lingwei.kong/hawkbit
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Migrated environment aware to property annotation mechanism, documented properties.

Browse Source
This commit is contained in:
Kai Zimmermann
2016-02-25 11:36:21 +01:00
parent ca66932918
commit 0b8e693cec
25 changed files with 688 additions and 351 deletions
Download Patch File Download Diff File Expand all files Collapse all files

147
hawkbit-security-core/src/main/java/org/eclipse/hawkbit/security/DdiSecurityProperties.java Normal file
View File

@@ -0,0 +1,147 @@
/**
* Copyright (c) 2015 Bosch Software Innovations GmbH and others.
*
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
* http://www.eclipse.org/legal/epl-v10.html
*/
package org.eclipse.hawkbit.security;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;
/**
* The common properties for DDI security.
*/
@ConfigurationProperties("hawkbit.server.ddi.security")
public class DdiSecurityProperties {
/**
* Inner class for reverse proxy configuration. Defines the security
* properties for authenticating controllers behind a reverse proxy which
* terminates the SSL session at the reverse proxy but adding request header
* which contains the CN of the certificate.
*/
@Component
@ConfigurationProperties("hawkbit.server.ddi.security.rp")
public static class RpProperties {
/**
* HTTP header field for common name of a DDI target client certificate.
*/
private String cnHeader = "X-Ssl-Client-Cn";
/**
* HTTP header field for issuer hash of a DDI target client certificate.
*/
private String sslIssuerHashHeader = "X-Ssl-Issuer-Hash-%d";
/**
* List of trusted (reverse proxy) IP addresses for performing DDI
* client certificate authentication.
*/
private List<String> trustedIPs;
/**
* @return the cnHeader
*/
public String getCnHeader() {
return cnHeader;
}
/**
* @param cnHeader
* the cnHeader to set
*/
public void setCnHeader(final String cnHeader) {
this.cnHeader = cnHeader;
}
/**
* @return the sslIssuerHashHeader
*/
public String getSslIssuerHashHeader() {
return sslIssuerHashHeader;
}
/**
* @param sslIssuerHashHeader
* the sslIssuerHashHeader to set
*/
public void setSslIssuerHashHeader(final String sslIssuerHashHeader) {
this.sslIssuerHashHeader = sslIssuerHashHeader;
}
/**
* @return the trustedIPs
*/
public List<String> getTrustedIPs() {
return trustedIPs;
}
/**
* @param trustedIPs
* the trustedIPs to set
*/
public void setTrustedIPs(final List<String> trustedIPs) {
this.trustedIPs = trustedIPs;
}
}
/**
* Inner class for anonymous enable configuration.
*/
@Component
@ConfigurationProperties("hawkbit.server.ddi.security.authentication.anonymous")
public static class AnoymousAuthenticationProperties {
/**
* Set to true to enable anonymous DDI client authentication.
*/
private Boolean enabled = Boolean.FALSE;
/**
* @param enabled
* the enabled to set
*/
public void setEnabled(final Boolean enabled) {
this.enabled = enabled;
}
/**
* @return the enabled
*/
public Boolean getEnabled() {
return enabled;
}
}
@Autowired
private RpProperties rppProperties;
@Autowired
private AnoymousAuthenticationProperties authenticationsProperties;
public String getRpCnHeader() {
return rppProperties.getCnHeader();
}
public String getRpSslIssuerHashHeader() {
return rppProperties.getSslIssuerHashHeader();
}
public List<String> getRpTrustedIPs() {
return rppProperties.getTrustedIPs();
}
public Boolean getAnonymousEnabled() {
return authenticationsProperties.getEnabled();
}
}

231
hawkbit-security-core/src/main/java/org/eclipse/hawkbit/security/SecurityProperties.java
View File

