Update ACL config format to support AND/OR logic between subjects

Cargo.toml

@@ -106,6 +106,7 @@ hmac = { version = "0.12.1", features = ["std"] }
 home = "0.5.4"
 http-types = "2.12.0"
 humantime = "2.1.0"
+itertools = "0.13.0"
 json5 = "0.4.1"
 jsonschema = { version = "0.18.0", default-features = false }
 keyed-set = "1.0.0"
@@ -170,6 +171,7 @@ tokio-tungstenite = "0.23.1"
 tokio-rustls = { version = "0.26.0", default-features = false }
 # tokio-vsock = see: io/zenoh-links/zenoh-link-vsock/Cargo.toml (workspaces does not support platform dependent dependencies)
 thread-priority = "1.1.0"
+trie-rs = "0.4.2"
 typenum = "1.16.0"
 uhlc = { version = "0.7.0", default-features = false } # Default features are disabled due to usage in no_std crates
 unwrap-infallible = "0.1.5"

DEFAULT_CONFIG.json5

@@ -178,16 +178,18 @@
   //    },
   //  ],
 
-  //  /// configure access control (ACL) rules
+  //  /// Configure access control (ACL) rules
   //  access_control: {
-  //   ///[true/false] acl will be activated only if this is set to true
+  //   /// [true/false] acl will be activated only if this is set to true
   //   "enabled": false,
-  //   ///[deny/allow] default permission is deny (even if this is left empty or not specified)
+  //   /// [deny/allow] default permission is deny (even if this is left empty or not specified)
   //   "default_permission": "deny",
-  //   ///rule set for permissions allowing or denying access to key-expressions
+  //   /// Rule set for permissions allowing or denying access to key-expressions
   //   "rules":
   //   [
   //     {
+  //       /// Id has to be unique within the rule set
+  //       "id": "rule1",
   //       "actions": [
   //         "put", "get", "declare_subscriber", "declare_queryable"
   //       ],
@@ -196,9 +198,29 @@
   //       "key_exprs": [
   //         "test/demo"
   //       ],
+  //     },
+  //     {
+  //       "id": "rule2",
+  //       "actions": [
+  //         "put", "get", "declare_subscriber", "declare_queryable"
+  //       ],
+  //       "flows":["ingress"],
+  //       "permission": "allow",
+  //       "key_exprs": [
+  //         "**"
+  //       ],
+  //     },
+  //   ],
+  //   /// List of combinations of subjects
+  //   "subjects":
+  //   [
+  //     {
+  //       /// Id has to be unique within the subjects list
+  //       "id": "subject1",
   //       /// Subjects can be interfaces
   //       "interfaces": [
-  //         "lo0"
+  //         "lo0",
+  //         "en0",
   //       ],
   //       /// Subjects can be cert_common_names when using TLS or Quic 
   //       "cert_common_names": [
@@ -207,9 +229,43 @@
   //       /// Subjects can be usernames when using user/password authentication
   //       "usernames": [
   //         "zenoh-example"
-  //       ]
+  //       ],
+  //       /// This instance translates internally to this filter:
+  //       /// (interface="lo0" && cert_common_name="example.zenoh.io" && username="zenoh-example") ||
+  //       /// (interface="en0" && cert_common_name="example.zenoh.io" && username="zenoh-example")
   //     },
-  //  ]
+  //     {
+  //       "id": "subject2",
+  //       "interfaces": [
+  //         "lo0",
+  //         "en0",
+  //       ],
+  //       "cert_common_names": [
+  //         "example2.zenoh.io"
+  //       ],
+  //       /// This instance translates internally to this filter:
+  //       /// (interface="lo0" && cert_common_name="example2.zenoh.io") ||
+  //       /// (interface="en0" && cert_common_name="example2.zenoh.io")
+  //     },
+  //     {
+  //       "id": "subject3",
+  //       /// An empty subject combination is a wildcard (all interfaces)
+  //     },
+  //   ],
+  //   /// The policy list contains policy entries
+  //   "policy":
+  //   [  
+  //      /// Each policy entry associates one or multiple rules to one or multiple subject combinations
+  //      {
+  //         /// Rules and Subjects are identified with their unique IDs declared above
+  //         "rules": ["rule1"],
+  //         "subjects": ["subject1", "subject2"],
+  //      },
+  //      {
+  //         "rules": ["rule2"],
+  //         "subjects": ["subject3"],
+  //      },
+  //   ]
   //},
 
