xds: RBAC `Authenticated` principal without `principal_name` is rejected ("Unknown StringMatcher match pattern: MATCHPATTERN_NOT_SET")

Abierto Apto para principiantes
  • ¿Algo no está bien?
#13,150 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
78/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java
Área
authorization, security

Línea de trabajo

Empieza en parseAuthenticatedMatcher en xds/src/main/java/io/grpc/xds/RbacFilter.java, que siempre pasa proto.getPrincipalName() a MatcherParser.parseStringMatcher. Revisa cómo se gestiona AuthenticatedMatcher.create(null) en GrpcAuthorizationEngine.java. Está terminado cuando las dos pruebas de RbacFilterAuthenticatedMatcherTest del issue se parsean y hacen match, y las pruebas RBAC existentes siguen pasando.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
What version of gRPC-Java are you using?

master at 15d64a4 (1.86.0-SNAPSHOT). The code involved is unchanged on the current master.

What is your environment?

Linux 5.15, OpenJDK 21.0.2, Gradle 8.14.5 (wrapper).

What did you expect to see?

An RBAC policy whose principal is authenticated: {} (no principal_name) should be accepted and should match any TLS connection. The Envoy Principal.Authenticated docs say "If unset, it applies to any user that is authenticated", and gRFC A41 says:

If principal_name is unset, then Authenticated is said to match if the connection uses TLS; a client certificate is not necessary.

What did you see instead?

The RBAC filter config fails to parse with Encountered error parsing policy: java.lang.IllegalArgumentException: Unknown StringMatcher match pattern: MATCHPATTERN_NOT_SET.

Location (grpc/grpc-java @ 15d64a4):

  private static AuthenticatedMatcher parseAuthenticatedMatcher(
          Principal.Authenticated proto) {
    Matchers.StringMatcher matcher = MatcherParser.parseStringMatcher(proto.getPrincipalName());
    return AuthenticatedMatcher.create(matcher);
  }

Problem

When principal_name is unset, proto.getPrincipalName() returns the default StringMatcher instance, whose match pattern is MATCHPATTERN_NOT_SET. MatcherParser.parseStringMatcher throws for that case, so the whole RBAC config (RbacFilter.Provider.parseRbacConfig) is rejected, even though the engine already supports a null delegate that means "any authenticated connection". Only Authenticated principals without principal_name are affected. Matching with a principal_name set does not change.

Reproduction

RbacFilterAuthenticatedMatcherTest.java (xds/src/test/java/io/grpc/xds) 
/*
 * Copyright 2021 The gRPC Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package io.grpc.xds;

import static com.google.common.truth.Truth.assertThat;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import io.envoyproxy.envoy.config.rbac.v3.Permission;
import io.envoyproxy.envoy.config.rbac.v3.Policy;
import io.envoyproxy.envoy.config.rbac.v3.Principal;
import io.envoyproxy.envoy.config.rbac.v3.Principal.Authenticated;
import io.envoyproxy.envoy.config.rbac.v3.RBAC;
import io.envoyproxy.envoy.config.rbac.v3.RBAC.Action;
import io.grpc.Attributes;
import io.grpc.Grpc;
import io.grpc.Metadata;
import io.grpc.MethodDescriptor;
import io.grpc.MethodDescriptor.MethodType;
import io.grpc.ServerCall;
import io.grpc.testing.TestMethodDescriptors;
import io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine;
import io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import javax.net.ssl.SSLSession;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;

/**
 * Tests for {@link RbacFilter} authenticated matcher with unset PrincipalName.
 */
@RunWith(JUnit4.class)
public class RbacFilterAuthenticatedMatcherTest {

  private static final RbacFilter.Provider FILTER_PROVIDER = new RbacFilter.Provider();

