Re: [SCITT] scitt-api-emulator: pull request: policy engine: Simple decoupled file based policy engine

[John Andersen <[e-mail]>]

Hi all,

Ive updated the pull request to align with Darrel’s review comments on
error properties. However, as mentioned in
https://github.com/ietf-wg-scitt/draft-ietf-scitt-architecture/issues/62 it
would be great to return an object in addition to or instead of a string.
Or allow for other properties which would be fully content-typeable to a
custom response object within the error response on claim insert failure.

Lack of this prevents an automated conversation to resolve issues with
claim insertion. Human readable strings are great, but ideally a human
doesn't even get involved and machines can auto remediate issues due to
detailed failure reasoning. This way the a human readable string might only
be needed after a failed machine driven insert conversation (more than one
call response).
Thank you,
John

On Fri, Mar 31, 2023 at 15:05 Andersen, John S <[e-mail]>
wrote:

> Hi all,
>
>
>
> Happy Friday!
>
>
>
> Just wanted to see if the mailing list had any thoughts on this and
> broadcast for visibility and others who want to experiment in this space as
> well as hoping for review/merge of this PR.
>
>
>
> https://github.com/scitt-community/scitt-api-emulator/pull/27 enables a
> simple insert policy based engine based on presence of
> operation.policy.{insert,denied,failure} files. Currently only for use with
> use_lro=True. This is a simple way to enable evaluation of claims prior to
> submission by arbitrary policy engines which watch the workspace (fanotify,
> inotify, etc.).
>
>
>
> We could also load content from those files in the future, for aiding in
> explaining reasons for failure or denial. Left that out for now to strip to
> the bare minimum.
>
>
>
> Thank you,
>
> John
>
>
>
>
>
> Associated docs reproduced below:
>
>
> Registration Policies
> <https://github.com/scitt-community/scitt-api-emulator/blob/2787820abf3fa4701bc46a9629cd98d11254fbe6/docs/registration_policies.md#registration-policies>
>
>    - References
>       - 5.2.2. Registration Policies
>       <https://www.ietf.org/archive/id/draft-birkholz-scitt-architecture-02.html#name-registration-policies>
>
> Simple decoupled file based policy engine
>
> The SCITT API emulator can deny entry based on presence of
> operation.policy.{insert,denied,failure} files. Currently only for use
> with use_lro=True.
>
> This is a simple way to enable evaluation of claims prior to submission by
> arbitrary policy engines which watch the workspace (fanotify, inotify,
> etc.).
>
> Start the server
>
> $ rm -rf workspace/
>
> $ mkdir -p workspace/storage/operations
>
> $ scitt-emulator server --workspace workspace/ --tree-alg CCF --use-lro
>
> Service parameters: workspace/service_parameters.json
>
> ^C
>
>
>
> Modification of config to non-* insert policy. Restart SCITT API emulator
> server after this.
>
>
>
> $ echo "$(cat workspace/service_parameters.json)" \
>
>     | jq '.insertPolicy = "external"' \
>
>     | tee workspace/service_parameters.json.new \
>
>     && mv workspace/service_parameters.json.new workspace/service_parameters.json
>
> {
>
>   "serviceId": "emulator",
>
>   "treeAlgorithm": "CCF",
>
>   "signatureAlgorithm": "ES256",
>
>   "serviceCertificate": "-----BEGIN CERTIFICATE-----",
>
>   "insertPolicy": "external"
>
> }
>
>
>
> Basic policy engine in two files
>
> *enforce_policy.py*
>
> import os
>
> import sys
>
> import pathlib
>
>
>
> cose_path = pathlib.Path(sys.argv[-1])
>
> policy_action_path = cose_path.with_suffix(".policy." + os.environ["POLICY_ACTION"].lower())
>
> policy_action_path.write_text("")
>
>
>
> Simple drop rule based on claim content blocklist.
>
> *is_on_blocklist.py*
>
> import os
>
> import sys
>
> import json
>
>
>
> import cbor2
>
> import pycose
>
> from pycose.messages import CoseMessage, Sign1Message
>
>
>
> from scitt_emulator.scitt import ClaimInvalidError, COSE_Headers_Issuer
>
>
>
> BLOCKLIST_DEFAULT = [
>
>     "did:web:example.com",
>
> ]
>
> BLOCKLIST_DEFAULT_JSON = json.dumps(BLOCKLIST_DEFAULT)
>
> BLOCKLIST = json.loads(os.environ.get("BLOCKLIST", BLOCKLIST_DEFAULT_JSON))
>
>
>
> claim = sys.stdin.buffer.read()
>
>
>
> msg = CoseMessage.decode(claim)
>
>
>
> if pycose.headers.ContentType not in msg.phdr:
>
>     raise ClaimInvalidError(
>
>         "Claim does not have a content type header parameter"
>
>     )
>
> if COSE_Headers_Issuer not in msg.phdr:
>
>     raise ClaimInvalidError("Claim does not have an issuer header parameter")
>
>
>
> if msg.phdr[COSE_Headers_Issuer] not in BLOCKLIST:
>
>     sys.exit(1)
>
>
>
> # EXIT_SUCCESS == MUST block. In case of thrown errors/exceptions.
>
>
>
> Example running blocklist check and enforcement to disable issuer
> (example: did:web:example.com).
>
>
>
> $ npm install -g nodemon
>
> $ nodemon -e .cose --exec 'find workspace/storage/operations -name \*.cose -exec nohup sh -xc "echo {} && (python3 is_on_blocklist.py < {} && POLICY_ACTION=denied python3 enforce_policy.py {}) || POLICY_ACTION=insert python3 enforce_policy.py {}" \;'
>
> Create claim from blocked issuer (.com) and from non-blocked (.org).
>
> $ scitt-emulator client create-claim --issuer did:web:example.com --content-type application/json --payload '{"sun": "yellow"}' --out claim.cose
>
> Claim written to claim.cose
>
> $ scitt-emulator client submit-claim --claim claim.cose --out claim.receipt.cbor
>
> Traceback (most recent call last):
>
>   File "/home/alice/.local/bin/scitt-emulator", line 33, in <module>
>
>     sys.exit(load_entry_point('scitt-emulator', 'console_scripts', 'scitt-emulator')())
>
>   File "/home/alice/Documents/python/scitt-api-emulator/scitt_emulator/cli.py", line 22, in main
>
>     args.func(args)
>
>   File "/home/alice/Documents/python/scitt-api-emulator/scitt_emulator/client.py", line 182, in <lambda>
>
>     func=lambda args: submit_claim(
>
>   File "/home/alice/Documents/python/scitt-api-emulator/scitt_emulator/client.py", line 93, in submit_claim
>
>     raise_for_operation_status(operation)
>
>   File "/home/alice/Documents/python/scitt-api-emulator/scitt_emulator/client.py", line 29, in raise_for_operation_status
>
>     raise RuntimeError(f"Operation error: {operation['error']}")
>
> RuntimeError: Operation error: {'status': 'denied'}
>
> $ scitt-emulator client create-claim --issuer did:web:example.org --content-type application/json --payload '{"sun": "yellow"}' --out claim.cose
>
> Claim written to claim.cose
>
> $ scitt-emulator client submit-claim --claim claim.cose --out claim.receipt.cbor
>
> Claim registered with entry ID 1
>
> Receipt written to claim.receipt.cbor
>
>
> --
> SCITT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/scitt
>