diff options
8 files changed, 321 insertions, 36 deletions
diff --git a/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java b/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java index 7bf28c7560..441369d064 100644 --- a/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java +++ b/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java @@ -311,13 +311,13 @@ public class ServerConfiguration implements SignalHandler { Configuration newConfig = parseConfig(_configFile); _securityConfiguration = new SecurityConfiguration(newConfig.subset("security")); - ApplicationRegistry.getInstance().getAccessManager().configurePlugins(_securityConfiguration); VirtualHostRegistry vhostRegistry = ApplicationRegistry.getInstance().getVirtualHostRegistry(); for (String hostname : _virtualHosts.keySet()) { VirtualHost vhost = vhostRegistry.getVirtualHost(hostname); SecurityConfiguration hostSecurityConfig = new SecurityConfiguration(newConfig.subset("virtualhosts.virtualhost."+hostname+".security")); + vhost.getAccessManager().configureGlobalPlugins(_securityConfiguration); vhost.getAccessManager().configureHostPlugins(hostSecurityConfig); } } diff --git a/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java b/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java index af0a1944cd..7d6ae285c5 100644 --- a/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java +++ b/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java @@ -67,14 +67,18 @@ public class ACLManager _allSecurityPlugins.put(securityPlugin.getClass().getName(), securityPlugin); } - _globalPlugins = configurePlugins(configuration); + configureGlobalPlugins(configuration); } - public void configureHostPlugins(SecurityConfiguration hostConfig) throws ConfigurationException { _hostPlugins = configurePlugins(hostConfig); } + + public void configureGlobalPlugins(SecurityConfiguration configuration) throws ConfigurationException + { + _globalPlugins = configurePlugins(configuration); + } public Map<String, ACLPlugin> configurePlugins(SecurityConfiguration hostConfig) throws ConfigurationException { @@ -93,7 +97,7 @@ public class ACLManager { if (plugin.supportsTag(tag)) { - _logger.warn("Plugin handling security section "+tag+" is "+plugin.getClass().getSimpleName()); + _logger.info("Plugin handling security section "+tag+" is "+plugin); handledTags.add(tag); plugins.put(plugin.getClass().getName(), plugin.newInstance(securityConfig)); } diff --git a/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java b/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java index 5bd739c0af..23041061be 100644 --- a/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java +++ b/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java @@ -760,38 +760,8 @@ public class ServerConfigurationTest extends TestCase // Write out config File mainFile = File.createTempFile(getClass().getName(), null); mainFile.deleteOnExit(); - FileWriter out = new FileWriter(mainFile); - - out.write("<broker>\n"); - out.write("\t<management><enabled>false</enabled></management>\n"); - out.write("\t<security>\n"); - out.write("\t\t<principal-databases>\n"); - out.write("\t\t\t<principal-database>\n"); - out.write("\t\t\t\t<name>passwordfile</name>\n"); - out.write("\t\t\t\t<class>org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase</class>\n"); - out.write("\t\t\t\t<attributes>\n"); - out.write("\t\t\t\t\t<attribute>\n"); - out.write("\t\t\t\t\t\t<name>passwordFile</name>\n"); - out.write("\t\t\t\t\t\t<value>/dev/null</value>\n"); - out.write("\t\t\t\t\t</attribute>\n"); - out.write("\t\t\t\t</attributes>\n"); - out.write("\t\t\t</principal-database>\n"); - out.write("\t\t</principal-databases>\n"); - out.write("\t\t<jmx>\n"); - out.write("\t\t\t<access>/dev/null</access>\n"); - out.write("\t\t\t<principal-database>passwordfile</principal-database>\n"); - out.write("\t\t</jmx>\n"); - out.write("\t\t<firewall>\n"); - out.write("\t\t\t<rule access=\"deny\" network=\"127.0.0.1\"/>"); - out.write("\t\t</firewall>\n"); - out.write("\t</security>\n"); - out.write("\t<virtualhosts>\n"); - out.write("\t\t<virtualhost>\n"); - out.write("\t\t\t<name>test</name>\n"); - out.write("\t\t</virtualhost>\n"); - out.write("\t</virtualhosts>\n"); - out.write("</broker>\n"); - out.close(); + FileWriter out; + writeConfigFile(mainFile, false); // Load config ApplicationRegistry reg = new ConfigurationFileApplicationRegistry(mainFile); @@ -882,6 +852,70 @@ public class ServerConfigurationTest extends TestCase session.setNetworkDriver(testDriver); assertFalse(reg.getAccessManager().authoriseConnect(session, virtualHost)); } + + public void testConfigurationFirewallReload() throws Exception + { + // Write out config + File mainFile = File.createTempFile(getClass().getName(), null); + + mainFile.deleteOnExit(); + writeConfigFile(mainFile, false); + + // Load config + ApplicationRegistry reg = new ConfigurationFileApplicationRegistry(mainFile); + ApplicationRegistry.initialise(reg, 1); + + // Test config + TestNetworkDriver testDriver = new TestNetworkDriver(); + testDriver.setRemoteAddress("127.0.0.1"); + VirtualHostRegistry virtualHostRegistry = reg.getVirtualHostRegistry(); + VirtualHost virtualHost = virtualHostRegistry.getVirtualHost("test"); + AMQProtocolSession session = new AMQProtocolEngine(virtualHostRegistry, testDriver); + + assertFalse(reg.getAccessManager().authoriseConnect(session, virtualHost)); + + // Switch to deny the connection + writeConfigFile(mainFile, true); + + reg.getConfiguration().reparseConfigFile(); + + assertTrue(reg.getAccessManager().authoriseConnect(session, virtualHost)); + + } + + private void writeConfigFile(File mainFile, boolean allow) throws IOException { + FileWriter out = new FileWriter(mainFile); + out.write("<broker>\n"); + out.write("\t<management><enabled>false</enabled></management>\n"); + out.write("\t<security>\n"); + out.write("\t\t<principal-databases>\n"); + out.write("\t\t\t<principal-database>\n"); + out.write("\t\t\t\t<name>passwordfile</name>\n"); + out.write("\t\t\t\t<class>org.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase</class>\n"); + out.write("\t\t\t\t<attributes>\n"); + out.write("\t\t\t\t\t<attribute>\n"); + out.write("\t\t\t\t\t\t<name>passwordFile</name>\n"); + out.write("\t\t\t\t\t\t<value>/dev/null</value>\n"); + out.write("\t\t\t\t\t</attribute>\n"); + out.write("\t\t\t\t</attributes>\n"); + out.write("\t\t\t</principal-database>\n"); + out.write("\t\t</principal-databases>\n"); + out.write("\t\t<jmx>\n"); + out.write("\t\t\t<access>/dev/null</access>\n"); + out.write("\t\t\t<principal-database>passwordfile</principal-database>\n"); + out.write("\t\t</jmx>\n"); + out.write("\t\t<firewall>\n"); + out.write("\t\t\t<rule access=\""+ ((allow) ? "allow" : "deny") +"\" network=\"127.0.0.1\"/>"); + out.write("\t\t</firewall>\n"); + out.write("\t</security>\n"); + out.write("\t<virtualhosts>\n"); + out.write("\t\t<virtualhost>\n"); + out.write("\t\t\t<name>test</name>\n"); + out.write("\t\t</virtualhost>\n"); + out.write("\t</virtualhosts>\n"); + out.write("</broker>\n"); + out.close(); + } public void testCombinedConfigurationFirewallReload() throws Exception { diff --git a/java/systests/etc/config-systests-firewall-settings.xml b/java/systests/etc/config-systests-firewall-settings.xml new file mode 100644 index 0000000000..d115e74663 --- /dev/null +++ b/java/systests/etc/config-systests-firewall-settings.xml @@ -0,0 +1,28 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<!-- + - + - Licensed to the Apache Software Foundation (ASF) under one + - or more contributor license agreements. See the NOTICE file + - distributed with this work for additional information + - regarding copyright ownership. The ASF licenses this file + - to you under the Apache License, Version 2.0 (the + - "License"); you may not use this file except in compliance + - with the License. You may obtain a copy of the License at + - + - http://www.apache.org/licenses/LICENSE-2.0 + - + - Unless required by applicable law or agreed to in writing, + - software distributed under the License is distributed on an + - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + - KIND, either express or implied. See the License for the + - specific language governing permissions and limitations + - under the License. + - + --> +<broker> + <security> + <firewall> + <rule access="allow" network="127.0.0.1"/> + </firewall> + </security> +</broker> diff --git a/java/systests/etc/config-systests-firewall.xml b/java/systests/etc/config-systests-firewall.xml new file mode 100644 index 0000000000..90773f5cc2 --- /dev/null +++ b/java/systests/etc/config-systests-firewall.xml @@ -0,0 +1,30 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<!-- + - + - Licensed to the Apache Software Foundation (ASF) under one + - or more contributor license agreements. See the NOTICE file + - distributed with this work for additional information + - regarding copyright ownership. The ASF licenses this file + - to you under the Apache License, Version 2.0 (the + - "License"); you may not use this file except in compliance + - with the License. You may obtain a copy of the License at + - + - http://www.apache.org/licenses/LICENSE-2.0 + - + - Unless required by applicable law or agreed to in writing, + - software distributed under the License is distributed on an + - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + - KIND, either express or implied. See the License for the + - specific language governing permissions and limitations + - under the License. + - + --> +<configuration> + <system/> + <override> + <xml fileName="${test.config}" config-optional="true"/> + <xml fileName="${QPID_FIREWALL_SETTINGS}"/> + <xml fileName="${QPID_HOME}/etc/config-systests-settings.xml"/> + <xml