openstack policy 鉴权过程分析

你的名字 2022-08-25 14:56 116阅读 0赞

**1. openstack 鉴权简单介绍**  
 众所周知，openstack通过keystone用来完成authenticate（认证），真正的鉴权（authorize）是在各个模块分别做的，具体实现为每个模块都有一个policy文件，叫policy.json，里面定义了鉴权用的rules。  
 以nova为例，policy文件的位置在：/etc/nova/policy.json，下面先来看几条rules，了解其基本含义：

1.  "compute:create": "",   
    
2.  "compute:create:attach\_network": "",  
    
3.  "compute:create:attach\_volume": "",  
    
4.  "compute:create:forced\_host": "is\_admin:True",  
    
5.  "compute:get\_all": "",  
    
6.  "compute:get\_all\_tenants": "",  
    
7.  "compute:start": "rule:admin\_or\_owner",  
    
8.  "compute:stop": "rule:admin\_or\_owner",  
    
9.  "compute:unlock\_override": "rule:admin\_api",

语法规则为：rule:\[result\]  
 rule：指这条规则是干啥的，通常对应一个action，以类似scope:action的形式给出，scope表示作用范围，action表示执行哪种操作  
 result: 表示这条rule的判定结果或者如何进行判定，比如  "compute:create:forced\_host" :  "is\_admin:True" , 如果执行此操作的用户具有admin角色（role），则这条结果的判定结果就是True。  
另外，rule是可以嵌套的，比如 "compute:stop" :  "rule:admin\_or\_owner" , 表示compute:stop这条规则的结果为 admin\_or\_owner 这条规则的结果，而 admin\_or\_owner 规则如下：

1.  "admin\_or\_owner": "is\_admin:True or project\_id:%(project\_id)s",

如果调用这个操作的用户的角色是admin，就返回True，或者返回用户所属的project的id.  
  
**2. policy鉴权代码分析**  
针对每一个操作，都会经过一个叫@wrap\_check\_policy的decorator，以nova的resize操作为例，在执行真正的resize代码之前，先要经过一个叫 @wrap\_check\_policy 的装饰器来完成policy的check过程，具体参见后面的代码check\_policy函数：

1.  @wrap\_check\_policy  
    
2.   @check\_instance\_lock  
    
3.   @check\_instance\_cell  
    
4.   @check\_instance\_state(vm\_state=\[vm\_states.ACTIVE, vm\_states.STOPPED\],  
    
5.   task\_state=\[None\])  
    
6.  def resize(self, context, instance, flavor\_id=None,  
    
7.  \*\*extra\_instance\_updates):

check\_policy(context, action, target, scope='compute') 函数有四个参数：  
(1) context: 执行resize操作的上下文，其内容包括project\_id, user\_id, role，auth\_token等信息，具体如下：

1.  \{ 'project\_name': u'demo', 'user\_id': u'a51e07e52af24111973dd7e11ece97f3', 'roles': \[u'admin'\], 'timestamp': '2014-03-10T08:45:56.552624', 'auth\_token': '851012cfd5ad220e02cc3bc61b31c5f5', 'remote\_address': '10.2.45.133', 'quota\_class': None, 'is\_admin': True, 'tenant': u'999c9fb0d7684ce1913cac4cc6122e51', 'service\_catalog': \[\{ u'endpoints': \[\{ u'adminURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51', u'region': u'RegionOne', u'id': u'0987e932f0a0408ca7a5a31200c8ac51', u'internalURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51', u'publicURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51'\}\], u'endpoints\_links': \[\], u'type': u'volume', u'name': u'cinder'\}\], 'request\_id': 'req-292b93ac-0a2b-488e-8a51-ea734286b07c', 'instance\_lock\_checked': False, 'project\_id': u'999c9fb0d7684ce1913cac4cc6122e51', 'user\_name': u'admin', 'read\_deleted': 'no', 'user': u'a51e07e52af24111973dd7e11ece97f3'\}

(2) action：表示当前执行的操作是啥，这里就是resize  
(3) target：操作针对的object是啥，这里就是instance id  
(4) scope：当前操作的作用域是啥，主要为了与policy文件中定义的作用域匹配，这里为compute，即nova执行的操作

1.  def check\_policy(context, action, target, scope='compute'):  
    
2.  \_action = '%s:%s' % (scope, action) \#\#这里拼接成policy.json的rule，即\_action=compute:resize  
    
3.  nova.policy.enforce(context, \_action, target)  
    
4.  \------------------------------------------------------------------------------------------------------------------------  
    
5.  def enforce(context, action, target, do\_raise=True):  
    
6.  """Verifies that the action is valid on the target in this context.  
    
7.    
    
8.  :param context: nova context  
    
9.  :param action: string representing the action to be checked  
    
10. this should be colon separated for clarity.  
    
11. i.e. \`\`compute:create\_instance\`\`,  
    
12. \`\`compute:attach\_volume\`\`,  
    
13. \`\`volume:attach\_volume\`\`  
    
14. :param target: dictionary representing the object of the action  
    
15. for object creation this should be a dictionary representing the  
    
16. location of the object e.g. \`\`\{'project\_id': context.project\_id\}\`\`  
    
17. :param do\_raise: if True (the default), raises PolicyNotAuthorized;  
    
18. if False, returns False  
    
19.   
    
