You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by da...@apache.org on 2018/07/04 10:20:31 UTC
[sling-whiteboard] branch master updated: Start of an
implementation of Feature Model API Whitelist support
This is an automated email from the ASF dual-hosted git repository.
davidb pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-whiteboard.git
The following commit(s) were added to refs/heads/master by this push:
new 679dc82 Start of an implementation of Feature Model API Whitelist support
679dc82 is described below
commit 679dc82ecb4931474129f9248f971781716ddc19
Author: David Bosschaert <da...@gmail.com>
AuthorDate: Wed Jul 4 11:16:56 2018 +0100
Start of an implementation of Feature Model API Whitelist support
As described in https://github.com/apache/sling-org-apache-sling-feature/blob/master/apicontroller.md
---
featuremodel/feature-service/pom.xml | 85 ++++++++++++++
.../sling/feature/service/FeatureService.java | 28 +++++
.../feature/service/impl/FeatureServiceImpl.java | 23 ++++
.../apache/sling/feature/service/package-info.java | 23 ++++
.../service/impl/FeatureServiceImplTest.java | 28 +++++
featuremodel/feature-whitelist/pom.xml | 101 +++++++++++++++++
.../sling/feature/whitelist/WhitelistService.java | 35 ++++++
.../sling/feature/whitelist/impl/Activator.java | 55 +++++++++
.../feature/whitelist/impl/ResolverHookImpl.java | 126 +++++++++++++++++++++
.../feature/whitelist/impl/WhitelistEnforcer.java | 111 ++++++++++++++++++
.../whitelist/impl/WhitelistServiceImpl.java | 64 +++++++++++
.../whitelist/impl/WhitelistEnforcerTest.java | 23 ++++
.../whitelist/impl/WhitelistServiceImplTest.java | 61 ++++++++++
13 files changed, 763 insertions(+)
diff --git a/featuremodel/feature-service/pom.xml b/featuremodel/feature-service/pom.xml
new file mode 100644
index 0000000..3c93d25
--- /dev/null
+++ b/featuremodel/feature-service/pom.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+ <!--
+ Licensed to the Apache Software Foundation (ASF) under one or more contributor license
+ agreements. See the NOTICE file distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file to you under the Apache License,
+ Version 2.0 (the "License"); you may not use this file except in compliance with the
+ License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software distributed under the
+ License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ either express or implied. See the License for the specific language governing permissions
+ and limitations under the License.
+ -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>sling</artifactId>
+ <version>33</version>
+ <relativePath />
+ </parent>
+
+ <artifactId>org.apache.sling.feature.service</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ <packaging>bundle</packaging>
+
+ <name>Apache Sling Feature Runtime Service</name>
+ <description>
+ A runtime service to interact with the feature model
+ </description>
+
+ <properties>
+ <sling.java.version>8</sling.java.version>
+ </properties>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.felix</groupId>
+ <artifactId>maven-bundle-plugin</artifactId>
+ <extensions>true</extensions>
+ <configuration>
+ <!-- Skip baselining for 0.x version -->
+ <skip>true</skip>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.rat</groupId>
+ <artifactId>apache-rat-plugin</artifactId>
+ <configuration>
+ <excludes>
+ <exclude>*.md</exclude>
+ </excludes>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>org.apache.sling.feature</artifactId>
+ <version>0.1.2</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.osgi</groupId>
+ <artifactId>org.osgi.annotation.versioning</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.osgi</groupId>
+ <artifactId>osgi.core</artifactId>
+ <scope>provided</scope>
+ </dependency>
+
+ <!-- Testing -->
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <scope>test</scope>
+ </dependency>
+
+ </dependencies>
+</project>
diff --git a/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/FeatureService.java b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/FeatureService.java
new file mode 100644
index 0000000..a9fe2de
--- /dev/null
+++ b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/FeatureService.java
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.service;
+
+import org.apache.sling.feature.Feature;
+
+import java.util.Collection;
+
+public interface FeatureService {
+ Collection<Feature> listFeatures();
+ Feature getFeature(long bundleId);
+}
