Merge branch 'master' into rest_handler_client
Original commit: elastic/x-pack-elasticsearch@7fcc120767
This commit is contained in:
commit
82e4330e87
|
@ -39,11 +39,8 @@ public final class MessyTestUtils {
|
||||||
ScriptEngineRegistry scriptEngineRegistry = new ScriptEngineRegistry(Collections.singleton(groovyScriptEngineService));
|
ScriptEngineRegistry scriptEngineRegistry = new ScriptEngineRegistry(Collections.singleton(groovyScriptEngineService));
|
||||||
ScriptContextRegistry scriptContextRegistry = new ScriptContextRegistry(Arrays.asList(ScriptServiceProxy.INSTANCE));
|
ScriptContextRegistry scriptContextRegistry = new ScriptContextRegistry(Arrays.asList(ScriptServiceProxy.INSTANCE));
|
||||||
|
|
||||||
ClusterService clusterService = Mockito.mock(ClusterService.class);
|
|
||||||
Mockito.when(clusterService.state()).thenReturn(ClusterState.builder(new ClusterName("_name")).build());
|
|
||||||
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, scriptContextRegistry);
|
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, scriptContextRegistry);
|
||||||
return ScriptServiceProxy.of(new ScriptService(settings, new Environment(settings),
|
return ScriptServiceProxy.of(new ScriptService(settings, new Environment(settings),
|
||||||
new ResourceWatcherService(settings, tp), scriptEngineRegistry, scriptContextRegistry, scriptSettings),
|
new ResourceWatcherService(settings, tp), scriptEngineRegistry, scriptContextRegistry, scriptSettings));
|
||||||
clusterService);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -362,7 +362,7 @@ public class SearchInputIT extends ESIntegTestCase {
|
||||||
protected WatcherSearchTemplateService watcherSearchTemplateService() {
|
protected WatcherSearchTemplateService watcherSearchTemplateService() {
|
||||||
String master = internalCluster().getMasterName();
|
String master = internalCluster().getMasterName();
|
||||||
return new WatcherSearchTemplateService(internalCluster().clusterService(master).getSettings(),
|
return new WatcherSearchTemplateService(internalCluster().clusterService(master).getSettings(),
|
||||||
ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class, master), internalCluster().clusterService(master)),
|
ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class, master)),
|
||||||
internalCluster().getInstance(IndicesQueriesRegistry.class, master),
|
internalCluster().getInstance(IndicesQueriesRegistry.class, master),
|
||||||
internalCluster().getInstance(AggregatorParsers.class, master),
|
internalCluster().getInstance(AggregatorParsers.class, master),
|
||||||
internalCluster().getInstance(Suggesters.class, master)
|
internalCluster().getInstance(Suggesters.class, master)
|
||||||
|
@ -370,7 +370,7 @@ public class SearchInputIT extends ESIntegTestCase {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected ScriptServiceProxy scriptService() {
|
protected ScriptServiceProxy scriptService() {
|
||||||
return ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class), internalCluster().clusterService());
|
return ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class));
|
||||||
}
|
}
|
||||||
|
|
||||||
private XContentSource toXContentSource(SearchInput.Result result) throws IOException {
|
private XContentSource toXContentSource(SearchInput.Result result) throws IOException {
|
||||||
|
|
|
@ -519,7 +519,7 @@ public class SearchTransformIT extends ESIntegTestCase {
|
||||||
protected WatcherSearchTemplateService watcherSearchTemplateService() {
|
protected WatcherSearchTemplateService watcherSearchTemplateService() {
|
||||||
String master = internalCluster().getMasterName();
|
String master = internalCluster().getMasterName();
|
||||||
return new WatcherSearchTemplateService(internalCluster().clusterService(master).getSettings(),
|
return new WatcherSearchTemplateService(internalCluster().clusterService(master).getSettings(),
|
||||||
ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class, master), internalCluster().clusterService(master)),
