acl

package
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 10, 2020 License: GPL-3.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source
const (

	// DefaultAndFilter is a default AND mask of basic ACL value of container.
	DefaultAndFilter = 0xFFFFFFFF
)
View Source
const ErrNilBinaryExtendedACLStore = internal.Error("binary extended ACL store is nil")

ErrNilBinaryExtendedACLStore is returned by function that expect a non-nil BinaryExtendedACLStore, but received nil.

Variables

This section is empty.

Functions

func MatchFilters

func MatchFilters(src TypedHeaderSource, filters []acl.HeaderFilter) int

MatchFilters checks if passed source carry at least one header that satisfies passed filters.

Nil header does not satisfy any filter. Any header does not satisfy nil filter.

Returns mResMismatch if passed TypedHeaderSource is nil. Returns mResMatch if passed filters are empty.

If headers for some of the HeaderType could not be composed, mResUndefined returns.

Types

type BasicACLChecker

type BasicACLChecker struct{}

BasicACLChecker performs basic ACL check.

func (*BasicACLChecker) Action

func (c *BasicACLChecker) Action(rule uint32, req object.RequestType, t acl.Target) (bool, error)

Action returns true if request is allowed for target.

func (*BasicACLChecker) Bearer

func (c *BasicACLChecker) Bearer(rule uint32, req object.RequestType) (bool, error)

Bearer returns true if bearer token is allowed to use for this request as source of extended ACL.

func (*BasicACLChecker) Extended

func (c *BasicACLChecker) Extended(rule uint32) bool

Extended returns true if extended ACL stored in the container are allowed to use.

func (*BasicACLChecker) Sticky

func (c *BasicACLChecker) Sticky(rule uint32) bool

Sticky returns true if container is not allowed to store objects with owners different from request owner.

type BasicChecker

type BasicChecker interface {
	// Action returns true if request is allowed for this target.
	Action(uint32, object.RequestType, acl.Target) (bool, error)

	// Bearer returns true if bearer token is allowed for this request.
	Bearer(uint32, object.RequestType) (bool, error)

	// Extended returns true if extended ACL is allowed for this.
	Extended(uint32) bool

	// Sticky returns true if sticky bit is set.
	Sticky(uint32) bool
}

BasicChecker is an interface of the basic ACL control tool.

func NewMaskedBasicACLChecker

func NewMaskedBasicACLChecker(or, and uint32) BasicChecker

NewMaskedBasicACLChecker returns BasicChecker that applies predefined bit mask on basic ACL value.

type BinaryEACLKey

type BinaryEACLKey struct {
	// contains filtered or unexported fields
}

BinaryEACLKey is a binary EACL storage key.

func (BinaryEACLKey) CID

func (s BinaryEACLKey) CID() refs.CID

CID is a container ID getter.

func (*BinaryEACLKey) SetCID

func (s *BinaryEACLKey) SetCID(v refs.CID)

SetCID is a container ID setter.

type BinaryEACLValue

type BinaryEACLValue struct {
	// contains filtered or unexported fields
}

BinaryEACLValue is a binary EACL storage value.

func (BinaryEACLValue) EACL

func (s BinaryEACLValue) EACL() []byte

EACL is a binary extended ACL table getter.

func (BinaryEACLValue) MarshalBinary

func (s BinaryEACLValue) MarshalBinary() ([]byte, error)

MarshalBinary returns a binary representation of BinaryEACLValue.

func (*BinaryEACLValue) SetEACL

func (s *BinaryEACLValue) SetEACL(v []byte)

SetEACL is a binary extended ACL table setter.

func (*BinaryEACLValue) SetSignature

func (s *BinaryEACLValue) SetSignature(v []byte)

SetSignature is an EACL signature setter.

func (BinaryEACLValue) Signature

func (s BinaryEACLValue) Signature() []byte

Signature is an EACL signature getter.

func (*BinaryEACLValue) UnmarshalBinary

func (s *BinaryEACLValue) UnmarshalBinary(data []byte) (err error)

UnmarshalBinary unmarshals BinaryEACLValue from bytes.

