From 67d52c4f42fc59b5d340a63cacc735fb2f394937 Mon Sep 17 00:00:00 2001 From: Aidan Skinner Date: Wed, 11 Nov 2009 22:59:29 +0000 Subject: QPID-2184: make sure global security plugins are reconfigured properly ServerConfigurationTest: add test for reloading firewall config in main section, not just as a combined file FirewallConfigTest: add a systest for firewalls with real broker QpidTestCase: add a reloadBroker() method git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@835115 13f79535-47bb-0310-9956-ffa450edef68 --- .../server/configuration/ServerConfiguration.java | 2 +- .../qpid/server/security/access/ACLManager.java | 10 +- .../configuration/ServerConfigurationTest.java | 98 ++++++++---- .../etc/config-systests-firewall-settings.xml | 28 ++++ .../java/systests/etc/config-systests-firewall.xml | 30 ++++ .../security/firewall/FirewallConfigTest.java | 164 +++++++++++++++++++++ .../org/apache/qpid/test/utils/QpidTestCase.java | 24 +++ qpid/java/test-profiles/010Excludes | 1 + 8 files changed, 321 insertions(+), 36 deletions(-) create mode 100644 qpid/java/systests/etc/config-systests-firewall-settings.xml create mode 100644 qpid/java/systests/etc/config-systests-firewall.xml create mode 100644 qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java (limited to 'qpid/java') diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java index 7bf28c7560..441369d064 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/configuration/ServerConfiguration.java @@ -311,13 +311,13 @@ public class ServerConfiguration implements SignalHandler { Configuration newConfig = parseConfig(_configFile); _securityConfiguration = new SecurityConfiguration(newConfig.subset("security")); - ApplicationRegistry.getInstance().getAccessManager().configurePlugins(_securityConfiguration); VirtualHostRegistry vhostRegistry = ApplicationRegistry.getInstance().getVirtualHostRegistry(); for (String hostname : _virtualHosts.keySet()) { VirtualHost vhost = vhostRegistry.getVirtualHost(hostname); SecurityConfiguration hostSecurityConfig = new SecurityConfiguration(newConfig.subset("virtualhosts.virtualhost."+hostname+".security")); + vhost.getAccessManager().configureGlobalPlugins(_securityConfiguration); vhost.getAccessManager().configureHostPlugins(hostSecurityConfig); } } diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java index af0a1944cd..7d6ae285c5 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/ACLManager.java @@ -67,14 +67,18 @@ public class ACLManager _allSecurityPlugins.put(securityPlugin.getClass().getName(), securityPlugin); } - _globalPlugins = configurePlugins(configuration); + configureGlobalPlugins(configuration); } - public void configureHostPlugins(SecurityConfiguration hostConfig) throws ConfigurationException { _hostPlugins = configurePlugins(hostConfig); } + + public void configureGlobalPlugins(SecurityConfiguration configuration) throws ConfigurationException + { + _globalPlugins = configurePlugins(configuration); + } public Map configurePlugins(SecurityConfiguration hostConfig) throws ConfigurationException { @@ -93,7 +97,7 @@ public class ACLManager { if (plugin.supportsTag(tag)) { - _logger.warn("Plugin handling security section "+tag+" is "+plugin.getClass().getSimpleName()); + _logger.info("Plugin handling security section "+tag+" is "+plugin); handledTags.add(tag); plugins.put(plugin.getClass().getName(), plugin.newInstance(securityConfig)); } diff --git a/qpid/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java b/qpid/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java index 5bd739c0af..23041061be 100644 --- a/qpid/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java +++ b/qpid/java/broker/src/test/java/org/apache/qpid/server/configuration/ServerConfigurationTest.java @@ -760,38 +760,8 @@ public class ServerConfigurationTest extends TestCase // Write out config File mainFile = File.createTempFile(getClass().getName(), null); mainFile.deleteOnExit(); - FileWriter out = new FileWriter(mainFile); - - out.write("\n"); - out.write("\tfalse\n"); - out.write("\t\n"); - out.write("\t\t\n"); - out.write("\t\t\t\n"); - out.write("\t\t\t\tpasswordfile\n"); - out.write("\t\t\t\torg.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase\n"); - out.write("\t\t\t\t\n"); - out.write("\t\t\t\t\t\n"); - out.write("\t\t\t\t\t\tpasswordFile\n"); - out.write("\t\t\t\t\t\t/dev/null\n"); - out.write("\t\t\t\t\t\n"); - out.write("\t\t\t\t\n"); - out.write("\t\t\t\n"); - out.write("\t\t\n"); - out.write("\t\t\n"); - out.write("\t\t\t/dev/null\n"); - out.write("\t\t\tpasswordfile\n"); - out.write("\t\t\n"); - out.write("\t\t\n"); - out.write("\t\t\t"); - out.write("\t\t\n"); - out.write("\t\n"); - out.write("\t\n"); - out.write("\t\t\n"); - out.write("\t\t\ttest\n"); - out.write("\t\t\n"); - out.write("\t\n"); - out.write("\n"); - out.close(); + FileWriter out; + writeConfigFile(mainFile, false); // Load config ApplicationRegistry reg = new ConfigurationFileApplicationRegistry(mainFile); @@ -882,6 +852,70 @@ public class ServerConfigurationTest extends TestCase session.setNetworkDriver(testDriver); assertFalse(reg.getAccessManager().authoriseConnect(session, virtualHost)); } + + public void testConfigurationFirewallReload() throws Exception + { + // Write out config + File mainFile = File.createTempFile(getClass().getName(), null); + + mainFile.deleteOnExit(); + writeConfigFile(mainFile, false); + + // Load config + ApplicationRegistry reg = new ConfigurationFileApplicationRegistry(mainFile); + ApplicationRegistry.initialise(reg, 1); + + // Test config + TestNetworkDriver testDriver = new TestNetworkDriver(); + testDriver.setRemoteAddress("127.0.0.1"); + VirtualHostRegistry virtualHostRegistry = reg.getVirtualHostRegistry(); + VirtualHost virtualHost = virtualHostRegistry.getVirtualHost("test"); + AMQProtocolSession session = new AMQProtocolEngine(virtualHostRegistry, testDriver); + + assertFalse(reg.getAccessManager().authoriseConnect(session, virtualHost)); + + // Switch to deny the connection + writeConfigFile(mainFile, true); + + reg.getConfiguration().reparseConfigFile(); + + assertTrue(reg.getAccessManager().authoriseConnect(session, virtualHost)); + + } + + private void writeConfigFile(File mainFile, boolean allow) throws IOException { + FileWriter out = new FileWriter(mainFile); + out.write("\n"); + out.write("\tfalse\n"); + out.write("\t\n"); + out.write("\t\t\n"); + out.write("\t\t\t\n"); + out.write("\t\t\t\tpasswordfile\n"); + out.write("\t\t\t\torg.apache.qpid.server.security.auth.database.PlainPasswordFilePrincipalDatabase\n"); + out.write("\t\t\t\t\n"); + out.write("\t\t\t\t\t\n"); + out.write("\t\t\t\t\t\tpasswordFile\n"); + out.write("\t\t\t\t\t\t/dev/null\n"); + out.write("\t\t\t\t\t\n"); + out.write("\t\t\t\t\n"); + out.write("\t\t\t\n"); + out.write("\t\t\n"); + out.write("\t\t\n"); + out.write("\t\t\t/dev/null\n"); + out.write("\t\t\tpasswordfile\n"); + out.write("\t\t\n"); + out.write("\t\t\n"); + out.write("\t\t\t"); + out.write("\t\t\n"); + out.write("\t\n"); + out.write("\t\n"); + out.write("\t\t\n"); + out.write("\t\t\ttest\n"); + out.write("\t\t\n"); + out.write("\t\n"); + out.write("\n"); + out.close(); + } public void testCombinedConfigurationFirewallReload() throws Exception { diff --git a/qpid/java/systests/etc/config-systests-firewall-settings.xml b/qpid/java/systests/etc/config-systests-firewall-settings.xml new file mode 100644 index 0000000000..d115e74663 --- /dev/null +++ b/qpid/java/systests/etc/config-systests-firewall-settings.xml @@ -0,0 +1,28 @@ + + + + + + + + + diff --git a/qpid/java/systests/etc/config-systests-firewall.xml b/qpid/java/systests/etc/config-systests-firewall.xml new file mode 100644 index 0000000000..90773f5cc2 --- /dev/null +++ b/qpid/java/systests/etc/config-systests-firewall.xml @@ -0,0 +1,30 @@ + + + + + + + + + + + diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java new file mode 100644 index 0000000000..94bacea2f4 --- /dev/null +++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/firewall/FirewallConfigTest.java @@ -0,0 +1,164 @@ +package org.apache.qpid.server.security.firewall; + +import java.io.File; +import java.io.FileWriter; +import java.io.IOException; + +import javax.jms.Connection; +import javax.jms.JMSException; + +import org.apache.qpid.test.utils.QpidTestCase; + +public class FirewallConfigTest extends QpidTestCase +{ + + private File tmpFile = null; + @Override + protected void setUp() throws Exception + { + // do setup + final String QPID_HOME = System.getProperty("QPID_HOME"); + + if (QPID_HOME == null) + { + fail("QPID_HOME not set"); + } + + // Setup initial config. + _configFile = new File(QPID_HOME, "etc/config-systests-firewall.xml"); + tmpFile = File.createTempFile("config-systests-firewall", ".xml"); + setSystemProperty("QPID_FIREWALL_SETTINGS", tmpFile.getAbsolutePath()); + tmpFile.deleteOnExit(); + } + + private void writeFirewallFile(boolean allow, boolean inVhost) throws IOException + { + FileWriter out = new FileWriter(tmpFile); + String ipAddr = "127.0.0.1"; // FIXME: get this from InetAddress.getLocalHost().getAddress() ? + out.write(""); + if (inVhost) + { + out.write(""); + } + out.write(""); + out.write(""); + out.write(""); + if (inVhost) + { + out.write(""); + } + out.write(""); + out.close(); + } + + public void testDenyOnRestart() throws Exception + { + testDeny(false, new Runnable() { + + public void run() + { + try + { + restartBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + }); + } + + public void testDenyOnRestartInVhost() throws Exception + { + testDeny(true, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + }); + } + + public void testDenyOnReload() throws Exception + { + testDeny(false, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + } + ); + } + + public void testDenyOnReloadInVhost() throws Exception + { + testDeny(true, new Runnable() { + + public void run() + { + try + { + reloadBroker(); + } catch (Exception e) + { + fail(e.getMessage()); + } + } + } + ); + + } + + private void testDeny(boolean inVhost, Runnable restartOrReload) throws Exception + { + if (_broker.equals(VM)) + { + // No point running this test in a vm broker + return; + } + + writeFirewallFile(false, inVhost); + super.setUp(); + + Exception exception = null; + Connection conn = null; + try + { + conn = getConnection(); + } + catch (JMSException e) + { + exception = e; + } + assertNotNull(exception); + + // Check we can get a connection + + writeFirewallFile(true, inVhost); + restartOrReload.run(); + + exception = null; + try + { + conn = getConnection(); + } + catch (JMSException e) + { + exception = e; + } + assertNull(exception); + } +} diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java index a1fa2c1a0c..886612b9d9 100644 --- a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java +++ b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/QpidTestCase.java @@ -57,6 +57,7 @@ import java.io.InputStream; import java.io.InputStreamReader; import java.io.LineNumberReader; import java.io.PrintStream; +import java.io.Reader; import java.net.MalformedURLException; import java.util.ArrayList; import java.util.HashMap; @@ -1241,4 +1242,27 @@ public class QpidTestCase extends TestCase return null; } + public void reloadBroker() throws ConfigurationException, IOException + { + reloadBroker(0); + } + + public void reloadBroker(int port) throws ConfigurationException, IOException + { + if (_broker.equals(VM)) + { + ApplicationRegistry.getInstance().getConfiguration().reparseConfigFile(); + } + else // FIXME: should really use the JMX interface to do this + { + /* + * Sigh, this is going to get messy. grep for BRKR and the port number + */ + + Process p = Runtime.getRuntime().exec("/usr/bin/pgrep -f " + getPort(port)); + BufferedReader reader = new BufferedReader (new InputStreamReader(p.getInputStream())); + String cmd = "/bin/kill -SIGHUP " + reader.readLine(); + p = Runtime.getRuntime().exec(cmd); + } + } } diff --git a/qpid/java/test-profiles/010Excludes b/qpid/java/test-profiles/010Excludes index 7dfed6cee0..cb72da2a88 100755 --- a/qpid/java/test-profiles/010Excludes +++ b/qpid/java/test-profiles/010Excludes @@ -3,6 +3,7 @@ org.apache.qpid.client.ResetMessageListenerTest#* //These tests are for the java broker org.apache.qpid.server.security.acl.SimpleACLTest#* +org.apache.qpid.server.security.firewall.FirewallConfigTest#* org.apache.qpid.server.plugins.PluginTest#* org.apache.qpid.server.BrokerStartupTest#* -- cgit v1.2.1