Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
languagejava
firstline144
titleclients/src/main/java/org/apache/kafka/server/authorizer/Authorizer.java
linenumberstrue
    /**
     * Check if the caller is authorized to perform the given ACL operation on at least one
     * resource of the given type.
     *
     * @param requestContext Request context including request resourceType, security protocol, and listener name
     * @param op             The ACL operation to check
     * @param resourceType   The resource type
     * @return               Return {@link AuthorizationResult#ALLOWED} if the caller is authorized to perform the
     *                       given ACL operation on at least one resource of the given type. 
     *                       Return {@link AuthorizationResult#DENIED} otherwise.
     */
    default AuthorizationResult authorizeAny(AuthorizableRequestContext requestContext, AclOperation op, ResourceType resourceType) {
        ResourcePatternFilter resourceFilter = new ResourcePatternFilterif (resourceType, null,== PatternTypeResourceType.ANY); {
        AclBindingFilter   aclFilter =throw new AclBindingFilterIllegalArgumentException(
            resourceFilter,   new AccessControlEntryFilter(
"Must specify a non-filter resource type for authorizeAny");
         requestContext.principal().toString(),}

        if (resourceType == ResourceType.UNKNOWN) {
            throw new IllegalArgumentException(
  requestContext.clientAddress().getHostAddress(),
              "Unknown  op,resource type");
        }

         AclPermissionType.ANY));

if (op == AclOperation.ANY) {
            throw new IllegalArgumentException(
                "Must specify a non-filter operation type for authorizeAny");
        }

        if (op == AclOperation.UNKNOWN) {
            throw new IllegalArgumentException(
                "Unknown operation type");
        }

        ResourcePatternFilter resourceTypeFilter = new ResourcePatternFilter(
            resourceType, null, PatternType.ANY);
        AclBindingFilter aclFilter = new AclBindingFilter(
            resourceTypeFilter, AccessControlEntryFilter.ANY);

        Set<String> denyPrefixes = new HashSet<>();
        Set<String> allowPrefixes = new HashSet<>();
        boolean hasWildCardAllow = false;

        for (AclBinding binding : acls(aclFilter)) {
            if (!binding.entry().host().equals(requestContext.clientAddress().getHostAddress())
                    && !binding.entry().host().equals("*"))
                continue;

            if (!binding.entry().principal().equals(requestContext.principal().toString())
                    && !binding.entry().principal().equals("User:*"))
            Set<String> denyPrefixes = new HashSet<>()continue;

        Set<String>  allowPrefixes = new HashSet<>();

    if (binding.entry().operation() != op
    for (AclBinding binding : acls(aclFilter)) {
            if&& (binding.entry().permissionTypeoperation() != AclPermissionTypeAclOperation.ALLOWALL) {

                continue;

            if (binding.entry().permissionType() == AclPermissionType.DENY) {
                    switch (binding.pattern().patternType()) {
                        case LITERAL:
                            if (binding.pattern().name().equals(ResourcePattern.WILDCARD_RESOURCE))

                            return AuthorizationResult.DENIED;
                         return AuthorizationResult.DENIED;
 if (binding.pattern().resourceType() == ResourceType.CLUSTER &&
                           if (binding.pattern().name().resourceType() == ResourceType.CLUSTER &&
equals(Resource.CLUSTER_NAME))
                            return AuthorizationResult.DENIED;
         binding.pattern().name().equals(Resource.CLUSTER_NAME))
               break;
                 return AuthorizationResult.DENIED;
  case PREFIXED:
                         break;if (binding.pattern().name().isEmpty())
                        case PREFIXED:
   return AuthorizationResult.DENIED;
                        if denyPrefixes.add(binding.pattern().name().isEmpty());
                                return AuthorizationResult.DENIEDbreak;
                   }
         denyPrefixes.add(binding.pattern().name());
          continue;
            }

      break;
      if (binding.entry().permissionType() != AclPermissionType.ALLOW)
            }
    continue;

            }
  switch (binding.pattern().patternType()) {
              continue;
  case  LITERAL:
        }

            switchif (binding.pattern().patternTypename().equals(ResourcePattern.WILDCARD_RESOURCE)) {
                case   LITERAL:
     hasWildCardAllow = true;
             if (binding.pattern().name() == ResourcePattern.WILDCARD_RESOURCE)
           continue;
                  return AuthorizationResult.ALLOWED;  }
                    List<Action> action = Collections.singletonList(new Action(
                        op, binding.pattern(), 1, false, false));
                    if (authorize(requestContext, action).get(0) == AuthorizationResult.ALLOWED) {
                        return AuthorizationResult.ALLOWED;
                    }
                    break;
                case PREFIXED:
                    allowPrefixes.add(binding.pattern().name());
                    break;
            }
        }

        if (hasWildCardAllow) {
            return AuthorizationResult.ALLOWED;
        }

        for (String allowed : allowPrefixes) {
            StringBuilder sb = new StringBuilder();
            boolean hasDominatedDeny = false;
            for (int pos = 0; pos < allowed.length(); pos++) {
                sb.append(allowed.charAt(pos));
                if (denyPrefixes.contains(sb.toString())) {
                    hasDominatedDeny = true;
                    break;
                }
            }
            if (!hasDominatedDeny)
                return AuthorizationResult.ALLOWED;
        }
        return AuthorizationResult.DENIED;
    }

    }

Proposed Changes

AclAuthorizer and SimpleAclAuthorizer

...