[
https://issues.apache.org/jira/browse/KNOX-2777?focusedWorklogId=792659&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-792659
]
ASF GitHub Bot logged work on KNOX-2777:
----------------------------------------
Author: ASF GitHub Bot
Created on: 19/Jul/22 12:50
Start Date: 19/Jul/22 12:50
Worklog Time Spent: 10m
Work Description: zeroflag commented on code in PR #608:
URL: https://github.com/apache/knox/pull/608#discussion_r924458961
##########
gateway-util-common/src/main/java/org/apache/knox/gateway/util/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.util;
+
+
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class ConcurrentSessionVerifier {
+ private static Set<String> privilegedUsers = new HashSet<>();
+ private static Set<String> nonPrivilegedUsers = new HashSet<>();;
+ private static int privilegedUserConcurrentSessionLimit = 3;
+ private static int nonPrivilegedUserConcurrentSessionLimit = 2;
+ private static Map<String, Integer> concurrentSessionCounter = new
ConcurrentHashMap<>();
+ private static final Object lock = new Object();
+
+ private ConcurrentSessionVerifier(){}
+
+ public static synchronized void init(Set<String> privilegedUsers,
Set<String> nonPrivilegedUsers, int privilegedUserConcurrentSessionLimit, int
nonPrivilegedUserConcurrentSessionLimit){
+ ConcurrentSessionVerifier.privilegedUsers = privilegedUsers;
+ ConcurrentSessionVerifier.nonPrivilegedUsers = nonPrivilegedUsers;
+ ConcurrentSessionVerifier.privilegedUserConcurrentSessionLimit =
privilegedUserConcurrentSessionLimit;
+ ConcurrentSessionVerifier.nonPrivilegedUserConcurrentSessionLimit =
nonPrivilegedUserConcurrentSessionLimit;
+ concurrentSessionCounter = new ConcurrentHashMap<>();
+ }
+
+ public static boolean verifySessionForUser(String username){
+ if(!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+ synchronized(lock) {
+ if (!concurrentSessionCounter.containsKey(username)) {
Review Comment:
This is probably can be simplified by using `computeIfAbsent` /
`putIfAbsent` / `compute` methods.
For example:
```java
int count = concurrentSessionCounter.computeIfAbsent(username, name -> 0);
if (...) {
}
```
##########
gateway-util-common/src/main/java/org/apache/knox/gateway/util/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.util;
+
+
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class ConcurrentSessionVerifier {
Review Comment:
Instead of using static methods and static fields, let's have a normal non
static class with instance variables and non static methods. Constants like
`privilegedUserConcurrentSessionLimit`/`privilegedUserConcurrentSessionLimit`
should be kept as statics but `concurrentSessionCounter` should be non static.
Then we can create one instance of this class and use that at each places
where needed. Either by creating an instance somewhere in GatewayServer's
`main()` and passing that around or by making a singleton. I prefer the former
but that's up to how the code is structured. We can decide that later when we
start using it.
##########
gateway-util-common/src/main/java/org/apache/knox/gateway/util/ConcurrentSessionVerifier.java:
##########
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.util;
+
+
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+public class ConcurrentSessionVerifier {
+ private static Set<String> privilegedUsers = new HashSet<>();
+ private static Set<String> nonPrivilegedUsers = new HashSet<>();;
+ private static int privilegedUserConcurrentSessionLimit = 3;
+ private static int nonPrivilegedUserConcurrentSessionLimit = 2;
+ private static Map<String, Integer> concurrentSessionCounter = new
ConcurrentHashMap<>();
+ private static final Object lock = new Object();
+
+ private ConcurrentSessionVerifier(){}
+
+ public static synchronized void init(Set<String> privilegedUsers,
Set<String> nonPrivilegedUsers, int privilegedUserConcurrentSessionLimit, int
nonPrivilegedUserConcurrentSessionLimit){
+ ConcurrentSessionVerifier.privilegedUsers = privilegedUsers;
+ ConcurrentSessionVerifier.nonPrivilegedUsers = nonPrivilegedUsers;
+ ConcurrentSessionVerifier.privilegedUserConcurrentSessionLimit =
privilegedUserConcurrentSessionLimit;
+ ConcurrentSessionVerifier.nonPrivilegedUserConcurrentSessionLimit =
nonPrivilegedUserConcurrentSessionLimit;
+ concurrentSessionCounter = new ConcurrentHashMap<>();
+ }
+
+ public static boolean verifySessionForUser(String username){
+ if(!privilegedUsers.contains(username) &&
!nonPrivilegedUsers.contains(username)) {
+ return true;
+ }
+ synchronized(lock) {
+ if (!concurrentSessionCounter.containsKey(username)) {
+ concurrentSessionCounter.put(username, 0);
+ }
+ if ((privilegedUsers.contains(username) &&
!(concurrentSessionCounter.get(username) <
privilegedUserConcurrentSessionLimit)) ||
(nonPrivilegedUsers.contains(username) &&
!(concurrentSessionCounter.get(username) <
nonPrivilegedUserConcurrentSessionLimit))) {
+ return false;
+ }
+ incrementConcurrentSessionCount(username);
+ }
+ return true;
+ }
+
+ private static synchronized void incrementConcurrentSessionCount(String
username){
+ int count = concurrentSessionCounter.get(username);
Review Comment:
Similarly, see if you can use `compute` to simplify this. For example:
```java
concurrentSessionCounter.compute(username, (key ,value) -> value + 1);
```
Issue Time Tracking
-------------------
Worklog Id: (was: 792659)
Time Spent: 1h 50m (was: 1h 40m)
> Implement concurrent session verifier
> -------------------------------------
>
> Key: KNOX-2777
> URL: https://issues.apache.org/jira/browse/KNOX-2777
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 2.0.0
> Reporter: Sandor Molnar
> Priority: Major
> Fix For: 2.0.0
>
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> The following needs to be implemented in the scope of this JIRA:
> * we need 4 new Gateway-level configurations:
> ** privileged user list (defaults to an empty collection)
> ** non-privileged user list (defaults to an empty collection)
> ** session limit for privileged users (defaults to 3)
> ** session limit for non-privileged users (defaults to 2)
> * In addition to the new configs, a verifier has to be implemented that
> enforces the following business logic: if a user is listed in the
> above-introduced privileged/non-privileged collection AND is about to pass a
> configured session limit the verification should fail. The verification
> should succeed if the given user is declared neither a privileged nor a
> non-privileged user.
> The new verifier implementation may be placed in the {{gateway-util-common}}
> project for now.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
