Skip to content

Commit 342dc69

Browse files
retareta
committed
Switch to built-in security transports from core
Signed-off-by: Andriy Redko <andriy.redko@aiven.io>
1 parent dd119e5 commit 342dc69

10 files changed

Lines changed: 183 additions & 940 deletions

‎src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java‎

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
import java.util.List;
4747
import java.util.Map;
4848
import java.util.Objects;
49+
import java.util.Optional;
4950
import java.util.Set;
5051
import java.util.concurrent.atomic.AtomicReference;
5152
import java.util.function.BiFunction;
@@ -114,6 +115,8 @@
114115
import org.opensearch.plugins.ExtensionAwarePlugin;
115116
import org.opensearch.plugins.IdentityPlugin;
116117
import org.opensearch.plugins.MapperPlugin;
118+
import org.opensearch.plugins.SecureSettingsFactory;
119+
import org.opensearch.plugins.SecureTransportSettingsProvider;
117120
import org.opensearch.repositories.RepositoriesService;
118121
import org.opensearch.rest.RestController;
119122
import org.opensearch.rest.RestHandler;
@@ -167,11 +170,11 @@
167170
import org.opensearch.security.securityconf.DynamicConfigFactory;
168171
import org.opensearch.security.setting.OpensearchDynamicSetting;
169172
import org.opensearch.security.setting.TransportPassiveAuthSetting;
173+
import org.opensearch.security.ssl.OpenSearchSecureSettingsFactory;
170174
import org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin;
171175
import org.opensearch.security.ssl.SslExceptionHandler;
172176
import org.opensearch.security.ssl.http.netty.ValidatingDispatcher;
173177
import org.opensearch.security.ssl.transport.DefaultPrincipalExtractor;
174-
import org.opensearch.security.ssl.transport.SecuritySSLNettyTransport;
175178
import org.opensearch.security.ssl.util.SSLConfigConstants;
176179
import org.opensearch.security.support.ConfigConstants;
177180
import org.opensearch.security.support.GuardedSearchOperationWrapper;
@@ -199,6 +202,7 @@
199202
import org.opensearch.transport.TransportRequestOptions;
200203
import org.opensearch.transport.TransportResponseHandler;
201204
import org.opensearch.transport.TransportService;
205+
import org.opensearch.transport.netty4.ssl.SecureNetty4Transport;
202206
import org.opensearch.watcher.ResourceWatcherService;
203207

204208
import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.ENDPOINTS_WITH_PERMISSIONS;
@@ -858,44 +862,44 @@ public <T extends TransportResponse> void sendRequest(
858862
}
859863

860864
@Override
861-
public Map<String, Supplier<Transport>> getTransports(
865+
public Map<String, Supplier<Transport>> getSecureTransports(
862866
Settings settings,
863867
ThreadPool threadPool,
864868
PageCacheRecycler pageCacheRecycler,
865869
CircuitBreakerService circuitBreakerService,
866870
NamedWriteableRegistry namedWriteableRegistry,
867871
NetworkService networkService,
872+
SecureTransportSettingsProvider secureTransportSettingsProvider,
868873
Tracer tracer
869874
) {
870875
Map<String, Supplier<Transport>> transports = new HashMap<String, Supplier<Transport>>();
871876

872877
if (SSLConfig.isSslOnlyMode()) {
873-
return super.getTransports(
878+
return super.getSecureTransports(
874879
settings,
875880
threadPool,
876881
pageCacheRecycler,
877882
circuitBreakerService,
878883
namedWriteableRegistry,
879884
networkService,
885+
secureTransportSettingsProvider,
880886
tracer
881887
);
882888
}
883889

