You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ignite.apache.org by al...@apache.org on 2020/07/17 12:07:18 UTC
[ignite] branch ignite-2.9 updated: IGNITE-13228 Remote filter of
IgniteEvents has to run with appropriate SecurityContext - Fixes #8017.
This is an automated email from the ASF dual-hosted git repository.
alexpl pushed a commit to branch ignite-2.9
in repository https://gitbox.apache.org/repos/asf/ignite.git
The following commit(s) were added to refs/heads/ignite-2.9 by this push:
new 09a3fb6 IGNITE-13228 Remote filter of IgniteEvents has to run with appropriate SecurityContext - Fixes #8017.
09a3fb6 is described below
commit 09a3fb6553deec55c9ad7485188ce13e9a92b8fd
Author: d.garus <ga...@gmail.com>
AuthorDate: Fri Jul 17 17:02:51 2020 +0500
IGNITE-13228 Remote filter of IgniteEvents has to run with appropriate SecurityContext - Fixes #8017.
Signed-off-by: Aleksey Plekhanov <pl...@gmail.com>
(cherry picked from commit cc8bbdcfaf35a41f84ad176dc8914003bccc9220)
---
.../apache/ignite/internal/IgniteEventsImpl.java | 21 ++-
.../ignite/internal/SecurityAwarePredicate.java | 57 +++++++
.../EventsRemoteSecurityContextCheckTest.java | 169 +++++++++++++++++++++
.../ignite/testsuites/SecurityTestSuite.java | 2 +
4 files changed, 247 insertions(+), 2 deletions(-)
diff --git a/modules/core/src/main/java/org/apache/ignite/internal/IgniteEventsImpl.java b/modules/core/src/main/java/org/apache/ignite/internal/IgniteEventsImpl.java
index d683ecb..4e5a7bb 100644
--- a/modules/core/src/main/java/org/apache/ignite/internal/IgniteEventsImpl.java
+++ b/modules/core/src/main/java/org/apache/ignite/internal/IgniteEventsImpl.java
@@ -133,7 +133,7 @@ public class IgniteEventsImpl extends AsyncSupportAdapter<IgniteEvents> implemen
try {
GridEventConsumeHandler hnd = new GridEventConsumeHandler((IgniteBiPredicate<UUID, Event>)locLsnr,
- (IgnitePredicate<Event>)rmtFilter, types);
+ securityAwareRemoteFilter(rmtFilter), types);
return saveOrGet(ctx.continuous().startRoutine(
hnd,
@@ -162,7 +162,7 @@ public class IgniteEventsImpl extends AsyncSupportAdapter<IgniteEvents> implemen
try {
GridEventConsumeHandler hnd = new GridEventConsumeHandler((IgniteBiPredicate<UUID, Event>)locLsnr,
- (IgnitePredicate<Event>)rmtFilter, types);
+ securityAwareRemoteFilter(rmtFilter), types);
return new IgniteFutureImpl<>(ctx.continuous().startRoutine(
hnd,
@@ -180,6 +180,23 @@ public class IgniteEventsImpl extends AsyncSupportAdapter<IgniteEvents> implemen
}
}
+ /**
+ * @param original Original IgnitePredicate.
+ * @return Security aware IgnitePredicate.
+ */
+ private <T> IgnitePredicate<Event> securityAwareRemoteFilter(IgnitePredicate<T> original) {
+ IgnitePredicate<Event> res = (IgnitePredicate<Event>)original;
+
+ if (ctx.security().enabled()) {
+ final UUID subjId = ctx.security().securityContext().subject().id();
+
+ return new SecurityAwarePredicate<>(subjId, res);
+
+ }
+
+ return res;
+ }
+
/** {@inheritDoc} */
@Override public void stopRemoteListen(UUID opId) {
A.notNull(opId, "consumeId");
diff --git a/modules/core/src/main/java/org/apache/ignite/internal/SecurityAwarePredicate.java b/modules/core/src/main/java/org/apache/ignite/internal/SecurityAwarePredicate.java
new file mode 100644
index 0000000..b175957
--- /dev/null
+++ b/modules/core/src/main/java/org/apache/ignite/internal/SecurityAwarePredicate.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.internal;
+
+import java.util.UUID;
+import org.apache.ignite.internal.processors.security.AbstractSecurityAwareExternalizable;
+import org.apache.ignite.internal.processors.security.IgniteSecurity;
+import org.apache.ignite.internal.processors.security.OperationSecurityContext;
+import org.apache.ignite.lang.IgnitePredicate;
+
+/**
+ * Security aware IgnitePredicate.
