From 751d3f24cf01ffb841ba90c5ddae06900cdadbfa Mon Sep 17 00:00:00 2001 From: Marcus Eriksson Date: Thu, 16 Jan 2025 10:45:45 +0100 Subject: [PATCH] Make sure we can set parameters when configuring CassandraCIDRAuthorizer patch by Marcus Eriksson; reviewed by Stefan Miklosovic for CASSANDRA-20220 --- CHANGES.txt | 1 + .../auth/CassandraCIDRAuthorizer.java | 15 ++++- .../cassandra/config/DatabaseDescriptor.java | 14 ----- .../test/auth/CIDRAuthorizerConfigTest.java | 58 +++++++++++++++++++ .../apache/cassandra/auth/AuthTestUtils.java | 13 +---- 5 files changed, 74 insertions(+), 27 deletions(-) create mode 100644 test/distributed/org/apache/cassandra/distributed/test/auth/CIDRAuthorizerConfigTest.java diff --git a/CHANGES.txt b/CHANGES.txt index 7666f06070..4e36bfd35f 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 5.0.3 + * Make sure we can set parameters when configuring CassandraCIDRAuthorizer (CASSANDRA-20220) * Add selected SAI index state and query performance metrics to nodetool tablestats (CASSANDRA-20026) * Remove v30 and v3X from 5.x in-JVM upgrade tests (CASSANDRA-20103) * Avoid memory allocation in offheap_object's NativeCell.valueSize() and NativeClustering.dataSize() (CASSANDRA-20162) diff --git a/src/java/org/apache/cassandra/auth/CassandraCIDRAuthorizer.java b/src/java/org/apache/cassandra/auth/CassandraCIDRAuthorizer.java index ffbfdcadba..518cf9b224 100644 --- a/src/java/org/apache/cassandra/auth/CassandraCIDRAuthorizer.java +++ b/src/java/org/apache/cassandra/auth/CassandraCIDRAuthorizer.java @@ -19,6 +19,7 @@ package org.apache.cassandra.auth; import java.net.InetAddress; +import java.util.Locale; import java.util.Map; import java.util.Set; import java.util.concurrent.TimeUnit; @@ -28,7 +29,6 @@ import com.google.common.annotations.VisibleForTesting; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.apache.cassandra.config.DatabaseDescriptor; import org.apache.cassandra.utils.MonotonicClock; import org.apache.cassandra.utils.NoSpamLogger; @@ -39,11 +39,20 @@ import org.apache.cassandra.utils.NoSpamLogger; */ public class CassandraCIDRAuthorizer extends AbstractCIDRAuthorizer { + static final String CIDR_AUTHORIZER_MODE_PARAM = "cidr_authorizer_mode"; + private static final Logger logger = LoggerFactory.getLogger(AuthenticatedUser.class); private static final NoSpamLogger noSpamLogger = NoSpamLogger.getLogger(logger, 1, TimeUnit.MINUTES); - protected static CIDRPermissionsCache cidrPermissionsCache; protected static CIDRGroupsMappingCache cidrGroupsMappingCache; + private final CIDRAuthorizerMode cidrAuthorizerMode; + + public CassandraCIDRAuthorizer(Map params) + { + cidrAuthorizerMode = (params != null && params.containsKey(CIDR_AUTHORIZER_MODE_PARAM)) + ? CIDRAuthorizerMode.valueOf(params.get(CIDR_AUTHORIZER_MODE_PARAM).toUpperCase(Locale.US)) + : CIDRAuthorizerMode.MONITOR; + } @Override public void setup() @@ -105,7 +114,7 @@ public class CassandraCIDRAuthorizer extends AbstractCIDRAuthorizer @VisibleForTesting protected boolean isMonitorMode() { - return DatabaseDescriptor.getCidrAuthorizerMode() == CIDRAuthorizerMode.MONITOR; + return cidrAuthorizerMode == CIDRAuthorizerMode.MONITOR; } private boolean hasCidrAccess(RoleResource role, InetAddress ipAddress) diff --git a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java index d282cf3e3d..4a11285e41 100644 --- a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java +++ b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java @@ -1731,20 +1731,6 @@ public class DatabaseDescriptor return Boolean.parseBoolean(value); } - public static ICIDRAuthorizer.CIDRAuthorizerMode getCidrAuthorizerMode() - { - ICIDRAuthorizer.CIDRAuthorizerMode