[Question] can we use ipMatch in a police rule?

[skyfall2022]

Want to prioritize this issue? Try:

------

What's your scenario? What do you want to achieve?
deny the request of some type of devices from some ip addresses

Your model:

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub_rule, obj, act, eft

[policy_effect]
e = !some(where (p.eft == deny))

[matchers]
m = eval(p.sub_rule) && r.obj == p.obj && r.act == p.act

Your policy:

p, r.sub.Device == 'Android', file, send, deny
p, r.sub.Device == 'Windows' && ipMatch(r.sub.Ip, '10.0.0.0/24'), file, save, deny

Your request(s):

{Device:'Android',Ip:'10.1.0.3'}, file, send
{Device:'iOS',Ip:'10.0.0.2'}, file, save

[casbin-bot]

@tangyang9464 @JalinWang

[skyfall2022]

it will return 'Unclosed ( at character 83' if I run the test :<

[PokIsemaine]

@skyfall2022 try to add ""

p, r.sub.Device == 'Windows' && ipMatch(r.sub.Ip, '10.0.0.0/24'), file, save, deny
// Add ""
p, "r.sub.Device == 'Windows' && ipMatch(r.sub.Ip, '10.0.0.0/24')", file, save, deny

[skyfall2022]

p, r.sub.Device == 'Windows' && ipMatch(r.sub.Ip, '10.0.0.0/24'), file, save, deny

it doesn't work, the enforcement result:
Unclosed quote after "r.sub.Device == 'Windows' && ipMatch(r_sub.Ip) && r_obj == p_obj && r_act == p_act" at character 84

[PokIsemaine]

p, r.sub.Device == 'Windows' && ipMatch(r.sub.Ip, '10.0.0.0/24'), file, save, deny

it doesn't work, the enforcement result: Unclosed quote after "r.sub.Device == 'Windows' && ipMatch(r_sub.Ip) && r_obj == p_obj && r_act == p_act" at character 84

I tried running a demo locally and it didn't get an error

[PokIsemaine]

@skyfall2022
Hey, did you use Casbin Editor (Casbin Node.js) to test?
I found this different from the local results (casbin golang).

[skyfall2022]

yes, I did. I will try to use golang instead. thanks!

[hsluoyz]

@PokIsemaine why are Go and Node.js different? This is an issue that needs to fix, as we aim to provide the same result for different languages

[PokIsemaine]

@PokIsemaine why are Go and Node.js different? This is an issue that needs to fix, as we aim to provide the same result for different languages

I don't know about node-casbin yet, and it may take me a while to investigate the cause.

[casbin-bot]

@nodece

[nodece]

Please update your policy:

p, r.sub.Device == 'Android', file, send, deny
p, "r.sub.Device == 'IOS' && ipMatch(r.sub.Ip,'10.0.0.0/24')", file, save, deny