Acl fix (#993)

* ACL does not intercept messages with no key_expr * Update DEFAULT_CONFIG.json5
eclipse-zenoh · Apr 30, 2024 · 4806af0 · 4806af0
1 parent 4c277d3
commit 4806af0
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 10 deletions.
diff --git a/DEFAULT_CONFIG.json5 b/DEFAULT_CONFIG.json5
@@ -175,6 +175,7 @@
   //      ],
   //    },
   //  ],
+
   //  /// configure access control (ACL) rules 
   //  access_control: {
   //   ///[true/false] acl will be activated only if this is set to true
@@ -199,6 +200,7 @@
   //     },
   //  ]
   //},
+
   /// Configure internal transport parameters
   transport: {
     unicast: {

diff --git a/zenoh/src/net/routing/interceptor/access_control.rs b/zenoh/src/net/routing/interceptor/access_control.rs
@@ -162,22 +162,22 @@ impl InterceptorTrait for IngressAclEnforcer {
                     None
                 }
             })
-            .or_else(|| ctx.full_expr())?;
+            .or_else(|| ctx.full_expr());
 
         match &ctx.msg.body {
             NetworkBody::Push(Push {
                 payload: PushBody::Put(_),
                 ..
             }) => {
-                if self.action(Action::Put, "Put (ingress)", key_expr) == Permission::Deny {
+                if self.action(Action::Put, "Put (ingress)", key_expr?) == Permission::Deny {
                     return None;
                 }
             }
             NetworkBody::Request(Request {
                 payload: RequestBody::Query(_),
                 ..
             }) => {
-                if self.action(Action::Get, "Get (ingress)", key_expr) == Permission::Deny {
+                if self.action(Action::Get, "Get (ingress)", key_expr?) == Permission::Deny {
                     return None;
                 }
             }
@@ -188,7 +188,7 @@ impl InterceptorTrait for IngressAclEnforcer {
                 if self.action(
                     Action::DeclareSubscriber,
                     "Declare Subscriber (ingress)",
-                    key_expr,
+                    key_expr?,
                 ) == Permission::Deny
                 {
                     return None;
@@ -201,7 +201,7 @@ impl InterceptorTrait for IngressAclEnforcer {
                 if self.action(
                     Action::DeclareQueryable,
                     "Declare Queryable (ingress)",
-                    key_expr,
+                    key_expr?,
                 ) == Permission::Deny
                 {
                     return None;
@@ -230,22 +230,22 @@ impl InterceptorTrait for EgressAclEnforcer {
                     None
                 }
             })
-            .or_else(|| ctx.full_expr())?;
+            .or_else(|| ctx.full_expr());
 
         match &ctx.msg.body {
             NetworkBody::Push(Push {
                 payload: PushBody::Put(_),
                 ..
             }) => {
-                if self.action(Action::Put, "Put (egress)", key_expr) == Permission::Deny {
+                if self.action(Action::Put, "Put (egress)", key_expr?) == Permission::Deny {
                     return None;
                 }
             }
             NetworkBody::Request(Request {
                 payload: RequestBody::Query(_),
                 ..
             }) => {
-                if self.action(Action::Get, "Get (egress)", key_expr) == Permission::Deny {
+                if self.action(Action::Get, "Get (egress)", key_expr?) == Permission::Deny {
                     return None;
                 }
             }
@@ -256,7 +256,7 @@ impl InterceptorTrait for EgressAclEnforcer {
                 if self.action(
                     Action::DeclareSubscriber,
                     "Declare Subscriber (egress)",
-                    key_expr,
+                    key_expr?,
                 ) == Permission::Deny
                 {
                     return None;
@@ -269,7 +269,7 @@ impl InterceptorTrait for EgressAclEnforcer {
                 if self.action(
                     Action::DeclareQueryable,
                     "Declare Queryable (egress)",
-                    key_expr,
+                    key_expr?,
                 ) == Permission::Deny
                 {
                     return None;