Repository navigation
Add support for network-names caveat. - #51
Conversation
The network-names caveat has a list of network names that are allowed. If the access request does not provide a name, it fails. If the access request provides a name that is not in the set of allowed names, it fails. It can be used with the if-present caveat to allow access when a network resource is not requested, or if it is requested, if the network name matches.
| if f.AppFeature != nil { | ||
| appResources = append(appResources, *f.AppFeature) | ||
| } | ||
| if f.NetworkName != nil { |
There was a problem hiding this comment.
This makes the network name app-owned, so a check that names a network also needs an AppID. wggwd's token check asks about the org and the wg feature, with no app: tokenauth.go#L152-L156
Validate() runs before the caveats (caveat_set.go#L58), so wggwd gets must specify app if app-owned resource is specified as soon as it sets NetworkName. Can we drop this, so the name can go with a feature or an app?
| if f.NetworkName != nil { |
There was a problem hiding this comment.
yah, we can drop the app requirement for this.
There was a problem hiding this comment.
I changed it to an org resource check instead of an app resource check, which I think is the appropriate thing here.
There was a problem hiding this comment.
One problem with making it an org resource: org resources are mutually exclusive (access.go#L67-L72), so wggwd can't ask about the wg feature and network name in one check. It gets resources are mutually exclusive: wg, network-name.
There was a problem hiding this comment.
And splitting the check into two checks wouldn't work for existing tokens. fly tokens create wireguard allows read only on anything that isn't an app or wg (create.go#L590-L600), so a write check on the network name is refused.
There was a problem hiding this comment.
Can the network name go with a feature or an app, and only require the org? OrgID is already required for every access
| } | ||
|
|
||
| type NetworkNames struct { | ||
| NetworkNames resset.ResourceSet[string, resset.Action] `json:"network_names"` |
There was a problem hiding this comment.
How should a token name the default network? Its name is empty (provision.go#L89-L93), and an empty key in a string ResourceSet matches every resource:
macaroon/resset/resource_set.go
Lines 81 to 85 in c71c45d
Would you agree to checking the default network as default in wggwd?
There was a problem hiding this comment.
This is a good question. We could assign a name for the default network and use that when doing access checks, but that leaves open the possibility of collision with some network that happens to use that name. Or we could change the resource set type from "string" to something like {bool,string} (or alternately, encode it into the string like "/networkname" vs ":default" or something ad hoc like that).
Do you have thoughts?
There was a problem hiding this comment.
You're right about possible collisions. We can take advantage of the name validation, which ensures that all names start with a letter (network.rb#L29-L37) to use a reserved name, like :default. It'd be good to define the constant in this library and reuse it everywhere.
The network-names caveat has a list of network names that are allowed. If the access request does not provide a name, it fails. If the access request provides a name that is not in the set of allowed names, it fails. It can be used with the if-present caveat to allow access when a network resource is not requested, or if it is requested, if the network name matches.