openstack policy 鉴权过程分析

1. openstack 鉴权简单介绍   
    众所周知，openstack通过keystone用来完成authenticate（认证），真正的鉴权（authorize）是在各个模块分别做的，具体实现为每个模块都有一个policy文件，叫policy.json，里面定义了鉴权用的rules。
    以nova为例，policy文件的位置在：/etc/nova/policy.json，下面先来看几条rules，了解其基本含义：

1. "compute:create": "",                                              
   
2. "compute:create:attach_network": "",
   
3. "compute:create:attach_volume": "",
   
4. "compute:create:forced_host": "is_admin:True",
   
5. "compute:get_all": "",
   
6. "compute:get_all_tenants": "",
   
7. "compute:start": "rule:admin_or_owner",
   
8. "compute:stop": "rule:admin_or_owner",
   
9. "compute:unlock_override": "rule:admin_api",

语法规则为：rule:[result]
    rule：指这条规则是干啥的，通常对应一个action，以类似scope:action的形式给出，scope表示作用范围，action表示执行哪种操作
    result: 表示这条rule的判定结果或者如何进行判定，比如"compute:create:forced_host": "is_admin:True",如果执行此操作的用户具有admin角色（role），则这条结果的判定结果就是True。
另外，rule是可以嵌套的，比如"compute:stop": "rule:admin_or_owner",表示compute:stop这条规则的结果为admin_or_owner这条规则的结果，而admin_or_owner规则如下：

1. "admin_or_owner": "is_admin:True or project_id:%(project_id)s",

如果调用这个操作的用户的角色是admin，就返回True，或者返回用户所属的project的id.

2. policy鉴权代码分析
针对每一个操作，都会经过一个叫@wrap_check_policy的decorator，以nova的resize操作为例，在执行真正的resize代码之前，先要经过一个叫@wrap_check_policy的装饰器来完成policy的check过程，具体参见后面的代码check_policy函数：

1.     @wrap_check_policy
   
2.     @check_instance_lock
   
3.     @check_instance_cell
   
4.     @check_instance_state(vm_state=[vm_states.ACTIVE, vm_states.STOPPED],
   
5.                           task_state=[None])
   
6.     def resize(self, context, instance, flavor_id=None,
   
7.                **extra_instance_updates):

check_policy(context, action, target, scope='compute')函数有四个参数：
(1) context: 执行resize操作的上下文，其内容包括project_id, user_id, role，auth_token等信息，具体如下：

1. {'project_name': u'demo', 'user_id': u'a51e07e52af24111973dd7e11ece97f3', 'roles': [u'admin'], 'timestamp': '2014-03-10T08:45:56.552624', 'auth_token': '851012cfd5ad220e02cc3bc61b31c5f5', 'remote_address': '10.2.45.133', 'quota_class': None, 'is_admin': True, 'tenant': u'999c9fb0d7684ce1913cac4cc6122e51', 'service_catalog': [{u'endpoints': [{u'adminURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51', u'region': u'RegionOne', u'id': u'0987e932f0a0408ca7a5a31200c8ac51', u'internalURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51', u'publicURL': u'http://10.2.45.133:8776/v1/999c9fb0d7684ce1913cac4cc6122e51'}], u'endpoints_links': [], u'type': u'volume', u'name': u'cinder'}], 'request_id': 'req-292b93ac-0a2b-488e-8a51-ea734286b07c', 'instance_lock_checked': False, 'project_id': u'999c9fb0d7684ce1913cac4cc6122e51', 'user_name': u'admin', 'read_deleted': 'no', 'user': u'a51e07e52af24111973dd7e11ece97f3'}

(2) action：表示当前执行的操作是啥，这里就是resize
(3) target：操作针对的object是啥，这里就是instance id
(4) scope：当前操作的作用域是啥，主要为了与policy文件中定义的作用域匹配，这里为compute，即nova执行的操作

1. def check_policy(context, action, target, scope='compute'):
   
2.         _action = '%s:%s' % (scope, action)  ##这里拼接成policy.json的rule，即_action=compute:resize
   
3.         nova.policy.enforce(context, _action, target) 
   
4. ------------------------------------------------------------------------------------------------------------------------
   
5.     def enforce(context, action, target, do_raise=True):
   
6.         """Verifies that the action is valid on the target in this context.
   
7. 
   
8.            :param context: nova context
   
9.            :param action: string representing the action to be checked
   
10.                this should be colon separated for clarity.
    
11.                i.e. ``compute:create_instance``,
    
12.                ``compute:attach_volume``,
    
13.                ``volume:attach_volume``
    
14.            :param target: dictionary representing the object of the action
    
15.                for object creation this should be a dictionary representing the
    
16.                location of the object e.g. ``{'project_id': context.project_id}``
    
17.            :param do_raise: if True (the default), raises PolicyNotAuthorized;
    
18.                if False, returns False
    
19. 
    
