mirrors/onos
1
0
Fork 0
mirror of https://github.com/opennetworkinglab/onos.git synced 2025-10-17 10:21:52 +02:00
Code Issues Projects Releases Wiki Activity

More APIs permission for new ONOS APIs

Browse Source 
Change-Id: I43fee65254adca451f77431bfbf5accdf95b81ab
This commit is contained in:
Heedo Kang 2016-02-29 17:40:23 +09:00 committed by Gerrit Code Review
parent 661d4100a6
commit 4a47a304c4
26 changed files with 275 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
core/api/src/main/java/org/onosproject/security/AppPermission.java
View File

@ -29,11 +29,16 @@ public class AppPermission extends BasicPermission {
public enum Type { public enum Type {
APP_READ, APP_READ,
APP_EVENT, APP_EVENT,
APP_WRITE,
CONFIG_READ, CONFIG_READ,
CONFIG_WRITE, CONFIG_WRITE,
CONFIG_EVENT,
CLUSTER_READ, CLUSTER_READ,
CLUSTER_WRITE, CLUSTER_WRITE,
CLUSTER_EVENT, CLUSTER_EVENT,
CODEC_READ,
CODEC_WRITE,
CLOCK_WRITE,
DEVICE_KEY_EVENT, DEVICE_KEY_EVENT,
DEVICE_KEY_READ, DEVICE_KEY_READ,
DEVICE_KEY_WRITE, DEVICE_KEY_WRITE,
@ -41,6 +46,8 @@ public class AppPermission extends BasicPermission {
DEVICE_EVENT, DEVICE_EVENT,
DRIVER_READ, DRIVER_READ,
DRIVER_WRITE, DRIVER_WRITE,
EVENT_READ,
EVENT_WRITE,
FLOWRULE_READ, FLOWRULE_READ,
FLOWRULE_WRITE, FLOWRULE_WRITE,
FLOWRULE_EVENT, FLOWRULE_EVENT,
@ -56,16 +63,26 @@ public class AppPermission extends BasicPermission {
LINK_READ, LINK_READ,
LINK_WRITE, LINK_WRITE,
LINK_EVENT, LINK_EVENT,
MUTEX_WRITE,
PACKET_READ, PACKET_READ,
PACKET_WRITE, PACKET_WRITE,
PACKET_EVENT, PACKET_EVENT,
PERSISTENCE_WRITE,
PARTITION_READ,
PARTITION_EVENT,
RESOURCE_READ,
RESOURCE_WRITE,
RESOURCE_EVENT,
REGION_READ,
STATISTIC_READ, STATISTIC_READ,
STORAGE_WRITE,
TOPOLOGY_READ, TOPOLOGY_READ,
TOPOLOGY_EVENT, TOPOLOGY_EVENT,
TUNNEL_READ, TUNNEL_READ,
TUNNEL_WRITE, TUNNEL_WRITE,
TUNNEL_EVENT, TUNNEL_EVENT,
STORAGE_WRITE UI_READ,
UI_WRITE
} }
protected Type type; protected Type type;

7
core/common/src/main/java/org/onosproject/codec/impl/CodecManager.java
View File

@ -69,6 +69,9 @@ import java.util.Map;
import java.util.Set; import java.util.Set;
import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentHashMap;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
/** /**
* Implementation of the JSON codec brokering service. * Implementation of the JSON codec brokering service.
*/ */
@ -134,22 +137,26 @@ public class CodecManager implements CodecService {
@Override @Override
public Set<Class<?>> getCodecs() { public Set<Class<?>> getCodecs() {
checkPermission(CODEC_READ);
return ImmutableSet.copyOf(codecs.keySet()); return ImmutableSet.copyOf(codecs.keySet());
} }
@Override @Override
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public <T> JsonCodec<T> getCodec(Class<T> entityClass) { public <T> JsonCodec<T> getCodec(Class<T> entityClass) {
checkPermission(CODEC_READ);
return codecs.get(entityClass); return codecs.get(entityClass);
} }
@Override @Override
public <T> void registerCodec(Class<T> entityClass, JsonCodec<T> codec) { public <T> void registerCodec(Class<T> entityClass, JsonCodec<T> codec) {
checkPermission(CODEC_WRITE);
codecs.putIfAbsent(entityClass, codec); codecs.putIfAbsent(entityClass, codec);
} }
@Override @Override
public void unregisterCodec(Class<?> entityClass) { public void unregisterCodec(Class<?> entityClass) {
checkPermission(CODEC_WRITE);
codecs.remove(entityClass); codecs.remove(entityClass);
} }

6
core/common/src/test/java/org/onosproject/store/trivial/SimpleClusterStore.java
View File

@ -41,6 +41,8 @@ import org.slf4j.Logger;
import java.util.Set; import java.util.Set;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
/** /**
@ -119,21 +121,25 @@ public class SimpleClusterStore
@Override @Override
public boolean isMine(Key intentKey) { public boolean isMine(Key intentKey) {
checkPermission(INTENT_READ);
return true; return true;
} }
@Override @Override
public NodeId getLeader(Key intentKey) { public NodeId getLeader(Key intentKey) {
checkPermission(INTENT_READ);
return instance.id(); return instance.id();
} }
@Override @Override
public void addListener(IntentPartitionEventListener listener) { public void addListener(IntentPartitionEventListener listener) {
checkPermission(INTENT_EVENT);
listenerRegistry.addListener(listener); listenerRegistry.addListener(listener);
} }
@Override @Override
public void removeListener(IntentPartitionEventListener listener) { public void removeListener(IntentPartitionEventListener listener) {
checkPermission(INTENT_EVENT);
listenerRegistry.removeListener(listener); listenerRegistry.removeListener(listener);
} }
} }

29
core/net/src/main/java/org/onosproject/cluster/impl/ClusterMetadataManager.java
View File

@ -15,17 +15,6 @@
*/ */
package org.onosproject.cluster.impl; package org.onosproject.cluster.impl;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.NetworkInterface;
import java.net.SocketException;
import java.net.URL;
import java.util.Collection;
import java.util.Enumeration;
import org.apache.felix.scr.annotations.Activate; import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component; import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.Deactivate; import org.apache.felix.scr.annotations.Deactivate;
@ -47,6 +36,19 @@ import org.onosproject.net.provider.AbstractProviderService;
import org.onosproject.store.service.Versioned; import org.onosproject.store.service.Versioned;
import org.slf4j.Logger; import org.slf4j.Logger;
import java.net.InetAddress;
import java.net.MalformedURLException;
import java.net.NetworkInterface;
import java.net.SocketException;
import java.net.URL;
import java.util.Collection;
import java.util.Enumeration;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.CLUSTER_READ;
import static org.slf4j.LoggerFactory.getLogger;
/** /**
* Implementation of ClusterMetadataService. * Implementation of ClusterMetadataService.
*/ */
@ -77,6 +79,7 @@ public class ClusterMetadataManager
@Override @Override
public ClusterMetadata getClusterMetadata() { public ClusterMetadata getClusterMetadata() {
checkPermission(CLUSTER_READ);
Versioned<ClusterMetadata> metadata = getProvider().getClusterMetadata(); Versioned<ClusterMetadata> metadata = getProvider().getClusterMetadata();
return metadata.value(); return metadata.value();
} }
@ -85,11 +88,13 @@ public class ClusterMetadataManager
@Override @Override
protected ClusterMetadataProviderService createProviderService( protected ClusterMetadataProviderService createProviderService(
ClusterMetadataProvider provider) { ClusterMetadataProvider provider) {
checkPermission(CLUSTER_READ);
return new InternalClusterMetadataProviderService(provider); return new InternalClusterMetadataProviderService(provider);
} }
@Override @Override
public ControllerNode getLocalNode() { public ControllerNode getLocalNode() {
checkPermission(CLUSTER_READ);
if (localNode == null) { if (localNode == null) {
establishSelfIdentity(); establishSelfIdentity();
} }
@ -188,4 +193,4 @@ public class ClusterMetadataManager
// TODO: notify listeners // TODO: notify listeners
} }
} }
} }

1
core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
View File

@ -187,6 +187,7 @@ public class MastershipManager
@Override @Override
public MastershipTerm getMastershipTerm(DeviceId deviceId) { public MastershipTerm getMastershipTerm(DeviceId deviceId) {
checkPermission(CLUSTER_READ);
return store.getTermFor(deviceId); return store.getTermFor(deviceId);
} }

6
core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
View File

@ -50,8 +50,7 @@ import java.util.Set;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.base.Strings.isNullOrEmpty; import static com.google.common.base.Strings.isNullOrEmpty;
import static org.onosproject.security.AppGuard.checkPermission; import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.APP_READ; import static org.onosproject.security.AppPermission.Type.*;
/** /**
@ -149,12 +148,14 @@ public class CoreManager implements CoreService {
@Override @Override
public ApplicationId registerApplication(String name) { public ApplicationId registerApplication(String name) {
checkPermission(APP_WRITE);
checkNotNull(name, "Application ID cannot be null"); checkNotNull(name, "Application ID cannot be null");
return applicationIdStore.registerApplication(name); return applicationIdStore.registerApplication(name);
} }
@Override @Override
public ApplicationId registerApplication(String name, Runnable preDeactivate) { public ApplicationId registerApplication(String name, Runnable preDeactivate) {
checkPermission(APP_WRITE);
ApplicationId id = registerApplication(name); ApplicationId id = registerApplication(name);
appService.registerDeactivateHook(id, preDeactivate); appService.registerDeactivateHook(id, preDeactivate);
return id; return id;
@ -162,6 +163,7 @@ public class CoreManager implements CoreService {
@Override @Override
public IdGenerator getIdGenerator(String topic) { public IdGenerator getIdGenerator(String topic) {
checkPermission(APP_READ);
IdBlockAllocator allocator = new StoreBasedIdBlockAllocator(topic, idBlockStore); IdBlockAllocator allocator = new StoreBasedIdBlockAllocator(topic, idBlockStore);
return new BlockAllocatorBasedIdGenerator(allocator); return new BlockAllocatorBasedIdGenerator(allocator);
} }

4
core/net/src/main/java/org/onosproject/event/impl/CoreEventDispatcher.java
View File

@ -38,6 +38,8 @@ import static java.util.concurrent.Executors.newSingleThreadExecutor;
import static org.onlab.util.Tools.groupedThreads; import static org.onlab.util.Tools.groupedThreads;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
/** /**
* Simple implementation of an event dispatching service. * Simple implementation of an event dispatching service.
*/ */
@ -96,6 +98,7 @@ public class CoreEventDispatcher extends DefaultEventSinkRegistry
@Override @Override
public void setDispatchTimeLimit(long millis) { public void setDispatchTimeLimit(long millis) {
checkPermission(EVENT_WRITE);
checkArgument(millis >= WATCHDOG_MS, checkArgument(millis >= WATCHDOG_MS,
"Time limit must be greater than %s", WATCHDOG_MS); "Time limit must be greater than %s", WATCHDOG_MS);
maxProcessMillis = millis; maxProcessMillis = millis;
@ -103,6 +106,7 @@ public class CoreEventDispatcher extends DefaultEventSinkRegistry
@Override @Override
public long getDispatchTimeLimit() { public long getDispatchTimeLimit() {
checkPermission(EVENT_READ);
return maxProcessMillis; return maxProcessMillis;
} }

14
core/net/src/main/java/org/onosproject/net/config/impl/NetworkConfigManager.java
View File

@ -42,6 +42,8 @@ import java.util.Objects;
import java.util.Set; import java.util.Set;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
/** /**
* Implementation of the network configuration subsystem. * Implementation of the network configuration subsystem.
@ -142,6 +144,7 @@ public class NetworkConfigManager
@Override @Override
public Set<Class> getSubjectClasses() { public Set<Class> getSubjectClasses() {
checkPermission(CONFIG_READ);
ImmutableSet.Builder<Class> builder = ImmutableSet.builder(); ImmutableSet.Builder<Class> builder = ImmutableSet.builder();
factories.forEach((k, v) -> builder.add(k.subjectClass)); factories.forEach((k, v) -> builder.add(k.subjectClass));
return builder.build(); return builder.build();
@ -149,16 +152,19 @@ public class NetworkConfigManager
@Override @Override
public SubjectFactory getSubjectFactory(String subjectClassKey) { public SubjectFactory getSubjectFactory(String subjectClassKey) {
checkPermission(CONFIG_READ);
return subjectClasses.get(subjectClassKey); return subjectClasses.get(subjectClassKey);
} }
@Override @Override
public SubjectFactory getSubjectFactory(Class subjectClass) { public SubjectFactory getSubjectFactory(Class subjectClass) {
checkPermission(CONFIG_READ);
return subjectClassKeys.get(subjectClass); return subjectClassKeys.get(subjectClass);
} }
@Override @Override
public Class<? extends Config> getConfigClass(String subjectClassKey, String configKey) { public Class<? extends Config> getConfigClass(String subjectClassKey, String configKey) {
checkPermission(CONFIG_READ);
checkNotNull(subjectClassKey, NULL_SCKEY_MSG); checkNotNull(subjectClassKey, NULL_SCKEY_MSG);
checkNotNull(configKey, NULL_CKEY_MSG); checkNotNull(configKey, NULL_CKEY_MSG);
return configClasses.get(new ConfigIdentifier(subjectClassKey, configKey)); return configClasses.get(new ConfigIdentifier(subjectClassKey, configKey));
@ -166,12 +172,14 @@ public class NetworkConfigManager
@Override @Override
public <S> Set<S> getSubjects(Class<S> subjectClass) { public <S> Set<S> getSubjects(Class<S> subjectClass) {
checkPermission(CONFIG_READ);
checkNotNull(subjectClass, NULL_SCLASS_MSG); checkNotNull(subjectClass, NULL_SCLASS_MSG);
return store.getSubjects(subjectClass); return store.getSubjects(subjectClass);
} }
@Override @Override
public <S, C extends Config<S>> Set<S> getSubjects(Class<S> subjectClass, Class<C> configClass) { public <S, C extends Config<S>> Set<S> getSubjects(Class<S> subjectClass, Class<C> configClass) {
checkPermission(CONFIG_READ);
checkNotNull(subjectClass, NULL_SCLASS_MSG); checkNotNull(subjectClass, NULL_SCLASS_MSG);
checkNotNull(configClass, NULL_CCLASS_MSG); checkNotNull(configClass, NULL_CCLASS_MSG);
return store.getSubjects(subjectClass, configClass); return store.getSubjects(subjectClass, configClass);
@ -179,6 +187,7 @@ public class NetworkConfigManager
@Override @Override
public <S> Set<Config<S>> getConfigs(S subject) { public <S> Set<Config<S>> getConfigs(S subject) {
checkPermission(CONFIG_READ);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
Set<Class<? extends Config<S>>> configClasses = store.getConfigClasses(subject); Set<Class<? extends Config<S>>> configClasses = store.getConfigClasses(subject);
ImmutableSet.Builder<Config<S>> cfg = ImmutableSet.builder(); ImmutableSet.Builder<Config<S>> cfg = ImmutableSet.builder();
@ -188,6 +197,7 @@ public class NetworkConfigManager
@Override @Override
public <S, C extends Config<S>> C getConfig(S subject, Class<C> configClass) { public <S, C extends Config<S>> C getConfig(S subject, Class<C> configClass) {
checkPermission(CONFIG_READ);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
checkNotNull(configClass, NULL_CCLASS_MSG); checkNotNull(configClass, NULL_CCLASS_MSG);
return store.getConfig(subject, configClass); return store.getConfig(subject, configClass);
@ -196,6 +206,7 @@ public class NetworkConfigManager
@Override @Override
public <S, C extends Config<S>> C addConfig(S subject, Class<C> configClass) { public <S, C extends Config<S>> C addConfig(S subject, Class<C> configClass) {
checkPermission(CONFIG_WRITE);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
checkNotNull(configClass, NULL_CCLASS_MSG); checkNotNull(configClass, NULL_CCLASS_MSG);
return store.createConfig(subject, configClass); return store.createConfig(subject, configClass);
@ -203,6 +214,7 @@ public class NetworkConfigManager
@Override @Override
public <S, C extends Config<S>> C applyConfig(S subject, Class<C> configClass, JsonNode json) { public <S, C extends Config<S>> C applyConfig(S subject, Class<C> configClass, JsonNode json) {
checkPermission(CONFIG_WRITE);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
checkNotNull(configClass, NULL_CCLASS_MSG); checkNotNull(configClass, NULL_CCLASS_MSG);
checkNotNull(json, NULL_JSON_MSG); checkNotNull(json, NULL_JSON_MSG);
@ -213,6 +225,7 @@ public class NetworkConfigManager
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
public <S, C extends Config<S>> C applyConfig(String subjectClassKey, S subject, public <S, C extends Config<S>> C applyConfig(String subjectClassKey, S subject,
String configKey, JsonNode json) { String configKey, JsonNode json) {
checkPermission(CONFIG_WRITE);
checkNotNull(subjectClassKey, NULL_SCKEY_MSG); checkNotNull(subjectClassKey, NULL_SCKEY_MSG);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
checkNotNull(configKey, NULL_CKEY_MSG); checkNotNull(configKey, NULL_CKEY_MSG);
@ -229,6 +242,7 @@ public class NetworkConfigManager
@Override @Override
public <S, C extends Config<S>> void removeConfig(S subject, Class<C> configClass) { public <S, C extends Config<S>> void removeConfig(S subject, Class<C> configClass) {
checkPermission(CONFIG_WRITE);
checkNotNull(subject, NULL_SUBJECT_MSG); checkNotNull(subject, NULL_SUBJECT_MSG);
checkNotNull(configClass, NULL_CCLASS_MSG); checkNotNull(configClass, NULL_CCLASS_MSG);
store.clearConfig(subject, configClass); store.clearConfig(subject, configClass);

6
core/net/src/main/java/org/onosproject/net/edgeservice/impl/EdgeManager.java
View File

@ -56,6 +56,8 @@ import static org.onosproject.net.device.DeviceEvent.Type.*;
import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_ADDED; import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_ADDED;
import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_REMOVED; import static org.onosproject.net.edge.EdgePortEvent.Type.EDGE_PORT_REMOVED;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
/** /**
* This is an implementation of the edge net service. * This is an implementation of the edge net service.
@ -107,11 +109,13 @@ public class EdgeManager
@Override @Override
public boolean isEdgePoint(ConnectPoint point) { public boolean isEdgePoint(ConnectPoint point) {
checkPermission(TOPOLOGY_READ);
return !topologyService.isInfrastructure(topologyService.currentTopology(), point); return !topologyService.isInfrastructure(topologyService.currentTopology(), point);
} }
@Override @Override
public Iterable<ConnectPoint> getEdgePoints() { public Iterable<ConnectPoint> getEdgePoints() {
checkPermission(TOPOLOGY_READ);
ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder(); ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder();
connectionPoints.forEach((k, v) -> v.forEach(builder::add)); connectionPoints.forEach((k, v) -> v.forEach(builder::add));
return builder.build(); return builder.build();
@ -119,6 +123,7 @@ public class EdgeManager
@Override @Override
public Iterable<ConnectPoint> getEdgePoints(DeviceId deviceId) { public Iterable<ConnectPoint> getEdgePoints(DeviceId deviceId) {
checkPermission(TOPOLOGY_READ);
ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder(); ImmutableSet.Builder<ConnectPoint> builder = ImmutableSet.builder();
Set<ConnectPoint> set = connectionPoints.get(deviceId); Set<ConnectPoint> set = connectionPoints.get(deviceId);
if (set != null) { if (set != null) {
@ -129,6 +134,7 @@ public class EdgeManager
@Override @Override
public void emitPacket(ByteBuffer data, Optional<TrafficTreatment> treatment) { public void emitPacket(ByteBuffer data, Optional<TrafficTreatment> treatment) {
checkPermission(PACKET_WRITE);
TrafficTreatment.Builder builder = treatment.map(DefaultTrafficTreatment::builder) TrafficTreatment.Builder builder = treatment.map(DefaultTrafficTreatment::builder)
.orElse(DefaultTrafficTreatment.builder()); .orElse(DefaultTrafficTreatment.builder());
getEdgePoints().forEach(p -> packetService.emit(packet(builder, p, data))); getEdgePoints().forEach(p -> packetService.emit(packet(builder, p, data)));

1
core/net/src/main/java/org/onosproject/net/flowobjective/impl/composition/FlowObjectiveCompositionManager.java
View File

@ -272,6 +272,7 @@ public class FlowObjectiveCompositionManager implements FlowObjectiveService {
@Override @Override
public void initPolicy(String policy) { public void initPolicy(String policy) {
checkPermission(FLOWRULE_WRITE);
this.policy = policy; this.policy = policy;
deviceService.getDevices().forEach(device -> deviceService.getDevices().forEach(device ->
this.deviceCompositionTreeMap.put(device.id(), FlowObjectiveCompositionUtil.parsePolicyString(policy))); this.deviceCompositionTreeMap.put(device.id(), FlowObjectiveCompositionUtil.parsePolicyString(policy)));

3
core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
View File

@ -282,16 +282,19 @@ public class IntentManager
@Override @Override
public <T extends Intent> void registerCompiler(Class<T> cls, IntentCompiler<T> compiler) { public <T extends Intent> void registerCompiler(Class<T> cls, IntentCompiler<T> compiler) {
checkPermission(INTENT_WRITE);
compilerRegistry.registerCompiler(cls, compiler); compilerRegistry.registerCompiler(cls, compiler);
} }
@Override @Override
public <T extends Intent> void unregisterCompiler(Class<T> cls) { public <T extends Intent> void unregisterCompiler(Class<T> cls) {
checkPermission(INTENT_WRITE);
compilerRegistry.unregisterCompiler(cls); compilerRegistry.unregisterCompiler(cls);
} }
@Override @Override
public Map<Class<? extends Intent>, IntentCompiler<? extends Intent>> getCompilers() { public Map<Class<? extends Intent>, IntentCompiler<? extends Intent>> getCompilers() {
checkPermission(INTENT_READ);
return compilerRegistry.getCompilers(); return compilerRegistry.getCompilers();
} }

3
core/net/src/main/java/org/onosproject/net/key/impl/DeviceKeyManager.java
View File

@ -38,7 +38,6 @@ import java.util.Collection;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.security.AppGuard.checkPermission; import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.DEVICE_KEY_READ; import static org.onosproject.security.AppPermission.Type.DEVICE_KEY_READ;
import static org.onosproject.security.AppPermission.Type.DEVICE_KEY_WRITE;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
/** /**
@ -72,14 +71,12 @@ public class DeviceKeyManager extends AbstractListenerManager<DeviceKeyEvent, De
@Override @Override
public void addKey(DeviceKey deviceKey) { public void addKey(DeviceKey deviceKey) {
checkPermission(DEVICE_KEY_WRITE);
checkNotNull(deviceKey, "Device key cannot be null"); checkNotNull(deviceKey, "Device key cannot be null");
store.createOrUpdateDeviceKey(deviceKey); store.createOrUpdateDeviceKey(deviceKey);
} }
@Override @Override
public void removeKey(DeviceKeyId deviceKeyId) { public void removeKey(DeviceKeyId deviceKeyId) {
checkPermission(DEVICE_KEY_WRITE);
checkNotNull(deviceKeyId, "Device key identifier cannot be null"); checkNotNull(deviceKeyId, "Device key identifier cannot be null");
store.deleteDeviceKey(deviceKeyId); store.deleteDeviceKey(deviceKeyId);
} }

13
core/net/src/main/java/org/onosproject/net/newresource/impl/ResourceManager.java
View File

@ -45,6 +45,9 @@ import java.util.Set;
import java.util.stream.Collectors; import java.util.stream.Collectors;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.RESOURCE_WRITE;
import static org.onosproject.security.AppPermission.Type.RESOURCE_READ;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
/** /**
@ -82,6 +85,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public List<ResourceAllocation> allocate(ResourceConsumer consumer, public List<ResourceAllocation> allocate(ResourceConsumer consumer,
List<Resource> resources) { List<Resource> resources) {
checkPermission(RESOURCE_WRITE);
checkNotNull(consumer); checkNotNull(consumer);
checkNotNull(resources); checkNotNull(resources);
@ -97,6 +101,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public boolean release(List<ResourceAllocation> allocations) { public boolean release(List<ResourceAllocation> allocations) {
checkPermission(RESOURCE_WRITE);
checkNotNull(allocations); checkNotNull(allocations);
return store.release(allocations); return store.release(allocations);
@ -112,6 +117,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public List<ResourceAllocation> getResourceAllocations(ResourceId id) { public List<ResourceAllocation> getResourceAllocations(ResourceId id) {
checkPermission(RESOURCE_READ);
checkNotNull(id); checkNotNull(id);
return store.getResourceAllocations(id); return store.getResourceAllocations(id);
@ -119,6 +125,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public <T> Collection<ResourceAllocation> getResourceAllocations(DiscreteResourceId parent, Class<T> cls) { public <T> Collection<ResourceAllocation> getResourceAllocations(DiscreteResourceId parent, Class<T> cls) {
checkPermission(RESOURCE_READ);
checkNotNull(parent); checkNotNull(parent);
checkNotNull(cls); checkNotNull(cls);
@ -131,6 +138,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public Collection<ResourceAllocation> getResourceAllocations(ResourceConsumer consumer) { public Collection<ResourceAllocation> getResourceAllocations(ResourceConsumer consumer) {
checkPermission(RESOURCE_READ);
checkNotNull(consumer); checkNotNull(consumer);
Collection<Resource> resources = store.getResources(consumer); Collection<Resource> resources = store.getResources(consumer);
@ -141,6 +149,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public Set<Resource> getAvailableResources(DiscreteResourceId parent) { public Set<Resource> getAvailableResources(DiscreteResourceId parent) {
checkPermission(RESOURCE_READ);
checkNotNull(parent); checkNotNull(parent);
Set<Resource> children = store.getChildResources(parent); Set<Resource> children = store.getChildResources(parent);
@ -152,6 +161,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public <T> Set<Resource> getAvailableResources(DiscreteResourceId parent, Class<T> cls) { public <T> Set<Resource> getAvailableResources(DiscreteResourceId parent, Class<T> cls) {
checkPermission(RESOURCE_READ);
checkNotNull(parent); checkNotNull(parent);
checkNotNull(cls); checkNotNull(cls);
@ -163,6 +173,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public <T> Set<T> getAvailableResourceValues(DiscreteResourceId parent, Class<T> cls) { public <T> Set<T> getAvailableResourceValues(DiscreteResourceId parent, Class<T> cls) {
checkPermission(RESOURCE_READ);
checkNotNull(parent); checkNotNull(parent);
checkNotNull(cls); checkNotNull(cls);
@ -174,6 +185,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public Set<Resource> getRegisteredResources(DiscreteResourceId parent) { public Set<Resource> getRegisteredResources(DiscreteResourceId parent) {
checkPermission(RESOURCE_READ);
checkNotNull(parent); checkNotNull(parent);
return store.getChildResources(parent); return store.getChildResources(parent);
@ -181,6 +193,7 @@ public final class ResourceManager extends AbstractListenerManager<ResourceEvent
@Override @Override
public boolean isAvailable(Resource resource) { public boolean isAvailable(Resource resource) {
checkPermission(RESOURCE_READ);
checkNotNull(resource); checkNotNull(resource);
return store.isAvailable(resource); return store.isAvailable(resource);

2
core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
View File

@ -175,6 +175,7 @@ public class PacketManager
@Override @Override
public List<PacketProcessorEntry> getProcessors() { public List<PacketProcessorEntry> getProcessors() {
checkPermission(PACKET_READ);
return ImmutableList.copyOf(processors); return ImmutableList.copyOf(processors);
} }
@ -233,6 +234,7 @@ public class PacketManager
@Override @Override
public List<PacketRequest> getRequests() { public List<PacketRequest> getRequests() {
checkPermission(PACKET_READ);
return store.existingRequests(); return store.existingRequests();
} }

6
core/net/src/main/java/org/onosproject/net/region/impl/RegionManager.java
View File

@ -43,6 +43,8 @@ import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.base.Preconditions.checkState; import static com.google.common.base.Preconditions.checkState;
import static com.google.common.collect.ImmutableList.of; import static com.google.common.collect.ImmutableList.of;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.REGION_READ;
/** /**
* Provides implementation of the region service APIs. * Provides implementation of the region service APIs.
@ -122,23 +124,27 @@ public class RegionManager extends AbstractListenerManager<RegionEvent, RegionLi
@Override @Override
public Set<Region> getRegions() { public Set<Region> getRegions() {
checkPermission(REGION_READ);
return store.getRegions(); return store.getRegions();
} }
@Override @Override
public Region getRegion(RegionId regionId) { public Region getRegion(RegionId regionId) {
checkPermission(REGION_READ);
checkNotNull(regionId, REGION_ID_NULL); checkNotNull(regionId, REGION_ID_NULL);
return store.getRegion(regionId); return store.getRegion(regionId);
} }
@Override @Override
public Region getRegionForDevice(DeviceId deviceId) { public Region getRegionForDevice(DeviceId deviceId) {
checkPermission(REGION_READ);
checkNotNull(deviceId, DEVICE_ID_NULL); checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getRegionForDevice(deviceId); return store.getRegionForDevice(deviceId);
} }
@Override @Override
public Set<DeviceId> getRegionDevices(RegionId regionId) { public Set<DeviceId> getRegionDevices(RegionId regionId) {
checkPermission(REGION_READ);
checkNotNull(regionId, REGION_ID_NULL); checkNotNull(regionId, REGION_ID_NULL);
return store.getRegionDevices(regionId); return store.getRegionDevices(regionId);
} }

4
core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
View File

@ -134,11 +134,13 @@ public class PathManager implements PathService {
@Override @Override
public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst) { public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst) {
checkPermission(TOPOLOGY_READ);
return getDisjointPaths(src, dst, (LinkWeight) null); return getDisjointPaths(src, dst, (LinkWeight) null);
} }
@Override @Override
public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight) { public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight) {
checkPermission(TOPOLOGY_READ);
checkNotNull(src, ELEMENT_ID_NULL); checkNotNull(src, ELEMENT_ID_NULL);
checkNotNull(dst, ELEMENT_ID_NULL); checkNotNull(dst, ELEMENT_ID_NULL);
@ -173,12 +175,14 @@ public class PathManager implements PathService {
@Override @Override
public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst,
Map<Link, Object> riskProfile) { Map<Link, Object> riskProfile) {
checkPermission(TOPOLOGY_READ);
return getDisjointPaths(src, dst, null, riskProfile); return getDisjointPaths(src, dst, null, riskProfile);
} }
@Override @Override
public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight, public Set<DisjointPath> getDisjointPaths(ElementId src, ElementId dst, LinkWeight weight,
Map<Link, Object> riskProfile) { Map<Link, Object> riskProfile) {
checkPermission(TOPOLOGY_READ);
checkNotNull(src, ELEMENT_ID_NULL); checkNotNull(src, ELEMENT_ID_NULL);
checkNotNull(dst, ELEMENT_ID_NULL); checkNotNull(dst, ELEMENT_ID_NULL);

4
core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
View File

@ -166,6 +166,7 @@ public class TopologyManager
@Override @Override
public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst) { public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst) {
checkPermission(TOPOLOGY_READ);
checkNotNull(topology, TOPOLOGY_NULL); checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL); checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL); checkNotNull(dst, DEVICE_ID_NULL);
@ -175,6 +176,7 @@ public class TopologyManager
@Override @Override
public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src,
DeviceId dst, LinkWeight weight) { DeviceId dst, LinkWeight weight) {
checkPermission(TOPOLOGY_READ);
checkNotNull(topology, TOPOLOGY_NULL); checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL); checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL); checkNotNull(dst, DEVICE_ID_NULL);
@ -185,6 +187,7 @@ public class TopologyManager
@Override @Override
public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst, public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, DeviceId dst,
Map<Link, Object> riskProfile) { Map<Link, Object> riskProfile) {
checkPermission(TOPOLOGY_READ);
checkNotNull(topology, TOPOLOGY_NULL); checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL); checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL); checkNotNull(dst, DEVICE_ID_NULL);
@ -195,6 +198,7 @@ public class TopologyManager
public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src, public Set<DisjointPath> getDisjointPaths(Topology topology, DeviceId src,
DeviceId dst, LinkWeight weight, DeviceId dst, LinkWeight weight,
Map<Link, Object> riskProfile) { Map<Link, Object> riskProfile) {
checkPermission(TOPOLOGY_READ);
checkNotNull(topology, TOPOLOGY_NULL); checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL); checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL); checkNotNull(dst, DEVICE_ID_NULL);

126
core/security/src/main/java/org/onosproject/security/impl/DefaultPolicyBuilder.java
View File

@ -19,14 +19,31 @@ package org.onosproject.security.impl;
import com.google.common.collect.ImmutableSet; import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Lists; import com.google.common.collect.Lists;
import com.google.common.collect.Sets; import com.google.common.collect.Sets;
import org.onosproject.cluster.ClusterAdminService;
import org.onosproject.cluster.ClusterMetadataService;
import org.onosproject.cluster.ClusterService;
import org.onosproject.cluster.ClusterMetadataAdminService;
import org.onosproject.cluster.LeadershipService;
import org.onosproject.cluster.LeadershipAdminService;
import org.onosproject.codec.CodecService;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.mastership.MastershipTermService;
import org.onosproject.net.config.BasicNetworkConfigService;
import org.onosproject.net.config.NetworkConfigService;
import org.onosproject.net.edge.EdgePortService;
import org.onosproject.net.key.DeviceKeyAdminService;
import org.onosproject.net.key.DeviceKeyService;
import org.onosproject.net.newresource.ResourceAdminService;
import org.onosproject.net.newresource.ResourceService;
import org.onosproject.net.region.RegionAdminService;
import org.onosproject.net.region.RegionService;
import org.onosproject.net.statistic.FlowStatisticService;
import org.onosproject.persistence.PersistenceService;
import org.onosproject.security.AppPermission; import org.onosproject.security.AppPermission;
import org.onosproject.app.ApplicationAdminService; import org.onosproject.app.ApplicationAdminService;
import org.onosproject.app.ApplicationService; import org.onosproject.app.ApplicationService;
import org.onosproject.cfg.ComponentConfigService; import org.onosproject.cfg.ComponentConfigService;
import org.onosproject.cluster.ClusterAdminService;
import org.onosproject.cluster.ClusterService;
import org.onosproject.core.CoreService; import org.onosproject.core.CoreService;
import org.onosproject.cluster.LeadershipService;
import org.onosproject.mastership.MastershipAdminService; import org.onosproject.mastership.MastershipAdminService;
import org.onosproject.mastership.MastershipService; import org.onosproject.mastership.MastershipService;
import org.onosproject.net.device.DeviceAdminService; import org.onosproject.net.device.DeviceAdminService;
@ -47,13 +64,19 @@ import org.onosproject.net.link.LinkAdminService;
import org.onosproject.net.link.LinkService; import org.onosproject.net.link.LinkService;
import org.onosproject.net.packet.PacketService; import org.onosproject.net.packet.PacketService;
import org.onosproject.net.proxyarp.ProxyArpService; import org.onosproject.net.proxyarp.ProxyArpService;
import org.onosproject.net.resource.link.LinkResourceService;
import org.onosproject.net.statistic.StatisticService; import org.onosproject.net.statistic.StatisticService;
import org.onosproject.net.topology.PathService; import org.onosproject.net.topology.PathService;
import org.onosproject.net.topology.TopologyService; import org.onosproject.net.topology.TopologyService;
import org.onosproject.security.SecurityAdminService; import org.onosproject.security.SecurityAdminService;
import org.onosproject.store.cluster.messaging.ClusterCommunicationService;
import org.onosproject.store.cluster.messaging.MessagingService;
import org.onosproject.store.primitives.PartitionAdminService;
import org.onosproject.store.primitives.PartitionService;
import org.onosproject.store.service.LogicalClockService;
import org.onosproject.store.service.MutexExecutionService;
import org.onosproject.store.service.StorageAdminService; import org.onosproject.store.service.StorageAdminService;
import org.onosproject.store.service.StorageService; import org.onosproject.store.service.StorageService;
import org.onosproject.ui.UiExtensionService;
import org.osgi.framework.ServicePermission; import org.osgi.framework.ServicePermission;
import org.osgi.framework.AdminPermission; import org.osgi.framework.AdminPermission;
import org.osgi.framework.AdaptPermission; import org.osgi.framework.AdaptPermission;
@ -169,23 +192,35 @@ public final class DefaultPolicyBuilder {
List<Permission> permSet = Lists.newArrayList(); List<Permission> permSet = Lists.newArrayList();
permSet.add(new ServicePermission(ApplicationAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ApplicationAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ClusterAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ClusterAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LeadershipAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ClusterMetadataAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(MastershipAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(MastershipAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DeviceAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(DeviceAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(HostAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LinkAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DriverAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(DriverAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(HostAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DeviceKeyAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LinkAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ResourceAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(RegionAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(PartitionAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(StorageAdminService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(StorageAdminService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(LabelResourceAdminService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(TunnelAdminService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ApplicationService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ApplicationService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ComponentConfigService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ComponentConfigService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(CoreService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ClusterMetadataService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ClusterService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ClusterService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LeadershipService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(LeadershipService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(CodecService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(CoreService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(EventDeliveryService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(MastershipService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(MastershipService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(MastershipTermService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(BasicNetworkConfigService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(NetworkConfigService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DeviceService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(DeviceService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DeviceClockService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(DeviceClockService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DriverService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(DriverService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(EdgePortService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(FlowRuleService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(FlowRuleService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(FlowObjectiveService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(FlowObjectiveService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(GroupService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(GroupService.class.getName(), ServicePermission.GET));
@ -194,16 +229,29 @@ public final class DefaultPolicyBuilder {
permSet.add(new ServicePermission(IntentClockService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(IntentClockService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(IntentExtensionService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(IntentExtensionService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(IntentPartitionService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(IntentPartitionService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(DeviceKeyService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LinkService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(LinkService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LinkResourceService.class.getName(), ServicePermission.GET)); // permSet.add(new ServicePermission(MulticastRouteService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(LabelResourceService.class.getName(), ServicePermission.GET)); // permSet.add(new ServicePermission(MeterService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ResourceService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(PacketService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(PacketService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ProxyArpService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(ProxyArpService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(RegionService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(LinkResourceService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(FlowStatisticService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(StatisticService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(StatisticService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(PathService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(PathService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(TopologyService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(TopologyService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(TunnelService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(PersistenceService.class.getName(), ServicePermission.GET));
// permSet.add(new ServicePermission(ApiDocService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(ClusterCommunicationService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(MessagingService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(PartitionService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(LogicalClockService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(MutexExecutionService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(StorageService.class.getName(), ServicePermission.GET)); permSet.add(new ServicePermission(StorageService.class.getName(), ServicePermission.GET));
permSet.add(new ServicePermission(UiExtensionService.class.getName(), ServicePermission.GET));
return permSet; return permSet;
} }
@ -223,15 +271,21 @@ public final class DefaultPolicyBuilder {
ApplicationService.class.getName(), CoreService.class.getName())); ApplicationService.class.getName(), CoreService.class.getName()));
serviceDirectory.put(APP_EVENT, ImmutableSet.of( serviceDirectory.put(APP_EVENT, ImmutableSet.of(
ApplicationService.class.getName(), CoreService.class.getName())); ApplicationService.class.getName(), CoreService.class.getName()));
serviceDirectory.put(APP_WRITE, ImmutableSet.of(
CoreService.class.getName()));
serviceDirectory.put(CONFIG_READ, ImmutableSet.of( serviceDirectory.put(CONFIG_READ, ImmutableSet.of(
ComponentConfigService.class.getName())); ComponentConfigService.class.getName(), NetworkConfigService.class.getName()));
serviceDirectory.put(CONFIG_WRITE, ImmutableSet.of( serviceDirectory.put(CONFIG_WRITE, ImmutableSet.of(
ComponentConfigService.class.getName())); ComponentConfigService.class.getName(), NetworkConfigService.class.getName()));
serviceDirectory.put(CONFIG_EVENT, ImmutableSet.of(
NetworkConfigService.class.getName()));
serviceDirectory.put(CLUSTER_READ, ImmutableSet.of( serviceDirectory.put(CLUSTER_READ, ImmutableSet.of(
ClusterService.class.getName(), LeadershipService.class.getName(), ClusterService.class.getName(), LeadershipService.class.getName(),
MastershipService.class.getName())); MastershipService.class.getName(), ClusterMetadataService.class.getName(),
MastershipTermService.class.getName()));
serviceDirectory.put(CLUSTER_WRITE, ImmutableSet.of( serviceDirectory.put(CLUSTER_WRITE, ImmutableSet.of(
LeadershipService.class.getName(), MastershipService.class.getName())); LeadershipService.class.getName(), MastershipService.class.getName(),
ClusterCommunicationService.class.getName(), MessagingService.class.getName()));
serviceDirectory.put(CLUSTER_EVENT, ImmutableSet.of( serviceDirectory.put(CLUSTER_EVENT, ImmutableSet.of(
ClusterService.class.getName(), LeadershipService.class.getName(), ClusterService.class.getName(), LeadershipService.class.getName(),
MastershipService.class.getName())); MastershipService.class.getName()));
@ -263,11 +317,11 @@ public final class DefaultPolicyBuilder {
HostService.class.getName())); HostService.class.getName()));
serviceDirectory.put(INTENT_READ, ImmutableSet.of( serviceDirectory.put(INTENT_READ, ImmutableSet.of(
IntentService.class.getName(), IntentPartitionService.class.getName(), IntentService.class.getName(), IntentPartitionService.class.getName(),
IntentClockService.class.getName())); IntentClockService.class.getName(), IntentExtensionService.class.getName()));
serviceDirectory.put(INTENT_WRITE, ImmutableSet.of( serviceDirectory.put(INTENT_WRITE, ImmutableSet.of(
IntentService.class.getName())); IntentService.class.getName(), IntentExtensionService.class.getName()));
serviceDirectory.put(INTENT_EVENT, ImmutableSet.of( serviceDirectory.put(INTENT_EVENT, ImmutableSet.of(
IntentService.class.getName())); IntentService.class.getName(), IntentPartitionService.class.getName()));
// serviceDirectory.put(LINK_READ, ImmutableSet.of( // serviceDirectory.put(LINK_READ, ImmutableSet.of(
// LinkService.class.getName(), LinkResourceService.class.getName(), // LinkService.class.getName(), LinkResourceService.class.getName(),
// LabelResourceService.class.getName())); // LabelResourceService.class.getName()));
@ -279,13 +333,15 @@ public final class DefaultPolicyBuilder {
serviceDirectory.put(PACKET_READ, ImmutableSet.of( serviceDirectory.put(PACKET_READ, ImmutableSet.of(
PacketService.class.getName(), ProxyArpService.class.getName())); PacketService.class.getName(), ProxyArpService.class.getName()));
serviceDirectory.put(PACKET_WRITE, ImmutableSet.of( serviceDirectory.put(PACKET_WRITE, ImmutableSet.of(
PacketService.class.getName(), ProxyArpService.class.getName())); PacketService.class.getName(), ProxyArpService.class.getName(),
EdgePortService.class.getName()));
serviceDirectory.put(PACKET_EVENT, ImmutableSet.of( serviceDirectory.put(PACKET_EVENT, ImmutableSet.of(
PacketService.class.getName())); PacketService.class.getName()));
serviceDirectory.put(STATISTIC_READ, ImmutableSet.of( serviceDirectory.put(STATISTIC_READ, ImmutableSet.of(
StatisticService.class.getName())); StatisticService.class.getName(), FlowStatisticService.class.getName()));
serviceDirectory.put(TOPOLOGY_READ, ImmutableSet.of( serviceDirectory.put(TOPOLOGY_READ, ImmutableSet.of(
TopologyService.class.getName(), PathService.class.getName())); TopologyService.class.getName(), PathService.class.getName(),
EdgePortService.class.getName()));
serviceDirectory.put(TOPOLOGY_EVENT, ImmutableSet.of( serviceDirectory.put(TOPOLOGY_EVENT, ImmutableSet.of(
TopologyService.class.getName())); TopologyService.class.getName()));
// serviceDirectory.put(TUNNEL_READ, ImmutableSet.of( // serviceDirectory.put(TUNNEL_READ, ImmutableSet.of(
@ -296,6 +352,32 @@ public final class DefaultPolicyBuilder {
// TunnelService.class.getName())); // TunnelService.class.getName()));
serviceDirectory.put(STORAGE_WRITE, ImmutableSet.of( serviceDirectory.put(STORAGE_WRITE, ImmutableSet.of(
StorageService.class.getName())); StorageService.class.getName()));
serviceDirectory.put(CODEC_READ, ImmutableSet.of(
CodecService.class.getName()));
serviceDirectory.put(CODEC_WRITE, ImmutableSet.of(
CodecService.class.getName()));
serviceDirectory.put(EVENT_READ, ImmutableSet.of(
EventDeliveryService.class.getName()));
serviceDirectory.put(EVENT_WRITE, ImmutableSet.of(
EventDeliveryService.class.getName()));
serviceDirectory.put(RESOURCE_READ, ImmutableSet.of(
ResourceService.class.getName()));
serviceDirectory.put(RESOURCE_WRITE, ImmutableSet.of(
ResourceService.class.getName()));
serviceDirectory.put(RESOURCE_EVENT, ImmutableSet.of(
ResourceService.class.getName()));
serviceDirectory.put(REGION_READ, ImmutableSet.of(
RegionService.class.getName()));
serviceDirectory.put(PERSISTENCE_WRITE, ImmutableSet.of(
PersistenceService.class.getName()));
serviceDirectory.put(PARTITION_READ, ImmutableSet.of(
PartitionService.class.getName()));
serviceDirectory.put(PARTITION_EVENT, ImmutableSet.of(
PartitionService.class.getName()));
serviceDirectory.put(CLOCK_WRITE, ImmutableSet.of(
LogicalClockService.class.getName()));
serviceDirectory.put(MUTEX_WRITE, ImmutableSet.of(
MutexExecutionService.class.getName()));
return serviceDirectory; return serviceDirectory;
} }

12
core/store/dist/src/main/java/org/onosproject/store/cluster/messaging/impl/ClusterCommunicationManager.java vendored
View File

@ -50,6 +50,8 @@ import java.util.stream.Collectors;
import static com.google.common.base.Preconditions.checkArgument; import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.CLUSTER_WRITE;
@Component(immediate = true) @Component(immediate = true)
@Service @Service
@ -94,6 +96,7 @@ public class ClusterCommunicationManager
public <M> void broadcast(M message, public <M> void broadcast(M message,
MessageSubject subject, MessageSubject subject,
Function<M, byte[]> encoder) { Function<M, byte[]> encoder) {
checkPermission(CLUSTER_WRITE);
multicast(message, multicast(message,
subject, subject,
encoder, encoder,
@ -108,6 +111,7 @@ public class ClusterCommunicationManager
public <M> void broadcastIncludeSelf(M message, public <M> void broadcastIncludeSelf(M message,
MessageSubject subject, MessageSubject subject,
Function<M, byte[]> encoder) { Function<M, byte[]> encoder) {
checkPermission(CLUSTER_WRITE);
multicast(message, multicast(message,
subject, subject,
encoder, encoder,
@ -122,6 +126,7 @@ public class ClusterCommunicationManager
MessageSubject subject, MessageSubject subject,
Function<M, byte[]> encoder, Function<M, byte[]> encoder,
NodeId toNodeId) { NodeId toNodeId) {
checkPermission(CLUSTER_WRITE);
try { try {
byte[] payload = new ClusterMessage( byte[] payload = new ClusterMessage(
localNodeId, localNodeId,
@ -139,6 +144,7 @@ public class ClusterCommunicationManager
MessageSubject subject, MessageSubject subject,
Function<M, byte[]> encoder, Function<M, byte[]> encoder,
Set<NodeId> nodes) { Set<NodeId> nodes) {
checkPermission(CLUSTER_WRITE);
byte[] payload = new ClusterMessage( byte[] payload = new ClusterMessage(
localNodeId, localNodeId,
subject, subject,
@ -153,6 +159,7 @@ public class ClusterCommunicationManager
Function<M, byte[]> encoder, Function<M, byte[]> encoder,
Function<byte[], R> decoder, Function<byte[], R> decoder,
NodeId toNodeId) { NodeId toNodeId) {
checkPermission(CLUSTER_WRITE);
try { try {
ClusterMessage envelope = new ClusterMessage( ClusterMessage envelope = new ClusterMessage(
clusterService.getLocalNode().id(), clusterService.getLocalNode().id(),
@ -193,6 +200,7 @@ public class ClusterCommunicationManager
public void addSubscriber(MessageSubject subject, public void addSubscriber(MessageSubject subject,
ClusterMessageHandler subscriber, ClusterMessageHandler subscriber,
ExecutorService executor) { ExecutorService executor) {
checkPermission(CLUSTER_WRITE);
messagingService.registerHandler(subject.value(), messagingService.registerHandler(subject.value(),
new InternalClusterMessageHandler(subscriber), new InternalClusterMessageHandler(subscriber),
executor); executor);
@ -200,6 +208,7 @@ public class ClusterCommunicationManager
@Override @Override
public void removeSubscriber(MessageSubject subject) { public void removeSubscriber(MessageSubject subject) {
checkPermission(CLUSTER_WRITE);
messagingService.unregisterHandler(subject.value()); messagingService.unregisterHandler(subject.value());
} }
@ -209,6 +218,7 @@ public class ClusterCommunicationManager
Function<M, R> handler, Function<M, R> handler,
Function<R, byte[]> encoder, Function<R, byte[]> encoder,
Executor executor) { Executor executor) {
checkPermission(CLUSTER_WRITE);
messagingService.registerHandler(subject.value(), messagingService.registerHandler(subject.value(),
new InternalMessageResponder<M, R>(decoder, encoder, m -> { new InternalMessageResponder<M, R>(decoder, encoder, m -> {
CompletableFuture<R> responseFuture = new CompletableFuture<>(); CompletableFuture<R> responseFuture = new CompletableFuture<>();
@ -228,6 +238,7 @@ public class ClusterCommunicationManager
Function<byte[], M> decoder, Function<byte[], M> decoder,
Function<M, CompletableFuture<R>> handler, Function<M, CompletableFuture<R>> handler,
Function<R, byte[]> encoder) { Function<R, byte[]> encoder) {
checkPermission(CLUSTER_WRITE);
messagingService.registerHandler(subject.value(), messagingService.registerHandler(subject.value(),
new InternalMessageResponder<>(decoder, encoder, handler)); new InternalMessageResponder<>(decoder, encoder, handler));
} }
@ -237,6 +248,7 @@ public class ClusterCommunicationManager
Function<byte[], M> decoder, Function<byte[], M> decoder,
Consumer<M> handler, Consumer<M> handler,
Executor executor) { Executor executor) {
checkPermission(CLUSTER_WRITE);
messagingService.registerHandler(subject.value(), messagingService.registerHandler(subject.value(),
new InternalMessageConsumer<>(decoder, handler), new InternalMessageConsumer<>(decoder, handler),
executor); executor);

11
core/store/dist/src/main/java/org/onosproject/store/cluster/messaging/impl/NettyMessagingManager.java vendored
View File

@ -82,6 +82,9 @@ import java.util.function.BiConsumer;
import java.util.function.BiFunction; import java.util.function.BiFunction;
import java.util.function.Consumer; import java.util.function.Consumer;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.CLUSTER_WRITE;
/** /**
* Netty based MessagingService. * Netty based MessagingService.
*/ */
@ -213,6 +216,7 @@ public class NettyMessagingManager implements MessagingService {
@Override @Override
public CompletableFuture<Void> sendAsync(Endpoint ep, String type, byte[] payload) { public CompletableFuture<Void> sendAsync(Endpoint ep, String type, byte[] payload) {
checkPermission(CLUSTER_WRITE);
InternalMessage message = new InternalMessage(messageIdGenerator.incrementAndGet(), InternalMessage message = new InternalMessage(messageIdGenerator.incrementAndGet(),
localEp, localEp,
type, type,
@ -221,6 +225,7 @@ public class NettyMessagingManager implements MessagingService {
} }
protected CompletableFuture<Void> sendAsync(Endpoint ep, InternalMessage message) { protected CompletableFuture<Void> sendAsync(Endpoint ep, InternalMessage message) {
checkPermission(CLUSTER_WRITE);
if (ep.equals(localEp)) { if (ep.equals(localEp)) {
try { try {
dispatchLocally(message); dispatchLocally(message);
@ -247,11 +252,13 @@ public class NettyMessagingManager implements MessagingService {
@Override @Override
public CompletableFuture<byte[]> sendAndReceive(Endpoint ep, String type, byte[] payload) { public CompletableFuture<byte[]> sendAndReceive(Endpoint ep, String type, byte[] payload) {
checkPermission(CLUSTER_WRITE);
return sendAndReceive(ep, type, payload, MoreExecutors.directExecutor()); return sendAndReceive(ep, type, payload, MoreExecutors.directExecutor());
} }
@Override @Override
public CompletableFuture<byte[]> sendAndReceive(Endpoint ep, String type, byte[] payload, Executor executor) { public CompletableFuture<byte[]> sendAndReceive(Endpoint ep, String type, byte[] payload, Executor executor) {
checkPermission(CLUSTER_WRITE);
CompletableFuture<byte[]> response = new CompletableFuture<>(); CompletableFuture<byte[]> response = new CompletableFuture<>();
Callback callback = new Callback(response, executor); Callback callback = new Callback(response, executor);
Long messageId = messageIdGenerator.incrementAndGet(); Long messageId = messageIdGenerator.incrementAndGet();
@ -266,11 +273,13 @@ public class NettyMessagingManager implements MessagingService {
@Override @Override
public void registerHandler(String type, BiConsumer<Endpoint, byte[]> handler, Executor executor) { public void registerHandler(String type, BiConsumer<Endpoint, byte[]> handler, Executor executor) {
checkPermission(CLUSTER_WRITE);
handlers.put(type, message -> executor.execute(() -> handler.accept(message.sender(), message.payload()))); handlers.put(type, message -> executor.execute(() -> handler.accept(message.sender(), message.payload())));
} }
@Override @Override
public void registerHandler(String type, BiFunction<Endpoint, byte[], byte[]> handler, Executor executor) { public void registerHandler(String type, BiFunction<Endpoint, byte[], byte[]> handler, Executor executor) {
checkPermission(CLUSTER_WRITE);
handlers.put(type, message -> executor.execute(() -> { handlers.put(type, message -> executor.execute(() -> {
byte[] responsePayload = null; byte[] responsePayload = null;
Status status = Status.OK; Status status = Status.OK;
@ -285,6 +294,7 @@ public class NettyMessagingManager implements MessagingService {
@Override @Override
public void registerHandler(String type, BiFunction<Endpoint, byte[], CompletableFuture<byte[]>> handler) { public void registerHandler(String type, BiFunction<Endpoint, byte[], CompletableFuture<byte[]>> handler) {
checkPermission(CLUSTER_WRITE);
handlers.put(type, message -> { handlers.put(type, message -> {
handler.apply(message.sender(), message.payload()).whenComplete((result, error) -> { handler.apply(message.sender(), message.payload()).whenComplete((result, error) -> {
Status status = error == null ? Status.OK : Status.ERROR_HANDLER_EXCEPTION; Status status = error == null ? Status.OK : Status.ERROR_HANDLER_EXCEPTION;
@ -295,6 +305,7 @@ public class NettyMessagingManager implements MessagingService {
@Override @Override
public void unregisterHandler(String type) { public void unregisterHandler(String type) {
checkPermission(CLUSTER_WRITE);
handlers.remove(type); handlers.remove(type);
} }

4
core/store/dist/src/main/java/org/onosproject/store/core/impl/LogicalClockManager.java vendored
View File

@ -30,6 +30,9 @@ import org.onosproject.store.service.LogicalClockService;
import org.onosproject.store.service.StorageService; import org.onosproject.store.service.StorageService;
import org.slf4j.Logger; import org.slf4j.Logger;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.CLOCK_WRITE;
/** /**
* LogicalClockService implementation based on a AtomicCounter. * LogicalClockService implementation based on a AtomicCounter.
*/ */
@ -62,6 +65,7 @@ public class LogicalClockManager implements LogicalClockService {
@Override @Override
public Timestamp getTimestamp() { public Timestamp getTimestamp() {
checkPermission(CLOCK_WRITE);
return new LogicalTimestamp(atomicCounter.incrementAndGet()); return new LogicalTimestamp(atomicCounter.incrementAndGet());
} }
} }

4
core/store/persistence/src/main/java/org/onosproject/persistence/impl/PersistenceManager.java
View File

@ -36,6 +36,8 @@ import java.util.Set;
import java.util.Timer; import java.util.Timer;
import java.util.TimerTask; import java.util.TimerTask;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.PERSISTENCE_WRITE;
import static org.slf4j.LoggerFactory.getLogger; import static org.slf4j.LoggerFactory.getLogger;
/** /**
@ -122,10 +124,12 @@ public class PersistenceManager implements PersistenceService {
} }
public <K, V> PersistentMapBuilder<K, V> persistentMapBuilder() { public <K, V> PersistentMapBuilder<K, V> persistentMapBuilder() {
checkPermission(PERSISTENCE_WRITE);
return new DefaultPersistentMapBuilder<>(localDB); return new DefaultPersistentMapBuilder<>(localDB);
} }
public <E> PersistentSetBuilder<E> persistentSetBuilder() { public <E> PersistentSetBuilder<E> persistentSetBuilder() {
checkPermission(PERSISTENCE_WRITE);
return new DefaultPersistentSetBuilder<>(localDB); return new DefaultPersistentSetBuilder<>(localDB);
} }

4
core/store/primitives/src/main/java/org/onosproject/store/primitives/impl/MutexExecutionManager.java
View File

@ -50,7 +50,8 @@ import org.slf4j.Logger;
import com.google.common.base.MoreObjects; import com.google.common.base.MoreObjects;
import com.google.common.collect.Lists; import com.google.common.collect.Lists;
import com.google.common.collect.Maps; import com.google.common.collect.Maps;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.MUTEX_WRITE;
/** /**
* Implementation of a MutexExecutionService. * Implementation of a MutexExecutionService.
*/ */
@ -103,6 +104,7 @@ public class MutexExecutionManager implements MutexExecutionService {
@Override @Override
public CompletableFuture<Void> execute(MutexTask task, String exclusionPath, Executor executor) { public CompletableFuture<Void> execute(MutexTask task, String exclusionPath, Executor executor) {
checkPermission(MUTEX_WRITE);
return lock(exclusionPath) return lock(exclusionPath)
.thenApply(state -> activeTasks.computeIfAbsent(exclusionPath, .thenApply(state -> activeTasks.computeIfAbsent(exclusionPath,
k -> new InnerMutexTask(exclusionPath, k -> new InnerMutexTask(exclusionPath,

8
core/store/primitives/src/main/java/org/onosproject/store/primitives/impl/PartitionManager.java
View File

