Skip to content

Commit 48d02de

Browse files
CaideyipiCaideyipi
committed
security-policies
1 parent 2645e83 commit 48d02de

File tree

3 files changed

+87
-53
lines changed

3 files changed

+87
-53
lines changed

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/sink/protocol/opcua/OpcUaSink.java‎

Lines changed: 45 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,11 @@
5757
import java.util.Arrays;
5858
import java.util.Map;
5959
import java.util.Objects;
60+
import java.util.Set;
6061
import java.util.UUID;
6162
import java.util.concurrent.ConcurrentHashMap;
6263
import java.util.concurrent.atomic.AtomicInteger;
64+
import java.util.stream.Collectors;
6365

6466
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_IOTDB_PASSWORD_DEFAULT_VALUE;
6567
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_IOTDB_PASSWORD_KEY;
@@ -90,6 +92,7 @@
9092
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_SECURITY_DIR_DEFAULT_VALUE;
9193
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_SECURITY_DIR_KEY;
9294
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_SECURITY_POLICY_KEY;
95+
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_SECURITY_POLICY_SERVER_DEFAULT_VALUES;
9396
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_TCP_BIND_PORT_DEFAULT_VALUE;
9497
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_TCP_BIND_PORT_KEY;
9598
import static org.apache.iotdb.commons.pipe.config.constant.PipeSinkConstant.CONNECTOR_OPC_UA_VALUE_NAME_DEFAULT_VALUE;
@@ -270,6 +273,18 @@ private void customizeServer(final PipeParameters parameters) {
270273
CONNECTOR_OPC_UA_ENABLE_ANONYMOUS_ACCESS_KEY,
271274
SINK_OPC_UA_ENABLE_ANONYMOUS_ACCESS_KEY),
272275
CONNECTOR_OPC_UA_ENABLE_ANONYMOUS_ACCESS_DEFAULT_VALUE);
276+
final Set<SecurityPolicy> securityPolicies =
277+
(parameters.hasAnyAttributes(
278+
CONNECTOR_OPC_UA_SECURITY_POLICY_KEY, SINK_OPC_UA_SECURITY_POLICY_KEY)
279+
? Arrays.stream(
280+
parameters
281+
.getStringByKeys(
282+
CONNECTOR_OPC_UA_SECURITY_POLICY_KEY, SINK_OPC_UA_SECURITY_POLICY_KEY)
283+
.replace(" ", "")
284+
.split(","))
285+
: CONNECTOR_OPC_UA_SECURITY_POLICY_SERVER_DEFAULT_VALUES.stream())
286+
.map(this::getSecurityPolicy)
287+
.collect(Collectors.toSet());
273288

274289
synchronized (SERVER_KEY_TO_REFERENCE_COUNT_AND_NAME_SPACE_MAP) {
275290
serverKey = httpsBindPort + ":" + tcpBindPort;
@@ -288,7 +303,8 @@ private void customizeServer(final PipeParameters parameters) {
288303
.setUser(user)
289304
.setPassword(password)
290305
.setSecurityDir(securityDir)
291-
.setEnableAnonymousAccess(enableAnonymousAccess);
306+
.setEnableAnonymousAccess(enableAnonymousAccess)
307+
.setSecurityPolicies(securityPolicies);
292308
final OpcUaServer newServer = builder.build();
293309
nameSpace = new OpcUaNameSpace(newServer, builder);
294310
nameSpace.startup();
@@ -312,34 +328,14 @@ private void customizeServer(final PipeParameters parameters) {
312328
}
313329

314330
private void customizeClient(final String nodeUrl, final PipeParameters parameters) {
315-
final SecurityPolicy policy;
316-
switch (parameters
317-
.getStringOrDefault(
318-
Arrays.asList(CONNECTOR_OPC_UA_SECURITY_POLICY_KEY, SINK_OPC_UA_SECURITY_POLICY_KEY),
319-
CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_SHA_256_VALUE)
320-
.toUpperCase()) {
321-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_NONE_VALUE:
322-
policy = SecurityPolicy.None;
323-
break;
324-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_128_RSA_15_VALUE:
325-
policy = SecurityPolicy.Basic128Rsa15;
326-
break;
327-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_VALUE:
328-
policy = SecurityPolicy.Basic256;
329-
break;
330-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_SHA_256_VALUE:
331-
policy = SecurityPolicy.Basic256Sha256;
332-
break;
333-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES128_SHA256_RSAOAEP_VALUE:
334-
policy = SecurityPolicy.Aes128_Sha256_RsaOaep;
335-
break;
336-
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES256_SHA256_RSAPSS_VALUE:
337-
policy = SecurityPolicy.Aes256_Sha256_RsaPss;
338-
break;
339-
default:
340-
throw new PipeException(
341-
"The security policy can only be 'None', 'Basic128Rsa15', 'Basic256', 'Basic256Sha256', 'Aes128_Sha256_RsaOaep' or 'Aes256_Sha256_RsaPss'.");
342-
}
331+
final SecurityPolicy policy =
332+
getSecurityPolicy(
333+
parameters
334+
.getStringOrDefault(
335+
Arrays.asList(
336+
CONNECTOR_OPC_UA_SECURITY_POLICY_KEY, SINK_OPC_UA_SECURITY_POLICY_KEY),
337+
CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_SHA_256_VALUE)
338+
.toUpperCase());
343339

344340
final IdentityProvider provider;
345341
final String userName =
@@ -372,6 +368,26 @@ private void customizeClient(final String nodeUrl, final PipeParameters paramete
372368
new ClientRunner(client, securityDir, password).run();
373369
}
374370

371+
private SecurityPolicy getSecurityPolicy(final String securityPolicy) {
372+
switch (securityPolicy.toUpperCase()) {
373+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_NONE_VALUE:
374+
return SecurityPolicy.None;
375+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_128_RSA_15_VALUE:
376+
return SecurityPolicy.Basic128Rsa15;
377+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_VALUE:
378+
return SecurityPolicy.Basic256;
379+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_SHA_256_VALUE:
380+
return SecurityPolicy.Basic256Sha256;
381+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES128_SHA256_RSAOAEP_VALUE:
382+
return SecurityPolicy.Aes128_Sha256_RsaOaep;
383+
case CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES256_SHA256_RSAPSS_VALUE:
384+
return SecurityPolicy.Aes256_Sha256_RsaPss;
385+
default:
386+
throw new PipeException(
387+
"The security policy can only be 'None', 'Basic128Rsa15', 'Basic256', 'Basic256Sha256', 'Aes128_Sha256_RsaOaep' or 'Aes256_Sha256_RsaPss'.");
388+
}
389+
}
390+
375391
@Override
376392
public void handshake() throws Exception {
377393
// Server side, do nothing

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/sink/protocol/opcua/server/OpcUaServerBuilder.java‎

Lines changed: 35 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ public class OpcUaServerBuilder implements Closeable {
8383
private String password;
8484
private Path securityDir;
8585
private boolean enableAnonymousAccess;
86+
private Set<SecurityPolicy> securityPolicies;
8687
private DefaultTrustListManager trustListManager;
8788

8889
public OpcUaServerBuilder setTcpBindPort(final int tcpBindPort) {
@@ -115,6 +116,11 @@ public OpcUaServerBuilder setEnableAnonymousAccess(final boolean enableAnonymous
115116
return this;
116117
}
117118

119+
public OpcUaServerBuilder setSecurityPolicies(final Set<SecurityPolicy> securityPolicies) {
120+
this.securityPolicies = securityPolicies;
121+
return this;
122+
}
123+
118124
public OpcUaServer build() throws Exception {
119125
Files.createDirectories(securityDir);
120126
if (!Files.exists(securityDir)) {
@@ -237,30 +243,35 @@ private Set<EndpointConfiguration> createEndpointConfigurations(
237243
USER_TOKEN_POLICY_USERNAME,
238244
USER_TOKEN_POLICY_X509);
239245

240-
final EndpointConfiguration.Builder noSecurityBuilder =
241-
builder
242-
.copy()
243-
.setSecurityPolicy(SecurityPolicy.None)
244-
.setSecurityMode(MessageSecurityMode.None);
245-
246-
endpointConfigurations.add(buildTcpEndpoint(noSecurityBuilder, tcpBindPort));
247-
endpointConfigurations.add(buildHttpsEndpoint(noSecurityBuilder, httpsBindPort));
248-
249-
endpointConfigurations.add(
250-
buildTcpEndpoint(
251-
builder
252-
.copy()
253-
.setSecurityPolicy(SecurityPolicy.Basic256Sha256)
254-
.setSecurityMode(MessageSecurityMode.SignAndEncrypt),
255-
tcpBindPort));
256-
257-
endpointConfigurations.add(
258-
buildHttpsEndpoint(
259-
builder
260-
.copy()
261-
.setSecurityPolicy(SecurityPolicy.Basic256Sha256)
262-
.setSecurityMode(MessageSecurityMode.Sign),
263-
httpsBindPort));
246+
if (securityPolicies.contains(SecurityPolicy.None)) {
247+
final EndpointConfiguration.Builder noSecurityBuilder =
248+
builder
249+
.copy()
250+
.setSecurityPolicy(SecurityPolicy.None)
251+
.setSecurityMode(MessageSecurityMode.None);
252+
253+
endpointConfigurations.add(buildTcpEndpoint(noSecurityBuilder, tcpBindPort));
254+
endpointConfigurations.add(buildHttpsEndpoint(noSecurityBuilder, httpsBindPort));
255+
securityPolicies.remove(SecurityPolicy.None);
256+
}
257+
258+
for (final SecurityPolicy securityPolicy : securityPolicies) {
259+
endpointConfigurations.add(
260+
buildTcpEndpoint(
261+
builder
262+
.copy()
263+
.setSecurityPolicy(securityPolicy)
264+
.setSecurityMode(MessageSecurityMode.SignAndEncrypt),
265+
tcpBindPort));
266+
267+
endpointConfigurations.add(
268+
buildHttpsEndpoint(
269+
builder
270+
.copy()
271+
.setSecurityPolicy(securityPolicy)
272+
.setSecurityMode(MessageSecurityMode.Sign),
273+
httpsBindPort));
274+
}
264275

265276
final EndpointConfiguration.Builder discoveryBuilder =
266277
builder

‎iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/pipe/config/constant/PipeSinkConstant.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import java.util.Arrays;
2929
import java.util.Collections;
3030
import java.util.HashSet;
31+
import java.util.List;
3132
import java.util.Set;
3233

3334
import static org.apache.iotdb.commons.conf.IoTDBConstant.MB;
@@ -211,6 +212,12 @@ public class PipeSinkConstant {
211212
public static final String CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES256_SHA256_RSAPSS_VALUE =
212213
"AES256_SHA256_RSAPSS";
213214

215+
public static final List<String> CONNECTOR_OPC_UA_SECURITY_POLICY_SERVER_DEFAULT_VALUES =
216+
Arrays.asList(
217+
CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_BASIC_256_SHA_256_VALUE,
218+
CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES128_SHA256_RSAOAEP_VALUE,
219+
CONNECTOR_OPC_UA_QUALITY_SECURITY_POLICY_AES256_SHA256_RSAPSS_VALUE);
220+
214221
public static final String CONNECTOR_OPC_UA_HISTORIZING_KEY = "connector.opcua.historizing";
215222
public static final String SINK_OPC_UA_HISTORIZING_KEY = "sink.opcua.historizing";
216223
public static final boolean CONNECTOR_OPC_UA_HISTORIZING_DEFAULT_VALUE = false;

0 commit comments

Comments
 (0)