gerrit.opnfv Code Review - onosfw.git/blob

   1 package org.onosproject.security.impl;
   2
   3
   4 import com.google.common.collect.ImmutableSet;
   5 import com.google.common.collect.Lists;
   6 import com.google.common.collect.Sets;
   7 import org.onosproject.security.AppPermission;
   8 import org.onosproject.app.ApplicationAdminService;
   9 import org.onosproject.app.ApplicationService;
  10 import org.onosproject.cfg.ComponentConfigService;
  11 import org.onosproject.cluster.ClusterAdminService;
  12 import org.onosproject.cluster.ClusterService;
  13 import org.onosproject.core.CoreService;
  14 import org.onosproject.cluster.LeadershipService;
  15 import org.onosproject.mastership.MastershipAdminService;
  16 import org.onosproject.mastership.MastershipService;
  17 import org.onosproject.net.device.DeviceAdminService;
  18 import org.onosproject.net.device.DeviceService;
  19 import org.onosproject.net.device.DeviceClockService;
  20 import org.onosproject.net.driver.DriverAdminService;
  21 import org.onosproject.net.driver.DriverService;
  22 import org.onosproject.net.flow.FlowRuleService;
  23 import org.onosproject.net.flowobjective.FlowObjectiveService;
  24 import org.onosproject.net.group.GroupService;
  25 import org.onosproject.net.host.HostAdminService;
  26 import org.onosproject.net.host.HostService;
  27 import org.onosproject.net.intent.IntentService;
  28 import org.onosproject.net.intent.IntentExtensionService;
  29 import org.onosproject.net.intent.IntentClockService;
  30 import org.onosproject.net.intent.PartitionService;
  31 import org.onosproject.net.link.LinkAdminService;
  32 import org.onosproject.net.link.LinkService;
  33 import org.onosproject.net.packet.PacketService;
  34 import org.onosproject.net.proxyarp.ProxyArpService;
  35 import org.onosproject.net.resource.link.LinkResourceService;
  36 import org.onosproject.net.statistic.StatisticService;
  37 import org.onosproject.net.topology.PathService;
  38 import org.onosproject.net.topology.TopologyService;
  39 import org.onosproject.security.SecurityAdminService;
  40 import org.onosproject.store.service.StorageAdminService;
  41 import org.onosproject.store.service.StorageService;
  42 import org.osgi.framework.BundlePermission;
  43 import org.osgi.framework.CapabilityPermission;
  44 import org.osgi.framework.ServicePermission;
  45 import org.osgi.framework.PackagePermission;
  46 import org.osgi.framework.AdaptPermission;
  47 import org.osgi.service.cm.ConfigurationPermission;
  48
  49 import javax.net.ssl.SSLPermission;
  50 import javax.security.auth.AuthPermission;
  51 import javax.security.auth.PrivateCredentialPermission;
  52 import javax.security.auth.kerberos.DelegationPermission;
  53 import javax.sound.sampled.AudioPermission;
  54 import java.io.FilePermission;
  55 import java.io.SerializablePermission;
  56 import java.net.NetPermission;
  57 import java.net.SocketPermission;
  58 import java.security.Permissions;
  59 import java.sql.SQLPermission;
  60 import java.util.ArrayList;
  61 import java.util.Enumeration;
  62 import java.util.HashSet;
  63 import java.util.List;
  64 import java.util.PropertyPermission;
  65 import java.util.Set;
  66 import java.util.concurrent.ConcurrentHashMap;
  67 import java.security.Permission;
  68 import java.util.logging.LoggingPermission;
  69
  70 import static org.onosproject.security.AppPermission.Type.*;
  71
  72 public final class DefaultPolicyBuilder {
  73
  74     protected static ConcurrentHashMap<AppPermission.Type,
  75             Set<String>> serviceDirectory = getServiceDirectory();
  76
  77     protected static List<Permission> defaultPermissions = getDefaultPerms();
  78     protected static List<Permission> adminServicePermissions = getAdminDefaultPerms();
  79
  80     private DefaultPolicyBuilder(){
  81     }
  82
  83     public static List<Permission> getUserApplicationPermissions(Set<org.onosproject.security.Permission> permissions) {
  84         List<Permission> perms = Lists.newArrayList();
  85         perms.addAll(defaultPermissions);
  86         perms.addAll(convertToJavaPermissions(permissions));
  87         return optimizePermissions(perms);
  88     }
  89
  90     public static List<Permission> getAdminApplicationPermissions(
  91             Set<org.onosproject.security.Permission> permissions) {