  /**
   * Per the RBAC spec, an Authenticated principal with no PrincipalName set should match
   * any authenticated user (i.e. any connection with a valid TLS certificate).
   * This test verifies that parsing such a configuration succeeds.
   */
  @Test
  public void authenticatedMatcherWithoutPrincipalName_shouldParseSuccessfully() {
    // Create an Authenticated principal without setting PrincipalName.
    // Per the RBAC spec: "If unset, it applies to any user that is authenticated."
    List<Permission> permissionList = Arrays.asList(
        Permission.newBuilder().setAny(true).build());
    List<Principal> principalList = Arrays.asList(
        Principal.newBuilder().setAuthenticated(
            Authenticated.newBuilder().build()).build());

    io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC rbac =
        io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC.newBuilder()
            .setRules(RBAC.newBuilder().setAction(Action.ALLOW)
                .putPolicies("any-authenticated-user",
                    Policy.newBuilder()
                        .addAllPermissions(permissionList)
                        .addAllPrincipals(principalList).build())
                .build())
            .build();

    ConfigOrError<RbacConfig> result = RbacFilter.Provider.parseRbacConfig(rbac);
    // The config should parse successfully without error.
    assertThat(result.errorDetail).isNull();
    assertThat(result.config).isNotNull();
    assertThat(result.config.authConfig()).isNotNull();
  }

  /**
   * An Authenticated principal with no PrincipalName should match any authenticated
   * connection (one with an SSL session and peer certificates).
   */
  @Test
  @SuppressWarnings("unchecked")
  public void authenticatedMatcherWithoutPrincipalName_shouldMatchAuthenticatedConnection()
      throws Exception {
    List<Permission> permissionList = Arrays.asList(
        Permission.newBuilder().setAny(true).build());
    List<Principal> principalList = Arrays.asList(
        Principal.newBuilder().setAuthenticated(
            Authenticated.newBuilder().build()).build());

    io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC rbac =
        io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC.newBuilder()
            .setRules(RBAC.newBuilder().setAction(Action.ALLOW)
                .putPolicies("any-authenticated-user",
                    Policy.newBuilder()
                        .addAllPermissions(permissionList)
                        .addAllPrincipals(principalList).build())
                .build())
            .build();

    ConfigOrError<RbacConfig> result = RbacFilter.Provider.parseRbacConfig(rbac);
    // Parsing must succeed first.
    assertThat(result.errorDetail).isNull();

    // Set up an authenticated connection with a mock SSL session and certificate.
    SSLSession sslSession = mock(SSLSession.class);
    X509Certificate mockCert = mock(X509Certificate.class);
    when(sslSession.getPeerCertificates()).thenReturn(new X509Certificate[]{mockCert});
    when(mockCert.getSubjectAlternativeNames()).thenReturn(
        Collections.<List<?>>singletonList(Arrays.asList(6, "spiffe://example.com/service")));

    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    Attributes attributes = Attributes.newBuilder()
        .set(Grpc.TRANSPORT_ATTR_SSL_SESSION, sslSession)
        .build();
    when(serverCall.getAttributes()).thenReturn(attributes);
    when(serverCall.getMethodDescriptor()).thenReturn(
        MethodDescriptor.<Void, Void>newBuilder()
            .setType(MethodType.BIDI_STREAMING)
            .setFullMethodName("test/method")
            .setRequestMarshaller(TestMethodDescriptors.voidMarshaller())
            .setResponseMarshaller(TestMethodDescriptors.voidMarshaller())
            .build());

    GrpcAuthorizationEngine engine =
        new GrpcAuthorizationEngine(result.config.authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    // An authenticated connection should be allowed by this policy.
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.ALLOW);
  }
}

Run: ./gradlew :grpc-xds:test --tests io.grpc.xds.RbacFilterAuthenticatedMatcherTest -PskipCodegen=true -PskipAndroid=true

RbacFilterAuthenticatedMatcherTest > authenticatedMatcherWithoutPrincipalName_shouldMatchAuthenticatedConnection FAILED
    expected: null
    but was : Encountered error parsing policy: java.lang.IllegalArgumentException: Unknown StringMatcher match pattern: MATCHPATTERN_NOT_SET
        at app//io.grpc.xds.RbacFilterAuthenticatedMatcherTest.authenticatedMatcherWithoutPrincipalName_shouldMatchAuthenticatedConnection(RbacFilterAuthenticatedMatcherTest.java:113)

RbacFilterAuthenticatedMatcherTest > authenticatedMatcherWithoutPrincipalName_shouldParseSuccessfully FAILED
    expected: null
    but was : Encountered error parsing policy: java.lang.IllegalArgumentException: Unknown StringMatcher match pattern: MATCHPATTERN_NOT_SET
        at app//io.grpc.xds.RbacFilterAuthenticatedMatcherTest.authenticatedMatcherWithoutPrincipalName_shouldParseSuccessfully(RbacFilterAuthenticatedMatcherTest.java:82)

Environment: commit 15d64a4, OpenJDK 21.0.2, Gradle 8.14.5.

Already fixed in grpc/grpc-go

PR: https://github.com/grpc/grpc-go/pull/4576, "Add extra layer on top of RBAC Engine" (merged 2021-07-22T02:42:38Z, merge commit c513103bee3). grpc-go is another implementation of the same xDS RBAC spec. As part of that PR, newAuthenticatedMatcher treats a nil PrincipalName as "any authenticated user" instead of passing it to the string matcher parser.

How grpc-go fixed it (relevant hunks, verbatim):

--- a/internal/xds/rbac/matchers.go
+++ b/internal/xds/rbac/matchers.go
@@ -361,26 +361,56 @@ func newPortMatcher(destinationPort uint32) *portMatcher {
...
 type authenticatedMatcher struct {
-	stringMatcher internalmatcher.StringMatcher
+	stringMatcher *internalmatcher.StringMatcher
 }
 
 func newAuthenticatedMatcher(authenticatedMatcherConfig *v3rbacpb.Principal_Authenticated) (*authenticatedMatcher, error) {
+	// Represents this line in the RBAC documentation = "If unset, it applies to
+	// any user that is authenticated" (see package-level comments).
+	if authenticatedMatcherConfig.PrincipalName == nil {
+		return &authenticatedMatcher{}, nil
+	}
 	stringMatcher, err := internalmatcher.StringMatcherFromProto(authenticatedMatcherConfig.PrincipalName)
 	if err != nil {
 		return nil, err
 	}
-	return &authenticatedMatcher{stringMatcher: stringMatcher}, nil
+	return &authenticatedMatcher{stringMatcher: &stringMatcher}, nil
 }
 
...
+	if am.stringMatcher == nil {
+		return len(data.certs) != 0
+	}
...
Suggested fix

When principal_name is unset, create the AuthenticatedMatcher with a null delegate, which the engine already treats as "any authenticated connection":

diff --git a/xds/src/main/java/io/grpc/xds/RbacFilter.java b/xds/src/main/java/io/grpc/xds/RbacFilter.java
--- a/xds/src/main/java/io/grpc/xds/RbacFilter.java
+++ b/xds/src/main/java/io/grpc/xds/RbacFilter.java
@@ -334,6 +334,10 @@ final class RbacFilter implements Filter {
 
   private static AuthenticatedMatcher parseAuthenticatedMatcher(
           Principal.Authenticated proto) {
+    // An unset principal_name matches any authenticated (TLS) connection.
+    if (!proto.hasPrincipalName()) {
+      return AuthenticatedMatcher.create(null);
+    }
     Matchers.StringMatcher matcher = MatcherParser.parseStringMatcher(proto.getPrincipalName());
     return AuthenticatedMatcher.create(matcher);
   }

Verified on 15d64a4 (OpenJDK 21.0.2, Gradle 8.14.5): the test above fails without this patch and passes with it; no other test results change (:grpc-xds:test: 4473 tests; FakeControlPlaneXdsIntegrationTest.changeClusterForRoute[enableRfc3986UrisParam=true] fails with and without the patch).

I can submit a PR for this.

I searched issues and PRs for RBAC Authenticated/principal_name handling and for the MATCHPATTERN_NOT_SET error, and found no existing report.

Lenguaje dominante
Java
Estrellas
12.1k
Forks
4k
Merge medio
1 d 13 h
PR fusionados (30 d)
42

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de grpc/grpc-java

Todos los issues de grpc/grpc-java

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.