You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@knox.apache.org by lm...@apache.org on 2014/03/07 22:45:04 UTC
[2/2] git commit: KNOX-303 - invalid configuration should result in
500 and appropriate error message.
KNOX-303 - invalid configuration should result in 500 and appropriate error message.
Project: http://git-wip-us.apache.org/repos/asf/knox/repo
Commit: http://git-wip-us.apache.org/repos/asf/knox/commit/bfe4ce7e
Tree: http://git-wip-us.apache.org/repos/asf/knox/tree/bfe4ce7e
Diff: http://git-wip-us.apache.org/repos/asf/knox/diff/bfe4ce7e
Branch: refs/heads/master
Commit: bfe4ce7e799a540a732ad0008e14620d48ee9a01
Parents: 1ca4faa
Author: Larry McCay <lm...@hortonworks.com>
Authored: Fri Mar 7 16:42:07 2014 -0500
Committer: Larry McCay <lm...@hortonworks.com>
Committed: Fri Mar 7 16:42:07 2014 -0500
----------------------------------------------------------------------
.../apache/hadoop/gateway/filter/AclParser.java | 104 +++++++++
.../gateway/filter/AclsAuthorizationFilter.java | 76 ++-----
.../gateway/filter/InvalidACLException.java | 31 +++
.../hadoop/gateway/filter/AclParserTest.java | 212 +++++++++++++++++++
4 files changed, 359 insertions(+), 64 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/knox/blob/bfe4ce7e/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclParser.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclParser.java b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclParser.java
new file mode 100644
index 0000000..a568537
--- /dev/null
+++ b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclParser.java
@@ -0,0 +1,104 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.gateway.filter;
+
+import java.util.ArrayList;
+import java.util.Collections;
+
+import org.apache.hadoop.gateway.util.IpAddressValidator;
+
+/**
+ * @author larry
+ */
+public class AclParser {
+
+ /**
+ *
+ */
+ public ArrayList<String> users;
+ /**
+ *
+ */
+ public ArrayList<String> groups;
+ /**
+ *
+ */
+ public boolean anyUser = true;
+ /**
+ *
+ */
+ public boolean anyGroup = true;
+ /**
+ *
+ */
+ public IpAddressValidator ipv;
+
+
+ /**
+ *
+ */
+ public AclParser() {
+ }
+
+ public void parseAcls(String acls) throws InvalidACLException {
+ if (acls != null) {
+ String[] parts = acls.split(";");
+ if (parts.length != 3) {
+ //log.invalidAclsFoundForResource(resourceRole);
+ // TODO: should probably throw an exception since this can leave
+ // us in an insecure state - either that or lock it down so that
+ // it isn't unprotected
+ throw new InvalidACLException("Invalid ACLs specified: " + acls);
+ }
+ else {
+ //log.aclsFoundForResource(resourceRole);
+ }
+ parseUserAcls(parts);
+
+ parseGroupAcls(parts);
+
+ parseIpAddressAcls(parts);
+ }
+ else {
+ //log.noAclsFoundForResource(resourceRole);
+ users = new ArrayList<String>();
+ groups = new ArrayList<String>();
+ ipv = new IpAddressValidator(null);
+ }
+ }
+
+ private void parseUserAcls(String[] parts) {
+ users = new ArrayList<String>();
+ Collections.addAll(users, parts[0].split(","));
+ if (!users.contains("*")) {
+ anyUser = false;
+ }
+ }
+
+ private void parseGroupAcls(String[] parts) {
+ groups = new ArrayList<String>();
+ Collections.addAll(groups, parts[1].split(","));
+ if (!groups.contains("*")) {
+ anyGroup = false;
+ }
+ }
+
+ private void parseIpAddressAcls(String[] parts) {
+ ipv = new IpAddressValidator(parts[2]);
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/knox/blob/bfe4ce7e/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclsAuthorizationFilter.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclsAuthorizationFilter.java b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclsAuthorizationFilter.java
index 9a1aa10..45d3a4d 100644
--- a/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclsAuthorizationFilter.java
+++ b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/AclsAuthorizationFilter.java
@@ -52,13 +52,8 @@ public class AclsAuthorizationFilter implements Filter {
AuditConstants.KNOX_SERVICE_NAME, AuditConstants.KNOX_COMPONENT_NAME );
private String resourceRole = null;
- private ArrayList<String> users;
- private ArrayList<String> groups;
- private boolean anyUser = true;
- private boolean anyGroup = true;
- private IpAddressValidator ipv = null;
-
private String aclProcessingMode = null;
+ private AclParser parser = new AclParser();
@Override
