ONOS-1993 Implement API-level permission checking + security util code location replacement
Change-Id: I7bf20eda9c12ed2a44334504333b093057764cd2
diff --git a/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java b/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
index a8ff84f..9894174 100644
--- a/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
+++ b/core/net/src/main/java/org/onosproject/app/impl/ApplicationManager.java
@@ -42,6 +42,7 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.app.ApplicationEvent.Type.*;
+import static org.onosproject.security.AppGuard.checkPermission;
import static org.slf4j.LoggerFactory.getLogger;
/**
@@ -91,29 +92,39 @@
@Override
public Set<Application> getApplications() {
+ checkPermission(Permission.APP_READ);
+
return store.getApplications();
}
@Override
public ApplicationId getId(String name) {
+ checkPermission(Permission.APP_READ);
+
checkNotNull(name, "Name cannot be null");
return store.getId(name);
}
@Override
public Application getApplication(ApplicationId appId) {
+ checkPermission(Permission.APP_READ);
+
checkNotNull(appId, APP_ID_NULL);
return store.getApplication(appId);
}
@Override
public ApplicationState getState(ApplicationId appId) {
+ checkPermission(Permission.APP_READ);
+
checkNotNull(appId, APP_ID_NULL);
return store.getState(appId);
}
@Override
public Set<Permission> getPermissions(ApplicationId appId) {
+ checkPermission(Permission.APP_READ);
+
checkNotNull(appId, APP_ID_NULL);
return store.getPermissions(appId);
}
@@ -155,11 +166,15 @@
@Override
public void addListener(ApplicationListener listener) {
+ checkPermission(Permission.APP_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(ApplicationListener listener) {
+ checkPermission(Permission.APP_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java b/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
index 2397c64..9b80bcc 100644
--- a/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
+++ b/core/net/src/main/java/org/onosproject/cfg/impl/ComponentConfigManager.java
@@ -28,6 +28,7 @@
import org.onosproject.cfg.ComponentConfigStore;
import org.onosproject.cfg.ComponentConfigStoreDelegate;
import org.onosproject.cfg.ConfigProperty;
+import org.onosproject.core.Permission;
import org.osgi.service.cm.Configuration;
import org.osgi.service.cm.ConfigurationAdmin;
import org.slf4j.Logger;
@@ -43,6 +44,8 @@
import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Implementation of the centralized component configuration service.
@@ -84,11 +87,15 @@
@Override
public Set<String> getComponentNames() {
+ checkPermission(Permission.CONFIG_READ);
+
return ImmutableSet.copyOf(properties.keySet());
}
@Override
public void registerProperties(Class<?> componentClass) {
+ checkPermission(Permission.CONFIG_WRITE);
+
String componentName = componentClass.getName();
String resourceName = componentClass.getSimpleName() + RESOURCE_EXT;
try (InputStream ris = componentClass.getResourceAsStream(resourceName)) {
@@ -111,6 +118,8 @@
@Override
public void unregisterProperties(Class<?> componentClass, boolean clear) {
+ checkPermission(Permission.CONFIG_WRITE);
+
String componentName = componentClass.getName();
checkNotNull(componentName, COMPONENT_NULL);
Map<String, ConfigProperty> cps = properties.remove(componentName);
@@ -127,12 +136,16 @@
@Override
public Set<ConfigProperty> getProperties(String componentName) {
+ checkPermission(Permission.CONFIG_READ);
+
Map<String, ConfigProperty> map = properties.get(componentName);
return map != null ? ImmutableSet.copyOf(map.values()) : null;
}
@Override
public void setProperty(String componentName, String name, String value) {
+ checkPermission(Permission.CONFIG_WRITE);
+
checkNotNull(componentName, COMPONENT_NULL);
checkNotNull(name, PROPERTY_NULL);
store.setProperty(componentName, name, value);
@@ -140,6 +153,8 @@
@Override
public void unsetProperty(String componentName, String name) {
+ checkPermission(Permission.CONFIG_WRITE);
+
checkNotNull(componentName, COMPONENT_NULL);
checkNotNull(name, PROPERTY_NULL);
store.unsetProperty(componentName, name);
diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
index 980d40f..273738b 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/ClusterManager.java
@@ -33,6 +33,7 @@
import org.onosproject.cluster.ClusterStoreDelegate;
import org.onosproject.cluster.ControllerNode;
import org.onosproject.cluster.NodeId;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.slf4j.Logger;
@@ -42,6 +43,8 @@
import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Implementation of the cluster service.
