2 * ============LICENSE_START=======================================================
4 * ================================================================================
5 * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6 * ================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
11 * http://www.apache.org/licenses/LICENSE-2.0
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
21 package org.openecomp.policy.pdp.rest;
23 import java.io.FileOutputStream;
24 import java.io.IOException;
25 import java.io.InputStream;
26 import java.io.OutputStream;
27 import java.net.MalformedURLException;
30 import java.net.URLConnection;
31 import java.nio.charset.StandardCharsets;
32 import java.nio.file.Files;
33 import java.nio.file.Path;
34 import java.nio.file.Paths;
35 import java.util.Base64;
36 import java.util.ConcurrentModificationException;
37 import java.util.HashMap;
38 import java.util.Properties;
41 import org.apache.commons.io.IOUtils;
42 import org.openecomp.policy.pdp.rest.notifications.NotificationController;
43 import org.openecomp.policy.rest.XACMLRest;
44 import org.openecomp.policy.rest.XACMLRestProperties;
45 import org.openecomp.policy.common.logging.flexlogger.FlexLogger;
46 import org.openecomp.policy.common.logging.flexlogger.Logger;
48 import org.openecomp.policy.xacml.api.XACMLErrorConstants;
49 import com.att.research.xacml.api.pap.PAPException;
50 import com.att.research.xacml.api.pap.PDPStatus;
51 import com.att.research.xacml.api.pap.PDPStatus.Status;
52 import com.att.research.xacml.api.pdp.PDPEngine;
53 import com.att.research.xacml.api.pdp.PDPEngineFactory;
54 import com.att.research.xacml.api.pip.PIPEngine;
55 import com.att.research.xacml.api.pip.PIPException;
56 import com.att.research.xacml.api.pip.PIPFinder;
57 import com.att.research.xacml.api.pip.PIPFinderFactory;
58 import org.openecomp.policy.xacml.std.pap.StdPDPPIPConfig;
59 import org.openecomp.policy.xacml.std.pap.StdPDPPolicy;
60 import org.openecomp.policy.xacml.std.pap.StdPDPStatus;
61 import com.att.research.xacml.util.FactoryException;
62 import com.att.research.xacml.util.XACMLProperties;
63 import com.att.research.xacmlatt.pdp.policy.PolicyDef;
64 import com.att.research.xacmlatt.pdp.policy.dom.DOMPolicyDef;
65 import com.att.research.xacmlatt.pdp.std.StdPolicyFinderFactory;
66 import com.google.common.base.Splitter;
69 * Does the work for loading policy and PIP configurations sent from the PAP
75 public class XACMLPdpLoader {
76 private static final Logger LOGGER = FlexLogger.getLogger(XACMLPdpLoader.class);
77 private static NotificationController notificationController = new NotificationController();
78 private static final Long notifyDelay = (long) XACMLPdpServlet.getNotificationDelay();
81 public static synchronized PDPEngine loadEngine(StdPDPStatus status,
82 Properties policyProperties, Properties pipProperties) {
83 LOGGER.info("loadEngine: " + policyProperties + " " + pipProperties);
85 // First load our policies
89 // Were we given some properties?
91 if (policyProperties == null) {
93 // On init we have no incoming configuration, so just
94 // Load our current saved configuration
96 policyProperties = new Properties();
97 try (InputStream is = Files.newInputStream(getPDPPolicyCache())) {
98 policyProperties.load(is);
103 // Get our policy cache up-to-date
105 // Side effects of this include:
106 // - downloading of policies from remote locations, and
107 // - creating new "<PolicyId>.file" properties for files existing
110 XACMLPdpLoader.cachePolicies(policyProperties);
112 // Validate the policies
114 XACMLPdpLoader.validatePolicies(policyProperties, status);
115 if (LOGGER.isDebugEnabled()) {
116 LOGGER.debug("Status: " + status);
118 } catch (ConcurrentModificationException e) {
119 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + e.getMessage());
120 } catch (Exception e) {
121 String error = "Failed to load Policy Cache properties file: "
123 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + error, e);
124 status.addLoadError(error);
125 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
128 // Load our PIP configuration
132 // Were we given some properties to use?
134 if (pipProperties == null) {
136 // Load our current saved configuration
138 pipProperties = new Properties();
139 try (InputStream is = Files.newInputStream(getPIPConfig())) {
140 pipProperties.load(is);
144 // Validate our PIP configurations
146 XACMLPdpLoader.validatePipConfiguration(pipProperties, status);
147 if (LOGGER.isDebugEnabled()) {
148 LOGGER.debug("Status: " + status);
150 } catch (Exception e) {
151 String error = "Failed to load/validate Pip Config properties file: "
153 LOGGER.error(XACMLErrorConstants.ERROR_DATA_ISSUE + error, e);
154 status.addLoadError(XACMLErrorConstants.ERROR_PROCESS_FLOW + error);
155 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
158 // Were they validated?
160 if (status.getStatus() == Status.LOAD_ERRORS) {
161 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW +"there were load errors");
165 // Reset our official properties the PDP factory
166 // uses to configure the PDP engine.
168 XACMLRest.loadXacmlProperties(policyProperties, pipProperties);
170 // Dump ALL our properties that we are trying to load
173 LOGGER.info(XACMLProperties.getProperties().toString());
174 } catch (IOException e) {
175 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to get XACML Properties", e);
178 // Now load the PDP engine
180 PDPEngineFactory factory = null;
181 PDPEngine engine = null;
183 factory = PDPEngineFactory.newInstance();
184 engine = factory.newEngine();
185 LOGGER.info("Loaded new PDP engine.");
186 status.setStatus(Status.UP_TO_DATE);
187 } catch (FactoryException e) {
188 String error = "Failed to create new PDP Engine";
189 LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR +error, e);
190 status.addLoadError(error);
192 // Notification will be Sent Here.
197 private static HashMap<String, PolicyDef> policyContainer = null;
199 private static void sendNotification(){
200 Thread notify = new Thread(){
203 Thread.sleep(notifyDelay);
204 NotificationController.sendNotification();
206 LOGGER.error(XACMLErrorConstants.ERROR_UNKNOWN + e);
213 public static synchronized void validatePolicies(Properties properties,
214 StdPDPStatus status) throws PAPException {
215 Set<String> rootPolicies = XACMLProperties.getRootPolicyIDs(properties);
216 Set<String> refPolicies = XACMLProperties
217 .getReferencedPolicyIDs(properties);
218 policyContainer = new HashMap<String, PolicyDef>();
220 for (String id : rootPolicies) {
221 loadPolicy(properties, status, id, true);
223 // remember which policies were root policies
224 status.addAllLoadedRootPolicies(status.getLoadedPolicies());
226 for (String id : refPolicies) {
227 loadPolicy(properties, status, id, false);
229 LOGGER.info("Loaded " + status.getLoadedPolicies().size()
230 + " policies, failed to load "
231 + status.getFailedPolicies().size() + " policies, "
232 + status.getLoadedRootPolicies().size() + " root policies");
233 notificationController.check(status, policyContainer);
234 if (status.getLoadedRootPolicies().size() == 0) {
235 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW +"NO ROOT POLICIES LOADED!!! Cannot serve PEP Requests.");
236 status.addLoadWarning("NO ROOT POLICIES LOADED!!! Cannot serve PEP Requests.");
238 policyContainer.clear();
242 public static synchronized void loadPolicy(Properties properties,
243 StdPDPStatus status, String id, boolean isRoot) throws PAPException {
244 PolicyDef policy = null;
245 String location = null;
246 URI locationURI = null;
247 boolean isFile = false;
248 boolean rougeFile = false;
250 location = properties.getProperty(id + ".file");
251 if(location != null){
253 locationURI = Paths.get(location).toUri();
254 try (InputStream is = Files.newInputStream(Paths.get(location))) {
255 policy = DOMPolicyDef.load(is);
256 } catch (Exception e){
257 // This Happens if a any issue with the error policyFile. Lets remove it.
259 LOGGER.error("Corrupted policy file, deleting: " + location);
260 Files.delete(Paths.get(location));
261 properties.remove(id + ".file");
263 } catch (IOException e1) {
268 if(location==null || rougeFile){
272 location = properties.getProperty(id + ".url");
273 if (location != null) {
278 boolean error= false;
281 PapUrlResolver papUrls = PapUrlResolver.getInstance();
282 while(papUrls.hasMoreUrls()){
283 String papID = papUrls.getUserId();
284 String papPass = papUrls.getPass();
285 Base64.Encoder encoder = Base64.getEncoder();
286 String encoding = encoder.encodeToString((papID+":"+papPass).getBytes(StandardCharsets.UTF_8));
287 locationURI = URI.create(papUrls.getUrl(PapUrlResolver.extractIdFromUrl(location)));
288 URL url = locationURI.toURL();
289 URLConnection urlConnection = null;
291 urlConnection = url.openConnection();
292 } catch (IOException e){
297 urlConnection.setRequestProperty(XACMLRestProperties.PROP_PDP_HTTP_HEADER_ID,
298 XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_ID));
299 urlConnection.setRequestProperty("Authorization", "Basic " + encoding);
301 // Now construct the output file name
303 Path outFile = Paths.get(getPDPConfig().toAbsolutePath()
308 try (FileOutputStream fos = new FileOutputStream(
310 IOUtils.copy(urlConnection.getInputStream(), fos);
311 } catch(IOException e){
320 try (InputStream fis = Files.newInputStream(outFile)) {
321 policy = DOMPolicyDef.load(fis);
324 LOGGER.error("Corrupted policy file, deleting: " + location);
325 Files.delete(outFile);
329 } catch (IOException e1) {
336 properties.setProperty(id + ".file", outFile
337 .toAbsolutePath().toString());
341 }while(error && errorCount>2);
344 if (policy != null) {
345 status.addLoadedPolicy(new StdPDPPolicy(id, isRoot,
346 locationURI, properties));
347 LOGGER.info("Loaded policy: " + policy.getIdentifier()
348 + " version: " + policy.getVersion().stringValue());
349 // Sending the policy objects to the Notification Controller.
350 policyContainer.put(id, policy);
352 String error = "Failed to load policy " + location;
353 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + error);
354 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
355 status.addLoadError(error);
356 status.addFailedPolicy(new StdPDPPolicy(id, isRoot));
358 } catch (Exception e) {
359 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW +"Failed to load policy '" + id + "' from location '"
360 + location + "'", e);
361 status.setStatus(PDPStatus.Status.LOAD_ERRORS);
362 status.addFailedPolicy(new StdPDPPolicy(id, isRoot));
371 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Corrupted policy file, deleting: " + location);
372 Files.delete(Paths.get(location));
374 } catch (IOException e1) {
375 LOGGER.error(XACMLErrorConstants.ERROR_SYSTEM_ERROR + e1);
381 public static synchronized void validatePipConfiguration(
382 Properties properties, StdPDPStatus status) throws PAPException {
384 PIPFinderFactory factory = PIPFinderFactory.newInstance(properties);
385 if (factory == null) {
386 throw new FactoryException(
387 "Could not create PIP Finder Factory: "
389 .getProperty(XACMLProperties.PROP_PIPFINDERFACTORY));
391 PIPFinder finder = factory.getFinder(properties);
393 // Check for this, although it should always return something
395 if (finder == null) {
396 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "pip finder factory returned a null engine.");
397 throw new PIPException("Could not create PIP Finder");
399 LOGGER.info("Loaded PIP finder");
401 for (PIPEngine engine : finder.getPIPEngines()) {
402 LOGGER.info("Configured PIP Engine: " + engine.getName());
403 StdPDPPIPConfig config = new StdPDPPIPConfig();
404 config.setName(engine.getName());
405 status.addLoadedPipConfig(config);
407 } catch (FactoryException | PIPException e) {
408 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "validate PIP configuration failed: "
409 + e.getLocalizedMessage());
410 status.addLoadError(e.getLocalizedMessage());
411 status.setStatus(Status.LOAD_ERRORS);
412 throw new PAPException(e);
417 * Iterates the policies defined in the props object to ensure they are
418 * loaded locally. Policies are searched for in the following order: - see
419 * if the current properties has a "<PolicyID>.file" entry and that
420 * file exists in the local directory - if not, see if the file exists in
421 * the local directory; if so create a ".file" property for it. - if not,
422 * get the "<PolicyID>.url" property and try to GET the policy from
423 * that location (and set the ".file" property)
425 * If the ".file" property is created, then true is returned to tell the
426 * caller that the props object changed.
429 * @return true/false if anything was changed in the props object
430 * @throws PAPException
432 public static synchronized boolean cachePolicies(Properties props)
433 throws PAPException {
434 boolean changed = false;
435 String[] lists = new String[2];
436 lists[0] = props.getProperty(XACMLProperties.PROP_ROOTPOLICIES);
437 lists[1] = props.getProperty(XACMLProperties.PROP_REFERENCEDPOLICIES);
438 for (String list : lists) {
440 // Check for a null or empty parameter
442 if (list == null || list.length() == 0) {
445 Iterable<String> policies = Splitter.on(',').trimResults()
446 .omitEmptyStrings().split(list);
447 for (String policy : policies) {
448 boolean policyExists = false;
450 // First look for ".file" property and verify the file exists
451 String propLocation = props.getProperty(policy
452 + StdPolicyFinderFactory.PROP_FILE);
453 if (propLocation != null) {
457 policyExists = Files.exists(Paths.get(propLocation));
458 if (policyExists == false) {
459 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy file " + policy + " expected at "
460 + propLocation + " does NOT exist.");
464 // If ".file" property does not exist, try looking for the local
466 // (it might exist without having a ".file" property set for it)
467 if (policyExists == false) {
469 // Now construct the output file name
471 Path outFile = Paths.get(getPDPConfig().toAbsolutePath()
472 .toString(), policy);
474 // Double check to see if we pulled it at some point
476 policyExists = Files.exists(outFile);
479 // Set the property so the PDP engine doesn't have
480 // to pull it from the URL but rather the FILE.
482 LOGGER.info("Policy does exist: "
483 + outFile.toAbsolutePath().toString());
484 props.setProperty(policy
485 + StdPolicyFinderFactory.PROP_FILE, outFile
486 .toAbsolutePath().toString());
488 // Indicate that there were changes made to the
494 // File does not exist locally, so we need to get it
495 // from the location given in the ".url" property (which
499 // There better be a URL to retrieve it
501 propLocation = props.getProperty(policy
502 + StdPolicyFinderFactory.PROP_URL);
503 if (propLocation != null) {
507 PapUrlResolver papUrls = PapUrlResolver.getInstance();
508 while(papUrls.hasMoreUrls()){
509 String papID = papUrls.getUserId();
510 String papPass = papUrls.getPass();
511 Base64.Encoder encoder = Base64.getEncoder();
512 String encoding = encoder.encodeToString((papID+":"+papPass).getBytes(StandardCharsets.UTF_8));
518 url = new URL(papUrls.getUrl(PapUrlResolver.extractIdFromUrl(propLocation)));
519 LOGGER.info("Pulling " + url.toString());
521 // Open the connection
523 URLConnection urlConnection = url.openConnection();
524 urlConnection.setRequestProperty(XACMLRestProperties.PROP_PDP_HTTP_HEADER_ID,
525 XACMLProperties.getProperty(XACMLRestProperties.PROP_PDP_ID));
526 urlConnection.setRequestProperty("Authorization", "Basic " + encoding);
530 try (InputStream is = urlConnection
532 OutputStream os = new FileOutputStream(
534 IOUtils.copy(is, os);
537 // Now save it in the properties as a .file
539 LOGGER.info("Pulled policy: "
540 + outFile.toAbsolutePath().toString());
541 props.setProperty(policy
542 + StdPolicyFinderFactory.PROP_FILE,
543 outFile.toAbsolutePath().toString());
546 // Indicate that there were changes made to the
550 } catch (Exception e) {
552 if (e instanceof MalformedURLException) {
553 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy '"
555 + "' had bad URL in new configuration, URL='"
556 + propLocation + "'");
559 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error while retrieving policy "
568 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Policy " + policy
569 + " does NOT exist and does NOT have a URL");
578 public static synchronized Path getPDPPolicyCache() throws PAPException {
579 Path config = getPDPConfig();
580 Path policyProperties = Paths.get(config.toAbsolutePath().toString(),
581 "xacml.policy.properties");
582 if (Files.notExists(policyProperties)) {
583 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + policyProperties.toAbsolutePath().toString()
584 + " does NOT exist.");
586 // Try to create the file
589 Files.createFile(policyProperties);
590 } catch (IOException e) {
591 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create policy properties file: "
592 + policyProperties.toAbsolutePath().toString());
593 throw new PAPException(
594 "Failed to create policy properties file: "
595 + policyProperties.toAbsolutePath().toString());
598 return policyProperties;
601 public static synchronized Path getPIPConfig() throws PAPException {
602 Path config = getPDPConfig();
603 Path pipConfigProperties = Paths.get(
604 config.toAbsolutePath().toString(), "xacml.pip.properties");
605 if (Files.notExists(pipConfigProperties)) {
606 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + pipConfigProperties.toAbsolutePath().toString()
607 + " does NOT exist.");
609 // Try to create the file
612 Files.createFile(pipConfigProperties);
613 } catch (IOException e) {
614 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create pip properties file: "
615 + pipConfigProperties.toAbsolutePath().toString());
616 throw new PAPException("Failed to create pip properties file: "
617 + pipConfigProperties.toAbsolutePath().toString());
620 return pipConfigProperties;
623 public static synchronized Path getPDPConfig() throws PAPException {
624 Path config = Paths.get(XACMLProperties
625 .getProperty(XACMLRestProperties.PROP_PDP_CONFIG));
626 if (Files.notExists(config)) {
627 LOGGER.warn(XACMLErrorConstants.ERROR_PROCESS_FLOW + config.toAbsolutePath().toString() + " does NOT exist.");
629 // Try to create the directory
632 Files.createDirectories(config);
633 } catch (IOException e) {
634 LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Failed to create config directory: "
635 + config.toAbsolutePath().toString(), e);
636 throw new PAPException("Failed to create config directory: "
637 + config.toAbsolutePath().toString());