Skip to content

Commit 6df14c8

Browse files
jinmeiliaojinmeiliao
authored
GEODE-3974: Core function security improvement (#1310)
1 parent 6501fb5 commit 6df14c8

File tree

62 files changed

+764
-336
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+764
-336
lines changed

‎geode-connectors/src/test/java/org/apache/geode/connectors/jdbc/internal/cli/JDBCConnectorFunctionsSecurityTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ public static void setupClass() {
7777
functionStringMap.keySet().forEach(FunctionService::registerFunction);
7878
}
7979

80-
8180
@Test
8281
@ConnectionConfiguration(user = "user", password = "user")
8382
public void functionRequireExpectedPermission() throws Exception {
@@ -86,7 +85,8 @@ public void functionRequireExpectedPermission() throws Exception {
8685
String permission = entry.getValue();
8786
gfsh.executeAndAssertThat("execute function --id=" + function.getId())
8887
.tableHasRowCount("Function Execution Result", 1)
89-
.tableHasColumnWithValuesContaining("Function Execution Result", permission)
88+
.tableHasRowWithValues("Function Execution Result",
89+
"Exception: user not authorized for " + permission)
9090
.statusIsError();
9191
});
9292
}

‎geode-core/src/main/java/org/apache/geode/internal/cache/execute/util/FindRestEnabledServersFunction.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,7 @@
1515
package org.apache.geode.internal.cache.execute.util;
1616

1717
import org.apache.geode.cache.CacheClosedException;
18-
import org.apache.geode.cache.CacheFactory;
19-
import org.apache.geode.cache.execute.FunctionAdapter;
18+
import org.apache.geode.cache.execute.Function;
2019
import org.apache.geode.cache.execute.FunctionContext;
2120
import org.apache.geode.distributed.internal.DistributionConfig;
2221
import org.apache.geode.distributed.internal.InternalDistributedSystem;
@@ -30,7 +29,7 @@
3029
*
3130
* @since GemFire 8.1
3231
*/
33-
public class FindRestEnabledServersFunction extends FunctionAdapter implements InternalEntity {
32+
public class FindRestEnabledServersFunction implements Function, InternalEntity {
3433
private static final long serialVersionUID = 7851518767859544678L;
3534

3635
/**
@@ -42,7 +41,7 @@ public class FindRestEnabledServersFunction extends FunctionAdapter implements I
4241

4342
public void execute(FunctionContext context) {
4443
try {
45-
InternalCache cache = (InternalCache) CacheFactory.getAnyInstance();
44+
InternalCache cache = (InternalCache) context.getCache();
4645
DistributionConfig config = InternalDistributedSystem.getAnyInstance().getConfig();
4746

4847
String bindAddress = RestAgent.getBindAddressForHttpService(config);

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/AlterRuntimeConfigFunction.java‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,16 @@
1414
*/
1515
package org.apache.geode.management.internal.cli.functions;
1616

17+
import java.util.Collection;
18+
import java.util.Collections;
1719
import java.util.Map;
1820
import java.util.Map.Entry;
1921
import java.util.Set;
2022

2123
import org.apache.logging.log4j.Logger;
2224

2325
import org.apache.geode.cache.CacheClosedException;
24-
import org.apache.geode.cache.execute.FunctionAdapter;
26+
import org.apache.geode.cache.execute.Function;
2527
import org.apache.geode.cache.execute.FunctionContext;
2628
import org.apache.geode.distributed.internal.DistributionConfig;
2729
import org.apache.geode.internal.ConfigSource;
@@ -30,8 +32,10 @@
3032
import org.apache.geode.internal.logging.LogService;
3133
import org.apache.geode.management.internal.cli.CliUtil;
3234
import org.apache.geode.management.internal.cli.i18n.CliStrings;
35+
import org.apache.geode.management.internal.security.ResourcePermissions;
36+
import org.apache.geode.security.ResourcePermission;
3337

34-
public class AlterRuntimeConfigFunction extends FunctionAdapter implements InternalEntity {
38+
public class AlterRuntimeConfigFunction implements Function, InternalEntity {
3539

3640
private static final long serialVersionUID = 1L;
3741

@@ -85,6 +89,11 @@ public void execute(FunctionContext context) {
8589
}
8690
}
8791

92+
@Override
93+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
94+
return Collections.singleton(ResourcePermissions.CLUSTER_WRITE);
95+
}
96+
8897
@Override
8998
public String getId() {
9099
return AlterRuntimeConfigFunction.class.getName();

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/ChangeLogLevelFunction.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,10 @@
1414
*/
1515
package org.apache.geode.management.internal.cli.functions;
1616

17-
import static org.apache.geode.distributed.ConfigurationProperties.*;
17+
import static org.apache.geode.distributed.ConfigurationProperties.LOG_LEVEL;
1818

19+
import java.util.Collection;
20+
import java.util.Collections;
1921
import java.util.HashMap;
2022
import java.util.Map;
2123

@@ -31,6 +33,8 @@
3133
import org.apache.geode.internal.logging.log4j.LogLevel;
3234
import org.apache.geode.internal.logging.log4j.LogMarker;
3335
import org.apache.geode.internal.logging.log4j.LogWriterLogger;
36+
import org.apache.geode.management.internal.security.ResourcePermissions;
37+
import org.apache.geode.security.ResourcePermission;
3438

3539

3640
/**
@@ -72,6 +76,11 @@ public void execute(FunctionContext context) {
7276
}
7377
}
7478

79+
@Override
80+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
81+
return Collections.singleton(ResourcePermissions.CLUSTER_WRITE);
82+
}
83+
7584
@Override
7685
public String getId() {
7786
return ChangeLogLevelFunction.ID;

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/CloseDurableClientFunction.java‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,33 @@
1414
*/
1515
package org.apache.geode.management.internal.cli.functions;
1616

17+
import java.util.Collection;
18+
import java.util.Collections;
19+
1720
import org.apache.geode.cache.Cache;
18-
import org.apache.geode.cache.execute.FunctionAdapter;
21+
import org.apache.geode.cache.execute.Function;
1922
import org.apache.geode.cache.execute.FunctionContext;
20-
import org.apache.geode.distributed.internal.InternalDistributedSystem;
2123
import org.apache.geode.internal.InternalEntity;
2224
import org.apache.geode.internal.cache.tier.sockets.CacheClientNotifier;
2325
import org.apache.geode.internal.cache.tier.sockets.CacheClientProxy;
2426
import org.apache.geode.management.internal.cli.CliUtil;
2527
import org.apache.geode.management.internal.cli.domain.MemberResult;
2628
import org.apache.geode.management.internal.cli.i18n.CliStrings;
29+
import org.apache.geode.management.internal.security.ResourcePermissions;
30+
import org.apache.geode.security.ResourcePermission;
2731

2832
/***
2933
* Function to close a durable client
3034
*
3135
*/
32-
public class CloseDurableClientFunction extends FunctionAdapter implements InternalEntity {
36+
public class CloseDurableClientFunction implements Function, InternalEntity {
3337

3438
private static final long serialVersionUID = 1L;
3539

3640
@Override
3741
public void execute(FunctionContext context) {
3842
String durableClientId = (String) context.getArguments();
39-
final Cache cache = CliUtil.getCacheIfExists();
43+
final Cache cache = context.getCache();
4044
final String memberNameOrId =
4145
CliUtil.getMemberNameOrId(cache.getDistributedSystem().getDistributedMember());
4246
MemberResult memberResult = new MemberResult(memberNameOrId);
@@ -69,6 +73,11 @@ public void execute(FunctionContext context) {
6973
}
7074
}
7175

76+
@Override
77+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
78+
return Collections.singleton(ResourcePermissions.CLUSTER_MANAGE_QUERY);
79+
}
80+
7281
@Override
7382
public String getId() {
7483
return CloseDurableClientFunction.class.getName();

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/CloseDurableCqFunction.java‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,29 +14,33 @@
1414
*/
1515
package org.apache.geode.management.internal.cli.functions;
1616

17+
import java.util.Collection;
18+
import java.util.Collections;
19+
1720
import org.apache.geode.cache.Cache;
18-
import org.apache.geode.cache.execute.FunctionAdapter;
21+
import org.apache.geode.cache.execute.Function;
1922
import org.apache.geode.cache.execute.FunctionContext;
2023
import org.apache.geode.internal.InternalEntity;
2124
import org.apache.geode.internal.cache.tier.sockets.CacheClientNotifier;
2225
import org.apache.geode.internal.cache.tier.sockets.CacheClientProxy;
23-
import org.apache.geode.internal.cache.tier.sockets.ClientProxyMembershipID;
2426
import org.apache.geode.management.internal.cli.CliUtil;
2527
import org.apache.geode.management.internal.cli.domain.MemberResult;
2628
import org.apache.geode.management.internal.cli.i18n.CliStrings;
29+
import org.apache.geode.management.internal.security.ResourcePermissions;
30+
import org.apache.geode.security.ResourcePermission;
2731

2832
/***
2933
* Function to close a durable cq
3034
*
3135
*/
32-
public class CloseDurableCqFunction extends FunctionAdapter implements InternalEntity {
36+
public class CloseDurableCqFunction implements Function, InternalEntity {
3337

3438
private static final long serialVersionUID = 1L;
3539

3640
@Override
3741
public void execute(FunctionContext context) {
3842

39-
final Cache cache = CliUtil.getCacheIfExists();
43+
final Cache cache = context.getCache();
4044
final String memberNameOrId =
4145
CliUtil.getMemberNameOrId(cache.getDistributedSystem().getDistributedMember());
4246
CacheClientNotifier cacheClientNotifier = CacheClientNotifier.getInstance();
@@ -71,6 +75,11 @@ public void execute(FunctionContext context) {
7175
}
7276
}
7377

78+
@Override
79+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
80+
return Collections.singleton(ResourcePermissions.CLUSTER_MANAGE_QUERY);
81+
}
82+
7483
@Override
7584
public String getId() {
7685
return CloseDurableCqFunction.class.getName();

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/ContinuousQueryFunction.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
import java.io.Serializable;
1818
import java.util.Collection;
19+
import java.util.Collections;
1920
import java.util.Iterator;
2021

2122
import org.apache.geode.cache.execute.Function;
@@ -28,6 +29,8 @@
2829
import org.apache.geode.internal.cache.tier.sockets.CacheClientProxy;
2930
import org.apache.geode.internal.cache.tier.sockets.ClientProxyMembershipID;
3031
import org.apache.geode.internal.cache.tier.sockets.ServerConnection;
32+
import org.apache.geode.management.internal.security.ResourcePermissions;
33+
import org.apache.geode.security.ResourcePermission;
3134

3235
/**
3336
* @since GemFire 8.0
@@ -103,6 +106,11 @@ public void execute(FunctionContext context) {
103106
context.getResultSender().lastResult(null);
104107
}
105108

109+
@Override
110+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
111+
return Collections.singleton(ResourcePermissions.CLUSTER_READ);
112+
}
113+
106114
@Override
107115
public String getId() {
108116
return ContinuousQueryFunction.ID;

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/CreateAsyncEventQueueFunction.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
*/
1515
package org.apache.geode.management.internal.cli.functions;
1616

17+
import java.util.Collection;
18+
import java.util.Collections;
1719
import java.util.HashMap;
1820
import java.util.Map;
1921
import java.util.Properties;
@@ -38,6 +40,8 @@
3840
import org.apache.geode.internal.cache.xmlcache.CacheXml;
3941
import org.apache.geode.internal.logging.LogService;
4042
import org.apache.geode.management.internal.configuration.domain.XmlEntity;
43+
import org.apache.geode.management.internal.security.ResourcePermissions;
44+
import org.apache.geode.security.ResourcePermission;
4145

4246
/**
4347
* Function used by the 'create async-event-queue' gfsh command to create an asynchronous event
@@ -128,6 +132,11 @@ public void execute(FunctionContext context) {
128132
}
129133
}
130134

