PrincsFilter to ClientFilter reimplementation

cli/src/skell.rs

@@ -123,16 +123,23 @@ fn get_filter() -> String {
 # Subscription filter (optional)
 #
 # Filters enables you to choose which clients can read the subscription
-# There are two operations available :
-# - "Only": only the listed principals will be able to read the subscription
-# - "Except": everyone but the listed principals will be able to read the subscription
+# There are two operations available:
+# - "Only": only the listed clients will be able to read the subscription
+# - "Except": everyone but the listed clients will be able to read the subscription
+#
+# Types: KerberosPrinc, TLSCertSubject, MachineID
+#
+# Flags: GlobPattern, CaseSensitive
+# Filters are case-insensitive by default.
 #
 # By default, everyone can read the subscription.
 #
-# Example to only authorize "courgette@REALM" and "radis@REALM" to read the subscription.
+# Example to only authorize computers marching the "courgette@REALM" and "radis*@REALM" patterns to read the subscription.
 # [filter]
 # operation = "Only"
-# princs = ["courgette@REALM", "radis@REALM"]
+# type = "MachineID"
+# flags = "GlobPattern | CaseSensitive"
+# targets = ["courgette@REALM", "radis*@REALM"]
 
 "#
     .to_string()

cli/src/subscriptions.rs

@@ -3,7 +3,7 @@ use common::{
     encoding::decode_utf16le,
     settings::Settings,
     subscription::{
-        ContentFormat, FilesConfiguration, KafkaConfiguration, PrincsFilterOperation,
+        ContentFormat, FilesConfiguration, KafkaConfiguration, ClientFilter, ClientFilterOperation,
         RedisConfiguration, SubscriptionData, SubscriptionMachineState, SubscriptionOutput,
         SubscriptionOutputDriver, SubscriptionOutputFormat, TcpConfiguration,
         UnixDatagramConfiguration,
@@ -20,7 +20,7 @@ use std::{
 };
 use uuid::Uuid;
 
-use anyhow::{anyhow, bail, ensure, Context, Result};
+use anyhow::{anyhow, bail, ensure, Context, Ok, Result};
 use clap::ArgMatches;
 use log::{debug, info, warn};
 use std::io::Write;
@@ -595,39 +595,50 @@ async fn delete(db: &Db, matches: &ArgMatches) -> Result<()> {
 }
 
 async fn edit_filter(subscription: &mut SubscriptionData, matches: &ArgMatches) -> Result<()> {
-    let mut filter = subscription.princs_filter().clone();
-    match matches.subcommand() {
-        Some(("set", matches)) => {
-            let op_str = matches
-                .get_one::<String>("operation")
-                .ok_or_else(|| anyhow!("Missing operation argument"))?;
+    if let Some(("set", matches)) = matches.subcommand() {
+        let op_str = matches
+            .get_one::<String>("operation")
+            .ok_or_else(|| anyhow!("Missing operation argument"))?;
 
-            let op_opt = PrincsFilterOperation::opt_from_str(op_str)?;
-            filter.set_operation(op_opt.clone());
+        if op_str.eq_ignore_ascii_case("none") {
+            subscription.set_client_filter(None);
+            return Ok(());
+        }
 
