Block action if BIB and BCB conflict on the same target - #299
Block action if BIB and BCB conflict on the same target#299william-fei wants to merge 6 commits into
Conversation
william-fei
added
sustainment
BrianSipos
left a comment
BrianSipos
left a comment
There was a problem hiding this comment.
It could be good to capture a valid/invalid use of this in an mock BPA test, which would be a stand-alone example of what works and what does not.
From the standpoint of real use cases, I don't know that a verifier role for both ops with the same target makes sense anyway. Verifying a BCB will check the integrity of the target plaintext because all encrypt algos available to BSL are AEAD and use an auth tag for integrity.
jeronstone
left a comment
jeronstone
left a comment
There was a problem hiding this comment.
#292 is now merged, which includes a MockBPA test for this. Remove the _ from _test_json_verify_bib_bcb in test_json_policy (and, you may need to change the failure condition / expected output)
william-fei
changed the title
jeronstone
left a comment
jeronstone
left a comment
There was a problem hiding this comment.
In general, there needs to be a refactor of the Query function. That can be a separate ticket, though.
One idea is to add a map { target : secop (list) } to make it easier to determine conflicts/invalid ops/etc. That would prevent the n^2 search for conflicting secops
william-fei
changed the title
|
| else | ||
| { | ||
| BSL_LOG_DEBUG("No rules matched, doing nothing"); | ||
| BSL_LOG_ERR("Invalid action: conflicting BIB and BCB operations target block %" PRIu64, |
There was a problem hiding this comment.
There may still be logic to log and accumulate the number of conflicts and then clear secops and action at the end if the number of conflicts is nonzero. This will catch and log multiple conflicts rather than giving up on the first one.
3 participants
Closes #290