From 152de87dc21260c3a9f25c1a0e9eee78900a3cda Mon Sep 17 00:00:00 2001 From: Michael Jumper Date: Sat, 22 Oct 2016 20:19:18 -0700 Subject: [PATCH 1/2] GUACAMOLE-189: Allow per-connection guacd parameters for the JDBC auth. --- .../guacamole/auth/jdbc/JDBCEnvironment.java | 38 +++++ .../auth/jdbc/connection/ConnectionModel.java | 92 ++++++++++++ .../GuacamoleProxyConfiguration.java | 132 +++++++++++++++++ .../jdbc/connection/ModeledConnection.java | 140 +++++++++++++++++- .../AbstractGuacamoleTunnelService.java | 75 +++++----- .../src/main/resources/translations/en.json | 11 +- .../schema/upgrade/upgrade-pre-0.9.13.sql | 30 ++++ .../auth/jdbc/connection/ConnectionMapper.xml | 34 ++++- .../schema/upgrade/upgrade-pre-0.9.13.sql | 35 +++++ .../auth/jdbc/connection/ConnectionMapper.xml | 34 ++++- 10 files changed, 571 insertions(+), 50 deletions(-) create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.13.sql create mode 100644 extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.13.sql diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java index dfbf0e9b5..52aed0318 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java @@ -20,6 +20,8 @@ package org.apache.guacamole.auth.jdbc; import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration; +import org.apache.guacamole.environment.Environment; import org.apache.guacamole.environment.LocalEnvironment; import org.apache.guacamole.auth.jdbc.security.PasswordPolicy; @@ -29,6 +31,18 @@ import org.apache.guacamole.auth.jdbc.security.PasswordPolicy; */ public abstract class JDBCEnvironment extends LocalEnvironment { + /** + * The hostname to use when connecting to guacd if no hostname is provided + * within guacamole.properties. + */ + private static final String DEFAULT_GUACD_HOSTNAME = "localhost"; + + /** + * The port to use when connecting to guacd if no port is provided within + * guacamole.properties. + */ + private static final int DEFAULT_GUACD_PORT = 4822; + /** * Constructs a new JDBCEnvironment using an underlying LocalEnviroment to * read properties from the file system. @@ -40,6 +54,30 @@ public abstract class JDBCEnvironment extends LocalEnvironment { super(); } + /** + * Returns the connection information which should be used, by default, to + * connect to guacd when establishing a remote desktop connection. + * + * @return + * The connection information which should be used, by default, to + * connect to guacd. + * + * @throws GuacamoleException + * If the properties describing the connection information for guacd + * cannot be parsed. + */ + public GuacamoleProxyConfiguration getDefaultGuacamoleProxyConfiguration() + throws GuacamoleException { + + // Parse guacd hostname/port/ssl properties + return new GuacamoleProxyConfiguration( + getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME), + getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT), + getProperty(Environment.GUACD_SSL, false) + ); + + } + /** * Returns whether a database user account is required for authentication to * succeed, even if another authentication provider has already diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java index ac104551f..92346b7ed 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java @@ -22,6 +22,7 @@ package org.apache.guacamole.auth.jdbc.connection; import java.util.HashSet; import java.util.Set; import org.apache.guacamole.auth.jdbc.base.ChildObjectModel; +import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration.EncryptionMethod; /** * Object representation of a Guacamole connection, as represented in the @@ -59,6 +60,24 @@ public class ConnectionModel extends ChildObjectModel { */ private Set sharingProfileIdentifiers = new HashSet(); + /** + * The hostname of the guacd instance to use, or null if the hostname of the + * default guacd instance should be used. + */ + private String proxyHostname; + + /** + * The port of the guacd instance to use, or null if the port of the default + * guacd instance should be used. + */ + private Integer proxyPort; + + /** + * The encryption method required by the desired guacd instance, or null if + * the encryption method of the default guacd instance should be used. + */ + private EncryptionMethod proxyEncryptionMethod; + /** * Creates a new, empty connection. */ @@ -158,6 +177,79 @@ public class ConnectionModel extends