|
ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class, master)),
|
||||||
internalCluster().getInstance(IndicesQueriesRegistry.class, master),
|
internalCluster().getInstance(IndicesQueriesRegistry.class, master),
|
||||||
internalCluster().getInstance(AggregatorParsers.class, master),
|
internalCluster().getInstance(AggregatorParsers.class, master),
|
||||||
internalCluster().getInstance(Suggesters.class, master)
|
internalCluster().getInstance(Suggesters.class, master)
|
||||||
|
@ -527,7 +527,7 @@ public class SearchTransformIT extends ESIntegTestCase {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected ScriptServiceProxy scriptService() {
|
protected ScriptServiceProxy scriptService() {
|
||||||
return ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class), internalCluster().clusterService());
|
return ScriptServiceProxy.of(internalCluster().getInstance(ScriptService.class));
|
||||||
}
|
}
|
||||||
|
|
||||||
private static Map<String, Object> doc(String date, String value) {
|
private static Map<String, Object> doc(String date, String value) {
|
||||||
|
|
|
@ -58,9 +58,7 @@ public class WatcherTemplateTests extends ESTestCase {
|
||||||
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, registry);
|
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, registry);
|
||||||
ScriptService scriptService = new ScriptService(setting, environment, resourceWatcherService, scriptEngineRegistry,
|
ScriptService scriptService = new ScriptService(setting, environment, resourceWatcherService, scriptEngineRegistry,
|
||||||
registry, scriptSettings);
|
registry, scriptSettings);
|
||||||
ClusterService clusterService = Mockito.mock(ClusterService.class);
|
engine = new DefaultTextTemplateEngine(Settings.EMPTY, ScriptServiceProxy.of(scriptService));
|
||||||
Mockito.when(clusterService.state()).thenReturn(ClusterState.builder(new ClusterName("_name")).build());
|
|
||||||
engine = new DefaultTextTemplateEngine(Settings.EMPTY, ScriptServiceProxy.of(scriptService, clusterService));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
public void testEscaping() throws Exception {
|
public void testEscaping() throws Exception {
|
||||||
|
|
|
@ -36,7 +36,7 @@ public class MonitoringBulkDocTests extends ESTestCase {
|
||||||
output.setVersion(outputVersion);
|
output.setVersion(outputVersion);
|
||||||
doc.writeTo(output);
|
doc.writeTo(output);
|
||||||
|
|
||||||
StreamInput streamInput = StreamInput.wrap(output.bytes());
|
StreamInput streamInput = output.bytes().streamInput();
|
||||||
streamInput.setVersion(randomVersion(random()));
|
streamInput.setVersion(randomVersion(random()));
|
||||||
MonitoringBulkDoc doc2 = new MonitoringBulkDoc(streamInput);
|
MonitoringBulkDoc doc2 = new MonitoringBulkDoc(streamInput);
|
||||||
|
|
||||||
|
|
|
@ -181,7 +181,7 @@ public class MonitoringBulkRequestTests extends ESTestCase {
|
||||||
out.setVersion(randomVersion(random()));
|
out.setVersion(randomVersion(random()));
|
||||||
request.writeTo(out);
|
request.writeTo(out);
|
||||||
|
|
||||||
StreamInput in = StreamInput.wrap(out.bytes());
|
StreamInput in = out.bytes().streamInput();
|
||||||
in.setVersion(out.getVersion());
|
in.setVersion(out.getVersion());
|
||||||
MonitoringBulkRequest request2 = new MonitoringBulkRequest();
|
MonitoringBulkRequest request2 = new MonitoringBulkRequest();
|
||||||
request2.readFrom(in);
|
request2.readFrom(in);
|
||||||
|
|
|
@ -57,7 +57,7 @@ public class MonitoringBulkResponseTests extends ESTestCase {
|
||||||
output.setVersion(outputVersion);
|
output.setVersion(outputVersion);
|
||||||
response.writeTo(output);
|
response.writeTo(output);
|
||||||
|
|
||||||
StreamInput streamInput = StreamInput.wrap(output.bytes());
|
StreamInput streamInput = output.bytes().streamInput();
|
||||||
streamInput.setVersion(randomVersion(random()));
|
streamInput.setVersion(randomVersion(random()));
|
||||||
MonitoringBulkResponse response2 = new MonitoringBulkResponse();
|
MonitoringBulkResponse response2 = new MonitoringBulkResponse();
|
||||||
response2.readFrom(streamInput);
|
response2.readFrom(streamInput);
|
||||||
|
|
|
@ -45,7 +45,7 @@ public class MonitoringDocTests extends ESTestCase {
|
||||||
output.setVersion(outputVersion);
|
output.setVersion(outputVersion);
|
||||||
monitoringDoc.writeTo(output);
|
monitoringDoc.writeTo(output);
|
||||||
|
|
||||||
StreamInput streamInput = StreamInput.wrap(output.bytes());
|
StreamInput streamInput = output.bytes().streamInput();
|
||||||
streamInput.setVersion(randomVersion(random()));
|
streamInput.setVersion(randomVersion(random()));
|
||||||
MonitoringDoc monitoringDoc2 = new MonitoringDoc(streamInput);
|
MonitoringDoc monitoringDoc2 = new MonitoringDoc(streamInput);
|
||||||
|
|
||||||
|
|
|
@ -8,6 +8,7 @@ package org.elasticsearch.xpack.security.transport;
|
||||||
import org.elasticsearch.common.logging.ESLogger;
|
import org.elasticsearch.common.logging.ESLogger;
|
||||||
import org.elasticsearch.common.logging.Loggers;
|
import org.elasticsearch.common.logging.Loggers;
|
||||||
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
||||||
|
import org.elasticsearch.transport.TcpTransportChannel;
|
||||||
import org.elasticsearch.xpack.security.authc.Authentication;
|
import org.elasticsearch.xpack.security.authc.Authentication;
|
||||||
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
|
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
|
||||||
import org.elasticsearch.xpack.security.authc.AuthenticationService;
|
import org.elasticsearch.xpack.security.authc.AuthenticationService;
|
||||||
|
@ -16,7 +17,6 @@ import org.elasticsearch.xpack.security.authz.AuthorizationService;
|
||||||
import org.elasticsearch.transport.DelegatingTransportChannel;
|
import org.elasticsearch.transport.DelegatingTransportChannel;
|
||||||
import org.elasticsearch.transport.TransportChannel;
|
import org.elasticsearch.transport.TransportChannel;
|
||||||
import org.elasticsearch.transport.TransportRequest;
|
import org.elasticsearch.transport.TransportRequest;
|
||||||
import org.elasticsearch.transport.netty.NettyTransportChannel;
|
|
||||||
import org.jboss.netty.channel.Channel;
|
import org.jboss.netty.channel.Channel;
|
||||||
import org.jboss.netty.handler.ssl.SslHandler;
|
import org.jboss.netty.handler.ssl.SslHandler;
|
||||||
|
|
||||||
|
@ -81,8 +81,9 @@ public interface ServerTransportFilter {
|
||||||
unwrappedChannel = ((DelegatingTransportChannel) unwrappedChannel).getChannel();
|
unwrappedChannel = ((DelegatingTransportChannel) unwrappedChannel).getChannel();
|
||||||
}
|
}
|
||||||
|
|
||||||
if (extractClientCert && (unwrappedChannel instanceof NettyTransportChannel)) {
|
if (extractClientCert && (unwrappedChannel instanceof TcpTransportChannel)
|
||||||
Channel channel = ((NettyTransportChannel) unwrappedChannel).getChannel();
|
&& ((TcpTransportChannel) unwrappedChannel).getChannel() instanceof Channel) {
|
||||||
|
Channel channel = (Channel) ((TcpTransportChannel) unwrappedChannel).getChannel();
|
||||||
SslHandler sslHandler = channel.getPipeline().get(SslHandler.class);
|
SslHandler sslHandler = channel.getPipeline().get(SslHandler.class);
|
||||||
assert sslHandler != null;
|
assert sslHandler != null;
|
||||||
|
|
||||||
|
|
|
@ -21,6 +21,7 @@ import org.elasticsearch.xpack.security.transport.SSLClientAuth;
|
||||||
import org.elasticsearch.xpack.security.transport.filter.IPFilter;
|
import org.elasticsearch.xpack.security.transport.filter.IPFilter;
|
||||||
import org.elasticsearch.threadpool.ThreadPool;
|
import org.elasticsearch.threadpool.ThreadPool;
|
||||||
import org.elasticsearch.transport.netty.NettyTransport;
|
import org.elasticsearch.transport.netty.NettyTransport;
|
||||||
|
import org.jboss.netty.channel.Channel;
|
||||||
import org.jboss.netty.channel.ChannelHandlerContext;
|
import org.jboss.netty.channel.ChannelHandlerContext;
|
||||||
import org.jboss.netty.channel.ChannelPipeline;
|
import org.jboss.netty.channel.ChannelPipeline;
|
||||||
import org.jboss.netty.channel.ChannelPipelineFactory;
|
import org.jboss.netty.channel.ChannelPipelineFactory;
|
||||||
|
@ -32,6 +33,7 @@ import org.jboss.netty.handler.ssl.SslHandler;
|
||||||
import javax.net.ssl.SSLEngine;
|
import javax.net.ssl.SSLEngine;
|
||||||
import javax.net.ssl.SSLParameters;
|
import javax.net.ssl.SSLParameters;
|
||||||
import java.net.InetSocketAddress;
|
import java.net.InetSocketAddress;
|
||||||
|
import java.util.Collections;
|
||||||
import java.util.List;
|
import java.util.List;
|
||||||
|
|
||||||
import static org.elasticsearch.xpack.security.Security.featureEnabledSetting;
|
import static org.elasticsearch.xpack.security.Security.featureEnabledSetting;
|
||||||
|
@ -111,30 +113,23 @@ public class SecurityNettyTransport extends NettyTransport {
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
protected void exceptionCaught(ChannelHandlerContext ctx, ExceptionEvent e) throws Exception {
|
protected void onException(Channel channel, Throwable e) {
|
||||||
if (!lifecycle.started()) {
|
if (isNotSslRecordException(e)) {
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
Throwable t = e.getCause();
|
|
||||||
if (isNotSslRecordException(t)) {
|
|
||||||
if (logger.isTraceEnabled()) {
|
if (logger.isTraceEnabled()) {
|
||||||
logger.trace("received plaintext traffic on a encrypted channel, closing connection {}", t, ctx.getChannel());
|
logger.trace("received plaintext traffic on a encrypted channel, closing connection {}", e, channel);
|
||||||
} else {
|
} else {
|
||||||
logger.warn("received plaintext traffic on a encrypted channel, closing connection {}", ctx.getChannel());
|
logger.warn("received plaintext traffic on a encrypted channel, closing connection {}", channel);
|
||||||
}
|
}
|
||||||
ctx.getChannel().close();
|
disconnectFromNodeChannel(channel, e);
|
||||||
disconnectFromNodeChannel(ctx.getChannel(), e.getCause());
|
} else if (isCloseDuringHandshakeException(e)) {
|
||||||
} else if (isCloseDuringHandshakeException(t)) {
|
|
||||||
if (logger.isTraceEnabled()) {
|
if (logger.isTraceEnabled()) {
|
||||||
logger.trace("connection {} closed during handshake", t, ctx.getChannel());
|
logger.trace("connection {} closed during handshake", e, channel);
|
||||||
} else {
|
} else {
|
||||||
logger.warn("connection {} closed during handshake", ctx.getChannel());
|
logger.warn("connection {} closed during handshake", channel);
|
||||||
}
|
}
|
||||||
ctx.getChannel().close();
|
disconnectFromNodeChannel(channel, e);
|
||||||
disconnectFromNodeChannel(ctx.getChannel(), e.getCause());
|
|
||||||
} else {
|
} else {
|
||||||
super.exceptionCaught(ctx, e);
|
super.onException(channel, e);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
*/
|
*/
|
||||||
package org.elasticsearch.http.netty;
|
package org.elasticsearch.http.netty;
|
||||||
|
|
||||||
import org.elasticsearch.common.netty.OpenChannelsHandler;
|
import org.elasticsearch.transport.netty.OpenChannelsHandler;
|
||||||
|
|
||||||
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.mock;
|
||||||
|
|
||||||
|
|
|
@ -8,6 +8,8 @@ package org.elasticsearch.integration;
|
||||||
import org.elasticsearch.action.search.SearchResponse;
|
import org.elasticsearch.action.search.SearchResponse;
|
||||||
import org.elasticsearch.common.settings.Settings;
|
import org.elasticsearch.common.settings.Settings;
|
||||||
import org.elasticsearch.index.IndexModule;
|
import org.elasticsearch.index.IndexModule;
|
||||||
|
import org.elasticsearch.index.query.QueryBuilder;
|
||||||
|
import org.elasticsearch.index.query.QueryBuilders;
|
||||||
import org.elasticsearch.search.sort.SortOrder;
|
import org.elasticsearch.search.sort.SortOrder;
|
||||||
import org.elasticsearch.xpack.security.Security;
|
import org.elasticsearch.xpack.security.Security;
|
||||||
import org.elasticsearch.xpack.security.authc.support.Hasher;
|
import org.elasticsearch.xpack.security.authc.support.Hasher;
|
||||||
|
@ -38,7 +40,8 @@ public class DocumentAndFieldLevelSecurityTests extends SecurityIntegTestCase {
|
||||||
"user1:" + USERS_PASSWD_HASHED + "\n" +
|
"user1:" + USERS_PASSWD_HASHED + "\n" +
|
||||||
"user2:" + USERS_PASSWD_HASHED + "\n" +
|
"user2:" + USERS_PASSWD_HASHED + "\n" +
|
||||||
"user3:" + USERS_PASSWD_HASHED + "\n" +
|
"user3:" + USERS_PASSWD_HASHED + "\n" +
|
||||||
"user4:" + USERS_PASSWD_HASHED + "\n";
|
"user4:" + USERS_PASSWD_HASHED + "\n" +
|
||||||
|
"user5:" + USERS_PASSWD_HASHED + "\n";
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -47,7 +50,7 @@ public class DocumentAndFieldLevelSecurityTests extends SecurityIntegTestCase {
|
||||||
"role1:user1\n" +
|
"role1:user1\n" +
|
||||||
"role2:user1,user4\n" +
|
"role2:user1,user4\n" +
|
||||||
"role3:user2,user4\n" +
|
"role3:user2,user4\n" +
|
||||||
"role4:user3,user4\n";
|
"role4:user3,user4,user5\n";
|
||||||
}
|
}
|
||||||
|
|
||||||
@Override
|
@Override
|
||||||
|
@ -128,6 +131,33 @@ public class DocumentAndFieldLevelSecurityTests extends SecurityIntegTestCase {
|
||||||
assertThat(response.getHits().getAt(1).getSource().get("field2").toString(), equalTo("value2"));
|
assertThat(response.getHits().getAt(1).getSource().get("field2").toString(), equalTo("value2"));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public void testDLSIsAppliedBeforeFLS() throws Exception {
|
||||||
|
assertAcked(client().admin().indices().prepareCreate("test")
|
||||||
|
.addMapping("type1", "field1", "type=text", "field2", "type=text")
|
||||||
|
);
|
||||||
|
client().prepareIndex("test", "type1", "1").setSource("field1", "value1", "field2", "value1")
|
||||||
|
.setRefreshPolicy(IMMEDIATE)
|
||||||
|
.get();
|
||||||
|
client().prepareIndex("test", "type1", "2").setSource("field1", "value2", "field2", "value2")
|
||||||
|
.setRefreshPolicy(IMMEDIATE)
|
||||||
|
.get();
|
||||||
|
|
||||||
|
SearchResponse response = client().filterWithHeader(
|
||||||
|
Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user5", USERS_PASSWD)))
|
||||||
|
.prepareSearch("test").setQuery(QueryBuilders.termQuery("field1", "value2"))
|
||||||
|
.get();
|
||||||
|
assertHitCount(response, 1);
|
||||||
|
assertSearchHits(response, "2");
|
||||||
|
assertThat(response.getHits().getAt(0).getSource().size(), equalTo(1));
|
||||||
|
assertThat(response.getHits().getAt(0).getSource().get("field1").toString(), equalTo("value2"));
|
||||||
|
|
||||||
|
response = client().filterWithHeader(
|
||||||
|
Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user5", USERS_PASSWD)))
|
||||||
|
.prepareSearch("test").setQuery(QueryBuilders.termQuery("field1", "value1"))
|
||||||
|
.get();
|
||||||
|
assertHitCount(response, 0);
|
||||||
|
}
|
||||||
|
|
||||||
public void testQueryCache() throws Exception {
|
public void testQueryCache() throws Exception {
|
||||||
assertAcked(client().admin().indices().prepareCreate("test")
|
assertAcked(client().admin().indices().prepareCreate("test")
|
||||||
.setSettings(Settings.builder().put(IndexModule.INDEX_QUERY_CACHE_EVERYTHING_SETTING.getKey(), true))
|
.setSettings(Settings.builder().put(IndexModule.INDEX_QUERY_CACHE_EVERYTHING_SETTING.getKey(), true))
|
||||||
|
|
|
@ -5,8 +5,6 @@
|
||||||
*/
|
*/
|
||||||
package org.elasticsearch.transport.netty;
|
package org.elasticsearch.transport.netty;
|
||||||
|
|
||||||
import org.elasticsearch.common.netty.OpenChannelsHandler;
|
|
||||||
|
|
||||||
import static org.mockito.Mockito.mock;
|
import static org.mockito.Mockito.mock;
|
||||||
|
|
||||||
/** Allows setting a mock into NettyTransport */
|
/** Allows setting a mock into NettyTransport */
|
||||||
|
|
|
@ -332,7 +332,7 @@ public class InternalAuthenticationServiceTests extends ESTestCase {
|
||||||
|
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
threadContext1.writeTo(output);
|
threadContext1.writeTo(output);
|
||||||
StreamInput input = StreamInput.wrap(output.bytes());