  92         List<Permission> perms = Lists.newArrayList();
  93         perms.addAll(defaultPermissions);
  94         perms.addAll(adminServicePermissions);
  95         for (AppPermission.Type perm : serviceDirectory.keySet()) {
  96             perms.add(new AppPermission(perm));
  97         }
  98         perms.addAll(convertToJavaPermissions(permissions));
  99         return optimizePermissions(perms);
 100     }
 101
 102     public static List<Permission> convertToJavaPermissions(Set<org.onosproject.security.Permission> permissions) {
 103         List<Permission> result = Lists.newArrayList();
 104         for (org.onosproject.security.Permission perm : permissions) {
 105             Permission javaPerm = getPermission(perm);
 106             if (javaPerm != null) {
 107                 if (javaPerm instanceof AppPermission) {
 108                     if (((AppPermission) javaPerm).getType() != null) {
 109                         AppPermission ap = (AppPermission) javaPerm;
 110                         result.add(ap);
 111                         if (serviceDirectory.containsKey(ap.getType())) {
 112                             for (String service : serviceDirectory.get(ap.getType())) {
 113                                 result.add(new ServicePermission(service, ServicePermission.GET));
 114                             }
 115                         }
 116                     }
 117                 } else if (javaPerm instanceof ServicePermission) {
 118                     if (!javaPerm.getName().contains(SecurityAdminService.class.getName())) {
 119                         result.add(javaPerm);
 120                     }
 121                 } else {
 122                     result.add(javaPerm);
 123                 }
 124
 125             }
 126         }
 127         return result;
 128     }
 129
 130     public static Set<org.onosproject.security.Permission> convertToOnosPermissions(List<Permission> permissions) {
 131         Set<org.onosproject.security.Permission> result = Sets.newHashSet();
 132         for (Permission perm : permissions) {
 133             org.onosproject.security.Permission onosPerm = getOnosPermission(perm);
 134             if (onosPerm != null) {
 135                 result.add(onosPerm);
 136             }
 137         }
 138         return result;
 139     }
 140
 141     public static List<Permission> getDefaultPerms() {
 142         List<Permission> permSet = Lists.newArrayList();
 143         permSet.add(new PackagePermission("*", PackagePermission.EXPORTONLY));
 144         permSet.add(new PackagePermission("*", PackagePermission.IMPORT));
 145         permSet.add(new AdaptPermission("*", AdaptPermission.ADAPT));
 146         permSet.add(new ConfigurationPermission("*", ConfigurationPermission.CONFIGURE));
 147         return permSet;
 148     }
 149
 150     private static List<Permission> getAdminDefaultPerms() {
 151         List<Permission> permSet = Lists.newArrayList();
 152         permSet.add(new ServicePermission(ApplicationAdminService.class.getName(), ServicePermission.GET));
 153         permSet.add(new ServicePermission(ClusterAdminService.class.getName(), ServicePermission.GET));
 154         permSet.add(new ServicePermission(MastershipAdminService.class.getName(), ServicePermission.GET));
 155         permSet.add(new ServicePermission(DeviceAdminService.class.getName(), ServicePermission.GET));
 156         permSet.add(new ServicePermission(HostAdminService.class.getName(), ServicePermission.GET));
 157         permSet.add(new ServicePermission(LinkAdminService.class.getName(), ServicePermission.GET));
 158         permSet.add(new ServicePermission(DriverAdminService.class.getName(), ServicePermission.GET));
 159         permSet.add(new ServicePermission(StorageAdminService.class.getName(), ServicePermission.GET));
 160 //      permSet.add(new ServicePermission(LabelResourceAdminService.class.getName(), ServicePermission.GET));
 161 //      permSet.add(new ServicePermission(TunnelAdminService.class.getName(), ServicePermission.GET));
 162         permSet.add(new ServicePermission(ApplicationService.class.getName(), ServicePermission.GET));
 163         permSet.add(new ServicePermission(ComponentConfigService.class.getName(), ServicePermission.GET));
 164         permSet.add(new ServicePermission(CoreService.class.getName(), ServicePermission.GET));
 165         permSet.add(new ServicePermission(ClusterService.class.getName(), ServicePermission.GET));
 166         permSet.add(new ServicePermission(LeadershipService.class.getName(), ServicePermission.GET));
 167         permSet.add(new ServicePermission(MastershipService.class.getName(), ServicePermission.GET));
 168         permSet.add(new ServicePermission(DeviceService.class.getName(), ServicePermission.GET));
 169         permSet.add(new ServicePermission(DeviceClockService.class.getName(), ServicePermission.GET));
 170         permSet.add(new ServicePermission(DriverService.class.getName(), ServicePermission.GET));
 171         permSet.add(new ServicePermission(FlowRuleService.class.getName(), ServicePermission.GET));
 172         permSet.add(new ServicePermission(FlowObjectiveService.class.getName(), ServicePermission.GET));
 173         permSet.add(new ServicePermission(GroupService.class.getName(), ServicePermission.GET));
 174         permSet.add(new ServicePermission(HostService.class.getName(), ServicePermission.GET));
 175         permSet.add(new ServicePermission(IntentService.class.getName(), ServicePermission.GET));
 176         permSet.add(new ServicePermission(IntentClockService.class.getName(), ServicePermission.GET));
 177         permSet.add(new ServicePermission(IntentExtensionService.class.getName(), ServicePermission.GET));
 178         permSet.add(new ServicePermission(PartitionService.class.getName(), ServicePermission.GET));
 179         permSet.add(new ServicePermission(LinkService.class.getName(), ServicePermission.GET));
 180         permSet.add(new ServicePermission(LinkResourceService.class.getName(), ServicePermission.GET));
 181 //      permSet.add(new ServicePermission(LabelResourceService.class.getName(), ServicePermission.GET));
 182         permSet.add(new ServicePermission(PacketService.class.getName(), ServicePermission.GET));
 183         permSet.add(new ServicePermission(ProxyArpService.class.getName(), ServicePermission.GET));
 184         permSet.add(new ServicePermission(StatisticService.class.getName(), ServicePermission.GET));
 185         permSet.add(new ServicePermission(PathService.class.getName(), ServicePermission.GET));
 186         permSet.add(new ServicePermission(TopologyService.class.getName(), ServicePermission.GET));
 187 //      permSet.add(new ServicePermission(TunnelService.class.getName(), ServicePermission.GET));
 188         permSet.add(new ServicePermission(StorageService.class.getName(), ServicePermission.GET));
 189         return permSet;
 190     }
 191
 192     public static Set<String> getNBServiceList() {
 193         Set<String> permString = new HashSet<>();
 194         for (Permission perm : getAdminDefaultPerms()) {
 195             permString.add(perm.getName());
 196         }
 197         return permString;
 198     }
 199
 200     private static ConcurrentHashMap<AppPermission.Type, Set<String>> getServiceDirectory() {
 201
 202         ConcurrentHashMap<AppPermission.Type, Set<String>> serviceDirectory = new ConcurrentHashMap<>();
 203
 204         serviceDirectory.put(APP_READ, ImmutableSet.of(
 205                 ApplicationService.class.getName(), CoreService.class.getName()));
 206         serviceDirectory.put(APP_EVENT, ImmutableSet.of(
 207                 ApplicationService.class.getName(), CoreService.class.getName()));
 208         serviceDirectory.put(CONFIG_READ, ImmutableSet.of(
 209                 ComponentConfigService.class.getName()));
 210         serviceDirectory.put(CONFIG_WRITE, ImmutableSet.of(
 211                 ComponentConfigService.class.getName()));
 212         serviceDirectory.put(CLUSTER_READ, ImmutableSet.of(
 213                 ClusterService.class.getName(), LeadershipService.class.getName(),
 214                 MastershipService.class.getName()));
 215         serviceDirectory.put(CLUSTER_WRITE, ImmutableSet.of(
 216                 LeadershipService.class.getName(), MastershipService.class.getName()));
 217         serviceDirectory.put(CLUSTER_EVENT, ImmutableSet.of(
 218                 ClusterService.class.getName(), LeadershipService.class.getName(),
 219                 MastershipService.class.getName()));
 220         serviceDirectory.put(DEVICE_READ, ImmutableSet.of(
 221                 DeviceService.class.getName(), DeviceClockService.class.getName()));
 222         serviceDirectory.put(DEVICE_EVENT, ImmutableSet.of(
