홍길동 / onos

Go to a project
Toggle navigation Toggle navigation pinning
Changhoon Yoon
Committed by Gerrit Code Review
541ef71e 1 parent 52c98bd0

ONOS-1993 Implement API-level permission checking + security util code location replacement 

Change-Id: I7bf20eda9c12ed2a44334504333b093057764cd2
Inline Side-by-side
Showing 30 changed files with 424 additions and 53 deletions
...@@ -15,12 +15,16 @@ ...@@ -15,12 +15,16 @@
15 */ 15 */
16 package org.onosproject.net.packet; 16 package org.onosproject.net.packet;
17 17
18 +import org.onosproject.core.Permission;
18 import org.onosproject.net.flow.DefaultTrafficTreatment; 19 import org.onosproject.net.flow.DefaultTrafficTreatment;
19 import org.onosproject.net.flow.TrafficTreatment; 20 import org.onosproject.net.flow.TrafficTreatment;
20 import org.onosproject.net.flow.TrafficTreatment.Builder; 21 import org.onosproject.net.flow.TrafficTreatment.Builder;
21 22
22 import java.util.concurrent.atomic.AtomicBoolean; 23 import java.util.concurrent.atomic.AtomicBoolean;
23 24
25 +import static org.onosproject.security.AppGuard.checkPermission;
26 +
27 +
24 /** 28 /**
25 * Default implementation of a packet context. 29 * Default implementation of a packet context.
26 */ 30 */
...@@ -53,21 +57,29 @@ public abstract class DefaultPacketContext implements PacketContext { ...@@ -53,21 +57,29 @@ public abstract class DefaultPacketContext implements PacketContext {
53 57
54 @Override 58 @Override
55 public long time() { 59 public long time() {
60 + checkPermission(Permission.PACKET_READ);
61 +
56 return time; 62 return time;
57 } 63 }
58 64
59 @Override 65 @Override
60 public InboundPacket inPacket() { 66 public InboundPacket inPacket() {
67 + checkPermission(Permission.PACKET_READ);
68 +
61 return inPkt; 69 return inPkt;
62 } 70 }
63 71
64 @Override 72 @Override
65 public OutboundPacket outPacket() { 73 public OutboundPacket outPacket() {
74 + checkPermission(Permission.PACKET_READ);
75 +
66 return outPkt; 76 return outPkt;
67 } 77 }
68 78
69 @Override 79 @Override
70 public Builder treatmentBuilder() { 80 public Builder treatmentBuilder() {
81 + checkPermission(Permission.PACKET_READ);
82 +
71 return builder; 83 return builder;
72 } 84 }
73 85
...@@ -76,11 +88,15 @@ public abstract class DefaultPacketContext implements PacketContext { ...@@ -76,11 +88,15 @@ public abstract class DefaultPacketContext implements PacketContext {
76 88
77 @Override 89 @Override
78 public boolean block() { 90 public boolean block() {
91 + checkPermission(Permission.PACKET_WRITE);
92 +
79 return this.block.getAndSet(true); 93 return this.block.getAndSet(true);
80 } 94 }
81 95
82 @Override 96 @Override
83 public boolean isHandled() { 97 public boolean isHandled() {
98 + checkPermission(Permission.PACKET_READ);
99 +
84 return this.block.get(); 100 return this.block.get();
85 } 101 }
86 } 102 }
...\ No newline at end of file ...\ No newline at end of file
......
...@@ -14,21 +14,26 @@ ...@@ -14,21 +14,26 @@
14 * limitations under the License. 14 * limitations under the License.
15 */ 15 */
16 16
17 -package org.onosproject.security.util; 17 +package org.onosproject.security;
18 +
19 +import org.onosproject.core.Permission;
18 20
19 /** 21 /**
20 - * Checks if the caller has the required permission to call each API. 22 + * Aids SM-ONOS to perform API-level permission checking.
21 */ 23 */
22 public final class AppGuard { 24 public final class AppGuard {
23 25
24 private AppGuard() { 26 private AppGuard() {
25 } 27 }
26 28
27 - public static boolean check(String perm) { 29 + /**
30 + * Checks if the caller has the required permission only when security-mode is enabled.
31 + * @param permission permission to be checked
32 + */
33 + public static void checkPermission(Permission permission) {
28 SecurityManager sm = System.getSecurityManager(); 34 SecurityManager sm = System.getSecurityManager();
29 if (sm != null) { 35 if (sm != null) {
30 - System.getSecurityManager().checkPermission(new AppPermission(perm)); 36 + System.getSecurityManager().checkPermission(new AppPermission(permission.name()));
31 } 37 }
32 - return true;
33 } 38 }
34 } 39 }
......
...@@ -14,7 +14,7 @@ ...@@ -14,7 +14,7 @@
14 * limitations under the License. 14 * limitations under the License.
15 */ 15 */
16 16
17 -package org.onosproject.security.util; 17 +package org.onosproject.security;
18 18
19 import java.security.BasicPermission; 19 import java.security.BasicPermission;
20 20
...@@ -23,10 +23,19 @@ import java.security.BasicPermission; ...@@ -23,10 +23,19 @@ import java.security.BasicPermission;
23 */ 23 */
24 public class AppPermission extends BasicPermission { 24 public class AppPermission extends BasicPermission {
25 25
26 + /**
27 + * Creates new application permission using the supplied data.
28 + * @param name permission name
29 + */
26 public AppPermission(String name) { 30 public AppPermission(String name) {
27 super(name.toUpperCase(), ""); 31 super(name.toUpperCase(), "");
28 } 32 }
29 33
34 + /**
35 + * Creates new application permission using the supplied data.
36 + * @param name permission name
37 + * @param actions permission action
38 + */
30 public AppPermission(String name, String actions) { 39 public AppPermission(String name, String actions) {
31 super(name.toUpperCase(), actions); 40 super(name.toUpperCase(), actions);
32 } 41 }
......
...@@ -42,6 +42,7 @@ import java.util.Set; ...@@ -42,6 +42,7 @@ import java.util.Set;
42 42
43 import static com.google.common.base.Preconditions.checkNotNull; 43 import static com.google.common.base.Preconditions.checkNotNull;
44 import static org.onosproject.app.ApplicationEvent.Type.*; 44 import static org.onosproject.app.ApplicationEvent.Type.*;
45 +import static org.onosproject.security.AppGuard.checkPermission;
45 import static org.slf4j.LoggerFactory.getLogger; 46 import static org.slf4j.LoggerFactory.getLogger;
46 47
47 /** 48 /**
...@@ -91,29 +92,39 @@ public class ApplicationManager implements ApplicationService, ApplicationAdminS ...@@ -91,29 +92,39 @@ public class ApplicationManager implements ApplicationService, ApplicationAdminS
91 92
92 @Override 93 @Override
93 public Set<Application> getApplications() { 94 public Set<Application> getApplications() {
95 + checkPermission(Permission.APP_READ);
96 +
94 return store.getApplications(); 97 return store.getApplications();
95 } 98 }
96 99
97 @Override 100 @Override
98 public ApplicationId getId(String name) { 101 public ApplicationId getId(String name) {
102 + checkPermission(Permission.APP_READ);
103 +
99 checkNotNull(name, "Name cannot be null"); 104 checkNotNull(name, "Name cannot be null");
100 return store.getId(name); 105 return store.getId(name);
101 } 106 }
102 107
103 @Override 108 @Override
104 public Application getApplication(ApplicationId appId) { 109 public Application getApplication(ApplicationId appId) {
110 + checkPermission(Permission.APP_READ);
111 +
105 checkNotNull(appId, APP_ID_NULL); 112 checkNotNull(appId, APP_ID_NULL);
106 return store.getApplication(appId); 113 return store.getApplication(appId);
107 } 114 }
108 115
109 @Override 116 @Override
110 public ApplicationState getState(ApplicationId appId) { 117 public ApplicationState getState(ApplicationId appId) {
118 + checkPermission(Permission.APP_READ);
119 +
111 checkNotNull(appId, APP_ID_NULL); 120 checkNotNull(appId, APP_ID_NULL);
112 return store.getState(appId); 121 return store.getState(appId);
113 } 122 }
114 123
115 @Override 124 @Override
116 public Set<Permission> getPermissions(ApplicationId appId) { 125 public Set<Permission> getPermissions(ApplicationId appId) {
126 + checkPermission(Permission.APP_READ);
127 +
117 checkNotNull(appId, APP_ID_NULL); 128 checkNotNull(appId, APP_ID_NULL);
118 return store.getPermissions(appId); 129 return store.getPermissions(appId);
119 } 130 }
...@@ -155,11 +166,15 @@ public class ApplicationManager implements ApplicationService, ApplicationAdminS ...@@ -155,11 +166,15 @@ public class ApplicationManager implements ApplicationService, ApplicationAdminS
155 166
156 @Override 167 @Override
157 public void addListener(ApplicationListener listener) { 168 public void addListener(ApplicationListener listener) {
169 + checkPermission(Permission.APP_EVENT);
170 +
158 listenerRegistry.addListener(listener); 171 listenerRegistry.addListener(listener);
159 } 172 }
160 173
161 @Override 174 @Override
162 public void removeListener(ApplicationListener listener) { 175 public void removeListener(ApplicationListener listener) {
176 + checkPermission(Permission.APP_EVENT);
177 +
163 listenerRegistry.removeListener(listener); 178 listenerRegistry.removeListener(listener);
164 } 179 }
165 180
......
...@@ -28,6 +28,7 @@ import org.onosproject.cfg.ComponentConfigService; ...@@ -28,6 +28,7 @@ import org.onosproject.cfg.ComponentConfigService;
28 import org.onosproject.cfg.ComponentConfigStore; 28 import org.onosproject.cfg.ComponentConfigStore;
29 import org.onosproject.cfg.ComponentConfigStoreDelegate; 29 import org.onosproject.cfg.ComponentConfigStoreDelegate;
30 import org.onosproject.cfg.ConfigProperty; 30 import org.onosproject.cfg.ConfigProperty;
31 +import org.onosproject.core.Permission;
31 import org.osgi.service.cm.Configuration; 32 import org.osgi.service.cm.Configuration;
32 import org.osgi.service.cm.ConfigurationAdmin; 33 import org.osgi.service.cm.ConfigurationAdmin;
33 import org.slf4j.Logger; 34 import org.slf4j.Logger;
...@@ -43,6 +44,8 @@ import java.util.Set; ...@@ -43,6 +44,8 @@ import java.util.Set;
43 import static com.google.common.base.Preconditions.checkArgument; 44 import static com.google.common.base.Preconditions.checkArgument;
44 import static com.google.common.base.Preconditions.checkNotNull; 45 import static com.google.common.base.Preconditions.checkNotNull;
45 import static org.slf4j.LoggerFactory.getLogger; 46 import static org.slf4j.LoggerFactory.getLogger;
47 +import static org.onosproject.security.AppGuard.checkPermission;
48 +
46 49
47 /** 50 /**
48 * Implementation of the centralized component configuration service. 51 * Implementation of the centralized component configuration service.
...@@ -84,11 +87,15 @@ public class ComponentConfigManager implements ComponentConfigService { ...@@ -84,11 +87,15 @@ public class ComponentConfigManager implements ComponentConfigService {
84 87
85 @Override 88 @Override
86 public Set<String> getComponentNames() { 89 public Set<String> getComponentNames() {
90 + checkPermission(Permission.CONFIG_READ);
91 +
87 return ImmutableSet.copyOf(properties.keySet()); 92 return ImmutableSet.copyOf(properties.keySet());
88 } 93 }
89 94
90 @Override 95 @Override
91 public void registerProperties(Class<?> componentClass) { 96 public void registerProperties(Class<?> componentClass) {
97 + checkPermission(Permission.CONFIG_WRITE);
98 +
92 String componentName = componentClass.getName(); 99 String componentName = componentClass.getName();
93 String resourceName = componentClass.getSimpleName() + RESOURCE_EXT; 100 String resourceName = componentClass.getSimpleName() + RESOURCE_EXT;
94 try (InputStream ris = componentClass.getResourceAsStream(resourceName)) { 101 try (InputStream ris = componentClass.getResourceAsStream(resourceName)) {
...@@ -111,6 +118,8 @@ public class ComponentConfigManager implements ComponentConfigService { ...@@ -111,6 +118,8 @@ public class ComponentConfigManager implements ComponentConfigService {
111 118
112 @Override 119 @Override
113 public void unregisterProperties(Class<?> componentClass, boolean clear) { 120 public void unregisterProperties(Class<?> componentClass, boolean clear) {
121 + checkPermission(Permission.CONFIG_WRITE);
122 +
114 String componentName = componentClass.getName(); 123 String componentName = componentClass.getName();
115 checkNotNull(componentName, COMPONENT_NULL); 124 checkNotNull(componentName, COMPONENT_NULL);
116 Map<String, ConfigProperty> cps = properties.remove(componentName); 125 Map<String, ConfigProperty> cps = properties.remove(componentName);
...@@ -127,12 +136,16 @@ public class ComponentConfigManager implements ComponentConfigService { ...@@ -127,12 +136,16 @@ public class ComponentConfigManager implements ComponentConfigService {
127 136
128 @Override 137 @Override
129 public Set<ConfigProperty> getProperties(String componentName) { 138 public Set<ConfigProperty> getProperties(String componentName) {
139 + checkPermission(Permission.CONFIG_READ);
140 +
130 Map<String, ConfigProperty> map = properties.get(componentName); 141 Map<String, ConfigProperty> map = properties.get(componentName);
131 return map != null ? ImmutableSet.copyOf(map.values()) : null; 142 return map != null ? ImmutableSet.copyOf(map.values()) : null;
132 } 143 }
133 144
134 @Override 145 @Override
135 public void setProperty(String componentName, String name, String value) { 146 public void setProperty(String componentName, String name, String value) {
147 + checkPermission(Permission.CONFIG_WRITE);
148 +
136 checkNotNull(componentName, COMPONENT_NULL); 149 checkNotNull(componentName, COMPONENT_NULL);
137 checkNotNull(name, PROPERTY_NULL); 150 checkNotNull(name, PROPERTY_NULL);
138 store.setProperty(componentName, name, value); 151 store.setProperty(componentName, name, value);
...@@ -140,6 +153,8 @@ public class ComponentConfigManager implements ComponentConfigService { ...@@ -140,6 +153,8 @@ public class ComponentConfigManager implements ComponentConfigService {
140 153
141 @Override 154 @Override
142 public void unsetProperty(String componentName, String name) { 155 public void unsetProperty(String componentName, String name) {
156 + checkPermission(Permission.CONFIG_WRITE);
157 +
143 checkNotNull(componentName, COMPONENT_NULL); 158 checkNotNull(componentName, COMPONENT_NULL);
144 checkNotNull(name, PROPERTY_NULL); 159 checkNotNull(name, PROPERTY_NULL);
145 store.unsetProperty(componentName, name); 160 store.unsetProperty(componentName, name);
......
...@@ -33,6 +33,7 @@ import org.onosproject.cluster.ClusterStore; ...@@ -33,6 +33,7 @@ import org.onosproject.cluster.ClusterStore;
33 import org.onosproject.cluster.ClusterStoreDelegate; 33 import org.onosproject.cluster.ClusterStoreDelegate;
34 import org.onosproject.cluster.ControllerNode; 34 import org.onosproject.cluster.ControllerNode;
35 import org.onosproject.cluster.NodeId; 35 import org.onosproject.cluster.NodeId;
36 +import org.onosproject.core.Permission;
36 import org.onosproject.event.ListenerRegistry; 37 import org.onosproject.event.ListenerRegistry;
37 import org.onosproject.event.EventDeliveryService; 38 import org.onosproject.event.EventDeliveryService;
38 import org.slf4j.Logger; 39 import org.slf4j.Logger;
...@@ -42,6 +43,8 @@ import java.util.Set; ...@@ -42,6 +43,8 @@ import java.util.Set;
42 import static com.google.common.base.Preconditions.checkArgument; 43 import static com.google.common.base.Preconditions.checkArgument;
43 import static com.google.common.base.Preconditions.checkNotNull; 44 import static com.google.common.base.Preconditions.checkNotNull;
44 import static org.slf4j.LoggerFactory.getLogger; 45 import static org.slf4j.LoggerFactory.getLogger;
46 +import static org.onosproject.security.AppGuard.checkPermission;
47 +
45 48
46 /** 49 /**
47 * Implementation of the cluster service. 50 * Implementation of the cluster service.
...@@ -88,22 +91,30 @@ public class ClusterManager implements ClusterService, ClusterAdminService { ...@@ -88,22 +91,30 @@ public class ClusterManager implements ClusterService, ClusterAdminService {
88 91
89 @Override 92 @Override
90 public ControllerNode getLocalNode() { 93 public ControllerNode getLocalNode() {
94 + checkPermission(Permission.CLUSTER_READ);
95 +
91 return store.getLocalNode(); 96 return store.getLocalNode();
92 } 97 }
93 98
94 @Override 99 @Override
95 public Set<ControllerNode> getNodes() { 100 public Set<ControllerNode> getNodes() {
101 + checkPermission(Permission.CLUSTER_READ);
102 +
96 return store.getNodes(); 103 return store.getNodes();
97 } 104 }
98 105
99 @Override 106 @Override
100 public ControllerNode getNode(NodeId nodeId) { 107 public ControllerNode getNode(NodeId nodeId) {
108 + checkPermission(Permission.CLUSTER_READ);
109 +
101 checkNotNull(nodeId, INSTANCE_ID_NULL); 110 checkNotNull(nodeId, INSTANCE_ID_NULL);
102 return store.getNode(nodeId); 111 return store.getNode(nodeId);
103 } 112 }
104 113
105 @Override 114 @Override
106 public ControllerNode.State getState(NodeId nodeId) { 115 public ControllerNode.State getState(NodeId nodeId) {
116 + checkPermission(Permission.CLUSTER_READ);
117 +
107 checkNotNull(nodeId, INSTANCE_ID_NULL); 118 checkNotNull(nodeId, INSTANCE_ID_NULL);
108 return store.getState(nodeId); 119 return store.getState(nodeId);
109 } 120 }
...@@ -111,6 +122,8 @@ public class ClusterManager implements ClusterService, ClusterAdminService { ...@@ -111,6 +122,8 @@ public class ClusterManager implements ClusterService, ClusterAdminService {
111 122
112 @Override 123 @Override
113 public DateTime getLastUpdated(NodeId nodeId) { 124 public DateTime getLastUpdated(NodeId nodeId) {
125 + checkPermission(Permission.CLUSTER_READ);
126 +
114 return store.getLastUpdated(nodeId); 127 return store.getLastUpdated(nodeId);
115 } 128 }
116 129
...@@ -144,11 +157,15 @@ public class ClusterManager implements ClusterService, ClusterAdminService { ...@@ -144,11 +157,15 @@ public class ClusterManager implements ClusterService, ClusterAdminService {
144 157
145 @Override 158 @Override
146 public void addListener(ClusterEventListener listener) { 159 public void addListener(ClusterEventListener listener) {
160 + checkPermission(Permission.CLUSTER_EVENT);
161 +
147 listenerRegistry.addListener(listener); 162 listenerRegistry.addListener(listener);
148 } 163 }
149 164
150 @Override 165 @Override
151 public void removeListener(ClusterEventListener listener) { 166 public void removeListener(ClusterEventListener listener) {
167 + checkPermission(Permission.CLUSTER_EVENT);
168 +
152 listenerRegistry.removeListener(listener); 169 listenerRegistry.removeListener(listener);
153 } 170 }
154 171
......
...@@ -32,6 +32,7 @@ import org.onosproject.cluster.ControllerNode; ...@@ -32,6 +32,7 @@ import org.onosproject.cluster.ControllerNode;
32 import org.onosproject.cluster.NodeId; 32 import org.onosproject.cluster.NodeId;
33 import org.onosproject.cluster.RoleInfo; 33 import org.onosproject.cluster.RoleInfo;
34 import org.onosproject.core.MetricsHelper; 34 import org.onosproject.core.MetricsHelper;
35 +import org.onosproject.core.Permission;
35 import org.onosproject.event.ListenerRegistry; 36 import org.onosproject.event.ListenerRegistry;
36 import org.onosproject.event.EventDeliveryService; 37 import org.onosproject.event.EventDeliveryService;
37 import org.onosproject.mastership.MastershipAdminService; 38 import org.onosproject.mastership.MastershipAdminService;
...@@ -62,6 +63,8 @@ import static org.onlab.metrics.MetricsUtil.stopTimer; ...@@ -62,6 +63,8 @@ import static org.onlab.metrics.MetricsUtil.stopTimer;
62 import static org.onosproject.cluster.ControllerNode.State.ACTIVE; 63 import static org.onosproject.cluster.ControllerNode.State.ACTIVE;
63 import static org.onosproject.net.MastershipRole.MASTER; 64 import static org.onosproject.net.MastershipRole.MASTER;
64 import static org.slf4j.LoggerFactory.getLogger; 65 import static org.slf4j.LoggerFactory.getLogger;
66 +import static org.onosproject.security.AppGuard.checkPermission;
67 +
65 68
66 @Component(immediate = true) 69 @Component(immediate = true)
67 @Service 70 @Service
...@@ -142,12 +145,16 @@ public class MastershipManager ...@@ -142,12 +145,16 @@ public class MastershipManager
142 145
143 @Override 146 @Override
144 public MastershipRole getLocalRole(DeviceId deviceId) { 147 public MastershipRole getLocalRole(DeviceId deviceId) {
148 + checkPermission(Permission.CLUSTER_READ);
149 +
145 checkNotNull(deviceId, DEVICE_ID_NULL); 150 checkNotNull(deviceId, DEVICE_ID_NULL);
146 return store.getRole(clusterService.getLocalNode().id(), deviceId); 151 return store.getRole(clusterService.getLocalNode().id(), deviceId);
147 } 152 }
148 153
149 @Override 154 @Override
150 public void relinquishMastership(DeviceId deviceId) { 155 public void relinquishMastership(DeviceId deviceId) {
156 + checkPermission(Permission.CLUSTER_WRITE);
157 +
151 store.relinquishRole(clusterService.getLocalNode().id(), deviceId) 158 store.relinquishRole(clusterService.getLocalNode().id(), deviceId)
152 .whenComplete((event, error) -> { 159 .whenComplete((event, error) -> {
153 if (event != null) { 160 if (event != null) {
...@@ -158,6 +165,8 @@ public class MastershipManager ...@@ -158,6 +165,8 @@ public class MastershipManager
158 165
159 @Override 166 @Override
160 public CompletableFuture<MastershipRole> requestRoleFor(DeviceId deviceId) { 167 public CompletableFuture<MastershipRole> requestRoleFor(DeviceId deviceId) {
168 + checkPermission(Permission.CLUSTER_WRITE);
169 +
161 checkNotNull(deviceId, DEVICE_ID_NULL); 170 checkNotNull(deviceId, DEVICE_ID_NULL);
162 final Context timer = startTimer(requestRoleTimer); 171 final Context timer = startTimer(requestRoleTimer);
163 return store.requestRole(deviceId).whenComplete((result, error) -> stopTimer(timer)); 172 return store.requestRole(deviceId).whenComplete((result, error) -> stopTimer(timer));
...@@ -166,18 +175,24 @@ public class MastershipManager ...@@ -166,18 +175,24 @@ public class MastershipManager
166 175
167 @Override 176 @Override
168 public NodeId getMasterFor(DeviceId deviceId) { 177 public NodeId getMasterFor(DeviceId deviceId) {
178 + checkPermission(Permission.CLUSTER_READ);
179 +
169 checkNotNull(deviceId, DEVICE_ID_NULL); 180 checkNotNull(deviceId, DEVICE_ID_NULL);
170 return store.getMaster(deviceId); 181 return store.getMaster(deviceId);
171 } 182 }
172 183
173 @Override 184 @Override
174 public Set<DeviceId> getDevicesOf(NodeId nodeId) { 185 public Set<DeviceId> getDevicesOf(NodeId nodeId) {
186 + checkPermission(Permission.CLUSTER_READ);
187 +
175 checkNotNull(nodeId, NODE_ID_NULL); 188 checkNotNull(nodeId, NODE_ID_NULL);
176 return store.getDevices(nodeId); 189 return store.getDevices(nodeId);
177 } 190 }
178 191
179 @Override 192 @Override
180 public RoleInfo getNodesFor(DeviceId deviceId) { 193 public RoleInfo getNodesFor(DeviceId deviceId) {
194 + checkPermission(Permission.CLUSTER_READ);
195 +
181 checkNotNull(deviceId, DEVICE_ID_NULL); 196 checkNotNull(deviceId, DEVICE_ID_NULL);
182 return store.getNodes(deviceId); 197 return store.getNodes(deviceId);
183 } 198 }
...@@ -189,12 +204,16 @@ public class MastershipManager ...@@ -189,12 +204,16 @@ public class MastershipManager
189 204
190 @Override 205 @Override
191 public void addListener(MastershipListener listener) { 206 public void addListener(MastershipListener listener) {
207 + checkPermission(Permission.CLUSTER_EVENT);
208 +
192 checkNotNull(listener); 209 checkNotNull(listener);
193 listenerRegistry.addListener(listener); 210 listenerRegistry.addListener(listener);
194 } 211 }
195 212
196 @Override 213 @Override
197 public void removeListener(MastershipListener listener) { 214 public void removeListener(MastershipListener listener) {
215 + checkPermission(Permission.CLUSTER_EVENT);
216 +
198 checkNotNull(listener); 217 checkNotNull(listener);
199 listenerRegistry.removeListener(listener); 218 listenerRegistry.removeListener(listener);
200 } 219 }
......
...@@ -31,6 +31,7 @@ import org.onosproject.core.ApplicationIdStore; ...@@ -31,6 +31,7 @@ import org.onosproject.core.ApplicationIdStore;
31 import org.onosproject.core.CoreService; 31 import org.onosproject.core.CoreService;
32 import org.onosproject.core.IdBlockStore; 32 import org.onosproject.core.IdBlockStore;
33 import org.onosproject.core.IdGenerator; 33 import org.onosproject.core.IdGenerator;
34 +import org.onosproject.core.Permission;
34 import org.onosproject.core.Version; 35 import org.onosproject.core.Version;
35 import org.onosproject.event.EventDeliveryService; 36 import org.onosproject.event.EventDeliveryService;
36 import org.osgi.service.component.ComponentContext; 37 import org.osgi.service.component.ComponentContext;
...@@ -44,6 +45,8 @@ import java.util.Set; ...@@ -44,6 +45,8 @@ import java.util.Set;
44 45
45 import static com.google.common.base.Preconditions.checkNotNull; 46 import static com.google.common.base.Preconditions.checkNotNull;
46 import static com.google.common.base.Strings.isNullOrEmpty; 47 import static com.google.common.base.Strings.isNullOrEmpty;
48 +import static org.onosproject.security.AppGuard.checkPermission;
49 +
47 50
48 /** 51 /**
49 * Core service implementation. 52 * Core service implementation.
...@@ -97,21 +100,29 @@ public class CoreManager implements CoreService { ...@@ -97,21 +100,29 @@ public class CoreManager implements CoreService {
97 100
98 @Override 101 @Override
99 public Version version() { 102 public Version version() {
103 + checkPermission(Permission.APP_READ);
104 +
100 return version; 105 return version;
101 } 106 }
102 107
103 @Override 108 @Override
104 public Set<ApplicationId> getAppIds() { 109 public Set<ApplicationId> getAppIds() {
110 + checkPermission(Permission.APP_READ);
111 +
105 return applicationIdStore.getAppIds(); 112 return applicationIdStore.getAppIds();
106 } 113 }
107 114
108 @Override 115 @Override
109 public ApplicationId getAppId(Short id) { 116 public ApplicationId getAppId(Short id) {
117 + checkPermission(Permission.APP_READ);
118 +
110 return applicationIdStore.getAppId(id); 119 return applicationIdStore.getAppId(id);
111 } 120 }
112 121
113 @Override 122 @Override
114 public ApplicationId getAppId(String name) { 123 public ApplicationId getAppId(String name) {
124 + checkPermission(Permission.APP_READ);
125 +
115 return applicationIdStore.getAppId(name); 126 return applicationIdStore.getAppId(name);
116 } 127 }
117 128
......
...@@ -25,6 +25,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality; ...@@ -25,6 +25,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality;
25 import org.apache.felix.scr.annotations.Service; 25 import org.apache.felix.scr.annotations.Service;
26 import org.onosproject.cluster.ClusterService; 26 import org.onosproject.cluster.ClusterService;
27 import org.onosproject.cluster.NodeId; 27 import org.onosproject.cluster.NodeId;
28 +import org.onosproject.core.Permission;
28 import org.onosproject.event.ListenerRegistry; 29 import org.onosproject.event.ListenerRegistry;
29 import org.onosproject.event.EventDeliveryService; 30 import org.onosproject.event.EventDeliveryService;
30 import org.onosproject.mastership.MastershipEvent; 31 import org.onosproject.mastership.MastershipEvent;
...@@ -68,6 +69,8 @@ import static java.util.concurrent.Executors.newSingleThreadScheduledExecutor; ...@@ -68,6 +69,8 @@ import static java.util.concurrent.Executors.newSingleThreadScheduledExecutor;
68 import static org.onlab.util.Tools.groupedThreads; 69 import static org.onlab.util.Tools.groupedThreads;
69 import static org.onosproject.net.MastershipRole.*; 70 import static org.onosproject.net.MastershipRole.*;
70 import static org.slf4j.LoggerFactory.getLogger; 71 import static org.slf4j.LoggerFactory.getLogger;
72 +import static org.onosproject.security.AppGuard.checkPermission;
73 +
71 74
72 /** 75 /**
73 * Provides implementation of the device SB &amp; NB APIs. 76 * Provides implementation of the device SB &amp; NB APIs.
...@@ -148,45 +151,61 @@ public class DeviceManager ...@@ -148,45 +151,61 @@ public class DeviceManager
148 151
149 @Override 152 @Override
150 public int getDeviceCount() { 153 public int getDeviceCount() {
154 + checkPermission(Permission.DEVICE_READ);
155 +
151 return store.getDeviceCount(); 156 return store.getDeviceCount();
152 } 157 }
153 158
154 @Override 159 @Override
155 public Iterable<Device> getDevices() { 160 public Iterable<Device> getDevices() {
161 + checkPermission(Permission.DEVICE_READ);
162 +
156 return store.getDevices(); 163 return store.getDevices();
157 } 164 }
158 165
159 @Override 166 @Override
160 public Iterable<Device> getAvailableDevices() { 167 public Iterable<Device> getAvailableDevices() {
168 + checkPermission(Permission.DEVICE_READ);
169 +
161 return store.getAvailableDevices(); 170 return store.getAvailableDevices();
162 } 171 }
163 172
164 @Override 173 @Override
165 public Device getDevice(DeviceId deviceId) { 174 public Device getDevice(DeviceId deviceId) {
175 + checkPermission(Permission.DEVICE_READ);
176 +
166 checkNotNull(deviceId, DEVICE_ID_NULL); 177 checkNotNull(deviceId, DEVICE_ID_NULL);
167 return store.getDevice(deviceId); 178 return store.getDevice(deviceId);
168 } 179 }
169 180
170 @Override 181 @Override
171 public MastershipRole getRole(DeviceId deviceId) { 182 public MastershipRole getRole(DeviceId deviceId) {
183 + checkPermission(Permission.DEVICE_READ);
184 +
172 checkNotNull(deviceId, DEVICE_ID_NULL); 185 checkNotNull(deviceId, DEVICE_ID_NULL);
173 return mastershipService.getLocalRole(deviceId); 186 return mastershipService.getLocalRole(deviceId);
174 } 187 }
175 188
176 @Override 189 @Override
177 public List<Port> getPorts(DeviceId deviceId) { 190 public List<Port> getPorts(DeviceId deviceId) {
191 + checkPermission(Permission.DEVICE_READ);
192 +
178 checkNotNull(deviceId, DEVICE_ID_NULL); 193 checkNotNull(deviceId, DEVICE_ID_NULL);
179 return store.getPorts(deviceId); 194 return store.getPorts(deviceId);
180 } 195 }
181 196
182 @Override 197 @Override
183 public List<PortStatistics> getPortStatistics(DeviceId deviceId) { 198 public List<PortStatistics> getPortStatistics(DeviceId deviceId) {
199 + checkPermission(Permission.DEVICE_READ);
200 +
184 checkNotNull(deviceId, DEVICE_ID_NULL); 201 checkNotNull(deviceId, DEVICE_ID_NULL);
185 return store.getPortStatistics(deviceId); 202 return store.getPortStatistics(deviceId);
186 } 203 }
187 204
188 @Override 205 @Override
189 public Port getPort(DeviceId deviceId, PortNumber portNumber) { 206 public Port getPort(DeviceId deviceId, PortNumber portNumber) {
207 + checkPermission(Permission.DEVICE_READ);
208 +
190 checkNotNull(deviceId, DEVICE_ID_NULL); 209 checkNotNull(deviceId, DEVICE_ID_NULL);
191 checkNotNull(portNumber, PORT_NUMBER_NULL); 210 checkNotNull(portNumber, PORT_NUMBER_NULL);
192 return store.getPort(deviceId, portNumber); 211 return store.getPort(deviceId, portNumber);
...@@ -194,6 +213,8 @@ public class DeviceManager ...@@ -194,6 +213,8 @@ public class DeviceManager
194 213
195 @Override 214 @Override
196 public boolean isAvailable(DeviceId deviceId) { 215 public boolean isAvailable(DeviceId deviceId) {
216 + checkPermission(Permission.DEVICE_READ);
217 +
197 checkNotNull(deviceId, DEVICE_ID_NULL); 218 checkNotNull(deviceId, DEVICE_ID_NULL);
198 return store.isAvailable(deviceId); 219 return store.isAvailable(deviceId);
199 } 220 }
...@@ -224,11 +245,15 @@ public class DeviceManager ...@@ -224,11 +245,15 @@ public class DeviceManager
224 245
225 @Override 246 @Override
226 public void addListener(DeviceListener listener) { 247 public void addListener(DeviceListener listener) {
248 + checkPermission(Permission.DEVICE_EVENT);
249 +
227 listenerRegistry.addListener(listener); 250 listenerRegistry.addListener(listener);
228 } 251 }
229 252
230 @Override 253 @Override
231 public void removeListener(DeviceListener listener) { 254 public void removeListener(DeviceListener listener) {
255 + checkPermission(Permission.DEVICE_EVENT);
256 +
232 listenerRegistry.removeListener(listener); 257 listenerRegistry.removeListener(listener);
233 } 258 }
234 259
......
...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate; ...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate;
24 import org.apache.felix.scr.annotations.Reference; 24 import org.apache.felix.scr.annotations.Reference;
25 import org.apache.felix.scr.annotations.ReferenceCardinality; 25 import org.apache.felix.scr.annotations.ReferenceCardinality;
26 import org.apache.felix.scr.annotations.Service; 26 import org.apache.felix.scr.annotations.Service;
27 +import org.onosproject.core.Permission;
27 import org.onosproject.net.Device; 28 import org.onosproject.net.Device;
28 import org.onosproject.net.DeviceId; 29 import org.onosproject.net.DeviceId;
29 import org.onosproject.net.device.DeviceService; 30 import org.onosproject.net.device.DeviceService;
...@@ -45,6 +46,8 @@ import java.util.stream.Collectors; ...@@ -45,6 +46,8 @@ import java.util.stream.Collectors;
45 46
46 import static org.onlab.util.Tools.nullIsNotFound; 47 import static org.onlab.util.Tools.nullIsNotFound;
47 import static org.onosproject.net.AnnotationKeys.DRIVER; 48 import static org.onosproject.net.AnnotationKeys.DRIVER;
49 +import static org.onosproject.security.AppGuard.checkPermission;
50 +
48 51
49 /** 52 /**
50 * Manages inventory of device drivers. 53 * Manages inventory of device drivers.
...@@ -105,6 +108,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS ...@@ -105,6 +108,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS
105 108
106 @Override 109 @Override
107 public Set<Driver> getDrivers() { 110 public Set<Driver> getDrivers() {
111 + checkPermission(Permission.DRIVER_READ);
112 +
108 ImmutableSet.Builder<Driver> builder = ImmutableSet.builder(); 113 ImmutableSet.Builder<Driver> builder = ImmutableSet.builder();
109 drivers.values().forEach(builder::add); 114 drivers.values().forEach(builder::add);
110 return builder.build(); 115 return builder.build();
...@@ -112,6 +117,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS ...@@ -112,6 +117,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS
112 117
113 @Override 118 @Override
114 public Set<Driver> getDrivers(Class<? extends Behaviour> withBehaviour) { 119 public Set<Driver> getDrivers(Class<? extends Behaviour> withBehaviour) {
120 + checkPermission(Permission.DRIVER_READ);
121 +
115 return drivers.values().stream() 122 return drivers.values().stream()
116 .filter(d -> d.hasBehaviour(withBehaviour)) 123 .filter(d -> d.hasBehaviour(withBehaviour))
117 .collect(Collectors.toSet()); 124 .collect(Collectors.toSet());
...@@ -119,11 +126,15 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS ...@@ -119,11 +126,15 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS
119 126
120 @Override 127 @Override
121 public Driver getDriver(String driverName) { 128 public Driver getDriver(String driverName) {
129 + checkPermission(Permission.DRIVER_READ);
130 +
122 return nullIsNotFound(drivers.get(driverName), NO_DRIVER); 131 return nullIsNotFound(drivers.get(driverName), NO_DRIVER);
123 } 132 }
124 133
125 @Override 134 @Override
126 public Driver getDriver(String mfr, String hw, String sw) { 135 public Driver getDriver(String mfr, String hw, String sw) {
136 + checkPermission(Permission.DRIVER_READ);
137 +
127 // First attempt a literal search. 138 // First attempt a literal search.
128 Driver driver = driverByKey.get(key(mfr, hw, sw)); 139 Driver driver = driverByKey.get(key(mfr, hw, sw));
129 if (driver != null) { 140 if (driver != null) {
...@@ -149,6 +160,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS ...@@ -149,6 +160,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS
149 160
150 @Override 161 @Override
151 public Driver getDriver(DeviceId deviceId) { 162 public Driver getDriver(DeviceId deviceId) {
163 + checkPermission(Permission.DRIVER_READ);
164 +
152 Device device = nullIsNotFound(deviceService.getDevice(deviceId), NO_DEVICE); 165 Device device = nullIsNotFound(deviceService.getDevice(deviceId), NO_DEVICE);
153 String driverName = device.annotations().value(DRIVER); 166 String driverName = device.annotations().value(DRIVER);
154 if (driverName != null) { 167 if (driverName != null) {
...@@ -161,6 +174,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS ...@@ -161,6 +174,8 @@ public class DriverManager extends DefaultDriverProvider implements DriverAdminS
161 174
162 @Override 175 @Override
163 public DriverHandler createHandler(DeviceId deviceId, String... credentials) { 176 public DriverHandler createHandler(DeviceId deviceId, String... credentials) {
177 + checkPermission(Permission.DRIVER_WRITE);
178 +
164 Driver driver = getDriver(deviceId); 179 Driver driver = getDriver(deviceId);
165 return new DefaultDriverHandler(new DefaultDriverData(driver)); 180 return new DefaultDriverHandler(new DefaultDriverData(driver));
166 } 181 }
......
...@@ -35,6 +35,7 @@ import org.onosproject.cfg.ComponentConfigService; ...@@ -35,6 +35,7 @@ import org.onosproject.cfg.ComponentConfigService;
35 import org.onosproject.core.ApplicationId; 35 import org.onosproject.core.ApplicationId;
36 import org.onosproject.core.CoreService; 36 import org.onosproject.core.CoreService;
37 import org.onosproject.core.IdGenerator; 37 import org.onosproject.core.IdGenerator;
38 +import org.onosproject.core.Permission;
38 import org.onosproject.event.ListenerRegistry; 39 import org.onosproject.event.ListenerRegistry;
39 import org.onosproject.event.EventDeliveryService; 40 import org.onosproject.event.EventDeliveryService;
40 import org.onosproject.net.Device; 41 import org.onosproject.net.Device;
...@@ -77,6 +78,8 @@ import java.util.concurrent.atomic.AtomicBoolean; ...@@ -77,6 +78,8 @@ import java.util.concurrent.atomic.AtomicBoolean;
77 import static com.google.common.base.Preconditions.checkNotNull; 78 import static com.google.common.base.Preconditions.checkNotNull;
78 import static org.onlab.util.Tools.groupedThreads; 79 import static org.onlab.util.Tools.groupedThreads;
79 import static org.slf4j.LoggerFactory.getLogger; 80 import static org.slf4j.LoggerFactory.getLogger;
81 +import static org.onosproject.security.AppGuard.checkPermission;
82 +
80 83
81 /** 84 /**
82 * Provides implementation of the flow NB &amp; SB APIs. 85 * Provides implementation of the flow NB &amp; SB APIs.
...@@ -167,16 +170,22 @@ public class FlowRuleManager ...@@ -167,16 +170,22 @@ public class FlowRuleManager
167 170
168 @Override 171 @Override
169 public int getFlowRuleCount() { 172 public int getFlowRuleCount() {
173 + checkPermission(Permission.FLOWRULE_READ);
174 +
170 return store.getFlowRuleCount(); 175 return store.getFlowRuleCount();
171 } 176 }
172 177
173 @Override 178 @Override
174 public Iterable<FlowEntry> getFlowEntries(DeviceId deviceId) { 179 public Iterable<FlowEntry> getFlowEntries(DeviceId deviceId) {
180 + checkPermission(Permission.FLOWRULE_READ);
181 +
175 return store.getFlowEntries(deviceId); 182 return store.getFlowEntries(deviceId);
176 } 183 }
177 184
178 @Override 185 @Override
179 public void applyFlowRules(FlowRule... flowRules) { 186 public void applyFlowRules(FlowRule... flowRules) {
187 + checkPermission(Permission.FLOWRULE_WRITE);
188 +
180 FlowRuleOperations.Builder builder = FlowRuleOperations.builder(); 189 FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
181 for (int i = 0; i < flowRules.length; i++) { 190 for (int i = 0; i < flowRules.length; i++) {
182 builder.add(flowRules[i]); 191 builder.add(flowRules[i]);
...@@ -186,6 +195,8 @@ public class FlowRuleManager ...@@ -186,6 +195,8 @@ public class FlowRuleManager
186 195
187 @Override 196 @Override
188 public void removeFlowRules(FlowRule... flowRules) { 197 public void removeFlowRules(FlowRule... flowRules) {
198 + checkPermission(Permission.FLOWRULE_WRITE);
199 +
189 FlowRuleOperations.Builder builder = FlowRuleOperations.builder(); 200 FlowRuleOperations.Builder builder = FlowRuleOperations.builder();
190 for (int i = 0; i < flowRules.length; i++) { 201 for (int i = 0; i < flowRules.length; i++) {
191 builder.remove(flowRules[i]); 202 builder.remove(flowRules[i]);
...@@ -195,11 +206,15 @@ public class FlowRuleManager ...@@ -195,11 +206,15 @@ public class FlowRuleManager
195 206
196 @Override 207 @Override
197 public void removeFlowRulesById(ApplicationId id) { 208 public void removeFlowRulesById(ApplicationId id) {
209 + checkPermission(Permission.FLOWRULE_WRITE);
210 +
198 removeFlowRules(Iterables.toArray(getFlowRulesById(id), FlowRule.class)); 211 removeFlowRules(Iterables.toArray(getFlowRulesById(id), FlowRule.class));
199 } 212 }
200 213
201 @Override 214 @Override
202 public Iterable<FlowRule> getFlowRulesById(ApplicationId id) { 215 public Iterable<FlowRule> getFlowRulesById(ApplicationId id) {
216 + checkPermission(Permission.FLOWRULE_READ);
217 +
203 Set<FlowRule> flowEntries = Sets.newHashSet(); 218 Set<FlowRule> flowEntries = Sets.newHashSet();
204 for (Device d : deviceService.getDevices()) { 219 for (Device d : deviceService.getDevices()) {
205 for (FlowEntry flowEntry : store.getFlowEntries(d.id())) { 220 for (FlowEntry flowEntry : store.getFlowEntries(d.id())) {
...@@ -213,6 +228,8 @@ public class FlowRuleManager ...@@ -213,6 +228,8 @@ public class FlowRuleManager
213 228
214 @Override 229 @Override
215 public Iterable<FlowRule> getFlowRulesByGroupId(ApplicationId appId, short groupId) { 230 public Iterable<FlowRule> getFlowRulesByGroupId(ApplicationId appId, short groupId) {
231 + checkPermission(Permission.FLOWRULE_READ);
232 +
216 Set<FlowRule> matches = Sets.newHashSet(); 233 Set<FlowRule> matches = Sets.newHashSet();
217 long toLookUp = ((long) appId.id() << 16) | groupId; 234 long toLookUp = ((long) appId.id() << 16) | groupId;
218 for (Device d : deviceService.getDevices()) { 235 for (Device d : deviceService.getDevices()) {
...@@ -227,16 +244,22 @@ public class FlowRuleManager ...@@ -227,16 +244,22 @@ public class FlowRuleManager
227 244
228 @Override 245 @Override
229 public void apply(FlowRuleOperations ops) { 246 public void apply(FlowRuleOperations ops) {
247 + checkPermission(Permission.FLOWRULE_WRITE);
248 +
230 operationsService.submit(new FlowOperationsProcessor(ops)); 249 operationsService.submit(new FlowOperationsProcessor(ops));
231 } 250 }
232 251
233 @Override 252 @Override
234 public void addListener(FlowRuleListener listener) { 253 public void addListener(FlowRuleListener listener) {
254 + checkPermission(Permission.FLOWRULE_EVENT);
255 +
235 listenerRegistry.addListener(listener); 256 listenerRegistry.addListener(listener);
236 } 257 }
237 258
238 @Override 259 @Override
239 public void removeListener(FlowRuleListener listener) { 260 public void removeListener(FlowRuleListener listener) {
261 + checkPermission(Permission.FLOWRULE_EVENT);
262 +
240 listenerRegistry.removeListener(listener); 263 listenerRegistry.removeListener(listener);
241 } 264 }
242 265
......
...@@ -27,6 +27,7 @@ import org.onlab.osgi.DefaultServiceDirectory; ...@@ -27,6 +27,7 @@ import org.onlab.osgi.DefaultServiceDirectory;
27 import org.onlab.osgi.ServiceDirectory; 27 import org.onlab.osgi.ServiceDirectory;
28 import org.onlab.util.ItemNotFoundException; 28 import org.onlab.util.ItemNotFoundException;
29 import org.onosproject.cluster.ClusterService; 29 import org.onosproject.cluster.ClusterService;
30 +import org.onosproject.core.Permission;
30 import org.onosproject.mastership.MastershipEvent; 31 import org.onosproject.mastership.MastershipEvent;
31 import org.onosproject.mastership.MastershipListener; 32 import org.onosproject.mastership.MastershipListener;
32 import org.onosproject.mastership.MastershipService; 33 import org.onosproject.mastership.MastershipService;
...@@ -59,6 +60,8 @@ import java.util.concurrent.ExecutorService; ...@@ -59,6 +60,8 @@ import java.util.concurrent.ExecutorService;
59 60
60 import static java.util.concurrent.Executors.newFixedThreadPool; 61 import static java.util.concurrent.Executors.newFixedThreadPool;
61 import static org.onlab.util.Tools.groupedThreads; 62 import static org.onlab.util.Tools.groupedThreads;
63 +import static org.onosproject.security.AppGuard.checkPermission;
64 +
62 65
63 /** 66 /**
64 * Provides implementation of the flow objective programming service. 67 * Provides implementation of the flow objective programming service.
...@@ -212,11 +215,15 @@ public class FlowObjectiveManager implements FlowObjectiveService { ...@@ -212,11 +215,15 @@ public class FlowObjectiveManager implements FlowObjectiveService {
212 215
213 @Override 216 @Override
214 public void filter(DeviceId deviceId, FilteringObjective filteringObjective) { 217 public void filter(DeviceId deviceId, FilteringObjective filteringObjective) {
218 + checkPermission(Permission.FLOWRULE_WRITE);
219 +
215 executorService.submit(new ObjectiveInstaller(deviceId, filteringObjective)); 220 executorService.submit(new ObjectiveInstaller(deviceId, filteringObjective));
216 } 221 }
217 222
218 @Override 223 @Override
219 public void forward(DeviceId deviceId, ForwardingObjective forwardingObjective) { 224 public void forward(DeviceId deviceId, ForwardingObjective forwardingObjective) {
225 + checkPermission(Permission.FLOWRULE_WRITE);
226 +
220 if (queueObjective(deviceId, forwardingObjective)) { 227 if (queueObjective(deviceId, forwardingObjective)) {
221 return; 228 return;
222 } 229 }
...@@ -225,11 +232,15 @@ public class FlowObjectiveManager implements FlowObjectiveService { ...@@ -225,11 +232,15 @@ public class FlowObjectiveManager implements FlowObjectiveService {
225 232
226 @Override 233 @Override
227 public void next(DeviceId deviceId, NextObjective nextObjective) { 234 public void next(DeviceId deviceId, NextObjective nextObjective) {
235 + checkPermission(Permission.FLOWRULE_WRITE);
236 +
228 executorService.submit(new ObjectiveInstaller(deviceId, nextObjective)); 237 executorService.submit(new ObjectiveInstaller(deviceId, nextObjective));
229 } 238 }
230 239
231 @Override 240 @Override
232 public int allocateNextId() { 241 public int allocateNextId() {
242 + checkPermission(Permission.FLOWRULE_WRITE);
243 +
233 return flowObjectiveStore.allocateNextId(); 244 return flowObjectiveStore.allocateNextId();
234 } 245 }
235 246
......
...@@ -27,6 +27,7 @@ import org.apache.felix.scr.annotations.Reference; ...@@ -27,6 +27,7 @@ import org.apache.felix.scr.annotations.Reference;
27 import org.apache.felix.scr.annotations.ReferenceCardinality; 27 import org.apache.felix.scr.annotations.ReferenceCardinality;
28 import org.apache.felix.scr.annotations.Service; 28 import org.apache.felix.scr.annotations.Service;
29 import org.onosproject.core.ApplicationId; 29 import org.onosproject.core.ApplicationId;
30 +import org.onosproject.core.Permission;
30 import org.onosproject.event.EventDeliveryService; 31 import org.onosproject.event.EventDeliveryService;
31 import org.onosproject.event.ListenerRegistry; 32 import org.onosproject.event.ListenerRegistry;
32 import org.onosproject.net.DeviceId; 33 import org.onosproject.net.DeviceId;
...@@ -52,6 +53,9 @@ import org.onosproject.net.provider.AbstractProviderRegistry; ...@@ -52,6 +53,9 @@ import org.onosproject.net.provider.AbstractProviderRegistry;
52 import org.onosproject.net.provider.AbstractProviderService; 53 import org.onosproject.net.provider.AbstractProviderService;
53 import org.slf4j.Logger; 54 import org.slf4j.Logger;
54 55
56 +import static org.onosproject.security.AppGuard.checkPermission;
57 +
58 +
55 /** 59 /**
56 * Provides implementation of the group service APIs. 60 * Provides implementation of the group service APIs.
57 */ 61 */
...@@ -100,6 +104,8 @@ public class GroupManager ...@@ -100,6 +104,8 @@ public class GroupManager
100 */ 104 */
101 @Override 105 @Override
102 public void addGroup(GroupDescription groupDesc) { 106 public void addGroup(GroupDescription groupDesc) {
107 + checkPermission(Permission.GROUP_WRITE);
108 +
103 log.trace("In addGroup API"); 109 log.trace("In addGroup API");
104 store.storeGroupDescription(groupDesc); 110 store.storeGroupDescription(groupDesc);
105 } 111 }
...@@ -119,6 +125,8 @@ public class GroupManager ...@@ -119,6 +125,8 @@ public class GroupManager
119 */ 125 */
120 @Override 126 @Override
121 public Group getGroup(DeviceId deviceId, GroupKey appCookie) { 127 public Group getGroup(DeviceId deviceId, GroupKey appCookie) {
128 + checkPermission(Permission.GROUP_READ);
129 +
122 log.trace("In getGroup API"); 130 log.trace("In getGroup API");
123 return store.getGroup(deviceId, appCookie); 131 return store.getGroup(deviceId, appCookie);
124 } 132 }
...@@ -141,6 +149,8 @@ public class GroupManager ...@@ -141,6 +149,8 @@ public class GroupManager
141 GroupBuckets buckets, 149 GroupBuckets buckets,
142 GroupKey newCookie, 150 GroupKey newCookie,
143 ApplicationId appId) { 151 ApplicationId appId) {
152 + checkPermission(Permission.GROUP_WRITE);
153 +
144 log.trace("In addBucketsToGroup API"); 154 log.trace("In addBucketsToGroup API");
145 store.updateGroupDescription(deviceId, 155 store.updateGroupDescription(deviceId,
146 oldCookie, 156 oldCookie,
...@@ -167,6 +177,8 @@ public class GroupManager ...@@ -167,6 +177,8 @@ public class GroupManager
167 GroupBuckets buckets, 177 GroupBuckets buckets,
168 GroupKey newCookie, 178 GroupKey newCookie,
169 ApplicationId appId) { 179 ApplicationId appId) {
180 + checkPermission(Permission.GROUP_WRITE);
181 +
170 log.trace("In removeBucketsFromGroup API"); 182 log.trace("In removeBucketsFromGroup API");
171 store.updateGroupDescription(deviceId, 183 store.updateGroupDescription(deviceId,
172 oldCookie, 184 oldCookie,
...@@ -189,6 +201,8 @@ public class GroupManager ...@@ -189,6 +201,8 @@ public class GroupManager
189 public void removeGroup(DeviceId deviceId, 201 public void removeGroup(DeviceId deviceId,
190 GroupKey appCookie, 202 GroupKey appCookie,
191 ApplicationId appId) { 203 ApplicationId appId) {
204 + checkPermission(Permission.GROUP_WRITE);
205 +
192 log.trace("In removeGroup API"); 206 log.trace("In removeGroup API");
193 store.deleteGroupDescription(deviceId, appCookie); 207 store.deleteGroupDescription(deviceId, appCookie);
194 } 208 }
...@@ -204,12 +218,16 @@ public class GroupManager ...@@ -204,12 +218,16 @@ public class GroupManager
204 @Override 218 @Override
205 public Iterable<Group> getGroups(DeviceId deviceId, 219 public Iterable<Group> getGroups(DeviceId deviceId,
206 ApplicationId appId) { 220 ApplicationId appId) {
221 + checkPermission(Permission.GROUP_READ);
222 +
207 log.trace("In getGroups API"); 223 log.trace("In getGroups API");
208 return store.getGroups(deviceId); 224 return store.getGroups(deviceId);
209 } 225 }
210 226
211 @Override 227 @Override
212 public Iterable<Group> getGroups(DeviceId deviceId) { 228 public Iterable<Group> getGroups(DeviceId deviceId) {
229 + checkPermission(Permission.GROUP_READ);
230 +
213 log.trace("In getGroups API"); 231 log.trace("In getGroups API");
214 return store.getGroups(deviceId); 232 return store.getGroups(deviceId);
215 } 233 }
...@@ -221,6 +239,8 @@ public class GroupManager ...@@ -221,6 +239,8 @@ public class GroupManager
221 */ 239 */
222 @Override 240 @Override
223 public void addListener(GroupListener listener) { 241 public void addListener(GroupListener listener) {
242 + checkPermission(Permission.GROUP_EVENT);
243 +
224 log.trace("In addListener API"); 244 log.trace("In addListener API");
225 listenerRegistry.addListener(listener); 245 listenerRegistry.addListener(listener);
226 } 246 }
...@@ -232,6 +252,8 @@ public class GroupManager ...@@ -232,6 +252,8 @@ public class GroupManager
232 */ 252 */
233 @Override 253 @Override
234 public void removeListener(GroupListener listener) { 254 public void removeListener(GroupListener listener) {
255 + checkPermission(Permission.GROUP_EVENT);
256 +
235 log.trace("In removeListener API"); 257 log.trace("In removeListener API");
236 listenerRegistry.removeListener(listener); 258 listenerRegistry.removeListener(listener);
237 } 259 }
......
...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Service; ...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Service;
24 import org.onlab.packet.IpAddress; 24 import org.onlab.packet.IpAddress;
25 import org.onlab.packet.MacAddress; 25 import org.onlab.packet.MacAddress;
26 import org.onlab.packet.VlanId; 26 import org.onlab.packet.VlanId;
27 +import org.onosproject.core.Permission;
27 import org.onosproject.event.EventDeliveryService; 28 import org.onosproject.event.EventDeliveryService;
28 import org.onosproject.event.ListenerRegistry; 29 import org.onosproject.event.ListenerRegistry;
29 import org.onosproject.net.ConnectPoint; 30 import org.onosproject.net.ConnectPoint;
...@@ -51,6 +52,8 @@ import java.util.Set; ...@@ -51,6 +52,8 @@ import java.util.Set;
51 52
52 import static com.google.common.base.Preconditions.checkNotNull; 53 import static com.google.common.base.Preconditions.checkNotNull;
53 import static org.slf4j.LoggerFactory.getLogger; 54 import static org.slf4j.LoggerFactory.getLogger;
55 +import static org.onosproject.security.AppGuard.checkPermission;
56 +
54 57
55 /** 58 /**
56 * Provides basic implementation of the host SB &amp; NB APIs. 59 * Provides basic implementation of the host SB &amp; NB APIs.
...@@ -109,56 +112,76 @@ public class HostManager ...@@ -109,56 +112,76 @@ public class HostManager
109 112
110 @Override 113 @Override
111 public int getHostCount() { 114 public int getHostCount() {
115 + checkPermission(Permission.HOST_READ);
116 +
112 return store.getHostCount(); 117 return store.getHostCount();
113 } 118 }
114 119
115 @Override 120 @Override
116 public Iterable<Host> getHosts() { 121 public Iterable<Host> getHosts() {
122 + checkPermission(Permission.HOST_READ);
123 +
117 return store.getHosts(); 124 return store.getHosts();
118 } 125 }
119 126
120 @Override 127 @Override
121 public Host getHost(HostId hostId) { 128 public Host getHost(HostId hostId) {
129 + checkPermission(Permission.HOST_READ);
130 +
122 checkNotNull(hostId, HOST_ID_NULL); 131 checkNotNull(hostId, HOST_ID_NULL);
123 return store.getHost(hostId); 132 return store.getHost(hostId);
124 } 133 }
125 134
126 @Override 135 @Override
127 public Set<Host> getHostsByVlan(VlanId vlanId) { 136 public Set<Host> getHostsByVlan(VlanId vlanId) {
137 + checkPermission(Permission.HOST_READ);
138 +
128 return store.getHosts(vlanId); 139 return store.getHosts(vlanId);
129 } 140 }
130 141
131 @Override 142 @Override
132 public Set<Host> getHostsByMac(MacAddress mac) { 143 public Set<Host> getHostsByMac(MacAddress mac) {
144 + checkPermission(Permission.HOST_READ);
145 +
133 checkNotNull(mac, "MAC address cannot be null"); 146 checkNotNull(mac, "MAC address cannot be null");
134 return store.getHosts(mac); 147 return store.getHosts(mac);
135 } 148 }
136 149
137 @Override 150 @Override
138 public Set<Host> getHostsByIp(IpAddress ip) { 151 public Set<Host> getHostsByIp(IpAddress ip) {
152 + checkPermission(Permission.HOST_READ);
153 +
139 checkNotNull(ip, "IP address cannot be null"); 154 checkNotNull(ip, "IP address cannot be null");
140 return store.getHosts(ip); 155 return store.getHosts(ip);
141 } 156 }
142 157
143 @Override 158 @Override
144 public Set<Host> getConnectedHosts(ConnectPoint connectPoint) { 159 public Set<Host> getConnectedHosts(ConnectPoint connectPoint) {
160 + checkPermission(Permission.HOST_READ);
161 +
145 checkNotNull(connectPoint, "Connection point cannot be null"); 162 checkNotNull(connectPoint, "Connection point cannot be null");
146 return store.getConnectedHosts(connectPoint); 163 return store.getConnectedHosts(connectPoint);
147 } 164 }
148 165
149 @Override 166 @Override
150 public Set<Host> getConnectedHosts(DeviceId deviceId) { 167 public Set<Host> getConnectedHosts(DeviceId deviceId) {
168 + checkPermission(Permission.HOST_READ);
169 +
151 checkNotNull(deviceId, "Device ID cannot be null"); 170 checkNotNull(deviceId, "Device ID cannot be null");
152 return store.getConnectedHosts(deviceId); 171 return store.getConnectedHosts(deviceId);
153 } 172 }
154 173
155 @Override 174 @Override
156 public void startMonitoringIp(IpAddress ip) { 175 public void startMonitoringIp(IpAddress ip) {
176 + checkPermission(Permission.HOST_EVENT);
177 +
157 monitor.addMonitoringFor(ip); 178 monitor.addMonitoringFor(ip);
158 } 179 }
159 180
160 @Override 181 @Override
161 public void stopMonitoringIp(IpAddress ip) { 182 public void stopMonitoringIp(IpAddress ip) {
183 + checkPermission(Permission.HOST_EVENT);
184 +
162 monitor.stopMonitoring(ip); 185 monitor.stopMonitoring(ip);
163 } 186 }
164 187
...@@ -169,11 +192,15 @@ public class HostManager ...@@ -169,11 +192,15 @@ public class HostManager
169 192
170 @Override 193 @Override
171 public void addListener(HostListener listener) { 194 public void addListener(HostListener listener) {
195 + checkPermission(Permission.HOST_EVENT);
196 +
172 listenerRegistry.addListener(listener); 197 listenerRegistry.addListener(listener);
173 } 198 }
174 199
175 @Override 200 @Override
176 public void removeListener(HostListener listener) { 201 public void removeListener(HostListener listener) {
202 + checkPermission(Permission.HOST_EVENT);
203 +
177 listenerRegistry.removeListener(listener); 204 listenerRegistry.removeListener(listener);
178 } 205 }
179 206
...@@ -203,11 +230,15 @@ public class HostManager ...@@ -203,11 +230,15 @@ public class HostManager
203 230
204 @Override 231 @Override
205 public Set<PortAddresses> getAddressBindings() { 232 public Set<PortAddresses> getAddressBindings() {
233 + checkPermission(Permission.HOST_READ);
234 +
206 return store.getAddressBindings(); 235 return store.getAddressBindings();
207 } 236 }
208 237
209 @Override 238 @Override
210 public Set<PortAddresses> getAddressBindingsForPort(ConnectPoint connectPoint) { 239 public Set<PortAddresses> getAddressBindingsForPort(ConnectPoint connectPoint) {
240 + checkPermission(Permission.HOST_READ);
241 +
211 return store.getAddressBindingsForPort(connectPoint); 242 return store.getAddressBindingsForPort(connectPoint);
212 } 243 }
213 244
......
...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality; ...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality;
24 import org.apache.felix.scr.annotations.Service; 24 import org.apache.felix.scr.annotations.Service;
25 import org.onosproject.core.CoreService; 25 import org.onosproject.core.CoreService;
26 import org.onosproject.core.IdGenerator; 26 import org.onosproject.core.IdGenerator;
27 +import org.onosproject.core.Permission;
27 import org.onosproject.event.ListenerRegistry; 28 import org.onosproject.event.ListenerRegistry;
28 import org.onosproject.event.EventDeliveryService; 29 import org.onosproject.event.EventDeliveryService;
29 import org.onosproject.net.flow.FlowRule; 30 import org.onosproject.net.flow.FlowRule;
...@@ -65,6 +66,8 @@ import static org.onlab.util.Tools.groupedThreads; ...@@ -65,6 +66,8 @@ import static org.onlab.util.Tools.groupedThreads;
65 import static org.onosproject.net.intent.IntentState.*; 66 import static org.onosproject.net.intent.IntentState.*;
66 import static org.onosproject.net.intent.impl.phase.IntentProcessPhase.newInitialPhase; 67 import static org.onosproject.net.intent.impl.phase.IntentProcessPhase.newInitialPhase;
67 import static org.slf4j.LoggerFactory.getLogger; 68 import static org.slf4j.LoggerFactory.getLogger;
69 +import static org.onosproject.security.AppGuard.checkPermission;
70 +
68 71
69 /** 72 /**
70 * An implementation of Intent Manager. 73 * An implementation of Intent Manager.
...@@ -139,6 +142,8 @@ public class IntentManager ...@@ -139,6 +142,8 @@ public class IntentManager
139 142
140 @Override 143 @Override
141 public void submit(Intent intent) { 144 public void submit(Intent intent) {
145 + checkPermission(Permission.INTENT_WRITE);
146 +
142 checkNotNull(intent, INTENT_NULL); 147 checkNotNull(intent, INTENT_NULL);
143 IntentData data = new IntentData(intent, IntentState.INSTALL_REQ, null); 148 IntentData data = new IntentData(intent, IntentState.INSTALL_REQ, null);
144 store.addPending(data); 149 store.addPending(data);
...@@ -146,6 +151,8 @@ public class IntentManager ...@@ -146,6 +151,8 @@ public class IntentManager
146 151
147 @Override 152 @Override
148 public void withdraw(Intent intent) { 153 public void withdraw(Intent intent) {
154 + checkPermission(Permission.INTENT_WRITE);
155 +
149 checkNotNull(intent, INTENT_NULL); 156 checkNotNull(intent, INTENT_NULL);
150 IntentData data = new IntentData(intent, IntentState.WITHDRAW_REQ, null); 157 IntentData data = new IntentData(intent, IntentState.WITHDRAW_REQ, null);
151 store.addPending(data); 158 store.addPending(data);
...@@ -153,6 +160,8 @@ public class IntentManager ...@@ -153,6 +160,8 @@ public class IntentManager
153 160
154 @Override 161 @Override
155 public void purge(Intent intent) { 162 public void purge(Intent intent) {
163 + checkPermission(Permission.INTENT_WRITE);
164 +
156 checkNotNull(intent, INTENT_NULL); 165 checkNotNull(intent, INTENT_NULL);
157 IntentData data = new IntentData(intent, IntentState.PURGE_REQ, null); 166 IntentData data = new IntentData(intent, IntentState.PURGE_REQ, null);
158 store.addPending(data); 167 store.addPending(data);
...@@ -160,43 +169,59 @@ public class IntentManager ...@@ -160,43 +169,59 @@ public class IntentManager
160 169
161 @Override 170 @Override
162 public Intent getIntent(Key key) { 171 public Intent getIntent(Key key) {
172 + checkPermission(Permission.INTENT_READ);
173 +
163 return store.getIntent(key); 174 return store.getIntent(key);
164 } 175 }
165 176
166 @Override 177 @Override
167 public Iterable<Intent> getIntents() { 178 public Iterable<Intent> getIntents() {
179 + checkPermission(Permission.INTENT_READ);
180 +
168 return store.getIntents(); 181 return store.getIntents();
169 } 182 }
170 183
171 @Override 184 @Override
172 public long getIntentCount() { 185 public long getIntentCount() {
186 + checkPermission(Permission.INTENT_READ);
187 +
173 return store.getIntentCount(); 188 return store.getIntentCount();
174 } 189 }
175 190
176 @Override 191 @Override
177 public IntentState getIntentState(Key intentKey) { 192 public IntentState getIntentState(Key intentKey) {
193 + checkPermission(Permission.INTENT_READ);
194 +
178 checkNotNull(intentKey, INTENT_ID_NULL); 195 checkNotNull(intentKey, INTENT_ID_NULL);
179 return store.getIntentState(intentKey); 196 return store.getIntentState(intentKey);
180 } 197 }
181 198
182 @Override 199 @Override
183 public List<Intent> getInstallableIntents(Key intentKey) { 200 public List<Intent> getInstallableIntents(Key intentKey) {
201 + checkPermission(Permission.INTENT_READ);
202 +
184 checkNotNull(intentKey, INTENT_ID_NULL); 203 checkNotNull(intentKey, INTENT_ID_NULL);
185 return store.getInstallableIntents(intentKey); 204 return store.getInstallableIntents(intentKey);
186 } 205 }
187 206
188 @Override 207 @Override
189 public boolean isLocal(Key intentKey) { 208 public boolean isLocal(Key intentKey) {
209 + checkPermission(Permission.INTENT_READ);
210 +
190 return store.isMaster(intentKey); 211 return store.isMaster(intentKey);
191 } 212 }
192 213
193 @Override 214 @Override
194 public void addListener(IntentListener listener) { 215 public void addListener(IntentListener listener) {
216 + checkPermission(Permission.INTENT_EVENT);
217 +
195 listenerRegistry.addListener(listener); 218 listenerRegistry.addListener(listener);
196 } 219 }
197 220
198 @Override 221 @Override
199 public void removeListener(IntentListener listener) { 222 public void removeListener(IntentListener listener) {
223 + checkPermission(Permission.INTENT_EVENT);
224 +
200 listenerRegistry.removeListener(listener); 225 listenerRegistry.removeListener(listener);
201 } 226 }
202 227
...@@ -217,6 +242,8 @@ public class IntentManager ...@@ -217,6 +242,8 @@ public class IntentManager
217 242
218 @Override 243 @Override
219 public Iterable<Intent> getPending() { 244 public Iterable<Intent> getPending() {
245 + checkPermission(Permission.INTENT_READ);
246 +
220 return store.getPending(); 247 return store.getPending();
221 } 248 }
222 249
......
...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate; ...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate;
24 import org.apache.felix.scr.annotations.Reference; 24 import org.apache.felix.scr.annotations.Reference;
25 import org.apache.felix.scr.annotations.ReferenceCardinality; 25 import org.apache.felix.scr.annotations.ReferenceCardinality;
26 import org.apache.felix.scr.annotations.Service; 26 import org.apache.felix.scr.annotations.Service;
27 +import org.onosproject.core.Permission;
27 import org.onosproject.event.EventDeliveryService; 28 import org.onosproject.event.EventDeliveryService;
28 import org.onosproject.event.ListenerRegistry; 29 import org.onosproject.event.ListenerRegistry;
29 import org.onosproject.net.ConnectPoint; 30 import org.onosproject.net.ConnectPoint;
...@@ -52,6 +53,8 @@ import java.util.Set; ...@@ -52,6 +53,8 @@ import java.util.Set;
52 53
53 import static com.google.common.base.Preconditions.checkNotNull; 54 import static com.google.common.base.Preconditions.checkNotNull;
54 import static org.slf4j.LoggerFactory.getLogger; 55 import static org.slf4j.LoggerFactory.getLogger;
56 +import static org.onosproject.security.AppGuard.checkPermission;
57 +
55 58
56 /** 59 /**
57 * Provides basic implementation of the link SB &amp; NB APIs. 60 * Provides basic implementation of the link SB &amp; NB APIs.
...@@ -102,16 +105,22 @@ public class LinkManager ...@@ -102,16 +105,22 @@ public class LinkManager
102 105
103 @Override 106 @Override
104 public int getLinkCount() { 107 public int getLinkCount() {
108 + checkPermission(Permission.LINK_READ);
109 +
105 return store.getLinkCount(); 110 return store.getLinkCount();
106 } 111 }
107 112
108 @Override 113 @Override
109 public Iterable<Link> getLinks() { 114 public Iterable<Link> getLinks() {
115 + checkPermission(Permission.LINK_READ);
116 +
110 return store.getLinks(); 117 return store.getLinks();
111 } 118 }
112 119
113 @Override 120 @Override
114 public Iterable<Link> getActiveLinks() { 121 public Iterable<Link> getActiveLinks() {
122 + checkPermission(Permission.LINK_READ);
123 +
115 return FluentIterable.from(getLinks()) 124 return FluentIterable.from(getLinks())
116 .filter(new Predicate<Link>() { 125 .filter(new Predicate<Link>() {
117 126
...@@ -124,6 +133,8 @@ public class LinkManager ...@@ -124,6 +133,8 @@ public class LinkManager
124 133
125 @Override 134 @Override
126 public Set<Link> getDeviceLinks(DeviceId deviceId) { 135 public Set<Link> getDeviceLinks(DeviceId deviceId) {
136 + checkPermission(Permission.LINK_READ);
137 +
127 checkNotNull(deviceId, DEVICE_ID_NULL); 138 checkNotNull(deviceId, DEVICE_ID_NULL);
128 return Sets.union(store.getDeviceEgressLinks(deviceId), 139 return Sets.union(store.getDeviceEgressLinks(deviceId),
129 store.getDeviceIngressLinks(deviceId)); 140 store.getDeviceIngressLinks(deviceId));
...@@ -131,18 +142,24 @@ public class LinkManager ...@@ -131,18 +142,24 @@ public class LinkManager
131 142
132 @Override 143 @Override
133 public Set<Link> getDeviceEgressLinks(DeviceId deviceId) { 144 public Set<Link> getDeviceEgressLinks(DeviceId deviceId) {
145 + checkPermission(Permission.LINK_READ);
146 +
134 checkNotNull(deviceId, DEVICE_ID_NULL); 147 checkNotNull(deviceId, DEVICE_ID_NULL);
135 return store.getDeviceEgressLinks(deviceId); 148 return store.getDeviceEgressLinks(deviceId);
136 } 149 }
137 150
138 @Override 151 @Override
139 public Set<Link> getDeviceIngressLinks(DeviceId deviceId) { 152 public Set<Link> getDeviceIngressLinks(DeviceId deviceId) {
153 + checkPermission(Permission.LINK_READ);
154 +
140 checkNotNull(deviceId, DEVICE_ID_NULL); 155 checkNotNull(deviceId, DEVICE_ID_NULL);
141 return store.getDeviceIngressLinks(deviceId); 156 return store.getDeviceIngressLinks(deviceId);
142 } 157 }
143 158
144 @Override 159 @Override
145 public Set<Link> getLinks(ConnectPoint connectPoint) { 160 public Set<Link> getLinks(ConnectPoint connectPoint) {
161 + checkPermission(Permission.LINK_READ);
162 +
146 checkNotNull(connectPoint, CONNECT_POINT_NULL); 163 checkNotNull(connectPoint, CONNECT_POINT_NULL);
147 return Sets.union(store.getEgressLinks(connectPoint), 164 return Sets.union(store.getEgressLinks(connectPoint),
148 store.getIngressLinks(connectPoint)); 165 store.getIngressLinks(connectPoint));
...@@ -150,18 +167,24 @@ public class LinkManager ...@@ -150,18 +167,24 @@ public class LinkManager
150 167
151 @Override 168 @Override
152 public Set<Link> getEgressLinks(ConnectPoint connectPoint) { 169 public Set<Link> getEgressLinks(ConnectPoint connectPoint) {
170 + checkPermission(Permission.LINK_READ);
171 +
153 checkNotNull(connectPoint, CONNECT_POINT_NULL); 172 checkNotNull(connectPoint, CONNECT_POINT_NULL);
154 return store.getEgressLinks(connectPoint); 173 return store.getEgressLinks(connectPoint);
155 } 174 }
156 175
157 @Override 176 @Override
158 public Set<Link> getIngressLinks(ConnectPoint connectPoint) { 177 public Set<Link> getIngressLinks(ConnectPoint connectPoint) {
178 + checkPermission(Permission.LINK_READ);
179 +
159 checkNotNull(connectPoint, CONNECT_POINT_NULL); 180 checkNotNull(connectPoint, CONNECT_POINT_NULL);
160 return store.getIngressLinks(connectPoint); 181 return store.getIngressLinks(connectPoint);
161 } 182 }
162 183
163 @Override 184 @Override
164 public Link getLink(ConnectPoint src, ConnectPoint dst) { 185 public Link getLink(ConnectPoint src, ConnectPoint dst) {
186 + checkPermission(Permission.LINK_READ);
187 +
165 checkNotNull(src, CONNECT_POINT_NULL); 188 checkNotNull(src, CONNECT_POINT_NULL);
166 checkNotNull(dst, CONNECT_POINT_NULL); 189 checkNotNull(dst, CONNECT_POINT_NULL);
167 return store.getLink(src, dst); 190 return store.getLink(src, dst);
...@@ -185,11 +208,15 @@ public class LinkManager ...@@ -185,11 +208,15 @@ public class LinkManager
185 208
186 @Override 209 @Override
187 public void addListener(LinkListener listener) { 210 public void addListener(LinkListener listener) {
211 + checkPermission(Permission.LINK_EVENT);
212 +
188 listenerRegistry.addListener(listener); 213 listenerRegistry.addListener(listener);
189 } 214 }
190 215
191 @Override 216 @Override
192 public void removeListener(LinkListener listener) { 217 public void removeListener(LinkListener listener) {
218 + checkPermission(Permission.LINK_EVENT);
219 +
193 listenerRegistry.removeListener(listener); 220 listenerRegistry.removeListener(listener);
194 } 221 }
195 222
......
...@@ -23,6 +23,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality; ...@@ -23,6 +23,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality;
23 import org.apache.felix.scr.annotations.Service; 23 import org.apache.felix.scr.annotations.Service;
24 import org.onosproject.core.ApplicationId; 24 import org.onosproject.core.ApplicationId;
25 import org.onosproject.core.CoreService; 25 import org.onosproject.core.CoreService;
26 +import org.onosproject.core.Permission;
26 import org.onosproject.net.Device; 27 import org.onosproject.net.Device;
27 import org.onosproject.net.device.DeviceEvent; 28 import org.onosproject.net.device.DeviceEvent;
28 import org.onosproject.net.device.DeviceListener; 29 import org.onosproject.net.device.DeviceListener;
...@@ -60,6 +61,8 @@ import java.util.concurrent.ConcurrentHashMap; ...@@ -60,6 +61,8 @@ import java.util.concurrent.ConcurrentHashMap;
60 61
61 import static com.google.common.base.Preconditions.checkNotNull; 62 import static com.google.common.base.Preconditions.checkNotNull;
62 import static org.slf4j.LoggerFactory.getLogger; 63 import static org.slf4j.LoggerFactory.getLogger;
64 +import static org.onosproject.security.AppGuard.checkPermission;
65 +
63 66
64 /** 67 /**
65 * Provides a basic implementation of the packet SB &amp; NB APIs. 68 * Provides a basic implementation of the packet SB &amp; NB APIs.
...@@ -113,12 +116,16 @@ public class PacketManager ...@@ -113,12 +116,16 @@ public class PacketManager
113 116
114 @Override 117 @Override
115 public void addProcessor(PacketProcessor processor, int priority) { 118 public void addProcessor(PacketProcessor processor, int priority) {
119 + checkPermission(Permission.PACKET_EVENT);
120 +
116 checkNotNull(processor, "Processor cannot be null"); 121 checkNotNull(processor, "Processor cannot be null");
117 processors.put(priority, processor); 122 processors.put(priority, processor);
118 } 123 }
119 124
120 @Override 125 @Override
121 public void removeProcessor(PacketProcessor processor) { 126 public void removeProcessor(PacketProcessor processor) {
127 + checkPermission(Permission.PACKET_EVENT);
128 +
122 checkNotNull(processor, "Processor cannot be null"); 129 checkNotNull(processor, "Processor cannot be null");
123 processors.values().remove(processor); 130 processors.values().remove(processor);
124 } 131 }
...@@ -126,6 +133,8 @@ public class PacketManager ...@@ -126,6 +133,8 @@ public class PacketManager
126 @Override 133 @Override
127 public void requestPackets(TrafficSelector selector, PacketPriority priority, 134 public void requestPackets(TrafficSelector selector, PacketPriority priority,
128 ApplicationId appId) { 135 ApplicationId appId) {
136 + checkPermission(Permission.PACKET_READ);
137 +
129 checkNotNull(selector, "Selector cannot be null"); 138 checkNotNull(selector, "Selector cannot be null");
130 checkNotNull(appId, "Application ID cannot be null"); 139 checkNotNull(appId, "Application ID cannot be null");
131 140
...@@ -140,6 +149,8 @@ public class PacketManager ...@@ -140,6 +149,8 @@ public class PacketManager
140 @Override 149 @Override
141 public void requestPackets(TrafficSelector selector, PacketPriority priority, 150 public void requestPackets(TrafficSelector selector, PacketPriority priority,
142 ApplicationId appId, FlowRule.Type tableType) { 151 ApplicationId appId, FlowRule.Type tableType) {
152 + checkPermission(Permission.PACKET_READ);
153 +
143 checkNotNull(selector, "Selector cannot be null"); 154 checkNotNull(selector, "Selector cannot be null");
144 checkNotNull(appId, "Application ID cannot be null"); 155 checkNotNull(appId, "Application ID cannot be null");
145 checkNotNull(tableType, "Table Type cannot be null. For requesting packets +" 156 checkNotNull(tableType, "Table Type cannot be null. For requesting packets +"
...@@ -205,6 +216,8 @@ public class PacketManager ...@@ -205,6 +216,8 @@ public class PacketManager
205 216
206 @Override 217 @Override
207 public void emit(OutboundPacket packet) { 218 public void emit(OutboundPacket packet) {
219 + checkPermission(Permission.PACKET_WRITE);
220 +
208 checkNotNull(packet, "Packet cannot be null"); 221 checkNotNull(packet, "Packet cannot be null");
209 222
210 store.emit(packet); 223 store.emit(packet);
......
...@@ -36,6 +36,7 @@ import org.onlab.packet.VlanId; ...@@ -36,6 +36,7 @@ import org.onlab.packet.VlanId;
36 import org.onlab.packet.ndp.NeighborAdvertisement; 36 import org.onlab.packet.ndp.NeighborAdvertisement;
37 import org.onlab.packet.ndp.NeighborDiscoveryOptions; 37 import org.onlab.packet.ndp.NeighborDiscoveryOptions;
38 import org.onlab.packet.ndp.NeighborSolicitation; 38 import org.onlab.packet.ndp.NeighborSolicitation;
39 +import org.onosproject.core.Permission;
39 import org.onosproject.net.ConnectPoint; 40 import org.onosproject.net.ConnectPoint;
40 import org.onosproject.net.Device; 41 import org.onosproject.net.Device;
41 import org.onosproject.net.Host; 42 import org.onosproject.net.Host;
...@@ -70,6 +71,8 @@ import java.util.Set; ...@@ -70,6 +71,8 @@ import java.util.Set;
70 import static com.google.common.base.Preconditions.checkArgument; 71 import static com.google.common.base.Preconditions.checkArgument;
71 import static com.google.common.base.Preconditions.checkNotNull; 72 import static com.google.common.base.Preconditions.checkNotNull;
72 import static org.slf4j.LoggerFactory.getLogger; 73 import static org.slf4j.LoggerFactory.getLogger;
74 +import static org.onosproject.security.AppGuard.checkPermission;
75 +
73 76
74 @Component(immediate = true) 77 @Component(immediate = true)
75 @Service 78 @Service
...@@ -123,6 +126,8 @@ public class ProxyArpManager implements ProxyArpService { ...@@ -123,6 +126,8 @@ public class ProxyArpManager implements ProxyArpService {
123 126
124 @Override 127 @Override
125 public boolean isKnown(IpAddress addr) { 128 public boolean isKnown(IpAddress addr) {
129 + checkPermission(Permission.PACKET_READ);
130 +
126 checkNotNull(addr, MAC_ADDR_NULL); 131 checkNotNull(addr, MAC_ADDR_NULL);
127 Set<Host> hosts = hostService.getHostsByIp(addr); 132 Set<Host> hosts = hostService.getHostsByIp(addr);
128 return !hosts.isEmpty(); 133 return !hosts.isEmpty();
...@@ -130,6 +135,8 @@ public class ProxyArpManager implements ProxyArpService { ...@@ -130,6 +135,8 @@ public class ProxyArpManager implements ProxyArpService {
130 135
131 @Override 136 @Override
132 public void reply(Ethernet eth, ConnectPoint inPort) { 137 public void reply(Ethernet eth, ConnectPoint inPort) {
138 + checkPermission(Permission.PACKET_WRITE);
139 +
133 checkNotNull(eth, REQUEST_NULL); 140 checkNotNull(eth, REQUEST_NULL);
134 141
135 if (eth.getEtherType() == Ethernet.TYPE_ARP) { 142 if (eth.getEtherType() == Ethernet.TYPE_ARP) {
...@@ -353,6 +360,8 @@ public class ProxyArpManager implements ProxyArpService { ...@@ -353,6 +360,8 @@ public class ProxyArpManager implements ProxyArpService {
353 360
354 @Override 361 @Override
355 public void forward(Ethernet eth, ConnectPoint inPort) { 362 public void forward(Ethernet eth, ConnectPoint inPort) {
363 + checkPermission(Permission.PACKET_WRITE);
364 +
356 checkNotNull(eth, REQUEST_NULL); 365 checkNotNull(eth, REQUEST_NULL);
357 366
358 Host h = hostService.getHost(HostId.hostId(eth.getDestinationMAC(), 367 Host h = hostService.getHost(HostId.hostId(eth.getDestinationMAC(),
...@@ -371,6 +380,8 @@ public class ProxyArpManager implements ProxyArpService { ...@@ -371,6 +380,8 @@ public class ProxyArpManager implements ProxyArpService {
371 380
372 @Override 381 @Override
373 public boolean handlePacket(PacketContext context) { 382 public boolean handlePacket(PacketContext context) {
383 + checkPermission(Permission.PACKET_WRITE);
384 +
374 InboundPacket pkt = context.inPacket(); 385 InboundPacket pkt = context.inPacket();
375 Ethernet ethPkt = pkt.parsed(); 386 Ethernet ethPkt = pkt.parsed();
376 387
......
...@@ -21,6 +21,7 @@ import org.apache.felix.scr.annotations.Deactivate; ...@@ -21,6 +21,7 @@ import org.apache.felix.scr.annotations.Deactivate;
21 import org.apache.felix.scr.annotations.Reference; 21 import org.apache.felix.scr.annotations.Reference;
22 import org.apache.felix.scr.annotations.ReferenceCardinality; 22 import org.apache.felix.scr.annotations.ReferenceCardinality;
23 import org.apache.felix.scr.annotations.Service; 23 import org.apache.felix.scr.annotations.Service;
24 +import org.onosproject.core.Permission;
24 import org.onosproject.event.ListenerRegistry; 25 import org.onosproject.event.ListenerRegistry;
25 import org.onosproject.event.EventDeliveryService; 26 import org.onosproject.event.EventDeliveryService;
26 import org.onosproject.net.Link; 27 import org.onosproject.net.Link;
...@@ -56,6 +57,8 @@ import java.util.Set; ...@@ -56,6 +57,8 @@ import java.util.Set;
56 import static com.google.common.base.Preconditions.checkArgument; 57 import static com.google.common.base.Preconditions.checkArgument;
57 import static com.google.common.base.Preconditions.checkNotNull; 58 import static com.google.common.base.Preconditions.checkNotNull;
58 import static org.slf4j.LoggerFactory.getLogger; 59 import static org.slf4j.LoggerFactory.getLogger;
60 +import static org.onosproject.security.AppGuard.checkPermission;
61 +
59 62
60 /** 63 /**
61 * Provides basic implementation of link resources allocation. 64 * Provides basic implementation of link resources allocation.
...@@ -150,6 +153,8 @@ public class LinkResourceManager implements LinkResourceService { ...@@ -150,6 +153,8 @@ public class LinkResourceManager implements LinkResourceService {
150 153
151 @Override 154 @Override
152 public LinkResourceAllocations requestResources(LinkResourceRequest req) { 155 public LinkResourceAllocations requestResources(LinkResourceRequest req) {
156 + checkPermission(Permission.LINK_WRITE);
157 +
153 // TODO Concatenate multiple bandwidth requests. 158 // TODO Concatenate multiple bandwidth requests.
154 // TODO Support multiple lambda resource requests. 159 // TODO Support multiple lambda resource requests.
155 // TODO Throw appropriate exception. 160 // TODO Throw appropriate exception.
...@@ -211,6 +216,8 @@ public class LinkResourceManager implements LinkResourceService { ...@@ -211,6 +216,8 @@ public class LinkResourceManager implements LinkResourceService {
211 216
212 @Override 217 @Override
213 public void releaseResources(LinkResourceAllocations allocations) { 218 public void releaseResources(LinkResourceAllocations allocations) {
219 + checkPermission(Permission.LINK_WRITE);
220 +
214 final LinkResourceEvent event = store.releaseResources(allocations); 221 final LinkResourceEvent event = store.releaseResources(allocations);
215 if (event != null) { 222 if (event != null) {
216 post(event); 223 post(event);
...@@ -220,27 +227,37 @@ public class LinkResourceManager implements LinkResourceService { ...@@ -220,27 +227,37 @@ public class LinkResourceManager implements LinkResourceService {
220 @Override 227 @Override
221 public LinkResourceAllocations updateResources(LinkResourceRequest req, 228 public LinkResourceAllocations updateResources(LinkResourceRequest req,
222 LinkResourceAllocations oldAllocations) { 229 LinkResourceAllocations oldAllocations) {
230 + checkPermission(Permission.LINK_WRITE);
231 +
223 releaseResources(oldAllocations); 232 releaseResources(oldAllocations);
224 return requestResources(req); 233 return requestResources(req);
225 } 234 }
226 235
227 @Override 236 @Override
228 public Iterable<LinkResourceAllocations> getAllocations() { 237 public Iterable<LinkResourceAllocations> getAllocations() {
238 + checkPermission(Permission.LINK_READ);
239 +
229 return store.getAllocations(); 240 return store.getAllocations();
230 } 241 }
231 242
232 @Override 243 @Override
233 public Iterable<LinkResourceAllocations> getAllocations(Link link) { 244 public Iterable<LinkResourceAllocations> getAllocations(Link link) {
245 + checkPermission(Permission.LINK_READ);
246 +
234 return store.getAllocations(link); 247 return store.getAllocations(link);
235 } 248 }
236 249
237 @Override 250 @Override
238 public LinkResourceAllocations getAllocations(IntentId intentId) { 251 public LinkResourceAllocations getAllocations(IntentId intentId) {
252 + checkPermission(Permission.LINK_READ);
253 +
239 return store.getAllocations(intentId); 254 return store.getAllocations(intentId);
240 } 255 }
241 256
242 @Override 257 @Override
243 public Iterable<ResourceRequest> getAvailableResources(Link link) { 258 public Iterable<ResourceRequest> getAvailableResources(Link link) {
259 + checkPermission(Permission.LINK_READ);
260 +
244 Set<ResourceAllocation> freeRes = store.getFreeResources(link); 261 Set<ResourceAllocation> freeRes = store.getFreeResources(link);
245 Set<ResourceRequest> result = new HashSet<>(); 262 Set<ResourceRequest> result = new HashSet<>();
246 for (ResourceAllocation alloc : freeRes) { 263 for (ResourceAllocation alloc : freeRes) {
...@@ -265,6 +282,8 @@ public class LinkResourceManager implements LinkResourceService { ...@@ -265,6 +282,8 @@ public class LinkResourceManager implements LinkResourceService {
265 @Override 282 @Override
266 public Iterable<ResourceRequest> getAvailableResources(Link link, 283 public Iterable<ResourceRequest> getAvailableResources(Link link,
267 LinkResourceAllocations allocations) { 284 LinkResourceAllocations allocations) {
285 + checkPermission(Permission.LINK_READ);
286 +
268 Set<ResourceRequest> result = new HashSet<>(); 287 Set<ResourceRequest> result = new HashSet<>();
269 Set<ResourceAllocation> allocatedRes = allocations.getResourceAllocation(link); 288 Set<ResourceAllocation> allocatedRes = allocations.getResourceAllocation(link);
270 result = (Set<ResourceRequest>) getAvailableResources(link); 289 result = (Set<ResourceRequest>) getAvailableResources(link);
...@@ -274,11 +293,15 @@ public class LinkResourceManager implements LinkResourceService { ...@@ -274,11 +293,15 @@ public class LinkResourceManager implements LinkResourceService {
274 293
275 @Override 294 @Override
276 public void addListener(LinkResourceListener listener) { 295 public void addListener(LinkResourceListener listener) {
296 + checkPermission(Permission.LINK_EVENT);
297 +
277 listenerRegistry.addListener(listener); 298 listenerRegistry.addListener(listener);
278 } 299 }
279 300
280 @Override 301 @Override
281 public void removeListener(LinkResourceListener listener) { 302 public void removeListener(LinkResourceListener listener) {
303 + checkPermission(Permission.LINK_EVENT);
304 +
282 listenerRegistry.removeListener(listener); 305 listenerRegistry.removeListener(listener);
283 } 306 }
284 307
......
...@@ -27,6 +27,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality; ...@@ -27,6 +27,7 @@ import org.apache.felix.scr.annotations.ReferenceCardinality;
27 import org.apache.felix.scr.annotations.Service; 27 import org.apache.felix.scr.annotations.Service;
28 import org.onosproject.core.ApplicationId; 28 import org.onosproject.core.ApplicationId;
29 import org.onosproject.core.GroupId; 29 import org.onosproject.core.GroupId;
30 +import org.onosproject.core.Permission;
30 import org.onosproject.net.ConnectPoint; 31 import org.onosproject.net.ConnectPoint;
31 import org.onosproject.net.Link; 32 import org.onosproject.net.Link;
32 import org.onosproject.net.Path; 33 import org.onosproject.net.Path;
...@@ -49,6 +50,8 @@ import java.util.Set; ...@@ -49,6 +50,8 @@ import java.util.Set;
49 50
50 import static com.google.common.base.Preconditions.checkNotNull; 51 import static com.google.common.base.Preconditions.checkNotNull;
51 import static org.slf4j.LoggerFactory.getLogger; 52 import static org.slf4j.LoggerFactory.getLogger;
53 +import static org.onosproject.security.AppGuard.checkPermission;
54 +
52 55
53 /** 56 /**
54 * Provides an implementation of the Statistic Service. 57 * Provides an implementation of the Statistic Service.
...@@ -83,11 +86,15 @@ public class StatisticManager implements StatisticService { ...@@ -83,11 +86,15 @@ public class StatisticManager implements StatisticService {
83 86
84 @Override 87 @Override
85 public Load load(Link link) { 88 public Load load(Link link) {
89 + checkPermission(Permission.STATISTIC_READ);
90 +
86 return load(link.src()); 91 return load(link.src());
87 } 92 }
88 93
89 @Override 94 @Override
90 public Load load(Link link, ApplicationId appId, Optional<GroupId> groupId) { 95 public Load load(Link link, ApplicationId appId, Optional<GroupId> groupId) {
96 + checkPermission(Permission.STATISTIC_READ);
97 +
91 Statistics stats = getStatistics(link.src()); 98 Statistics stats = getStatistics(link.src());
92 if (!stats.isValid()) { 99 if (!stats.isValid()) {
93 return new DefaultLoad(); 100 return new DefaultLoad();
...@@ -107,11 +114,15 @@ public class StatisticManager implements StatisticService { ...@@ -107,11 +114,15 @@ public class StatisticManager implements StatisticService {
107 114
108 @Override 115 @Override
109 public Load load(ConnectPoint connectPoint) { 116 public Load load(ConnectPoint connectPoint) {
117 + checkPermission(Permission.STATISTIC_READ);
118 +
110 return loadInternal(connectPoint); 119 return loadInternal(connectPoint);
111 } 120 }
112 121
113 @Override 122 @Override
114 public Link max(Path path) { 123 public Link max(Path path) {
124 + checkPermission(Permission.STATISTIC_READ);
125 +
115 if (path.links().isEmpty()) { 126 if (path.links().isEmpty()) {
116 return null; 127 return null;
117 } 128 }
...@@ -129,6 +140,8 @@ public class StatisticManager implements StatisticService { ...@@ -129,6 +140,8 @@ public class StatisticManager implements StatisticService {
129 140
130 @Override 141 @Override
131 public Link min(Path path) { 142 public Link min(Path path) {
143 + checkPermission(Permission.STATISTIC_READ);
144 +
132 if (path.links().isEmpty()) { 145 if (path.links().isEmpty()) {
133 return null; 146 return null;
134 } 147 }
...@@ -146,6 +159,8 @@ public class StatisticManager implements StatisticService { ...@@ -146,6 +159,8 @@ public class StatisticManager implements StatisticService {
146 159
147 @Override 160 @Override
148 public FlowRule highestHitter(ConnectPoint connectPoint) { 161 public FlowRule highestHitter(ConnectPoint connectPoint) {
162 + checkPermission(Permission.STATISTIC_READ);
163 +
149 Set<FlowEntry> hitters = statisticStore.getCurrentStatistic(connectPoint); 164 Set<FlowEntry> hitters = statisticStore.getCurrentStatistic(connectPoint);
150 if (hitters.isEmpty()) { 165 if (hitters.isEmpty()) {
151 return null; 166 return null;
......
...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate; ...@@ -24,6 +24,7 @@ import org.apache.felix.scr.annotations.Deactivate;
24 import org.apache.felix.scr.annotations.Reference; 24 import org.apache.felix.scr.annotations.Reference;
25 import org.apache.felix.scr.annotations.ReferenceCardinality; 25 import org.apache.felix.scr.annotations.ReferenceCardinality;
26 import org.apache.felix.scr.annotations.Service; 26 import org.apache.felix.scr.annotations.Service;
27 +import org.onosproject.core.Permission;
27 import org.onosproject.net.ConnectPoint; 28 import org.onosproject.net.ConnectPoint;
28 import org.onosproject.net.DefaultEdgeLink; 29 import org.onosproject.net.DefaultEdgeLink;
29 import org.onosproject.net.DefaultPath; 30 import org.onosproject.net.DefaultPath;
...@@ -49,6 +50,8 @@ import java.util.Set; ...@@ -49,6 +50,8 @@ import java.util.Set;
49 50
50 import static com.google.common.base.Preconditions.checkNotNull; 51 import static com.google.common.base.Preconditions.checkNotNull;
51 import static org.slf4j.LoggerFactory.getLogger; 52 import static org.slf4j.LoggerFactory.getLogger;
53 +import static org.onosproject.security.AppGuard.checkPermission;
54 +
52 55
53 /** 56 /**
54 * Provides implementation of a path selection service atop the current 57 * Provides implementation of a path selection service atop the current
...@@ -85,11 +88,15 @@ public class PathManager implements PathService { ...@@ -85,11 +88,15 @@ public class PathManager implements PathService {
85 88
86 @Override 89 @Override
87 public Set<Path> getPaths(ElementId src, ElementId dst) { 90 public Set<Path> getPaths(ElementId src, ElementId dst) {
91 + checkPermission(Permission.TOPOLOGY_READ);
92 +
88 return getPaths(src, dst, null); 93 return getPaths(src, dst, null);
89 } 94 }
90 95
91 @Override 96 @Override
92 public Set<Path> getPaths(ElementId src, ElementId dst, LinkWeight weight) { 97 public Set<Path> getPaths(ElementId src, ElementId dst, LinkWeight weight) {
98 + checkPermission(Permission.TOPOLOGY_READ);
99 +
93 checkNotNull(src, ELEMENT_ID_NULL); 100 checkNotNull(src, ELEMENT_ID_NULL);
94 checkNotNull(dst, ELEMENT_ID_NULL); 101 checkNotNull(dst, ELEMENT_ID_NULL);
95 102
......
...@@ -21,6 +21,7 @@ import org.apache.felix.scr.annotations.Deactivate; ...@@ -21,6 +21,7 @@ import org.apache.felix.scr.annotations.Deactivate;
21 import org.apache.felix.scr.annotations.Reference; 21 import org.apache.felix.scr.annotations.Reference;
22 import org.apache.felix.scr.annotations.ReferenceCardinality; 22 import org.apache.felix.scr.annotations.ReferenceCardinality;
23 import org.apache.felix.scr.annotations.Service; 23 import org.apache.felix.scr.annotations.Service;
24 +import org.onosproject.core.Permission;
24 import org.onosproject.event.ListenerRegistry; 25 import org.onosproject.event.ListenerRegistry;
25 import org.onosproject.event.Event; 26 import org.onosproject.event.Event;
26 import org.onosproject.event.EventDeliveryService; 27 import org.onosproject.event.EventDeliveryService;
...@@ -51,6 +52,7 @@ import java.util.Set; ...@@ -51,6 +52,7 @@ import java.util.Set;
51 52
52 import static com.google.common.base.Preconditions.checkNotNull; 53 import static com.google.common.base.Preconditions.checkNotNull;
53 import static org.slf4j.LoggerFactory.getLogger; 54 import static org.slf4j.LoggerFactory.getLogger;
55 +import static org.onosproject.security.AppGuard.checkPermission;
54 56
55 /** 57 /**
56 * Provides basic implementation of the topology SB &amp; NB APIs. 58 * Provides basic implementation of the topology SB &amp; NB APIs.