ChildObjectModel { this.maxConnectionsPerUser = maxConnectionsPerUser; } + /** + * Returns the hostname of the guacd instance to use. If the hostname of the + * default guacd instance should be used instead, null is returned. + * + * @return + * The hostname of the guacd instance to use, or null if the hostname + * of the default guacd instance should be used. + */ + public String getProxyHostname() { + return proxyHostname; + } + + /** + * Sets the hostname of the guacd instance to use. + * + * @param proxyHostname + * The hostname of the guacd instance to use, or null if the hostname + * of the default guacd instance should be used. + */ + public void setProxyHostname(String proxyHostname) { + this.proxyHostname = proxyHostname; + } + + /** + * Returns the port of the guacd instance to use. If the port of the default + * guacd instance should be used instead, null is returned. + * + * @return + * The port of the guacd instance to use, or null if the port of the + * default guacd instance should be used. + */ + public Integer getProxyPort() { + return proxyPort; + } + + /** + * Sets the port of the guacd instance to use. + * + * @param proxyPort + * The port of the guacd instance to use, or null if the port of the + * default guacd instance should be used. + */ + public void setProxyPort(Integer proxyPort) { + this.proxyPort = proxyPort; + } + + /** + * Returns the type of encryption required by the desired guacd instance. + * If the encryption method of the default guacd instance should be used + * instead, null is returned. + * + * @return + * The type of encryption required by the desired guacd instance, or + * null if the encryption method of the default guacd instance should + * be used. + */ + public EncryptionMethod getProxyEncryptionMethod() { + return proxyEncryptionMethod; + } + + /** + * Sets the type of encryption which should be used when connecting to + * guacd, if any. + * + * @param proxyEncryptionMethod + * The type of encryption required by the desired guacd instance, or + * null if the encryption method of the default guacd instance should + * be used. + */ + public void setProxyEncryptionMethod(EncryptionMethod proxyEncryptionMethod) { + this.proxyEncryptionMethod = proxyEncryptionMethod; + } + /** * Returns the identifiers of all readable sharing profiles associated with * this connection. This is set only when the connection is queried, and has diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java new file mode 100644 index 000000000..28d02e896 --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java @@ -0,0 +1,132 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package org.apache.guacamole.auth.jdbc.connection; + +/** + * Information which describes how the connection to guacd should be + * established. This includes the hostname and port which guacd is listening on, + * as well as the type of encryption required, if any. + * + * @author Michael Jumper + */ +public class GuacamoleProxyConfiguration { + + /** + * All possible types of encryption used by guacd. + */ + public enum EncryptionMethod { + + /** + * Unencrypted (plaintext). + */ + NONE, + + /** + * Encrypted with SSL or TLS. + */ + SSL + + } + + /** + * The hostname or address of the machine where guacd is running. + */ + private final String hostname; + + /** + * The port that guacd is listening on. + */ + private final int port; + + /** + * The type of encryption required by guacd. + */ + private final EncryptionMethod encryptionMethod; + + /** + * Creates a new GuacamoleProxyConfiguration having the given hostname, + * port, and encryption method. + * + * @param hostname + * The hostname or address of the machine where guacd is running. + * + * @param port + * The port that guacd is listening on. + * + * @param encryptionMethod + * The type of encryption required by the instance of guacd running at + * the given hostname and port. + */ + public GuacamoleProxyConfiguration(String hostname, int port, + EncryptionMethod encryptionMethod) { + this.hostname = hostname; + this.port = port; + this.encryptionMethod = encryptionMethod; + } + + /** + * Creates a new GuacamoleProxyConfiguration having the given hostname and + * port, with encryption method being restricted to either NONE or SSL. + * + * @param hostname + * The hostname or address of the machine where guacd is running. + * + * @param port + * The port that guacd is listening on. + * + * @param ssl + * true if guacd requires SSL/TLS encryption, false if communication + * with guacd should be unencrypted. + */ + public GuacamoleProxyConfiguration(String hostname, int port, boolean ssl) { + this(hostname, port, ssl ? EncryptionMethod.SSL : EncryptionMethod.NONE); + } + + /** + * Returns the hostname or address of the machine where guacd is running. + * + * @return + * The hostname or address of the machine where guacd is running. + */ + public String getHostname() { + return hostname; + } + + /** + * Returns the port that guacd is listening on. + * + * @return + * The port that guacd is listening on. + */ + public int getPort() { + return port; + } + + /** + * Returns the type of encryption required by guacd. + * + * @return + * The type of encryption required by guacd. + */ + public EncryptionMethod getEncryptionMethod() { + return encryptionMethod; + } + +} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java index cbfdb68ca..2de235cec 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java @@ -32,9 +32,12 @@ import org.apache.guacamole.auth.jdbc.tunnel.GuacamoleTunnelService; import org.apache.guacamole.GuacamoleException; import org.apache.guacamole.auth.jdbc.JDBCEnvironment; import org.apache.guacamole.auth.jdbc.base.ModeledChildDirectoryObject; +import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration.EncryptionMethod; +import org.apache.guacamole.form.EnumField; import org.apache.guacamole.form.Field; import org.apache.guacamole.form.Form; import org.apache.guacamole.form.NumericField; +import org.apache.guacamole.form.TextField; import org.apache.guacamole.net.GuacamoleTunnel; import org.apache.guacamole.net.auth.Connection; import org.apache.guacamole.net.auth.ConnectionRecord; @@ -55,6 +58,51 @@ public class ModeledConnection extends ModeledChildDirectoryObjectasList( + new TextField(GUACD_HOSTNAME_NAME), + new NumericField(GUACD_PORT_NAME), + new EnumField(GUACD_ENCRYPTION_NAME, Arrays.asList( + "", + GUACD_ENCRYPTION_VALUE_NONE, + GUACD_ENCRYPTION_VALUE_SSL + )) + )); + /** * The name of the attribute which controls the maximum number of * concurrent connections. @@ -81,7 +129,8 @@ public class ModeledConnection extends ModeledChildDirectoryObject ATTRIBUTES = Collections.unmodifiableCollection(Arrays.asList( - CONCURRENCY_LIMITS + CONCURRENCY_LIMITS, + GUACD_PARAMETERS )); /** @@ -186,6 +235,35 @@ public class ModeledConnection extends ModeledChildDirectoryObject activeConnectionRecordProvider; - /** - * The hostname to use when connecting to guacd if no hostname is provided - * within guacamole.properties. - */ - private static final String DEFAULT_GUACD_HOSTNAME = "localhost"; - - /** - * The port to use when connecting to guacd if no port is provided within - * guacamole.properties. - */ - private static final int DEFAULT_GUACD_PORT = 4822; - /** * All active connections through the tunnel having a given UUID. */ @@ -333,6 +316,13 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS * Returns an unconfigured GuacamoleSocket that is already connected to * guacd as specified in guacamole.properties, using SSL if necessary. * + * @param proxyConfig + * The configuration information to use when connecting to guacd. + * + * @param socketClosedCallback + * The callback which should be invoked whenever the returned socket + * closes. + * * @return * An unconfigured GuacamoleSocket, already connected to guacd. * @@ -340,23 +330,33 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS * If an error occurs while connecting to guacd, or while parsing * guacd-related properties. */ - private GuacamoleSocket getUnconfiguredGuacamoleSocket(Runnable socketClosedCallback) - throws GuacamoleException { + private GuacamoleSocket getUnconfiguredGuacamoleSocket( + GuacamoleProxyConfiguration proxyConfig, + Runnable socketClosedCallback) throws GuacamoleException { - // Use SSL if requested - if (environment.getProperty(Environment.GUACD_SSL, false)) - return new ManagedSSLGuacamoleSocket( - environment.getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME), - environment.getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT), - socketClosedCallback - ); + // Select socket type depending on desired encryption + switch (proxyConfig.getEncryptionMethod()) { - // Otherwise, just use straight TCP - return new ManagedInetGuacamoleSocket( - environment.getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME), - environment.getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT), - socketClosedCallback - ); + // Use SSL if requested + case SSL: + return new ManagedSSLGuacamoleSocket( + proxyConfig.getHostname(), + proxyConfig.getPort(), + socketClosedCallback + ); + + // Use straight TCP if unencrypted + case NONE: + return new ManagedInetGuacamoleSocket( + proxyConfig.getHostname(), + proxyConfig.getPort(), + socketClosedCallback + ); + + } + + // Bail out if encryption method is unknown + throw new GuacamoleServerException("Unimplemented encryption method."); } @@ -472,10 +472,12 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS GuacamoleConfiguration config; + // Retrieve connection information associated with given connection record + ModeledConnection connection = activeConnection.getConnection(); + // Pull configuration directly from the connection if we are not // joining an active connection if (activeConnection.isPrimaryConnection()) { - ModeledConnection connection = activeConnection.getConnection(); activeConnections.put(connection.getIdentifier(), activeConnection); activeConnectionGroups.put(connection.getParentIdentifier(), activeConnection); config = getGuacamoleConfiguration(activeConnection.getUser(), connection); @@ -499,7 +501,8 @@ public abstract class AbstractGuacamoleTunnelService implements GuacamoleTunnelS // Obtain socket which will automatically run the cleanup task ConfiguredGuacamoleSocket socket = new ConfiguredGuacamoleSocket( - getUnconfiguredGuacamoleSocket(cleanupTask), config, info); + getUnconfiguredGuacamoleSocket(connection.getGuacamoleProxyConfiguration(), + cleanupTask), config, info); // Assign and return new tunnel if (interceptErrors) diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json index 78728c3c6..f182aacb7 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/resources/translations/en.json @@ -20,7 +20,16 @@ "FIELD_HEADER_MAX_CONNECTIONS" : "Maximum number of connections:", "FIELD_HEADER_MAX_CONNECTIONS_PER_USER" : "Maximum number of connections per user:", - "SECTION_HEADER_CONCURRENCY" : "Concurrency Limits" + "FIELD_HEADER_GUACD_HOSTNAME" : "Hostname:", + "FIELD_HEADER_GUACD_ENCRYPTION" : "Encryption:", + "FIELD_HEADER_GUACD_PORT" : "Port:", + + "FIELD_OPTION_GUACD_ENCRYPTION_EMPTY" : "", + "FIELD_OPTION_GUACD_ENCRYPTION_NONE" : "None (unencrypted)", + "FIELD_OPTION_GUACD_ENCRYPTION_SSL" : "SSL / TLS", + + "SECTION_HEADER_CONCURRENCY" : "Concurrency Limits", + "SECTION_HEADER_GUACD" : "Guacamole Proxy Parameters (guacd)" }, diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.13.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.13.sql new file mode 100644 index 000000000..bb37c6c31 --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/schema/upgrade/upgrade-pre-0.9.13.sql @@ -0,0 +1,30 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, +-- software distributed under the License is distributed on an +-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +-- KIND, either express or implied. See the License for the +-- specific language governing permissions and limitations +-- under the License. +-- + +-- +-- Add guacd per-connection override columns +-- + +ALTER TABLE guacamole_connection ADD COLUMN proxy_port INT(11); +ALTER TABLE guacamole_connection ADD COLUMN proxy_hostname VARCHAR(512); + +ALTER TABLE guacamole_connection ADD COLUMN proxy_encryption_method ENUM( + 'NONE', + 'SSL' +); diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml index 0fd026579..e4b52943a 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml @@ -33,6 +33,10 @@ + + + parent_id = #{parentIdentifier,jdbcType=VARCHAR} @@ -173,14 +186,20 @@ parent_id, protocol, max_connections, - max_connections_per_user + max_connections_per_user, + proxy_hostname, + proxy_port, + proxy_encryption_method ) VALUES ( #{object.name,jdbcType=VARCHAR}, #{object.parentIdentifier,jdbcType=VARCHAR}, #{object.protocol,jdbcType=VARCHAR}, #{object.maxConnections,jdbcType=INTEGER}, - #{object.maxConnectionsPerUser,jdbcType=INTEGER} + #{object.maxConnectionsPerUser,jdbcType=INTEGER}, + #{object.proxyHostname,jdbcType=VARCHAR}, + #{object.proxyPort,jdbcType=INTEGER}, + #{object.proxyEncryptionMethod,jdbcType=VARCHAR} ) @@ -192,7 +211,10 @@ parent_id = #{object.parentIdentifier,jdbcType=VARCHAR}, protocol = #{object.protocol,jdbcType=VARCHAR}, max_connections = #{object.maxConnections,jdbcType=INTEGER}, - max_connections_per_user = #{object.maxConnectionsPerUser,jdbcType=INTEGER} + max_connections_per_user = #{object.maxConnectionsPerUser,jdbcType=INTEGER}, + proxy_hostname = #{object.proxyHostname,jdbcType=VARCHAR}, + proxy_port = #{object.proxyPort,jdbcType=INTEGER}, + proxy_encryption_method = #{object.proxyEncryptionMethod,jdbcType=VARCHAR} WHERE connection_id = #{object.objectID,jdbcType=INTEGER} diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.13.sql b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.13.sql new file mode 100644 index 000000000..015ec9a6c --- /dev/null +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/schema/upgrade/upgrade-pre-0.9.13.sql @@ -0,0 +1,35 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, +-- software distributed under the License is distributed on an +-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +-- KIND, either express or implied. See the License for the +-- specific language governing permissions and limitations +-- under the License. +-- + +-- +-- Add new guacd encryption method type +-- + +CREATE TYPE guacamole_proxy_encryption_method AS ENUM( + 'NONE', + 'SSL' +); + +-- +-- Add guacd per-connection override columns +-- + +ALTER TABLE guacamole_connection ADD COLUMN proxy_port integer; +ALTER TABLE guacamole_connection ADD COLUMN proxy_hostname varchar(512); +ALTER TABLE guacamole_connection ADD COLUMN proxy_encryption_method guacamole_proxy_encryption_method; diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml index 5fe9de43a..aedd86b20 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml @@ -33,6 +33,10 @@ + + + parent_id = #{parentIdentifier,jdbcType=INTEGER}::integer @@ -173,14 +186,20 @@ parent_id, protocol, max_connections, - max_connections_per_user + max_connections_per_user, + proxy_hostname, + proxy_port, + proxy_encryption_method ) VALUES ( #{object.name,jdbcType=VARCHAR}, #{object.parentIdentifier,jdbcType=INTEGER}::integer, #{object.protocol,jdbcType=VARCHAR}, #{object.maxConnections,jdbcType=INTEGER}, - #{object.maxConnectionsPerUser,jdbcType=INTEGER} + #{object.maxConnectionsPerUser,jdbcType=INTEGER}, + #{object.proxyHostname,jdbcType=VARCHAR}, + #{object.proxyPort,jdbcType=INTEGER}, + #{object.proxyEncryptionMethod,jdbcType=VARCHAR}::guacamole_proxy_encryption_method ) @@ -192,7 +211,10 @@ parent_id = #{object.parentIdentifier,jdbcType=INTEGER}::integer, protocol = #{object.protocol,jdbcType=VARCHAR}, max_connections = #{object.maxConnections,jdbcType=INTEGER}, - max_connections_per_user = #{object.maxConnectionsPerUser,jdbcType=INTEGER} + max_connections_per_user = #{object.maxConnectionsPerUser,jdbcType=INTEGER}, + proxy_hostname = #{object.proxyHostname,jdbcType=VARCHAR}, + proxy_port = #{object.proxyPort,jdbcType=INTEGER}, + proxy_encryption_method = #{object.proxyEncryptionMethod,jdbcType=VARCHAR}::guacamole_proxy_encryption_method WHERE connection_id = #{object.objectID,jdbcType=INTEGER}::integer From 31b1b42ba6bf873e3f7af0848c6c24495027a14d Mon Sep 17 00:00:00 2001 From: Michael Jumper Date: Tue, 24 Jan 2017 21:38:31 -0800 Subject: [PATCH 2/2] GUACAMOLE-189: Refactor GuacamoleProxyConfiguration to guacamole-ext. --- .../guacamole/auth/jdbc/JDBCEnvironment.java | 38 ------------ .../auth/jdbc/connection/ConnectionModel.java | 2 +- .../jdbc/connection/ModeledConnection.java | 3 +- .../AbstractGuacamoleTunnelService.java | 2 +- .../auth/jdbc/connection/ConnectionMapper.xml | 4 +- .../auth/jdbc/connection/ConnectionMapper.xml | 4 +- .../guacamole/environment/Environment.java | 16 +++++ .../environment/LocalEnvironment.java | 32 ++++++++++ .../auth}/GuacamoleProxyConfiguration.java | 2 +- .../net/auth/simple/SimpleConnection.java | 61 ++++++++++--------- 10 files changed, 89 insertions(+), 75 deletions(-) rename {extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection => guacamole-ext/src/main/java/org/apache/guacamole/net/auth}/GuacamoleProxyConfiguration.java (98%) diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java index 52aed0318..dfbf0e9b5 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/JDBCEnvironment.java @@ -20,8 +20,6 @@ package org.apache.guacamole.auth.jdbc; import org.apache.guacamole.GuacamoleException; -import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration; -import org.apache.guacamole.environment.Environment; import org.apache.guacamole.environment.LocalEnvironment; import org.apache.guacamole.auth.jdbc.security.PasswordPolicy; @@ -31,18 +29,6 @@ import org.apache.guacamole.auth.jdbc.security.PasswordPolicy; */ public abstract class JDBCEnvironment extends LocalEnvironment { - /** - * The hostname to use when connecting to guacd if no hostname is provided - * within guacamole.properties. - */ - private static final String DEFAULT_GUACD_HOSTNAME = "localhost"; - - /** - * The port to use when connecting to guacd if no port is provided within - * guacamole.properties. - */ - private static final int DEFAULT_GUACD_PORT = 4822; - /** * Constructs a new JDBCEnvironment using an underlying LocalEnviroment to * read properties from the file system. @@ -54,30 +40,6 @@ public abstract class JDBCEnvironment extends LocalEnvironment { super(); } - /** - * Returns the connection information which should be used, by default, to - * connect to guacd when establishing a remote desktop connection. - * - * @return - * The connection information which should be used, by default, to - * connect to guacd. - * - * @throws GuacamoleException - * If the properties describing the connection information for guacd - * cannot be parsed. - */ - public GuacamoleProxyConfiguration getDefaultGuacamoleProxyConfiguration() - throws GuacamoleException { - - // Parse guacd hostname/port/ssl properties - return new GuacamoleProxyConfiguration( - getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME), - getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT), - getProperty(Environment.GUACD_SSL, false) - ); - - } - /** * Returns whether a database user account is required for authentication to * succeed, even if another authentication provider has already diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java index 92346b7ed..44f4b3b69 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ConnectionModel.java @@ -22,7 +22,7 @@ package org.apache.guacamole.auth.jdbc.connection; import java.util.HashSet; import java.util.Set; import org.apache.guacamole.auth.jdbc.base.ChildObjectModel; -import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration.EncryptionMethod; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration.EncryptionMethod; /** * Object representation of a Guacamole connection, as represented in the diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java index 2de235cec..bcd7b117e 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/ModeledConnection.java @@ -32,7 +32,6 @@ import org.apache.guacamole.auth.jdbc.tunnel.GuacamoleTunnelService; import org.apache.guacamole.GuacamoleException; import org.apache.guacamole.auth.jdbc.JDBCEnvironment; import org.apache.guacamole.auth.jdbc.base.ModeledChildDirectoryObject; -import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration.EncryptionMethod; import org.apache.guacamole.form.EnumField; import org.apache.guacamole.form.Field; import org.apache.guacamole.form.Form; @@ -41,6 +40,8 @@ import org.apache.guacamole.form.TextField; import org.apache.guacamole.net.GuacamoleTunnel; import org.apache.guacamole.net.auth.Connection; import org.apache.guacamole.net.auth.ConnectionRecord; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration.EncryptionMethod; import org.apache.guacamole.protocol.GuacamoleClientInformation; import org.apache.guacamole.protocol.GuacamoleConfiguration; import org.slf4j.Logger; diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java index abdeaffe1..392d01944 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/tunnel/AbstractGuacamoleTunnelService.java @@ -57,12 +57,12 @@ import org.apache.guacamole.token.StandardTokens; import org.apache.guacamole.token.TokenFilter; import org.mybatis.guice.transactional.Transactional; import org.apache.guacamole.auth.jdbc.connection.ConnectionParameterMapper; -import org.apache.guacamole.auth.jdbc.connection.GuacamoleProxyConfiguration; import org.apache.guacamole.auth.jdbc.sharing.connection.SharedConnectionDefinition; import org.apache.guacamole.auth.jdbc.sharingprofile.ModeledSharingProfile; import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterMapper; import org.apache.guacamole.auth.jdbc.sharingprofile.SharingProfileParameterModel; import org.apache.guacamole.auth.jdbc.user.RemoteAuthenticatedUser; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration; import org.apache.guacamole.protocol.FailoverGuacamoleSocket; import org.slf4j.Logger; import org.slf4j.LoggerFactory; diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml index e4b52943a..46f8f1039 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml @@ -36,7 +36,7 @@ + javaType="org.apache.guacamole.net.auth.GuacamoleProxyConfiguration$EncryptionMethod"/> - \ No newline at end of file + diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml index aedd86b20..44828fa29 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml +++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/apache/guacamole/auth/jdbc/connection/ConnectionMapper.xml @@ -36,7 +36,7 @@ + javaType="org.apache.guacamole.net.auth.GuacamoleProxyConfiguration$EncryptionMethod"/> - \ No newline at end of file + diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/environment/Environment.java b/guacamole-ext/src/main/java/org/apache/guacamole/environment/Environment.java index 445f1efe7..43f8f7560 100644 --- a/guacamole-ext/src/main/java/org/apache/guacamole/environment/Environment.java +++ b/guacamole-ext/src/main/java/org/apache/guacamole/environment/Environment.java @@ -22,6 +22,7 @@ package org.apache.guacamole.environment; import java.io.File; import java.util.Map; import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration; import org.apache.guacamole.properties.BooleanGuacamoleProperty; import org.apache.guacamole.properties.GuacamoleProperty; import org.apache.guacamole.properties.IntegerGuacamoleProperty; @@ -146,4 +147,19 @@ public interface Environment { public Type getRequiredProperty(GuacamoleProperty property) throws GuacamoleException; + /** + * Returns the connection information which should be used, by default, to + * connect to guacd when establishing a remote desktop connection. + * + * @return + * The connection information which should be used, by default, to + * connect to guacd. + * + * @throws GuacamoleException + * If the the connection information for guacd cannot be + * retrieved. + */ + public GuacamoleProxyConfiguration getDefaultGuacamoleProxyConfiguration() + throws GuacamoleException; + } diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/environment/LocalEnvironment.java b/guacamole-ext/src/main/java/org/apache/guacamole/environment/LocalEnvironment.java index 74adaea84..0b7ffadbf 100644 --- a/guacamole-ext/src/main/java/org/apache/guacamole/environment/LocalEnvironment.java +++ b/guacamole-ext/src/main/java/org/apache/guacamole/environment/LocalEnvironment.java @@ -30,6 +30,7 @@ import java.util.Properties; import org.codehaus.jackson.map.ObjectMapper; import org.apache.guacamole.GuacamoleException; import org.apache.guacamole.GuacamoleServerException; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration; import org.apache.guacamole.properties.GuacamoleProperty; import org.apache.guacamole.protocols.ProtocolInfo; import org.slf4j.Logger; @@ -53,6 +54,24 @@ public class LocalEnvironment implements Environment { private static final String[] KNOWN_PROTOCOLS = new String[]{ "vnc", "rdp", "ssh", "telnet"}; + /** + * The hostname to use when connecting to guacd if no hostname is provided + * within guacamole.properties. + */ + private static final String DEFAULT_GUACD_HOSTNAME = "localhost"; + + /** + * The port to use when connecting to guacd if no port is provided within + * guacamole.properties. + */ + private static final int DEFAULT_GUACD_PORT = 4822; + + /** + * Whether SSL/TLS is enabled for connections to guacd if not specified + * within guacamole.properties. + */ + private static final boolean DEFAULT_GUACD_SSL = false; + /** * All properties read from guacamole.properties. */ @@ -313,4 +332,17 @@ public class LocalEnvironment implements Environment { return availableProtocols.get(name); } + @Override + public GuacamoleProxyConfiguration getDefaultGuacamoleProxyConfiguration() + throws GuacamoleException { + + // Parse guacd hostname/port/ssl properties + return new