 223                 DeviceService.class.getName()));
 224         serviceDirectory.put(DRIVER_READ, ImmutableSet.of(
 225                 DriverService.class.getName()));
 226         serviceDirectory.put(DRIVER_WRITE, ImmutableSet.of(
 227                 DriverService.class.getName()));
 228         serviceDirectory.put(FLOWRULE_READ, ImmutableSet.of(
 229                 FlowRuleService.class.getName()));
 230         serviceDirectory.put(FLOWRULE_WRITE, ImmutableSet.of(
 231                 FlowRuleService.class.getName(), FlowObjectiveService.class.getName()));
 232         serviceDirectory.put(FLOWRULE_EVENT, ImmutableSet.of(
 233                 FlowRuleService.class.getName()));
 234         serviceDirectory.put(GROUP_READ, ImmutableSet.of(
 235                 GroupService.class.getName()));
 236         serviceDirectory.put(GROUP_WRITE, ImmutableSet.of(
 237                 GroupService.class.getName()));
 238         serviceDirectory.put(GROUP_EVENT, ImmutableSet.of(
 239                 GroupService.class.getName()));
 240         serviceDirectory.put(HOST_READ, ImmutableSet.of(
 241                 HostService.class.getName()));
 242         serviceDirectory.put(HOST_WRITE, ImmutableSet.of(
 243                 HostService.class.getName()));
 244         serviceDirectory.put(HOST_EVENT, ImmutableSet.of(
 245                 HostService.class.getName()));
 246         serviceDirectory.put(INTENT_READ, ImmutableSet.of(
 247                 IntentService.class.getName(), PartitionService.class.getName(),
 248                 IntentClockService.class.getName()));
 249         serviceDirectory.put(INTENT_WRITE, ImmutableSet.of(
 250                 IntentService.class.getName()));
 251         serviceDirectory.put(INTENT_EVENT, ImmutableSet.of(
 252                 IntentService.class.getName()));
 253 //        serviceDirectory.put(LINK_READ, ImmutableSet.of(
 254 //                LinkService.class.getName(), LinkResourceService.class.getName(),
 255 //                LabelResourceService.class.getName()));
 256 //        serviceDirectory.put(LINK_WRITE, ImmutableSet.of(
 257 //                LinkResourceService.class.getName(), LabelResourceService.class.getName()));
 258 //        serviceDirectory.put(LINK_EVENT, ImmutableSet.of(
 259 //                LinkService.class.getName(), LinkResourceService.class.getName(),
 260 //                LabelResourceService.class.getName()));
 261         serviceDirectory.put(PACKET_READ, ImmutableSet.of(
 262                 PacketService.class.getName(), ProxyArpService.class.getName()));
 263         serviceDirectory.put(PACKET_WRITE, ImmutableSet.of(
 264                 PacketService.class.getName(), ProxyArpService.class.getName()));
 265         serviceDirectory.put(PACKET_EVENT, ImmutableSet.of(
 266                 PacketService.class.getName()));
 267         serviceDirectory.put(STATISTIC_READ, ImmutableSet.of(
 268                 StatisticService.class.getName()));
 269         serviceDirectory.put(TOPOLOGY_READ, ImmutableSet.of(
 270                 TopologyService.class.getName(), PathService.class.getName()));
 271         serviceDirectory.put(TOPOLOGY_EVENT, ImmutableSet.of(
 272                 TopologyService.class.getName()));
 273 //        serviceDirectory.put(TUNNEL_READ, ImmutableSet.of(
 274 //                TunnelService.class.getName()));
 275 //        serviceDirectory.put(TUNNEL_WRITE, ImmutableSet.of(
 276 //                TunnelService.class.getName()));
 277 //        serviceDirectory.put(TUNNEL_EVENT, ImmutableSet.of(
 278 //                TunnelService.class.getName()));
 279         serviceDirectory.put(STORAGE_WRITE, ImmutableSet.of(
 280                 StorageService.class.getName()));
 281
 282         return serviceDirectory;
 283     }
 284
 285
 286     public static org.onosproject.security.Permission getOnosPermission(Permission permission) {
 287         if (permission instanceof AppPermission) {
 288             return new org.onosproject.security.Permission(AppPermission.class.getName(), permission.getName(), "");
 289         } else if (permission instanceof FilePermission) {
 290             return new org.onosproject.security.Permission(
 291                     FilePermission.class.getName(), permission.getName(), permission.getActions());
 292         } else if (permission instanceof SerializablePermission) {