@@ -1,130 +1,181 @@
/**
* Copyright (c) 2015 Bosch Software Innovations GmbH and others.
*
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
* http://www.eclipse.org/legal/epl-v10.html
*/
package org.eclipse.hawkbit.security;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;
/**
* The common properties for security.
*
*
* Security related hawkbit configuration.
*
*/
@ConfigurationProperties
@ConfigurationProperties("hawkbit.server.security")
public class SecurityProperties {
private final Clients clients = new Clients();
private final Dos dos = new Dos();
private final Xframe xframe = new Xframe();
public Dos getDos() {
return dos;
}
public Clients getClients() {
return clients;
}
public Xframe getXframe() {
return xframe;
}
/**
* Inner class for reverse proxy configuration.
* Defines the XFrameOption policy.
*
*/
@Component
@ConfigurationProperties("hawkbit.server.controller.security.rp")
public static class RpProperties {
private String cnHeader = "X-Ssl-Client-Cn";
private String sslIssuerHashHeader = "X-Ssl-Issuer-Hash-%d";
private List<String> trustedIPs;
public static class Xframe {
/**
* @return the cnHeader
* XFrame option. Allowed values: SAMEORIGIN, DENY, ALLOW-FROM
*/
public String getCnHeader() {
return cnHeader;
private String option = "DENY";
/**
* ALLOW-FROM defined URL, has to be filled in case ALLOW-FROM option is
* selected.
*/
private String allowfrom = "";
public String getOption() {
return option;
}
/**
* @param cnHeader
* the cnHeader to set
*/
public void setCnHeader(final String cnHeader) {
this.cnHeader = cnHeader;
public void setOption(final String option) {
this.option = option;
}
/**
* @return the sslIssuerHashHeader
*/
public String getSslIssuerHashHeader() {
return sslIssuerHashHeader;
public String getAllowfrom() {
return allowfrom;
}
/**
* @param sslIssuerHashHeader
* the sslIssuerHashHeader to set
*/
public void setSslIssuerHashHeader(final String sslIssuerHashHeader) {
this.sslIssuerHashHeader = sslIssuerHashHeader;
}
/**
* @return the trustedIPs
*/
public List<String> getTrustedIPs() {
return trustedIPs;
}
/**
* @param trustedIPs
* the trustedIPs to set
*/
public void setTrustedIPs(final List<String> trustedIPs) {
this.trustedIPs = trustedIPs;
public void setAllowfrom(final String allowfrom) {
this.allowfrom = allowfrom;
}
}
/**
* Inner class for anonymous enable configuration.
* Security configuration related to clients.
*
*/
@Component
@ConfigurationProperties("hawkbit.server.controller.security.authentication.anonymous")
public static class AnoymousAuthenticationProperties {
private Boolean enabled = Boolean.FALSE;
public static class Clients {
/**
* @param enabled
* the enabled to set
* Blacklisted client (IP addresses) for for DDI and Management API.
*/
public void setEnabled(final Boolean enabled) {
this.enabled = enabled;
}
private String blacklist = "";
/**
* @return the enabled
* Name of the http header from which the remote ip is extracted.
*/
public Boolean getEnabled() {
return enabled;
private String remoteIpHeader = "X-Forwarded-For";
public String getBlacklist() {
return blacklist;
}
public void setBlacklist(final String blacklist) {
this.blacklist = blacklist;
}
public String getRemoteIpHeader() {
return remoteIpHeader;
}
public void setRemoteIpHeader(final String remoteIpHeader) {
this.remoteIpHeader = remoteIpHeader;
}
}
@Autowired
private RpProperties rppProperties;
/**
* Denial of service protection related properties.
*
*/
public static class Dos {
@Autowired
private AnoymousAuthenticationProperties authenticationsProperties;
/**
* White list of peer IP addresses for DOS filter (regular expression).
*/
private String whitelist = "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|192\\.168\\.\\d{1,3}\\.\\d{1,3}|169\\.254\\.\\d{1,3}\\.\\d{1,3}|127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|172\\.1[6-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}";
public String getRpCnHeader() {
return rppProperties.getCnHeader();
/**
* Maximum number of status updates that the controller can report for
* an action (0 to disable).
*/
private int maxStatusEntriesPerAction = 1000;
/**
* Maximum number of attributes that the controller can report;
*/
private int maxAttributeEntriesPerTarget = 100;
private final Filter filter = new Filter();
public Filter getFilter() {
return filter;
}
public String getWhitelist() {
return whitelist;
}
public void setWhitelist(final String whitelist) {
this.whitelist = whitelist;
}
public int getMaxStatusEntriesPerAction() {
return maxStatusEntriesPerAction;
}
public void setMaxStatusEntriesPerAction(final int maxStatusEntriesPerAction) {
this.maxStatusEntriesPerAction = maxStatusEntriesPerAction;
}
public int getMaxAttributeEntriesPerTarget() {
return maxAttributeEntriesPerTarget;
}
public void setMaxAttributeEntriesPerTarget(final int maxAttributeEntriesPerTarget) {
this.maxAttributeEntriesPerTarget = maxAttributeEntriesPerTarget;
}
public static class Filter {
/**
* # Maximum number of allowed REST read/GET requests per second per
* client.
*/
int maxRead = 200;
/**
* Maximum number of allowed REST write/(PUT/POST/etc.) requests per
* second per client.
*/
int maxWrite = 50;
public int getMaxRead() {
return maxRead;
}
public void setMaxRead(final int maxRead) {
this.maxRead = maxRead;
}
public int getMaxWrite() {
return maxWrite;
}
public void setMaxWrite(final int maxWrite) {
this.maxWrite = maxWrite;
}
}
}
public String getRpSslIssuerHashHeader() {
return rppProperties.getSslIssuerHashHeader();
}
public List<String> getRpTrustedIPs() {
return rppProperties.getTrustedIPs();
}
public Boolean getAnonymousEnabled() {
return authenticationsProperties.getEnabled();
}
}