|
StreamInput input = output.bytes().streamInput();
|
||||||
threadContext1 = new ThreadContext(Settings.EMPTY);
|
threadContext1 = new ThreadContext(Settings.EMPTY);
|
||||||
threadContext1.readHeaders(input);
|
threadContext1.readHeaders(input);
|
||||||
|
|
||||||
|
@ -379,7 +379,7 @@ public class InternalAuthenticationServiceTests extends ESTestCase {
|
||||||
|
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
threadContext1.writeTo(output);
|
threadContext1.writeTo(output);
|
||||||
StreamInput input = StreamInput.wrap(output.bytes());
|
StreamInput input = output.bytes().streamInput();
|
||||||
threadContext1 = new ThreadContext(Settings.EMPTY);
|
threadContext1 = new ThreadContext(Settings.EMPTY);
|
||||||
threadContext1.readHeaders(input);
|
threadContext1.readHeaders(input);
|
||||||
|
|
||||||
|
|
|
@ -8,6 +8,7 @@ package org.elasticsearch.xpack.security.transport;
|
||||||
import org.elasticsearch.ElasticsearchSecurityException;
|
import org.elasticsearch.ElasticsearchSecurityException;
|
||||||
import org.elasticsearch.common.settings.Settings;
|
import org.elasticsearch.common.settings.Settings;
|
||||||
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
import org.elasticsearch.common.util.concurrent.ThreadContext;
|
||||||
|
import org.elasticsearch.transport.TransportChannel;
|
||||||
import org.elasticsearch.xpack.security.authc.Authentication;
|
import org.elasticsearch.xpack.security.authc.Authentication;
|
||||||
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
|
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
|
||||||
import org.elasticsearch.xpack.security.authc.AuthenticationService;
|
import org.elasticsearch.xpack.security.authc.AuthenticationService;
|
||||||
|
@ -15,7 +16,6 @@ import org.elasticsearch.xpack.security.authz.AuthorizationService;
|
||||||
import org.elasticsearch.test.ESTestCase;
|
import org.elasticsearch.test.ESTestCase;
|
||||||
import org.elasticsearch.transport.TransportRequest;
|
import org.elasticsearch.transport.TransportRequest;
|
||||||
import org.elasticsearch.transport.TransportSettings;
|
import org.elasticsearch.transport.TransportSettings;
|
||||||
import org.elasticsearch.transport.netty.NettyTransportChannel;
|
|
||||||
import org.junit.Before;
|
import org.junit.Before;
|
||||||
|
|
||||||
import static org.elasticsearch.xpack.security.support.Exceptions.authenticationError;
|
import static org.elasticsearch.xpack.security.support.Exceptions.authenticationError;
|
||||||
|
@ -34,13 +34,13 @@ public class ServerTransportFilterTests extends ESTestCase {
|
||||||
private AuthenticationService authcService;
|
private AuthenticationService authcService;
|
||||||
private AuthorizationService authzService;
|
private AuthorizationService authzService;
|
||||||
private ServerTransportFilter filter;
|
private ServerTransportFilter filter;
|
||||||
private NettyTransportChannel channel;
|
private TransportChannel channel;
|
||||||
|
|
||||||
@Before
|
@Before
|
||||||
public void init() throws Exception {
|
public void init() throws Exception {
|
||||||
authcService = mock(AuthenticationService.class);
|
authcService = mock(AuthenticationService.class);
|
||||||
authzService = mock(AuthorizationService.class);
|
authzService = mock(AuthorizationService.class);
|
||||||
channel = mock(NettyTransportChannel.class);
|
channel = mock(TransportChannel.class);
|
||||||
when(channel.getProfileName()).thenReturn(TransportSettings.DEFAULT_PROFILE);
|
when(channel.getProfileName()).thenReturn(TransportSettings.DEFAULT_PROFILE);
|
||||||
filter = new ServerTransportFilter.NodeProfile(authcService, authzService, new SecurityActionMapper(),
|
filter = new ServerTransportFilter.NodeProfile(authcService, authzService, new SecurityActionMapper(),
|
||||||
new ThreadContext(Settings.EMPTY), false);
|
new ThreadContext(Settings.EMPTY), false);
|
||||||
|
|
|
@ -31,7 +31,7 @@ public class UserTests extends ESTestCase {
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
|
|
||||||
User.writeTo(user, output);
|
User.writeTo(user, output);
|
||||||
User readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, not(sameInstance(user)));
|
assertThat(readFrom, not(sameInstance(user)));
|
||||||
assertThat(readFrom.principal(), is(user.principal()));
|
assertThat(readFrom.principal(), is(user.principal()));
|
||||||
|
@ -47,7 +47,7 @@ public class UserTests extends ESTestCase {
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
|
|
||||||
User.writeTo(user, output);
|
User.writeTo(user, output);
|
||||||
User readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, not(sameInstance(user)));
|
assertThat(readFrom, not(sameInstance(user)));
|
||||||
assertThat(readFrom.principal(), is(user.principal()));
|
assertThat(readFrom.principal(), is(user.principal()));
|
||||||
|
@ -63,7 +63,7 @@ public class UserTests extends ESTestCase {
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
|
|
||||||
User.writeTo(SystemUser.INSTANCE, output);
|
User.writeTo(SystemUser.INSTANCE, output);
|
||||||
User readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, is(sameInstance(SystemUser.INSTANCE)));
|
assertThat(readFrom, is(sameInstance(SystemUser.INSTANCE)));
|
||||||
assertThat(readFrom.runAs(), is(nullValue()));
|
assertThat(readFrom.runAs(), is(nullValue()));
|
||||||
|
@ -73,7 +73,7 @@ public class UserTests extends ESTestCase {
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
|
|
||||||
User.writeTo(XPackUser.INSTANCE, output);
|
User.writeTo(XPackUser.INSTANCE, output);
|
||||||
User readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, is(sameInstance(XPackUser.INSTANCE)));
|
assertThat(readFrom, is(sameInstance(XPackUser.INSTANCE)));
|
||||||
assertThat(readFrom.runAs(), is(nullValue()));
|
assertThat(readFrom.runAs(), is(nullValue()));
|
||||||
|
@ -84,7 +84,7 @@ public class UserTests extends ESTestCase {
|
||||||
output.writeBoolean(true);
|
output.writeBoolean(true);
|
||||||
output.writeString(randomAsciiOfLengthBetween(4, 30));
|
output.writeString(randomAsciiOfLengthBetween(4, 30));
|
||||||
try {
|
try {
|
||||||
User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User.readFrom(output.bytes().streamInput());
|
||||||
fail("system user had wrong name");
|
fail("system user had wrong name");
|
||||||
} catch (IllegalStateException e) {
|
} catch (IllegalStateException e) {
|
||||||
// expected
|
// expected
|
||||||
|
@ -114,13 +114,13 @@ public class UserTests extends ESTestCase {
|
||||||
public void testReservedUserSerialization() throws Exception {
|
public void testReservedUserSerialization() throws Exception {
|
||||||
BytesStreamOutput output = new BytesStreamOutput();
|
BytesStreamOutput output = new BytesStreamOutput();
|
||||||
User.writeTo(ElasticUser.INSTANCE, output);
|
User.writeTo(ElasticUser.INSTANCE, output);
|
||||||
User readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
User readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, is(sameInstance(ElasticUser.INSTANCE)));
|
assertThat(readFrom, is(sameInstance(ElasticUser.INSTANCE)));
|
||||||
|
|
||||||
output = new BytesStreamOutput();
|
output = new BytesStreamOutput();
|
||||||
User.writeTo(KibanaUser.INSTANCE, output);
|
User.writeTo(KibanaUser.INSTANCE, output);
|
||||||
readFrom = User.readFrom(ByteBufferStreamInput.wrap(output.bytes()));
|
readFrom = User.readFrom(output.bytes().streamInput());
|
||||||
|
|
||||||
assertThat(readFrom, is(sameInstance(KibanaUser.INSTANCE)));
|
assertThat(readFrom, is(sameInstance(KibanaUser.INSTANCE)));
|
||||||
}
|
}
|
||||||
|
|
|
@ -26,13 +26,11 @@ public class ScriptServiceProxy {
|
||||||
|
|
||||||
private final ScriptService service;
|
private final ScriptService service;
|
||||||
private final SecurityContext securityContext;
|
private final SecurityContext securityContext;
|
||||||
private final ClusterService clusterService;
|
|
||||||
|
|
||||||
@Inject
|
@Inject
|
||||||