884890
if (transportSSLEnabled) {
885891
transports.put(
886892
"org.opensearch.security.ssl.http.netty.SecuritySSLNettyTransport",
887-
() -> new SecuritySSLNettyTransport(
888-
settings,
893+
() -> new SecureNetty4Transport(
894+
migrateSettings(settings),
889895
Version.CURRENT,
890896
threadPool,
891897
networkService,
892898
pageCacheRecycler,
893899
namedWriteableRegistry,
894900
circuitBreakerService,
895-
sks,
896-
evaluateSslExceptionHandler(),
897901
sharedGroupFactory,
898-
SSLConfig,
902+
secureTransportSettingsProvider,
899903
tracer
900904
)
901905
);
@@ -904,7 +908,7 @@ public Map<String, Supplier<Transport>> getTransports(
904908
}
905909

906910
@Override
907-
public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
911+
public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
908912
Settings settings,
909913
ThreadPool threadPool,
910914
BigArrays bigArrays,
@@ -914,11 +918,12 @@ public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
914918
NetworkService networkService,
915919
Dispatcher dispatcher,
916920
ClusterSettings clusterSettings,
921+
SecureTransportSettingsProvider secureTransportSettingsProvider,
917922
Tracer tracer
918923
) {
919924

920925
if (SSLConfig.isSslOnlyMode()) {
921-
return super.getHttpTransports(
926+
return super.getSecureHttpTransports(
922927
settings,
923928
threadPool,
924929
bigArrays,
@@ -928,6 +933,7 @@ public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
928933
networkService,
929934
dispatcher,
930935
clusterSettings,
936+
secureTransportSettingsProvider,
931937
tracer
932938
);
933939
}
@@ -944,16 +950,15 @@ public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
944950
);
945951
// TODO close odshst
946952
final SecurityHttpServerTransport odshst = new SecurityHttpServerTransport(
947-
settings,
953+
migrateSettings(settings),
948954
networkService,
949955
bigArrays,
950956
threadPool,
951-
sks,
952-
evaluateSslExceptionHandler(),
953957
xContentRegistry,
954958
validatingDispatcher,
955959
clusterSettings,
956960
sharedGroupFactory,
961+
secureTransportSettingsProvider,
957962
tracer,
958963
securityRestHandler
959964
);
@@ -963,14 +968,15 @@ public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
963968
return Collections.singletonMap(
964969
"org.opensearch.security.http.SecurityHttpServerTransport",
965970
() -> new SecurityNonSslHttpServerTransport(
966-
settings,
971+
migrateSettings(settings),
967972
networkService,
968973
bigArrays,
969974
threadPool,
970975
xContentRegistry,
971976
dispatcher,
972977
clusterSettings,
973978
sharedGroupFactory,
979+
secureTransportSettingsProvider,
974980
tracer,
975981
securityRestHandler
976982
)
@@ -2005,6 +2011,11 @@ public SecurityTokenManager getTokenManager() {
20052011
return tokenManager;
20062012
}
20072013

2014+
@Override
2015+
public Optional<SecureSettingsFactory> getSecureSettingFactory(Settings settings) {
2016+
return Optional.of(new OpenSearchSecureSettingsFactory(settings, sks, sslExceptionHandler));
2017+
}
2018+
20082019
public static class GuiceHolder implements LifecycleComponent {
20092020

20102021
private static RepositoriesService repositoriesService;

‎src/main/java/org/opensearch/security/http/SecurityHttpServerTransport.java‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,19 +34,21 @@
3434
import org.opensearch.common.util.BigArrays;
3535
import org.opensearch.common.util.concurrent.ThreadContext;
3636
import org.opensearch.core.xcontent.NamedXContentRegistry;
37+
import org.opensearch.http.netty4.ssl.SecureNetty4HttpServerTransport;
38+
import org.opensearch.plugins.SecureTransportSettingsProvider;
3739
import org.opensearch.security.filter.SecurityResponse;
3840
import org.opensearch.security.filter.SecurityRestFilter;
39-
import org.opensearch.security.ssl.SecurityKeyStore;
40-
import org.opensearch.security.ssl.SslExceptionHandler;
41-
import org.opensearch.security.ssl.http.netty.SecuritySSLNettyHttpServerTransport;
41+
import org.opensearch.security.ssl.http.netty.Netty4ConditionalDecompressor;
42+
import org.opensearch.security.ssl.http.netty.Netty4HttpRequestHeaderVerifier;
4243
import org.opensearch.security.ssl.http.netty.ValidatingDispatcher;
4344
import org.opensearch.telemetry.tracing.Tracer;
4445
import org.opensearch.threadpool.ThreadPool;
4546
import org.opensearch.transport.SharedGroupFactory;
4647