@@ -88,22 +91,30 @@
@Override
public ControllerNode getLocalNode() {
+ checkPermission(Permission.CLUSTER_READ);
+
return store.getLocalNode();
}
@Override
public Set<ControllerNode> getNodes() {
+ checkPermission(Permission.CLUSTER_READ);
+
return store.getNodes();
}
@Override
public ControllerNode getNode(NodeId nodeId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(nodeId, INSTANCE_ID_NULL);
return store.getNode(nodeId);
}
@Override
public ControllerNode.State getState(NodeId nodeId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(nodeId, INSTANCE_ID_NULL);
return store.getState(nodeId);
}
@@ -111,6 +122,8 @@
@Override
public DateTime getLastUpdated(NodeId nodeId) {
+ checkPermission(Permission.CLUSTER_READ);
+
return store.getLastUpdated(nodeId);
}
@@ -144,11 +157,15 @@
@Override
public void addListener(ClusterEventListener listener) {
+ checkPermission(Permission.CLUSTER_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(ClusterEventListener listener) {
+ checkPermission(Permission.CLUSTER_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
index ee60cc7..cc33d56 100644
--- a/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
+++ b/core/net/src/main/java/org/onosproject/cluster/impl/MastershipManager.java
@@ -32,6 +32,7 @@
import org.onosproject.cluster.NodeId;
import org.onosproject.cluster.RoleInfo;
import org.onosproject.core.MetricsHelper;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.mastership.MastershipAdminService;
@@ -62,6 +63,8 @@
import static org.onosproject.cluster.ControllerNode.State.ACTIVE;
import static org.onosproject.net.MastershipRole.MASTER;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
@Component(immediate = true)
@Service
@@ -142,12 +145,16 @@
@Override
public MastershipRole getLocalRole(DeviceId deviceId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getRole(clusterService.getLocalNode().id(), deviceId);
}
@Override
public void relinquishMastership(DeviceId deviceId) {
+ checkPermission(Permission.CLUSTER_WRITE);
+
store.relinquishRole(clusterService.getLocalNode().id(), deviceId)
.whenComplete((event, error) -> {
if (event != null) {
@@ -158,6 +165,8 @@
@Override
public CompletableFuture<MastershipRole> requestRoleFor(DeviceId deviceId) {
+ checkPermission(Permission.CLUSTER_WRITE);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
final Context timer = startTimer(requestRoleTimer);
return store.requestRole(deviceId).whenComplete((result, error) -> stopTimer(timer));
@@ -166,18 +175,24 @@
@Override
public NodeId getMasterFor(DeviceId deviceId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getMaster(deviceId);
}
@Override
public Set<DeviceId> getDevicesOf(NodeId nodeId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(nodeId, NODE_ID_NULL);
return store.getDevices(nodeId);
}
@Override
public RoleInfo getNodesFor(DeviceId deviceId) {
+ checkPermission(Permission.CLUSTER_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getNodes(deviceId);
}
@@ -189,12 +204,16 @@
@Override
public void addListener(MastershipListener listener) {
+ checkPermission(Permission.CLUSTER_EVENT);
+
checkNotNull(listener);
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(MastershipListener listener) {
+ checkPermission(Permission.CLUSTER_EVENT);
+
checkNotNull(listener);
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
index 5c78bb4..f4fd648 100644
--- a/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
+++ b/core/net/src/main/java/org/onosproject/core/impl/CoreManager.java
@@ -31,6 +31,7 @@
import org.onosproject.core.CoreService;
import org.onosproject.core.IdBlockStore;
import org.onosproject.core.IdGenerator;
+import org.onosproject.core.Permission;
import org.onosproject.core.Version;
import org.onosproject.event.EventDeliveryService;
import org.osgi.service.component.ComponentContext;
@@ -44,6 +45,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static com.google.common.base.Strings.isNullOrEmpty;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Core service implementation.
@@ -97,21 +100,29 @@
@Override
public Version version() {
+ checkPermission(Permission.APP_READ);
+
return version;
}
@Override
public Set<ApplicationId> getAppIds() {
+ checkPermission(Permission.APP_READ);
+
return applicationIdStore.getAppIds();
}
@Override
public ApplicationId getAppId(Short id) {
+ checkPermission(Permission.APP_READ);
+
return applicationIdStore.getAppId(id);
}
@Override
public ApplicationId getAppId(String name) {
+ checkPermission(Permission.APP_READ);
+
return applicationIdStore.getAppId(name);
}
diff --git a/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java b/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
index d901623..a703270 100644
--- a/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
+++ b/core/net/src/main/java/org/onosproject/net/device/impl/DeviceManager.java
@@ -25,6 +25,7 @@
import org.apache.felix.scr.annotations.Service;
import org.onosproject.cluster.ClusterService;
import org.onosproject.cluster.NodeId;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.mastership.MastershipEvent;
@@ -68,6 +69,8 @@
import static org.onlab.util.Tools.groupedThreads;
import static org.onosproject.net.MastershipRole.*;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides implementation of the device SB & NB APIs.
