diff --git a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java index b0529868019a5..2976f2b0b2b69 100644 --- a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java +++ b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java @@ -32,8 +32,10 @@ import java.util.Arrays; import java.util.Collection; import java.util.HashMap; +import java.util.HashSet; import java.util.Map; import java.util.Objects; +import java.util.Set; import java.util.UUID; import java.util.concurrent.Callable; import org.apache.ignite.IgniteCheckedException; @@ -131,13 +133,13 @@ public static void restoreDefaultSerializeVersion() { /** * @return Allow all service permissions. */ - public static Map> compatibleServicePermissions() { - Map> srvcPerms = new HashMap<>(); + public static Map> compatibleServicePermissions() { + Map> srvcPerms = new HashMap<>(); - srvcPerms.put("*", Arrays.asList( + srvcPerms.put("*", new HashSet<>(Arrays.asList( SecurityPermission.SERVICE_CANCEL, SecurityPermission.SERVICE_DEPLOY, - SecurityPermission.SERVICE_INVOKE)); + SecurityPermission.SERVICE_INVOKE))); return srvcPerms; } @@ -366,7 +368,8 @@ public static void authorizeAll(IgniteSecurity security, SecurityPermissionSet p } /** */ - private static void authorizeAll(IgniteSecurity security, Map> permissions) { + private static void authorizeAll(IgniteSecurity security, + Map> permissions) { if (F.isEmpty(permissions)) return; diff --git a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java index 3daf23d9088c7..cfa92a771638b 100644 --- a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java +++ b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java @@ -23,8 +23,11 @@ import java.util.Collection; import java.util.Collections; import java.util.HashMap; +import java.util.HashSet; import java.util.Map; import java.util.Objects; +import java.util.Set; +import java.util.stream.Collectors; import org.apache.ignite.internal.Order; import org.apache.ignite.internal.util.tostring.GridToStringInclude; import org.apache.ignite.internal.util.typedef.internal.A; @@ -47,24 +50,24 @@ public class SecurityBasicPermissionSet implements SecurityPermissionSet { /** Cache permissions. */ @GridToStringInclude @Order(0) - Map> cachePermissions = new HashMap<>(); + Map> cachePermissions = new HashMap<>(); /** Task permissions. */ @GridToStringInclude @Order(1) - Map> taskPermissions = new HashMap<>(); + Map> taskPermissions = new HashMap<>(); /** Service permissions. */ @GridToStringInclude @Order(2) - transient Map> srvcPermissions = isSecurityCompatibilityMode() + transient Map> srvcPermissions = isSecurityCompatibilityMode() ? compatibleServicePermissions() : new HashMap<>(); /** System permissions. */ @GridToStringInclude @Order(3) - Collection sysPermissions; + Set sysPermissions; /** Default allow all. */ @Order(4) @@ -78,7 +81,7 @@ public class SecurityBasicPermissionSet implements SecurityPermissionSet { public void setCachePermissions(Map> cachePermissions) { A.notNull(cachePermissions, "cachePermissions"); - this.cachePermissions = cachePermissions; + this.cachePermissions = toHashSetMap(cachePermissions); } /** @@ -89,7 +92,7 @@ public void setCachePermissions(Map> cach public void setTaskPermissions(Map> taskPermissions) { A.notNull(taskPermissions, "taskPermissions"); - this.taskPermissions = taskPermissions; + this.taskPermissions = toHashSetMap(taskPermissions); } /** @@ -100,7 +103,23 @@ public void setTaskPermissions(Map> taskP public void setServicePermissions(Map> srvcPermissions) { A.notNull(taskPermissions, "servicePermissions"); - this.srvcPermissions = srvcPermissions; + this.srvcPermissions = toHashSetMap(srvcPermissions); + } + + /** + * Copies content to a form with indemponent `hashCode` and `equals` results. + * + * @param cachePermissions Cache permissions. + * @return Map with hash set of security permissions. + */ + private Map> toHashSetMap(Map> cachePermissions) { + return cachePermissions.entrySet().stream() + .collect(Collectors.toMap(Map.Entry::getKey, e -> toHashSet(e.getValue()))); + } + + /** @return Hash set with permissions. */ + private Set toHashSet(Collection col) { + return col instanceof HashSet ? (HashSet)col : new HashSet<>(col); } /** @@ -109,7 +128,7 @@ public void setServicePermissions(Map> sr * @param sysPermissions System permissions. */ public void setSystemPermissions(Collection sysPermissions) { - this.sysPermissions = sysPermissions; + this.sysPermissions = new HashSet<>(sysPermissions); } /** @@ -122,17 +141,17 @@ public void setDefaultAllowAll(boolean dfltAllowAll) { } /** {@inheritDoc} */ - @Override public Map> cachePermissions() { + @Override public Map> cachePermissions() { return cachePermissions; } /** {@inheritDoc} */ - @Override public Map> taskPermissions() { + @Override public Map> taskPermissions() { return taskPermissions; } /** {@inheritDoc} */ - @Override public Map> servicePermissions() { + @Override public Map> servicePermissions() { return srvcPermissions; } diff --git a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSet.java b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSet.java index 20e78c6efab7f..96a966c4a9d58 100644 --- a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSet.java +++ b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityPermissionSet.java @@ -48,7 +48,7 @@ public interface SecurityPermissionSet extends Serializable, Message { * * @return Map of task names to task permissions. */ - public Map> taskPermissions(); + public