Fix qos command remote check (apache#11506)

* Fix qos command remote check * update * Fix NPE
lcb11 · Mar 31, 2023 · d360339 · d360339
1 parent 443e16c
commit d360339
Show file tree

Hide file tree

Showing 4 changed files with 73 additions and 31 deletions.
diff --git a/dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/command/CommandContext.java b/dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/command/CommandContext.java
@@ -16,10 +16,10 @@
  */
 package org.apache.dubbo.qos.command;
 
-import io.netty.channel.Channel;
-import org.apache.dubbo.qos.permission.PermissionLevel;
 import org.apache.dubbo.qos.common.QosConfiguration;
 
+import io.netty.channel.Channel;
+
 public class CommandContext {
 
     private String commandName;
@@ -93,8 +93,8 @@ public void setQosConfiguration(QosConfiguration qosConfiguration) {
         this.qosConfiguration = qosConfiguration;
     }
 
-    public boolean hasPermission(PermissionLevel cmdRequiredPermissionLevel) {
-        return cmdRequiredPermissionLevel.getLevel() <= qosConfiguration.getAnonymousAccessPermissionLevel().getLevel();
+    public QosConfiguration getQosConfiguration() {
+        return qosConfiguration;
     }
 
     public boolean isAllowAnonymousAccess(){

diff --git a/dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/common/QosConfiguration.java b/dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/common/QosConfiguration.java
@@ -16,6 +16,12 @@
  */
 package org.apache.dubbo.qos.common;
 
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
+
+import org.apache.dubbo.common.utils.NetUtils;
+import org.apache.dubbo.common.utils.StringUtils;
 import org.apache.dubbo.qos.permission.PermissionLevel;
 
 public class QosConfiguration {
@@ -26,6 +32,8 @@ public class QosConfiguration {
     // support specific ip and an ip range from CIDR specification
     private String acceptForeignIpWhitelist;
 
+    private Predicate<String> acceptForeignIpWhitelistPredicate;
+
     // this permission level for anonymous access, it will ignore the acceptForeignIp and acceptForeignIpWhitelist configurations
     // Access permission depends on the config anonymousAccessPermissionLevel and the cmd required permission level
     // the default value is Cmd.PermissionLevel.PUBLIC, can only access PUBLIC level cmd
@@ -39,6 +47,27 @@ public QosConfiguration(Builder builder) {
         this.acceptForeignIp = builder.isAcceptForeignIp();
         this.acceptForeignIpWhitelist = builder.getAcceptForeignIpWhitelist();
         this.anonymousAccessPermissionLevel = builder.getAnonymousAccessPermissionLevel();
+        buildPredicate();
+    }
+
+    private void buildPredicate() {
+        if (StringUtils.isNotEmpty(acceptForeignIpWhitelist)) {
+            this.acceptForeignIpWhitelistPredicate = Arrays.stream(acceptForeignIpWhitelist.split(","))
+                .map(String::trim)
+                .filter(StringUtils::isNotEmpty)
+                .map(foreignIpPattern -> (Predicate<String>) foreignIp -> {
+                    try {
+                        // hard code port to -1
+                        return NetUtils.matchIpExpression(foreignIpPattern, foreignIp, -1);
+                    } catch (UnknownHostException ignore) {
+                        // ignore illegal CIDR specification
+                    }
+                    return false;
+                })
+                .reduce(Predicate::or).orElse(s -> false);
+        } else {
+            this.acceptForeignIpWhitelistPredicate = foreignIp -> false;
+        }
     }
 
     public boolean isAllowAnonymousAccess() {
@@ -57,6 +86,10 @@ public String getAcceptForeignIpWhitelist() {
         return acceptForeignIpWhitelist;
     }
 
+    public Predicate<String> getAcceptForeignIpWhitelistPredicate() {
+        return acceptForeignIpWhitelistPredicate;
+    }
+
     public boolean isAcceptForeignIp() {
         return acceptForeignIp;
     }

diff --git a/...rc/main/java/org/apache/dubbo/qos/permission/DefaultAnonymousAccessPermissionChecker.java b/...rc/main/java/org/apache/dubbo/qos/permission/DefaultAnonymousAccessPermissionChecker.java
@@ -17,12 +17,37 @@
 package org.apache.dubbo.qos.permission;
 
 import org.apache.dubbo.qos.command.CommandContext;
+import org.apache.dubbo.qos.common.QosConfiguration;
+
+import io.netty.channel.Channel;
+
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.util.Optional;
 
 public class DefaultAnonymousAccessPermissionChecker implements PermissionChecker {
     public static final DefaultAnonymousAccessPermissionChecker INSTANCE = new DefaultAnonymousAccessPermissionChecker();
 
