jdk/src/share/classes/com/sun/jmx/namespace/NamespaceInterceptor.java

/*
 * Copyright 2008 Sun Microsystems, Inc.  All Rights Reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Sun designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Sun in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
 * CA 95054 USA or visit www.sun.com if you need additional information or
 * have any questions.
 */
package com.sun.jmx.namespace;

import com.sun.jmx.defaults.JmxProperties;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import java.util.UUID;
import java.util.logging.Logger;

import javax.management.Attribute;
import javax.management.AttributeList;
import javax.management.MBeanServer;
import javax.management.MBeanServerConnection;
import javax.management.MalformedObjectNameException;
import javax.management.ObjectName;
import javax.management.QueryExp;
import javax.management.namespace.JMXNamespaces;
import javax.management.namespace.JMXNamespace;
import javax.management.namespace.JMXNamespacePermission;

/**
 * A NamespaceInterceptor wraps a JMXNamespace, performing
 * ObjectName rewriting.
 * <p><b>
 * This API is a Sun internal API and is subject to changes without notice.
 * </b></p>
 * @since 1.7
 */
public class NamespaceInterceptor extends HandlerInterceptor<JMXNamespace> {

    /**
     * A logger for this class.
     **/
    private static final Logger LOG = JmxProperties.NAMESPACE_LOGGER;
    private static final Logger PROBE_LOG = Logger.getLogger(
            JmxProperties.NAMESPACE_LOGGER+".probe");

    // The target name space in which the NamepsaceHandler is mounted.
    private final String           targetNs;

    private final String           serverName;

    private final ObjectNameRouter proc;

    /**
     * Internal hack. The JMXRemoteNamespace can be closed and reconnected.
     * Each time the JMXRemoteNamespace connects, a probe should be sent
     * to detect cycle. The MBeanServer exposed by JMXRemoteNamespace thus
     * implements the DynamicProbe interface, which makes it possible for
     * this handler to know that it should send a new probe.
     *
     * XXX: TODO this probe thing is way too complex and fragile.
     *      This *must* go away or be replaced by something simpler.
     *      ideas are welcomed.
     **/
    public static interface DynamicProbe {
        public boolean isProbeRequested();
    }

    /**
     * Creates a new instance of NamespaceInterceptor
     */
    public NamespaceInterceptor(
            String serverName,
            JMXNamespace handler,
            String targetNamespace) {
        super(handler);
        this.serverName = serverName;
        this.targetNs =
                ObjectNameRouter.normalizeNamespacePath(targetNamespace,
                true, true, false);
        proc = new ObjectNameRouter(targetNamespace, "");
    }

    @Override
    public String toString() {
        return this.getClass().getName()+"(parent="+serverName+
                ", namespace="+this.targetNs+")";
    }

    /*
     * XXX: TODO this probe thing is way too complex and fragile.
     *      This *must* go away or be replaced by something simpler.
     *      ideas are welcomed.
     */
    private volatile boolean probed = false;
    private volatile ObjectName probe;

    // Query Pattern that we will send through the source server in order
    // to detect self-linking namespaces.
    //
    // XXX: TODO this probe thing is way too complex and fragile.
    //      This *must* go away or be replaced by something simpler.
    //      ideas are welcomed.
    final ObjectName makeProbePattern(ObjectName probe)
            throws MalformedObjectNameException {

        // we could probably link the probe pattern with the probe - e.g.
        // using the UUID as key in the pattern - but is it worth it? it
        // also has some side effects on the context namespace - because
        // such a probe may get rejected by the jmx.context// namespace.
        //
        // The trick here is to devise a pattern that is not likely to
        // be blocked by intermediate levels. Querying for all namespace
        // handlers in the source (or source namespace) is more likely to
        // achieve this goal.
        //
        return ObjectName.getInstance("*" +
                JMXNamespaces.NAMESPACE_SEPARATOR + ":" +
                JMXNamespace.TYPE_ASSIGNMENT);
    }

    // tell whether the name pattern corresponds to what might have been
    // sent as a probe.
    // XXX: TODO this probe thing is way too complex and fragile.
    //      This *must* go away or be replaced by something simpler.
    //      ideas are welcomed.
    final boolean isProbePattern(ObjectName name) {
        final ObjectName p = probe;
        if (p == null) return false;
        try {
            return String.valueOf(name).endsWith(targetNs+
                JMXNamespaces.NAMESPACE_SEPARATOR + "*" +
                JMXNamespaces.NAMESPACE_SEPARATOR + ":" +
                JMXNamespace.TYPE_ASSIGNMENT);
        } catch (RuntimeException x) {
            // should not happen.
            PROBE_LOG.finest("Ignoring unexpected exception in self link detection: "+
                    x);
            return false;
        }
    }

    // The first time a request reaches this NamespaceInterceptor, the
    // interceptor will send a probe to detect whether the underlying
    // JMXNamespace links to itslef.
    //
    // One way to create such self-linking namespace would be for instance
    // to create a JMXNamespace whose getSourceServer() method would return:
    // JMXNamespaces.narrowToNamespace(getMBeanServer(),
    //                                 getObjectName().getDomain())
    //
    // If such an MBeanServer is returned, then any call to that MBeanServer
    // will trigger an infinite loop.
    // There can be even trickier configurations if remote connections are
    // involved.
    //
    // In order to prevent this from happening, the NamespaceInterceptor will
    // send a probe, in an attempt to detect whether it will receive it at
    // the other end. If the probe is received, an exception will be thrown
    // in order to break the recursion. The probe is only sent once - when
    // the first request to the namespace occurs. The DynamicProbe interface
    // can also be used by a Sun JMXNamespace implementation to request the
    // emission of a probe at any time (see JMXRemoteNamespace
    // implementation).
    //
    // Probes work this way: the NamespaceInterceptor sets a flag and sends
    // a queryNames() request. If a queryNames() request comes in when the flag
    // is on, then it deduces that there is a self-linking loop - and instead
    // of calling queryNames() on the source MBeanServer of the JMXNamespace
    // handler (which would cause the loop to go on) it breaks the recursion
    // by returning the probe ObjectName.
    // If the NamespaceInterceptor receives the probe ObjectName as result of
    // its original sendProbe() request it knows that it has been looping
    // back on itslef and throws an IOException...
    //
    //
    // XXX: TODO this probe thing is way too complex and fragile.
    //      This *must* go away or be replaced by something simpler.
    //      ideas are welcomed.
    //
    final void sendProbe(MBeanServerConnection msc)
            throws IOException {
        try {
            PROBE_LOG.fine("Sending probe");

            // This is just to prevent any other thread to modify
            // the probe while the detection cycle is in progress.
            //
            final ObjectName probePattern;
            // we don't want to synchronize on this - we use targetNs
            // because it's non null and final.
            synchronized (targetNs) {
                probed = false;
                if (probe != null) {
                    throw new IOException("concurent connection in progress");
                }
                final String uuid = UUID.randomUUID().toString();
                final String endprobe =
                        JMXNamespaces.NAMESPACE_SEPARATOR + uuid +
                        ":type=Probe,key="+uuid;
                final ObjectName newprobe =
                        ObjectName.getInstance(endprobe);
                probePattern = makeProbePattern(newprobe);
                probe = newprobe;
            }

            try {
                PROBE_LOG.finer("Probe query: "+probePattern+" expecting: "+probe);
                final Set<ObjectName> res = msc.queryNames(probePattern, null);
                final ObjectName expected = probe;
                PROBE_LOG.finer("Probe res: "+res);
                if (res.contains(expected)) {
                    throw new IOException("namespace " +
                            targetNs + " is linking to itself: " +
                            "cycle detected by probe");
                }
            } catch (SecurityException x) {
                PROBE_LOG.finer("Can't check for cycles: " + x);
                // can't do anything....
            } catch (RuntimeException x) {
                PROBE_LOG.finer("Exception raised by queryNames: " + x);
                throw x;
            } finally {
                probe = null;
            }
        } catch (MalformedObjectNameException x) {
            final IOException io =
                    new IOException("invalid name space: probe failed");
            io.initCause(x);
            throw io;
        }
        PROBE_LOG.fine("Probe returned - no cycles");
        probed = true;
    }

    // allows a Sun implementation JMX Namespace, such as the
    // JMXRemoteNamespace, to control when a probe should be sent.
    //
    // XXX: TODO this probe thing is way too complex and fragile.
    //      This *must* go away or be replaced by something simpler.
    //      ideas are welcomed.
    private boolean isProbeRequested(Object o) {
        if (o instanceof DynamicProbe)
            return ((DynamicProbe)o).isProbeRequested();
        return false;
    }

