Added Access Control for Network Interface

Cargo.toml

@@ -218,4 +218,4 @@ debug = false     # If you want debug symbol in release mode, set the env variab
 lto = "fat"
 codegen-units = 1
 opt-level = 3
-panic = "abort"
+panic = "abort"

DEFAULT_CONFIG.json5

@@ -175,7 +175,30 @@
   //      ],
   //    },
   //  ],
-
+  //  /// configure access control (ACL) rules 
+  //  access_control: {
+  //   ///[true/false] acl will be activated only if this is set to true
+  //   "enabled": false,
+  //   ///[deny/allow] default permission is deny (even if this is left empty or not specified)
+  //   "default_permission": "deny",
+  //   ///rule set for permissions allowing or denying access to key-expressions
+  //   "rules": 
+  //   [
+  //     {
+  //       "actions": [
+  //         "put", "get", "declare_subscriber", "declare_queryable"
+  //       ],
+  //       "flows":["egress","ingress"],
+  //       "permission": "allow",
+  //       "key_exprs": [
+  //         "test/demo"
+  //       ],
+  //       "interfaces": [
+  //         "lo0"
+  //       ]
+  //     },
+  //  ]
+  //},
   /// Configure internal transport parameters
   transport: {
     unicast: {
@@ -318,7 +341,6 @@
     shared_memory: {
       enabled: false,
     },
-    /// Access control configuration
     auth: {
       /// The configuration of authentification.
       /// A password implies a username is required.

commons/zenoh-config/src/defaults.rs

@@ -221,6 +221,16 @@ impl Default for SharedMemoryConf {
     }
 }
 
+impl Default for AclConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            default_permission: Permission::Deny,
+            rules: None,
+        }
+    }
+}
+
 pub const DEFAULT_CONNECT_TIMEOUT_MS: ModeDependentValue<i64> =
     ModeDependentValue::Dependent(ModeValues {
         client: Some(0),

commons/zenoh-config/src/lib.rs

@@ -73,9 +73,9 @@ impl Zeroize for SecretString {
 
 pub type SecretValue = Secret<SecretString>;
 
-#[derive(Debug, Deserialize, Serialize, Clone)]
+#[derive(Debug, Deserialize, Serialize, Clone, Copy)]
 #[serde(rename_all = "lowercase")]
-pub enum DownsamplingFlow {
+pub enum InterceptorFlow {
     Egress,
     Ingress,
 }
@@ -97,7 +97,48 @@ pub struct DownsamplingItemConf {
     /// A list of interfaces to which the downsampling will be applied.
     pub rules: Vec<DownsamplingRuleConf>,
     /// Downsampling flow direction: egress, ingress
-    pub flow: DownsamplingFlow,
+    pub flow: InterceptorFlow,
+}
+
+#[derive(Serialize, Debug, Deserialize, Clone)]
+pub struct AclConfigRules {
+    pub interfaces: Vec<String>,
+    pub key_exprs: Vec<String>,
+    pub actions: Vec<Action>,
+    pub flows: Vec<InterceptorFlow>,
+    pub permission: Permission,
+}
+
+#[derive(Clone, Serialize, Debug, Deserialize)]
+pub struct PolicyRule {
+    pub subject: Subject,
+    pub key_expr: String,
+    pub action: Action,
+    pub permission: Permission,
+    pub flow: InterceptorFlow,
+}
+
+#[derive(Serialize, Debug, Deserialize, Eq, PartialEq, Hash, Clone)]
+#[serde(untagged)]
+#[serde(rename_all = "snake_case")]
+pub enum Subject {
+    Interface(String),
+}
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, Eq, Hash, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum Action {
+    Put,
+    DeclareSubscriber,
+    Get,
+    DeclareQueryable,
+}
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, Eq, Hash, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum Permission {
+    Allow,
+    Deny,
 }
 
 pub trait ConfigValidator: Send + Sync {
@@ -431,6 +472,7 @@ validated_struct::validator! {
                     known_keys_file: Option<String>,
                 },
             },
+
         },
         /// Configuration of the admin space.
         pub adminspace: #[derive(Default)]
@@ -456,6 +498,13 @@ validated_struct::validator! {
         /// Configuration of the downsampling.
         downsampling: Vec<DownsamplingItemConf>,
 
+        ///Configuration of the access control (ACL)
+        pub access_control: AclConfig {
+            pub enabled: bool,
+            pub default_permission: Permission,
+            pub rules: Option<Vec<AclConfigRules>>
+        },
+
         /// A list of directories where plugins may be searched for if no `__path__` was specified for them.
         /// The executable's current directory will be added to the search paths.
         plugins_search_dirs: Vec<String>, // TODO (low-prio): Switch this String to a PathBuf? (applies to other paths in the config as well)

zenoh/Cargo.toml

@@ -48,7 +48,7 @@ transport_tls = ["zenoh-transport/transport_tls"]
 transport_udp = ["zenoh-transport/transport_udp"]
 transport_unixsock-stream = ["zenoh-transport/transport_unixsock-stream"]
 transport_ws = ["zenoh-transport/transport_ws"]
-transport_vsock= ["zenoh-transport/transport_vsock"]
+transport_vsock = ["zenoh-transport/transport_vsock"]
 unstable = []
 default = [
     "auth_pubkey",
@@ -66,6 +66,7 @@ default = [
 [dependencies]
 tokio = { workspace = true, features = ["rt", "macros", "time"] }
 tokio-util = { workspace = true }
+ahash = { workspace = true }
 async-trait = { workspace = true }
 base64 = { workspace = true }
 const_format = { workspace = true }