Do proper ACL checks on event reads/subscriptions. #26761
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pullapprove
bot
requested review from
amitnj,
anush-apple,
arkq,
carol-apple,
cecille,
chrisdecenzo,
chshu,
chulspro,
cliffamzn,
Damian-Nordic,
dhrishi,
electrocucaracha,
emargolis,
franck-apple,
gjc13,
harimau-qirex,
harsha-rajendran,
hawk248,
jelderton,
jepenven-silabs,
jmartinez-silabs,
jmeg-sfy,
joonhaengHeo,
jtung-apple,
kcoppock,
kkasperczyk-no and
ksperling-apple
bzbarsky-apple
force-pushed
the
use-event-list-for-checks
branch
from
c0b425a to
7bbf873
Compare
|
PR #26761: Size comparison from dd21e4e to 7bbf873 Increases (27 builds for bl602, bl702, cc32xx, efr32, k32w, linux, qpg)
Full report (27 builds for bl602, bl702, cc32xx, efr32, k32w, linux, qpg)
|
bzbarsky-apple
force-pushed
the
use-event-list-for-checks
branch
from
7bbf873 to
7a90143
Compare
cecille
approved these changes
Jun 7, 2023
cecille
approved these changes
Jun 7, 2023
cecille
approved these changes
Jun 7, 2023
|
PR #26761: Size comparison from edef5a8 to 7a90143 Increases (8 builds for bl602, bl702, cc32xx, mbed, qpg)
Full report (8 builds for bl602, bl702, cc32xx, mbed, qpg)
|
bzbarsky-apple
force-pushed
the
use-event-list-for-checks
branch
2 times, most recently
from
e1fd781 to
7394a73
Compare
|
PR #26761: Size comparison from fd9721d to 7394a73 Increases (56 builds for bl602, bl702, cc32xx, cyw30739, efr32, esp32, k32w, linux, nrfconnect, psoc6, qpg, telink)
Full report (56 builds for bl602, bl702, cc32xx, cyw30739, efr32, esp32, k32w, linux, nrfconnect, psoc6, qpg, telink)
|
Merged
This adds the following functionality: 1. We now correctly detect subsciptions that don't have any access to anything, even if they have an event path in the subscribe request. For paths with a wildcard event id, this check assumes read privileges are needed when event lists are disabled, and uses the actual event-specific privileges when event lists are enabled. 2. When doing reads of an unsupported event, correctly return an errors instead of an empty event list. 3. Fix various unit test mocks to provide the information needed for the new checks. 4. Update expectation in existing YAML test that was checking an "unimplemented event" case.
bzbarsky-apple
force-pushed
the
use-event-list-for-checks
branch
from
7394a73 to
fd63f94
Compare
bzbarsky-apple
force-pushed
the
use-event-list-for-checks
branch
from
fd63f94 to
9299fd7
Compare
|
PR #26761: Size comparison from 3d481f3 to 9299fd7 Increases (57 builds for bl602, bl702, cc32xx, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, psoc6, qpg, telink)
Full report (57 builds for bl602, bl702, cc32xx, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, psoc6, qpg, telink)
|
jmartinez-silabs
approved these changes
Jun 14, 2023
maciejbaczmanski
pushed a commit
to maciejbaczmanski/connectedhomeip
that referenced
this pull request
Jul 15, 2024
…oject-chip#26761) * Do proper ACL checks on event reads/subscriptions. This adds the following functionality: 1. We now correctly detect subsciptions that don't have any access to anything, even if they have an event path in the subscribe request. For paths with a wildcard event id, this check assumes read privileges are needed when event lists are disabled, and uses the actual event-specific privileges when event lists are enabled. 2. When doing reads of an unsupported event, correctly return an errors instead of an empty event list. 3. Fix various unit test mocks to provide the information needed for the new checks. 4. Update expectation in existing YAML test that was checking an "unimplemented event" case. * Address review comments. * Fix darwin build. * Fix Darwin tests, now that we get errors for unsupported events. * Move function declarations to a non-codegen-dependent header. * Handle ACL checks for event wildcards even if we have no EventList. * Update to spec change for unsupported event errors. * Address review comments.
maciejbaczmanski
pushed a commit
to maciejbaczmanski/connectedhomeip
that referenced
this pull request
Jul 15, 2024
…ons. (project-chip#26761)" This reverts commit 03fb17e.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds the following functionality: