|
| 1 | +/* |
| 2 | + * This file is part of ReadonlyREST. |
| 3 | + * |
| 4 | + * ReadonlyREST is free software: you can redistribute it and/or modify |
| 5 | + * it under the terms of the GNU General Public License as published by |
| 6 | + * the Free Software Foundation, either version 3 of the License, or |
| 7 | + * (at your option) any later version. |
| 8 | + * |
| 9 | + * ReadonlyREST is distributed in the hope that it will be useful, |
| 10 | + * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | + * GNU General Public License for more details. |
| 13 | + * |
| 14 | + * You should have received a copy of the GNU General Public License |
| 15 | + * along with ReadonlyREST. If not, see http://www.gnu.org/licenses/ |
| 16 | + */ |
| 17 | +package tech.beshu.ror.tools.core.patches.internal.modifiers.bytecodeJars.entitlements |
| 18 | + |
| 19 | +import just.semver.SemVer |
| 20 | +import org.objectweb.asm.* |
| 21 | +import org.objectweb.asm.tree.* |
| 22 | +import tech.beshu.ror.tools.core.patches.internal.modifiers.BytecodeJarModifier |
| 23 | +import tech.beshu.ror.tools.core.utils.EsUtil.{es8190, es900, es903} |
| 24 | + |
| 25 | +import java.io.{File, InputStream} |
| 26 | + |
| 27 | +private[patches] class ModifyPolicyCheckerImplClass(esVersion: SemVer) |
| 28 | + extends BytecodeJarModifier { |
| 29 | + |
| 30 | + override def apply(jar: File): Unit = { |
| 31 | + modifyFileInJar( |
| 32 | + jar = jar, |
| 33 | + filePathString = "org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.class", |
| 34 | + processFileContent = dontValidateFileAccessInCaseOfRorPlugin |
| 35 | + ) |
| 36 | + } |
| 37 | + |
| 38 | + private def dontValidateFileAccessInCaseOfRorPlugin(moduleInputStream: InputStream) = { |
| 39 | + val reader = new ClassReader(moduleInputStream) |
| 40 | + val writer = new ClassWriter(reader, ClassWriter.COMPUTE_FRAMES) |
| 41 | + reader.accept(new EsClassVisitor(writer), 0) |
| 42 | + writer.toByteArray |
| 43 | + } |
| 44 | + |
| 45 | + private class EsClassVisitor(writer: ClassWriter) |
| 46 | + extends ClassVisitor(Opcodes.ASM9, writer) { |
| 47 | + |
| 48 | + override def visitMethod(access: Int, |
| 49 | + name: String, |
| 50 | + descriptor: String, |
| 51 | + signature: String, |
| 52 | + exceptions: Array[String]): MethodVisitor = { |
| 53 | + name match { |
| 54 | + case "checkFileRead" => |
| 55 | + esVersion match { |
| 56 | + case v if v >= es903 => |
| 57 | + val mv = super.visitMethod(access, name, descriptor, signature, exceptions) |
| 58 | + new CheckFileReadMethodShouldNotValidateFileAccessInCaseOfRorPlugin(access, name, descriptor, signature, exceptions, mv) |
| 59 | + case v if v >= es900 => |
| 60 | + super.visitMethod(access, name, descriptor, signature, exceptions) |
| 61 | + case v if v >= es8190 => |
| 62 | + val mv = super.visitMethod(access, name, descriptor, signature, exceptions) |
| 63 | + new CheckFileReadMethodShouldNotValidateFileAccessInCaseOfRorPlugin(access, name, descriptor, signature, exceptions, mv) |
| 64 | + case v => |
| 65 | + super.visitMethod(access, name, descriptor, signature, exceptions) |
| 66 | + } |
| 67 | + case _ => |
| 68 | + super.visitMethod(access, name, descriptor, signature, exceptions) |
| 69 | + } |
| 70 | + } |
| 71 | + } |
| 72 | + |
| 73 | + private class CheckFileReadMethodShouldNotValidateFileAccessInCaseOfRorPlugin(access: Int, |
| 74 | + name: String, |
| 75 | + desc: String, |
| 76 | + signature: String, |
| 77 | + exceptions: Array[String], |
| 78 | + underlying: MethodVisitor) |
| 79 | + extends MethodNode(Opcodes.ASM9, access, name, desc, signature, exceptions) { |
| 80 | + |
| 81 | + override def visitEnd(): Unit = { |
| 82 | + patchAllCanReadCalls() |
| 83 | + accept(underlying) |
| 84 | + } |
| 85 | + |
| 86 | + private def patchAllCanReadCalls(): Unit = { |
| 87 | + val insns = instructions |
| 88 | + var insn = insns.getFirst |
| 89 | + |
| 90 | + while (insn != null) { |
| 91 | + val nextInsn = insn.getNext |
| 92 | + |
| 93 | + insn match { |
| 94 | + case m: MethodInsnNode |
| 95 | + if m.name == "canRead" && m.desc == "(Ljava/nio/file/Path;)Z" => |
| 96 | + |
| 97 | + val loadPath = m.getPrevious |
| 98 | + val fileAccessCall = if (loadPath != null) loadPath.getPrevious else null |
| 99 | + val loadEnt = if (fileAccessCall != null) fileAccessCall.getPrevious else null |
| 100 | + |
| 101 | + (loadEnt, fileAccessCall, loadPath) match { |
| 102 | + case (ve: VarInsnNode, fa: MethodInsnNode, vp: VarInsnNode) |
| 103 | + if ve.getOpcode == Opcodes.ALOAD && |
| 104 | + vp.getOpcode == Opcodes.ALOAD && |
| 105 | + fa.name == "fileAccess" => |
| 106 | + |
| 107 | + val entIdx = ve.`var` |
| 108 | + val pathIdx = vp.`var` |
| 109 | + |
| 110 | + val lElse = new LabelNode() |
| 111 | + val lEnd = new LabelNode() |
| 112 | + |
| 113 | + val replacement = new InsnList() |
| 114 | + |
| 115 | + // "readonlyrest".equals(entitlements.componentName()) |
| 116 | + replacement.add(new LdcInsnNode("readonlyrest")) |
| 117 | + replacement.add(new VarInsnNode(Opcodes.ALOAD, entIdx)) |
| 118 | + replacement.add(new MethodInsnNode( |
| 119 | + Opcodes.INVOKEVIRTUAL, |
| 120 | + fa.owner, |
| 121 | + "componentName", |
| 122 | + "()Ljava/lang/String;", |
| 123 | + false |
| 124 | + )) |
| 125 | + replacement.add(new MethodInsnNode( |
| 126 | + Opcodes.INVOKEVIRTUAL, |
| 127 | + "java/lang/String", |
| 128 | + "equals", |
| 129 | + "(Ljava/lang/Object;)Z", |
| 130 | + false |
| 131 | + )) |
| 132 | + |
| 133 | + // if false -> else branch |
| 134 | + replacement.add(new JumpInsnNode(Opcodes.IFEQ, lElse)) |
| 135 | + |
| 136 | + // true branch => push true |
| 137 | + replacement.add(new InsnNode(Opcodes.ICONST_1)) |
| 138 | + replacement.add(new JumpInsnNode(Opcodes.GOTO, lEnd)) |
| 139 | + |
| 140 | + // else branch => original entitlements.fileAccess().canRead(path) |
| 141 | + replacement.add(lElse) |
| 142 | + replacement.add(new VarInsnNode(Opcodes.ALOAD, entIdx)) |
| 143 | + replacement.add(new MethodInsnNode(fa.getOpcode, fa.owner, fa.name, fa.desc, fa.itf)) |
| 144 | + replacement.add(new VarInsnNode(Opcodes.ALOAD, pathIdx)) |
| 145 | + replacement.add(new MethodInsnNode(m.getOpcode, m.owner, m.name, m.desc, m.itf)) |
| 146 | + |
| 147 | + replacement.add(lEnd) |
| 148 | + |
| 149 | + // Insert replacement before the start of the old sequence, then remove old nodes |
| 150 | + insns.insertBefore(ve, replacement) |
| 151 | + insns.remove(ve) |
| 152 | + insns.remove(fa) |
| 153 | + insns.remove(vp) |
| 154 | + insns.remove(m) |
| 155 | + case _ => // pattern didn't match; do nothing |
| 156 | + } |
| 157 | + case _ => // ignore |
| 158 | + } |
| 159 | + insn = nextInsn |
| 160 | + } |
| 161 | + } |
| 162 | + } |
| 163 | +} |
0 commit comments