Skip to content
This repository was archived by the owner on Jan 6, 2022. It is now read-only.

Commit 1ae9682

Browse files
NihalHarishhardik-k-shah
NihalHarish
authored and
hardik-k-shah
committed
Support for Elasticsearch 6.6.2 (#5)
* unit tests passing * modified pom.xml * Support for ElasticSearch 6.6.2 * updated version from 0.7.0.1 to 0.8.0.0
1 parent 54c2f09 commit 1ae9682

File tree

10 files changed

+98
-48
lines changed

10 files changed

+98
-48
lines changed

Diff for: ‎plugin-descriptor.properties

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
description=Provides SSL for Elasticsearch 6
44
#
55
# 'version': plugin's version
6-
version=0.7.0.1
6+
version=0.8.0.0
77
#
88
# 'name': the plugin name
99
name=opendistro_security-ssl
@@ -22,4 +22,4 @@ java.version=1.8
2222
# elasticsearch release. This version is checked when the plugin
2323
# is loaded so Elasticsearch will refuse to start in the presence of
2424
# plugins with the incorrect elasticsearch.version.
25-
elasticsearch.version=6.5.4
25+
elasticsearch.version=6.6.2

Diff for: ‎pom.xml

+7-7
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,11 @@
3535
<parent>
3636
<groupId>com.amazon.opendistroforelasticsearch</groupId>
3737
<artifactId>opendistro_security_parent</artifactId>
38-
<version>0.7.0.1</version>
38+
<version>0.8.0.0</version>
3939
</parent>
4040

4141
<artifactId>opendistro_security_ssl</artifactId>
42-
<version>0.7.0.1</version>
42+
<version>0.8.0.0</version>
4343
<packaging>jar</packaging>
4444

4545
<name>Open Distro Security SSL</name>
@@ -56,18 +56,18 @@
5656
</licenses>
5757

5858
<properties>
59-
<elasticsearch.version>6.5.4</elasticsearch.version>
59+
<elasticsearch.version>6.6.2</elasticsearch.version>
6060

6161
<!-- deps -->
62-
<netty-native.version>2.0.15.Final</netty-native.version>
62+
<netty-native.version>2.0.20.Final</netty-native.version>
6363
<log4j.version>2.11.1</log4j.version>
6464
</properties>
6565

6666
<scm>
6767
<url>https://github.com/opendistro-for-elasticsearch/security-ssl</url>
6868
<connection>scm:git:git@github.com:opendistro-for-elasticsearch/security-ssl.git</connection>
6969
<developerConnection>scm:git:git@github.com:opendistro-for-elasticsearch/security-ssl.git</developerConnection>
70-
<tag>v0.7.0.1</tag>
70+
<tag>v0.8.0.0</tag>
7171
</scm>
7272

7373
<issueManagement>
@@ -172,7 +172,7 @@
172172
<dependency>
173173
<groupId>com.floragunn</groupId>
174174
<artifactId>search-guard-static-tcnative-beta</artifactId>
175-
<version>1.1.0j-${netty-native.version}-non-fedora-linux-x86_64</version>
175+
<version>1.1.1a-${netty-native.version}-non-fedora-linux-x86_64</version>
176176
<scope>provided</scope>
177177
</dependency>
178178
</dependencies>
@@ -183,7 +183,7 @@
183183
<dependency>
184184
<groupId>com.floragunn</groupId>
185185
<artifactId>search-guard-static-tcnative-beta</artifactId>
186-
<version>1.1.0j-${netty-native.version}-fedora-linux-x86_64</version>
186+
<version>1.1.1a-${netty-native.version}-fedora-linux-x86_64</version>
187187
<scope>provided</scope>
188188
</dependency>
189189
</dependencies>

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/OpenDistroSecuritySSLPlugin.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
import org.apache.logging.log4j.Logger;
5151
import org.elasticsearch.ElasticsearchException;
5252
import org.elasticsearch.SpecialPermission;
53+
import org.elasticsearch.Version;
5354
import org.elasticsearch.client.Client;
5455
import org.elasticsearch.cluster.metadata.IndexNameExpressionResolver;
5556
import org.elasticsearch.cluster.node.DiscoveryNodes;
@@ -255,14 +256,13 @@ public List<TransportInterceptor> getTransportInterceptors(NamedWriteableRegistr
255256

256257

257258
@Override
258-
public Map<String, Supplier<Transport>> getTransports(Settings settings, ThreadPool threadPool, BigArrays bigArrays,
259-
PageCacheRecycler pageCacheRecycler, CircuitBreakerService circuitBreakerService,
260-
NamedWriteableRegistry namedWriteableRegistry, NetworkService networkService) {
261-
259+
public Map<String, Supplier<Transport>> getTransports(Settings settings, ThreadPool threadPool, PageCacheRecycler pageCacheRecycler,
260+
CircuitBreakerService circuitBreakerService, NamedWriteableRegistry namedWriteableRegistry, NetworkService networkService) {
262261
Map<String, Supplier<Transport>> transports = new HashMap<String, Supplier<Transport>>();
263262
if (transportSSLEnabled) {
264263
transports.put("com.amazon.opendistroforelasticsearch.security.ssl.http.netty.OpenDistroSecuritySSLNettyTransport",
265-
() -> new OpenDistroSecuritySSLNettyTransport(settings, threadPool, networkService, bigArrays, namedWriteableRegistry, circuitBreakerService, odsks, NOOP_SSL_EXCEPTION_HANDLER));
264+
() -> new OpenDistroSecuritySSLNettyTransport(settings, Version.CURRENT, threadPool, networkService, pageCacheRecycler, namedWriteableRegistry, circuitBreakerService, odsks, NOOP_SSL_EXCEPTION_HANDLER));
265+
266266
}
267267
return transports;
268268

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/http/netty/OpenDistroSecuritySSLNettyHttpServerTransport.java

+3
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@
4040
import javax.net.ssl.SSLException;
4141
import javax.net.ssl.SSLHandshakeException;
4242

43+
import org.apache.logging.log4j.LogManager;
44+
import org.apache.logging.log4j.Logger;
4345
import org.elasticsearch.common.network.NetworkService;
4446
import org.elasticsearch.common.settings.Settings;
4547
import org.elasticsearch.common.util.BigArrays;
@@ -53,6 +55,7 @@
5355

5456
public class OpenDistroSecuritySSLNettyHttpServerTransport extends Netty4HttpServerTransport {
5557

58+
private static final Logger logger = LogManager.getLogger(OpenDistroSecuritySSLNettyHttpServerTransport.class);
5659
private final OpenDistroSecurityKeyStore sgks;
5760
private final ThreadContext threadContext;
5861
private final SslExceptionHandler errorHandler;

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/rest/OpenDistroSecuritySSLInfoAction.java

+2
Original file line numberDiff line numberDiff line change
@@ -59,13 +59,15 @@ public class OpenDistroSecuritySSLInfoAction extends BaseRestHandler {
5959
private final OpenDistroSecurityKeyStore sgks;
6060
final PrincipalExtractor principalExtractor;
6161
private final Path configPath;
62+
private final Settings settings;
6263

6364
public OpenDistroSecuritySSLInfoAction(final Settings settings, final Path configPath, final RestController controller,
6465
final OpenDistroSecurityKeyStore sgks, final PrincipalExtractor principalExtractor) {
6566
super(settings);
6667
this.sgks = sgks;
6768
this.principalExtractor = principalExtractor;
6869
this.configPath = configPath;
70+
this.settings = settings;
6971
controller.registerHandler(GET, "/_opendistro/_security/sslinfo", this);
7072
}
7173

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/transport/OpenDistroSecuritySSLNettyTransport.java

+21-18
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,6 @@
3030

3131
package com.amazon.opendistroforelasticsearch.security.ssl.transport;
3232

33-
import io.netty.channel.Channel;
34-
import io.netty.channel.ChannelHandler;
35-
import io.netty.channel.ChannelHandlerContext;
36-
import io.netty.channel.ChannelOutboundHandlerAdapter;
37-
import io.netty.channel.ChannelPromise;
38-
import io.netty.handler.codec.DecoderException;
39-
import io.netty.handler.ssl.NotSslRecordException;
40-
import io.netty.handler.ssl.SslHandler;
41-
4233
import java.net.InetSocketAddress;
4334
import java.net.SocketAddress;
4435

@@ -49,11 +40,13 @@
4940
import org.apache.logging.log4j.LogManager;
5041
import org.apache.logging.log4j.Logger;
5142
import org.elasticsearch.ExceptionsHelper;
43+
import org.elasticsearch.Version;
5244
import org.elasticsearch.cluster.node.DiscoveryNode;
5345
import org.elasticsearch.common.io.stream.NamedWriteableRegistry;
46+
import org.elasticsearch.common.network.CloseableChannel;
5447
import org.elasticsearch.common.network.NetworkService;
5548
import org.elasticsearch.common.settings.Settings;
56-
import org.elasticsearch.common.util.BigArrays;
49+
import org.elasticsearch.common.util.PageCacheRecycler;
5750
import org.elasticsearch.indices.breaker.CircuitBreakerService;
5851
import org.elasticsearch.threadpool.ThreadPool;
5952
import org.elasticsearch.transport.TcpChannel;
@@ -63,21 +56,31 @@
6356
import com.amazon.opendistroforelasticsearch.security.ssl.SslExceptionHandler;
6457
import com.amazon.opendistroforelasticsearch.security.ssl.util.SSLConfigConstants;
6558

59+
import io.netty.channel.Channel;
60+
import io.netty.channel.ChannelHandler;
61+
import io.netty.channel.ChannelHandlerContext;
62+
import io.netty.channel.ChannelOutboundHandlerAdapter;
63+
import io.netty.channel.ChannelPromise;
64+
import io.netty.handler.codec.DecoderException;
65+
import io.netty.handler.ssl.NotSslRecordException;
66+
import io.netty.handler.ssl.SslHandler;
67+
6668
public class OpenDistroSecuritySSLNettyTransport extends Netty4Transport {
6769

70+
private static final Logger logger = LogManager.getLogger(OpenDistroSecuritySSLNettyTransport.class);
6871
private final OpenDistroSecurityKeyStore sgks;
6972
private final SslExceptionHandler errorHandler;
7073

71-
public OpenDistroSecuritySSLNettyTransport(final Settings settings, final ThreadPool threadPool, final NetworkService networkService,
72-
final BigArrays bigArrays, final NamedWriteableRegistry namedWriteableRegistry,
73-
final CircuitBreakerService circuitBreakerService, final OpenDistroSecurityKeyStore sgks, final SslExceptionHandler errorHandler) {
74-
super(settings, threadPool, networkService, bigArrays, namedWriteableRegistry, circuitBreakerService);
74+
public OpenDistroSecuritySSLNettyTransport(final Settings settings, final Version version, final ThreadPool threadPool, final NetworkService networkService,
75+
final PageCacheRecycler pageCacheRecycler, final NamedWriteableRegistry namedWriteableRegistry,
76+
final CircuitBreakerService circuitBreakerService, final OpenDistroSecurityKeyStore sgks, final SslExceptionHandler errorHandler) {
77+
super(settings, version, threadPool, networkService, pageCacheRecycler, namedWriteableRegistry, circuitBreakerService);
7578
this.sgks = sgks;
7679
this.errorHandler = errorHandler;
7780
}
7881

7982
@Override
80-
protected void onException(TcpChannel channel, Exception e) {
83+
public void onException(TcpChannel channel, Exception e) {
8184

8285

8386
if (lifecycle.started()) {
@@ -92,15 +95,15 @@ protected void onException(TcpChannel channel, Exception e) {
9295

9396
if(cause instanceof NotSslRecordException) {
9497
logger.warn("Someone ({}) speaks transport plaintext instead of ssl, will close the channel", channel.getLocalAddress());
95-
TcpChannel.closeChannel(channel, false);
98+
CloseableChannel.closeChannel(channel, false);
9699
return;
97100
} else if (cause instanceof SSLException) {
98101
logger.error("SSL Problem "+cause.getMessage(),cause);
99-
TcpChannel.closeChannel(channel, false);
102+
CloseableChannel.closeChannel(channel, false);
100103
return;
101104
} else if (cause instanceof SSLHandshakeException) {
102105
logger.error("Problem during handshake "+cause.getMessage());
103-
TcpChannel.closeChannel(channel, false);
106+
CloseableChannel.closeChannel(channel, false);
104107
return;
105108
}
106109
}

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/transport/OpenDistroSecuritySSLRequestHandler.java

+6-7
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,6 @@
3030

3131
package com.amazon.opendistroforelasticsearch.security.ssl.transport;
3232

33-
import io.netty.channel.Channel;
34-
import io.netty.handler.ssl.SslHandler;
35-
3633
import java.lang.reflect.Method;
3734
import java.security.cert.Certificate;
3835
import java.security.cert.X509Certificate;
@@ -53,12 +50,14 @@
5350
import org.elasticsearch.transport.TransportChannel;
5451
import org.elasticsearch.transport.TransportRequest;
5552
import org.elasticsearch.transport.TransportRequestHandler;
56-
import org.elasticsearch.transport.netty4.NettyTcpChannel;
53+
import org.elasticsearch.transport.netty4.Netty4TcpChannel;
5754

5855
import com.amazon.opendistroforelasticsearch.security.ssl.SslExceptionHandler;
5956
import com.amazon.opendistroforelasticsearch.security.ssl.util.ExceptionUtils;
6057
import com.amazon.opendistroforelasticsearch.security.ssl.util.SSLRequestHelper;
6158

59+
import io.netty.handler.ssl.SslHandler;
60+
6261
public class OpenDistroSecuritySSLRequestHandler<T extends TransportRequest>
6362
implements TransportRequestHandler<T> {
6463

@@ -120,15 +119,15 @@ public final void messageReceived(T request, TransportChannel channel, Task task
120119

121120
try {
122121

123-
NettyTcpChannel nettyChannel = null;
122+
Netty4TcpChannel nettyChannel = null;
124123

125124
if (innerChannel instanceof TaskTransportChannel) {
126125
final TransportChannel inner = ((TaskTransportChannel) innerChannel).getChannel();
127-
nettyChannel = (NettyTcpChannel) ((TcpTransportChannel) inner).getChannel();
126+
nettyChannel = (Netty4TcpChannel) ((TcpTransportChannel) inner).getChannel();
128127
} else
129128
if (innerChannel instanceof TcpTransportChannel) {
130129
final TcpChannel inner = ((TcpTransportChannel) innerChannel).getChannel();
131-
nettyChannel = (NettyTcpChannel) inner;
130+
nettyChannel = (Netty4TcpChannel) inner;
132131
} else {
133132
throw new Exception("Invalid channel of type "+innerChannel.getClass()+ " ("+innerChannel.getChannelType()+")");
134133
}

Diff for: ‎src/main/java/com/amazon/opendistroforelasticsearch/security/ssl/util/SSLConfigConstants.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,8 @@ public static final String[] getSecureSSLProtocols(Settings settings, boolean ht
186186
"TLS_AES_256_GCM_SHA384",
187187

188188
//TLS 1.3 OpenSSL
189-
"TLS_CHACHA20_POLY1305_SHA256",
189+
"TLS_AES_128_CCM_8_SHA256",
190+
"TLS_AES_128_CCM_SHA256",
190191

191192
//IBM
192193
"SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256",

Diff for: ‎src/test/java/com/amazon/opendistroforelasticsearch/security/ssl/OpenSSLTest.java

+48-2
Original file line numberDiff line numberDiff line change
@@ -30,19 +30,27 @@
3030

3131
package com.amazon.opendistroforelasticsearch.security.ssl;
3232

33-
import io.netty.handler.ssl.OpenSsl;
34-
3533
import java.util.HashSet;
34+
import java.util.Random;
3635
import java.util.Set;
3736

37+
import org.elasticsearch.action.admin.cluster.health.ClusterHealthRequest;
38+
import org.elasticsearch.action.admin.cluster.health.ClusterHealthResponse;
39+
import org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest;
3840
import org.elasticsearch.common.settings.Settings;
41+
import org.elasticsearch.common.unit.TimeValue;
42+
import org.elasticsearch.node.Node;
43+
import org.elasticsearch.node.PluginAwareNode;
44+
import org.elasticsearch.transport.Netty4Plugin;
3945
import org.junit.Assert;
4046
import org.junit.Assume;
4147
import org.junit.Before;
4248
import org.junit.Test;
4349

4450
import com.amazon.opendistroforelasticsearch.security.ssl.util.SSLConfigConstants;
4551

52+
import io.netty.handler.ssl.OpenSsl;
53+
4654
public class OpenSSLTest extends SSLTest {
4755

4856
@Before
@@ -177,4 +185,42 @@ public void testHttpsAndNodeSSLPemEnc() throws Exception {
177185
Assume.assumeTrue(OpenSsl.isAvailable());
178186
super.testHttpsAndNodeSSLPemEnc();
179187
}
188+
189+
@Test
190+
public void testNodeClientSSLwithOpenSslTLSv13() throws Exception {
191+
192+
Assume.assumeTrue(OpenSsl.isAvailable() && OpenSsl.version() > 0x10101009L);
193+
194+
final Settings settings = Settings.builder().put("opendistro_security.ssl.transport.enabled", true)
195+
.put(SSLConfigConstants.OPENDISTRO_SECURITY_SSL_HTTP_ENABLE_OPENSSL_IF_AVAILABLE, allowOpenSSL)
196+
.put(SSLConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_ENABLE_OPENSSL_IF_AVAILABLE, allowOpenSSL)
197+
.put(SSLConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_KEYSTORE_ALIAS, "node-0")
198+
.put("opendistro_security.ssl.transport.keystore_filepath", getAbsoluteFilePathFromClassPath("node-0-keystore.jks"))
199+
.put("opendistro_security.ssl.transport.truststore_filepath", getAbsoluteFilePathFromClassPath("truststore.jks"))
200+
.put("opendistro_security.ssl.transport.enforce_hostname_verification", false)
201+
.put("opendistro_security.ssl.transport.resolve_hostname", false)
202+
.putList(SSLConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_ENABLED_PROTOCOLS, "TLSv1.3")
203+
.putList(SSLConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_ENABLED_CIPHERS, "TLS_CHACHA20_POLY1305_SHA256")
204+
.build();
205+
206+
startES(settings);
207+
208+
final Settings tcSettings = Settings.builder().put("cluster.name", clustername).put("path.home", ".")
209+
.put("node.name", "client_node_" + new Random().nextInt())
210+
.put(settings)// -----
211+
.build();
212+
213+
try (Node node = new PluginAwareNode(tcSettings, Netty4Plugin.class, OpenDistroSecuritySSLPlugin.class).start()) {
214+
ClusterHealthResponse res = node.client().admin().cluster().health(new ClusterHealthRequest().waitForNodes("4").timeout(TimeValue.timeValueSeconds(5))).actionGet();
215+
Assert.assertFalse(res.isTimedOut());
216+
Assert.assertEquals(4, res.getNumberOfNodes());
217+
Assert.assertEquals(4, node.client().admin().cluster().nodesInfo(new NodesInfoRequest()).actionGet().getNodes().size());
218+
}
219+
220+
Assert.assertFalse(executeSimpleRequest("_nodes/stats?pretty").contains("\"tx_size_in_bytes\" : 0"));
221+
Assert.assertFalse(executeSimpleRequest("_nodes/stats?pretty").contains("\"rx_count\" : 0"));
222+
Assert.assertFalse(executeSimpleRequest("_nodes/stats?pretty").contains("\"rx_size_in_bytes\" : 0"));
223+
Assert.assertFalse(executeSimpleRequest("_nodes/stats?pretty").contains("\"tx_count\" : 0"));
224+
}
225+
180226
}

Diff for: ‎src/test/java/com/amazon/opendistroforelasticsearch/security/ssl/SSLTest.java

+2-6
Original file line numberDiff line numberDiff line change
@@ -371,12 +371,8 @@ public void testHttpsAndNodeSSLFailedCipher() throws Exception {
371371
Assert.fail();
372372
} catch (Exception e1) {
373373
Throwable e = ExceptionUtils.getRootCause(e1);
374-
if(allowOpenSSL) {
375-
Assert.assertTrue(e.toString(), e.toString().contains("no cipher match"));
376-
} else {
377-
Assert.assertTrue(e.toString(), e.toString().contains("no valid cipher"));
378-
}
379-
}
374+
Assert.assertTrue(e.toString(), e.toString().contains("no valid cipher"));
375+
}
380376
}
381377

382378
@Test

0 commit comments

Comments
 (0)