krabka_verified/
authz.rs

1//! Kafka ACL precedence and SASL session/request admission.
2
3use creusot_std::prelude::*;
4
5/// Why ACL evaluation allowed or denied a request.
6#[krabka_macros::model_type]
7pub enum AclDecision {
8    AllowSuperuser,
9    AllowAcl,
10    /// `allow.everyone.if.no.acl.found` allowed the request because no ACL
11    /// at all applies to the resource.
12    AllowNoAcl,
13    DenyExplicit,
14    DenyDefault,
15}
16
17/// Resource-pattern class used by the verified ACL applicability adapter.
18#[krabka_macros::model_type]
19pub enum AclPatternKind {
20    Literal,
21    Prefixed,
22}
23
24/// ACL operation class used by the verified implication table.
25#[krabka_macros::model_type]
26pub enum AclOperationKind {
27    All,
28    Read,
29    Write,
30    Create,
31    Delete,
32    Alter,
33    Describe,
34    ClusterAction,
35    DescribeConfigs,
36    AlterConfigs,
37    IdempotentWrite,
38    TwoPhaseCommit,
39    /// KIP-373: create a delegation token owned by the `User` resource.
40    CreateTokens,
41    /// KIP-373: describe the delegation tokens the `User` resource owns.
42    DescribeTokens,
43}
44
45/// Whether a stored ACL names the requested resource type.
46#[krabka_macros::model_type]
47pub enum AclResourceTypeMatch {
48    Same,
49    Different,
50}
51
52/// How a stored ACL's resource name relates to the requested resource name.
53#[krabka_macros::model_type]
54pub struct AclResourceFacts {
55    pub resource_type: AclResourceTypeMatch,
56    /// The stored name equals the requested name.
57    pub exact_name: bool,
58    /// The stored name is the literal wildcard `*`.
59    pub wildcard_name: bool,
60    /// The requested name starts with the stored name.
61    pub name_has_prefix: bool,
62}
63
64/// Authentication phase used to admit a Kafka request, after Kafka's
65/// `SaslServerAuthenticator` states.
66#[krabka_macros::model_type]
67pub enum RequestAuthState {
68    /// No `SaslHandshake` has run yet: only `SaslHandshake` (17) and
69    /// `ApiVersions` (18) are Kafka requests the authenticator handles.
70    PreHandshake,
71    /// A handshake chose a mechanism, for the initial authentication or a
72    /// KIP-368 re-authentication: only `SaslAuthenticate` (36) may follow.
73    Exchanging,
74    /// Authentication failed, including a mechanism switch or a controller
75    /// session that expired: the next frame, whatever it is, fails
76    /// the connection.
77    Failed,
78    Authenticated,
79}
80
81/// The outcome when no ACL matched the request.
82#[krabka_macros::model_type]
83pub enum AclDefault {
84    Deny,
85    /// `allow.everyone.if.no.acl.found` is set and no ACL at all applies to
86    /// the resource.
87    Allow,
88}
89
90/// What the precedence loop observed for one request.
91#[krabka_macros::model_type]
92pub struct AclFacts {
93    pub super_user: bool,
94    /// Some applicable ALLOW ACL matched the principal, host, and operation.
95    pub saw_allow: bool,
96    /// Some applicable DENY ACL matched the principal, host, and operation.
97    pub saw_deny: bool,
98    pub default_decision: AclDefault,
99}
100
101mod acl_decision;
102pub use acl_decision::{
103    acl_decision, acl_identity_match, acl_operation_match, acl_resource_match,
104    request_auth_admission,
105};
106
107mod session;
108pub use session::{
109    MIN_REAUTH_INTERVAL_MS, reauthentication_begins, sasl_session_expiry,
110    session_expired_for_request,
111};
112
113mod controller_session;
114pub use controller_session::controller_request_admission;
115
116#[cfg(test)]
117mod tests;
krabka_verified/authz.rs

krabka_verified/
authz.rs