-            if let Some(op) = op_opt {
-                let mut princs = HashSet::new();
-                if let Some(identifiers) = matches.get_many::<String>("principals") {
-                    for identifier in identifiers {
-                        princs.insert(identifier.clone());
-                    }
-                }
-                if op == PrincsFilterOperation::Only && princs.is_empty() {
-                    warn!("'{}' filter has been set without principals making this subscription apply to nothing.", op)
-                }
-                filter.set_princs(princs)?;
+        let op = op_str.parse()?;
+
+        let mut princs = HashSet::new();
+        if let Some(identifiers) = matches.get_many::<String>("principals") {
+            for identifier in identifiers {
+                princs.insert(identifier.clone());
             }
         }
-        Some(("princs", matches)) => match matches.subcommand() {
+        if op == ClientFilterOperation::Only && princs.is_empty() {
+            warn!("'{}' filter has been set without principals making this subscription apply to nothing.", op)
+        }
+
+        subscription.set_client_filter(Some(ClientFilter::new_legacy(op, princs)));
+        return Ok(());
+    }
+
+    if let Some(("princs", matches)) = matches.subcommand() {
+        let filter = subscription.client_filter().cloned();
+        let Some(mut filter) = filter else {
+            bail!("No filter is set");
+        };
+
+        match matches.subcommand() {
             Some(("add", matches)) => {
-                filter.add_princ(
+                #[allow(deprecated)]
+                filter.add_target(
                     matches
                         .get_one::<String>("principal")
                         .ok_or_else(|| anyhow!("Missing principal"))?,
                 )?;
             }
             Some(("delete", matches)) => {
-                filter.delete_princ(
+                #[allow(deprecated)]
+                filter.delete_target(
                     matches
                         .get_one::<String>("principal")
                         .ok_or_else(|| anyhow!("Missing principal"))?,
@@ -639,7 +650,8 @@ async fn edit_filter(subscription: &mut SubscriptionData, matches: &ArgMatches)
                     for identifier in identifiers {
                         princs.insert(identifier.clone());
                     }
-                    filter.set_princs(princs)?;
+                    #[allow(deprecated)]
+                    filter.set_targets(princs)?;
                 }
                 None => {
                     bail!("No principals to set")
@@ -648,14 +660,13 @@ async fn edit_filter(subscription: &mut SubscriptionData, matches: &ArgMatches)
             _ => {
                 bail!("Nothing to do");
             }
-        },
-        _ => {
-            bail!("Nothing to do");
         }
+
+        subscription.set_client_filter(Some(filter));
+        return Ok(())
     }
-    subscription.set_princs_filter(filter);
 
-    Ok(())
+    bail!("Nothing to do");
 }
 async fn outputs(subscription: &mut SubscriptionData, matches: &ArgMatches) -> Result<()> {
     info!(
@@ -1101,4 +1112,4 @@ fn check_subscriptions_ro(settings: &Settings) -> Result<()> {
 
 fn deprecated_cli_warn() {
     warn!("Using commands to manage subscriptions and there outputs is deprecated and will be removed in future releases. Use subscription configuration files instead.")
-}
+}

common/Cargo.toml

@@ -26,6 +26,8 @@ deadpool-sqlite = "0.5.0"
 openssl = "0.10.66"
 postgres-openssl = "0.5.0"
 strum = { version = "0.26.1", features = ["derive"] }
+bitflags = { version = "2.6.0", features = ["serde"] }
+glob = "0.3.1"
 
 [dev-dependencies]
 tempfile = "3.14.0"
@@ -68,4 +70,4 @@ assets = [
     { source = "../openwec.conf.sample.toml", dest = "/usr/share/doc/openwec/", mode = "0644", doc = true },
     { source = "../README.md", dest = "/usr/share/doc/openwec/", mode = "0644", doc = true },
     { source = "../doc/*", dest = "/usr/share/doc/openwec/doc/", mode = "0644", doc = true },
-]
+]

common/src/database/mod.rs

@@ -124,14 +124,14 @@ pub mod tests {
     use crate::{
         heartbeat::{HeartbeatKey, HeartbeatValue},
         subscription::{
-            ContentFormat, FilesConfiguration, PrincsFilter, PrincsFilterOperation,
+            ContentFormat, FilesConfiguration, ClientFilter, ClientFilterOperation,
             SubscriptionOutput, SubscriptionOutputDriver, SubscriptionOutputFormat,
             DEFAULT_CONTENT_FORMAT, DEFAULT_IGNORE_CHANNEL_ERROR, DEFAULT_READ_EXISTING_EVENTS,
         },
     };
 
     use super::{schema::Migrator, *};
-    use std::{collections::HashSet, thread::sleep, time::Duration, time::SystemTime};
+    use std::{collections::HashSet, thread::sleep, time::{Duration, SystemTime}};
 