68
hawkbit-security-core/src/main/java/org/eclipse/hawkbit/util/SPInfo.java
View File

@@ -11,90 +11,24 @@ package org.eclipse.hawkbit.util;
import javax.servlet.MultipartConfigElement;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.EnvironmentAware;
import org.springframework.core.env.Environment;
import org.springframework.stereotype.Component;
/**
* Bean which contains all informations about the SP software, e.g. like
* version, built time etc. from the environment.
*
*
*
*
*/
@Component
public class SPInfo implements EnvironmentAware {
public class SPInfo {
// package private for testing purposes
static final String UNKNOWN_VERSION = "unknown";
static final String UNKNOWN_CREDENTIAL = "unknown credential";
private Environment environmentData;
@Autowired
private MultipartConfigElement configElement;
/*
* (non-Javadoc)
*
* @see org.springframework.context.EnvironmentAware#setEnvironment(org.
* springframework.core.env. Environment)
*/
@Override
public void setEnvironment(final Environment environment) {
this.environmentData = environment;
}
/**
* @return the version in string format, e.g. 1.0.0 or {@code "UNKNOWN"} in
* case the SP version info cannot be determined.
*/
public String getVersion() {
if (environmentData != null) {
return environmentData.getProperty("info.build.version", UNKNOWN_VERSION);
}
return UNKNOWN_VERSION;
}
public String getSupportEmail() {
if (environmentData != null) {
return environmentData.getProperty("hawkbit.server.email.support");
}
return "";
}
public String getRequestAccountEmail() {
if (environmentData != null) {
return environmentData.getProperty("hawkbit.server.email.request.account");
}
return "";
}
public String getDemoTenant() {
if (environmentData != null) {
return environmentData.getProperty("hawkbit.server.demo.tenant");
}
return UNKNOWN_CREDENTIAL;
}
public String getDemoUser() {
if (environmentData != null) {
return environmentData.getProperty("hawkbit.server.demo.user");
}
return UNKNOWN_CREDENTIAL;
}
public String getDemoPassword() {
if (environmentData != null) {
return environmentData.getProperty("hawkbit.server.demo.password");
}
return UNKNOWN_CREDENTIAL;
}
/**
* @return the max file size to upload artifact files in bytes which has
* been configured.