20. :raises nova.exception.PolicyNotAuthorized: if verification fails  
    
21. and do\_raise is True.  
    
22.   
    
23. :return: returns a non-False value (not necessarily "True") if  
    
24. authorized, and the exact value False if not authorized and  
    
25. do\_raise is False.  
    
26. """  
    
27. init()  \#\#policy.json被cache到cache\_info数据结构中，init()函数就是去检查policy.json是否已经被加载或修改过，如果cache\_info结构为空，说明policy.json还没有加载过，则执行加载；如果policy.json被修改过，也会重新进行加载  
    
28.   
    
29. credentials = context.to\_dict() \#\#将context转化成dictonary，就是上面context给出的内容，以便后面代码使用  
    
30.   
    
31. \# Add the exception arguments if asked to do a raise  
    
32. extra = \{ \}  
    
33. if do\_raise:  
    
34. extra.update(exc=exception.PolicyNotAuthorized, action=action) \#\#增加no auth hook函数，即如果rule的结果为False，则执行no auth hook函数做一些处理  
    
35.   
    
36. return policy.check(action, target, credentials, \*\*extra) \#\#进行policy的check  
    
37. \----------------------\----------------------------------------------------------------------------------------------  
    
38. def init():  
    
39. global \_POLICY\_PATH  
    
40. global \_POLICY\_CACHE  
    
41. if not \_POLICY\_PATH:  
    
42. \_POLICY\_PATH = CONF.policy\_file  
    
43. if not os.path.exists(\_POLICY\_PATH):  
    
44. \_POLICY\_PATH = CONF.find\_file(\_POLICY\_PATH)  
    
45. if not \_POLICY\_PATH:  
    
46. raise exception.ConfigNotFound(path=CONF.policy\_file)  
    
47. utils.read\_cached\_file(\_POLICY\_PATH, \_POLICY\_CACHE,  
    
48. reload\_func=\_set\_rules) \#\#加载policy.json文件  
    
49. \----------------------------------------------------------------------------------------------------------------------  
    
50.   
    
51. def read\_cached\_file(filename, cache\_info, reload\_func=None):  
    
52. """Read from a file if it has been modified.  
    
53.   
    
54. :param cache\_info: dictionary to hold opaque cache.  
    
55. :param reload\_func: optional function to be called with data when  
    
56. file is reloaded due to a modification.  
    
57.   
    
58. :returns: data from file  
    
59.   
    
60. """  
    
61. mtime = os.path.getmtime(filename) \#\#\#获取policy.json文件的modify time，如果与cache\_info中的mtime不同，则说明文件被修改过，则执行重新加载  
    
62. if not cache\_info or mtime != cache\_info.get('mtime'):  
    
63. LOG.debug(\_("Reloading cached file %s") % filename)  
    
64. with open(filename) as fap:  
    
65. cache\_info\['data'\] = fap.read()  
    
66. cache\_info\['mtime'\] = mtime  
    
67. if reload\_func:  
    
68. reload\_func(cache\_info\['data'\])  
    
69. return cache\_info\['data'\] \#\#\#返回加载后的policy.json文件的内容  
    
70. \----\-----------------------------------------------------------------------------------------------------------------------  
    
71. def check(rule, target, creds, exc=None, \*args, \*\*kwargs):  
    
72. """  
    
73. Checks authorization of a rule against the target and credentials.  
    
74.   
    
75. :param rule: The rule to evaluate.  
    
76. :param target: As much information about the object being operated  
    
77. on as possible, as a dictionary.  
    
78. :param creds: As much information about the user performing the  
    
79. action as possible, as a dictionary.  
    
80. :param exc: Class of the exception to raise if the check fails.  
    
81. Any remaining arguments passed to check() (both  
    
82. positional and keyword arguments) will be passed to  
    
83. the exception class. If exc is not provided, returns  
    
84. False.  
    
85.   
    
86. :return: Returns False if the policy does not allow the action and  
    
87. exc is not provided; otherwise, returns a value that  
    
88. evaluates to True. Note: for rules using the "case"  
    
89. expression, this True value will be the specified string  
    
90. from the expression.  
    
91. """  
    
92.   
    
93. \# Allow the rule to be a Check tree  
    
94. if isinstance(rule, BaseCheck):  
    
95. result = rule(target, creds)  
    
96. elif not \_rules:  
    
97. \# No rules to reference means we're going to fail closed  
    
98. result = False  
    
99. else:  
    
100. try:  
    
101. \# Evaluate the rule  
    
102. result = \_rules\[rule\](target, creds) \#\#没一条rule执行一个函数，这个对应关系记录在全局变量\_rules  
    
103. except KeyError:  
    
104. \# If the rule doesn't exist, fail closed  
    
105. result = False  
    
106.   
    
107. \# If it is False, raise the exception if requested  
    
108. if exc and result is False:  
    
109. raise exc(\*args, \*\*kwargs)  
    
110.   
    
111. return result

**3. 总结**  
 之前一直以为修改了policy.json文件，需要重启service才能重新加载policy.json生效，通过分析代码，证明policy.json是动态更新的。另外，通过分析代码，也搞清楚了如何添加自定义的rule，以便实现更细粒度的rule，稍后会给出一个自己实现的例子。