Add check_topic_access/4 to rabbit_authz_backend

References rabbitmq/rabbitmq-server#505
rabbitmq · Dec 29, 2016 · 241c42b · 241c42b
1 parent 26f1d5c
commit 241c42b
Show file tree

Hide file tree

Showing 6 changed files with 51 additions and 34 deletions.
diff --git a/include/rabbit.hrl b/include/rabbit.hrl
@@ -116,9 +116,7 @@
     %% exchange, queue, ...
     kind,
     %% name as a binary
-    name,
-    %% options (e.g. routing key) as a map
-    options
+    name
 }).
 
 %% fields described as 'transient' here are cleared when writing to

diff --git a/src/rabbit_auth_backend_dummy.erl b/src/rabbit_auth_backend_dummy.erl
@@ -22,7 +22,7 @@
 
 -export([user/0]).
 -export([user_login_authentication/2, user_login_authorization/1,
-         check_vhost_access/3, check_resource_access/3]).
+         check_vhost_access/3, check_resource_access/3, check_topic_access/4]).
 
 -spec user() -> rabbit_types:user().
 
@@ -42,3 +42,4 @@ user_login_authorization(_) ->
 
 check_vhost_access(#auth_user{}, _VHostPath, _Sock) -> true.
 check_resource_access(#auth_user{}, #resource{}, _Permission) -> true.
+check_topic_access(#auth_user{}, #resource{}, _Permission, _Context) -> true.
diff --git a/src/rabbit_auth_backend_internal.erl b/src/rabbit_auth_backend_internal.erl
@@ -21,7 +21,7 @@
 -behaviour(rabbit_authz_backend).
 
 -export([user_login_authentication/2, user_login_authorization/1,
-         check_vhost_access/3, check_resource_access/3]).
+         check_vhost_access/3, check_resource_access/3, check_topic_access/4]).
 
 -export([add_user/2, delete_user/1, lookup_user/1,
          change_password/2, clear_password/1,
@@ -141,29 +141,6 @@ check_vhost_access(#auth_user{username = Username}, VHostPath, _Sock) ->
         [_R] -> true
     end.
 
-check_resource_access(#auth_user{username = Username},
-                      #resource{virtual_host = VHostPath, name = Name,
-                                options = Options,
-                                kind = topic},
-                      _Permission) ->
-    case mnesia:dirty_read({rabbit_topic_permission,
-        #topic_permission_key{user_vhost = #user_vhost{username     = Username,
-                                            virtual_host = VHostPath},
-                   name = Name
-            }}) of
-        [] ->
-            true;
-        [#topic_permission{pattern = Pattern}] ->
-            PermRegexp = case Pattern of
-                             %% <<"^$">> breaks Emacs' erlang mode
-                             <<"">> -> <<$^, $$>>;
-                             RE     -> RE
-                         end,
-            case re:run(maps:get(routing_key, Options), PermRegexp, [{capture, none}]) of
-                match    -> true;
-                nomatch  -> false
-            end
-    end;
 check_resource_access(#auth_user{username = Username},
                       #resource{virtual_host = VHostPath, name = Name},
                       Permission) ->
@@ -184,6 +161,30 @@ check_resource_access(#auth_user{username = Username},
             end
     end.
 
+check_topic_access(#auth_user{username = Username},
+                   #resource{virtual_host = VHostPath, name = Name, kind = topic},
+                   _Permission,
+                   Context) ->
+    case mnesia:dirty_read({rabbit_topic_permission,
+        #topic_permission_key{user_vhost = #user_vhost{username     = Username,
+                                                       virtual_host = VHostPath},
+                                                       name         = Name
+                             }}) of
+        [] ->
+            true;
+        [#topic_permission{pattern = Pattern}] ->
+            PermRegexp = case Pattern of
+                             %% <<"^$">> breaks Emacs' erlang mode
+                             <<"">> -> <<$^, $$>>;
+                             RE     -> RE
+                         end,
+            case re:run(maps:get(routing_key, Context), PermRegexp, [{capture, none}]) of
+                match    -> true;
+                nomatch  -> false
+            end
+    end.
+
+
 permission_index(configure) -> #permission.configure;
 permission_index(write)     -> #permission.write;
 permission_index(read)      -> #permission.read.

diff --git a/src/rabbit_authz_backend.erl b/src/rabbit_authz_backend.erl
@@ -60,3 +60,17 @@
                                 rabbit_types:r(atom()),
                                 rabbit_access_control:permission_atom()) ->
     boolean() | {'error', any()}.
+
+%% Given #auth_user, topic as resource, permission, and context, can a user access the topic?
+%%
+%% Possible responses:
+%% true
+%% false
+%% {error, Error}
+%%     Something went wrong. Log and die.
+-callback check_topic_access(rabbit_types:auth_user(),
+    rabbit_types:r(atom()),
+    rabbit_access_control:permission_atom(),
+    rabbit_types:context()) ->
+    boolean() | {'error', any()}.
+
diff --git a/src/rabbit_channel.erl b/src/rabbit_channel.erl
@@ -782,17 +782,18 @@ check_internal_exchange(_) ->
     ok.
 
 check_topic_authorisation(#exchange{name = Name, type = topic}, #ch{user = User}, RoutingKey) ->
-    Resource = Name#resource{kind = topic, options = #{routing_key => RoutingKey}},
+    Resource = Name#resource{kind = topic},
+    Context = #{routing_key => RoutingKey},
     Cache = case get(topic_permission_cache) of
                 undefined -> [];
                 Other     -> Other
             end,
-    case lists:member(Resource, Cache) of
+    case lists:member({Resource, Context}, Cache) of
         true  -> ok;
-        false -> ok = rabbit_access_control:check_resource_access(
-            User, Resource, write),
+        false -> ok = rabbit_access_control:check_topic_access(
+            User, Resource, write, Context),
             CacheTail = lists:sublist(Cache, ?MAX_PERMISSION_CACHE_SIZE-1),
-            put(topic_permission_cache, [Resource | CacheTail])
+            put(topic_permission_cache, [{Resource, Context} | CacheTail])
     end;
 check_topic_authorisation(_, _, _) ->
     ok.

diff --git a/src/rabbit_types.erl b/src/rabbit_types.erl
@@ -30,7 +30,7 @@
               ok/1, error/1, ok_or_error/1, ok_or_error2/2, ok_pid_or_error/0,
               channel_exit/0, connection_exit/0, mfargs/0, proc_name/0,
               proc_type_and_name/0, timestamp/0,
-              tracked_connection/0, node_type/0]).
+              tracked_connection/0, node_type/0, context/0]).
 
 -type(maybe(T) :: T | 'none').
 -type(timestamp() :: {non_neg_integer(), non_neg_integer(), non_neg_integer()}).
@@ -185,3 +185,5 @@
 
 -type(proc_name() :: term()).
 -type(proc_type_and_name() :: {atom(), proc_name()}).
+
+-type(context() :: map()).