type BinaryExtendedACLSource

type BinaryExtendedACLSource interface {
	// Must return binary extended ACL table by key.
	GetBinaryEACL(context.Context, BinaryEACLKey) (BinaryEACLValue, error)
}

BinaryExtendedACLSource is an interface of storage of binary extended ACL tables with read access.

type BinaryExtendedACLStore

type BinaryExtendedACLStore interface {
	BinaryExtendedACLSource

	// Must store binary extended ACL table for key.
	PutBinaryEACL(context.Context, BinaryEACLKey, BinaryEACLValue) error
}

BinaryExtendedACLStore is an interface of storage of binary extended ACL tables.

type ExtendedACLChecker

type ExtendedACLChecker interface {
	// Must return an action according to the results of applying the ACL table rules to request.
	//
	// Must return ActionUndefined if it is unable to explicitly calculate the action.
	Action(acl.ExtendedACLTable, RequestInfo) acl.ExtendedACLAction
}

ExtendedACLChecker is an interface of extended ACL checking tool.

func NewExtendedACLChecker

func NewExtendedACLChecker() ExtendedACLChecker

NewExtendedACLChecker creates a new extended ACL checking tool and returns ExtendedACLChecker interface.

type ExtendedACLSource

type ExtendedACLSource interface {
	// Must return extended ACL table by container ID key.
	GetExtendedACLTable(context.Context, refs.CID) (acl.ExtendedACLTable, error)
}

ExtendedACLSource is an interface of storage of extended ACL tables with read access.

type ExtendedACLStore

type ExtendedACLStore interface {
	ExtendedACLSource

	// Must store extended ACL table for container ID key.
	PutExtendedACLTable(context.Context, refs.CID, acl.ExtendedACLTable) error
}

ExtendedACLStore is an interface of storage of extended ACL tables.

type MaskedBasicACLChecker

type MaskedBasicACLChecker struct {
	BasicACLChecker
	// contains filtered or unexported fields
}

MaskedBasicACLChecker performs all basic ACL checks, but applying mask on ACL first. It is useful, when some bits must be always set or unset.

func (MaskedBasicACLChecker) Action

func (c MaskedBasicACLChecker) Action(rule uint32, req object.RequestType, t acl.Target) (bool, error)

Action returns true if request is allowed for target.

func (MaskedBasicACLChecker) Bearer

func (c MaskedBasicACLChecker) Bearer(rule uint32, req object.RequestType) (bool, error)

Bearer returns true if bearer token is allowed to use for this request as source of extended ACL.

func (MaskedBasicACLChecker) Extended

func (c MaskedBasicACLChecker) Extended(rule uint32) bool

Extended returns true if extended ACL stored in the container are allowed to use.

func (MaskedBasicACLChecker) Sticky

func (c MaskedBasicACLChecker) Sticky(rule uint32) bool

Sticky returns true if container is not allowed to store objects with owners different from request owner.

type RequestInfo

type RequestInfo interface {
	TypedHeaderSource

	// Must return the binary representation of request initiator's key.
	Key() []byte

	// Must return true if request corresponds to operation type.
	TypeOf(acl.OperationType) bool

	// Must return true if request has passed target.
	TargetOf(acl.Target) bool
}

RequestInfo is an interface of request information needed for extended ACL check.

type TypedHeaderSource

type TypedHeaderSource interface {
	// Must return list of Header of particular type.
	// Must return false if there is no ability to compose header list.
	HeadersOfType(acl.HeaderType) ([]acl.Header, bool)
}

TypedHeaderSource is a various types of header set interface.

func TypedHeaderSourceFromExtendedHeaders

func TypedHeaderSourceFromExtendedHeaders(hdrSrc service.ExtendedHeadersSource) TypedHeaderSource

TypedHeaderSourceFromExtendedHeaders wraps passed ExtendedHeadersSource and returns TypedHeaderSource interface.

func TypedHeaderSourceFromObject

func TypedHeaderSourceFromObject(obj *object.Object) TypedHeaderSource

TypedHeaderSourceFromObject wraps passed object and returns TypedHeaderSource interface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL