QPID-6364: Introduce attribute annotation property 'secureValueFilter' to mask only secure values matching the filter.

           Set secureValueFilter on keystores/trustores to mask only data URLs.
           Stop applying oversize when actuals attributes are requested.
           Update corresponding keystore/truststore UI tp show actual values for non data URLs.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1660391 13f79535-47bb-0310-9956-ffa450edef68

8 files changed, 46 insertions, 4 deletions

diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java
index b9a4b32acb..3ec60604c3 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java
@@ -44,6 +44,7 @@ import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.regex.Pattern;
 
 import javax.security.auth.Subject;
 
@@ -1136,8 +1137,9 @@ public abstract class AbstractConfiguredObject<X extends ConfiguredObject<X>> im
         if(attr != null && (attr.isAutomated() || attr.isDerived()))
         {
             Object value = attr.getValue((X)this);
-            if(value != null && attr.isSecure() &&
-               !SecurityManager.isSystemProcess())
+            Pattern secureValueFilter = attr.getSecureValueFilter();
+            if(value != null && attr.isSecure() && !SecurityManager.isSystemProcess() &&
+                    (secureValueFilter == null || secureValueFilter.matcher(value.toString()).matches()))
             {
                 return SECURE_VALUES.get(value.getClass());
             }
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredAutomatedAttribute.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredAutomatedAttribute.java
index 9fca898dc0..342b7ac0ba 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredAutomatedAttribute.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredAutomatedAttribute.java
@@ -28,6 +28,7 @@ import java.lang.reflect.Type;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.regex.Pattern;
 
 import org.apache.log4j.Logger;
 
@@ -37,6 +38,7 @@ public class ConfiguredAutomatedAttribute<C extends ConfiguredObject, T>  extend
 
     private final ManagedAttribute _annotation;
     private final Method _validValuesMethod;
+    private final Pattern _secureValuePattern;
 
     ConfiguredAutomatedAttribute(final Class<C> clazz,
                                  final Method getter,
@@ -53,6 +55,16 @@ public class ConfiguredAutomatedAttribute<C extends ConfiguredObject, T>  extend
             validValuesMethod = getValidValuesMethod(validValue, clazz);
         }
         _validValuesMethod = validValuesMethod;
+
+        String secureValueFilter = _annotation.secureValueFilter();
+        if (secureValueFilter == null || "".equals(secureValueFilter))
+        {
+            _secureValuePattern = null;
+        }
+        else
+        {
+            _secureValuePattern = Pattern.compile(secureValueFilter);
+        }
     }
 
     private Method getValidValuesMethod(final String validValue, final Class<C> clazz)
@@ -140,6 +152,11 @@ public class ConfiguredAutomatedAttribute<C extends ConfiguredObject, T>  extend
         return _annotation.description();
     }
 
+    public Pattern getSecureValueFilter()
+    {
+        return _secureValuePattern;
+    }
+
     public Collection<String> validValues()
     {
         if(_validValuesMethod != null)
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredDerivedAttribute.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredDerivedAttribute.java
index 71488edb8c..20fd0264c6 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredDerivedAttribute.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredDerivedAttribute.java
@@ -21,10 +21,12 @@
 package org.apache.qpid.server.model;
 
 import java.lang.reflect.Method;
+import java.util.regex.Pattern;
 
 public class ConfiguredDerivedAttribute<C extends ConfiguredObject, T>  extends ConfiguredObjectAttribute<C,T>
 {
     private final DerivedAttribute _annotation;
+    private final Pattern _secureValuePattern;
 
     ConfiguredDerivedAttribute(final Class<C> clazz,
                                final Method getter,
@@ -32,6 +34,16 @@ public class ConfiguredDerivedAttribute<C extends ConfiguredObject, T>  extends
     {
         super(clazz, getter);
         _annotation = annotation;
+
+        String secureValueFilter = _annotation.secureValueFilter();
+        if (secureValueFilter == null || "".equals(secureValueFilter))
+        {
+            _secureValuePattern = null;
+        }
+        else
+        {
+            _secureValuePattern = Pattern.compile(secureValueFilter);
+        }
     }
 
     public boolean isAutomated()
@@ -72,4 +84,10 @@ public class ConfiguredDerivedAttribute<C extends ConfiguredObject, T>  extends
         return _annotation.description();
     }
 
+    @Override
+    public Pattern getSecureValueFilter()
+    {
+        return _secureValuePattern;
+    }
+
 }
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredObjectAttribute.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredObjectAttribute.java
index 73b7839a8e..4f15d612f9 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredObjectAttribute.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ConfiguredObjectAttribute.java
@@ -22,6 +22,7 @@ package org.apache.qpid.server.model;
 
 import java.lang.reflect.Method;
 import java.lang.reflect.Type;
+import java.util.regex.Pattern;
 
 public abstract class ConfiguredObjectAttribute<C extends ConfiguredObject, T> extends ConfiguredObjectAttributeOrStatistic<C,T>
 {
@@ -49,6 +50,8 @@ public abstract class ConfiguredObjectAttribute<C extends ConfiguredObject, T> e
 
     public abstract String getDescription();
 
+    public abstract Pattern getSecureValueFilter();
+
     public T convert(final Object value, C object)
     {
         final AttributeValueConverter<T> converter = getConverter();
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/DerivedAttribute.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/DerivedAttribute.java
index e5c17a17e4..6de6bf25c3 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/DerivedAttribute.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/DerivedAttribute.java
@@ -32,4 +32,5 @@ public @interface DerivedAttribute
     boolean persist() default false;
     String description() default "";
     boolean oversize() default false;
+    String secureValueFilter() default "";
 }
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ManagedAttribute.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ManagedAttribute.java
index 05b2c610ba..2f96299703 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ManagedAttribute.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/ManagedAttribute.java
@@ -37,4 +37,5 @@ public @interface ManagedAttribute
     String[] validValues() default {};
     boolean oversize() default false;
     String oversizedAltText() default "";
+    String secureValueFilter() default "";
 }
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/FileKeyStore.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/FileKeyStore.java
index 0607f4b3d3..8b6a83d443 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/FileKeyStore.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/FileKeyStore.java
@@ -62,7 +62,7 @@ public interface FileKeyStore<X extends FileKeyStore<X>> extends KeyStore<X>
     @ManagedAttribute(defaultValue = "${this:path}")
     String getDescription();
 
-    @ManagedAttribute(  mandatory = true, secure = true, oversize = true, oversizedAltText = OVER_SIZED_ATTRIBUTE_ALTERNATIVE_TEXT)
+    @ManagedAttribute(  mandatory = true, secure = true, oversize = true, oversizedAltText = OVER_SIZED_ATTRIBUTE_ALTERNATIVE_TEXT, secureValueFilter = "^data\\:.*")
     String getStoreUrl();
 
     @DerivedAttribute
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/NonJavaKeyStore.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/NonJavaKeyStore.java
index 78509182b5..f239b83f27 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/NonJavaKeyStore.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/NonJavaKeyStore.java
@@ -31,7 +31,7 @@ public interface NonJavaKeyStore<X extends NonJavaKeyStore<X>> extends KeyStore<
     @ManagedAttribute(defaultValue = "${this:subjectName}")
     String getDescription();
 
-    @ManagedAttribute( mandatory = true, secure = true, oversize = true, oversizedAltText = OVER_SIZED_ATTRIBUTE_ALTERNATIVE_TEXT )
+    @ManagedAttribute( mandatory = true, secure = true, oversize = true, oversizedAltText = OVER_SIZED_ATTRIBUTE_ALTERNATIVE_TEXT, secureValueFilter = "^data\\:.*")
     String getPrivateKeyUrl();
 
     @ManagedAttribute( mandatory = true, oversize = true, oversizedAltText = OVER_SIZED_ATTRIBUTE_ALTERNATIVE_TEXT )