GuacamoleProxyConfiguration( + getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME), + getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT), + getProperty(Environment.GUACD_SSL, DEFAULT_GUACD_SSL) + ); + + } + } diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/GuacamoleProxyConfiguration.java similarity index 98% rename from extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java rename to guacamole-ext/src/main/java/org/apache/guacamole/net/auth/GuacamoleProxyConfiguration.java index 28d02e896..7a2483743 100644 --- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/connection/GuacamoleProxyConfiguration.java +++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/GuacamoleProxyConfiguration.java @@ -17,7 +17,7 @@ * under the License. */ -package org.apache.guacamole.auth.jdbc.connection; +package org.apache.guacamole.net.auth; /** * Information which describes how the connection to guacd should be diff --git a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleConnection.java b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleConnection.java index fe25fcfac..2251a9edf 100644 --- a/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleConnection.java +++ b/guacamole-ext/src/main/java/org/apache/guacamole/net/auth/simple/SimpleConnection.java @@ -23,6 +23,7 @@ import java.util.Collections; import java.util.List; import java.util.Map; import org.apache.guacamole.GuacamoleException; +import org.apache.guacamole.GuacamoleServerException; import org.apache.guacamole.environment.Environment; import org.apache.guacamole.environment.LocalEnvironment; import org.apache.guacamole.net.GuacamoleSocket; @@ -32,6 +33,7 @@ import org.apache.guacamole.net.SSLGuacamoleSocket; import org.apache.guacamole.net.SimpleGuacamoleTunnel; import org.apache.guacamole.net.auth.AbstractConnection; import org.apache.guacamole.net.auth.ConnectionRecord; +import org.apache.guacamole.net.auth.GuacamoleProxyConfiguration; import org.apache.guacamole.protocol.ConfiguredGuacamoleSocket; import org.apache.guacamole.protocol.GuacamoleClientInformation; import org.apache.guacamole.protocol.GuacamoleConfiguration; @@ -41,18 +43,6 @@ import org.apache.guacamole.protocol.GuacamoleConfiguration; */ public class SimpleConnection extends AbstractConnection { - /** - * The hostname to use when connecting to guacd if no hostname is provided - * within guacamole.properties. - */ - private static final String DEFAULT_GUACD_HOSTNAME = "localhost"; - - /** - * The port to use when connecting to guacd if no port is provided within - * guacamole.properties. - */ - private static final int DEFAULT_GUACD_PORT = 4822; - /** * Backing configuration, containing all sensitive information. */ @@ -107,27 +97,40 @@ public class SimpleConnection extends AbstractConnection { public GuacamoleTunnel connect(GuacamoleClientInformation info) throws GuacamoleException { - Environment env = new LocalEnvironment(); - + // Retrieve proxy configuration from environment + Environment environment = new LocalEnvironment(); + GuacamoleProxyConfiguration proxyConfig = environment.getDefaultGuacamoleProxyConfiguration(); + // Get guacd connection parameters - String hostname = env.getProperty(Environment.GUACD_HOSTNAME, DEFAULT_GUACD_HOSTNAME); - int port = env.getProperty(Environment.GUACD_PORT, DEFAULT_GUACD_PORT); + String hostname = proxyConfig.getHostname(); + int port = proxyConfig.getPort(); GuacamoleSocket socket; - - // If guacd requires SSL, use it - if (env.getProperty(Environment.GUACD_SSL, false)) - socket = new ConfiguredGuacamoleSocket( - new SSLGuacamoleSocket(hostname, port), - config, info - ); - // Otherwise, just connect directly via TCP - else - socket = new ConfiguredGuacamoleSocket( - new InetGuacamoleSocket(hostname, port), - config, info - ); + // Determine socket type based on required encryption method + switch (proxyConfig.getEncryptionMethod()) { + + // If guacd requires SSL, use it + case SSL: + socket = new ConfiguredGuacamoleSocket( + new SSLGuacamoleSocket(hostname, port), + config, info + ); + break; + + // Connect directly via TCP if encryption is not enabled + case NONE: + socket = new ConfiguredGuacamoleSocket( + new InetGuacamoleSocket(hostname, port), + config, info + ); + break; + + // Abort if encryption method is unknown + default: + throw new GuacamoleServerException("Unimplemented encryption method."); + + } return new SimpleGuacamoleTunnel(socket);