org.apache.thrift.transport.TSaslServerTransport Maven / Gradle / Ivy
The newest version!
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.thrift.transport;
import java.lang.ref.WeakReference;
import java.nio.charset.StandardCharsets;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
import java.util.WeakHashMap;
import javax.security.auth.callback.CallbackHandler;
import javax.security.sasl.Sasl;
import javax.security.sasl.SaslException;
import javax.security.sasl.SaslServer;
import org.apache.thrift.transport.sasl.NegotiationStatus;
import org.apache.thrift.transport.sasl.TSaslServerDefinition;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
* Wraps another Thrift TTransport, but performs SASL server negotiation on the call to
* open(). This class will wrap ensuing communication over it, if a SASL QOP is
* negotiated with the other party.
*/
public class TSaslServerTransport extends TSaslTransport {
private static final Logger LOGGER = LoggerFactory.getLogger(TSaslServerTransport.class);
/**
* Mapping from SASL mechanism name -> all the parameters required to instantiate a SASL server.
*/
private Map serverDefinitionMap =
new HashMap();
/**
* Uses the given underlying transport. Assumes that addServerDefinition is called later.
*
* @param transport Transport underlying this one.
*/
public TSaslServerTransport(TTransport transport) throws TTransportException {
super(transport);
}
/**
* Creates a SaslServer using the given SASL-specific parameters. See the Java
* documentation for Sasl.createSaslServer for the details of the parameters.
*
* @param transport The underlying Thrift transport.
*/
public TSaslServerTransport(
String mechanism,
String protocol,
String serverName,
Map props,
CallbackHandler cbh,
TTransport transport)
throws TTransportException {
super(transport);
addServerDefinition(mechanism, protocol, serverName, props, cbh);
}
private TSaslServerTransport(
Map serverDefinitionMap, TTransport transport)
throws TTransportException {
super(transport);
this.serverDefinitionMap.putAll(serverDefinitionMap);
}
/**
* Add a supported server definition to this transport. See the Java documentation for
* Sasl.createSaslServer for the details of the parameters.
*/
public void addServerDefinition(
String mechanism,
String protocol,
String serverName,
Map props,
CallbackHandler cbh) {
serverDefinitionMap.put(
mechanism, new TSaslServerDefinition(mechanism, protocol, serverName, props, cbh));
}
@Override
protected SaslRole getRole() {
return SaslRole.SERVER;
}
/**
* Performs the server side of the initial portion of the Thrift SASL protocol. Receives the
* initial response from the client, creates a SASL server using the mechanism requested by the
* client (if this server supports it), and sends the first challenge back to the client.
*/
@Override
protected void handleSaslStartMessage() throws TTransportException, SaslException {
SaslResponse message = receiveSaslMessage();
LOGGER.debug("Received start message with status {}", message.status);
if (message.status != NegotiationStatus.START) {
throw sendAndThrowMessage(
NegotiationStatus.ERROR, "Expecting START status, received " + message.status);
}
// Get the mechanism name.
String mechanismName = new String(message.payload, StandardCharsets.UTF_8);
TSaslServerDefinition serverDefinition = serverDefinitionMap.get(mechanismName);
LOGGER.debug("Received mechanism name '{}'", mechanismName);
if (serverDefinition == null) {
throw sendAndThrowMessage(
NegotiationStatus.BAD, "Unsupported mechanism type " + mechanismName);
}
SaslServer saslServer =
Sasl.createSaslServer(
serverDefinition.mechanism,
serverDefinition.protocol,
serverDefinition.serverName,
serverDefinition.props,
serverDefinition.cbh);
setSaslServer(saslServer);
}
/**
* TTransportFactory to create TSaslServerTransports. Ensures that a
* given underlying TTransport instance receives the same TSaslServerTransport
* . This is kind of an awful hack to work around the fact that Thrift is designed assuming
* that TTransport instances are stateless, and thus the existing TServers
* use different TTransport instances for input and output.
*/
public static class Factory extends TTransportFactory {
/**
* This is the implementation of the awful hack described above. WeakHashMap is
* used to ensure that we don't leak memory.
*/
private static Map> transportMap =
Collections.synchronizedMap(
new WeakHashMap>());
/**
* Mapping from SASL mechanism name -> all the parameters required to instantiate a SASL server.
*/
private Map serverDefinitionMap =
new HashMap();
/** Create a new Factory. Assumes that addServerDefinition will be called later. */
public Factory() {
super();
}
/**
* Create a new Factory, initially with the single server definition given. You may
* still call addServerDefinition later. See the Java documentation for
* Sasl.createSaslServer for the details of the parameters.
*/
public Factory(
String mechanism,
String protocol,
String serverName,
Map props,
CallbackHandler cbh) {
super();
addServerDefinition(mechanism, protocol, serverName, props, cbh);
}
/**
* Add a supported server definition to the transports created by this factory. See the Java
* documentation for Sasl.createSaslServer for the details of the parameters.
*/
public void addServerDefinition(
String mechanism,
String protocol,
String serverName,
Map props,
CallbackHandler cbh) {
serverDefinitionMap.put(
mechanism, new TSaslServerDefinition(mechanism, protocol, serverName, props, cbh));
}
/**
* Get a new TSaslServerTransport instance, or reuse the existing one if a
* TSaslServerTransport has already been created before using the given TTransport
* as an underlying transport. This ensures that a given underlying transport instance
* receives the same TSaslServerTransport.
*/
@Override
public TTransport getTransport(TTransport base) throws TTransportException {
WeakReference ret = transportMap.get(base);
if (ret == null || ret.get() == null) {
LOGGER.debug("transport map does not contain key", base);
ret =
new WeakReference(
new TSaslServerTransport(serverDefinitionMap, base));
try {
ret.get().open();
} catch (TTransportException e) {
LOGGER.debug("failed to open server transport", e);
throw new RuntimeException(e);
}
transportMap.put(base, ret); // No need for putIfAbsent().
// Concurrent calls to getTransport() will pass in different TTransports.
} else {
LOGGER.debug("transport map does contain key {}", base);
}
return ret.get();
}
}
}