Map> taskPermissions(); /** * Map of cache names to cache permissions. Wildcards are allowed at the @@ -56,7 +56,7 @@ public interface SecurityPermissionSet extends Serializable, Message { * * @return Map of cache names to cache permissions. */ - public Map> cachePermissions(); + public Map> cachePermissions(); /** * Map of service names to service permissions. Wildcards are allowed at the @@ -64,7 +64,7 @@ public interface SecurityPermissionSet extends Serializable, Message { * * @return Map of service names to service permissions. */ - public Map> servicePermissions(); + public Map> servicePermissions(); /** * Collection of system-wide permissions (events enable/disable, Visor task execution). diff --git a/modules/core/src/test/java/org/apache/ignite/internal/processors/security/impl/TestSecurityProcessor.java b/modules/core/src/test/java/org/apache/ignite/internal/processors/security/impl/TestSecurityProcessor.java index 06500e3ffbf1b..6f89644e87932 100644 --- a/modules/core/src/test/java/org/apache/ignite/internal/processors/security/impl/TestSecurityProcessor.java +++ b/modules/core/src/test/java/org/apache/ignite/internal/processors/security/impl/TestSecurityProcessor.java @@ -261,7 +261,7 @@ public static boolean contains(SecurityPermissionSet userPerms, String name, Sec /** */ private static boolean contains( - Map> userPerms, + Map> userPerms, boolean dfltAllowAll, String name, SecurityPermission perm diff --git a/modules/core/src/test/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSetSerializationTest.java b/modules/core/src/test/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSetSerializationTest.java index 5d94d4e88476f..59baf810bd855 100644 --- a/modules/core/src/test/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSetSerializationTest.java +++ b/modules/core/src/test/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSetSerializationTest.java @@ -18,7 +18,6 @@ package org.apache.ignite.plugin.security; import java.nio.ByteBuffer; -import java.util.Collection; import java.util.Map; import java.util.Set; import org.apache.ignite.IgniteCheckedException; @@ -34,7 +33,6 @@ import org.apache.ignite.testframework.GridTestUtils; import org.apache.ignite.testframework.junits.GridTestKernalContext; import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest; -import org.jetbrains.annotations.Nullable; import org.junit.Test; import static org.apache.ignite.internal.util.CommonUtils.makeMessageType; @@ -65,10 +63,11 @@ public void testWriteAndReadBack() throws Exception { src.setServicePermissions(Map.of("service", Set.of(SERVICE_INVOKE, SERVICE_CANCEL))); src.setCachePermissions(Map.of("cache", Set.of(CACHE_CREATE, CACHE_PUT))); - src.setCachePermissions(Map.of("cache", Set.of(CACHE_CREATE, CACHE_PUT))); SecurityBasicPermissionSet res = writeAndReadBack(src); - assertTrue("Permission sets are not equal [src=" + src + ", res=" + res + "]", deepEquals(src, res)); + assertEquals("Permission sets are not equal", src, res); + assertEquals("Hashes of permission sets are not equal [src=" + src + ", res=" + res + "]", + src.hashCode(), res.hashCode()); } /** @@ -100,50 +99,4 @@ private T writeAndReadBack(T msg) throws IgniteCheckedExcept return res; } - - /** - * Perfroms deep equals of permission sets. - * - * @param lhs First permissions set for equality check. - * @param rhs Second permissions set for equality check. - * @return Whether specified permission sets are equal. - */ - public static boolean deepEquals(SecurityPermissionSet lhs, SecurityPermissionSet rhs) { - if (lhs == rhs) - return true; - - return lhs != null - && rhs != null - && lhs.defaultAllowAll() == rhs.defaultAllowAll() - && (F.isEmpty(rhs.systemPermissions()) && F.isEmpty(rhs.systemPermissions()) - || F.eqNotOrdered(rhs.systemPermissions(), lhs.systemPermissions())) - && eqNotOrdered(rhs.taskPermissions(), lhs.taskPermissions()) - && eqNotOrdered(rhs.servicePermissions(), lhs.servicePermissions()) - && eqNotOrdered(rhs.cachePermissions(), lhs.cachePermissions()); - } - - /** - * @param m1 First map to check. - * @param m2 Second map to check - * @return {@code True} is maps are equal, {@code False} otherwise. - */ - public static boolean eqNotOrdered( - @Nullable Map> m1, - @Nullable Map> m2) { - if (m1 == m2) - return true; - - if (m1 == null || m2 == null) - return false; - - if (m1.size() != m2.size()) - return false; - - for (Map.Entry> e : m1.entrySet()) { - if (!F.eqNotOrdered(e.getValue(), m2.get(e.getKey()))) - return false; - } - - return true; - } } diff --git a/modules/core/src/test/java/org/apache/ignite/testframework/junits/spi/GridSpiAbstractTest.java b/modules/core/src/test/java/org/apache/ignite/testframework/junits/spi/GridSpiAbstractTest.java index 4c172b398a521..74e42f1fb3bf4 100644 --- a/modules/core/src/test/java/org/apache/ignite/testframework/junits/spi/GridSpiAbstractTest.java +++ b/modules/core/src/test/java/org/apache/ignite/testframework/junits/spi/GridSpiAbstractTest.java @@ -727,7 +727,7 @@ private static class SecurityPermissionSetImpl implements SecurityPermissionSet } /** {@inheritDoc} */ - @Override public Map> taskPermissions() { + @Override public Map> taskPermissions() { return Collections.emptyMap(); } @@ -737,7 +737,7 @@ private static class SecurityPermissionSetImpl implements SecurityPermissionSet } /** {@inheritDoc} */ - @Override public Map> servicePermissions() { + @Override public Map> servicePermissions() { return Collections.emptyMap(); }