Previously, the decision logger interface did not allow plugin
implementations to return an error. In some cases, implementations may
prefer to make OPA fail-closed if the event cannot be emitted.
This is a backwards incompatible change to the custom decision logger
API that was added in v0.10.3 and it deprecates the old diagnostic
interface as well.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously the build version was recorded in the version package and
then different components would report it in an ad-hoc manner, e.g.,
the REPL has a module that generates a virtual doc with the version
info in it, the server was using templating to do the same, etc.
These changes remove the special code from the REPL and server
implementations to report the version. Instead the runtime writes the
version into /system/version at boot.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This change appends a newline to pretty printed API results to improve readability on the command line. Also, fix tests that were asserting on string equality instead of JSON value equality.
Signed-off-by: Josh Marshall <joshua.r.marshall.1991@gmail.com>
These changes update the server to check the bundle scope before
writing any policy and data. This way the caller won't accidentally
write policy and data into OPA only to have it overwritten the next
time a bundle is downloaded and activated.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously there were no checks in place to ensure that base and
virtual documents do not overlap. As a result, if users loaded raw
JSON and rules into OPA that overlapped, the evaluation results were
not well defined. With these changes, we can detect the overlap and
reject updates (to policies or data) that would cause inconsistent
results.
Fixes#1207
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
I wasn't paying enough attention to this detail in #1149. It's low-impact,
but let's avoid the trap anyways.
Also moves the client creating code into a helper method, with a comment
regarding http.Transport{}.
Signed-off-by: Stephan Renatus <srenatus@chef.io>
Previously paths and queries were modelled with the same
attribute. This was going to cause headaches down the road for
decision log consumers that need to be able to deal with both kinds of
policy invocations.
As part of these changes, the decision logging test in the server has
been refactored to make it a bit more maintainable.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, the server was not including a decision ID in log events
for errors. This commit changes that.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously the input attribute was no represented as *interface{}
which makes it impossible to differentiate between null and undefined
input. This commit changes that. Eventually we should just get rid of
server.Info in favour of the decision log event structure.
This change requires a release note.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The error field from the server event was not being copied into the
decision log event. Also, we didn't have test cases to verify that the
error was being set correctly in the first place.
In the future, we should remove the duplication of the server event
and the decision log event (preferring the latter).
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes add a new metric into the server that calculates the
time taken from when the handler is invoked to the point where the
decison log is emitted. Hopefully this will prevent us from missing
important periods in the request path.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Fixes#1081
curl -G -v "http://localhost:8181/v1/query" --data-urlencode "q=^ -i"
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8181 (#0)
> GET /v1/query?q=%5E%20-i HTTP/1.1
> Host: localhost:8181
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Content-Type: application/json
< Date: Sat, 15 Dec 2018 09:13:58 GMT
< Content-Length: 118
<
{
"code": "invalid_parameter",
"message": "1 error occurred: 1:1: rego_parse_error: no match found\n\t^ -i\n\t^"
* Connection #0 to host localhost left intact
}%
Signed-off-by: repenno <rapenno@gmail.com>
Query API should return HTTP 400 if query does not parse
Fixes#1081
curl -G -v "http://localhost:8181/v1/query" --data-urlencode "q=^ -i"
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8181 (#0)
> GET /v1/query?q=%5E%20-i HTTP/1.1
> Host: localhost:8181
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Content-Type: application/json
< Date: Sat, 15 Dec 2018 09:13:58 GMT
< Content-Length: 118
<
{
"code": "invalid_parameter",
"message": "1 error occurred: 1:1: rego_parse_error: no match found\n\t^ -i\n\t^"
* Connection #0 to host localhost left intact
}%
Signed-off-by: repenno <rapenno@gmail.com>
Query API should return HTTP 400 if query does not parse
Fixes#1081
Reworked fix based on comments and current code.
v1QueryGet/Post already call ast.parseBody through validateQuery,
therefore the solution:
- Avoids double parsing query
- Keeps original query string around so logs can work
- Performs http error checking at the server.go level
- Enhanced testing to make sure all messages are sane
Optionally error checking in server.go could be factored in a
unified function.
Signed-off-by: repenno <rapenno@gmail.com>
Query API should return HTTP 400 if query does not parse
Fixes#1081
Reworked fix based on comments and current code.
v1QueryGet/Post already call ast.parseBody through validateQuery,
therefore the solution:
- Avoids double parsing query
- Keeps original query string around so logs can work
- Performs http error checking at the server.go level
- Enhanced testing to make sure all messages are sane
Optionally error checking in server.go could be factored in a
unified function.
Signed-off-by: repenno <rapenno@gmail.com>
Query API should return HTTP 400 if query does not parse
Fixes#1081
Reworked fix based on comments and current code.
v1QueryGet/Post already call ast.parseBody through validateQuery,
therefore the solution:
- Avoids double parsing query
- Keeps original query string around so logs can work
- Performs http error checking at the server.go level
- Enhanced testing to make sure all messages are sane
- Fixed existing server_test.go tests affected by requested changes
Optionally error checking in server.go could be factored in a
unified function.
Signed-off-by: repenno <rapenno@gmail.com>
* identifier: add TLSBased
This is only the identifier, the server setup still has to be done.
Note that it diverges a little from what was proposed in the issue:
not every client cert needs to have a CN record -- so instead, we'll
use whatever is the cert's subject as client identity.
* Drive-by fix: identifier_test: don't use same package for TokenBased
tests.
* server: require and verify client cert for AuthenticationTLS
* server: allow setting CA pool via --tls-ca-cert-file
* server: expose new authentication via parameter
* [nit] server: simplify getListenerForHTTPServer
* server_test: use httptest for integration-y TLS tests
* book/security: mention TLS authn with example
Signed-off-by: Stephan Renatus <srenatus@chef.io>
These changes refactor the discovery implementation a bit to improve
test coverage and remove duplication of common logic shared with the
bundle plugin.
Specifically, the downloading logic has been moved into a separate
package that is shared by bundle and discovery. Second, test coverage in
the discovery implementation is increased from ~15% to ~85%.
These changes also include a few functional improvements:
- The default decision paths can be updated dynamically
- The decision logger can be enabled dynamically
- Discovery downloading errors are reported in status updates
- Discovery bundle is evaluated with all runtime params
- Custom plugins can be created dynamically
- Status updates include both discovery and bundle status
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously OPA configuration for bundle downloading, status reporting, etc. had to be supplied in a configuration file on startup. With these changes, OPA can be configured to download a bundle that generates the OPA configuration. This allows OPA to boot with minimal configuration and dynamically update that configuration on-the-fly making it much easier to manage large deployments of OPAs for different use cases within the same system.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This allows callers to embed the OPA HTTP server inside another HTTP
server (e.g., under a path prefix like /opa).
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, OPA would serve POST requests with an empty URL path by
querying data.system.main and returning the generated value. In some
cases, it's useful to be able to reconfigure OPA to use a different
document to serve these kinds of requests. The same goes for the OPA
authorization policy.
These changes make the default decision and default authorization
decision paths configurable.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes add support for accessing runtime information inside of
policies. In some cases, policies need to access environment variables
or configuration that OPA was booted with. These changes add a built-in
function that allows policies to gain access to this information. The
built-in function itself is relatively trivial. Most of the required
changes were plumbing the runtime information from the entrypoint down
into the evaluation engine. The alternative would have been to introduce
a global variable containing this information however that would be have
been harder to reason about in library integrations.
Fixes#420
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously the query/input/error forms were being returned to the client
unescaped. This would allow for XSS attacks against admins with access
to the OPA debug page. While this scenario is quite uncommon (e.g., OPA
should be configured to listen on localhost/unix domain, authenticate
and authorize requests, etc.) it's still a possibility.
These changes escape the query/input/error forms returned to the browser
to prevent XSS attacks.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
With these changes, the identity will be undefined if a token is not
specified. This is less surprising than the empty string that would be
set prior to these changes.
Fixes#901
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, partial eval would always generate a support rule when it
evaluated a rule with a default value. These changes tweak this
behaviour so that support rules are only generated if the default value
is required in the partial eval output. It's better to avoid generating
support rules as it simplifies the assumptions that the consumer of
partial eval can make.
Fixes#820
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
I don't know why I ended up looking into this, but I've run
golangci-lint run --disable-all -E deadcode
on the code base and removed everything that came up :)
Signed-off-by: Stephan Renatus <srenatus@chef.io>
Partial allows callers to partially evaluate a query and obtain the
resulting partially evaluated queries and support modules from the
evaluation engine.
This is a lower level interface compared to the other API (PartialEval)
that returns a result which can be evaluated normally (which takes
advantage of partial evaluation for optimization purposes.) This new
interface is targetted at use cases where callers are not interested in
a binary policy decision but instead need the conditions that should be
evaluated at a later time.
Deprecate the old PartialEval function and rename it to PartialResult to
avoid some (but certainly not all) confusion.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This actually revealed a missing error check. Since we've started a
transaction at this point, I guessed that `s.abortAuto` is what we want
there.
Signed-off-by: Stephan Renatus <srenatus@chef.io>
The partial cache was not be invalidated when data changed. As a result,
callers would receive stale results when data updated.
Fixes#589
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
With the #762 and #764 there is no need to keep the logic for creating
the HTTP and HTTPS listeners inside the function. These changes just
split listener creation into separate functions for clarity.
Also, update runtime to use logrus for reporting initialization errors
instead of println for consistency.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This makes the --addr CLI parameter to be a slice and refactors the code
to allow several addresses to be passed. Hence we can listen on as many
HTTP and UNIX sockets as we want.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
This refactor consists of two things:
* Accept 'http(s)' as a scheme
* Move the code so it's easier to add new protocols to --addr
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
The socket removal was using the URIs path, which is fine for absolute
paths, but doesn't work properly with relative ones.
The socket itself is listening on the Host + Path, which works for
relative paths, so we use that same path for the removal.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Previously, the server loop functions were returned explicitly as
outputs (having three outputs for the loop functions and one for the
error). If we want to add more this approach doesn't work very well. So
this introduced a slice as the output of the Listen function for the
Server struct, which allows us to loop over it and iterate over however
many loop functions we need.
This keeps the same logic as before, and is merely a first step in
refactoring this logic.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
These changes tweak the UNIX domain socket to (1) return an error
instead of panicing (because the server may be embedded as a library)
and (2) to unlink the domain socket file before binding. The latter is
required so that OPA can be stopped and started without manually
removing the socket file.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This enabled the OPA server to listen on a UNIX domain socket through
the already existing --addr option. This option now parses the passed
argument as a URL and based on the scheme (which for this case has to be
"unix://"), it listens on the path for the socket.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
These changes extend #702 to include writes. If the path segments are
escaped, the should be unescaped during parsing. This allows callers to
write keys like "foo/bar" into storage.
Fixes#695
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Stefan Bueringer