diff --git a/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/impl/FeatureServiceImpl.java b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/impl/FeatureServiceImpl.java
new file mode 100644
index 0000000..cf138ae
--- /dev/null
+++ b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/impl/FeatureServiceImpl.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.service.impl;
+
+public class FeatureServiceImpl {
+
+}
diff --git a/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/package-info.java b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/package-info.java
new file mode 100644
index 0000000..5fbfdc0
--- /dev/null
+++ b/featuremodel/feature-service/src/main/java/org/apache/sling/feature/service/package-info.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+@org.osgi.annotation.versioning.Version("0.1.0")
+package org.apache.sling.feature.service;
+
+
diff --git a/featuremodel/feature-service/src/test/java/org/apache/sling/feature/service/impl/FeatureServiceImplTest.java b/featuremodel/feature-service/src/test/java/org/apache/sling/feature/service/impl/FeatureServiceImplTest.java
new file mode 100644
index 0000000..6b6e486
--- /dev/null
+++ b/featuremodel/feature-service/src/test/java/org/apache/sling/feature/service/impl/FeatureServiceImplTest.java
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.service.impl;
+
+import org.junit.Test;
+
+public class FeatureServiceImplTest {
+ @Test
+ public void testFeatureService() {
+// fail();
+ }
+}
diff --git a/featuremodel/feature-whitelist/pom.xml b/featuremodel/feature-whitelist/pom.xml
new file mode 100644
index 0000000..6e5fc2d
--- /dev/null
+++ b/featuremodel/feature-whitelist/pom.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+ <!--
+ Licensed to the Apache Software Foundation (ASF) under one or more contributor license
+ agreements. See the NOTICE file distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file to you under the Apache License,
+ Version 2.0 (the "License"); you may not use this file except in compliance with the
+ License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software distributed under the
+ License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ either express or implied. See the License for the specific language governing permissions
+ and limitations under the License.
+ -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>sling</artifactId>
+ <version>33</version>
+ <relativePath />
+ </parent>
+
+ <artifactId>org.apache.sling.feature.whitelist</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ <packaging>bundle</packaging>
+
+ <name>Apache Sling Feature API Whitelist component</name>
+ <description>
+ A runtime component to enforce API Whitelisting
+ </description>
+
+ <properties>
+ <sling.java.version>8</sling.java.version>
+ </properties>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.felix</groupId>
+ <artifactId>maven-bundle-plugin</artifactId>
+ <extensions>true</extensions>
+ <configuration>
+ <!-- Skip baselining for 0.x version -->
+ <skip>true</skip>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.rat</groupId>
+ <artifactId>apache-rat-plugin</artifactId>
+ <configuration>
+ <excludes>
+ <exclude>*.md</exclude>
+ </excludes>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>org.apache.sling.feature</artifactId>
+ <version>0.1.2</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sling</groupId>
+ <artifactId>org.apache.sling.feature.service</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.osgi</groupId>
+ <artifactId>org.osgi.annotation.versioning</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.osgi</groupId>
+ <artifactId>osgi.core</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.osgi</groupId>
+ <artifactId>osgi.cmpn</artifactId>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-api</artifactId>
+ <scope>provided</scope>
+ </dependency>
+
+ <!-- Testing -->
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <scope>test</scope>
+ </dependency>
+
+ </dependencies>
+</project>
diff --git a/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/WhitelistService.java b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/WhitelistService.java
new file mode 100644
index 0000000..0136b9c
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/WhitelistService.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist;
+
+import java.util.Set;
+
+public interface WhitelistService {
+ final static String GLOBAL_REGION = "global";
+
+ /**
+ * List the regions that a given feature is part of
+ * @param feature The feature ID in mvn syntax.
+ * @return A set of regions.
