backend/server/rhnServer/server_class.py |
4
java/code/src/com/redhat/rhn/frontend/action/LoginAction.java |
6
java/code/src/com/redhat/rhn/frontend/action/LoginSetupAction.java |
5
java/code/src/com/redhat/rhn/frontend/security/AuthenticationService.java |
21 +++
java/code/src/com/redhat/rhn/frontend/security/BaseAuthenticationService.java |
9 +
java/code/src/com/redhat/rhn/frontend/security/PxtAuthenticationService.java |
67 ++++++++++
java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java |
55 ++++++++
java/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml |
12 +
java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml |
13 +
java/code/src/com/redhat/rhn/frontend/xmlrpc/BaseHandler.java |
33 ++++
java/code/src/com/redhat/rhn/frontend/xmlrpc/SatelliteCertificateExpiredException.java |
37 +++++
java/code/src/com/redhat/rhn/frontend/xmlrpc/api/ApiHandler.java |
4
java/code/src/com/redhat/rhn/frontend/xmlrpc/auth/AuthHandler.java |
4
java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java |
4
java/code/src/com/redhat/rhn/frontend/xmlrpc/org/OrgHandler.java |
4
java/code/src/com/redhat/rhn/frontend/xmlrpc/org/trusts/OrgTrustHandler.java |
4
java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java |
4
java/code/src/com/redhat/rhn/manager/satellite/CertificateManager.java |
31 ++++
java/code/webapp/WEB-INF/pages/common/login.jsp |
2
19 files changed, 311 insertions(+), 8 deletions(-)
New commits:
commit 5c940e3b42144eb01bee8754a37cb6a49975222b
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Wed Jan 2 11:23:55 2013 +0100
use null as default value instead of an empty string for bug url
addressing:
com.redhat.rhn.common.hibernate.EmptyVarcharInterceptor - Object
com.redhat.rhn.domain.errata.impl.PublishedBug is setting empty string url
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
index 1604cbe..713df2b 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/errata/ErrataHandler.java
@@ -419,7 +419,7 @@ public class ErrataHandler extends BaseHandler {
(ArrayList<Map<String, Object>>)
details.get("bugs")) {
if (bugMap.containsKey("id") &&
bugMap.containsKey("summary")) {
- String url = "";
+ String url = null;
if (bugMap.containsKey("url")) {
url = (String) bugMap.get("url");
}
@@ -1251,7 +1251,7 @@ public class ErrataHandler extends BaseHandler {
for (Iterator itr = bugs.iterator(); itr.hasNext();) {
Map bugMap = (Map) itr.next();
- String url = "";
+ String url = null;
if (bugMap.containsKey("url")) {
url = (String) bugMap.get("url");
}
commit 0082beac1aec870cb26ae13bc204127018c61ac6
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Thu Dec 20 17:04:14 2012 +0100
adding previosly deleted strings
diff --git a/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
b/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
index 102c04b..0d4cf8b 100644
--- a/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
+++ b/java/code/src/com/redhat/rhn/frontend/strings/jsp/StringResource_en_US.xml
@@ -5167,6 +5167,19 @@ value for this entitlement, excluding the default
organization's consumption.</s
<trans-unit id="system_entitlements.emptyselectionerror">
<source>No Systems selected. Please select a system before executing an
action.</source>
</trans-unit>
+ <trans-unit
id="system_entitlements.setToManagementEntitled.success">
+ <source><strong>{0}</strong> system(s) set to
<strong>Management</strong>.</source>
+ </trans-unit>
+ <trans-unit
id="system_entitlements.setToManagementEntitled.failure">
+ <source><strong>{0}</strong> system(s) were
successfully set to <strong>Management</strong> entitled, but
you do not have enough <strong>Management</strong>
entitlements for the remaining <strong>{1}</strong> system(s).
You may free up <strong>Management</strong> entitlements by
downgrading <strong>Management</strong> entitled machines to
an Update entitlement, or you may purchase additional management entitlements at <a
href="https://www.redhat.com/apps/commerce/rhn/"><...
store</strong></a>. After you have additional
<strong>Management</strong> entitlements, you will be able to
upgrade these systems.
