Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add @kbens hack for jarray.array for ConnectionFilterRules to weblogic_domain.rb #11

Open
umaritimus opened this issue Dec 2, 2021 · 0 comments

Comments

@umaritimus
Copy link
Owner

It is possible to filter t3 connection traffic by defining ConnectionFilterRules in wlst. However, defining this in psft_customizations.yaml, e.g.

    config_settings:
      /:
        ConsoleEnabled:                     false
      "/SecurityConfiguration/%{lookup('pia_domain_name')}":
        EnforceValidBasicAuthCredentials:   false
        ConnectionLoggerEnabled:            true
        ConnectionFilter:                   'weblogic.security.net.ConnectionFilterImpl'
      "/SecurityConfiguration/%{lookup('pia_domain_name')}/":
        ConnectionFilterRules:              "jarray.array([String('%{facts.networking.ip} * * allow t3 t3s'), String('127.0.0.1 * * allow t3 t3s'), String('0.0.0.0/0 * * deny t3 t3s')],String)"

requires an "IOMOD" hack in modules/pt_config/lib/puppet/provider/pt_webserver_domain/weblogic_domain.rb, i.e.:

      config_settings.each do |config|
        context_path = config.split('=', 2)[0].strip
        context_settings = config.split('=', 2)[1].strip

        wlst_file.puts("cd('/')")
        wlst_file.puts("cd('#{context_path}')")

        # IOMOD - Change to allow values containing JArray vs. String
        # The setting must be the ONLY setting under parent context, otherwise split(',') will break it
        # Also, context settings in yaml must be unique, otherwise only the last entry gets used
        # To get around this, add trailing or extra / to the conext entry
        # example: 
        #"/SecurityConfiguration/%{hiera('db_name')}"
        #  ConnectionLoggerEnabled:
        #  ConnectionFilter:
        #"/SecurityConfiguration/%{hiera('db_name')}/"
        #  ConnectionFilterRules: 
        if context_settings.include? "jarray.array"
          # trim off first and last [] vs. using delete!
          context_settings[0] = ''
          context_settings = context_settings.chomp(']')
          # delete other special chars
          context_settings.delete!("\n\"")
          Puppet.debug("Updating setting 1 #{context_settings.inspect} class #{context_settings.class}")

          # puts to file without the wrapping ''
          Puppet.debug("IOMOD - Found jarray.array")
          setting_name = context_settings.split('=', 2)[0].strip
          setting_value = context_settings.split('=', 2)[1].strip
          Puppet.debug("Found setting: #{setting_name}=#{setting_value}")
          wlst_file.puts("set('#{setting_name}', #{setting_value})")
        else
          Puppet.debug("IOMOD - Found a string, not jarray.array")
          context_settings.delete!("\n[]\"")
          Puppet.debug("Updating setting 1 #{context_settings.inspect} class #{context_settings.class}")

          context_settings_array = context_settings.split(", ")
          Puppet.debug("Updating setting 2 #{context_settings_array.inspect} class #{context_settings_array.class}")
          for index in (0...context_settings_array.length)
            context_setting = context_settings_array[index]
            setting_name = context_setting.split('=', 2)[0].strip
            setting_value = context_setting.split('=', 2)[1].strip
            Puppet.debug("Found setting: #{setting_name}=#{setting_value}")
            wlst_file.puts("set('#{setting_name}', '#{setting_value}')")
          end # IOMOD
        end
        wlst_file.puts()
      end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant