content: /*
   * Licensed to the Apache Software Foundation (ASF) under one
   * or more contributor license agreements.  See the NOTICE file
   * distributed with this work for additional information
   * regarding copyright ownership.  The ASF licenses this file
   * to you under the Apache License, Version 2.0 (the
   * "License"); you may not use this file except in compliance
   * with the License.  You may obtain a copy of the License at
   *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.apache.cassandra.auth.jmx;
  
  import java.lang.reflect.Field;
  import java.rmi.server.RMISocketFactory;
  import java.util.HashMap;
  import java.util.Map;
  import java.util.Queue;
  import javax.management.JMX;
  import javax.management.MBeanServerConnection;
  import javax.management.ObjectName;
  import javax.management.remote.JMXConnector;
  import javax.management.remote.JMXConnectorFactory;
  import javax.management.remote.JMXConnectorServer;
  import javax.management.remote.JMXServiceURL;
  import javax.security.auth.Subject;
  import javax.security.auth.callback.CallbackHandler;
  import javax.security.auth.login.LoginException;
  import javax.security.auth.spi.LoginModule;
  
  import com.google.common.collect.ImmutableSet;
  import org.junit.Before;
  import org.junit.Ignore;
  import org.junit.Test;
  
  import org.apache.cassandra.audit.AuditLogEntry;
  import org.apache.cassandra.audit.AuditLogEntryType;
  import org.apache.cassandra.audit.AuditLogManager;
  import org.apache.cassandra.audit.AuditLogOptions;
  import org.apache.cassandra.audit.InMemoryAuditLogger;
  import org.apache.cassandra.auth.AuthenticatedUser;
  import org.apache.cassandra.auth.CassandraPrincipal;
  import org.apache.cassandra.auth.IAuthorizer;
  import org.apache.cassandra.auth.JMXResource;
  import org.apache.cassandra.auth.Permission;
  import org.apache.cassandra.auth.RoleResource;
  import org.apache.cassandra.auth.StubAuthorizer;
  import org.apache.cassandra.config.DatabaseDescriptor;
  import org.apache.cassandra.config.JMXServerOptions;
  import org.apache.cassandra.cql3.CQLTester;
  import org.apache.cassandra.db.ColumnFamilyStoreMBean;
  import org.apache.cassandra.utils.JMXServerUtils;
  import org.assertj.core.api.Assertions;
  
  import static org.junit.Assert.assertEquals;
  import static org.junit.Assert.fail;
  
  @Ignore
  public abstract class AbstractJMXAuthTest extends CQLTester
  {
      private static JMXConnectorServer jmxServer;
      private static MBeanServerConnection connection;
  
      private RoleResource role;
      private String tableName;
      private JMXResource tableMBean;
      private Queue<AuditLogEntry> auditLogs;
  
      @Before
      public void setup() throws Throwable
      {
          role = RoleResource.role("test_role");
          clearAllPermissions();
          tableName = createTable("CREATE TABLE %s (k int, v int, PRIMARY KEY (k))");
          tableMBean = JMXResource.mbean(String.format("org.apache.cassandra.db:type=Tables,keyspace=%s,table=%s",
                                                       KEYSPACE, tableName));
          AuditLogManager.instance.enable(DatabaseDescriptor.getAuditLoggingOptions());
          auditLogs = ((InMemoryAuditLogger) AuditLogManager.instance.getLogger()).internalQueue();
      }
  
      @Test
      public void readAttribute() throws Throwable
      {
          ColumnFamilyStoreMBean proxy = JMX.newMBeanProxy(connection,
                                                           ObjectName.getInstance(tableMBean.getObjectName()),
                                                           ColumnFamilyStoreMBean.class);
  
          // grant SELECT on a single specific Table mbean
          assertPermissionOnResource(Permission.SELECT, tableMBean, proxy::getTableName);
  
          // grant SELECT on all Table mbeans in named keyspace
          clearAllPermissions();
          JMXResource allTablesInKeyspace = JMXResource.mbean(String.format("org.apache.cassandra.db:type=Tables,keyspace=%s,*",
                                                                            KEYSPACE));
          assertPermissionOnResource(Permission.SELECT, allTablesInKeyspace, proxy::getTableName);
  