135+
@Override
136+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
137+
return Collections.singleton(ResourcePermissions.CLUSTER_MANAGE_DEPLOY);
138+
}
139+
131140
private Object newInstance(String className)
132141
throws ClassNotFoundException, IllegalAccessException, InstantiationException {
133142
if (Strings.isNullOrEmpty(className)) {
@@ -139,6 +148,6 @@ private Object newInstance(String className)
139148

140149
@Override
141150
public String getId() {
142-
return CreateDiskStoreFunction.class.getName();
151+
return CreateAsyncEventQueueFunction.class.getName();
143152
}
144153
}

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/CreateDefinedIndexesFunction.java‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@
1515
package org.apache.geode.management.internal.cli.functions;
1616

1717
import java.util.ArrayList;
18+
import java.util.Collection;
19+
import java.util.Collections;
1820
import java.util.Iterator;
1921
import java.util.List;
2022
import java.util.Map;
2123
import java.util.Set;
2224

2325
import org.apache.geode.cache.Cache;
24-
import org.apache.geode.cache.execute.FunctionAdapter;
26+
import org.apache.geode.cache.execute.Function;
2527
import org.apache.geode.cache.execute.FunctionContext;
2628
import org.apache.geode.cache.execute.ResultSender;
2729
import org.apache.geode.cache.query.Index;
@@ -33,8 +35,10 @@
3335
import org.apache.geode.management.internal.cli.domain.IndexInfo;
3436
import org.apache.geode.management.internal.cli.i18n.CliStrings;
3537
import org.apache.geode.management.internal.configuration.domain.XmlEntity;
38+
import org.apache.geode.management.internal.security.ResourcePermissions;
39+
import org.apache.geode.security.ResourcePermission;
3640

37-
public class CreateDefinedIndexesFunction extends FunctionAdapter implements InternalEntity {
41+
public class CreateDefinedIndexesFunction implements Function, InternalEntity {
3842
private static final long serialVersionUID = 1L;
3943

4044
@Override
@@ -122,4 +126,9 @@ public void execute(FunctionContext context) {
122126
.lastResult(new CliFunctionResult(memberId, exception, exceptionMessage));
123127
}
124128
}
129+
130+
@Override
131+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
132+
return Collections.singleton(ResourcePermissions.CLUSTER_MANAGE_QUERY);
133+
}
125134
}

‎geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/CreateDiskStoreFunction.java‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,15 @@
2020
* @since GemFire 8.0
2121
*/
2222

23+
import java.util.Collection;
24+
import java.util.Collections;
25+
2326
import org.apache.logging.log4j.Logger;
2427

2528
import org.apache.geode.SystemFailure;
2629
import org.apache.geode.cache.CacheClosedException;
2730
import org.apache.geode.cache.DiskStoreFactory;
28-
import org.apache.geode.cache.execute.FunctionAdapter;
31+
import org.apache.geode.cache.execute.Function;
2932
import org.apache.geode.cache.execute.FunctionContext;
3033
import org.apache.geode.distributed.DistributedMember;
3134
import org.apache.geode.internal.InternalEntity;
@@ -34,8 +37,10 @@
3437
import org.apache.geode.internal.cache.xmlcache.CacheXml;
3538
import org.apache.geode.internal.logging.LogService;
3639
import org.apache.geode.management.internal.configuration.domain.XmlEntity;
40+
import org.apache.geode.management.internal.security.ResourcePermissions;
41+
import org.apache.geode.security.ResourcePermission;
3742

38-
public class CreateDiskStoreFunction extends FunctionAdapter implements InternalEntity {
43+
public class CreateDiskStoreFunction implements Function, InternalEntity {
3944
private static final Logger logger = LogService.getLogger();
4045

4146
private static final long serialVersionUID = 1L;
@@ -79,6 +84,11 @@ public void execute(FunctionContext context) {
7984
}
8085
}
8186

87+
@Override
88+
public Collection<ResourcePermission> getRequiredPermissions(String regionName) {
89+
return Collections.singleton(ResourcePermissions.CLUSTER_MANAGE_DISK);
90+
}
91+
8292
@Override
8393
public String getId() {
8494
return CreateDiskStoreFunction.class.getName();

0 commit comments

Comments
 (0)