fileName="${QPID_HOME}/etc/config.xml"/> + </override> +</configuration> diff --git a/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java b/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java new file mode 100644 index 0000000000..94bacea2f4 --- /dev/null +++ b/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java @@ -0,0 +1,164 @@ +package org.apache.qpid.server.security.firewall; + +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; + +import javax.jms.Connection; +import javax.jms.JMSException; + +import org.apache.qpid.test.utils.QpidTestCase; + +public class FirewallConfigTest extends QpidTestCase +{ + + private File tmpFile = null; + @Override + protected void setUp() throws Exception + { + // do setup + final String QPID_HOME = System.getProperty("QPID_HOME"); + + if (QPID_HOME == null) + { + fail("QPID_HOME not set"); + } + + // Setup initial config. + _configFile = new File(QPID_HOME, "etc/config-systests-firewall.xml"); + tmpFile = File.createTempFile("config-systests-firewall", ".xml"); + setSystemProperty("QPID_FIREWALL_SETTINGS", tmpFile.getAbsolutePath()); + tmpFile.deleteOnExit(); + } + + private void writeFirewallFile(boolean allow, boolean inVhost) throws IOException + { + FileWriter out = new FileWriter(tmpFile); + String ipAddr = "127.0.0.1"; // FIXME: get this from InetAddress.getLocalHost().getAddress() ? + out.write("<broker>"); + if (inVhost) + { + out.write("<virtualhosts><virtualhost><test>"); + } + out.write("<security><firewall>"); + out.write("<rule access=\""+((allow) ? "allow" : "deny")+"\" network=\""+ipAddr +"\"/>"); + out.write("</firewall></security>"); + if (inVhost) + { + out.write("</test></virtualhost></virtualhosts>"); + } + out.write("</broker>"); + out.close(); + } + + public void testDenyOnRestart() throws Exception + { + testDeny(false, new Runnable() { + + public void run() + { + try + { + restartBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + }); + } + + public void testDenyOnRestartInVhost() throws Exception + { + testDeny(true, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + }); + } + + public void testDenyOnReload() throws Exception + { + testDeny(false, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + } + ); + } + + public void testDenyOnReloadInVhost() throws Exception + { + testDeny(true, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + } + ); + + } + + private void testDeny(boolean inVhost, Runnable restartOrReload) throws Exception + { + if (_broker.equals(VM)) + { + // No point running this test in a vm broker + return; + } + + writeFirewallFile(false, inVhost); + super.setUp(); + + Exception exception = null; + Connection conn = null; + try + { + conn = getConnection(); + } + catch (JMSException e) + { + exception = e; + } + assertNotNull(exception); + + // Check we can get a connection + + writeFirewallFile(true, inVhost); + restartOrReload.run(); + + exception = null; + try + { + conn = getConnection(); + } + catch (JMSException e) + { + exception = e; + } + assertNull(exception); + } +} diff --git a/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java b/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java index a1fa2c1a0c..886612b9d9 100644 --- a/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java +++ b/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java @@ -57,6 +57,7 @@ import java.io.InputStream; import java.io.InputStreamReader; import java.io.LineNumberReader; import java.io.PrintStream; +import java.io.Reader; import java.net.MalformedURLException; import java.util.ArrayList; import java.util.HashMap; @@ -1241,4 +1242,27 @@ public class QpidTestCase extends TestCase return null; } + public void reloadBroker() throws ConfigurationException, IOException + { + reloadBroker(0); + } + + public void reloadBroker(int port) throws ConfigurationException, IOException + { + if (_broker.equals(VM)) + { + ApplicationRegistry.getInstance().getConfiguration().reparseConfigFile(); + } + else // FIXME: should really use the JMX interface to do this + { + /* + * Sigh, this is going to get messy. grep for BRKR and the port number + */ + + Process p = Runtime.getRuntime().exec("/usr/bin/pgrep -f " + getPort(port)); + BufferedReader reader = new BufferedReader (new InputStreamReader(p.getInputStream())); + String cmd = "/bin/kill -SIGHUP " + reader.readLine(); + p = Runtime.getRuntime().exec(cmd); + } + } } diff --git a/java/test-profiles/010Excludes b/java/test-profiles/010Excludes index 7dfed6cee0..cb72da2a88 100755 --- a/java/test-profiles/010Excludes +++ b/java/test-profiles/010Excludes @@ -3,6 +3,7 @@ org.apache.qpid.client.ResetMessageListenerTest#* //These tests are for the java broker org.apache.qpid.server.security.acl.SimpleACLTest#* +org.apache.qpid.server.security.firewall.FirewallConfigTest#* org.apache.qpid.server.plugins.PluginTest#* org.apache.qpid.server.BrokerStartupTest#* |