48+
import io.netty.channel.ChannelInboundHandlerAdapter;
4749
import io.netty.util.AttributeKey;
4850

49-
public class SecurityHttpServerTransport extends SecuritySSLNettyHttpServerTransport {
51+
public class SecurityHttpServerTransport extends SecureNetty4HttpServerTransport {
5052

5153
public static final AttributeKey<SecurityResponse> EARLY_RESPONSE = AttributeKey.newInstance("opensearch-http-early-response");
5254
public static final AttributeKey<Set<String>> UNCONSUMED_PARAMS = AttributeKey.newInstance("opensearch-http-request-consumed-params");
@@ -56,17 +58,18 @@ public class SecurityHttpServerTransport extends SecuritySSLNettyHttpServerTrans
5658
public static final AttributeKey<Boolean> SHOULD_DECOMPRESS = AttributeKey.newInstance("opensearch-http-should-decompress");
5759
public static final AttributeKey<Boolean> IS_AUTHENTICATED = AttributeKey.newInstance("opensearch-http-is-authenticated");
5860

61+
private final ChannelInboundHandlerAdapter headerVerifier;
62+
5963
public SecurityHttpServerTransport(
6064
final Settings settings,
6165
final NetworkService networkService,
6266
final BigArrays bigArrays,
6367
final ThreadPool threadPool,
64-
final SecurityKeyStore odsks,
65-
final SslExceptionHandler sslExceptionHandler,
6668
final NamedXContentRegistry namedXContentRegistry,
6769
final ValidatingDispatcher dispatcher,
6870
final ClusterSettings clusterSettings,
6971
SharedGroupFactory sharedGroupFactory,
72+
final SecureTransportSettingsProvider secureTransportSettingsProvider,
7073
Tracer tracer,
7174
SecurityRestFilter restFilter
7275
) {
@@ -75,14 +78,24 @@ public SecurityHttpServerTransport(
7578
networkService,
7679
bigArrays,
7780
threadPool,
78-
odsks,
7981
namedXContentRegistry,
8082
dispatcher,
81-
sslExceptionHandler,
8283
clusterSettings,
8384
sharedGroupFactory,
84-
tracer,
85-
restFilter
85+
secureTransportSettingsProvider,
86+
tracer
8687
);
88+
89+
headerVerifier = new Netty4HttpRequestHeaderVerifier(restFilter, threadPool, settings);
90+
}
91+
92+
@Override
93+
protected ChannelInboundHandlerAdapter createHeaderVerifier() {
94+
return headerVerifier;
95+
}
96+
97+
@Override
98+
protected ChannelInboundHandlerAdapter createDecompressor() {
99+
return new Netty4ConditionalDecompressor();
87100
}
88101
}

‎src/main/java/org/opensearch/security/http/SecurityNonSslHttpServerTransport.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
import org.opensearch.core.xcontent.NamedXContentRegistry;
3434
import org.opensearch.http.HttpHandlingSettings;
3535
import org.opensearch.http.netty4.Netty4HttpServerTransport;
36+
import org.opensearch.http.netty4.ssl.SecureNetty4HttpServerTransport;
37+
import org.opensearch.plugins.SecureTransportSettingsProvider;
3638
import org.opensearch.security.filter.SecurityRestFilter;
3739
import org.opensearch.security.ssl.http.netty.Netty4ConditionalDecompressor;
3840
import org.opensearch.security.ssl.http.netty.Netty4HttpRequestHeaderVerifier;
@@ -44,7 +46,7 @@
4446
import io.netty.channel.ChannelHandler;
4547
import io.netty.channel.ChannelInboundHandlerAdapter;
4648