          // grant SELECT on all Table mbeans
          clearAllPermissions();
          JMXResource allTables = JMXResource.mbean("org.apache.cassandra.db:type=Tables,*");
          assertPermissionOnResource(Permission.SELECT, allTables, proxy::getTableName);
  
          // grant SELECT ON ALL MBEANS
          clearAllPermissions();
          assertPermissionOnResource(Permission.SELECT, JMXResource.root(), proxy::getTableName);
      }
  
      @Test
      public void writeAttribute() throws Throwable
      {
          ColumnFamilyStoreMBean proxy = JMX.newMBeanProxy(connection,
                                                           ObjectName.getInstance(tableMBean.getObjectName()),
                                                           ColumnFamilyStoreMBean.class);
          MBeanAction action = () -> proxy.setMinimumCompactionThreshold(4);
  
          // grant MODIFY on a single specific Table mbean
          assertPermissionOnResource(Permission.MODIFY, tableMBean, action);
  
          // grant MODIFY on all Table mbeans in named keyspace
          clearAllPermissions();
          JMXResource allTablesInKeyspace = JMXResource.mbean(String.format("org.apache.cassandra.db:type=Tables,keyspace=%s,*",
                                                                            KEYSPACE));
          assertPermissionOnResource(Permission.MODIFY, allTablesInKeyspace, action);
  
          // grant MODIFY on all Table mbeans
          clearAllPermissions();
          JMXResource allTables = JMXResource.mbean("org.apache.cassandra.db:type=Tables,*");
          assertPermissionOnResource(Permission.MODIFY, allTables, action);
  
          // grant MODIFY ON ALL MBEANS
          clearAllPermissions();
          assertPermissionOnResource(Permission.MODIFY, JMXResource.root(), action);
      }
  
      @Test
      public void executeMethod() throws Throwable
      {
          ColumnFamilyStoreMBean proxy = JMX.newMBeanProxy(connection,
                                                           ObjectName.getInstance(tableMBean.getObjectName()),
                                                           ColumnFamilyStoreMBean.class);
  
          // grant EXECUTE on a single specific Table mbean
          assertPermissionOnResource(Permission.EXECUTE, tableMBean, proxy::estimateKeys);
  
          // grant EXECUTE on all Table mbeans in named keyspace
          clearAllPermissions();
          JMXResource allTablesInKeyspace = JMXResource.mbean(String.format("org.apache.cassandra.db:type=Tables,keyspace=%s,*",
                                                                            KEYSPACE));
          assertPermissionOnResource(Permission.EXECUTE, allTablesInKeyspace, proxy::estimateKeys);
  
          // grant EXECUTE on all Table mbeans
          clearAllPermissions();
          JMXResource allTables = JMXResource.mbean("org.apache.cassandra.db:type=Tables,*");
          assertPermissionOnResource(Permission.EXECUTE, allTables, proxy::estimateKeys);
  
          // grant EXECUTE ON ALL MBEANS
          clearAllPermissions();
          assertPermissionOnResource(Permission.EXECUTE, JMXResource.root(), proxy::estimateKeys);
      }
  
  
      protected static void setupJMXServer(JMXServerOptions jmxServerOptions) throws Exception
      {
          DatabaseDescriptor.setAuditLoggingOptions(new AuditLogOptions.Builder()
                                                    .withEnabled(true)
                                                    .withBlock(true)
                                                    .withLogger("InMemoryAuditLogger", null)
                                                    .build());
  
          jmxServerOptions.jmx_encryption_options.applyConfig();
          jmxServer = JMXServerUtils.createJMXServer(jmxServerOptions, "localhost");
          jmxServer.start();
  
