diff --git a/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java b/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java index 965da1fa93b2f..da5fb38349cdb 100644 --- a/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java +++ b/modules/core/src/main/java/org/apache/ignite/IgniteSystemProperties.java @@ -989,10 +989,13 @@ public final class IgniteSystemProperties extends IgniteCommonsSystemProperties *

* Default is {@code false}, which means that service security permissions will be respected. *

+ * + * @deprecated Has no usage. */ @SystemProperty("Enables Ignite to switch to compatibility mode with versions that " + "don't support service security permissions. In this case security permissions will be ignored (if they set)." + " Default is false, which means that service security permissions will be respected") + @Deprecated public static final String IGNITE_SECURITY_COMPATIBILITY_MODE = "IGNITE_SECURITY_COMPATIBILITY_MODE"; /** Ignite cluster name. Defaults to {@link IgniteCluster#id()}. */ diff --git a/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java b/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java index 5c09f3660f2e0..74af20d016cc6 100644 --- a/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java +++ b/modules/core/src/main/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManager.java @@ -151,7 +151,6 @@ import static org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2; import static org.apache.ignite.IgniteSystemProperties.IGNITE_DISCOVERY_HISTORY_SIZE; import static org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID; -import static org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE; import static org.apache.ignite.IgniteSystemProperties.getInteger; import static org.apache.ignite.cluster.ClusterState.ACTIVE; import static org.apache.ignite.cluster.ClusterState.INACTIVE; @@ -172,13 +171,11 @@ import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_MARSHALLER_USE_DFLT_SUID; import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_OFFHEAP_SIZE; import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_PEER_CLASSLOADING; -import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SECURITY_COMPATIBILITY_MODE; import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_SHUTDOWN_POLICY; import static org.apache.ignite.internal.IgniteNodeAttributes.ATTR_USER_NAME; import static org.apache.ignite.internal.IgniteVersionUtils.VER; import static org.apache.ignite.internal.events.DiscoveryCustomEvent.EVT_DISCOVERY_CUSTOM_EVT; import static org.apache.ignite.internal.processors.metric.impl.MetricUtils.metricName; -import static org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode; import static org.apache.ignite.internal.processors.security.SecurityUtils.nodeSecurityContext; import static org.apache.ignite.internal.util.lang.ClusterNodeFunc.eqNodes; import static org.apache.ignite.internal.util.lang.ClusterNodeFunc.nodeConsistentIds; @@ -508,9 +505,6 @@ private void updateClientNodes(UUID leftNodeId) { spi.setMetricsProvider(createMetricsProvider()); if (ctx.security().enabled()) { - if (isSecurityCompatibilityMode()) - ctx.addNodeAttribute(ATTR_SECURITY_COMPATIBILITY_MODE, true); - spi.setAuthenticator(new DiscoverySpiNodeAuthenticator() { @Override public SecurityContext authenticateNode(ClusterNode node, SecurityCredentials cred) { try { @@ -1246,8 +1240,6 @@ private void checkAttributes(Iterable nodes) throws IgniteCheckedEx boolean locDelayAssign = locNode.attribute(ATTR_LATE_AFFINITY_ASSIGNMENT); - Boolean locSecurityCompatibilityEnabled = locNode.attribute(ATTR_SECURITY_COMPATIBILITY_MODE); - WALMode locWalMode = nodeWalMode(locNode); for (ClusterNode n : nodes) { @@ -1339,22 +1331,6 @@ private void checkAttributes(Iterable nodes) throws IgniteCheckedEx ", rmtAddrs=" + U.addressesAsString(n) + ", rmtNode=" + U.toShortString(n) + "]"); } - if (ctx.security().enabled()) { - Boolean rmtSecurityCompatibilityEnabled = n.attribute(ATTR_SECURITY_COMPATIBILITY_MODE); - - if (!Objects.equals(locSecurityCompatibilityEnabled, rmtSecurityCompatibilityEnabled)) { - throw new IgniteCheckedException("Local node's " + IGNITE_SECURITY_COMPATIBILITY_MODE + - " property value differs from remote node's value " + - "(to make sure all nodes in topology have identical Ignite security compatibility mode enabled, " + - "configure system property explicitly) " + - "[locSecurityCompatibilityEnabled=" + locSecurityCompatibilityEnabled + - ", rmtSecurityCompatibilityEnabled=" + rmtSecurityCompatibilityEnabled + - ", locNodeAddrs=" + U.addressesAsString(locNode) + - ", rmtNodeAddrs=" + U.addressesAsString(n) + - ", locNodeId=" + locNode.id() + ", rmtNode=" + U.toShortString(n) + "]"); - } - } - WALMode rmtWalMode = nodeWalMode(n); if (locWalMode != null && rmtWalMode != null && locWalMode != rmtWalMode) { diff --git a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java index a8aa2f64c8284..e83a1cda5da7d 100644 --- a/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java +++ b/modules/core/src/main/java/org/apache/ignite/internal/processors/security/SecurityUtils.java @@ -39,7 +39,6 @@ import java.util.stream.Collectors; import org.apache.ignite.IgniteCheckedException; import org.apache.ignite.IgniteException; -import org.apache.ignite.IgniteSystemProperties; import org.apache.ignite.cluster.ClusterNode; import org.apache.ignite.internal.GridKernalContext; import org.apache.ignite.internal.IgniteInternalWrapper; @@ -75,16 +74,6 @@ public class SecurityUtils { /** Ignite internal package. */ public static final String IGNITE_INTERNAL_PACKAGE = "org.apache.ignite.internal"; - /** Default serialization version. */ - private static final int DFLT_SERIALIZE_VERSION = isSecurityCompatibilityMode() ? 1 : 2; - - /** Current serialization version. */ - private static final ThreadLocal SERIALIZE_VERSION = new ThreadLocal() { - @Override protected Integer initialValue() { - return DFLT_SERIALIZE_VERSION; - } - }; - /** Permissions that contain {@code AllPermission}. */ public static final Permissions ALL_PERMISSIONS; @@ -101,48 +90,6 @@ public class SecurityUtils { private SecurityUtils() { } - /** - * @return Security compatibility mode flag. - */ - public static boolean isSecurityCompatibilityMode() { - return IgniteSystemProperties.getBoolean(IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE, false); - } - - /** - * @param ver Serialize version. - */ - public static void serializeVersion(int ver) { - SERIALIZE_VERSION.set(ver); - } - - /** - * @return Serialize version. - */ - public static int serializeVersion() { - return SERIALIZE_VERSION.get(); - } - - /** - * Sets default serialize version {@link #DFLT_SERIALIZE_VERSION}. - */ - public static void restoreDefaultSerializeVersion() { - serializeVersion(DFLT_SERIALIZE_VERSION); - } - - /** - * @return Allow all service permissions. - */ - public static Map> compatibleServicePermissions() { - Map> srvcPerms = new HashMap<>(); - - srvcPerms.put("*", EnumSet.of( - SecurityPermission.SERVICE_CANCEL, - SecurityPermission.SERVICE_DEPLOY, - SecurityPermission.SERVICE_INVOKE)); - - return srvcPerms; - } - /** */ public static Map> normalizeResourcePermissions( Map> rsrcPerms diff --git a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java index 627cd5a225055..3736f88bd2b2b 100644 --- a/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java +++ b/modules/core/src/main/java/org/apache/ignite/plugin/security/SecurityBasicPermissionSet.java @@ -22,7 +22,6 @@ import java.io.ObjectOutputStream; import java.io.ObjectStreamField; import java.util.Collection; -import java.util.Collections; import java.util.EnumSet; import java.util.HashMap; import java.util.Map; @@ -34,10 +33,7 @@ import org.apache.ignite.internal.util.typedef.internal.U; import org.jetbrains.annotations.Nullable; -import static org.apache.ignite.internal.processors.security.SecurityUtils.compatibleServicePermissions; -import static org.apache.ignite.internal.processors.security.SecurityUtils.isSecurityCompatibilityMode; import static org.apache.ignite.internal.processors.security.SecurityUtils.normalizeResourcePermissions; -import static org.apache.ignite.internal.processors.security.SecurityUtils.serializeVersion; import static org.apache.ignite.internal.processors.security.SecurityUtils.toEnumSet; /** @@ -69,9 +65,7 @@ public class SecurityBasicPermissionSet implements SecurityPermissionSet { /** Service permissions. */ @GridToStringInclude @Order(2) - transient Map> srvcPermissions = isSecurityCompatibilityMode() - ? compatibleServicePermissions() - : new HashMap<>(); + transient Map> srvcPermissions = new HashMap<>(); /** System permissions. */ @GridToStringInclude @@ -192,8 +186,7 @@ private void writeObject(ObjectOutputStream out) throws IOException { out.writeFields(); - if (serializeVersion() >= 2) - U.writeMap(out, srvcPermissions); + U.writeMap(out, srvcPermissions); } /** */ @@ -209,14 +202,7 @@ private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundE sysPermissions = sysPerms == null ? null : toEnumSet(sysPerms); - Map> srvcPerms = serializeVersion() >= 2 ? U.readMap(in) : null; - - if (srvcPerms == null) { - // Allow all for compatibility mode - srvcPerms = serializeVersion() < 2 ? compatibleServicePermissions() : Collections.emptyMap(); - } - - srvcPermissions = normalizeResourcePermissions(srvcPerms); + srvcPermissions = normalizeResourcePermissions(U.readMap(in)); } /** {@inheritDoc} */ diff --git a/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java b/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java index 1d70baed0aa48..c17346d10e738 100644 --- a/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java +++ b/modules/core/src/main/java/org/apache/ignite/spi/discovery/tcp/ServerImpl.java @@ -89,7 +89,6 @@ import org.apache.ignite.internal.processors.metric.MetricRegistryImpl; import org.apache.ignite.internal.processors.metric.impl.MaxValueMetric; import org.apache.ignite.internal.processors.security.SecurityContext; -import org.apache.ignite.internal.processors.security.SecurityUtils; import org.apache.ignite.internal.thread.context.Scope; import org.apache.ignite.internal.thread.pool.IgniteThreadPoolExecutor; import org.apache.ignite.internal.util.GridBoundedLinkedHashSet; @@ -1333,16 +1332,7 @@ private boolean sendJoinRequestMessage(TcpDiscoveryJoinRequestMessage joinMsg) t try { IgniteSpiOperationTimeoutHelper timeoutHelper = new IgniteSpiOperationTimeoutHelper(spi, true); - Integer res; - - try { - SecurityUtils.serializeVersion(1); - - res = sendMessageDirectly(joinMsg, addr, timeoutHelper); - } - finally { - SecurityUtils.restoreDefaultSerializeVersion(); - } + Integer res = sendMessageDirectly(joinMsg, addr, timeoutHelper); assert res != null; @@ -3662,8 +3652,6 @@ else if (!spi.failureDetectionTimeoutEnabled() && (e instanceof prepareNodeAddedMessage(msg, next.id(), pendingMsgs.msgs); try { - SecurityUtils.serializeVersion(1); - long tsNanos = System.nanoTime(); if (timeoutHelper == null) @@ -3706,8 +3694,6 @@ else if (!spi.failureDetectionTimeoutEnabled() && (e instanceof } } finally { - SecurityUtils.restoreDefaultSerializeVersion(); - clearNodeAddedMessage(msg); } @@ -6827,8 +6813,6 @@ else if (e.hasCause(ObjectStreamException.class) || while (!isInterrupted()) { try { - SecurityUtils.serializeVersion(1); - // Use inifinite timeout for accepting new messages. TcpDiscoveryAbstractMessage msg = spi.readMessage(ses, 0); @@ -7121,9 +7105,6 @@ else if (msg instanceof TcpDiscoveryRingLatencyCheckMessage) { return; } - finally { - SecurityUtils.restoreDefaultSerializeVersion(); - } } } catch (UnknownMessageException e) { diff --git a/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java b/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java index a89a8dfb11f88..21e4b55548293 100644 --- a/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java +++ b/modules/core/src/test/java/org/apache/ignite/internal/managers/discovery/GridDiscoveryManagerAttributesSelfTest.java @@ -23,13 +23,11 @@ import org.apache.ignite.configuration.IgniteConfiguration; import org.apache.ignite.internal.IgniteEx; import org.apache.ignite.marshaller.Marshallers; -import org.apache.ignite.spi.discovery.TestReconnectSecurityPluginProvider; import org.apache.ignite.testframework.junits.common.GridCommonAbstractTest; import org.junit.Test; import static org.apache.ignite.IgniteSystemProperties.IGNITE_BINARY_MARSHALLER_USE_STRING_SERIALIZATION_VER_2; import static org.apache.ignite.IgniteSystemProperties.IGNITE_OPTIMIZED_MARSHALLER_USE_DEFAULT_SUID; -import static org.apache.ignite.IgniteSystemProperties.IGNITE_SECURITY_COMPATIBILITY_MODE; import static org.apache.ignite.configuration.DeploymentMode.CONTINUOUS; import static org.apache.ignite.configuration.DeploymentMode.SHARED; @@ -46,9 +44,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends GridCommonAbstractTe /** */ private static boolean p2pEnabled; - /** Security enabled. */ - private static boolean secEnabled; - /** {@inheritDoc} */ @Override protected IgniteConfiguration getConfiguration(String igniteInstanceName) throws Exception { IgniteConfiguration cfg = super.getConfiguration(igniteInstanceName); @@ -57,9 +52,6 @@ public class GridDiscoveryManagerAttributesSelfTest extends GridCommonAbstractTe cfg.setDeploymentMode(mode); cfg.setPeerClassLoadingEnabled(p2pEnabled); - if (secEnabled) - cfg.setPluginProviders(new TestReconnectSecurityPluginProvider()); - return cfg; } @@ -230,91 +222,6 @@ private void doTestUseStrSerVer2(String first, String second, boolean fail) thro } } - /** - * @throws Exception If failed. - */ - @Test - public void testSecurityCompatibilityEnabled() throws Exception { - secEnabled = true; - - try { - doTestSecurityCompatibilityEnabled(true, null, true); - doTestSecurityCompatibilityEnabled(true, false, true); - doTestSecurityCompatibilityEnabled(false, true, true); - doTestSecurityCompatibilityEnabled(null, true, true); - - doTestSecurityCompatibilityEnabled(null, null, false); - doTestSecurityCompatibilityEnabled(null, false, false); - doTestSecurityCompatibilityEnabled(false, false, false); - doTestSecurityCompatibilityEnabled(false, null, false); - doTestSecurityCompatibilityEnabled(true, true, false); - } - finally { - secEnabled = false; - } - } - - /** - * @param first Service compatibility enabled flag for first node. - * @param second Service compatibility enabled flag for second node. - * @param fail Fail flag. - * @throws Exception If failed. - */ - private void doTestSecurityCompatibilityEnabled(Object first, Object second, boolean fail) throws Exception { - doTestCompatibilityEnabled(IGNITE_SECURITY_COMPATIBILITY_MODE, first, second, fail); - } - - /** - * @param prop System property. - * @param first Service compatibility enabled flag for first node. - * @param second Service compatibility enabled flag for second node. - * @param fail Fail flag. - * @throws Exception If failed. - */ - private void doTestCompatibilityEnabled(String prop, Object first, Object second, boolean fail) throws Exception { - String backup = System.getProperty(prop); - try { - if (first != null) - System.setProperty(prop, String.valueOf(first)); - else - System.clearProperty(prop); - - IgniteEx ignite = startGrid(0); - - checkIsClientFlag(ignite); - - // Ignore if disabled security plugin used. - if (IGNITE_SECURITY_COMPATIBILITY_MODE.equals(prop) && !ignite.context().security().enabled()) - return; - - if (second != null) - System.setProperty(prop, String.valueOf(second)); - else - System.clearProperty(prop); - - try { - IgniteEx g = startClientGrid(1); - - checkIsClientFlag(g); - - if (fail) - fail("Node must not join"); - } - catch (Exception e) { - if (!fail) - fail("Node must join: " + e.getMessage()); - } - } - finally { - stopAllGrids(); - - if (backup != null) - System.setProperty(prop, backup); - else - System.clearProperty(prop); - } - } - /** * @throws Exception If failed. */