@@ -148,45 +151,61 @@
@Override
public int getDeviceCount() {
+ checkPermission(Permission.DEVICE_READ);
+
return store.getDeviceCount();
}
@Override
public Iterable<Device> getDevices() {
+ checkPermission(Permission.DEVICE_READ);
+
return store.getDevices();
}
@Override
public Iterable<Device> getAvailableDevices() {
+ checkPermission(Permission.DEVICE_READ);
+
return store.getAvailableDevices();
}
@Override
public Device getDevice(DeviceId deviceId) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getDevice(deviceId);
}
@Override
public MastershipRole getRole(DeviceId deviceId) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return mastershipService.getLocalRole(deviceId);
}
@Override
public List<Port> getPorts(DeviceId deviceId) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getPorts(deviceId);
}
@Override
public List<PortStatistics> getPortStatistics(DeviceId deviceId) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getPortStatistics(deviceId);
}
@Override
public Port getPort(DeviceId deviceId, PortNumber portNumber) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
checkNotNull(portNumber, PORT_NUMBER_NULL);
return store.getPort(deviceId, portNumber);
@@ -194,6 +213,8 @@
@Override
public boolean isAvailable(DeviceId deviceId) {
+ checkPermission(Permission.DEVICE_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.isAvailable(deviceId);
}
@@ -224,11 +245,15 @@
@Override
public void addListener(DeviceListener listener) {
+ checkPermission(Permission.DEVICE_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(DeviceListener listener) {
+ checkPermission(Permission.DEVICE_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java b/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
index f8bc032..43040da 100644
--- a/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
+++ b/core/net/src/main/java/org/onosproject/net/driver/impl/DriverManager.java
@@ -24,6 +24,7 @@
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
+import org.onosproject.core.Permission;
import org.onosproject.net.Device;
import org.onosproject.net.DeviceId;
import org.onosproject.net.device.DeviceService;
@@ -45,6 +46,8 @@
import static org.onlab.util.Tools.nullIsNotFound;
import static org.onosproject.net.AnnotationKeys.DRIVER;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Manages inventory of device drivers.
@@ -105,6 +108,8 @@
@Override
public Set<Driver> getDrivers() {
+ checkPermission(Permission.DRIVER_READ);
+
ImmutableSet.Builder<Driver> builder = ImmutableSet.builder();
drivers.values().forEach(builder::add);
return builder.build();
@@ -112,6 +117,8 @@
@Override
public Set<Driver> getDrivers(Class<? extends Behaviour> withBehaviour) {
+ checkPermission(Permission.DRIVER_READ);
+
return drivers.values().stream()
.filter(d -> d.hasBehaviour(withBehaviour))
.collect(Collectors.toSet());
@@ -119,11 +126,15 @@
@Override
public Driver getDriver(String driverName) {
+ checkPermission(Permission.DRIVER_READ);
+
return nullIsNotFound(drivers.get(driverName), NO_DRIVER);
}
@Override
public Driver getDriver(String mfr, String hw, String sw) {
+ checkPermission(Permission.DRIVER_READ);
+
// First attempt a literal search.
Driver driver = driverByKey.get(key(mfr, hw, sw));
if (driver != null) {
@@ -149,6 +160,8 @@
@Override
public Driver getDriver(DeviceId deviceId) {
+ checkPermission(Permission.DRIVER_READ);
+
Device device = nullIsNotFound(deviceService.getDevice(deviceId), NO_DEVICE);
String driverName = device.annotations().value(DRIVER);
if (driverName != null) {
@@ -161,6 +174,8 @@
@Override
public DriverHandler createHandler(DeviceId deviceId, String... credentials) {
+ checkPermission(Permission.DRIVER_WRITE);
+
Driver driver = getDriver(deviceId);
return new DefaultDriverHandler(new DefaultDriverData(driver));
}
diff --git a/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java b/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
index 33e9994..b1de540 100644
--- a/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flow/impl/FlowRuleManager.java
@@ -35,6 +35,7 @@
import org.onosproject.core.ApplicationId;
import org.onosproject.core.CoreService;
import org.onosproject.core.IdGenerator;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.net.Device;
@@ -77,6 +78,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.onlab.util.Tools.groupedThreads;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides implementation of the flow NB & SB APIs.
@@ -167,16 +170,22 @@
@Override
public int getFlowRuleCount() {
+ checkPermission(Permission.FLOWRULE_READ);
+
return store.getFlowRuleCount();
}
@Override
public Iterable<FlowEntry> getFlowEntries(DeviceId deviceId) {
+ checkPermission(Permission.FLOWRULE_READ);
+
return store.getFlowEntries(deviceId);
}
@Override
public void applyFlowRules(FlowRule... flowRules) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
for (int i = 0; i < flowRules.length; i++) {
builder.add(flowRules[i]);
@@ -186,6 +195,8 @@
@Override
public void removeFlowRules(FlowRule... flowRules) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
for (int i = 0; i < flowRules.length; i++) {
builder.remove(flowRules[i]);
@@ -195,11 +206,15 @@
@Override
public void removeFlowRulesById(ApplicationId id) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
removeFlowRules(Iterables.toArray(getFlowRulesById(id), FlowRule.class));
}
@Override
public Iterable<FlowRule> getFlowRulesById(ApplicationId id) {
+ checkPermission(Permission.FLOWRULE_READ);
+
Set<FlowRule> flowEntries = Sets.newHashSet();
for (Device d : deviceService.getDevices()) {
for (FlowEntry flowEntry : store.getFlowEntries(d.id())) {
@@ -213,6 +228,8 @@
@Override
public Iterable<FlowRule> getFlowRulesByGroupId(ApplicationId appId, short groupId) {
+ checkPermission(Permission.FLOWRULE_READ);
+
Set<FlowRule> matches = Sets.newHashSet();
long toLookUp = ((long) appId.id() << 16) | groupId;
for (Device d : deviceService.getDevices()) {
@@ -227,16 +244,22 @@
@Override
public void apply(FlowRuleOperations ops) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
operationsService.submit(new FlowOperationsProcessor(ops));
}
@Override
public void addListener(FlowRuleListener listener) {
+ checkPermission(Permission.FLOWRULE_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(FlowRuleListener listener) {
+ checkPermission(Permission.FLOWRULE_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
index f84c24f..4c64784 100644
--- a/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
+++ b/core/net/src/main/java/org/onosproject/net/flowobjective/impl/FlowObjectiveManager.java
@@ -27,6 +27,7 @@
import org.onlab.osgi.ServiceDirectory;
import org.onlab.util.ItemNotFoundException;
import org.onosproject.cluster.ClusterService;
+import org.onosproject.core.Permission;
import org.onosproject.mastership.MastershipEvent;
import org.onosproject.mastership.MastershipListener;
import org.onosproject.mastership.MastershipService;
@@ -59,6 +60,8 @@
import static java.util.concurrent.Executors.newFixedThreadPool;
import static org.onlab.util.Tools.groupedThreads;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides implementation of the flow objective programming service.