@@ -74,61 +69,14 @@ public class AclsAuthorizationFilter implements Filter {
}
log.aclProcessingMode(aclProcessingMode);
String acls = getInitParameter(filterConfig, resourceRole + ".acl");
- parseAcls(acls);
+ parser.parseAcls(acls);
}
private String getInitParameter(FilterConfig filterConfig, String paramName) {
return filterConfig.getInitParameter(paramName.toLowerCase());
}
- private void parseAcls(String acls) {
- if (acls != null) {
- String[] parts = acls.split(";");
- if (parts.length != 3 && parts.length > 0) {
- log.invalidAclsFoundForResource(resourceRole);
- // TODO: should probably throw an exception since this can leave
- // us in an insecure state - either that or lock it down so that
- // it isn't unprotected
- }
- else {
- log.aclsFoundForResource(resourceRole);
- }
- parseUserAcls(parts);
-
- parseGroupAcls(parts);
-
- parseIpAddressAcls(parts);
- }
- else {
- log.noAclsFoundForResource(resourceRole);
- users = new ArrayList<String>();
- groups = new ArrayList<String>();
- ipv = new IpAddressValidator(null);
- }
- }
-
- private void parseUserAcls(String[] parts) {
- users = new ArrayList<String>();
- Collections.addAll(users, parts[0].split(","));
- if (!users.contains("*")) {
- anyUser = false;
- }
- }
-
- private void parseGroupAcls(String[] parts) {
- groups = new ArrayList<String>();
- Collections.addAll(groups, parts[1].split(","));
- if (!groups.contains("*")) {
- anyGroup = false;
- }
- }
-
- private void parseIpAddressAcls(String[] parts) {
- ipv = new IpAddressValidator(parts[2]);
- }
-
public void destroy() {
-
}
public void doFilter(ServletRequest request, ServletResponse response,
@@ -152,7 +100,7 @@ public class AclsAuthorizationFilter implements Filter {
// before enforcing acls check whether there are no acls defined
// which would mean that there are no restrictions
- if (users.size() == 0 && groups.size() == 0 && ipv.getIPAddresses().size() == 0) {
+ if (parser.users.size() == 0 && parser.groups.size() == 0 && parser.ipv.getIPAddresses().size() == 0) {
return true;
}
@@ -184,7 +132,7 @@ public class AclsAuthorizationFilter implements Filter {
// it true if there is an anyGroup acl
// for AND mode and acls like *;*;127.0.0.* we need to
// make it pass
- if (anyGroup && aclProcessingMode.equals("AND")) {
+ if (parser.anyGroup && aclProcessingMode.equals("AND")) {
groupAccess = true;
}
}
@@ -197,9 +145,9 @@ public class AclsAuthorizationFilter implements Filter {
// to make sense and not grant access to everyone by mistake.
// exclusion in OR is equivalent to denied
// so, let's set each one that contains '*' to false.
- if (anyUser) userAccess = false;
- if (anyGroup) groupAccess = false;
- if (ipv.allowsAnyIP()) ipAddrAccess = false;
+ if (parser.anyUser) userAccess = false;
+ if (parser.anyGroup) groupAccess = false;
+ if (parser.ipv.allowsAnyIP()) ipAddrAccess = false;
return (userAccess || groupAccess || ipAddrAccess);
}
@@ -214,7 +162,7 @@ public class AclsAuthorizationFilter implements Filter {
if (remoteAddr == null) {
return false;
}
- allowed = ipv.validateIpAddress(remoteAddr);
+ allowed = parser.ipv.validateIpAddress(remoteAddr);
return allowed;
}
@@ -223,11 +171,11 @@ public class AclsAuthorizationFilter implements Filter {
if (user == null) {
return false;
}
- if (anyUser) {
+ if (parser.anyUser) {
allowed = true;
}
else {
- if (users.contains(user.getName())) {
+ if (parser.users.contains(user.getName())) {
allowed = true;
}
}
@@ -239,12 +187,12 @@ public class AclsAuthorizationFilter implements Filter {
if (userGroups == null) {
return false;
}
- if (anyGroup) {
+ if (parser.anyGroup) {
allowed = true;
}
else {
for (int i = 0; i < userGroups.length; i++) {
- if (groups.contains(((Principal)userGroups[i]).getName())) {
+ if (parser.groups.contains(((Principal)userGroups[i]).getName())) {
allowed = true;
break;
}
http://git-wip-us.apache.org/repos/asf/knox/blob/bfe4ce7e/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/InvalidACLException.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/InvalidACLException.java b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/InvalidACLException.java
new file mode 100644
index 0000000..34a4ba1
--- /dev/null
+++ b/gateway-provider-security-authz-acls/src/main/java/org/apache/hadoop/gateway/filter/InvalidACLException.java
@@ -0,0 +1,31 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.gateway.filter;
+
+/**
+ * invalid ACL configuration item