...@@ -97,23 +99,31 @@ public class TopologyManager ...@@ -97,23 +99,31 @@ public class TopologyManager
97 99
98 @Override 100 @Override
99 public Topology currentTopology() { 101 public Topology currentTopology() {
102 + checkPermission(Permission.TOPOLOGY_READ);
103 +
100 return store.currentTopology(); 104 return store.currentTopology();
101 } 105 }
102 106
103 @Override 107 @Override
104 public boolean isLatest(Topology topology) { 108 public boolean isLatest(Topology topology) {
109 + checkPermission(Permission.TOPOLOGY_READ);
110 +
105 checkNotNull(topology, TOPOLOGY_NULL); 111 checkNotNull(topology, TOPOLOGY_NULL);
106 return store.isLatest(topology); 112 return store.isLatest(topology);
107 } 113 }
108 114
109 @Override 115 @Override
110 public Set<TopologyCluster> getClusters(Topology topology) { 116 public Set<TopologyCluster> getClusters(Topology topology) {
117 + checkPermission(Permission.TOPOLOGY_READ);
118 +
111 checkNotNull(topology, TOPOLOGY_NULL); 119 checkNotNull(topology, TOPOLOGY_NULL);
112 return store.getClusters(topology); 120 return store.getClusters(topology);
113 } 121 }
114 122
115 @Override 123 @Override
116 public TopologyCluster getCluster(Topology topology, ClusterId clusterId) { 124 public TopologyCluster getCluster(Topology topology, ClusterId clusterId) {
125 + checkPermission(Permission.TOPOLOGY_READ);
126 +
117 checkNotNull(topology, TOPOLOGY_NULL); 127 checkNotNull(topology, TOPOLOGY_NULL);
118 checkNotNull(topology, CLUSTER_ID_NULL); 128 checkNotNull(topology, CLUSTER_ID_NULL);
119 return store.getCluster(topology, clusterId); 129 return store.getCluster(topology, clusterId);
...@@ -121,6 +131,8 @@ public class TopologyManager ...@@ -121,6 +131,8 @@ public class TopologyManager
121 131
122 @Override 132 @Override
123 public Set<DeviceId> getClusterDevices(Topology topology, TopologyCluster cluster) { 133 public Set<DeviceId> getClusterDevices(Topology topology, TopologyCluster cluster) {
134 + checkPermission(Permission.TOPOLOGY_READ);
135 +
124 checkNotNull(topology, TOPOLOGY_NULL); 136 checkNotNull(topology, TOPOLOGY_NULL);
125 checkNotNull(topology, CLUSTER_NULL); 137 checkNotNull(topology, CLUSTER_NULL);
126 return store.getClusterDevices(topology, cluster); 138 return store.getClusterDevices(topology, cluster);
...@@ -128,6 +140,8 @@ public class TopologyManager ...@@ -128,6 +140,8 @@ public class TopologyManager
128 140
129 @Override 141 @Override
130 public Set<Link> getClusterLinks(Topology topology, TopologyCluster cluster) { 142 public Set<Link> getClusterLinks(Topology topology, TopologyCluster cluster) {
143 + checkPermission(Permission.TOPOLOGY_READ);
144 +
131 checkNotNull(topology, TOPOLOGY_NULL); 145 checkNotNull(topology, TOPOLOGY_NULL);
132 checkNotNull(topology, CLUSTER_NULL); 146 checkNotNull(topology, CLUSTER_NULL);
133 return store.getClusterLinks(topology, cluster); 147 return store.getClusterLinks(topology, cluster);
...@@ -135,12 +149,16 @@ public class TopologyManager ...@@ -135,12 +149,16 @@ public class TopologyManager
135 149
136 @Override 150 @Override
137 public TopologyGraph getGraph(Topology topology) { 151 public TopologyGraph getGraph(Topology topology) {
152 + checkPermission(Permission.TOPOLOGY_READ);
153 +
138 checkNotNull(topology, TOPOLOGY_NULL); 154 checkNotNull(topology, TOPOLOGY_NULL);
139 return store.getGraph(topology); 155 return store.getGraph(topology);
140 } 156 }
141 157
142 @Override 158 @Override
143 public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst) { 159 public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst) {
160 + checkPermission(Permission.TOPOLOGY_READ);
161 +
144 checkNotNull(topology, TOPOLOGY_NULL); 162 checkNotNull(topology, TOPOLOGY_NULL);
145 checkNotNull(src, DEVICE_ID_NULL); 163 checkNotNull(src, DEVICE_ID_NULL);
146 checkNotNull(dst, DEVICE_ID_NULL); 164 checkNotNull(dst, DEVICE_ID_NULL);
...@@ -149,6 +167,8 @@ public class TopologyManager ...@@ -149,6 +167,8 @@ public class TopologyManager
149 167
150 @Override 168 @Override
151 public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst, LinkWeight weight) { 169 public Set<Path> getPaths(Topology topology, DeviceId src, DeviceId dst, LinkWeight weight) {
170 + checkPermission(Permission.TOPOLOGY_READ);
171 +
152 checkNotNull(topology, TOPOLOGY_NULL); 172 checkNotNull(topology, TOPOLOGY_NULL);
153 checkNotNull(src, DEVICE_ID_NULL); 173 checkNotNull(src, DEVICE_ID_NULL);
154 checkNotNull(dst, DEVICE_ID_NULL); 174 checkNotNull(dst, DEVICE_ID_NULL);
...@@ -158,6 +178,8 @@ public class TopologyManager ...@@ -158,6 +178,8 @@ public class TopologyManager
158 178
159 @Override 179 @Override
160 public boolean isInfrastructure(Topology topology, ConnectPoint connectPoint) { 180 public boolean isInfrastructure(Topology topology, ConnectPoint connectPoint) {
181 + checkPermission(Permission.TOPOLOGY_READ);
182 +
161 checkNotNull(topology, TOPOLOGY_NULL); 183 checkNotNull(topology, TOPOLOGY_NULL);
162 checkNotNull(connectPoint, CONNECTION_POINT_NULL); 184 checkNotNull(connectPoint, CONNECTION_POINT_NULL);
163 return store.isInfrastructure(topology, connectPoint); 185 return store.isInfrastructure(topology, connectPoint);
...@@ -165,6 +187,8 @@ public class TopologyManager ...@@ -165,6 +187,8 @@ public class TopologyManager
165 187
166 @Override 188 @Override
167 public boolean isBroadcastPoint(Topology topology, ConnectPoint connectPoint) { 189 public boolean isBroadcastPoint(Topology topology, ConnectPoint connectPoint) {
190 + checkPermission(Permission.TOPOLOGY_READ);
191 +
168 checkNotNull(topology, TOPOLOGY_NULL); 192 checkNotNull(topology, TOPOLOGY_NULL);
169 checkNotNull(connectPoint, CONNECTION_POINT_NULL); 193 checkNotNull(connectPoint, CONNECTION_POINT_NULL);
170 return store.isBroadcastPoint(topology, connectPoint); 194 return store.isBroadcastPoint(topology, connectPoint);
...@@ -172,11 +196,15 @@ public class TopologyManager ...@@ -172,11 +196,15 @@ public class TopologyManager
172 196
173 @Override 197 @Override
174 public void addListener(TopologyListener listener) { 198 public void addListener(TopologyListener listener) {
199 + checkPermission(Permission.TOPOLOGY_EVENT);
200 +
175 listenerRegistry.addListener(listener); 201 listenerRegistry.addListener(listener);
176 } 202 }
177 203
178 @Override 204 @Override
179 public void removeListener(TopologyListener listener) { 205 public void removeListener(TopologyListener listener) {
206 + checkPermission(Permission.TOPOLOGY_EVENT);
207 +
180 listenerRegistry.removeListener(listener); 208 listenerRegistry.removeListener(listener);
181 } 209 }
182 210
......
...@@ -47,14 +47,19 @@ ...@@ -47,14 +47,19 @@
47 <artifactId>onos-api</artifactId> 47 <artifactId>onos-api</artifactId>
48 </dependency> 48 </dependency>
49 <dependency> 49 <dependency>
50 - <groupId>org.onosproject</groupId>
51 - <artifactId>onos-security-util</artifactId>
52 - <version>${project.version}</version>
53 - </dependency>
54 - <dependency>
55 <groupId>org.apache.karaf.features</groupId> 50 <groupId>org.apache.karaf.features</groupId>
56 <artifactId>org.apache.karaf.features.core</artifactId> 51 <artifactId>org.apache.karaf.features.core</artifactId>
57 </dependency> 52 </dependency>
58 </dependencies> 53 </dependencies>
59 54
55 + <build>
56 + <plugins>
57 + <plugin>
58 + <groupId>org.apache.felix</groupId>
59 + <artifactId>maven-scr-plugin</artifactId>
60 + </plugin>
61 + </plugins>
62 + </build>
63 +
64 +
60 </project> 65 </project>
...\ No newline at end of file ...\ No newline at end of file
......
...@@ -5,7 +5,7 @@ import com.google.common.collect.ImmutableSet; ...@@ -5,7 +5,7 @@ import com.google.common.collect.ImmutableSet;
5 import com.google.common.collect.Sets; 5 import com.google.common.collect.Sets;
6 import org.apache.commons.collections.FastHashMap; 6 import org.apache.commons.collections.FastHashMap;
7 import org.onosproject.core.Permission; 7 import org.onosproject.core.Permission;
8 -import org.onosproject.security.util.AppPermission; 8 +import org.onosproject.security.AppPermission;
9 import org.osgi.service.permissionadmin.PermissionInfo; 9 import org.osgi.service.permissionadmin.PermissionInfo;
10 10
11 import org.onosproject.app.ApplicationAdminService; 11 import org.onosproject.app.ApplicationAdminService;
......
...@@ -17,7 +17,7 @@ import org.onosproject.app.ApplicationState; ...@@ -17,7 +17,7 @@ import org.onosproject.app.ApplicationState;
17 import org.onosproject.core.Application; 17 import org.onosproject.core.Application;
18 import org.onosproject.core.ApplicationId; 18 import org.onosproject.core.ApplicationId;
19 import org.onosproject.core.Permission; 19 import org.onosproject.core.Permission;
20 -import org.onosproject.security.util.AppPermission; 20 +import org.onosproject.security.AppPermission;
21 import org.osgi.framework.Bundle; 21 import org.osgi.framework.Bundle;
22 import org.osgi.framework.BundleContext; 22 import org.osgi.framework.BundleContext;
23 import org.osgi.framework.BundleEvent; 23 import org.osgi.framework.BundleEvent;
...@@ -109,7 +109,6 @@ public class SecurityModeManager { ...@@ -109,7 +109,6 @@ public class SecurityModeManager {
109 109
110 permissionAdmin.setPermissions(bundle.getLocation(), allPerm); 110 permissionAdmin.setPermissions(bundle.getLocation(), allPerm);
111 log.warn("Security-Mode Started"); 111 log.warn("Security-Mode Started");
112 -
113 } 112 }
114 113
115 114
......
...@@ -14,7 +14,6 @@ ...@@ -14,7 +14,6 @@
14 <artifactId>onos-security</artifactId> 14 <artifactId>onos-security</artifactId>
15 <packaging>pom</packaging> 15 <packaging>pom</packaging>
16 <modules> 16 <modules>
17 - <module>util</module>
18 <module>impl</module> 17 <module>impl</module>
19 </modules> 18 </modules>
20 19
......
1 -<?xml version="1.0" encoding="UTF-8"?>
2 -<project xmlns="http://maven.apache.org/POM/4.0.0"
3 - xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4 - xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5 - <modelVersion>4.0.0</modelVersion>
6 -
7 - <parent>
8 - <artifactId>onos-security</artifactId>
9 - <groupId>org.onosproject</groupId>
10 - <version>1.2.0-SNAPSHOT</version>
11 - </parent>
12 -
13 - <artifactId>onos-security-util</artifactId>
14 - <packaging>bundle</packaging>
15 -
16 -</project>
1 -/*
2 - * Copyright 2015 Open Networking Laboratory
3 - *
4 - * Licensed under the Apache License, Version 2.0 (the "License");
5 - * you may not use this file except in compliance with the License.
6 - * You may obtain a copy of the License at
7 - *
8 - * http://www.apache.org/licenses/LICENSE-2.0
9 - *
10 - * Unless required by applicable law or agreed to in writing, software
11 - * distributed under the License is distributed on an "AS IS" BASIS,
12 - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 - * See the License for the specific language governing permissions and
14 - * limitations under the License.
15 - */
16 -
17 -/**
18 - * Security mode utilities.
19 - */
20 -package org.onosproject.security.util;
...\ No newline at end of file ...\ No newline at end of file
...@@ -132,9 +132,9 @@ ...@@ -132,9 +132,9 @@
132 132
133 <feature name="onos-security" version="@FEATURE-VERSION" 133 <feature name="onos-security" version="@FEATURE-VERSION"
134 description="Security-Mode ONOS"> 134 description="Security-Mode ONOS">
135 - <!--<bundle>mvn:org.onosproject/onos-security-felix/2.2.0-ONOS</bundle>--> 135 + <feature>onos-api</feature>
136 + <bundle>mvn:org.onosproject/org.apache.felix.framework.security/2.2.0.onos-SNAPSHOT</bundle>
136 <bundle>mvn:org.onosproject/onos-security-impl/@ONOS-VERSION</bundle> 137 <bundle>mvn:org.onosproject/onos-security-impl/@ONOS-VERSION</bundle>
137 - <bundle>mvn:org.onosproject/onos-security-util/@ONOS-VERSION</bundle>
138 </feature> 138 </feature>
139 139
140 <!-- Deprecated! For standalone testing only. --> 140 <!-- Deprecated! For standalone testing only. -->
......
...@@ -17,6 +17,7 @@ package org.onosproject.openflow.controller; ...@@ -17,6 +17,7 @@ package org.onosproject.openflow.controller;
17 17
18 18
19 import org.onlab.packet.Ethernet; 19 import org.onlab.packet.Ethernet;
20 +import org.onosproject.core.Permission;
20 import org.projectfloodlight.openflow.protocol.OFPacketIn; 21 import org.projectfloodlight.openflow.protocol.OFPacketIn;
21 import org.projectfloodlight.openflow.protocol.OFPacketOut; 22 import org.projectfloodlight.openflow.protocol.OFPacketOut;
22 import org.projectfloodlight.openflow.protocol.OFVersion; 23 import org.projectfloodlight.openflow.protocol.OFVersion;
...@@ -30,6 +31,9 @@ import java.nio.BufferUnderflowException; ...@@ -30,6 +31,9 @@ import java.nio.BufferUnderflowException;
30 import java.util.Collections; 31 import java.util.Collections;
31 import java.util.concurrent.atomic.AtomicBoolean; 32 import java.util.concurrent.atomic.AtomicBoolean;
32 33
34 +import static org.onosproject.security.AppGuard.checkPermission;
35 +
36 +
33 /** 37 /**
34 * Default implementation of an OpenFlowPacketContext. 38 * Default implementation of an OpenFlowPacketContext.
35 */ 39 */
...@@ -51,6 +55,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -51,6 +55,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
51 55
52 @Override 56 @Override
53 public void send() { 57 public void send() {
58 + checkPermission(Permission.PACKET_WRITE);
59 +
54 if (block() && isBuilt.get()) { 60 if (block() && isBuilt.get()) {
55 sw.sendMsg(pktout); 61 sw.sendMsg(pktout);
56 } 62 }
...@@ -89,6 +95,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -89,6 +95,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
89 95
90 @Override 96 @Override
91 public Ethernet parsed() { 97 public Ethernet parsed() {
98 + checkPermission(Permission.PACKET_READ);
99 +
92 Ethernet eth = new Ethernet(); 100 Ethernet eth = new Ethernet();
93 try { 101 try {
94 eth.deserialize(pktin.getData(), 0, pktin.getData().length); 102 eth.deserialize(pktin.getData(), 0, pktin.getData().length);
...@@ -100,6 +108,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -100,6 +108,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
100 108
101 @Override 109 @Override
102 public Dpid dpid() { 110 public Dpid dpid() {
111 + checkPermission(Permission.PACKET_READ);
112 +
103 return new Dpid(sw.getId()); 113 return new Dpid(sw.getId());
104 } 114 }
105 115
...@@ -117,6 +127,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -117,6 +127,8 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
117 127
118 @Override 128 @Override
119 public Integer inPort() { 129 public Integer inPort() {
130 + checkPermission(Permission.PACKET_READ);
131 +
120 return pktinInPort().getPortNumber(); 132 return pktinInPort().getPortNumber();
121 } 133 }
122 134
...@@ -129,6 +141,7 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -129,6 +141,7 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
129 141
130 @Override 142 @Override
131 public byte[] unparsed() { 143 public byte[] unparsed() {
144 + checkPermission(Permission.PACKET_READ);
132 145
133 return pktin.getData().clone(); 146 return pktin.getData().clone();
134 147
...@@ -144,16 +157,22 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext ...@@ -144,16 +157,22 @@ public final class DefaultOpenFlowPacketContext implements OpenFlowPacketContext
144 157
145 @Override 158 @Override
146 public boolean block() { 159 public boolean block() {
160 + checkPermission(Permission.PACKET_WRITE);
161 +
147 return free.getAndSet(false); 162 return free.getAndSet(false);
148 } 163 }
149 164
150 @Override 165 @Override
151 public boolean isHandled() { 166 public boolean isHandled() {
167 + checkPermission(Permission.PACKET_READ);
168 +
152 return !free.get(); 169 return !free.get();
153 } 170 }
154 171
155 @Override 172 @Override
156 public boolean isBuffered() { 173 public boolean isBuffered() {
174 + checkPermission(Permission.PACKET_READ);
175 +
157 return isBuffered; 176 return isBuffered;
158 } 177 }
159 178
......