47-
public class SecurityNonSslHttpServerTransport extends Netty4HttpServerTransport {
49+
public class SecurityNonSslHttpServerTransport extends SecureNetty4HttpServerTransport {
4850

4951
private final ChannelInboundHandlerAdapter headerVerifier;
5052

@@ -57,6 +59,7 @@ public SecurityNonSslHttpServerTransport(
5759
final Dispatcher dispatcher,
5860
final ClusterSettings clusterSettings,
5961
final SharedGroupFactory sharedGroupFactory,
62+
final SecureTransportSettingsProvider secureTransportSettingsProvider,
6063
final Tracer tracer,
6164
final SecurityRestFilter restFilter
6265
) {
@@ -69,6 +72,7 @@ public SecurityNonSslHttpServerTransport(
6972
dispatcher,
7073
clusterSettings,
7174
sharedGroupFactory,
75+
secureTransportSettingsProvider,
7276
tracer
7377
);
7478
headerVerifier = new Netty4HttpRequestHeaderVerifier(restFilter, threadPool, settings);

‎src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
12+
package org.opensearch.security.ssl;
13+
14+
import java.util.Optional;
15+
import javax.net.ssl.SSLEngine;
16+
import javax.net.ssl.SSLException;
17+
18+
import org.opensearch.common.settings.Settings;
19+
import org.opensearch.http.HttpServerTransport;
20+
import org.opensearch.plugins.SecureSettingsFactory;
21+
import org.opensearch.plugins.SecureTransportSettingsProvider;
22+
import org.opensearch.transport.TcpTransport;
23+
24+
public class OpenSearchSecureSettingsFactory implements SecureSettingsFactory {
25+
private final Settings settings;
26+
private final SecurityKeyStore sks;
27+
private final SslExceptionHandler sslExceptionHandler;
28+
29+
public OpenSearchSecureSettingsFactory(Settings settings, SecurityKeyStore sks, SslExceptionHandler sslExceptionHandler) {
30+
this.settings = settings;
31+
this.sks = sks;
32+
this.sslExceptionHandler = sslExceptionHandler;
33+
}
34+
35+
@Override
36+
public Optional<SecureTransportSettingsProvider> getSecureTransportSettingsProvider(Settings settings) {
37+
return Optional.of(new SecureTransportSettingsProvider() {
38+
@Override
39+
public Optional<ServerExceptionHandler> buildHttpServerExceptionHandler(Settings settings, HttpServerTransport transport) {
40+
return Optional.of(new ServerExceptionHandler() {
41+
@Override
42+
public void onError(Throwable t) {
43+
sslExceptionHandler.logError(t, true);
44+
}
45+
});
46+
}
47+
48+
@Override
49+
public Optional<ServerExceptionHandler> buildServerTransportExceptionHandler(Settings settings, TcpTransport transport) {
50+
return Optional.of(new ServerExceptionHandler() {
51+
@Override
52+
public void onError(Throwable t) {
53+
sslExceptionHandler.logError(t, false);
54+
}
55+
});
56+
}
57+
58+
@Override
59+
public Optional<SSLEngine> buildSecureHttpServerEngine(Settings settings, HttpServerTransport transport) throws SSLException {
60+
return Optional.of(sks.createHTTPSSLEngine());
61+
}
62+
63+
@Override
64+
public Optional<SSLEngine> buildSecureServerTransportEngine(Settings settings, TcpTransport transport) throws SSLException {
65+
return Optional.of(sks.createServerTransportSSLEngine());
66+
}
67+
68+
@Override
69+
public Optional<SSLEngine> buildSecureClientTransportEngine(Settings settings, String hostname, int port) throws SSLException {
70+
return Optional.of(sks.createClientTransportSSLEngine(hostname, port));
71+
}
72+
});
73+
}
74+
}

0 commit comments

Comments
 (0)