    /**
     * This method will send a probe to detect self-linking name spaces.
     * A self linking namespace is a namespace that links back directly
     * on itslef. Calling a method on such a name space always results
     * in an infinite loop going through:
     * [1]MBeanServer -> [2]NamespaceDispatcher -> [3]NamespaceInterceptor
     * [4]JMXNamespace -> { network // or cd // or ... } -> [5]MBeanServer
     * with exactly the same request than [1]...
     *
     * The namespace interceptor [2] tries to detect such condition the
     * *first time* that the connection is used. It does so by setting
     * a flag, and sending a queryNames() through the name space. If the
     * queryNames comes back, it knows that there's a loop.
     *
     * The DynamicProbe interface can also be used by a Sun JMXNamespace
     * implementation to request the emission of a probe at any time
     * (see JMXRemoteNamespace implementation).
     */
    private MBeanServer connection() {
        try {
            final MBeanServer c = super.source();
            if (probe != null) // should not happen
                throw new RuntimeException("connection is being probed");

            if (probed == false || isProbeRequested(c)) {
                try {
                    // Should not happen if class well behaved.
                    // Never probed. Force it.
                    //System.err.println("sending probe for " +
                    //        "target="+targetNs+", source="+srcNs);
                    sendProbe(c);
                } catch (IOException io) {
                    throw new RuntimeException(io.getMessage(), io);
                }
            }

            if (c != null) {
                return c;
            }
        } catch (RuntimeException x) {
            throw x;
        }
        throw new NullPointerException("getMBeanServerConnection");
    }


    @Override
    protected MBeanServer source() {
        return connection();
    }

    @Override
    protected MBeanServer getServerForLoading() {
        // don't want to send probe on getClassLoader/getClassLoaderFor
        return super.source();
    }

    /**
     * Calls {@link MBeanServerConnection#queryNames queryNames}
     * on the underlying
     * {@link #getMBeanServerConnection MBeanServerConnection}.
     **/
    @Override
    public final Set<ObjectName> queryNames(ObjectName name, QueryExp query) {
        // XXX: TODO this probe thing is way too complex and fragile.
        //      This *must* go away or be replaced by something simpler.
        //      ideas are welcomed.
        PROBE_LOG.finer("probe is: "+probe+" pattern is: "+name);
        if (probe != null && isProbePattern(name)) {
            PROBE_LOG.finer("Return probe: "+probe);
            return Collections.singleton(probe);
        }
        return super.queryNames(name, query);
    }

    @Override
    protected ObjectName toSource(ObjectName targetName)
            throws MalformedObjectNameException {
        return proc.toSourceContext(targetName, true);
    }

    @Override
    protected ObjectName toTarget(ObjectName sourceName)
            throws MalformedObjectNameException {
        return proc.toTargetContext(sourceName, false);
    }

    //
    // Implements permission checks.
    //
    @Override
    void check(ObjectName routingName, String member, String action) {
        final SecurityManager sm = System.getSecurityManager();
        if (sm == null) return;
        if ("getDomains".equals(action)) return;
        final JMXNamespacePermission perm =
                new  JMXNamespacePermission(serverName,member,
                routingName,action);
        sm.checkPermission(perm);
    }

    @Override
    void checkCreate(ObjectName routingName, String className, String action) {
        final SecurityManager sm = System.getSecurityManager();
        if (sm == null) return;
        final JMXNamespacePermission perm =
                new  JMXNamespacePermission(serverName,className,
                routingName,action);
        sm.checkPermission(perm);
    }

    //
    // Implements permission filters for attributes...
    //
    @Override
    AttributeList checkAttributes(ObjectName routingName,
            AttributeList attributes, String action) {
        check(routingName,null,action);
        if (attributes == null || attributes.isEmpty()) return attributes;
        final SecurityManager sm = System.getSecurityManager();
        if (sm == null) return attributes;
        final AttributeList res = new AttributeList();
        for (Attribute at : attributes.asList()) {
            try {
                check(routingName,at.getName(),action);
                res.add(at);
            } catch (SecurityException x) { // DLS: OK
                continue;
            }
        }
        return res;
    }

    //
    // Implements permission filters for attributes...
    //
    @Override
    String[] checkAttributes(ObjectName routingName, String[] attributes,
            String action) {
        check(routingName,null,action);
        if (attributes == null || attributes.length==0) return attributes;
        final SecurityManager sm = System.getSecurityManager();
        if (sm == null) return attributes;
        final List<String> res = new ArrayList<String>(attributes.length);
        for (String at : attributes) {
            try {
                check(routingName,at,action);
                res.add(at);
            } catch (SecurityException x) { // DLS: OK
                continue;
            }
        }
        return res.toArray(new String[res.size()]);
    }

    //
    // Implements permission filters for domains...
    //
    @Override
    String[] checkDomains(String[] domains, String action) {
        // in principle, this method is never called because
        // getDomains() will never be called - since there's
        // no way that MBeanServer.getDomains() can be routed
        // to a NamespaceInterceptor.
        //
        // This is also why there's no getDomains() in a
        // JMXNamespacePermission...
        //
        return super.checkDomains(domains, action);
    }

    //
    // Implements permission filters for queries...
    //
    @Override
    boolean checkQuery(ObjectName routingName, String action) {
        try {
            check(routingName,null,action);
            return true;
        } catch (SecurityException x) { // DLS: OK
            return false;
        }
    }

}