+ </source>
+ </trans-unit>
+ <trans-unit id="system_entitlements.unentitle.success">
+ <source><strong>{0}</strong> system(s)
<strong>Unentitled</strong>.</source>
+ </trans-unit>
+ <trans-unit id="system_entitlements.unentitle.failure">
+ <source>Unable to <strong>Unentitle
{0}</strong> system(s).</source>
+ </trans-unit>
<trans-unit id="system_entitlements.provisioning.success">
<source><strong>{0}</strong> system(s) set to
<strong>Provisioning</strong>.</source>
</trans-unit>
commit a30caab37c26dd060425cd3cdd5dd810070136d9
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Thu Dec 20 19:59:49 2012 +0100
889263 - unify java & backend grace period lenghts
diff --git a/backend/server/rhnServer/server_class.py
b/backend/server/rhnServer/server_class.py
index c814f1b..3344805 100644
--- a/backend/server/rhnServer/server_class.py
+++ b/backend/server/rhnServer/server_class.py
@@ -696,9 +696,9 @@ class Server(ServerWrapper):
log_debug(3, "Certificate expiration: %s; now: time: %s (%s)" % (
expire_string, time.ctime(now), now))
- # We will allow for a grace period of 8 days after the cert expires to
+ # We will allow for a grace period of 7 days after the cert expires to
# give the user some time renew the certificate before we disable.
- grace_period_seconds = 60 * 60 * 24 * 8
+ grace_period_seconds = 60 * 60 * 24 * 7
if (now > expire_time + grace_period_seconds):
log_debug(1, "Satellite certificate expired on %s" %
expire_string)
commit e8b986ee878d44e1b8cfc4e6b6a504ffa391df8a
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Wed Dec 19 14:08:15 2012 +0100
889263 - restrict API functionality when satellite certificate expires
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/BaseHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/BaseHandler.java
index 171100e..28001e5 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/BaseHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/BaseHandler.java
@@ -26,6 +26,7 @@ import com.redhat.rhn.domain.role.RoleFactory;
import com.redhat.rhn.domain.session.WebSession;
import com.redhat.rhn.domain.user.User;
import com.redhat.rhn.manager.entitlement.EntitlementManager;
+import com.redhat.rhn.manager.satellite.CertificateManager;
import com.redhat.rhn.manager.session.SessionManager;
import org.apache.log4j.Logger;
@@ -54,6 +55,14 @@ public class BaseHandler implements XmlRpcInvocationHandler {
private static Logger log = Logger.getLogger(BaseHandler.class);
+ protected boolean providesAuthentication() {
+ return false;
+ }
+
+ protected boolean availableInRestrictedPeriod() {
+ return false;
+ }
+
/**
* called by BaseHandler.doPost, contains the code that determines what
* method to call of a subclassed-object
@@ -105,6 +114,30 @@ public class BaseHandler implements XmlRpcInvocationHandler {
}
try {
+ if (!providesAuthentication()) {
+ CertificateManager cm = CertificateManager.getInstance();
+ if (cm.isSatelliteCertInRestrictedPeriod()) {
+ // allow only selected handlers
+ if (!availableInRestrictedPeriod()) {
+ log.warn("Blocking " + this.getClass().getSimpleName()
+ "." +
+ methodCalled + " API in restricted period.");
+ throw new SatelliteCertificateExpiredException(
+ "You are not allowed to perform this API until your
" +
+ "certificate is renewed. Please contact Red Hat for
a " +
+ "new certificate. Till then your satellite will have
" +
+ "restricted functionality.");
+ }
+ }
+ else if (cm.isSatelliteCertExpired()) {
+ // disable API at all
+ log.warn("Blocking " + this.getClass().getSimpleName() +
"." +
+ methodCalled + " API after satellite certificate has
expired.");
+ throw new SatelliteCertificateExpiredException(
+ "You are not allowed to perform this API until your
" +
+ "certificate is renewed. Please contact Red Hat for a
" +
+ "new certificate.");
+ }
+ }
return foundMethod.invoke(this, converted);
}
catch (IllegalAccessException e) {
diff --git
a/java/code/src/com/redhat/rhn/frontend/xmlrpc/SatelliteCertificateExpiredException.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/SatelliteCertificateExpiredException.java
new file mode 100644
index 0000000..524710a
--- /dev/null
+++
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/SatelliteCertificateExpiredException.java
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2012 Red Hat, Inc.
+ *
+ * This software is licensed to you under the GNU General Public License,
+ * version 2 (GPLv2). There is NO WARRANTY for this software, express or
+ * implied, including the implied warranties of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. You should have received a copy of GPLv2
+ * along with this software; if not, see
+ *
http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * Red Hat trademarks are not licensed under GPLv2. No permission is
+ * granted to use or replicate Red Hat trademarks that are incorporated
+ * in this software or its documentation.
+ */
+package com.redhat.rhn.frontend.xmlrpc;
+
+import com.redhat.rhn.FaultException;
+
+
+/**
+ * SatelliteCertificateExpiredException
+ * @version $Rev$
+ */
+public class SatelliteCertificateExpiredException extends FaultException {
+ /**
+ * Comment for <code>serialVersionUID</code>
+ */
+ private static final long serialVersionUID = 2642310584889207362L;
+
+ /**
+ * Constructor
+ * @param message custom exception message
+ */
+ public SatelliteCertificateExpiredException(String message) {
+ super(1214, "certificate expired", message);
+ }
+}
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/api/ApiHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/api/ApiHandler.java
index 10ea086..a29248e 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/api/ApiHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/api/ApiHandler.java
@@ -41,6 +41,10 @@ import java.util.Set;
*/
public class ApiHandler extends BaseHandler {
+ protected boolean availableInRestrictedPeriod() {
+ return true;
+ }
+
/**
* Returns the server version.
* @return Returns the server version.
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/auth/AuthHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/auth/AuthHandler.java
index 97a4db3..1c8c135 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/auth/AuthHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/auth/AuthHandler.java
@@ -39,6 +39,10 @@ public class AuthHandler extends BaseHandler {
private static Logger log = Logger.getLogger(AuthHandler.class);
+ protected boolean providesAuthentication() {
+ return true;
+ }
+
/**
* Logout user with sessionKey
* @param sessionKey The sessionKey for the loggedInUser
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/OrgHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/OrgHandler.java
index 16acb32..026c7db 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/OrgHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/OrgHandler.java
@@ -86,6 +86,10 @@ public class OrgHandler extends BaseHandler {
private static final String FREE_KEY = "free";
private static Logger log = Logger.getLogger(OrgHandler.class);
+ protected boolean availableInRestrictedPeriod() {
+ return true;
+ }
+
/**
* Create a new organization.
* @param sessionKey User's session key.
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/trusts/OrgTrustHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/trusts/OrgTrustHandler.java
index d191d92..f132e97 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/trusts/OrgTrustHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/org/trusts/OrgTrustHandler.java
@@ -47,6 +47,10 @@ import java.util.Map;
@SuppressWarnings("unchecked")
public class OrgTrustHandler extends BaseHandler {
+ protected boolean availableInRestrictedPeriod() {
+ return true;
+ }
+
/**
* Lists all organizations trusted by the user's organization.
* @param sessionKey session containing User information.
diff --git a/java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java
b/java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java
index 0a40913..2b11135 100644
--- a/java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java
+++ b/java/code/src/com/redhat/rhn/frontend/xmlrpc/system/SystemHandler.java
@@ -171,6 +171,10 @@ public class SystemHandler extends BaseHandler {
private static Logger log = Logger.getLogger(SystemHandler.class);
+ protected boolean availableInRestrictedPeriod() {
+ return true;
+ }
+
/**
* Get a reactivation key for this server.
*
commit fcfa6fe087a6196a07201645ac72cfc307ed3d5a
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Wed Dec 19 13:18:18 2012 +0100
889263 - allow displaying action messages on the webui login page
diff --git a/java/code/webapp/WEB-INF/pages/common/login.jsp
b/java/code/webapp/WEB-INF/pages/common/login.jsp
index b274c1c..f07fb33 100644
--- a/java/code/webapp/WEB-INF/pages/common/login.jsp
+++ b/java/code/webapp/WEB-INF/pages/common/login.jsp
@@ -6,7 +6,7 @@
<html>
<head>
<script src="/javascript/focus.js"
type="text/javascript"></script>
- <meta name="decorator" content="layout_equals" />
+ <meta name="decorator" content="layout_c" />
</head>
<body onLoad="formFocus('loginForm', 'username')">
commit 45b266b5c8a4f92bcfa7c2834992849361531923
Author: Tomas Lestach <tlestach(a)redhat.com>
Date: Tue Dec 4 17:10:28 2012 +0100
889263 - restrict WebUI functionality when satelllite certificate expires
diff --git a/java/code/src/com/redhat/rhn/frontend/action/LoginAction.java
b/java/code/src/com/redhat/rhn/frontend/action/LoginAction.java
index a8f5108..4ebb083 100644
--- a/java/code/src/com/redhat/rhn/frontend/action/LoginAction.java
+++ b/java/code/src/com/redhat/rhn/frontend/action/LoginAction.java
@@ -71,7 +71,11 @@ public class LoginAction extends RhnAction {
ActionForm form, HttpServletRequest request,
HttpServletResponse response) {
- if (CertificateManager.getInstance().isSatelliteCertExpired()) {
+ CertificateManager cm = CertificateManager.getInstance();
+ if (cm.isSatelliteCertInRestrictedPeriod()) {
+ createErrorMessage(request, "satellite.expired.restricted", null);
+ }
+ else if (cm.isSatelliteCertExpired()) {
addMessage(request, "satellite.expired");
request.setAttribute(LoginSetupAction.HAS_EXPIRED, Boolean.TRUE);
return mapping.findForward("failure");
diff --git a/java/code/src/com/redhat/rhn/frontend/action/LoginSetupAction.java
b/java/code/src/com/redhat/rhn/frontend/action/LoginSetupAction.java
index b3d1354..570c0c7 100644
--- a/java/code/src/com/redhat/rhn/frontend/action/LoginSetupAction.java
+++ b/java/code/src/com/redhat/rhn/frontend/action/LoginSetupAction.java
@@ -78,7 +78,10 @@ public class LoginSetupAction extends RhnAction {
}
CertificateManager man = CertificateManager.getInstance();
- if (man.isSatelliteCertExpired()) {
+ if (man.isSatelliteCertInRestrictedPeriod()) {
+ createErrorMessage(request, "satellite.expired.restricted", null);
+ }
+ else if (man.isSatelliteCertExpired()) {
addMessage(request, "satellite.expired");
request.setAttribute(HAS_EXPIRED, Boolean.TRUE);
return mapping.findForward(RhnHelper.DEFAULT_FORWARD);
diff --git a/java/code/src/com/redhat/rhn/frontend/security/AuthenticationService.java
b/java/code/src/com/redhat/rhn/frontend/security/AuthenticationService.java
index 32ce613..8b4e9e0 100644
--- a/java/code/src/com/redhat/rhn/frontend/security/AuthenticationService.java
+++ b/java/code/src/com/redhat/rhn/frontend/security/AuthenticationService.java
@@ -54,6 +54,14 @@ public interface AuthenticationService {
boolean skipCsfr(HttpServletRequest request);
/**
+ * If Satellite certificate is in the restricted mode, there's just a whitelist
+ * of pages the user may visit
+ * @param request The current request
+ * @return True if the url isn't allowed in the restricted mode
+ */
+ boolean postOnRestrictedWhitelist(HttpServletRequest request);
+
+ /**
* Redirects the request to whatever resource handles logins. This method is
typically
* invoked after a call to {@link #validate(HttpServletRequest,
HttpServletResponse)}
* fails. Note that the redirect may be client-side or server-side, and it may be to
an
@@ -67,6 +75,19 @@ public interface AuthenticationService {
throws ServletException;
/**
+ * Redirects the request to a different page
+ * Used in restricted period after grace period has expired to prevent basic
satellite
+ * functionality
+ *
+ * @param request the request
+ * @param response the response
+ * @param path where to redirect
+ * @throws ServletException If an unrecoverable error occurs
+ */
+ void redirectTo(HttpServletRequest request, HttpServletResponse response, String
path)
+ throws ServletException;
+
+ /**
* Invalidates login credentials associated with the given request.
*
* @param request The current request
diff --git a/java/code/src/com/redhat/rhn/frontend/security/BaseAuthenticationService.java
b/java/code/src/com/redhat/rhn/frontend/security/BaseAuthenticationService.java
index d6b51bf..09e7098 100644
--- a/java/code/src/com/redhat/rhn/frontend/security/BaseAuthenticationService.java
+++ b/java/code/src/com/redhat/rhn/frontend/security/BaseAuthenticationService.java
@@ -51,7 +51,16 @@ public abstract class BaseAuthenticationService implements
AuthenticationService
});
}
+ protected boolean requestRestrictedWhitelist(final HttpServletRequest request) {
+ return CollectionUtils.exists(getRestrictedWhitelistURIs(), new Predicate() {
+ public boolean evaluate(Object uri) {
+ return request.getRequestURI().startsWith(uri.toString());
+ }
+ });
+ }
+
protected abstract Set getUnprotectedURIs();
protected abstract Set getPostUnprotectedURIs();
protected abstract Set getLoginURIs();
+ protected abstract Set getRestrictedWhitelistURIs();
}
diff --git a/java/code/src/com/redhat/rhn/frontend/security/PxtAuthenticationService.java
b/java/code/src/com/redhat/rhn/frontend/security/PxtAuthenticationService.java
index 8347a39..479fe21 100644
--- a/java/code/src/com/redhat/rhn/frontend/security/PxtAuthenticationService.java
+++ b/java/code/src/com/redhat/rhn/frontend/security/PxtAuthenticationService.java
@@ -42,6 +42,7 @@ public class PxtAuthenticationService extends BaseAuthenticationService
{
private static final Set UNPROTECTED_URIS;
private static final Set POST_UNPROTECTED_URIS;
private static final Set LOGIN_URIS;
+ private static final Set RESRTICTED_WHITELIST_URIS;
static {
TreeSet set = new TreeSet();
@@ -68,6 +69,51 @@ public class PxtAuthenticationService extends BaseAuthenticationService
{
set.add("/rhn/common/DownloadFile");
POST_UNPROTECTED_URIS = UnmodifiableSet.decorate(set);
+
+ set = new TreeSet();
+ // base and add on entitlements
+ set.add("/rhn/systems/details/Edit.do");
+ set.add("/rhn/systems/SystemEntitlementsSubmit.do");
+ // org system entitlements
+ set.add("/rhn/admin/multiorg/OrgSystemSubscriptions.do");
+ // org software channel entitlements
+ set.add("/rhn/admin/multiorg/OrgSoftwareSubscriptions.do");
+ // delete system(s)
+ set.add("/rhn/systems/details/DeleteConfirm.do");
+ set.add("/rhn/systems/ssm/DeleteConfirm.do");
+ set.add("/rhn/systems/DuplicateIPList.do");
+ set.add("/rhn/systems/DuplicateIPv6List.do");
+ set.add("/rhn/systems/DuplicateHostName.do");
+ set.add("/rhn/systems/DuplicateMacAddress.do");
+ // migrate to another org
+ set.add("/rhn/admin/multiorg/OrgTrusts.do");
+ set.add("/rhn/systems/details/SystemMigrate.do");
+ set.add("/rhn/systems/ssm/MigrateSystems.do");
+ // change channel subscription
+ set.add("/rhn/systems/details/SystemChannels.do");
+ set.add("/rhn/channel/ssm/BaseChannelSubscribe.do");
+ set.add("/rhn/channel/ssm/ChildSubscriptions.do");
+ // change flex -> regular entitlemnts
+ set.add("/rhn/systems/entitlements/");
+ // upload certificate
+ set.add("/rhn/admin/config/CertificateConfig.do");
+ // select systems
+ set.add("/rhn/systems/Overview.do");
+ set.add("/rhn/systems/SystemList.do");
+ set.add("/rhn/systems/VirtualSystemsListSubmit.do");
+ set.add("/rhn/systems/OutOfDate.do");
+ set.add("/rhn/systems/RequiringReboot.do");
+ set.add("/rhn/systems/ExtraPackagesSystems.do");
+ set.add("/rhn/systems/Unentitled.do");
+ set.add("/rhn/systems/Ungrouped.do");
+ set.add("/rhn/systems/Inactive.do");
+ set.add("/rhn/systems/Registered.do");
+ set.add("/rhn/systems/ProxyList.do");
+ set.add("/rhn/systems/SystemCurrency.do");
+ // system search
+ set.add("/rhn/systems/Search.do");
+
+ RESRTICTED_WHITELIST_URIS = UnmodifiableSet.decorate(set);
}
private PxtSessionDelegate pxtDelegate;
@@ -87,6 +133,10 @@ public class PxtAuthenticationService extends
BaseAuthenticationService {
return POST_UNPROTECTED_URIS;
}
+ protected Set getRestrictedWhitelistURIs() {
+ return RESRTICTED_WHITELIST_URIS;
+ }
+
/**
* "Wires up" the PxtSessionDelegate that this service object will use.
Note that this
* method should be invoked by a factory that creates instances of this class, such
as
@@ -108,6 +158,13 @@ public class PxtAuthenticationService extends
BaseAuthenticationService {
/**
* {@inheritDoc}
*/
+ public boolean postOnRestrictedWhitelist(HttpServletRequest request) {
+ return requestRestrictedWhitelist(request);
+ }
+
+ /**
+ * {@inheritDoc}
+ */
public boolean validate(HttpServletRequest request, HttpServletResponse response) {
//is authentication needed (i.e. is our session valid, and does the url
// we are hitting require auth)
@@ -167,6 +224,16 @@ public class PxtAuthenticationService extends
BaseAuthenticationService {
/**
* {@inheritDoc}
*/
+ public void redirectTo(HttpServletRequest request, HttpServletResponse response,
+ String path)
+ throws ServletException {
+ response.setHeader("Location", path);
+ response.setStatus(response.SC_SEE_OTHER);
+ }
+
+ /**
+ * {@inheritDoc}
+ */
public void invalidate(HttpServletRequest request, HttpServletResponse response) {
pxtDelegate.invalidatePxtSession(request, response);
}
diff --git a/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
b/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
index ac94baf..97272c6 100644
--- a/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
+++ b/java/code/src/com/redhat/rhn/frontend/servlets/AuthFilter.java
@@ -19,11 +19,18 @@ import com.redhat.rhn.common.security.CSRFTokenException;
import com.redhat.rhn.common.security.CSRFTokenValidator;
import com.redhat.rhn.frontend.security.AuthenticationService;
import com.redhat.rhn.frontend.security.AuthenticationServiceFactory;
+import com.redhat.rhn.manager.satellite.CertificateManager;
import org.apache.log4j.Logger;
+import org.apache.struts.Globals;
+import org.apache.struts.action.ActionMessage;
+import org.apache.struts.action.ActionMessages;
import java.io.IOException;
+import java.net.MalformedURLException;
+import java.net.URL;
import java.util.Date;
+import java.util.Enumeration;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
@@ -80,6 +87,7 @@ public class AuthFilter implements Filter {
!authenticationService.skipCsfr((HttpServletRequest) request)) {
try {
CSRFTokenValidator.validate(hreq);
+
}
catch (CSRFTokenException e) {
// send HTTP 403 if security token validation failed
@@ -88,8 +96,24 @@ public class AuthFilter implements Filter {
e.getMessage());
return;
}
+ if (CertificateManager.getInstance().isSatelliteCertInRestrictedPeriod()
&&
+ !authenticationService.postOnRestrictedWhitelist(hreq)) {
+ // interrupt the POST and redirect to the referer page
+ URL url = getHttpRequestReferer(hreq);
+ String pathUrl;
+ if (url == null) {
+ pathUrl = "/YourRhn.do";
+ }
+ else {
+ pathUrl = url.getProtocol() + "://" + url.getHost() +
url.getFile();
+ }
+ log.warn("Blocking " + hreq.getRequestURI() +
+ " POST in restricted period. Redirecting to " +
pathUrl);
+ addErrorMessage(hreq, "restricted.forbidden");
+ ((HttpServletResponse) response).sendRedirect(url.getFile());
+ return;
+ }
}
-
chain.doFilter(request, response);
}
else {
@@ -104,6 +128,35 @@ public class AuthFilter implements Filter {
// }
}
+ private void addErrorMessage(HttpServletRequest hreq, String msgKey) {
+ ActionMessages ams = new ActionMessages();
+ ams.add(ActionMessages.GLOBAL_MESSAGE, new ActionMessage(msgKey));
+ hreq.getSession().setAttribute(Globals.ERROR_KEY, ams);
+ }
+
+ /**
+ * @param request
+ * @param response
+ * @param hreq
+ * @throws MalformedURLException
+ * @throws ServletException
+ * @throws IOException
+ */
+ private URL getHttpRequestReferer(HttpServletRequest hreq) {
+ Enumeration em = hreq.getHeaders("referer");
+ URL url = null;
+ while (em.hasMoreElements()) {
+ String urlString = (String) em.nextElement();
+ try {
+ url = new URL(urlString);
+ }
+ catch (MalformedURLException e) {
+ // it does not matter, if there's no referer
+ }
+ }
+ return url;
+ }
+
/**
* {@inheritDoc}