 293             return new org.onosproject.security.Permission(
 294                     SerializablePermission.class.getName(), permission.getName(), permission.getActions());
 295         } else if (permission instanceof NetPermission) {
 296             return new org.onosproject.security.Permission(
 297                     NetPermission.class.getName(), permission.getName(), permission.getActions());
 298         } else if (permission instanceof RuntimePermission) {
 299             return new org.onosproject.security.Permission(
 300                     RuntimePermission.class.getName(), permission.getName(), permission.getActions());
 301         } else if (permission instanceof SocketPermission) {
 302             return new org.onosproject.security.Permission(
 303                     SocketPermission.class.getName(), permission.getName(), permission.getActions());
 304         } else if (permission instanceof SQLPermission) {
 305             return new org.onosproject.security.Permission(
 306                     SQLPermission.class.getName(), permission.getName(), permission.getActions());
 307         } else if (permission instanceof PropertyPermission) {
 308             return new org.onosproject.security.Permission(
 309                     PropertyPermission.class.getName(), permission.getName(), permission.getActions());
 310         } else if (permission instanceof LoggingPermission) {
 311             return new org.onosproject.security.Permission(
 312                     LoggingPermission.class.getName(), permission.getName(), permission.getActions());
 313         } else if (permission instanceof SSLPermission) {
 314             return new org.onosproject.security.Permission(
 315                     SSLPermission.class.getName(), permission.getName(), permission.getActions());
 316         } else if (permission instanceof AuthPermission) {
 317             return new org.onosproject.security.Permission(
 318                     AuthPermission.class.getName(), permission.getName(), permission.getActions());
 319         } else if (permission instanceof PrivateCredentialPermission) {
 320             return new org.onosproject.security.Permission(
 321                     PrivateCredentialPermission.class.getName(), permission.getName(), permission.getActions());
 322         } else if (permission instanceof DelegationPermission) {
 323             return new org.onosproject.security.Permission(
 324                     DelegationPermission.class.getName(), permission.getName(), permission.getActions());
 325         } else if (permission instanceof javax.security.auth.kerberos.ServicePermission) {
 326             return new org.onosproject.security.Permission(
 327                     javax.security.auth.kerberos.ServicePermission.class.getName(), permission.getName(),
 328                     permission.getActions());
 329         } else if (permission instanceof AudioPermission) {
 330             return new org.onosproject.security.Permission(
 331                     AudioPermission.class.getName(), permission.getName(), permission.getActions());
 332         } else if (permission instanceof AdaptPermission) {
 333             return new org.onosproject.security.Permission(
 334                     AdaptPermission.class.getName(), permission.getName(), permission.getActions());
 335         } else if (permission instanceof BundlePermission) {
 336             return new org.onosproject.security.Permission(
 337                     BundlePermission.class.getName(), permission.getName(), permission.getActions());
 338         } else if (permission instanceof CapabilityPermission) {
 339             return new org.onosproject.security.Permission(
 340                     CapabilityPermission.class.getName(), permission.getName(), permission.getActions());
 341         } else if (permission instanceof PackagePermission) {
 342             return new org.onosproject.security.Permission(
 343                     PackagePermission.class.getName(), permission.getName(), permission.getActions());
 344         } else if (permission instanceof ServicePermission) {
 345             return new org.onosproject.security.Permission(
 346                     ServicePermission.class.getName(), permission.getName(), permission.getActions());
 347         }
 348         return null;
 349     }
 350
 351     private static Permission getPermission(org.onosproject.security.Permission permission) {
 352
 353         String classname = permission.getClassName();
 354         String name = permission.getName();
 355         String actions = permission.getActions();
 356
 357         if (classname == null || name == null) {
 358             return null;
 359         }
 360         classname = classname.trim();
 361         name = name.trim();
 362         actions = actions.trim();
 363
 364         if (AppPermission.class.getName().equals(classname)) {
 365             return new AppPermission(name);
 366         } else if (FilePermission.class.getName().equals(classname)) {
 367             return new FilePermission(name, actions);
 368         } else if (SerializablePermission.class.getName().equals(classname)) {
 369             return new SerializablePermission(name, actions);
 370         } else if (NetPermission.class.getName().equals(classname)) {
 371             return new NetPermission(name, actions);
 372         } else if (RuntimePermission.class.getName().equals(classname)) {
 373             return new RuntimePermission(name, actions);
 374         } else if (SocketPermission.class.getName().equals(classname)) {
 375             return new SocketPermission(name, actions);
 376         } else if (SQLPermission.class.getName().equals(classname)) {
 377             return new SQLPermission(name, actions);
 378         } else if (PropertyPermission.class.getName().equals(classname)) {
 379             return new PropertyPermission(name, actions);
 380         } else if (LoggingPermission.class.getName().equals(classname)) {
 381             return new LoggingPermission(name, actions);
 382         } else if (SSLPermission.class.getName().equals(classname)) {
 383             return new SSLPermission(name, actions);
 384         } else if (AuthPermission.class.getName().equals(classname)) {
 385             return new AuthPermission(name, actions);
 386         } else if (PrivateCredentialPermission.class.getName().equals(classname)) {
 387             return new PrivateCredentialPermission(name, actions);
 388         } else if (DelegationPermission.class.getName().equals(classname)) {
 389             return new DelegationPermission(name, actions);
 390         } else if (javax.security.auth.kerberos.ServicePermission.class.getName().equals(classname)) {
 391             return new javax.security.auth.kerberos.ServicePermission(name, actions);
 392         } else if (AudioPermission.class.getName().equals(classname)) {
 393             return new AudioPermission(name, actions);
 394         } else if (AdaptPermission.class.getName().equals(classname)) {
 395             return new AdaptPermission(name, actions);
 396         } else if (BundlePermission.class.getName().equals(classname)) {
 397             return new BundlePermission(name, actions);
 398         } else if (CapabilityPermission.class.getName().equals(classname)) {
 399             return new CapabilityPermission(name, actions);
 400         } else if (PackagePermission.class.getName().equals(classname)) {
 401             return new PackagePermission(name, actions);
 402         } else if (ServicePermission.class.getName().equals(classname)) {
 403             return new ServicePermission(name, actions);
 404         }
 405
 406         //AllPermission, SecurityPermission, UnresolvedPermission
 407         //AWTPermission, AdminPermission(osgi), ReflectPermission not allowed
 408         return null;
 409
 410     }
 411     private static List<Permission> optimizePermissions(List<Permission> perms) {
 412         Permissions permissions = listToPermissions(perms);
 413         return permissionsToList(permissions);
 414     }
 415
 416     private static List<Permission> permissionsToList(Permissions perms) {
 417         List<Permission> permissions = new ArrayList<>();
 418         Enumeration<Permission> e = perms.elements();
 419         while (e.hasMoreElements()) {
 420             permissions.add(e.nextElement());
 421         }
 422         return permissions;
 423     }
 424
 425     private static Permissions listToPermissions(List<Permission> perms) {
 426         Permissions permissions = new Permissions();
 427         for (Permission perm : perms) {
 428             permissions.add(perm);
 429         }
 430         return permissions;
 431     }
 432 }
 433