etcdctl/ctlv3: auth: slash and wildcard permissions

auth/prefix_perm.go

@@ -0,0 +1,57 @@
+// Copyright 2016 The etcd Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package auth
+
+import (
+	"bytes"
+)
+
+// isPrefixWithSlash returns true if and only if
+// a) both prefix and path are single keys; and
+// b) prefix ends in `/`; and
+// c) path starts with prefix.
+func isPrefixWithSlash(path, prefix *rangePerm) bool {
+
+	if len(prefix.end) != 0 || len(path.end) != 0 {
+		return false // not single keys
+	}
+	lenpre := len(prefix.begin)
+	if lenpre == 0 {
+		return false
+	}
+	if prefix.begin[lenpre-1] != '/' {
+		return false
+	}
+	return bytes.HasPrefix(path.begin, prefix.begin)
+}
+
+// isPrefixPlusWildcard returns true if and only if
+// a) both prefix and path are single keys; and
+// b) prefix ends in `*`; and
+// c) path starts with prefix up until the `*`.
+func isPrefixPlusWildcard(path, prefix *rangePerm) bool {
+
+	if len(prefix.end) != 0 || len(path.end) != 0 {
+		return false // not single keys
+	}
+	lenpre := len(prefix.begin)
+	if lenpre == 0 {
+		return false
+	}
+	if prefix.begin[lenpre-1] != '*' {
+		return false
+	}
+	return bytes.HasPrefix(path.begin, prefix.begin[:(lenpre-1)])
+}

auth/range_perm_cache.go

@@ -156,6 +156,12 @@ func checkKeyPerm(cachedPerms *unifiedRangePermissions, key, rangeEnd []byte, pe
 		if isSubset(requiredPerm, perm) {
 			return true
 		}
+		if isPrefixWithSlash(requiredPerm, perm) {
+			return true
+		}
+		if isPrefixPlusWildcard(requiredPerm, perm) {
+			return true
+		}
 	}
 
 	return false