Author: frm
Date: Fri Sep 9 15:54:40 2016
New Revision: 1760048
URL: http://svn.apache.org/viewvc?rev=1760048&view=rev
Log:
OAK-4784 - Move the client white list filter in a separate handler
Added:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java
(with props)
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java
(with props)
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilter.java
- copied, changed from r1760010,
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilter.java
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java
(with props)
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilterTest.java
- copied, changed from r1760010,
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilterTest.java
Removed:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilter.java
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilterTest.java
Modified:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServer.java
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServerHandler.java
Added:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java?rev=1760048&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java
(added)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java
Fri Sep 9 15:54:40 2016
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jackrabbit.oak.segment.standby.server;
+
+import java.net.SocketAddress;
+
+interface ClientFilter {
+
+ boolean isAllowed(SocketAddress address);
+
+}
Propchange:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilter.java
------------------------------------------------------------------------------
svn:eol-style = native
Added:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java?rev=1760048&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java
(added)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java
Fri Sep 9 15:54:40 2016
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jackrabbit.oak.segment.standby.server;
+
+import java.net.SocketAddress;
+
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A handler that filters out incoming connections based on the address of the
+ * client. This handler immediately closes the incoming connection if an
+ * unwanted client is detected.
+ */
+class ClientFilterHandler extends ChannelInboundHandlerAdapter {
+
+ private static final Logger log =
LoggerFactory.getLogger(ClientFilterHandler.class);
+
+ private final ClientFilter filter;
+
+ /**
+ * Create a new handler based on the provided filtering strategy.
+ *
+ * @param filter an instance of {@link ClientFilter} representing the
+ * filtering strategy for this handler.
+ */
+ ClientFilterHandler(ClientFilter filter) {
+ this.filter = filter;
+ }
+
+ @Override
+ public void channelActive(ChannelHandlerContext ctx) throws Exception {
+ SocketAddress address = ctx.channel().remoteAddress();
+
+ if (filter.isAllowed(address)) {
+ log.debug("Client {} is allowed", address);
+ ctx.fireChannelActive();
+ } else {
+ log.debug("Client {} is rejected", address);
+ ctx.close();
+ }
+ }
+
+}
Propchange:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandler.java
------------------------------------------------------------------------------
svn:eol-style = native
Copied:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilter.java
(from r1760010,
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilter.java)
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilter.java?p2=jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilter.java&p1=jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilter.java&r1=1760010&r2=1760048&rev=1760048&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilter.java
(original)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilter.java
Fri Sep 9 15:54:40 2016
@@ -18,6 +18,8 @@
package org.apache.jackrabbit.oak.segment.standby.server;
import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.SocketAddress;
import java.net.UnknownHostException;
import java.util.Arrays;
@@ -31,9 +33,9 @@ import org.slf4j.LoggerFactory;
* Known issue: if a host name is provided as a filter and that host name
* contains a dash ("-"), it will be interpreted as an IP range.
*/
-class IpAddressFilter {
+class ClientIpFilter implements ClientFilter {
- private static final Logger log =
LoggerFactory.getLogger(IpAddressFilter.class);
+ private static final Logger log =
LoggerFactory.getLogger(ClientIpFilter.class);
private static boolean areAddressesEqual(InetAddress a, InetAddress b) {
return Arrays.equals(a.getAddress(), b.getAddress());
@@ -118,18 +120,16 @@ class IpAddressFilter {
*
* @param filters A list of filters.
*/
- IpAddressFilter(String[] filters) {
+ ClientIpFilter(String[] filters) {
this.allowedIpRanges = filters;
}
- /**
- * Check if the provided IP address is allowed by this white list.
- *
- * @param address the address to verify.
- * @return {@code true} if the address is valid according to this white
- * list, {@code false} otherwise.