+ */
+ Set<String> listRegions(String feature);
+
+ boolean regionContainsPackage(String region, String packageName);
+
+}
diff --git a/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/Activator.java b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/Activator.java
new file mode 100644
index 0000000..92ba241
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/Activator.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+import org.apache.sling.feature.service.FeatureService;
+import org.osgi.framework.BundleActivator;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.Constants;
+import org.osgi.framework.ServiceRegistration;
+import org.osgi.framework.hooks.resolver.ResolverHookFactory;
+import org.osgi.service.cm.ManagedService;
+import org.osgi.util.tracker.ServiceTracker;
+
+import java.util.Dictionary;
+import java.util.Hashtable;
+
+public class Activator implements BundleActivator {
+ private ServiceTracker<FeatureService, FeatureService> tracker;
+ private ServiceRegistration<?> resolverHookServiceRegistration;
+
+ @Override
+ public synchronized void start(BundleContext context) throws Exception {
+ tracker = new ServiceTracker<>(context, FeatureService.class, null);
+ tracker.open();
+
+ WhitelistEnforcer whitelistEnforcer = new WhitelistEnforcer(tracker);
+ Dictionary<String, Object> resHookProps = new Hashtable<>();
+ resHookProps.put(Constants.SERVICE_PID, WhitelistEnforcer.class.getName());
+ resolverHookServiceRegistration = context.registerService(
+ new String[] {ManagedService.class.getName(), ResolverHookFactory.class.getName()},
+ whitelistEnforcer, resHookProps);
+ }
+
+ @Override
+ public synchronized void stop(BundleContext context) throws Exception {
+ resolverHookServiceRegistration.unregister();
+ tracker.close();
+ }
+}
diff --git a/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/ResolverHookImpl.java b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/ResolverHookImpl.java
new file mode 100644
index 0000000..0c7e1a0
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/ResolverHookImpl.java
@@ -0,0 +1,126 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+import org.apache.sling.feature.Feature;
+import org.apache.sling.feature.service.FeatureService;
+import org.apache.sling.feature.whitelist.WhitelistService;
+import org.osgi.framework.hooks.resolver.ResolverHook;
+import org.osgi.framework.namespace.PackageNamespace;
+import org.osgi.framework.wiring.BundleCapability;
+import org.osgi.framework.wiring.BundleRequirement;
+import org.osgi.framework.wiring.BundleRevision;
+import org.osgi.util.tracker.ServiceTracker;
+
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.Set;
+
+public class ResolverHookImpl implements ResolverHook {
+ private static final long SERVICE_WAIT_TIMEOUT = 60000;
+
+ private final ServiceTracker<FeatureService, FeatureService> featureServiceTracker;
+ private final WhitelistService whitelistService;
+
+ public ResolverHookImpl(ServiceTracker<FeatureService, FeatureService> tracker,
+ WhitelistService wls) {
+ featureServiceTracker = tracker;
+ whitelistService = wls;
+ }
+
+ @Override
+ public void filterResolvable(Collection<BundleRevision> candidates) {
+ // Nothing to do
+ }
+
+ @Override
+ public void filterSingletonCollisions(BundleCapability singleton, Collection<BundleCapability> collisionCandidates) {
+ // Nothing to do
+ }
+
+ @Override
+ public void filterMatches(BundleRequirement requirement, Collection<BundleCapability> candidates) {
+ // Filtering is only on package resolution. Any other kind of resolution is not limited
+ if (!PackageNamespace.PACKAGE_NAMESPACE.equals(requirement.getNamespace()))
+ return;
+
+ long reqBundleID = requirement.getRevision().getBundle().getBundleId();
+
+ try {
+ FeatureService fs = featureServiceTracker.waitForService(SERVICE_WAIT_TIMEOUT);
+
+ // The Feature Service could not be found, skip candidate pruning
+ if (fs == null) {
+ WhitelistEnforcer.LOG.warn("Could not obtain the feature service, no whitelist enforcement");
+ return;
+ }
+
+ Feature reqFeat = fs.getFeature(reqBundleID);
+ Set<String> regions = whitelistService.listRegions(reqFeat.getId().toMvnId());
+
+ nextCapability:
+ for (Iterator<BundleCapability> it = candidates.iterator(); it.hasNext(); ) {
+ BundleCapability bc = it.next();
+
+ BundleRevision rev = bc.getRevision();
+
+ // A bundle is allowed to wire to itself
+ long capBundleID = rev.getBundle().getBundleId();
+ if (capBundleID == reqBundleID)
+ continue nextCapability;
+
+ Feature capFeat = fs.getFeature(capBundleID);
+
+ // Within a single feature everything can wire to everything else
+ if (capFeat.equals(reqFeat))
+ continue nextCapability;
+
+
+ Object pkg = bc.getAttributes().get(PackageNamespace.PACKAGE_NAMESPACE);
+ if (pkg instanceof String) {
+ String packageName = (String) pkg;
+ // If the export is in the global region.
