forked from apache/doris
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[feature](merge-cloud) Add
SecurityChecker for cloud
- Loading branch information
1 parent
2882115
commit d1eae52
Showing
11 changed files
with
248 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
fe/fe-common/src/main/java/org/apache/doris/cloud/security/AliSecurityChecker.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| // Licensed to the Apache Software Foundation (ASF) under one | ||
| // or more contributor license agreements. See the NOTICE file | ||
| // distributed with this work for additional information | ||
| // regarding copyright ownership. The ASF licenses this file | ||
| // to you under the Apache License, Version 2.0 (the | ||
| // "License"); you may not use this file except in compliance | ||
| // with the License. You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, | ||
| // software distributed under the License is distributed on an | ||
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| // KIND, either express or implied. See the License for the | ||
| // specific language governing permissions and limitations | ||
| // under the License. | ||
|
|
||
| package org.apache.doris.cloud.security; | ||
|
|
||
| import org.apache.doris.thrift.TNetworkAddress; | ||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
|
|
||
| import java.lang.reflect.Method; | ||
| import java.net.InetAddress; | ||
|
|
||
| public class AliSecurityChecker extends SecurityChecker { | ||
| private static final Logger LOG = LogManager.getLogger(AliSecurityChecker.class); | ||
|
|
||
| private static Method jdbcUrlCheckMethod = null; | ||
| private static Method urlSecurityCheckMethod = null; | ||
| private static Method urlSecurityStopCheckMethod = null; | ||
|
|
||
| static { | ||
| try { | ||
| Class clazz = Class.forName("com.aliyun.securitysdk.SecurityUtil"); | ||
| jdbcUrlCheckMethod = clazz.getMethod("filterJdbcConnectionSource", String.class); | ||
| urlSecurityCheckMethod = clazz.getMethod("startSSRFNetHookChecking", String.class); | ||
| urlSecurityStopCheckMethod = clazz.getMethod("stopSSRFNetHookChecking", String.class); | ||
| } catch (Exception e) { | ||
| LOG.warn("exception:", e); | ||
| e.printStackTrace(); | ||
| System.out.println("Failed to find com.aliyun.securitysdk.SecurityUtil's method"); | ||
| } | ||
| } | ||
|
|
||
| protected AliSecurityChecker() {} | ||
|
|
||
| @Override | ||
| public String getSafeJdbcUrl(String originJdbcUrl) throws Exception { | ||
| if (jdbcUrlCheckMethod != null) { | ||
| return (String) (jdbcUrlCheckMethod.invoke(null, originJdbcUrl)); | ||
| } | ||
| throw new Exception("SecurityUtil.filterJdbcConnectionSource not found"); | ||
| } | ||
|
|
||
| @Override | ||
| public void startSSRFChecking(String originUri) throws Exception { | ||
| if (urlSecurityCheckMethod != null) { | ||
| urlSecurityCheckMethod.invoke(null, originUri); | ||
| return; | ||
| } | ||
| throw new Exception("SecurityUtil.startSSRFNetHookChecking not found"); | ||
| } | ||
|
|
||
| @Override | ||
| public void stopSSRFChecking() { | ||
| if (urlSecurityStopCheckMethod != null) { | ||
| try { | ||
| urlSecurityStopCheckMethod.invoke(null); | ||
| } catch (Exception e) { | ||
| LOG.warn("failed to stop SSRF checking, log and ignore.", e); | ||
| } | ||
| return; | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void checkHost(String host) throws Exception { | ||
| return; | ||
| } | ||
| } |
42 changes: 42 additions & 0 deletions
42
fe/fe-common/src/main/java/org/apache/doris/cloud/security/DummySecurityChecker.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| // Licensed to the Apache Software Foundation (ASF) under one | ||
| // or more contributor license agreements. See the NOTICE file | ||
| // distributed with this work for additional information | ||
| // regarding copyright ownership. The ASF licenses this file | ||
| // to you under the Apache License, Version 2.0 (the | ||
| // "License"); you may not use this file except in compliance | ||
| // with the License. You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, | ||
| // software distributed under the License is distributed on an | ||
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| // KIND, either express or implied. See the License for the | ||
| // specific language governing permissions and limitations | ||
| // under the License. | ||
|
|
||
| package org.apache.doris.cloud.security; | ||
|
|
||
| public class DummySecurityChecker extends SecurityChecker { | ||
| protected DummySecurityChecker() {} | ||
|
|
||
| @Override | ||
| public String getSafeJdbcUrl(String originJdbcUrl) throws Exception { | ||
| return originJdbcUrl; | ||
| } | ||
|
|
||
| @Override | ||
| public void startSSRFChecking(String originUri) throws Exception { | ||
| return; | ||
| } | ||
|
|
||
| @Override | ||
| public void stopSSRFChecking() { | ||
| return; | ||
| } | ||
|
|
||
| @Override | ||
| public void checkHost() throws Exception { | ||
| return; | ||
| } | ||
| } |
56 changes: 56 additions & 0 deletions
56
fe/fe-common/src/main/java/org/apache/doris/cloud/security/SecurityChecker.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| // Licensed to the Apache Software Foundation (ASF) under one | ||
| // or more contributor license agreements. See the NOTICE file | ||
| // distributed with this work for additional information | ||
| // regarding copyright ownership. The ASF licenses this file | ||
| // to you under the Apache License, Version 2.0 (the | ||
| // "License"); you may not use this file except in compliance | ||
| // with the License. You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, | ||
| // software distributed under the License is distributed on an | ||
| // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| // KIND, either express or implied. See the License for the | ||
| // specific language governing permissions and limitations | ||
| // under the License. | ||
|
|
||
| package org.apache.doris.cloud.security; | ||
|
|
||
| import org.apache.doris.common.Config; | ||
|
|
||
| /** | ||
| * SecurityChecker is used to check if the url is safe | ||
| */ | ||
| public abstract class SecurityChecker { | ||
| private static class SingletonHolder { | ||
| private static final SecurityChecker INSTANCE = Config.apsaradb_env_enabled | ||
| ? new AliSecurityChecker() : new DummySecurityChecker(); | ||
| } | ||
|
|
||
| protected SecurityChecker() {} | ||
|
|
||
| public static SecurityChecker getInstance() { | ||
| return SingletonHolder.INSTANCE; | ||
| } | ||
|
|
||
| /** | ||
| * Check and return safe jdbc url, avoid sql injection or other security issues | ||
| * @param originJdbcUrl | ||
| * @return | ||
| * @throws Exception | ||
| */ | ||
| public abstract String getSafeJdbcUrl(String originJdbcUrl) throws Exception; | ||
|
|
||
| /** | ||
| * Check if the uri is safe, avoid SSRF attack | ||
| * Only handle http:// https:// | ||
| * @param originUri | ||
| * @throws Exception | ||
| */ | ||
| public abstract void startSSRFChecking(String originUri) throws Exception; | ||
|
|
||
| public abstract void stopSSRFChecking(); | ||
|
|
||
| public abstract void checkHost(String host) throws Exception; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.