@ -55,6 +55,9 @@ import org.slf4j.Logger;
import com.google.common.collect.ImmutableSet; import com.google.common.collect.ImmutableSet;
import com.google.common.collect.Maps; import com.google.common.collect.Maps;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.PARTITION_READ;
/** /**
* Implementation of {@code PartitionService} and {@code PartitionAdminService}. * Implementation of {@code PartitionService} and {@code PartitionAdminService}.
*/ */
@ -116,27 +119,32 @@ public class PartitionManager extends AbstractListenerManager<PartitionEvent, Pa
@Override @Override
public int getNumberOfPartitions() { public int getNumberOfPartitions() {
checkPermission(PARTITION_READ);
return partitions.size(); return partitions.size();
} }
@Override @Override
public Set<PartitionId> getAllPartitionIds() { public Set<PartitionId> getAllPartitionIds() {
checkPermission(PARTITION_READ);
return partitions.keySet(); return partitions.keySet();
} }
@Override @Override
public DistributedPrimitiveCreator getDistributedPrimitiveCreator(PartitionId partitionId) { public DistributedPrimitiveCreator getDistributedPrimitiveCreator(PartitionId partitionId) {
checkPermission(PARTITION_READ);
return partitions.get(partitionId).client(); return partitions.get(partitionId).client();
} }
@Override @Override
public Set<NodeId> getConfiguredMembers(PartitionId partitionId) { public Set<NodeId> getConfiguredMembers(PartitionId partitionId) {
checkPermission(PARTITION_READ);
StoragePartition partition = partitions.get(partitionId); StoragePartition partition = partitions.get(partitionId);
return ImmutableSet.copyOf(partition.getMembers()); return ImmutableSet.copyOf(partition.getMembers());
} }
@Override @Override
public Set<NodeId> getActiveMembersMembers(PartitionId partitionId) { public Set<NodeId> getActiveMembersMembers(PartitionId partitionId) {
checkPermission(PARTITION_READ);
// TODO: This needs to query metadata to determine currently active // TODO: This needs to query metadata to determine currently active
// members of partition // members of partition
return getConfiguredMembers(partitionId); return getConfiguredMembers(partitionId);

11
core/store/primitives/src/main/java/org/onosproject/store/primitives/impl/StorageManager.java
View File

@ -61,6 +61,9 @@ import com.google.common.collect.ImmutableMap;
import com.google.common.collect.Maps; import com.google.common.collect.Maps;
import com.google.common.util.concurrent.Futures; import com.google.common.util.concurrent.Futures;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.*;
/** /**
* Implementation for {@code StorageService} and {@code StorageAdminService}. * Implementation for {@code StorageService} and {@code StorageAdminService}.
*/ */
@ -117,6 +120,7 @@ public class StorageManager implements StorageService, StorageAdminService {
@Override @Override
public <K, V> EventuallyConsistentMapBuilder<K, V> eventuallyConsistentMapBuilder() { public <K, V> EventuallyConsistentMapBuilder<K, V> eventuallyConsistentMapBuilder() {
checkPermission(STORAGE_WRITE);
return new EventuallyConsistentMapBuilderImpl<>(clusterService, return new EventuallyConsistentMapBuilderImpl<>(clusterService,
clusterCommunicator, clusterCommunicator,
persistenceService); persistenceService);
@ -124,27 +128,32 @@ public class StorageManager implements StorageService, StorageAdminService {
@Override @Override
public <K, V> ConsistentMapBuilder<K, V> consistentMapBuilder() { public <K, V> ConsistentMapBuilder<K, V> consistentMapBuilder() {
checkPermission(STORAGE_WRITE);
return new NewDefaultConsistentMapBuilder<>(federatedPrimitiveCreator); return new NewDefaultConsistentMapBuilder<>(federatedPrimitiveCreator);
} }
@Override @Override
public <E> DistributedSetBuilder<E> setBuilder() { public <E> DistributedSetBuilder<E> setBuilder() {
checkPermission(STORAGE_WRITE);
return new DefaultDistributedSetBuilder<>(() -> this.<E, Boolean>consistentMapBuilder()); return new DefaultDistributedSetBuilder<>(() -> this.<E, Boolean>consistentMapBuilder());
} }
@Override @Override
public <E> DistributedQueueBuilder<E> queueBuilder() { public <E> DistributedQueueBuilder<E> queueBuilder() {
checkPermission(STORAGE_WRITE);
// TODO: implement // TODO: implement
throw new UnsupportedOperationException(); throw new UnsupportedOperationException();
} }
@Override @Override
public AtomicCounterBuilder atomicCounterBuilder() { public AtomicCounterBuilder atomicCounterBuilder() {
checkPermission(STORAGE_WRITE);
return new NewDefaultAtomicCounterBuilder(federatedPrimitiveCreator); return new NewDefaultAtomicCounterBuilder(federatedPrimitiveCreator);
} }
@Override @Override
public <V> AtomicValueBuilder<V> atomicValueBuilder() { public <V> AtomicValueBuilder<V> atomicValueBuilder() {
checkPermission(STORAGE_WRITE);
Supplier<ConsistentMapBuilder<String, byte[]>> mapBuilderSupplier = Supplier<ConsistentMapBuilder<String, byte[]>> mapBuilderSupplier =
() -> this.<String, byte[]>consistentMapBuilder() () -> this.<String, byte[]>consistentMapBuilder()
.withName("onos-atomic-values") .withName("onos-atomic-values")
@ -154,6 +163,7 @@ public class StorageManager implements StorageService, StorageAdminService {
@Override @Override
public TransactionContextBuilder transactionContextBuilder() { public TransactionContextBuilder transactionContextBuilder() {
checkPermission(STORAGE_WRITE);
return new NewDefaultTransactionContextBuilder(transactionIdGenerator.get(), return new NewDefaultTransactionContextBuilder(transactionIdGenerator.get(),
federatedPrimitiveCreator, federatedPrimitiveCreator,
transactionCoordinator); transactionCoordinator);
@ -161,6 +171,7 @@ public class StorageManager implements StorageService, StorageAdminService {
@Override @Override
public LeaderElectorBuilder leaderElectorBuilder() { public LeaderElectorBuilder leaderElectorBuilder() {
checkPermission(STORAGE_WRITE);
return new DefaultLeaderElectorBuilder(federatedPrimitiveCreator); return new DefaultLeaderElectorBuilder(federatedPrimitiveCreator);
} }

8
web/gui/src/main/java/org/onosproject/ui/impl/UiExtensionManager.java
View File

@ -45,6 +45,10 @@ import static java.util.stream.Collectors.toSet;
import static org.onosproject.ui.UiView.Category.NETWORK; import static org.onosproject.ui.UiView.Category.NETWORK;
import static org.onosproject.ui.UiView.Category.PLATFORM; import static org.onosproject.ui.UiView.Category.PLATFORM;
import static org.onosproject.security.AppGuard.checkPermission;
import static org.onosproject.security.AppPermission.Type.UI_READ;
import static org.onosproject.security.AppPermission.Type.UI_WRITE;
/** /**
* Manages the user interface extensions. * Manages the user interface extensions.
*/ */
@ -136,6 +140,7 @@ public class UiExtensionManager implements UiExtensionService, SpriteService {
@Override @Override
public synchronized void register(UiExtension extension) { public synchronized void register(UiExtension extension) {
checkPermission(UI_WRITE);
if (!extensions.contains(extension)) { if (!extensions.contains(extension)) {
extensions.add(extension); extensions.add(extension);
for (UiView view : extension.views()) { for (UiView view : extension.views()) {
@ -146,6 +151,7 @@ public class UiExtensionManager implements UiExtensionService, SpriteService {
@Override @Override
public synchronized void unregister(UiExtension extension) { public synchronized void unregister(UiExtension extension) {
checkPermission(UI_WRITE);
extensions.remove(extension); extensions.remove(extension);
extension.views().stream() extension.views().stream()
.map(UiView::id).collect(toSet()).forEach(views::remove); .map(UiView::id).collect(toSet()).forEach(views::remove);
@ -153,11 +159,13 @@ public class UiExtensionManager implements UiExtensionService, SpriteService {
@Override @Override
public synchronized List<UiExtension> getExtensions() { public synchronized List<UiExtension> getExtensions() {
checkPermission(UI_READ);
return ImmutableList.copyOf(extensions); return ImmutableList.copyOf(extensions);
} }
@Override @Override
public synchronized UiExtension getViewExtension(String viewId) { public synchronized UiExtension getViewExtension(String viewId) {
checkPermission(UI_READ);
return views.get(viewId); return views.get(viewId);
} }