   /// Configure internal transport parameters

commons/zenoh-config/src/defaults.rs

@@ -228,6 +228,8 @@ impl Default for AclConfig {
             enabled: false,
             default_permission: Permission::Deny,
             rules: None,
+            subjects: None,
+            policy: None,
         }
     }
 }

commons/zenoh-config/src/lib.rs

@@ -104,26 +104,38 @@ pub struct DownsamplingItemConf {
 }
 
 #[derive(Serialize, Debug, Deserialize, Clone)]
-pub struct AclConfigRules {
-    pub interfaces: Option<Vec<String>>,
-    pub cert_common_names: Option<Vec<String>>,
-    pub usernames: Option<Vec<String>>,
+pub struct AclConfigRule {
+    pub id: String,
     pub key_exprs: Vec<String>,
     pub actions: Vec<Action>,
     pub flows: Option<Vec<InterceptorFlow>>,
     pub permission: Permission,
 }
 
+#[derive(Serialize, Debug, Deserialize, Clone)]
+pub struct AclConfigSubjects {
+    pub id: String,
+    pub interfaces: Option<Vec<String>>,
+    pub cert_common_names: Option<Vec<String>>,
+    pub usernames: Option<Vec<String>>,
+}
+
+#[derive(Serialize, Debug, Deserialize, Clone)]
+pub struct AclConfigPolicyEntry {
+    pub rules: Vec<String>,
+    pub subjects: Vec<String>,
+}
+
 #[derive(Clone, Serialize, Debug, Deserialize)]
 pub struct PolicyRule {
-    pub subject: Subject,
+    pub subject_id: usize,
     pub key_expr: String,
     pub action: Action,
     pub permission: Permission,
     pub flow: InterceptorFlow,
 }
 
-#[derive(Serialize, Debug, Deserialize, Eq, PartialEq, Hash, Clone)]
+#[derive(Serialize, Debug, Deserialize, Eq, PartialEq, Hash, Clone, PartialOrd, Ord)]
 #[serde(untagged)]
 #[serde(rename_all = "snake_case")]
 pub enum Subject {
@@ -132,6 +144,16 @@ pub enum Subject {
     Username(String),
 }
 
+impl std::fmt::Display for Subject {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Subject::Interface(s) => write!(f, "Interface({s})"),
+            Subject::CertCommonName(s) => write!(f, "CertCommonName({s})"),
+            Subject::Username(s) => write!(f, "Username({s})"),
+        }
+    }
+}
+
 #[derive(Clone, Copy, Debug, Serialize, Deserialize, Eq, Hash, PartialEq)]
 #[serde(rename_all = "snake_case")]
 pub enum Action {
@@ -514,7 +536,9 @@ validated_struct::validator! {
         pub access_control: AclConfig {
             pub enabled: bool,
             pub default_permission: Permission,
-            pub rules: Option<Vec<AclConfigRules>>
+            pub rules: Option<Vec<AclConfigRule>>,
+            pub subjects: Option<Vec<AclConfigSubjects>>,
+            pub policy: Option<Vec<AclConfigPolicyEntry>>,
         },
 
         /// A list of directories where plugins may be searched for if no `__path__` was specified for them.

zenoh/Cargo.toml

@@ -76,6 +76,7 @@ flume = { workspace = true }
 form_urlencoded = { workspace = true }
 futures = { workspace = true }
 git-version = { workspace = true }
+itertools = { workspace = true }
 lazy_static = { workspace = true }
 tracing = { workspace = true }
 ordered-float = { workspace = true }
@@ -91,6 +92,7 @@ serde-pickle = { workspace = true }
 serde_yaml = { workspace = true }
 socket2 = { workspace = true }
 stop-token = { workspace = true }
+trie-rs = { workspace = true }
 uhlc = { workspace = true, features = ["default"] }
 unwrap-infallible = { workspace = true }
 uuid = { workspace = true, features = ["default"] }