From 1f693c55dcc6f7a4fbf9fae288085bd2dea2c63e Mon Sep 17 00:00:00 2001 From: Bjørn Christian Seime Date: Wed, 13 Jul 2022 10:48:24 +0200 Subject: Add Capability and CapabilitySet including JSON serialization --- .../tls/json/TransportSecurityOptionsEntity.java | 1 + .../TransportSecurityOptionsJsonSerializer.java | 17 +++- .../com/yahoo/security/tls/policy/Capability.java | 32 ++++++++ .../yahoo/security/tls/policy/CapabilitySet.java | 90 ++++++++++++++++++++++ .../com/yahoo/security/tls/policy/PeerPolicy.java | 11 ++- 5 files changed, 147 insertions(+), 4 deletions(-) create mode 100644 security-utils/src/main/java/com/yahoo/security/tls/policy/Capability.java create mode 100644 security-utils/src/main/java/com/yahoo/security/tls/policy/CapabilitySet.java (limited to 'security-utils/src/main/java/com') diff --git a/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsEntity.java b/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsEntity.java index 02c6fe2ab99..b80a7e4f2fb 100644 --- a/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsEntity.java +++ b/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsEntity.java @@ -36,6 +36,7 @@ class TransportSecurityOptionsEntity { @JsonProperty("required-credentials") List requiredCredentials; @JsonProperty("name") String name; @JsonProperty("description") @JsonInclude(NON_NULL) String description; + @JsonProperty("capabilities") @JsonInclude(NON_EMPTY) List capabilities; } @JsonIgnoreProperties(ignoreUnknown = true) diff --git a/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsJsonSerializer.java b/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsJsonSerializer.java index 5deebf48d1b..195e200febb 100644 --- a/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsJsonSerializer.java +++ b/security-utils/src/main/java/com/yahoo/security/tls/json/TransportSecurityOptionsJsonSerializer.java @@ -8,6 +8,7 @@ import com.yahoo.security.tls.json.TransportSecurityOptionsEntity.CredentialFiel import com.yahoo.security.tls.json.TransportSecurityOptionsEntity.Files; import com.yahoo.security.tls.json.TransportSecurityOptionsEntity.RequiredCredential; import com.yahoo.security.tls.policy.AuthorizedPeers; +import com.yahoo.security.tls.policy.CapabilitySet; import com.yahoo.security.tls.policy.PeerPolicy; import com.yahoo.security.tls.policy.RequiredPeerCredential; @@ -19,6 +20,7 @@ import java.nio.file.Paths; import java.util.ArrayList; import java.util.Comparator; import java.util.List; +import java.util.Optional; import java.util.Set; import static java.util.stream.Collectors.toList; @@ -99,7 +101,16 @@ public class TransportSecurityOptionsJsonSerializer { if (authorizedPeer.requiredCredentials == null) { throw missingFieldException("required-credentials"); } - return new PeerPolicy(authorizedPeer.name, authorizedPeer.description, toRequestPeerCredentials(authorizedPeer.requiredCredentials)); + return new PeerPolicy(authorizedPeer.name, Optional.ofNullable(authorizedPeer.description), + toCapabilities(authorizedPeer.capabilities), toRequestPeerCredentials(authorizedPeer.requiredCredentials)); + } + + private static CapabilitySet toCapabilities(List capabilities) { + if (capabilities == null) return CapabilitySet.all(); + if (capabilities.isEmpty()) + throw new IllegalArgumentException("\"capabilities\" array must either be not present " + + "(implies all capabilities) or contain at least one capability name"); + return CapabilitySet.fromNames(capabilities); } private static List toRequestPeerCredentials(List requiredCredentials) { @@ -142,6 +153,10 @@ public class TransportSecurityOptionsJsonSerializer { authorizedPeer.name = peerPolicy.policyName(); authorizedPeer.requiredCredentials = new ArrayList<>(); authorizedPeer.description = peerPolicy.description().orElse(null); + CapabilitySet caps = peerPolicy.capabilities(); + if (!caps.hasAllCapabilities()) { + authorizedPeer.capabilities = List.copyOf(caps.toCapabilityNames()); + } for (RequiredPeerCredential requiredPeerCredential : peerPolicy.requiredCredentials()) { RequiredCredential requiredCredential = new RequiredCredential(); requiredCredential.field = toField(requiredPeerCredential.field()); diff --git a/security-utils/src/main/java/com/yahoo/security/tls/policy/Capability.java b/security-utils/src/main/java/com/yahoo/security/tls/policy/Capability.java new file mode 100644 index 00000000000..09d4de37831 --- /dev/null +++ b/security-utils/src/main/java/com/yahoo/security/tls/policy/Capability.java @@ -0,0 +1,32 @@ +// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.security.tls.policy; + +import java.util.Arrays; + +/** + * @author bjorncs + */ +public enum Capability { + CONTENT__CLUSTER_CONTROLLER__INTERNAL_STATE_API("vespa.content.cluster_controller.internal_state_api"), + CONTENT__DOCUMENT_API("vespa.content.document_api"), + CONTENT__METRICS_API("vespa.content.metrics_api"), + CONTENT__SEARCH_API("vespa.content.search_api"), + CONTENT__STATUS_PAGES("vespa.content.status_pages"), + CONTENT__STORAGE_API("vespa.content.storage_api"), + SLOBROK__API("vespa.slobrok.api"), + ; + + private final String name; + + Capability(String name) { this.name = name; } + + public String asString() { return name; } + + public static Capability fromName(String name) { + return Arrays.stream(values()) + .filter(c -> c.name.equals(name)) + .findAny().orElseThrow(() -> + new IllegalArgumentException("Cannot find predefined capability set with name '" + name + "'")); + } + +} diff --git a/security-utils/src/main/java/com/yahoo/security/tls/policy/CapabilitySet.java b/security-utils/src/main/java/com/yahoo/security/tls/policy/CapabilitySet.java new file mode 100644 index 00000000000..44ff1eedfb0 --- /dev/null +++ b/security-utils/src/main/java/com/yahoo/security/tls/policy/CapabilitySet.java @@ -0,0 +1,90 @@ +// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.security.tls.policy; + +import java.util.Arrays; +import java.util.Collection; +import java.util.EnumSet; +import java.util.List; +import java.util.Objects; +import java.util.Optional; +import java.util.SortedSet; +import java.util.TreeSet; +import java.util.stream.Collectors; + +/** + * @author bjorncs + */ +public class CapabilitySet { + public enum Predefined { + CONTENT_NODE("vespa.content_node", + Capability.CONTENT__STORAGE_API, Capability.CONTENT__DOCUMENT_API, Capability.SLOBROK__API), + CONTAINER_NODE("vespa.container_node", + Capability.CONTENT__DOCUMENT_API, Capability.CONTENT__SEARCH_API, Capability.SLOBROK__API), + TELEMETRY("vespa.telemetry", + Capability.CONTENT__STATUS_PAGES, Capability.CONTENT__METRICS_API), + CLUSTER_CONTROLLER_NODE("vespa.cluster_controller_node", + Capability.CONTENT__CLUSTER_CONTROLLER__INTERNAL_STATE_API, Capability.SLOBROK__API), + CONFIG_SERVER("vespa.config_server"), + ; + + private final String name; + private final EnumSet caps; + + Predefined(String name, Capability... caps) { + this.name = name; + this.caps = caps.length == 0 ? EnumSet.noneOf(Capability.class) : EnumSet.copyOf(List.of(caps)); } + + public static Optional fromName(String name) { + return Arrays.stream(values()).filter(p -> p.name.equals(name)).findAny(); + } + } + + private static final CapabilitySet ALL_CAPABILITIES = new CapabilitySet(EnumSet.allOf(Capability.class)); + private static final CapabilitySet NO_CAPABILITIES = new CapabilitySet(EnumSet.noneOf(Capability.class)); + + private final EnumSet caps; + + private CapabilitySet(EnumSet caps) { this.caps = caps; } + + public static CapabilitySet fromNames(Collection names) { + EnumSet caps = EnumSet.noneOf(Capability.class); + for (String name : names) { + Predefined predefined = Predefined.fromName(name).orElse(null); + if (predefined != null) caps.addAll(predefined.caps); + else caps.add(Capability.fromName(name)); + } + return new CapabilitySet(caps); + } + + public static CapabilitySet from(EnumSet caps) { return new CapabilitySet(EnumSet.copyOf(caps)); } + public static CapabilitySet from(Collection caps) { return new CapabilitySet(EnumSet.copyOf(caps)); } + public static CapabilitySet from(Capability... caps) { return new CapabilitySet(EnumSet.copyOf(List.of(caps))); } + public static CapabilitySet all() { return ALL_CAPABILITIES; } + public static CapabilitySet none() { return NO_CAPABILITIES; } + + public boolean hasAllCapabilities() { return this.caps.equals(ALL_CAPABILITIES.caps); } + + public SortedSet toCapabilityNames() { + return caps.stream().map(Capability::asString).collect(Collectors.toCollection(TreeSet::new)); + } + + @Override + public String toString() { + return "CapabilitySet{" + + "caps=" + caps + + '}'; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + CapabilitySet that = (CapabilitySet) o; + return Objects.equals(caps, that.caps); + } + + @Override + public int hashCode() { + return Objects.hash(caps); + } +} diff --git a/security-utils/src/main/java/com/yahoo/security/tls/policy/PeerPolicy.java b/security-utils/src/main/java/com/yahoo/security/tls/policy/PeerPolicy.java index 332c0d1a43f..cb39e5e9c3c 100644 --- a/security-utils/src/main/java/com/yahoo/security/tls/policy/PeerPolicy.java +++ b/security-utils/src/main/java/com/yahoo/security/tls/policy/PeerPolicy.java @@ -7,13 +7,18 @@ import java.util.Optional; /** * @author bjorncs */ -public record PeerPolicy(String policyName, Optional description, List requiredCredentials) { +public record PeerPolicy(String policyName, Optional description, CapabilitySet capabilities, + List requiredCredentials) { + + public PeerPolicy { + requiredCredentials = List.copyOf(requiredCredentials); + } public PeerPolicy(String policyName, List requiredCredentials) { - this(policyName, Optional.empty(), List.copyOf(requiredCredentials)); + this(policyName, Optional.empty(), CapabilitySet.all(), requiredCredentials); } public PeerPolicy(String policyName, String description, List requiredCredentials) { - this(policyName, Optional.ofNullable(description), List.copyOf(requiredCredentials)); + this(policyName, Optional.ofNullable(description), CapabilitySet.all(), requiredCredentials); } } -- cgit v1.2.3