defaultCidrAuthorizerMode = ICIDRAuthorizer.CIDRAuthorizerMode.MONITOR; - - if (conf.cidr_authorizer == null || conf.cidr_authorizer.parameters == null) - return defaultCidrAuthorizerMode; - - String cidrAuthorizerMode = conf.cidr_authorizer.parameters.get("cidr_authorizer_mode"); - if (cidrAuthorizerMode == null || cidrAuthorizerMode.isEmpty()) - return defaultCidrAuthorizerMode; - - return ICIDRAuthorizer.CIDRAuthorizerMode.valueOf(cidrAuthorizerMode.toUpperCase()); - } - public static int getCidrGroupsCacheRefreshInterval() { int defaultCidrGroupsCacheRefreshInterval = 5; // mins diff --git a/test/distributed/org/apache/cassandra/distributed/test/auth/CIDRAuthorizerConfigTest.java b/test/distributed/org/apache/cassandra/distributed/test/auth/CIDRAuthorizerConfigTest.java new file mode 100644 index 0000000000..084a85542d --- /dev/null +++ b/test/distributed/org/apache/cassandra/distributed/test/auth/CIDRAuthorizerConfigTest.java @@ -0,0 +1,58 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.cassandra.distributed.test.auth; + +import java.io.IOException; + +import com.google.common.collect.ImmutableMap; +import org.junit.Test; + +import org.apache.cassandra.config.ParameterizedClass; +import org.apache.cassandra.distributed.Cluster; +import org.apache.cassandra.distributed.test.TestBaseImpl; + +public class CIDRAuthorizerConfigTest extends TestBaseImpl +{ + @Test + public void testParameterizedClass() throws IOException + { + try (Cluster cluster = init(builder().withNodes(1) + .withConfig(c -> c.set("cidr_authorizer", new ParameterizedClass("CassandraCIDRAuthorizer", + ImmutableMap.of("cidr_authorizer_mode", "ENFORCE"))) + .set("authorizer.class_name", "CassandraAuthorizer") + .set("authenticator.class_name", "PasswordAuthenticator")) + .start())) + { + // just makes sure we can start with a param in the ParameterizedClass + } + } + + @Test + public void testParameterizedClass_no_params() throws IOException + { + try (Cluster cluster = init(builder().withNodes(1) + .withConfig(c -> c.set("cidr_authorizer.class_name","CassandraCIDRAuthorizer") + .set("authorizer.class_name", "CassandraAuthorizer") + .set("authenticator.class_name", "PasswordAuthenticator")) + .start())) + { + // just makes sure we can start without a param in the ParameterizedClass + } + } +} diff --git a/test/unit/org/apache/cassandra/auth/AuthTestUtils.java b/test/unit/org/apache/cassandra/auth/AuthTestUtils.java index 610832ffb4..16c5df8118 100644 --- a/test/unit/org/apache/cassandra/auth/AuthTestUtils.java +++ b/test/unit/org/apache/cassandra/auth/AuthTestUtils.java @@ -33,6 +33,7 @@ import java.util.Collection; import java.util.concurrent.Callable; import java.util.concurrent.TimeoutException; +import com.google.common.collect.ImmutableMap; import org.apache.cassandra.auth.jmx.AuthorizationProxy; import org.apache.cassandra.config.DatabaseDescriptor; import org.apache.cassandra.cql3.CIDR; @@ -183,16 +184,14 @@ public class AuthTestUtils public static class LocalCassandraCIDRAuthorizer extends CassandraCIDRAuthorizer { - CIDRAuthorizerMode cidrAuthorizerMode; - public LocalCassandraCIDRAuthorizer() { - cidrAuthorizerMode = CIDRAuthorizerMode.ENFORCE; + this(CIDRAuthorizerMode.ENFORCE); } public LocalCassandraCIDRAuthorizer(CIDRAuthorizerMode mode) { - cidrAuthorizerMode = mode; + super(ImmutableMap.of(CIDR_AUTHORIZER_MODE_PARAM, mode.name())); } @Override @@ -202,12 +201,6 @@ public class AuthTestUtils cidrGroupsMappingManager = new LocalCIDRGroupsMappingManager(); } - @Override - protected boolean isMonitorMode() - { - return cidrAuthorizerMode == CIDRAuthorizerMode.MONITOR; - } - CIDRPermissionsCache getCidrPermissionsCache() { return cidrPermissionsCache;