From 74fedcbfadad43d5aa194a3b7cb577a19cdeeac4 Mon Sep 17 00:00:00 2001 From: zhouxiang Date: Tue, 10 May 2022 11:25:47 +0800 Subject: [PATCH] [ISSUE #3949] Add PermissionChecker --- .../rocketmq/acl/PermissionChecker.java | 22 +++++++++++++++++++ .../acl/plain/PlainPermissionChecker.java | 22 +++++++++++-------- .../acl/plain/PlainPermissionManager.java | 5 ++++- 3 files changed, 39 insertions(+), 10 deletions(-) create mode 100644 acl/src/main/java/org/apache/rocketmq/acl/PermissionChecker.java diff --git a/acl/src/main/java/org/apache/rocketmq/acl/PermissionChecker.java b/acl/src/main/java/org/apache/rocketmq/acl/PermissionChecker.java new file mode 100644 index 0000000000..a38d3ec478 --- /dev/null +++ b/acl/src/main/java/org/apache/rocketmq/acl/PermissionChecker.java @@ -0,0 +1,22 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.rocketmq.acl; + +public interface PermissionChecker { + void check(AccessResource checkedAccess, AccessResource ownedAccess); +} diff --git a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java index 0f15edecaa..549c9fdce9 100644 --- a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java +++ b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java @@ -18,23 +18,27 @@ package org.apache.rocketmq.acl.plain; import java.util.Map; +import org.apache.rocketmq.acl.AccessResource; +import org.apache.rocketmq.acl.PermissionChecker; import org.apache.rocketmq.acl.common.AclException; import org.apache.rocketmq.acl.common.Permission; -public class PlainPermissionChecker { - public static void check(PlainAccessResource needCheckedAccess, PlainAccessResource ownedAccess) { - if (Permission.needAdminPerm(needCheckedAccess.getRequestCode()) && !ownedAccess.isAdmin()) { - throw new AclException(String.format("Need admin permission for request code=%d, but accessKey=%s is not", needCheckedAccess.getRequestCode(), ownedAccess.getAccessKey())); +public class PlainPermissionChecker implements PermissionChecker { + public void check(AccessResource checkedAccess, AccessResource ownedAccess) { + PlainAccessResource checkedPlainAccess = (PlainAccessResource) checkedAccess; + PlainAccessResource ownedPlainAccess = (PlainAccessResource) ownedAccess; + if (Permission.needAdminPerm(checkedPlainAccess.getRequestCode()) && !ownedPlainAccess.isAdmin()) { + throw new AclException(String.format("Need admin permission for request code=%d, but accessKey=%s is not", checkedPlainAccess.getRequestCode(), ownedPlainAccess.getAccessKey())); } - Map needCheckedPermMap = needCheckedAccess.getResourcePermMap(); - Map ownedPermMap = ownedAccess.getResourcePermMap(); + Map needCheckedPermMap = checkedPlainAccess.getResourcePermMap(); + Map ownedPermMap = ownedPlainAccess.getResourcePermMap(); if (needCheckedPermMap == null) { // If the needCheckedPermMap is null,then return return; } - if (ownedPermMap == null && ownedAccess.isAdmin()) { + if (ownedPermMap == null && ownedPlainAccess.isAdmin()) { // If the ownedPermMap is null and it is an admin user, then return return; } @@ -46,8 +50,8 @@ public class PlainPermissionChecker { if (ownedPermMap == null || !ownedPermMap.containsKey(resource)) { // Check the default perm - byte ownedPerm = isGroup ? ownedAccess.getDefaultGroupPerm() : - ownedAccess.getDefaultTopicPerm(); + byte ownedPerm = isGroup ? ownedPlainAccess.getDefaultGroupPerm() : + ownedPlainAccess.getDefaultTopicPerm(); if (!Permission.checkPermission(neededPerm, ownedPerm)) { throw new AclException(String.format("No default permission for %s", PlainAccessResource.printStr(resource, isGroup))); } diff --git a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java index 5b3848010f..b315d367b2 100644 --- a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java +++ b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java @@ -37,6 +37,7 @@ import java.util.Set; import java.util.concurrent.atomic.AtomicLong; import org.apache.commons.lang3.StringUtils; +import org.apache.rocketmq.acl.PermissionChecker; import org.apache.rocketmq.acl.common.AclConstants; import org.apache.rocketmq.acl.common.AclException; import org.apache.rocketmq.acl.common.AclUtils; @@ -81,6 +82,8 @@ public class PlainPermissionManager { private List fileList = new ArrayList<>(); + private final PermissionChecker permissionChecker = new PlainPermissionChecker(); + public PlainPermissionManager() { load(); watch(); @@ -559,7 +562,7 @@ public class PlainPermissionManager { } void checkPerm(PlainAccessResource needCheckedAccess, PlainAccessResource ownedAccess) { - PlainPermissionChecker.check(needCheckedAccess, ownedAccess); + permissionChecker.check(needCheckedAccess, ownedAccess); } void clearPermissionInfo() {