diff --git a/acl/pom.xml b/acl/pom.xml
index 36dae6ad045b67762f4221ab9df54e90666f8b7a..d62493417892e67b78a46f414f95320be263b6a7 100644
--- a/acl/pom.xml
+++ b/acl/pom.xml
@@ -13,7 +13,7 @@
org.apache.rocketmq
rocketmq-all
- 4.8.1-SNAPSHOT
+ 4.9.1-SNAPSHOT
rocketmq-acl
rocketmq-acl ${project.version}
diff --git a/acl/src/main/java/org/apache/rocketmq/acl/common/AclConstants.java b/acl/src/main/java/org/apache/rocketmq/acl/common/AclConstants.java
index bfe96f53037cca259b837a461114f879b2b7359c..d129c66d1c81dbb0cbce7dc7d5324eacdd53864d 100644
--- a/acl/src/main/java/org/apache/rocketmq/acl/common/AclConstants.java
+++ b/acl/src/main/java/org/apache/rocketmq/acl/common/AclConstants.java
@@ -44,6 +44,16 @@ public class AclConstants {
public static final String CONFIG_TIME_STAMP = "timestamp";
+ public static final String PUB = "PUB";
+
+ public static final String SUB = "SUB";
+
+ public static final String DENY = "DENY";
+
+ public static final String PUB_SUB = "PUB|SUB";
+
+ public static final String SUB_PUB = "SUB|PUB";
+
public static final int ACCESS_KEY_MIN_LENGTH = 6;
public static final int SECRET_KEY_MIN_LENGTH = 6;
diff --git a/acl/src/main/java/org/apache/rocketmq/acl/common/Permission.java b/acl/src/main/java/org/apache/rocketmq/acl/common/Permission.java
index 8ceb135fbf1f3f5fc07a83f68a981c22780d0506..dadcaa304aac45a460feb3e9a15654ffa46d6e8b 100644
--- a/acl/src/main/java/org/apache/rocketmq/acl/common/Permission.java
+++ b/acl/src/main/java/org/apache/rocketmq/acl/common/Permission.java
@@ -60,14 +60,14 @@ public class Permission {
return Permission.DENY;
}
switch (permString.trim()) {
- case "PUB":
+ case AclConstants.PUB:
return Permission.PUB;
- case "SUB":
+ case AclConstants.SUB:
return Permission.SUB;
- case "PUB|SUB":
- case "SUB|PUB":
+ case AclConstants.PUB_SUB:
+ case AclConstants.SUB_PUB:
return Permission.PUB | Permission.SUB;
- case "DENY":
+ case AclConstants.DENY:
return Permission.DENY;
default:
return Permission.DENY;
@@ -89,6 +89,25 @@ public class Permission {
}
}
+ public static void checkResourcePerms(List resources) {
+ if (resources == null || resources.isEmpty()) {
+ return;
+ }
+
+ for (String resource : resources) {
+ String[] items = StringUtils.split(resource, "=");
+ if (items.length != 2) {
+ throw new AclException(String.format("Parse Resource format error for %s.\n" +
+ "The expected resource format is 'Res=Perm'. For example: topicA=SUB", resource));
+ }
+
+ if (!AclConstants.DENY.equals(items[1].trim()) && Permission.DENY == Permission.parsePermFromString(items[1].trim())) {
+ throw new AclException(String.format("Parse resource permission error for %s.\n" +
+ "The expected permissions are 'SUB' or 'PUB' or 'SUB|PUB' or 'PUB|SUB'.", resource));
+ }
+ }
+ }
+
public static boolean needAdminPerm(Integer code) {
return ADMIN_CODE.contains(code);
}
diff --git a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java
index c182d7eb6a44fa7364542102471479b0fb25d86c..078d34b10b02a84837ad6bb0b34dd884833cab9c 100644
--- a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java
+++ b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionManager.java
@@ -50,9 +50,9 @@ public class PlainPermissionManager {
private String fileName = System.getProperty("rocketmq.acl.plain.file", DEFAULT_PLAIN_ACL_FILE);
- private Map plainAccessResourceMap = new HashMap<>();
+ private Map plainAccessResourceMap = new HashMap<>();
- private List globalWhiteRemoteAddressStrategy = new ArrayList<>();
+ private List globalWhiteRemoteAddressStrategy = new ArrayList<>();
private RemoteAddressStrategyFactory remoteAddressStrategyFactory = new RemoteAddressStrategyFactory();
@@ -80,7 +80,7 @@ public class PlainPermissionManager {
if (globalWhiteRemoteAddressesList != null && !globalWhiteRemoteAddressesList.isEmpty()) {
for (int i = 0; i < globalWhiteRemoteAddressesList.size(); i++) {
globalWhiteRemoteAddressStrategy.add(remoteAddressStrategyFactory.
- getRemoteAddressStrategy(globalWhiteRemoteAddressesList.getString(i)));
+ getRemoteAddressStrategy(globalWhiteRemoteAddressesList.getString(i)));
}
}
@@ -89,7 +89,7 @@ public class PlainPermissionManager {
List plainAccessConfigList = accounts.toJavaList(PlainAccessConfig.class);
for (PlainAccessConfig plainAccessConfig : plainAccessConfigList) {
PlainAccessResource plainAccessResource = buildPlainAccessResource(plainAccessConfig);
- plainAccessResourceMap.put(plainAccessResource.getAccessKey(),plainAccessResource);
+ plainAccessResourceMap.put(plainAccessResource.getAccessKey(), plainAccessResource);
}
}
@@ -128,12 +128,17 @@ public class PlainPermissionManager {
if (plainAccessConfig == null) {
log.error("Parameter value plainAccessConfig is null,Please check your parameter");
- return false;
+ throw new AclException("Parameter value plainAccessConfig is null, Please check your parameter");
}
+ Permission.checkResourcePerms(plainAccessConfig.getTopicPerms());
+ Permission.checkResourcePerms(plainAccessConfig.getGroupPerms());
+
Map aclAccessConfigMap = AclUtils.getYamlDataObject(fileHome + File.separator + fileName,
Map.class);
-
+ if (aclAccessConfigMap == null || aclAccessConfigMap.isEmpty()) {
+ throw new AclException(String.format("the %s file is not found or empty", fileHome + File.separator + fileName));
+ }
List