public ScriptServiceProxy(ScriptService service, SecurityContext securityContext, ClusterService clusterService) {
|
public ScriptServiceProxy(ScriptService service, SecurityContext securityContext) {
|
||||||
this.service = service;
|
this.service = service;
|
||||||
this.securityContext = securityContext;
|
this.securityContext = securityContext;
|
||||||
this.clusterService = clusterService;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
public CompiledScript compile(Script script) {
|
public CompiledScript compile(Script script) {
|
||||||
|
@ -41,7 +39,7 @@ public class ScriptServiceProxy {
|
||||||
|
|
||||||
public CompiledScript compile(org.elasticsearch.script.Script script, Map<String, String> compileParams) {
|
public CompiledScript compile(org.elasticsearch.script.Script script, Map<String, String> compileParams) {
|
||||||
return securityContext.executeAs(XPackUser.INSTANCE, () ->
|
return securityContext.executeAs(XPackUser.INSTANCE, () ->
|
||||||
service.compile(script, WatcherScriptContext.CTX, compileParams, clusterService.state()));
|
service.compile(script, WatcherScriptContext.CTX, compileParams));
|
||||||
}
|
}
|
||||||
|
|
||||||
public ExecutableScript executable(CompiledScript compiledScript, Map<String, Object> vars) {
|
public ExecutableScript executable(CompiledScript compiledScript, Map<String, Object> vars) {
|
||||||
|
@ -64,7 +62,7 @@ public class ScriptServiceProxy {
|
||||||
/**
|
/**
|
||||||
* Factory helper method for testing.
|
* Factory helper method for testing.
|
||||||
*/
|
*/
|
||||||
public static ScriptServiceProxy of(ScriptService service, ClusterService clusterService) {
|
public static ScriptServiceProxy of(ScriptService service) {
|
||||||
return new ScriptServiceProxy(service, SecurityContext.Insecure.INSTANCE, clusterService);
|
return new ScriptServiceProxy(service, SecurityContext.Insecure.INSTANCE);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -256,11 +256,8 @@ public final class WatcherTestUtils {
|
||||||
ScriptEngineRegistry scriptEngineRegistry =
|
ScriptEngineRegistry scriptEngineRegistry =
|
||||||
new ScriptEngineRegistry(Collections.emptyList());
|
new ScriptEngineRegistry(Collections.emptyList());
|
||||||
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, scriptContextRegistry);
|
ScriptSettings scriptSettings = new ScriptSettings(scriptEngineRegistry, scriptContextRegistry);
|
||||||
ClusterService clusterService = Mockito.mock(ClusterService.class);
|
|
||||||
Mockito.when(clusterService.state()).thenReturn(ClusterState.builder(new ClusterName("_name")).build());
|
|
||||||
return ScriptServiceProxy.of(new ScriptService(settings, new Environment(settings),
|
return ScriptServiceProxy.of(new ScriptService(settings, new Environment(settings),
|
||||||
new ResourceWatcherService(settings, tp), scriptEngineRegistry, scriptContextRegistry, scriptSettings),
|
new ResourceWatcherService(settings, tp), scriptEngineRegistry, scriptContextRegistry, scriptSettings));
|
||||||
clusterService);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
public static SearchType getRandomSupportedSearchType() {
|
public static SearchType getRandomSupportedSearchType() {
|
||||||
|
@ -270,12 +267,4 @@ public final class WatcherTestUtils {
|
||||||
SearchType.DFS_QUERY_THEN_FETCH,
|
SearchType.DFS_QUERY_THEN_FETCH,
|
||||||
SearchType.DFS_QUERY_AND_FETCH);
|
SearchType.DFS_QUERY_AND_FETCH);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static boolean areJsonEquivalent(String json1, String json2) throws IOException {
|
|
||||||
XContentParser parser1 = XContentHelper.createParser(new BytesArray(json1.getBytes(StandardCharsets.UTF_8)));
|
|
||||||
XContentParser parser2 = XContentHelper.createParser(new BytesArray(json2.getBytes(StandardCharsets.UTF_8)));
|
|
||||||
Map<String, Object> map1 = parser1.map();
|
|
||||||
Map<String, Object> map2 = parser2.map();
|
|
||||||
return map1.equals(map2);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue