14 Commits (master)

Author	SHA1	Message	Date
Kirill Solomko	5d7e137ec9	MT#65243 Plugin::NGCP::Redis handle 'active-replica' state ... * Catalyst::Plugin::NGCP::Redis::_wait_for_master_role() only expected the 'master' value to be considered as OK, whereas with Redis/KeyDB the value can be also 'active-replica'. Therefore, consider both 'master' and 'active-replica' values as OK. Change-Id: I16a0657a3a78a2f2b3c892c21ce0d9d6ebec0a0c	5 months ago
Kirill Solomko	e5d7232b63	MT#64891 enhance Redis connection handling ... * Catalyst::Plugin::NGCP::Redis changes - new function _connect_and_cache() that now contains the migrated connect & cache code returns the connection reference - new function _get_replication_role() that sends "INFO replication" command to the server and returns the role string back - new function _wait_for_master_role() that tries to wait 5 seconds for the server to return the 'master' role, with 1 second attempt intervals - rework redis_get_connection to obtain the connection inside try/catch and use _wait_for_master_role() after reconnect, as well as using it for the 'heartbeat' part to test dead connections instead of PING (so 1 command is sent in the end instead of 2). * With the redis_get_connection rework not only does it perform an automatic reconnect attempt if it detects a dead connection but it also waits until the server is 'master', which might happen during the db node switchovers, so API requests that happen during the switchover do not end up with errors "READ ONLY ROLE", and unless there is something persistently wrong on the server side, the reconnections/swithovers should be transparent now for the clients, with only probabaly 1-2 second delays on select API requests while the server is becoming the new 'master'. Change-Id: I41bf1f55a07b56e4fceef243f09f316694d62a39	6 months ago
Kirill Solomko	60fa23cb68	MT#60585 add user ban support ... * users for admin/subscriber realms are now banned if failed to login X amount of times (UI/API). * rework Redis connection and it's now a Catalyst plugin NGCP::Redis accessed by $c->redis_get_connection({database => 19}), the connection per database, per worker process is established only once and then reused (with auto built-in reconnect support). * remove Utils::Redis.pm as it does not have any code/logic anymore. * ban values are taken from $config->{security}{login} as - ban_enable: 1 - ban_expire_time: 3600 ban expire time in seconds - max_attempts: 5 * if max_attempts set to 0, the ban functionality is disabled as it requires to be at least 1 to work. * upon successful login or ban, the failed attempts counter is removed * the failed attempts counter is also removed automatically with the expire time equals "ban_expire_time" or otherwise 3600 seconds. * user bans are logged into panel.log * banned user receives exactly the same return page/codes as per invalid logic. Change-Id: I05cc68c623ee289488fc64f1af50527004dcaae1	2 years ago
Kirill Solomko	43d112bd5e	MT#60558 add max subscribers/groups license checks ... * max_subscribers, max_pbx_subscribers, max_pbx_groups license checks are added for subscriber/group creation in UI/API * new accessor $c->license_meta that returns meta license flags hashref * new accessor $c->license_max_subscribers * new accessor $c->license_max_pbx_subscribers * new accessor $c->license_max_pbx_groups * the new accessors (except license_meta) return -1 instead of 'unlimited' to ease off comprarsion * 403 Forbidden is returned by the API if a license is violated. Change-Id: I3f5a949efc84bf85b76b33404b37b362ec484d5f	2 years ago
Kirill Solomko	9d021be65a	MT#59979 add license control ... * UI and API parts are now under license control * new Util::License::get_license($c, $name) - fetches license status by name (1 if enabled, and also if /proc/ngcp/check if 'ok') * add Catalyst::Plugins::NGCP::License with license($name) to fetch valid license by name from anywhere using $c->license('pbx') or from the templates using c.license('pbx'). It internally uses Util::License::get_license($c, $name) * License::get_license_status($c) now requires $c as first argument as well logs license status check errors. * new ActionRoles::License that enables usage of :Does(License) RequiresLicense('pbx') LicenseDetachTo('/denied_page') in the Controller chains * Add license control for UI elements and return 403 Forbidden if a resource is covered by licenses and the license is not active * Hide UI elements if a license is not active * API/Entities/Entities new $c->set_config key: - per endpoint: $c->set_config({ required_licenses => [qw/pbx device_provisioning/] } - or per method: $c->set_config({ required_licenses => { POST => [qw/pbx device_provisioning/] } } } * In case if an API endpoint does not have a license: 403 Forbidden "Invalid license" reply is returned. * Add license based restrictions to API endpoints * /api documentation: - completely hide endpoints that do not have an active license - hide only methods that does not have an active license Change-Id: Iba45fc5068b02306a617fed7b5405f2210574b61	2 years ago
Kirill Solomko	c826fccb29	MT#58157 escape uri refs in body.tt ... * URI that comes from c.req.uri must be escaped as Catalyst provides c.req.uri unescaped. * new Catalyst::NGCP::Plugin::EscapeURI with escape_uri() function * new NGCP::Panel::Utils::Generic::escape_uri() that uses URI::Escape::uri::escape_utf8() * c.req.uri and c.req.path occurrences in layout/body.tt are now escaped with c.escape_uri() Change-Id: Id0483fa6e570a0ff8db84b1d470caf5405cc0886	3 years ago
Kirill Solomko	61fc16dec8	TT#122000 split session cookies per realm ... * new Plugin Catalyst/Plugin/NGCP/RealmCookie.pm that extends Catalyst::Plugin::Session::State::Cookie and overloads methods responsible for cookie_name creation. It uses NGCP_REALM fastcgi header to append it to the cookie name. Empty cookie with name "appprefix"_session is suppressed on Session pre-setup. * Base cookie_name is now set to 'ngcp-panel' Change-Id: I6b4c10c5e1728d0dd7a6398bf5191925d5b904f6	5 years ago
Rene Krenn	f66435c837	TT#75114 javascript support for prov templates ... Change-Id: I6f173ba6dd814f9be84bc3f077e8595e56d993c5	7 years ago
Guillem Jover	993f9ce7bb	TT#69900 Unbundle Catalyst::Plugin::Session::Store::Redis modules ... This is a separate upstream distribution which we should not be bundling. Change-Id: I8fab1de494e885063214957ef1ff35a82702f586	7 years ago
Guillem Jover	651a581812	TT#68012 Namespace NGCP-specific Catalyst plugins ... Ideally we'd not pollute the Catalyst namespace, and instead would use our base NGCP namespace, but at least for the EscapeJs module having it there makes loading it easier as it requires integration with the Template::Toolkit engine. Change-Id: Ide3f723fb3becbf49c405d9b34eb464fa7f8adbd	7 years ago
Rene Krenn	05958e4e68	TT#63402 escape localized strings used in js arguments ... Change-Id: I61f3c77e7bd1fd4ac9e9b952ceecfa233bdbdbf1	7 years ago
Rene Krenn	cae5270af5	TT#56340 panel logline obfuscation ... adds gdpr obfuscation quoting for: + subscriber numbers + subscriber ip addresses + subscriber usernames + any logmessage "DATA": query parameters, form data, response data + subscriber uuid's + call id's + callforward sip uri's the quoting is centralized by $c->qs() ("quote sensitive"), using catalyst plugin mechanism. escape symbols are set to « (\x{ab}) and » (\x{bb}). generate_logfile_data_inventory.pl was modified to mark loglines with "gdpr affected" status, if $c->qs() was used in a log message. Change-Id: I0f42d7992594232ae33e5666b0a64009211c5b76	7 years ago
Alexander Lutay	cdbc01978c	TT#29620 Clean TAP test warning: Missing AUTHOR/DESCRIPTION/LICENSE section in POD ... Change-Id: I522f20e6966253933d98766d0b3a51f43768be82	9 years ago
Andreas Granig	bfdf68ea40	TT#35523 Persist sessions in redis ... This will allow to apply changes or fail-over without re-login on the panel. Change-Id: Ie3dca1ea4ecfac75b1ffa939c3bba92afcc90db7	9 years ago