RANGER-5842: Evaluate constraint policies in the policy engine and return applicable constraints in the access result

agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java

@@ -30,6 +30,7 @@
 import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
 import org.apache.ranger.plugin.model.RangerServiceDef;
 import org.apache.ranger.plugin.model.RangerServiceDef.RangerAccessTypeDef;
+import org.apache.ranger.plugin.model.RangerServiceDef.RangerConstraintDef;
 import org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef;
 import org.apache.ranger.plugin.resourcematcher.RangerAbstractResourceMatcher;
 import org.apache.ranger.plugin.resourcematcher.RangerPathResourceMatcher;
@@ -316,6 +317,66 @@ public Set<List<RangerResourceDef>> getResourceHierarchies(Integer policyType, C
         return ret;
     }
 
+    /**
+     * Resource hierarchies for one constraint. Each access hierarchy contributes its longest prefix
+     * whose resources are all named on the constraint def. A def that lists no resources uses the access hierarchy.
+     * A prefix is returned only when it contains every key.
+     */
+    public Set<List<RangerResourceDef>> getResourceHierarchiesForConstraint(String constraint, Collection<String> keys) {
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("==> getResourceHierarchiesForConstraint(constraint={}, keys={})", constraint, StringUtils.join(keys, ","));
+        }
+
+        Set<List<RangerResourceDef>> ret           = new HashSet<>();
+        RangerConstraintDef          constraintDef = getConstraintDef(constraint);
+
+        if (constraintDef == null) {
+            ret = Collections.emptySet();
+        } else if (CollectionUtils.isEmpty(constraintDef.getResources())) {
+            ret.addAll(getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS, keys));
+        } else {
+            Set<String> names = new HashSet<>(constraintDef.getResources());
+
+            for (List<RangerResourceDef> hierarchy : getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS)) {
+                List<RangerResourceDef> prefix = new ArrayList<>();
+
+                for (RangerResourceDef resourceDef : hierarchy) {
+                    if (!names.contains(resourceDef.getName())) {
+                        break;
+                    }
+
+                    prefix.add(resourceDef);
+                }
+
+                if (CollectionUtils.isNotEmpty(prefix) && hierarchyHasAllResources(prefix, keys)) {
+                    ret.add(prefix);
+                }
+            }
+        }
+
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("<== getResourceHierarchiesForConstraint(constraint={}, keys={}): {}", constraint, StringUtils.join(keys, ","), StringUtils.join(ret, ""));
+        }
+
+        return ret;
+    }
+
+    private RangerConstraintDef getConstraintDef(String constraint) {
+        RangerConstraintDef ret = null;
+
+        if (StringUtils.isNotEmpty(constraint) && CollectionUtils.isNotEmpty(delegate.servicedef.getConstraintDefs())) {
+            for (RangerConstraintDef constraintDef : delegate.servicedef.getConstraintDefs()) {
+                if (constraintDef != null && StringUtils.equals(constraint, constraintDef.getName())) {
+                    ret = constraintDef;
+
+                    break;
+                }
+            }
+        }
+
+        return ret;
+    }
+
     public boolean hierarchyHasAllResources(List<RangerResourceDef> hierarchy, Collection<String> resourceNames) {
         if (LOG.isDebugEnabled()) {
             LOG.debug("==> hierarchyHasAllResources(hierarchy={}, resourceNames={})",  StringUtils.join(hierarchy, ","), StringUtils.join(resourceNames, ","));

agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java

@@ -621,11 +621,41 @@ private RangerAccessResult zoneAwareAccessEvaluationWithNoAudit(RangerAccessRequ
 
         evaluateInlinePolicy(request, ret);
 
+        if (policyType == RangerPolicy.POLICY_TYPE_ACCESS && ret != null && ret.getIsAllowed()) {
+            evaluateConstraintPolicies(request, ret);
+        }
+
         LOG.debug("<== RangerPolicyEngineImpl.zoneAwareAccessEvaluationWithNoAudit({}, policyType ={}): {}", request, policyType, ret);
 
         return ret;
     }
 
+    private void evaluateConstraintPolicies(RangerAccessRequest request, RangerAccessResult result) {
+        LOG.debug("==> RangerPolicyEngineImpl.evaluateConstraintPolicies({}, {})", request, result);
+
+        RangerPolicyRepository repository = policyEngine.getRepositoryForZone(result.getZoneName());
+
+        if (repository == null || repository.getConstraintPolicyEvaluatorCount() == 0) {
+            LOG.debug("<== RangerPolicyEngineImpl.evaluateConstraintPolicies({}, {}): no constraint policies", request, result);
+
+            return;
+        }
+
+        List<RangerPolicyEvaluator> evaluators = repository.getLikelyMatchPolicyEvaluators(request, RangerPolicy.POLICY_TYPE_CONSTRAINTS);
+
+        if (CollectionUtils.isNotEmpty(evaluators)) {
+            Date accessTime = request.getAccessTime() != null ? request.getAccessTime() : new Date();
+
+            for (RangerPolicyEvaluator evaluator : evaluators) {
+                if (evaluator.isApplicable(accessTime)) {
+                    evaluator.evaluateConstraints(request, result);
+                }
+            }
+        }
+
+        LOG.debug("<== RangerPolicyEngineImpl.evaluateConstraintPolicies({}, {}): constraints={}", request, result, result.getConstraints());
+    }
+
     private RangerAccessResult evaluatePoliciesNoAudit(RangerAccessRequest request, int policyType, String zoneName, RangerPolicyRepository policyRepository, RangerPolicyRepository tagPolicyRepository) {
         LOG.debug("==> RangerPolicyEngineImpl.evaluatePoliciesNoAudit({}, policyType={}, zoneName={})", request, policyType, zoneName);