     async fn setup_db(db: Arc<dyn Database>) -> Result<()> {
         db.setup_schema().await?;
@@ -168,9 +168,9 @@ pub mod tests {
         assert_eq!(toto.read_existing_events(), DEFAULT_READ_EXISTING_EVENTS);
         assert_eq!(toto.content_format(), &DEFAULT_CONTENT_FORMAT);
         assert_eq!(toto.ignore_channel_error(), DEFAULT_IGNORE_CHANNEL_ERROR);
-        assert_eq!(toto.princs_filter().operation(), None);
+        assert_eq!(toto.client_filter(), None);
         assert_eq!(toto.is_active(), false);
-        assert_eq!(toto.is_active_for("couscous"), false);
+        assert_eq!(toto.is_active_for("couscous", None), false);
         assert_eq!(toto.revision(), None);
         assert_eq!(toto.data_locale(), None);
         assert_eq!(toto.locale(), None);
@@ -194,10 +194,12 @@ pub mod tests {
             .set_read_existing_events(true)
             .set_content_format(ContentFormat::RenderedText)
             .set_ignore_channel_error(false)
-            .set_princs_filter(PrincsFilter::from(
-                Some("Only".to_string()),
+            .set_client_filter(Some(ClientFilter::from(
+                "Only".to_string(),
+                "KerberosPrinc".to_string(),
+                None,
                 Some("couscous,boulette".to_string()),
-            )?)
+            )?))
             .set_outputs(vec![
                 SubscriptionOutput::new(
                     SubscriptionOutputFormat::Json,
@@ -227,12 +229,12 @@ pub mod tests {
         assert_eq!(tata.content_format(), &ContentFormat::RenderedText);
         assert_eq!(tata.ignore_channel_error(), false);
         assert_eq!(
-            *tata.princs_filter().operation().unwrap(),
-            PrincsFilterOperation::Only
+            *tata.client_filter().unwrap().operation(),
+            ClientFilterOperation::Only
         );
         assert_eq!(
-            tata.princs_filter().princs(),
-            &HashSet::from(["couscous".to_string(), "boulette".to_string()])
+            tata.client_filter().unwrap().targets(),
+            HashSet::from(["couscous", "boulette"])
         );
 
         assert_eq!(
@@ -251,10 +253,10 @@ pub mod tests {
             ],
         );
         assert_eq!(tata.is_active(), true);
-        assert_eq!(tata.is_active_for("couscous"), true);
-        // Filter is case-sensitive
-        assert_eq!(tata.is_active_for("Couscous"), false);
-        assert_eq!(tata.is_active_for("semoule"), false);
+        assert_eq!(tata.is_active_for("couscous", None), true);
+        // Filter is case-insensitive
+        assert_eq!(tata.is_active_for("Couscous", None), true);
+        assert_eq!(tata.is_active_for("semoule", None), false);
         assert_eq!(tata.revision(), Some("1472".to_string()).as_ref());
         assert_eq!(tata.locale(), Some("fr-FR".to_string()).as_ref());
         assert_eq!(tata.data_locale(), Some("en-US".to_string()).as_ref());
@@ -272,9 +274,19 @@ pub mod tests {
             .set_ignore_channel_error(true)
             .set_revision(Some("1890".to_string()))
             .set_data_locale(Some("fr-FR".to_string()));
-        let mut new_princs_filter = tata.princs_filter().clone();
-        new_princs_filter.add_princ("semoule")?;
-        tata.set_princs_filter(new_princs_filter);
+
+
+        let orig_filter = &tata.client_filter().unwrap();
+        let mut new_targets: HashSet<String> = orig_filter.targets().iter().map(|&f| f.to_owned()).collect();
+        new_targets.insert("semoule".to_owned());
+
+        let new_client_filter = ClientFilter::try_new(orig_filter.operation().clone(),
+            orig_filter.kind().clone(),
+            orig_filter.flags().clone(),
+            new_targets
+        )?;
+
+        tata.set_client_filter(Some(new_client_filter));
 
         db.store_subscription(&tata).await?;
 
@@ -293,29 +305,32 @@ pub mod tests {
         assert_eq!(tata2.content_format(), &ContentFormat::Raw);
         assert_eq!(tata2.ignore_channel_error(), true);
         assert_eq!(
-            *tata2.princs_filter().operation().unwrap(),
-            PrincsFilterOperation::Only
+            *tata2.client_filter().unwrap().operation(),
+            ClientFilterOperation::Only
         );
         assert_eq!(
-            tata2.princs_filter().princs(),
-            &HashSet::from([
-                "couscous".to_string(),
-                "boulette".to_string(),
-                "semoule".to_string()
+            tata2.client_filter().unwrap().targets(),
+            HashSet::from([
+                "couscous",
+                "boulette",
+                "semoule"
             ])
         );
-        assert_eq!(tata2.is_active_for("couscous"), true);
-        assert_eq!(tata2.is_active_for("semoule"), true);
+        assert_eq!(tata2.is_active_for("couscous", None), true);
+        assert_eq!(tata2.is_active_for("semoule", None), true);
         assert_eq!(tata2.revision(), Some("1890".to_string()).as_ref());
         assert_eq!(tata2.locale(), Some("fr-FR".to_string()).as_ref()); // Unchanged
         assert_eq!(tata2.data_locale(), Some("fr-FR".to_string()).as_ref());
 
         assert!(tata2.public_version()? != tata_save.public_version()?);
 
-        let mut new_princs_filter = tata2.princs_filter().clone();
-        new_princs_filter.delete_princ("couscous")?;
-        new_princs_filter.set_operation(Some(PrincsFilterOperation::Except));
-        tata2.set_princs_filter(new_princs_filter);
+        let mut new_client_filter = tata2.client_filter().cloned();
+
+        #[allow(deprecated)]
+        new_client_filter.as_mut().unwrap().delete_target("couscous")?;
+        #[allow(deprecated)]
+        new_client_filter.as_mut().unwrap().set_operation(ClientFilterOperation::Except);
+        tata2.set_client_filter(new_client_filter);
 
         db.store_subscription(&tata2).await?;
 
@@ -324,33 +339,30 @@ pub mod tests {
             .await?
             .unwrap();
         assert_eq!(
-            *tata2_clone.princs_filter().operation().unwrap(),
-            PrincsFilterOperation::Except
+            *tata2_clone.client_filter().unwrap().operation(),
+            ClientFilterOperation::Except
         );
         assert_eq!(
-            tata2_clone.princs_filter().princs(),
-            &HashSet::from(["boulette".to_string(), "semoule".to_string()])
+            tata2_clone.client_filter().unwrap().targets(),
+            HashSet::from(["boulette", "semoule"])
         );
 
-        assert_eq!(tata2_clone.is_active_for("couscous"), true);
-        assert_eq!(tata2_clone.is_active_for("semoule"), false);
-        assert_eq!(tata2_clone.is_active_for("boulette"), false);
+        assert_eq!(tata2_clone.is_active_for("couscous", None), true);
+        assert_eq!(tata2_clone.is_active_for("semoule", None), false);
+        assert_eq!(tata2_clone.is_active_for("boulette", None), false);
 
-        let mut new_princs_filter = tata2_clone.princs_filter().clone();
-        new_princs_filter.set_operation(None);
-        tata2_clone.set_princs_filter(new_princs_filter);
+        tata2_clone.set_client_filter(None);
 
         db.store_subscription(&tata2_clone).await?;
 
         let tata2_clone_clone = db
             .get_subscription_by_identifier(&tata.uuid_string())
             .await?
             .unwrap();
-        assert_eq!(tata2_clone_clone.princs_filter().operation(), None);
-        assert_eq!(tata2_clone_clone.princs_filter().princs(), &HashSet::new());
-        assert_eq!(tata2_clone_clone.is_active_for("couscous"), true);
-        assert_eq!(tata2_clone_clone.is_active_for("semoule"), true);
-        assert_eq!(tata2_clone_clone.is_active_for("boulette"), true);
+        assert_eq!(tata2_clone_clone.client_filter(), None);
+        assert_eq!(tata2_clone_clone.is_active_for("couscous", None), true);
+        assert_eq!(tata2_clone_clone.is_active_for("semoule", None), true);
+        assert_eq!(tata2_clone_clone.is_active_for("boulette", None), true);
 
         db.delete_subscription(&toto3.uuid_string()).await?;
         ensure!(