+ */
+public class InvalidACLException extends RuntimeException {
+
+ private static final long serialVersionUID = -4284269372393774095L;
+
+ public InvalidACLException(String message) {
+ super(message);
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/knox/blob/bfe4ce7e/gateway-provider-security-authz-acls/src/test/java/org/apache/hadoop/gateway/filter/AclParserTest.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-authz-acls/src/test/java/org/apache/hadoop/gateway/filter/AclParserTest.java b/gateway-provider-security-authz-acls/src/test/java/org/apache/hadoop/gateway/filter/AclParserTest.java
new file mode 100644
index 0000000..c071ea9
--- /dev/null
+++ b/gateway-provider-security-authz-acls/src/test/java/org/apache/hadoop/gateway/filter/AclParserTest.java
@@ -0,0 +1,212 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.gateway.filter;
+
+import static org.junit.Assert.*;
+
+import org.junit.Test;
+
+/**
+ * @author larry
+ *
+ */
+public class AclParserTest {
+ @Test
+ public void testValidAcls() throws Exception {
+ AclParser p = new AclParser();
+ p.parseAcls("guest;*;*");
+ assertTrue(p.users.contains("guest"));
+ assertTrue(p.anyGroup);
+ assertTrue(p.ipv.allowsAnyIP());
+
+ p = new AclParser();
+ p.parseAcls("*;admins;*");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertTrue(p.ipv.allowsAnyIP());
+
+ p = new AclParser();
+ p.parseAcls("*;*;127.0.0.1");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertTrue(p.anyGroup);
+ assertFalse(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+
+ p = new AclParser();
+ p.parseAcls("*;admins;127.0.0.1");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+
+ p = new AclParser();
+ p.parseAcls("guest;admins;127.0.0.1");
+ assertTrue(p.users.contains("guest"));
+ assertFalse(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+
+ p = new AclParser();
+ p.parseAcls("guest;*;127.0.0.1");
+ assertTrue(p.users.contains("guest"));
+ assertFalse(p.anyUser);
+ assertTrue(p.anyGroup);
+ assertFalse(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+
+ p = new AclParser();
+ p.parseAcls("*;admins;127.0.0.1");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+ }
+
+
+ @Test
+ public void testValidMultiValuedAcls() throws Exception {
+ AclParser p = new AclParser();
+ p.parseAcls("*;admins;127.0.0.1,127.0.0.2");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.2"));
+ assertFalse(p.ipv.getIPAddresses().contains("127.0.0.3"));
+
+ p = new AclParser();
+ p.parseAcls("*;admins,users;127.0.0.1,127.0.0.2");
+ assertFalse(p.users.contains("guest"));
+ assertTrue(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertTrue(p.groups.contains("users"));
+ assertFalse(p.groups.contains("hackers"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.2"));
+ assertFalse(p.ipv.getIPAddresses().contains("127.0.0.3"));
+
+ p = new AclParser();
+ p.parseAcls("guest,visitor;admins,users;127.0.0.1,127.0.0.2");
+ assertTrue(p.users.contains("guest"));
+ assertTrue(p.users.contains("visitor"));
+ assertFalse(p.users.contains("missing-guy"));
+ assertFalse(p.anyUser);
+ assertFalse(p.anyGroup);
+ assertTrue(p.groups.contains("admins"));
+ assertTrue(p.groups.contains("users"));
+ assertFalse(p.groups.contains("hackers"));
+ assertFalse(p.ipv.allowsAnyIP());
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.1"));
+ assertTrue(p.ipv.getIPAddresses().contains("127.0.0.2"));
+ assertFalse(p.ipv.getIPAddresses().contains("127.0.0.3"));
+ }
+
+ @Test
+ public void testNullACL() throws Exception {
+ AclParser p = new AclParser();
+ try {
+ p.parseAcls(null);
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ fail("NULL acl should NOT have thrown InvalidACLException.");
+ }
+ }
+
+ @Test
+ public void testInvalidAcls() throws Exception {
+ AclParser p = new AclParser();
+ try {
+ p.parseAcls("guest");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls("guest;;");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls(";;");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls(";");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls("guest;");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls(";admins");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+
+ p = new AclParser();
+ try {
+ p.parseAcls("");
+ fail("Invalid acl should have thrown InvalidACLException.");
+ }
+ catch (InvalidACLException sle) {
+ // expected
+ }
+ }
+
+}