+ */
+public class SecurityAwarePredicate<E> extends AbstractSecurityAwareExternalizable<IgnitePredicate<E>>
+ implements IgnitePredicate<E> {
+ /** */
+ private static final long serialVersionUID = 0L;
+
+ /**
+ * Default constructor.
+ */
+ public SecurityAwarePredicate() {
+ // No-op.
+ }
+
+ /**
+ * @param subjectId Security subject id.
+ * @param original Original predicate.
+ */
+ public SecurityAwarePredicate(UUID subjectId, IgnitePredicate<E> original) {
+ super(subjectId, original);
+ }
+
+ /** {@inheritDoc} */
+ @Override public boolean apply(E e) {
+ IgniteSecurity security = ignite.context().security();
+
+ try (OperationSecurityContext c = security.withContext(subjectId)) {
+ return original.apply(e);
+ }
+ }
+}
diff --git a/modules/core/src/test/java/org/apache/ignite/internal/processors/security/events/EventsRemoteSecurityContextCheckTest.java b/modules/core/src/test/java/org/apache/ignite/internal/processors/security/events/EventsRemoteSecurityContextCheckTest.java
new file mode 100644
index 0000000..c43e390
--- /dev/null
+++ b/modules/core/src/test/java/org/apache/ignite/internal/processors/security/events/EventsRemoteSecurityContextCheckTest.java
@@ -0,0 +1,169 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.internal.processors.security.events;
+
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.BiFunction;
+import org.apache.ignite.Ignite;
+import org.apache.ignite.IgniteCache;
+import org.apache.ignite.IgniteEvents;
+import org.apache.ignite.Ignition;
+import org.apache.ignite.cache.CacheMode;
+import org.apache.ignite.configuration.CacheConfiguration;
+import org.apache.ignite.configuration.IgniteConfiguration;
+import org.apache.ignite.events.CacheEvent;
+import org.apache.ignite.events.Event;
+import org.apache.ignite.events.EventType;
+import org.apache.ignite.internal.processors.security.AbstractRemoteSecurityContextCheckTest;
+import org.apache.ignite.lang.IgnitePredicate;
+import org.junit.Test;
+
+/**
+ * Testing operation security context when the remote filter of IgniteEvents is executed on remote nodes.
+ * <p>
+ * The initiator node broadcasts a task to 'run' nodes that register the remote filter on check nodes. The filter is
+ * executed on 'check' nodes. On every step, it is performed verification that operation security context is the
+ * initiator context.
+ */
+public class EventsRemoteSecurityContextCheckTest extends AbstractRemoteSecurityContextCheckTest {
+ /** Server node to change cache state. */
+ private static final String SRV = "srv";
+
+ /** Name of server feature transit node. */
+ private static final String SRV_CHECK_ADDITIONAL = "srv_check_additional";
+
+ /** Index to generate a unique topic and the synchronized set value. */
+ private static final AtomicInteger INDEX = new AtomicInteger();
+
+ /** Map to sync filters. */
+ private static final Map<String, CountDownLatch> SYNC_MAP = new ConcurrentHashMap<>();
+
+ /** {@inheritDoc} */
+ @Override protected void beforeTestsStarted() throws Exception {
+ startGridAllowAll(SRV);
+
+ startGridAllowAll(SRV_INITIATOR);
+
+ startClientAllowAll(CLNT_INITIATOR);
+
+ startGridAllowAll(SRV_RUN);
+
+ startClientAllowAll(CLNT_RUN);
+
+ startGridAllowAll(SRV_CHECK);
+
+ startGridAllowAll(SRV_CHECK_ADDITIONAL);
+
+ awaitPartitionMapExchange();
+ }
+
+ /** {@inheritDoc} */
+ @Override protected IgniteConfiguration getConfiguration(String instanceName) throws Exception {
+ return super.getConfiguration(instanceName).setIncludeEventTypes(EventType.EVTS_ALL);
+ }
+
+ /** */
+ @Test
+ public void testRemoteListen() {
+ BiFunction<IgniteEvents, String, UUID> f = new BiFunction<IgniteEvents, String, UUID>() {
+ @Override public UUID apply(IgniteEvents evts, String cacheName) {
+ return evts.remoteListen((uuid, e) -> true, remoteFilter(cacheName), EventType.EVT_CACHE_OBJECT_PUT);
+ }
+ };
+
+ execute(f);
+ }
+
+ /** */
+ @Test
+ public void testRemoteListenAsync() {
+ BiFunction<IgniteEvents, String, UUID> f = new BiFunction<IgniteEvents, String, UUID>() {
+ @Override public UUID apply(IgniteEvents evts, String cacheName) {
+ return evts.remoteListenAsync((uuid, e) -> true, remoteFilter(cacheName), EventType.EVT_CACHE_OBJECT_PUT)
+ .get();
+ }
+ };
+
+ execute(f);
+ }
+
+ /** */
+ private void execute(BiFunction<IgniteEvents, String, UUID> func) {
+ SYNC_MAP.clear();
+
+ runAndCheck(() -> {
+ String cacheName = "test_cache_" + INDEX.incrementAndGet();
+
+ SYNC_MAP.put(cacheName, new CountDownLatch(nodesToCheck().size()));
+
+ IgniteCache<String, String> cache = grid(SRV).createCache(new CacheConfiguration<String, String>(cacheName)
+ .setCacheMode(CacheMode.REPLICATED));
+
+ Ignite loc = Ignition.localIgnite();
+
+ IgniteEvents evts = loc.events(loc.cluster().forNodeIds(nodesToCheckIds()));
+
+ UUID id = func.apply(evts, cacheName);
+
+ try {
+ cache.put("key", "value");
+
+ SYNC_MAP.get(cacheName).await(10, TimeUnit.SECONDS);
+ }
+ catch (InterruptedException e) {
+ throw new RuntimeException(e);
+ }
+ finally {
+ evts.stopRemoteListen(id);
+ }
+ });
+ }
+
+ /** */
+ private IgnitePredicate<Event> remoteFilter(final String cacheName) {
+ return e -> {
+ CacheEvent evt = (CacheEvent)e;
+
+ if (cacheName.equals(evt.cacheName())) {
+ VERIFIER.register(OPERATION_CHECK);
+
+ SYNC_MAP.get(cacheName).countDown();
+ }
+
+ return true;
+ };
+ }
+
+ /** {@inheritDoc} */
+ @Override protected Collection<String> endpoints() {
+ return Collections.emptyList();
+ }
+
+ /** {@inheritDoc} */
+ @Override protected Collection<String> nodesToCheck() {
+ return Arrays.asList(SRV_CHECK, SRV_CHECK_ADDITIONAL);
+ }
+}
diff --git a/modules/core/src/test/java/org/apache/ignite/testsuites/SecurityTestSuite.java b/modules/core/src/test/java/org/apache/ignite/testsuites/SecurityTestSuite.java
index 0667243..c416700 100644
--- a/modules/core/src/test/java/org/apache/ignite/testsuites/SecurityTestSuite.java
+++ b/modules/core/src/test/java/org/apache/ignite/testsuites/SecurityTestSuite.java
@@ -44,6 +44,7 @@ import org.apache.ignite.internal.processors.security.compute.closure.Distribute
import org.apache.ignite.internal.processors.security.compute.closure.ExecutorServiceRemoteSecurityContextCheckTest;
import org.apache.ignite.internal.processors.security.datastreamer.DataStreamerPermissionCheckTest;
import org.apache.ignite.internal.processors.security.datastreamer.closure.DataStreamerRemoteSecurityContextCheckTest;
+import org.apache.ignite.internal.processors.security.events.EventsRemoteSecurityContextCheckTest;
import org.apache.ignite.internal.processors.security.messaging.MessagingRemoteSecurityContextCheckTest;
import org.apache.ignite.internal.processors.security.sandbox.AccessToClassesInsideInternalPackageTest;
import org.apache.ignite.internal.processors.security.sandbox.CacheSandboxTest;
@@ -88,6 +89,7 @@ import org.junit.runners.Suite;
ThinClientSslPermissionCheckTest.class,
ThinClientSecurityContextOnRemoteNodeTest.class,
MessagingRemoteSecurityContextCheckTest.class,
+ EventsRemoteSecurityContextCheckTest.class,
InvalidServerTest.class,
AdditionalSecurityCheckTest.class,