mirror of
https://codeberg.org/redict/redict.git
synced 2025-01-22 16:18:28 -05:00
3193f086ca
Motivation: for applications that use RM ACL verification functions, they would
want to return errors back to the user, in ways that are consistent with Redis.
While investigating how we should return ACL errors to the user, we realized that
Redis isn't consistent, and currently returns ACL error strings in 3 primary ways.
[For the actual implications of this change, see the "Impact" section at the bottom]
1. how it returns an error when calling a command normally
ACL_DENIED_CMD -> "this user has no permissions to run the '%s' command"
ACL_DENIED_KEY -> "this user has no permissions to access one of the keys used as arguments"
ACL_DENIED_CHANNEL -> "this user has no permissions to access one of the channels used as arguments"
2. how it returns an error when calling via 'acl dryrun' command
ACL_DENIED_CMD -> "This user has no permissions to run the '%s' command"
ACL_DENIED_KEY -> "This user has no permissions to access the '%s' key"
ACL_DENIED_CHANNEL -> "This user has no permissions to access the '%s' channel"
3. how it returns an error via RM_Call (and scripting is similar).
ACL_DENIED_CMD -> "can't run this command or subcommand";
ACL_DENIED_KEY -> "can't access at least one of the keys mentioned in the command arguments";
ACL_DENIED_CHANNEL -> "can't publish to the channel mentioned in the command";
In addition, if one wants to use RM_Call's "dry run" capability instead of the RM ACL
functions directly, one also sees a different problem than it returns ACL errors with a -ERR,
not a -PERM, so it can't be returned directly to the caller.
This PR modifies the code to generate a base message in a common manner with the ability
to set verbose flag for acl dry run errors, and keep it unset for normal/rm_call/script cases
```c
sds getAclErrorMessage(int acl_res, user *user, struct redisCommand *cmd, sds errored_val, int verbose) {
switch (acl_res) {
case ACL_DENIED_CMD:
return sdscatfmt(sdsempty(), "User %S has no permissions to run "
"the '%S' command", user->name, cmd->fullname);
case ACL_DENIED_KEY:
if (verbose) {
return sdscatfmt(sdsempty(), "User %S has no permissions to access "
"the '%S' key", user->name, errored_val);
} else {
return sdsnew("No permissions to access a key");
}
case ACL_DENIED_CHANNEL:
if (verbose) {
return sdscatfmt(sdsempty(), "User %S has no permissions to access "
"the '%S' channel", user->name, errored_val);
} else {
return sdsnew("No permissions to access a channel");
}
}
```
The caller can append/prepend the message (adding NOPERM for normal/RM_Call or indicating it's within a script).
Impact:
- Plain commands, as well as scripts and RM_Call now include the user name.
- ACL DRYRUN remains the only one that's verbose (mentions the offending channel or key name)
- Changes RM_Call ACL errors from being a `-ERR` to being `-NOPERM` (besides for textual changes)
**This somewhat a breaking change, but it only affects the RM_Call with both `C` and `E`, or `D`**
- Changes ACL errors in scripts textually from being
`The user executing the script <old non unified text>`
to
`ACL failure in script: <new unified text>`
94 lines
3.8 KiB
Tcl
94 lines
3.8 KiB
Tcl
set testmodule [file normalize tests/modules/usercall.so]
|
|
|
|
set test_script_set "#!lua
|
|
redis.call('set','x',1)
|
|
return 1"
|
|
|
|
set test_script_get "#!lua
|
|
redis.call('get','x')
|
|
return 1"
|
|
|
|
start_server {tags {"modules usercall"}} {
|
|
r module load $testmodule
|
|
|
|
# baseline test that module isn't doing anything weird
|
|
test {test module check regular redis command without user/acl} {
|
|
assert_equal [r usercall.reset_user] OK
|
|
assert_equal [r usercall.add_to_acl "~* &* +@all -set"] OK
|
|
assert_equal [r usercall.call_without_user set x 5] OK
|
|
assert_equal [r usercall.reset_user] OK
|
|
}
|
|
|
|
# call with user with acl set on it, but without testing the acl
|
|
test {test module check regular redis command with user} {
|
|
assert_equal [r set x 5] OK
|
|
|
|
assert_equal [r usercall.reset_user] OK
|
|
assert_equal [r usercall.add_to_acl "~* &* +@all -set"] OK
|
|
# off and sanitize-payload because module user / default value
|
|
assert_equal [r usercall.get_acl] "off sanitize-payload ~* &* +@all -set"
|
|
|
|
# doesn't fail for regular commands as just testing acl here
|
|
assert_equal [r usercall.call_with_user_flag {} set x 10] OK
|
|
|
|
assert_equal [r get x] 10
|
|
assert_equal [r usercall.reset_user] OK
|
|
}
|
|
|
|
# call with user with acl set on it, but with testing the acl in rm_call (for cmd itself)
|
|
test {test module check regular redis command with user and acl} {
|
|
assert_equal [r set x 5] OK
|
|
|
|
assert_equal [r usercall.reset_user] OK
|
|
assert_equal [r usercall.add_to_acl "~* &* +@all -set"] OK
|
|
# off and sanitize-payload because module user / default value
|
|
assert_equal [r usercall.get_acl] "off sanitize-payload ~* &* +@all -set"
|
|
|
|
# fails here as testing acl in rm call
|
|
assert_error {*NOPERM User default has no permissions*} {r usercall.call_with_user_flag C set x 10}
|
|
|
|
assert_equal [r usercall.call_with_user_flag C get x] 5
|
|
|
|
assert_equal [r usercall.reset_user] OK
|
|
}
|
|
|
|
# baseline script test, call without user on script
|
|
test {test module check eval script without user} {
|
|
set sha_set [r script load $test_script_set]
|
|
set sha_get [r script load $test_script_get]
|
|
|
|
assert_equal [r usercall.call_without_user evalsha $sha_set 0] 1
|
|
assert_equal [r usercall.call_without_user evalsha $sha_get 0] 1
|
|
}
|
|
|
|
# baseline script test, call without user on script
|
|
test {test module check eval script with user being set, but not acl testing} {
|
|
set sha_set [r script load $test_script_set]
|
|
set sha_get [r script load $test_script_get]
|
|
|
|
assert_equal [r usercall.reset_user] OK
|
|
assert_equal [r usercall.add_to_acl "~* &* +@all -set"] OK
|
|
# off and sanitize-payload because module user / default value
|
|
assert_equal [r usercall.get_acl] "off sanitize-payload ~* &* +@all -set"
|
|
|
|
# passes as not checking ACL
|
|
assert_equal [r usercall.call_with_user_flag {} evalsha $sha_set 0] 1
|
|
assert_equal [r usercall.call_with_user_flag {} evalsha $sha_get 0] 1
|
|
}
|
|
|
|
# call with user on script (without rm_call acl check) to ensure user carries through to script execution
|
|
# we already tested the check in rm_call above, here we are checking the script itself will enforce ACL
|
|
test {test module check eval script with user and acl} {
|
|
set sha_set [r script load $test_script_set]
|
|
set sha_get [r script load $test_script_get]
|
|
|
|
assert_equal [r usercall.reset_user] OK
|
|
assert_equal [r usercall.add_to_acl "~* &* +@all -set"] OK
|
|
|
|
# fails here in script, as rm_call will permit the eval call
|
|
catch {r usercall.call_with_user_flag C evalsha $sha_set 0} e
|
|
assert_match {*ERR ACL failure in script*} $e
|
|
|
|
assert_equal [r usercall.call_with_user_flag C evalsha $sha_get 0] 1
|
|
}
|
|
} |