natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make sure we can set parameters when configuring CassandraCIDRAuthorizer 

patch by Marcus Eriksson; reviewed by Stefan Miklosovic for CASSANDRA-20220
This commit is contained in:
Marcus Eriksson 2025-01-16 10:45:45 +01:00 committed by Stefan Miklosovic
parent 0cc7a03523
commit 751d3f24cf
No known key found for this signature in database
GPG Key ID: 32F35CB2F546D93E
5 changed files with 74 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
5.0.3
* Make sure we can set parameters when configuring CassandraCIDRAuthorizer (CASSANDRA-20220)
* Add selected SAI index state and query performance metrics to nodetool tablestats (CASSANDRA-20026)
* Remove v30 and v3X from 5.x in-JVM upgrade tests (CASSANDRA-20103)
* Avoid memory allocation in offheap_object's NativeCell.valueSize() and NativeClustering.dataSize() (CASSANDRA-20162)

15
src/java/org/apache/cassandra/auth/CassandraCIDRAuthorizer.java
View File

@ -19,6 +19,7 @@
package org.apache.cassandra.auth;
import java.net.InetAddress;
import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.TimeUnit;
@ -28,7 +29,6 @@ import com.google.common.annotations.VisibleForTesting;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.utils.MonotonicClock;
import org.apache.cassandra.utils.NoSpamLogger;
@ -39,11 +39,20 @@ import org.apache.cassandra.utils.NoSpamLogger;
*/
public class CassandraCIDRAuthorizer extends AbstractCIDRAuthorizer
{
static final String CIDR_AUTHORIZER_MODE_PARAM = "cidr_authorizer_mode";
private static final Logger logger = LoggerFactory.getLogger(AuthenticatedUser.class);
private static final NoSpamLogger noSpamLogger = NoSpamLogger.getLogger(logger, 1, TimeUnit.MINUTES);
protected static CIDRPermissionsCache cidrPermissionsCache;
protected static CIDRGroupsMappingCache cidrGroupsMappingCache;
private final CIDRAuthorizerMode cidrAuthorizerMode;
public CassandraCIDRAuthorizer(Map<String, String> params)
{
cidrAuthorizerMode = (params != null && params.containsKey(CIDR_AUTHORIZER_MODE_PARAM))
? CIDRAuthorizerMode.valueOf(params.get(CIDR_AUTHORIZER_MODE_PARAM).toUpperCase(Locale.US))
: CIDRAuthorizerMode.MONITOR;
}
@Override
public void setup()
@ -105,7 +114,7 @@ public class CassandraCIDRAuthorizer extends AbstractCIDRAuthorizer
@VisibleForTesting
protected boolean isMonitorMode()
{
return DatabaseDescriptor.getCidrAuthorizerMode() == CIDRAuthorizerMode.MONITOR;
return cidrAuthorizerMode == CIDRAuthorizerMode.MONITOR;
}
private boolean hasCidrAccess(RoleResource role, InetAddress ipAddress)

14
src/java/org/apache/cassandra/config/DatabaseDescriptor.java
View File

@ -1731,20 +1731,6 @@ public class DatabaseDescriptor
return Boolean.parseBoolean(value);
}
public static ICIDRAuthorizer.CIDRAuthorizerMode getCidrAuthorizerMode()
{
ICIDRAuthorizer.CIDRAuthorizerMode defaultCidrAuthorizerMode = ICIDRAuthorizer.CIDRAuthorizerMode.MONITOR;
if (conf.cidr_authorizer == null || conf.cidr_authorizer.parameters == null)
return defaultCidrAuthorizerMode;
String cidrAuthorizerMode = conf.cidr_authorizer.parameters.get("cidr_authorizer_mode");
if (cidrAuthorizerMode == null || cidrAuthorizerMode.isEmpty())
return defaultCidrAuthorizerMode;
return ICIDRAuthorizer.CIDRAuthorizerMode.valueOf(cidrAuthorizerMode.toUpperCase());
}
public static int getCidrGroupsCacheRefreshInterval()
{
int defaultCidrGroupsCacheRefreshInterval = 5; // mins

58
test/distributed/org/apache/cassandra/distributed/test/auth/CIDRAuthorizerConfigTest.java Normal file
View File

@ -0,0 +1,58 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.cassandra.distributed.test.auth;
import java.io.IOException;
import com.google.common.collect.ImmutableMap;
import org.junit.Test;
import org.apache.cassandra.config.ParameterizedClass;
import org.apache.cassandra.distributed.Cluster;
import org.apache.cassandra.distributed.test.TestBaseImpl;
public class CIDRAuthorizerConfigTest extends TestBaseImpl
{
@Test
public void testParameterizedClass() throws IOException
{
try (Cluster cluster = init(builder().withNodes(1)
.withConfig(c -> c.set("cidr_authorizer", new ParameterizedClass("CassandraCIDRAuthorizer",
ImmutableMap.of("cidr_authorizer_mode", "ENFORCE")))
.set("authorizer.class_name", "CassandraAuthorizer")
.set("authenticator.class_name", "PasswordAuthenticator"))
.start()))
{
// just makes sure we can start with a param in the ParameterizedClass
}
}
@Test
public void testParameterizedClass_no_params() throws IOException
{
try (Cluster cluster = init(builder().withNodes(1)
.withConfig(c -> c.set("cidr_authorizer.class_name","CassandraCIDRAuthorizer")
.set("authorizer.class_name", "CassandraAuthorizer")
.set("authenticator.class_name", "PasswordAuthenticator"))
.start()))
{
// just makes sure we can start without a param in the ParameterizedClass
}
}
}

13
test/unit/org/apache/cassandra/auth/AuthTestUtils.java
View File

@ -33,6 +33,7 @@ import java.util.Collection;
import java.util.concurrent.Callable;
import java.util.concurrent.TimeoutException;
import com.google.common.collect.ImmutableMap;
import org.apache.cassandra.auth.jmx.AuthorizationProxy;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.cql3.CIDR;
@ -183,16 +184,14 @@ public class AuthTestUtils
public static class LocalCassandraCIDRAuthorizer extends CassandraCIDRAuthorizer
{
CIDRAuthorizerMode cidrAuthorizerMode;
public LocalCassandraCIDRAuthorizer()
{
cidrAuthorizerMode = CIDRAuthorizerMode.ENFORCE;
this(CIDRAuthorizerMode.ENFORCE);
}
public LocalCassandraCIDRAuthorizer(CIDRAuthorizerMode mode)
{
cidrAuthorizerMode = mode;
super(ImmutableMap.of(CIDR_AUTHORIZER_MODE_PARAM, mode.name()));
}
@Override
@ -202,12 +201,6 @@ public class AuthTestUtils
cidrGroupsMappingManager = new LocalCIDRGroupsMappingManager();
}
@Override
protected boolean isMonitorMode()
{
return cidrAuthorizerMode == CIDRAuthorizerMode.MONITOR;
}
CIDRPermissionsCache getCidrPermissionsCache()
{
return cidrPermissionsCache;