@@ -212,11 +215,15 @@
@Override
public void filter(DeviceId deviceId, FilteringObjective filteringObjective) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
executorService.submit(new ObjectiveInstaller(deviceId, filteringObjective));
}
@Override
public void forward(DeviceId deviceId, ForwardingObjective forwardingObjective) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
if (queueObjective(deviceId, forwardingObjective)) {
return;
}
@@ -225,11 +232,15 @@
@Override
public void next(DeviceId deviceId, NextObjective nextObjective) {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
executorService.submit(new ObjectiveInstaller(deviceId, nextObjective));
}
@Override
public int allocateNextId() {
+ checkPermission(Permission.FLOWRULE_WRITE);
+
return flowObjectiveStore.allocateNextId();
}
diff --git a/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java b/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
index b54e468..352059a 100644
--- a/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
+++ b/core/net/src/main/java/org/onosproject/net/group/impl/GroupManager.java
@@ -27,6 +27,7 @@
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
import org.onosproject.core.ApplicationId;
+import org.onosproject.core.Permission;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.net.DeviceId;
@@ -52,6 +53,9 @@
import org.onosproject.net.provider.AbstractProviderService;
import org.slf4j.Logger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
+
/**
* Provides implementation of the group service APIs.
*/
@@ -100,6 +104,8 @@
*/
@Override
public void addGroup(GroupDescription groupDesc) {
+ checkPermission(Permission.GROUP_WRITE);
+
log.trace("In addGroup API");
store.storeGroupDescription(groupDesc);
}
@@ -119,6 +125,8 @@
*/
@Override
public Group getGroup(DeviceId deviceId, GroupKey appCookie) {
+ checkPermission(Permission.GROUP_READ);
+
log.trace("In getGroup API");
return store.getGroup(deviceId, appCookie);
}
@@ -141,6 +149,8 @@
GroupBuckets buckets,
GroupKey newCookie,
ApplicationId appId) {
+ checkPermission(Permission.GROUP_WRITE);
+
log.trace("In addBucketsToGroup API");
store.updateGroupDescription(deviceId,
oldCookie,
@@ -167,6 +177,8 @@
GroupBuckets buckets,
GroupKey newCookie,
ApplicationId appId) {
+ checkPermission(Permission.GROUP_WRITE);
+
log.trace("In removeBucketsFromGroup API");
store.updateGroupDescription(deviceId,
oldCookie,
@@ -189,6 +201,8 @@
public void removeGroup(DeviceId deviceId,
GroupKey appCookie,
ApplicationId appId) {
+ checkPermission(Permission.GROUP_WRITE);
+
log.trace("In removeGroup API");
store.deleteGroupDescription(deviceId, appCookie);
}
@@ -204,12 +218,16 @@
@Override
public Iterable<Group> getGroups(DeviceId deviceId,
ApplicationId appId) {
+ checkPermission(Permission.GROUP_READ);
+
log.trace("In getGroups API");
return store.getGroups(deviceId);
}
@Override
public Iterable<Group> getGroups(DeviceId deviceId) {
+ checkPermission(Permission.GROUP_READ);
+
log.trace("In getGroups API");
return store.getGroups(deviceId);
}
@@ -221,6 +239,8 @@
*/
@Override
public void addListener(GroupListener listener) {
+ checkPermission(Permission.GROUP_EVENT);
+
log.trace("In addListener API");
listenerRegistry.addListener(listener);
}
@@ -232,6 +252,8 @@
*/
@Override
public void removeListener(GroupListener listener) {
+ checkPermission(Permission.GROUP_EVENT);
+
log.trace("In removeListener API");
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java b/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
index 0504442..3335f5a 100644
--- a/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
+++ b/core/net/src/main/java/org/onosproject/net/host/impl/HostManager.java
@@ -24,6 +24,7 @@
import org.onlab.packet.IpAddress;
import org.onlab.packet.MacAddress;
import org.onlab.packet.VlanId;
+import org.onosproject.core.Permission;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.net.ConnectPoint;
@@ -51,6 +52,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides basic implementation of the host SB & NB APIs.
@@ -109,56 +112,76 @@
@Override
public int getHostCount() {
+ checkPermission(Permission.HOST_READ);
+
return store.getHostCount();
}
@Override
public Iterable<Host> getHosts() {
+ checkPermission(Permission.HOST_READ);
+
return store.getHosts();
}
@Override
public Host getHost(HostId hostId) {
+ checkPermission(Permission.HOST_READ);
+
checkNotNull(hostId, HOST_ID_NULL);
return store.getHost(hostId);
}
@Override
public Set<Host> getHostsByVlan(VlanId vlanId) {
+ checkPermission(Permission.HOST_READ);
+
return store.getHosts(vlanId);
}
@Override
public Set<Host> getHostsByMac(MacAddress mac) {
+ checkPermission(Permission.HOST_READ);
+
checkNotNull(mac, "MAC address cannot be null");
return store.getHosts(mac);
}
@Override
public Set<Host> getHostsByIp(IpAddress ip) {
+ checkPermission(Permission.HOST_READ);
+
checkNotNull(ip, "IP address cannot be null");
return store.getHosts(ip);
}
@Override
public Set<Host> getConnectedHosts(ConnectPoint connectPoint) {
+ checkPermission(Permission.HOST_READ);
+
checkNotNull(connectPoint, "Connection point cannot be null");
return store.getConnectedHosts(connectPoint);
}
@Override
public Set<Host> getConnectedHosts(DeviceId deviceId) {
+ checkPermission(Permission.HOST_READ);
+
checkNotNull(deviceId, "Device ID cannot be null");
return store.getConnectedHosts(deviceId);
}
@Override
public void startMonitoringIp(IpAddress ip) {
+ checkPermission(Permission.HOST_EVENT);
+
monitor.addMonitoringFor(ip);
}
@Override
public void stopMonitoringIp(IpAddress ip) {
+ checkPermission(Permission.HOST_EVENT);
+
monitor.stopMonitoring(ip);
}
@@ -169,11 +192,15 @@
@Override
public void addListener(HostListener listener) {
+ checkPermission(Permission.HOST_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(HostListener listener) {
+ checkPermission(Permission.HOST_EVENT);
+
listenerRegistry.removeListener(listener);
}
@@ -203,11 +230,15 @@
@Override
public Set<PortAddresses> getAddressBindings() {
+ checkPermission(Permission.HOST_READ);
+
return store.getAddressBindings();
}
@Override
public Set<PortAddresses> getAddressBindingsForPort(ConnectPoint connectPoint) {
+ checkPermission(Permission.HOST_READ);
+
return store.getAddressBindingsForPort(connectPoint);
}
diff --git a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
index 10a01ec..62174e0 100644
--- a/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
+++ b/core/net/src/main/java/org/onosproject/net/intent/impl/IntentManager.java
@@ -24,6 +24,7 @@
import org.apache.felix.scr.annotations.Service;
import org.onosproject.core.CoreService;
import org.onosproject.core.IdGenerator;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.net.flow.FlowRule;
@@ -65,6 +66,8 @@
import static org.onosproject.net.intent.IntentState.*;
import static org.onosproject.net.intent.impl.phase.IntentProcessPhase.newInitialPhase;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* An implementation of Intent Manager.
@@ -139,6 +142,8 @@
@Override
public void submit(Intent intent) {
+ checkPermission(Permission.INTENT_WRITE);
+
checkNotNull(intent, INTENT_NULL);
IntentData data = new IntentData(intent, IntentState.INSTALL_REQ, null);
store.addPending(data);
@@ -146,6 +151,8 @@
@Override
public void withdraw(Intent intent) {
+ checkPermission(Permission.INTENT_WRITE);
+
checkNotNull(intent, INTENT_NULL);
IntentData data = new IntentData(intent, IntentState.WITHDRAW_REQ, null);
store.addPending(data);
@@ -153,6 +160,8 @@
@Override
public void purge(Intent intent) {
+ checkPermission(Permission.INTENT_WRITE);
+
checkNotNull(intent, INTENT_NULL);
IntentData data = new IntentData(intent, IntentState.PURGE_REQ, null);
store.addPending(data);
@@ -160,43 +169,59 @@
@Override
public Intent getIntent(Key key) {
+ checkPermission(Permission.INTENT_READ);
+
return store.getIntent(key);
}
@Override
public Iterable<Intent> getIntents() {
+ checkPermission(Permission.INTENT_READ);
+
return store.getIntents();
}
@Override
public long getIntentCount() {
+ checkPermission(Permission.INTENT_READ);
+
return store.getIntentCount();
}
@Override
public IntentState getIntentState(Key intentKey) {
+ checkPermission(Permission.INTENT_READ);
+
checkNotNull(intentKey, INTENT_ID_NULL);
return store.getIntentState(intentKey);
}
@Override
public List<Intent> getInstallableIntents(Key intentKey) {
+ checkPermission(Permission.INTENT_READ);
+
checkNotNull(intentKey, INTENT_ID_NULL);
return store.getInstallableIntents(intentKey);
}
@Override
public boolean isLocal(Key intentKey) {
+ checkPermission(Permission.INTENT_READ);
+
return store.isMaster(intentKey);
}
@Override
public void addListener(IntentListener listener) {
+ checkPermission(Permission.INTENT_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(IntentListener listener) {
+ checkPermission(Permission.INTENT_EVENT);
+
listenerRegistry.removeListener(listener);
}
@@ -217,6 +242,8 @@
@Override
public Iterable<Intent> getPending() {
+ checkPermission(Permission.INTENT_READ);
+
return store.getPending();
}
diff --git a/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java b/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
index 75aeb1e..75134f3 100644
--- a/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
+++ b/core/net/src/main/java/org/onosproject/net/link/impl/LinkManager.java
@@ -24,6 +24,7 @@
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
+import org.onosproject.core.Permission;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.net.ConnectPoint;
@@ -52,6 +53,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides basic implementation of the link SB & NB APIs.
@@ -102,16 +105,22 @@
@Override
public int getLinkCount() {
+ checkPermission(Permission.LINK_READ);
+
return store.getLinkCount();
}
@Override
public Iterable<Link> getLinks() {
+ checkPermission(Permission.LINK_READ);
+
return store.getLinks();
}
@Override
public Iterable<Link> getActiveLinks() {
+ checkPermission(Permission.LINK_READ);
+
return FluentIterable.from(getLinks())
.filter(new Predicate<Link>() {
@@ -124,6 +133,8 @@
@Override
public Set<Link> getDeviceLinks(DeviceId deviceId) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return Sets.union(store.getDeviceEgressLinks(deviceId),
store.getDeviceIngressLinks(deviceId));
@@ -131,18 +142,24 @@
@Override
public Set<Link> getDeviceEgressLinks(DeviceId deviceId) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getDeviceEgressLinks(deviceId);
}
@Override
public Set<Link> getDeviceIngressLinks(DeviceId deviceId) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(deviceId, DEVICE_ID_NULL);
return store.getDeviceIngressLinks(deviceId);
}
@Override
public Set<Link> getLinks(ConnectPoint connectPoint) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(connectPoint, CONNECT_POINT_NULL);
return Sets.union(store.getEgressLinks(connectPoint),
store.getIngressLinks(connectPoint));
@@ -150,18 +167,24 @@
@Override
public Set<Link> getEgressLinks(ConnectPoint connectPoint) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(connectPoint, CONNECT_POINT_NULL);
return store.getEgressLinks(connectPoint);
}
@Override
public Set<Link> getIngressLinks(ConnectPoint connectPoint) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(connectPoint, CONNECT_POINT_NULL);
return store.getIngressLinks(connectPoint);
}
@Override
public Link getLink(ConnectPoint src, ConnectPoint dst) {
+ checkPermission(Permission.LINK_READ);
+
checkNotNull(src, CONNECT_POINT_NULL);
checkNotNull(dst, CONNECT_POINT_NULL);
return store.getLink(src, dst);
@@ -185,11 +208,15 @@
@Override
public void addListener(LinkListener listener) {
+ checkPermission(Permission.LINK_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(LinkListener listener) {
+ checkPermission(Permission.LINK_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
index 27763f9..26c4102 100644
--- a/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
+++ b/core/net/src/main/java/org/onosproject/net/packet/impl/PacketManager.java
@@ -23,6 +23,7 @@
import org.apache.felix.scr.annotations.Service;
import org.onosproject.core.ApplicationId;
import org.onosproject.core.CoreService;
+import org.onosproject.core.Permission;
import org.onosproject.net.Device;
import org.onosproject.net.device.DeviceEvent;
import org.onosproject.net.device.DeviceListener;
@@ -60,6 +61,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides a basic implementation of the packet SB & NB APIs.
@@ -113,12 +116,16 @@
@Override
public void addProcessor(PacketProcessor processor, int priority) {
+ checkPermission(Permission.PACKET_EVENT);
+
checkNotNull(processor, "Processor cannot be null");
processors.put(priority, processor);
}
@Override
public void removeProcessor(PacketProcessor processor) {
+ checkPermission(Permission.PACKET_EVENT);
+
checkNotNull(processor, "Processor cannot be null");
processors.values().remove(processor);
}
@@ -126,6 +133,8 @@
@Override
public void requestPackets(TrafficSelector selector, PacketPriority priority,
ApplicationId appId) {
+ checkPermission(Permission.PACKET_READ);
+
checkNotNull(selector, "Selector cannot be null");
checkNotNull(appId, "Application ID cannot be null");
@@ -140,6 +149,8 @@
@Override
public void requestPackets(TrafficSelector selector, PacketPriority priority,
ApplicationId appId, FlowRule.Type tableType) {
+ checkPermission(Permission.PACKET_READ);
+
checkNotNull(selector, "Selector cannot be null");
checkNotNull(appId, "Application ID cannot be null");
checkNotNull(tableType, "Table Type cannot be null. For requesting packets +"
@@ -205,6 +216,8 @@
@Override
public void emit(OutboundPacket packet) {
+ checkPermission(Permission.PACKET_WRITE);
+
checkNotNull(packet, "Packet cannot be null");
store.emit(packet);
diff --git a/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java b/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
index 4ae3872..6411a4d 100644
--- a/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
+++ b/core/net/src/main/java/org/onosproject/net/proxyarp/impl/ProxyArpManager.java
@@ -36,6 +36,7 @@
import org.onlab.packet.ndp.NeighborAdvertisement;
import org.onlab.packet.ndp.NeighborDiscoveryOptions;
import org.onlab.packet.ndp.NeighborSolicitation;
+import org.onosproject.core.Permission;
import org.onosproject.net.ConnectPoint;
import org.onosproject.net.Device;
import org.onosproject.net.Host;
@@ -70,6 +71,8 @@
import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
@Component(immediate = true)
@Service
@@ -123,6 +126,8 @@
@Override
public boolean isKnown(IpAddress addr) {
+ checkPermission(Permission.PACKET_READ);
+
checkNotNull(addr, MAC_ADDR_NULL);
Set<Host> hosts = hostService.getHostsByIp(addr);
return !hosts.isEmpty();
@@ -130,6 +135,8 @@
@Override
public void reply(Ethernet eth, ConnectPoint inPort) {
+ checkPermission(Permission.PACKET_WRITE);
+
checkNotNull(eth, REQUEST_NULL);
if (eth.getEtherType() == Ethernet.TYPE_ARP) {
@@ -353,6 +360,8 @@
@Override
public void forward(Ethernet eth, ConnectPoint inPort) {
+ checkPermission(Permission.PACKET_WRITE);
+
checkNotNull(eth, REQUEST_NULL);
Host h = hostService.getHost(HostId.hostId(eth.getDestinationMAC(),
@@ -371,6 +380,8 @@
@Override
public boolean handlePacket(PacketContext context) {
+ checkPermission(Permission.PACKET_WRITE);
+
InboundPacket pkt = context.inPacket();
Ethernet ethPkt = pkt.parsed();
diff --git a/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java b/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
index 6b02edd..209e62c 100644
--- a/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
+++ b/core/net/src/main/java/org/onosproject/net/resource/impl/LinkResourceManager.java
@@ -21,6 +21,7 @@
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.EventDeliveryService;
import org.onosproject.net.Link;
@@ -56,6 +57,8 @@
import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides basic implementation of link resources allocation.
@@ -150,6 +153,8 @@
@Override
public LinkResourceAllocations requestResources(LinkResourceRequest req) {
+ checkPermission(Permission.LINK_WRITE);
+
// TODO Concatenate multiple bandwidth requests.
// TODO Support multiple lambda resource requests.
// TODO Throw appropriate exception.
@@ -211,6 +216,8 @@
@Override
public void releaseResources(LinkResourceAllocations allocations) {
+ checkPermission(Permission.LINK_WRITE);
+
final LinkResourceEvent event = store.releaseResources(allocations);
if (event != null) {
post(event);
@@ -220,27 +227,37 @@
@Override
public LinkResourceAllocations updateResources(LinkResourceRequest req,
LinkResourceAllocations oldAllocations) {
- releaseResources(oldAllocations);
+ checkPermission(Permission.LINK_WRITE);
+
+ releaseResources(oldAllocations);
return requestResources(req);
}
@Override
public Iterable<LinkResourceAllocations> getAllocations() {
+ checkPermission(Permission.LINK_READ);
+
return store.getAllocations();
}
@Override
public Iterable<LinkResourceAllocations> getAllocations(Link link) {
+ checkPermission(Permission.LINK_READ);
+
return store.getAllocations(link);
}
@Override
public LinkResourceAllocations getAllocations(IntentId intentId) {
+ checkPermission(Permission.LINK_READ);
+
return store.getAllocations(intentId);
}
@Override
public Iterable<ResourceRequest> getAvailableResources(Link link) {
+ checkPermission(Permission.LINK_READ);
+
Set<ResourceAllocation> freeRes = store.getFreeResources(link);
Set<ResourceRequest> result = new HashSet<>();
for (ResourceAllocation alloc : freeRes) {
@@ -265,6 +282,8 @@
@Override
public Iterable<ResourceRequest> getAvailableResources(Link link,
LinkResourceAllocations allocations) {
+ checkPermission(Permission.LINK_READ);
+
Set<ResourceRequest> result = new HashSet<>();
Set<ResourceAllocation> allocatedRes = allocations.getResourceAllocation(link);
result = (Set<ResourceRequest>) getAvailableResources(link);
@@ -274,11 +293,15 @@
@Override
public void addListener(LinkResourceListener listener) {
+ checkPermission(Permission.LINK_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(LinkResourceListener listener) {
+ checkPermission(Permission.LINK_EVENT);
+
listenerRegistry.removeListener(listener);
}
diff --git a/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java b/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
index 8d4f004..a07f196 100644
--- a/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
+++ b/core/net/src/main/java/org/onosproject/net/statistic/impl/StatisticManager.java
@@ -27,6 +27,7 @@
import org.apache.felix.scr.annotations.Service;
import org.onosproject.core.ApplicationId;
import org.onosproject.core.GroupId;
+import org.onosproject.core.Permission;
import org.onosproject.net.ConnectPoint;
import org.onosproject.net.Link;
import org.onosproject.net.Path;
@@ -49,6 +50,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides an implementation of the Statistic Service.
@@ -83,11 +86,15 @@
@Override
public Load load(Link link) {
- return load(link.src());
+ checkPermission(Permission.STATISTIC_READ);
+
+ return load(link.src());
}
@Override
public Load load(Link link, ApplicationId appId, Optional<GroupId> groupId) {
+ checkPermission(Permission.STATISTIC_READ);
+
Statistics stats = getStatistics(link.src());
if (!stats.isValid()) {
return new DefaultLoad();
@@ -107,11 +114,15 @@
@Override
public Load load(ConnectPoint connectPoint) {
+ checkPermission(Permission.STATISTIC_READ);
+
return loadInternal(connectPoint);
}
@Override
public Link max(Path path) {
+ checkPermission(Permission.STATISTIC_READ);
+
if (path.links().isEmpty()) {
return null;
}
@@ -129,6 +140,8 @@
@Override
public Link min(Path path) {
+ checkPermission(Permission.STATISTIC_READ);
+
if (path.links().isEmpty()) {
return null;
}
@@ -146,6 +159,8 @@
@Override
public FlowRule highestHitter(ConnectPoint connectPoint) {
+ checkPermission(Permission.STATISTIC_READ);
+
Set<FlowEntry> hitters = statisticStore.getCurrentStatistic(connectPoint);
if (hitters.isEmpty()) {
return null;
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
index 749a722..0852447 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/PathManager.java
@@ -24,6 +24,7 @@
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
+import org.onosproject.core.Permission;
import org.onosproject.net.ConnectPoint;
import org.onosproject.net.DefaultEdgeLink;
import org.onosproject.net.DefaultPath;
@@ -49,6 +50,8 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
+
/**
* Provides implementation of a path selection service atop the current
@@ -85,11 +88,15 @@
@Override
public Set<Path> getPaths(ElementId src, ElementId dst) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
return getPaths(src, dst, null);
}
@Override
public Set<Path> getPaths(ElementId src, ElementId dst, LinkWeight weight) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(src, ELEMENT_ID_NULL);
checkNotNull(dst, ELEMENT_ID_NULL);
diff --git a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
index 956d7a6..718d75d 100644
--- a/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
+++ b/core/net/src/main/java/org/onosproject/net/topology/impl/TopologyManager.java
@@ -21,6 +21,7 @@
import org.apache.felix.scr.annotations.Reference;
import org.apache.felix.scr.annotations.ReferenceCardinality;
import org.apache.felix.scr.annotations.Service;
+import org.onosproject.core.Permission;
import org.onosproject.event.ListenerRegistry;
import org.onosproject.event.Event;
import org.onosproject.event.EventDeliveryService;
@@ -51,6 +52,7 @@
import static com.google.common.base.Preconditions.checkNotNull;
import static org.slf4j.LoggerFactory.getLogger;
+import static org.onosproject.security.AppGuard.checkPermission;
/**
* Provides basic implementation of the topology SB & NB APIs.
@@ -97,23 +99,31 @@
@Override
public Topology currentTopology() {
+ checkPermission(Permission.TOPOLOGY_READ);
+
return store.currentTopology();
}
@Override
public boolean isLatest(Topology topology) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
return store.isLatest(topology);
}
@Override
public Set<TopologyCluster> getClusters(Topology topology) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
return store.getClusters(topology);
}
@Override
public TopologyCluster getCluster(Topology topology, ClusterId clusterId) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(topology, CLUSTER_ID_NULL);
return store.getCluster(topology, clusterId);
@@ -121,6 +131,8 @@
@Override
public Set<DeviceId> getClusterDevices(Topology topology, TopologyCluster cluster) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(topology, CLUSTER_NULL);
return store.getClusterDevices(topology, cluster);
@@ -128,6 +140,8 @@
@Override
public Set<Link> getClusterLinks(Topology topology, TopologyCluster cluster) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(topology, CLUSTER_NULL);
return store.getClusterLinks(topology, cluster);
@@ -135,12 +149,16 @@
@Override
public TopologyGraph getGraph(Topology topology) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
return store.getGraph(topology);
}
@Override
public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL);
@@ -149,6 +167,8 @@
@Override
public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst, LinkWeight weight) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(src, DEVICE_ID_NULL);
checkNotNull(dst, DEVICE_ID_NULL);
@@ -158,6 +178,8 @@
@Override
public boolean isInfrastructure(Topology topology, ConnectPoint connectPoint) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(connectPoint, CONNECTION_POINT_NULL);
return store.isInfrastructure(topology, connectPoint);
@@ -165,6 +187,8 @@
@Override
public boolean isBroadcastPoint(Topology topology, ConnectPoint connectPoint) {
+ checkPermission(Permission.TOPOLOGY_READ);
+
checkNotNull(topology, TOPOLOGY_NULL);
checkNotNull(connectPoint, CONNECTION_POINT_NULL);
return store.isBroadcastPoint(topology, connectPoint);
@@ -172,11 +196,15 @@
@Override
public void addListener(TopologyListener listener) {
+ checkPermission(Permission.TOPOLOGY_EVENT);
+
listenerRegistry.addListener(listener);
}
@Override
public void removeListener(TopologyListener listener) {
+ checkPermission(Permission.TOPOLOGY_EVENT);
+
listenerRegistry.removeListener(listener);
}