- */
- boolean isAllowed(InetAddress address) {
+ @Override
+ public boolean isAllowed(SocketAddress address) {
+ return isAllowed(((InetSocketAddress) address).getAddress());
+ }
+
+ private boolean isAllowed(InetAddress address) {
if (allowedIpRanges == null) {
return true;
}
Modified:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServer.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServer.java?rev=1760048&r1=1760047&r2=1760048&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServer.java
(original)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServer.java
Fri Sep 9 15:54:40 2016
@@ -82,7 +82,7 @@ public class StandbyServer implements St
this(port, store, allowedClientIPRanges, false);
}
- public StandbyServer(int port, final FileStore store, String[]
allowedClientIPRanges, boolean secure) throws CertificateException,
SSLException {
+ public StandbyServer(int port, final FileStore store, final String[]
allowedClientIPRanges, boolean secure) throws CertificateException,
SSLException {
this.port = port;
if (secure) {
@@ -91,7 +91,7 @@ public class StandbyServer implements St
}
observer = new CommunicationObserver("primary");
- handler = new StandbyServerHandler(store, observer,
allowedClientIPRanges);
+ handler = new StandbyServerHandler(store, observer);
bossGroup = new NioEventLoopGroup(1);
workerGroup = new NioEventLoopGroup();
@@ -117,9 +117,13 @@ public class StandbyServer implements St
@Override
public void initChannel(SocketChannel ch) throws Exception {
ChannelPipeline p = ch.pipeline();
+
+ p.addLast(new ClientFilterHandler(new
ClientIpFilter(allowedClientIPRanges)));
+
if (sslContext != null) {
p.addLast(sslContext.newHandler(ch.alloc()));
}
+
p.addLast(new LineBasedFrameDecoder(8192));
p.addLast(new StringDecoder(CharsetUtil.UTF_8));
p.addLast(new SnappyFramedEncoder());
Modified:
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServerHandler.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServerHandler.java?rev=1760048&r1=1760047&r2=1760048&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServerHandler.java
(original)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/main/java/org/apache/jackrabbit/oak/segment/standby/server/StandbyServerHandler.java
Fri Sep 9 15:54:40 2016
@@ -48,14 +48,11 @@ public class StandbyServerHandler extend
private final CommunicationObserver observer;
- private final IpAddressFilter allowedIPRanges;
-
public String state;
- public StandbyServerHandler(FileStore store, CommunicationObserver
observer, String[] allowedIPRanges) {
+ public StandbyServerHandler(FileStore store, CommunicationObserver
observer) {
this.store = store;
this.observer = observer;
- this.allowedIPRanges = new IpAddressFilter(allowedIPRanges);
}
private RecordId headId() {
@@ -65,10 +62,6 @@ public class StandbyServerHandler extend
return null;
}
- private boolean clientAllowed(InetSocketAddress client) {
- return allowedIPRanges.isAllowed(client.getAddress());
- }
-
@Override
public void channelRegistered(io.netty.channel.ChannelHandlerContext ctx)
throws java.lang.Exception {
state = "channel registered";
@@ -94,61 +87,57 @@ public class StandbyServerHandler extend
}
@Override
- public void channelRead0(ChannelHandlerContext ctx, String payload)
- throws Exception {
+ public void channelRead0(ChannelHandlerContext ctx, String payload) throws
Exception {
state = "got message";
String request = Messages.extractMessageFrom(payload);
- InetSocketAddress client =
(InetSocketAddress)ctx.channel().remoteAddress();
+ InetSocketAddress client = (InetSocketAddress)
ctx.channel().remoteAddress();
- if (!clientAllowed(client)) {
- log.warn("Got request from client " + client + " which is not in
the allowed ip ranges! Request will be ignored.");
- }
- else {
- String clientID = Messages.extractClientFrom(payload);
- observer.gotMessageFrom(clientID, request, client);
- if (Messages.GET_HEAD.equalsIgnoreCase(request)) {
- RecordId r = headId();
- if (r != null) {
- ctx.writeAndFlush(r);
- return;
- }
- } else if (request.startsWith(Messages.GET_SEGMENT)) {
- String sid = request.substring(Messages.GET_SEGMENT.length());
- log.debug("request segment id {}", sid);
- UUID uuid = UUID.fromString(sid);
-
- Segment s = null;
-
- for (int i = 0; i < 10; i++) {
- try {
- s =
store.readSegment(store.newSegmentId(uuid.getMostSignificantBits(),
uuid.getLeastSignificantBits()));
- } catch (IllegalRepositoryStateException e) {
- // segment not found
- log.debug("waiting for segment. Got exception: " +
e.getMessage());
- TimeUnit.MILLISECONDS.sleep(2000);
- }
- if (s != null) break;
+ String clientID = Messages.extractClientFrom(payload);
+ observer.gotMessageFrom(clientID, request, client);
+ if (Messages.GET_HEAD.equalsIgnoreCase(request)) {
+ RecordId r = headId();
+ if (r != null) {
+ ctx.writeAndFlush(r);
+ return;
+ }
+ } else if (request.startsWith(Messages.GET_SEGMENT)) {
+ String sid = request.substring(Messages.GET_SEGMENT.length());
+ log.debug("request segment id {}", sid);
+ UUID uuid = UUID.fromString(sid);
+
+ Segment s = null;
+
+ for (int i = 0; i < 10; i++) {
+ try {
+ s =
store.readSegment(store.newSegmentId(uuid.getMostSignificantBits(),
uuid.getLeastSignificantBits()));
+ } catch (IllegalRepositoryStateException e) {
+ // segment not found
+ log.debug("waiting for segment. Got exception: " +
e.getMessage());
+ TimeUnit.MILLISECONDS.sleep(2000);
}
-
if (s != null) {
- log.debug("sending segment " + sid + " to " + client);
- ctx.writeAndFlush(s);
- observer.didSendSegmentBytes(clientID, s.size());
- return;
+ break;
}
- } else if (request.startsWith(Messages.GET_BLOB)) {
- String bid = request.substring(Messages.GET_BLOB.length());
- log.debug("request blob id {}", bid);
- Blob b = readBlob(bid);
- log.debug("sending blob " + bid + " to " + client);
- ctx.writeAndFlush(b);
- observer.didSendBinariesBytes(clientID,
- Math.max(0, (int) b.length()));
+ }
+
+ if (s != null) {
+ log.debug("sending segment " + sid + " to " + client);
+ ctx.writeAndFlush(s);
+ observer.didSendSegmentBytes(clientID, s.size());
return;
- } else {
- log.warn("Unknown request {}, ignoring.", request);
}
+ } else if (request.startsWith(Messages.GET_BLOB)) {
+ String bid = request.substring(Messages.GET_BLOB.length());
+ log.debug("request blob id {}", bid);
+ Blob b = readBlob(bid);
+ log.debug("sending blob " + bid + " to " + client);
+ ctx.writeAndFlush(b);
+ observer.didSendBinariesBytes(clientID,
+ Math.max(0, (int) b.length()));
+ return;
+ } else {
+ log.warn("Unknown request {}, ignoring.", request);
}
ctx.writeAndFlush(Unpooled.EMPTY_BUFFER);
}
Added:
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java?rev=1760048&view=auto
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java
(added)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java
Fri Sep 9 15:54:40 2016
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.jackrabbit.oak.segment.standby.server;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.net.InetSocketAddress;
+import java.net.SocketAddress;
+
+import io.netty.channel.embedded.EmbeddedChannel;
+import org.junit.Test;
+
+public class ClientFilterHandlerTest {
+
+ @Test
+ public void allowedClientsShouldBeServed() {
+ EmbeddedChannel channel = new EmbeddedChannel(new
ClientFilterHandler(new ClientFilter() {
+
+ @Override
+ public boolean isAllowed(SocketAddress address) {
+ return true;
+ }
+
+ }));
+
+ channel.connect(new InetSocketAddress("127.0.0.1", 8080));
+ assertTrue(channel.isOpen());
+ }
+
+ @Test
+ public void disallowedClientsShouldNotBeServed() {
+ EmbeddedChannel channel = new EmbeddedChannel(new
ClientFilterHandler(new ClientFilter() {
+
+ @Override
+ public boolean isAllowed(SocketAddress address) {
+ return false;
+ }
+
+ }));
+
+ channel.connect(new InetSocketAddress("127.0.0.2", 8080));
+ assertFalse(channel.isOpen());
+ }
+
+}
Propchange:
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientFilterHandlerTest.java
------------------------------------------------------------------------------
svn:eol-style = native
Copied:
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilterTest.java
(from r1760010,
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilterTest.java)
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilterTest.java?p2=jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilterTest.java&p1=jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilterTest.java&r1=1760010&r2=1760048&rev=1760048&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/IpAddressFilterTest.java
(original)
+++
jackrabbit/oak/trunk/oak-segment-tar/src/test/java/org/apache/jackrabbit/oak/segment/standby/server/ClientIpFilterTest.java
Fri Sep 9 15:54:40 2016
@@ -20,6 +20,7 @@ package org.apache.jackrabbit.oak.segmen
import static org.junit.Assert.assertEquals;
import java.net.InetAddress;
+import java.net.InetSocketAddress;
import org.junit.Test;
import org.junit.runner.RunWith;
@@ -27,7 +28,7 @@ import org.junit.runners.Parameterized;
import org.junit.runners.Parameterized.Parameters;
@RunWith(Parameterized.class)
-public class IpAddressFilterTest {
+public class ClientIpFilterTest {
@Parameters(name = "filters={0}, address={1}, matches={2}")
public static Object[] parameters() {
@@ -58,7 +59,7 @@ public class IpAddressFilterTest {
private final boolean match;
- public IpAddressFilterTest(String addresses, String client, boolean match)
{
+ public ClientIpFilterTest(String addresses, String client, boolean match) {
this.addresses = addresses;
this.client = client;
this.match = match;
@@ -66,7 +67,7 @@ public class IpAddressFilterTest {
@Test
public void test() throws Exception {
- assertEquals(match, new
IpAddressFilter(parseFilters()).isAllowed(InetAddress.getByName(client)));
+ assertEquals(match, new
ClientIpFilter(parseFilters()).isAllowed(createAddress()));
}
private String[] parseFilters() {
@@ -77,4 +78,8 @@ public class IpAddressFilterTest {
return addresses.split(",");
}
+ private InetSocketAddress createAddress() throws Exception {
+ return new InetSocketAddress(InetAddress.getByName(client), 8080);
+ }
+
}