     @Override
     public boolean access(CommandContext commandContext, PermissionLevel defaultCmdRequiredPermissionLevel) {
-        return commandContext.hasPermission(defaultCmdRequiredPermissionLevel);
+        final InetAddress inetAddress = Optional.ofNullable(commandContext.getRemote())
+            .map(Channel::remoteAddress)
+            .map(InetSocketAddress.class::cast)
+            .map(InetSocketAddress::getAddress)
+            .orElse(null);
+
+        QosConfiguration qosConfiguration = commandContext.getQosConfiguration();
+        PermissionLevel currentLevel = qosConfiguration.getAnonymousAccessPermissionLevel();
+
+        // Local has private permission
+        if (inetAddress != null && inetAddress.isLoopbackAddress()) {
+            currentLevel = PermissionLevel.PRIVATE;
+        } else if (inetAddress != null &&
+            qosConfiguration.getAcceptForeignIpWhitelistPredicate()
+                .test(inetAddress.getHostAddress())) {
+            currentLevel = PermissionLevel.PROTECTED;
+        }
+
+        return currentLevel.getLevel() >= defaultCmdRequiredPermissionLevel.getLevel();
     }
 }
diff --git a/...dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/ForeignHostPermitHandler.java b/...dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/ForeignHostPermitHandler.java
@@ -16,21 +16,19 @@
  */
 package org.apache.dubbo.qos.server.handler;
 
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.util.function.Predicate;
+
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConfiguration;
+import org.apache.dubbo.qos.common.QosConstants;
+
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.channel.ChannelFutureListener;
 import io.netty.channel.ChannelHandlerAdapter;
 import io.netty.channel.ChannelHandlerContext;
-import org.apache.dubbo.common.utils.NetUtils;
-import org.apache.dubbo.common.utils.StringUtils;
-import org.apache.dubbo.qos.common.QosConstants;
-import org.apache.dubbo.qos.common.QosConfiguration;
-
-import java.net.InetAddress;
-import java.net.InetSocketAddress;
-import java.net.UnknownHostException;
-import java.util.Arrays;
-import java.util.function.Predicate;
 
 public class ForeignHostPermitHandler extends ChannelHandlerAdapter {
 
@@ -40,29 +38,15 @@ public class ForeignHostPermitHandler extends ChannelHandlerAdapter {
     // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
     // support specific ip and an ip range from CIDR specification
     private final String acceptForeignIpWhitelist;
-    private Predicate<String> whitelistPredicate = foreignIp -> false;
+    private Predicate<String> whitelistPredicate;
 
     private final QosConfiguration qosConfiguration;
 
     public ForeignHostPermitHandler(QosConfiguration qosConfiguration) {
         this.qosConfiguration = qosConfiguration;
         this.acceptForeignIp = qosConfiguration.isAcceptForeignIp();
         this.acceptForeignIpWhitelist = qosConfiguration.getAcceptForeignIpWhitelist();
-        if (StringUtils.isNotEmpty(acceptForeignIpWhitelist)) {
-            whitelistPredicate = Arrays.stream(acceptForeignIpWhitelist.split(","))
-                .map(String::trim)
-                .filter(StringUtils::isNotEmpty)
-                .map(foreignIpPattern -> (Predicate<String>) foreignIp -> {
-                    try {
-                        // hard code port to -1
-                        return NetUtils.matchIpExpression(foreignIpPattern, foreignIp, -1);
-                    } catch (UnknownHostException ignore) {
-                        // ignore illegal CIDR specification
-                    }
-                    return false;
-                })
-                .reduce(Predicate::or).orElse(s -> false);
-        }
+        this.whitelistPredicate = qosConfiguration.getAcceptForeignIpWhitelistPredicate();
     }
 
     @Override