*/
diff --git a/java/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
b/java/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
index 65e2406..7be87d5 100644
--- a/java/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
+++ b/java/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
@@ -5159,6 +5159,12 @@ user before attempting to deactivate their account.</source>
<context
context-type="sourcefile">/rhn/Login.do</context>
</context-group>
</trans-unit>
+ <trans-unit id="satellite.expired.restricted">
+ <source>Your satellite certificate has expired. Please contact Red Hat for
a new certificate. Till then your satellite will have restricted
functionality.</source>
+ <context-group name="ctx">
+ <context
context-type="sourcefile">/rhn/Login.do</context>
+ </context-group>
+ </trans-unit>
<trans-unit id="satellite.graceperiod">
<source>Your satellite certificate has expired. Please contact Red Hat for
a new certificate. Your satellite will become inactive in {0} day(s).</source>
<context-group name="ctx">
@@ -5166,6 +5172,12 @@ user before attempting to deactivate their account.</source>
<context
context-type="sourcefile">/rhn/YourRhn.do</context>
</context-group>
</trans-unit>
+ <trans-unit id="restricted.forbidden">
+ <source>You are not allowed to perform this action until your certificate
is renewed. Please contact Red Hat for a new certificate. Till then your satellite will
have restricted functionality.</source>
+ <context-group name="ctx">
+ <context
context-type="sourcefile">/rhn/Login.do</context>
+ </context-group>
+ </trans-unit>
<trans-unit id="certificate.config.error.nocert">
<source>No certificate found. Please select a local certificate file or
paste contents into the form.</source>
<context-group name="ctx">
diff --git a/java/code/src/com/redhat/rhn/manager/satellite/CertificateManager.java
b/java/code/src/com/redhat/rhn/manager/satellite/CertificateManager.java
index 0963ee4..33543f3 100644
--- a/java/code/src/com/redhat/rhn/manager/satellite/CertificateManager.java
+++ b/java/code/src/com/redhat/rhn/manager/satellite/CertificateManager.java
@@ -30,6 +30,7 @@ public class CertificateManager extends BaseManager {
private static CertificateManager instance = new CertificateManager();
public static final int GRACE_PERIOD_IN_DAYS = 7;
+ public static final int RESTRICTED_PERIOD_IN_DAYS = 24;
private static final long MILLISECONDS_IN_DAY = 86400000;
/**
@@ -69,6 +70,18 @@ public class CertificateManager extends BaseManager {
now.before(getGracePeriodEndDate());
}
+ /**
+ * Return whether the satellite certificate is in a restricted period or not.
+ * False will be returned if the restricted period is over or if it has not
+ * begun.
+ * @return true if in restricted period, false otherwise
+ */
+ public boolean isSatelliteCertInRestrictedPeriod() {
+ Date now = Calendar.getInstance().getTime();
+ return now.after(getGracePeriodEndDate()) &&
+ now.before(getRestrictedPeriodEndDate());
+ }
+
protected Date getGracePeriodBeginDate() {
SatelliteCertificate sc = CertificateFactory.lookupNewestCertificate();
Calendar cal = Calendar.getInstance();
@@ -98,6 +111,24 @@ public class CertificateManager extends BaseManager {
}
/**
+ * @return Date that represent the end of the satellite's certificate's
+ * restricted period
+ */
+ public Date getRestrictedPeriodEndDate() {
+ SatelliteCertificate sc = CertificateFactory.lookupNewestCertificate();
+ Calendar cal = Calendar.getInstance();
+ cal.setTime(sc.getExpires());
+ cal.set(Calendar.HOUR, 0);
+ cal.set(Calendar.MINUTE, 0);
+ cal.set(Calendar.SECOND, 0);
+ cal.set(Calendar.MILLISECOND, 0);
+ cal.set(Calendar.AM_PM, Calendar.AM);
+ cal.add(Calendar.DATE, GRACE_PERIOD_IN_DAYS);
+ cal.add(Calendar.DATE, RESTRICTED_PERIOD_IN_DAYS);
+ return cal.getTime();
+ }
+
+ /**
* @return the number of the days left before the Sat certificate will expire.
* (including the grace period)
*