Skip to content

authz: protect VPC endpoints#743

Merged
davepacheco merged 13 commits into
mainfrom
authz-vpc
Mar 10, 2022
Merged

authz: protect VPC endpoints#743
davepacheco merged 13 commits into
mainfrom
authz-vpc

Conversation

@davepacheco

Copy link
Copy Markdown
Collaborator

See #419 for context. This change adds authz protection for VPC create/delete/update/get and the "list VPCs" endpoint. This does not affect any of the resources underneath VPCs (subnets, routers, firewalls, etc.).

I ran into #742 and fixed that here as well.

@davepacheco davepacheco mentioned this pull request Mar 9, 2022
71 tasks
@davepacheco davepacheco marked this pull request as ready for review March 10, 2022 00:02
Comment thread nexus/src/db/datastore.rs
Comment thread nexus/src/db/datastore.rs
@@ -2110,18 +2198,15 @@ impl DataStore {
let now = Utc::now();
diesel::update(dsl::vpc)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At least some of the other deletion methods use the check_if_exists method to separately handle the case where there is no such object at all, and where there is one, but it's already been deleted. In the latter case, I think we want to not update time_deleted and return a success, to make the operation idempotent. If I understand correctly, this will return an object-not-found error in that case.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You might be right, though I think we expect that DELETE of a resource that doesn't exist in the public API produces a 404, not a successful result. This seems worth testing more broadly, though this one seems hard to test because you will have just looked up the VPC successfully to get to this code path.

Anyway, I think this is unrelated here (in that the behavior you're describing exists on "main" and isn't related to the change here). I'd like to file a separate issue to cover this.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I meant that: if there is no such record at all, return 404; if there is a record, but it's already deleted, return success. Or by "in the public API", did you mean one that isn't deleted? As an example, when you create a VPC (so you have the ID), then delete it twice, what should we return for that second call?

But that's a general question, I agree, and we should do it separately.

Comment thread nexus/src/db/datastore.rs
Comment thread nexus/src/db/datastore.rs
Comment thread nexus/src/nexus.rs
Comment thread nexus/src/nexus.rs

@bnaecker bnaecker left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thanks for doing this! I have a few questions about scope, but otherwise looks great.

@davepacheco davepacheco left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review!

Comment thread nexus/src/db/datastore.rs
@@ -2110,18 +2198,15 @@ impl DataStore {
let now = Utc::now();
diesel::update(dsl::vpc)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You might be right, though I think we expect that DELETE of a resource that doesn't exist in the public API produces a 404, not a successful result. This seems worth testing more broadly, though this one seems hard to test because you will have just looked up the VPC successfully to get to this code path.

Anyway, I think this is unrelated here (in that the behavior you're describing exists on "main" and isn't related to the change here). I'd like to file a separate issue to cover this.

Comment thread nexus/src/db/datastore.rs
Comment thread nexus/src/db/datastore.rs
Comment thread nexus/src/nexus.rs
Comment thread nexus/src/nexus.rs
@davepacheco davepacheco enabled auto-merge (squash) March 10, 2022 22:55
@davepacheco davepacheco merged commit 0eff1af into main Mar 10, 2022
@davepacheco davepacheco deleted the authz-vpc branch March 10, 2022 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants