forked from apache/doris
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathhttp_handler_with_auth.cpp
More file actions
124 lines (110 loc) · 4.5 KB
/
Copy pathhttp_handler_with_auth.cpp
File metadata and controls
124 lines (110 loc) · 4.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements. See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership. The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License. You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied. See the License for the
// specific language governing permissions and limitations
// under the License.
#include "http_handler_with_auth.h"
#include <gen_cpp/HeartbeatService_types.h>
#include "http/http_channel.h"
#include "runtime/client_cache.h"
#include "util/thrift_rpc_helper.h"
#include "utils.h"
namespace doris {
class TPrivilegeType;
class TPrivilegeHier;
class ThriftRpcHelper;
HttpHandlerWithAuth::HttpHandlerWithAuth(ExecEnv* exec_env, TPrivilegeHier::type hier,
TPrivilegeType::type type)
: _exec_env(exec_env), _hier(hier), _type(type) {}
int HttpHandlerWithAuth::on_header(HttpRequest* req) {
//if u return value isn't 0,u should `send_reply`,Avoid requesting links that never return.
TCheckAuthRequest auth_request;
TCheckAuthResult auth_result;
AuthInfo auth_info;
if (!config::enable_all_http_auth) {
return 0;
}
if (!parse_basic_auth(*req, &auth_info)) {
LOG(WARNING) << "parse basic authorization failed"
<< ", request: " << req->debug_string();
evhttp_add_header(evhttp_request_get_output_headers(req->get_evhttp_request()),
"WWW-Authenticate", "Basic realm=\"Restricted\"");
HttpChannel::send_reply(req, HttpStatus::UNAUTHORIZED);
return -1;
}
// check auth by token
if (auth_info.token != "") {
#ifdef BE_TEST
if (auth_info.token == "valid_token") {
return 0;
#else
if (_exec_env->check_auth_token(auth_info.token)) {
return 0;
#endif
} else {
LOG(WARNING) << "invalid auth token, request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::BAD_REQUEST);
return -1;
}
}
// check auth by user/password
auth_request.user = auth_info.user;
auth_request.passwd = auth_info.passwd;
auth_request.__set_cluster(auth_info.cluster);
auth_request.__set_user_ip(auth_info.user_ip);
auth_request.__set_thrift_rpc_timeout_ms(config::thrift_rpc_timeout_ms);
if (!on_privilege(*req, auth_request)) {
LOG(WARNING) << "invalid privilege, request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::BAD_REQUEST);
return -1;
}
#ifndef BE_TEST
TNetworkAddress master_addr = _exec_env->cluster_info()->master_fe_addr;
if (master_addr.hostname.empty() || master_addr.port == 0) {
LOG(WARNING) << "Not found master fe, Can't auth API request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::SERVICE_UNAVAILABLE);
return -1;
}
{
auto status = ThriftRpcHelper::rpc<FrontendServiceClient>(
master_addr.hostname, master_addr.port,
[&auth_result, &auth_request](FrontendServiceConnection& client) {
client->checkAuth(auth_result, auth_request);
});
if (!status) {
LOG(WARNING) << "CheckAuth Rpc Fail.Fe Ip:" << master_addr.hostname
<< ", Fe port:" << master_addr.port << ".Status:" << status.to_string()
<< ".Request: " << req->debug_string();
HttpChannel::send_error(req, HttpStatus::SERVICE_UNAVAILABLE);
return -1;
}
}
#else
if (auth_request.user == "root" && auth_request.passwd.empty()) {
auth_result.status.status_code = TStatusCode::type::OK;
auth_result.status.error_msgs.clear();
} else {
HttpChannel::send_reply(req, HttpStatus::FORBIDDEN);
return -1;
}
#endif
Status status(Status::create(auth_result.status));
if (!status.ok()) {
LOG(WARNING) << "permission verification failed, request: " << auth_request;
HttpChannel::send_reply(req, HttpStatus::FORBIDDEN);
return -1;
}
return 0;
}
} // namespace doris