20.            :raises nova.exception.PolicyNotAuthorized: if verification fails
    
21.                and do_raise is True.
    
22. 
    
23.            :return: returns a non-False value (not necessarily "True") if
    
24.                authorized, and the exact value False if not authorized and
    
25.                do_raise is False.
    
26.         """
    
27.         init()   ##policy.json被cache到cache_info数据结构中，init()函数就是去检查policy.json是否已经被加载或修改过，如果cache_info结构为空，说明policy.json还没有加载过，则执行加载；如果policy.json被修改过，也会重新进行加载
    
28. 
    
29.         credentials = context.to_dict()  ##将context转化成dictonary，就是上面context给出的内容，以便后面代码使用
    
30. 
    
31.         # Add the exception arguments if asked to do a raise
    
32.         extra = {}
    
33.         if do_raise:
    
34.             extra.update(exc=exception.PolicyNotAuthorized, action=action)  ##增加no auth hook函数，即如果rule的结果为False，则执行no auth hook函数做一些处理
    
35. 
    
36.         return policy.check(action, target, credentials, **extra)  ##进行policy的check
    
37. --------------------------------------------------------------------------------------------------------------------
    
38. def init():
    
39.     global _POLICY_PATH
    
40.     global _POLICY_CACHE
    
41.     if not _POLICY_PATH:
    
42.         _POLICY_PATH = CONF.policy_file
    
43.         if not os.path.exists(_POLICY_PATH):
    
44.             _POLICY_PATH = CONF.find_file(_POLICY_PATH)
    
45.         if not _POLICY_PATH:
    
46.             raise exception.ConfigNotFound(path=CONF.policy_file)
    
47.     utils.read_cached_file(_POLICY_PATH, _POLICY_CACHE,
    
48.                            reload_func=_set_rules) ##加载policy.json文件
    
49. ----------------------------------------------------------------------------------------------------------------------
    
50. 
    
51. def read_cached_file(filename, cache_info, reload_func=None):
    
52.     """Read from a file if it has been modified.
    
53. 
    
54.     :param cache_info: dictionary to hold opaque cache.
    
55.     :param reload_func: optional function to be called with data when
    
56.                         file is reloaded due to a modification.
    
57. 
    
58.     :returns: data from file
    
59. 
    
60.     """
    
61.     mtime = os.path.getmtime(filename)  ###获取policy.json文件的modify time，如果与cache_info中的mtime不同，则说明文件被修改过，则执行重新加载
    
62.     if not cache_info or mtime != cache_info.get('mtime'):
    
63.         LOG.debug(_("Reloading cached file %s") % filename)
    
64.         with open(filename) as fap:
    
65.             cache_info['data'] = fap.read()
    
66.         cache_info['mtime'] = mtime
    
67.         if reload_func:
    
68.             reload_func(cache_info['data'])
    
69.     return cache_info['data']            ###返回加载后的policy.json文件的内容
    
70. ---------------------------------------------------------------------------------------------------------------------------
    
71. def check(rule, target, creds, exc=None, *args, **kwargs):
    
72.     """
    
73.     Checks authorization of a rule against the target and credentials.
    
74. 
    
75.     :param rule: The rule to evaluate.
    
76.     :param target: As much information about the object being operated
    
77.                    on as possible, as a dictionary.
    
78.     :param creds: As much information about the user performing the
    
79.                   action as possible, as a dictionary.
    
80.     :param exc: Class of the exception to raise if the check fails.
    
81.                 Any remaining arguments passed to check() (both
    
82.                 positional and keyword arguments) will be passed to
    
83.                 the exception class. If exc is not provided, returns
    
84.                 False.
    
85. 
    
86.     :return: Returns False if the policy does not allow the action and
    
87.              exc is not provided; otherwise, returns a value that
    
88.              evaluates to True. Note: for rules using the "case"
    
89.              expression, this True value will be the specified string
    
90.              from the expression.
    
91.     """
    
92. 
    
93.     # Allow the rule to be a Check tree
    
94.     if isinstance(rule, BaseCheck):
    
95.         result = rule(target, creds)
    
96.     elif not _rules:
    
97.         # No rules to reference means we're going to fail closed
    
98.         result = False
    
99.     else:
    
100.         try:
     
101.             # Evaluate the rule
     
102.             result = _rules[rule](target, creds)  ##没一条rule执行一个函数，这个对应关系记录在全局变量_rules
     
103.         except KeyError:
     
104.             # If the rule doesn't exist, fail closed
     
105.             result = False
     
106. 
     
107.     # If it is False, raise the exception if requested
     
108.     if exc and result is False:
     
109.         raise exc(*args, **kwargs)
     
110. 
     
111.     return result

3. 总结 
    之前一直以为修改了policy.json文件，需要重启service才能重新加载policy.json生效，通过分析代码，证明policy.json是动态更新的。另外，通过分析代码，也搞清楚了如何添加自定义的rule，以便实现更细粒度的rule，稍后会给出一个自己实现的例子。