+ if (whitelistService.regionContainsPackage(WhitelistService.GLOBAL_REGION, packageName))
+ continue nextCapability;
+
+ // If the export is in a region that the feature is also in, then allow
+ for (String region : regions) {
+ // We've done this one already
+ if (WhitelistService.GLOBAL_REGION.equals(region))
+ continue;
+
+ if (whitelistService.regionContainsPackage(region, packageName))
+ continue nextCapability;
+ }
+
+ // The capability package is not visible by the requirer
+ // remove from the candidates.
+ it.remove();
+ }
+ }
+ } catch (InterruptedException e) {
+ // ignore
+ }
+ }
+
+ @Override
+ public void end() {
+ // Nothing to do
+ }
+}
diff --git a/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcer.java b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcer.java
new file mode 100644
index 0000000..609c34f
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcer.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+import org.apache.sling.feature.service.FeatureService;
+import org.apache.sling.feature.whitelist.WhitelistService;
+import org.osgi.framework.hooks.resolver.ResolverHook;
+import org.osgi.framework.hooks.resolver.ResolverHookFactory;
+import org.osgi.framework.wiring.BundleRevision;
+import org.osgi.service.cm.ConfigurationException;
+import org.osgi.service.cm.ManagedService;
+import org.osgi.util.tracker.ServiceTracker;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Dictionary;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+public class WhitelistEnforcer implements ResolverHookFactory, ManagedService {
+ private static final String CONFIG_REGION_MAPPING_PREFIX = "whitelist.region.";
+ private static final String CONFIG_FEATURE_MAPPING_PREFIX = "whitelist.feature.";
+ static final Logger LOG = LoggerFactory.getLogger(WhitelistEnforcer.class);
+
+ final ServiceTracker<FeatureService, FeatureService> featureServiceTracker;
+ volatile WhitelistService whitelistService = new NullWhitelistService();
+
+ public WhitelistEnforcer(ServiceTracker<FeatureService, FeatureService> tracker) {
+ featureServiceTracker = tracker;
+ }
+
+ @Override
+ public ResolverHook begin(Collection<BundleRevision> triggers) {
+ return new ResolverHookImpl(featureServiceTracker, whitelistService);
+ }
+
+ @Override
+ public void updated(Dictionary<String, ?> properties) throws ConfigurationException {
+ if (properties == null) {
+ whitelistService = new NullWhitelistService();
+ return;
+ }
+
+ Map<String, Set<String>> frm = new HashMap<>();
+ Map<String, Set<String>> rpm = new HashMap<>();
+
+ for (Enumeration<String> e = properties.keys(); e.hasMoreElements(); ) {
+ String key = e.nextElement().trim();
+
+ if (key.startsWith(CONFIG_REGION_MAPPING_PREFIX)) {
+ String region = key.substring(CONFIG_REGION_MAPPING_PREFIX.length());
+ Set<String> packages = getStringPlusValue(properties.get(key));
+ rpm.put(region, packages);
+ } else if (key.startsWith(CONFIG_FEATURE_MAPPING_PREFIX)) {
+ String feature = key.substring(CONFIG_FEATURE_MAPPING_PREFIX.length());
+ Set<String> regions = getStringPlusValue(properties.get(key));
+ frm.put(feature, regions);
+ }
+ }
+
+ whitelistService = new WhitelistServiceImpl(rpm, frm);
+ }
+
+ private Set<String> getStringPlusValue(Object val) {
+ if (val == null)
+ return null;
+
+ if (val instanceof Collection) {
+ return ((Collection<?>) val).stream().map(Object::toString).collect(Collectors.toSet());
+ } else if (val instanceof String[]) {
+ return new HashSet<>(Arrays.asList((String[]) val));
+ }
+ return Collections.singleton(val.toString());
+ }
+
+ private static class NullWhitelistService implements WhitelistService {
+ @Override
+ public Set<String> listRegions(String feature) {
+ return null;
+ }
+
+ @Override
+ public boolean regionContainsPackage(String region, String packageName) {
+ return true;
+ }
+ }
+
+}
diff --git a/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImpl.java b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImpl.java
new file mode 100644
index 0000000..e3a4c8a
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/main/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImpl.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+import org.apache.sling.feature.whitelist.WhitelistService;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+public class WhitelistServiceImpl implements WhitelistService {
+ final Map<String, Set<String>> featureRegionMapping;
+ final Map<String, Set<String>> regionPackageMapping;
+
+ WhitelistServiceImpl(Map<String, Set<String>> regionPackages,
+ Map<String, Set<String>> featureRegions) {
+ Map<String, Set<String>> rpm = new HashMap<>();
+ for (Map.Entry<String, Set<String>> entry : regionPackages.entrySet()) {
+ rpm.put(entry.getKey(),
+ Collections.unmodifiableSet(new HashSet<>(entry.getValue())));
+ }
+ regionPackageMapping = Collections.unmodifiableMap(rpm);
+
+ Map<String, Set<String>> frm = new HashMap<>();
+ for (Map.Entry<String, Set<String>> entry : featureRegions.entrySet()) {
+ frm.put(entry.getKey(),
+ Collections.unmodifiableSet(new HashSet<>(entry.getValue())));
+ }
+ featureRegionMapping = Collections.unmodifiableMap(frm);
+ }
+
+ @Override
+ public Set<String> listRegions(String featureID) {
+ return featureRegionMapping.get(featureID);
+ }
+
+ @Override
+ public boolean regionContainsPackage(String region, String packageName) {
+ Set<String> packages = regionPackageMapping.get(region);
+
+ if (packages == null)
+ return false;
+
+ return packages.contains(packageName);
+ }
+}
diff --git a/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcerTest.java b/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcerTest.java
new file mode 100644
index 0000000..145b0af
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistEnforcerTest.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+public class WhitelistEnforcerTest {
+
+}
diff --git a/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImplTest.java b/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImplTest.java
new file mode 100644
index 0000000..9168958
--- /dev/null
+++ b/featuremodel/feature-whitelist/src/test/java/org/apache/sling/feature/whitelist/impl/WhitelistServiceImplTest.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sling.feature.whitelist.impl;
+
+import org.apache.sling.feature.whitelist.WhitelistService;
+import org.junit.Test;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class WhitelistServiceImplTest {
+ @Test
+ public void testListRegions() {
+ Map<String, Set<String>> frm = new HashMap<>();
+ frm.put("myfeature", new HashSet<>(Arrays.asList("rega", "regb", "regc")));
+ frm.put("myotherfeature", Collections.emptySet());
+ WhitelistService wls = new WhitelistServiceImpl(Collections.emptyMap(), frm);
+
+ assertEquals(new HashSet<>(Arrays.asList("rega", "regb", "regc")),
+ wls.listRegions("myfeature"));
+ assertEquals(0, wls.listRegions("myotherfeature").size());
+ assertNull(wls.listRegions("nonexistent"));
+ }
+
+ @Test
+ public void testRegionContainsPackage() {
+ Map<String, Set<String>> rpm = new HashMap<>();
+ rpm.put("region1", new HashSet<>(Arrays.asList("org.foo", "org.bar", "org.foo.bar")));
+ WhitelistService wls = new WhitelistServiceImpl(rpm, Collections.emptyMap());
+
+ assertTrue(wls.regionContainsPackage("region1", "org.foo"));
+ assertTrue(wls.regionContainsPackage("region1", "org.foo.bar"));
+ assertFalse(wls.regionContainsPackage("region1", "org.bar.foo"));
+ assertFalse(wls.regionContainsPackage("nonexitent", "org.foo"));
+ }
+}