          JMXServiceURL jmxUrl = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://localhost:9999/jmxrmi");
          Map<String, Object> env = new HashMap<>();
          env.put("com.sun.jndi.rmi.factory.socket", RMISocketFactory.getDefaultSocketFactory());
          JMXConnector jmxc = JMXConnectorFactory.connect(jmxUrl, env);
          connection = jmxc.getMBeanServerConnection();
      }
  
      protected static void setupAuthorizer()
      {
          try
          {
              IAuthorizer authorizer = new StubAuthorizer();
              Field authorizerField = DatabaseDescriptor.class.getDeclaredField("authorizer");
              authorizerField.setAccessible(true);
              authorizerField.set(null, authorizer);
              DatabaseDescriptor.setPermissionsValidity(0);
          }
          catch (IllegalAccessException | NoSuchFieldException e)
          {
              throw new RuntimeException(e);
          }
      }
  
      @FunctionalInterface
      private interface MBeanAction
      {
          void execute();
      }
  
      private void assertPermissionOnResource(Permission permission,
                                              JMXResource resource,
                                              MBeanAction action)
      {
          assertUnauthorized(action);
          grantPermission(permission, resource, role);
          assertAuthorized(action);
      }
  
      private void grantPermission(Permission permission, JMXResource resource, RoleResource role)
      {
          DatabaseDescriptor.getAuthorizer().grant(AuthenticatedUser.SYSTEM_USER,
                                                   ImmutableSet.of(permission),
                                                   resource,
                                                   role);
      }
  
      private void assertAuthorized(MBeanAction action)
      {
          action.execute();
          AuditLogEntry entry = nextAuditEvent(auditLogs);
          Assertions.assertThat(entry.getType()).isSameAs(AuditLogEntryType.JMX);
          Assertions.assertThat(entry.getUser()).contains(role.getRoleName());
          Assertions.assertThat(entry.getOperation()).contains("JMX INVOCATION");
      }
  
      private void assertUnauthorized(MBeanAction action)
      {
          try
          {
              action.execute();
              fail("Expected an UnauthorizedException, but none was thrown");
          }
          catch (SecurityException e)
          {
              assertEquals("Access Denied", e.getLocalizedMessage());
              AuditLogEntry entry = nextAuditEvent(auditLogs);
              Assertions.assertThat(entry.getType()).isSameAs(AuditLogEntryType.JMX);
              Assertions.assertThat(entry.getUser()).contains(role.getRoleName());
              Assertions.assertThat(entry.getOperation()).contains("JMX FAILURE");
              Assertions.assertThat(entry.getOperation()).contains(e.getLocalizedMessage());
          }
      }
  
      private static AuditLogEntry nextAuditEvent(Queue<AuditLogEntry> auditLogs)
      {
          // When creating a new proxy, classloaders are loaded over JMX, so ignore those for permission assertions
          AuditLogEntry next = auditLogs.remove();
          if (next.getOperation().startsWith("JMX INVOCATION: javax.management.MBeanServer#getClassLoaderFor"))
              return auditLogs.remove();
          return next;
      }
  
      private void clearAllPermissions()
      {
          ((StubAuthorizer) DatabaseDescriptor.getAuthorizer()).clear();
      }
  
      public static class StubLoginModule implements LoginModule
      {
          private CassandraPrincipal principal;
          private Subject subject;
  
          public StubLoginModule()
          {
          }
  
          public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options)
          {
              this.subject = subject;
              principal = new CassandraPrincipal((String) options.get("role_name"));
          }
  
          public boolean login() throws LoginException
          {
              return true;
          }
  
          public boolean commit() throws LoginException
          {
              if (!subject.getPrincipals().contains(principal))
                  subject.getPrincipals().add(principal);
              return true;
          }
  
          public boolean abort() throws LoginException
          {
              return true;
          }
  
          public boolean logout() throws LoginException
          {
              return true;
          }
      }
  
      // always answers false to isSuperUser and true to isAuthSetup complete - saves us having to initialize
      // a real IRoleManager and StorageService for the test
      public static class NoSuperUserAuthorizationProxy extends AuthorizationProxy
      {
          public NoSuperUserAuthorizationProxy()
          {
              super();
              this.isSuperuser = (role) -> false;
              this.isAuthSetupComplete = () -> true;
          }
      }
  }
  