From 8648153f0ec64c898cada7e27213050600f56e93 Mon Sep 17 00:00:00 2001 From: Yannick Welsch Date: Wed, 20 Sep 2017 10:30:23 +0200 Subject: [PATCH] Deguice ActionFilter (elastic/x-pack-elasticsearch#2533) Companion PR to elastic/elasticsearch#26691 Original commit: elastic/x-pack-elasticsearch@3fceb548091be44da727d8697c35099b295afe8c --- .../org/elasticsearch/xpack/XPackPlugin.java | 4 +- .../xpack/security/Security.java | 25 +++++++++++-- .../security/action/SecurityActionModule.java | 37 ------------------- 3 files changed, 23 insertions(+), 43 deletions(-) delete mode 100644 plugin/src/main/java/org/elasticsearch/xpack/security/action/SecurityActionModule.java diff --git a/plugin/src/main/java/org/elasticsearch/xpack/XPackPlugin.java b/plugin/src/main/java/org/elasticsearch/xpack/XPackPlugin.java index 6f8d18d2790..00e33344090 100644 --- a/plugin/src/main/java/org/elasticsearch/xpack/XPackPlugin.java +++ b/plugin/src/main/java/org/elasticsearch/xpack/XPackPlugin.java @@ -456,8 +456,8 @@ public class XPackPlugin extends Plugin implements ScriptPlugin, ActionPlugin, I } @Override - public List> getActionFilters() { - List> filters = new ArrayList<>(); + public List getActionFilters() { + List filters = new ArrayList<>(); filters.addAll(licensing.getActionFilters()); filters.addAll(monitoring.getActionFilters()); filters.addAll(security.getActionFilters()); diff --git a/plugin/src/main/java/org/elasticsearch/xpack/security/Security.java b/plugin/src/main/java/org/elasticsearch/xpack/security/Security.java index f99b09b1555..f1f10949e88 100644 --- a/plugin/src/main/java/org/elasticsearch/xpack/security/Security.java +++ b/plugin/src/main/java/org/elasticsearch/xpack/security/Security.java @@ -42,6 +42,7 @@ import org.elasticsearch.common.settings.Settings; import org.elasticsearch.common.settings.SettingsFilter; import org.elasticsearch.common.util.BigArrays; import org.elasticsearch.common.util.concurrent.ThreadContext; +import org.elasticsearch.common.util.set.Sets; import org.elasticsearch.common.xcontent.NamedXContentRegistry; import org.elasticsearch.common.xcontent.XContent; import org.elasticsearch.common.xcontent.XContentFactory; @@ -75,8 +76,11 @@ import org.elasticsearch.xpack.XPackPlugin; import org.elasticsearch.xpack.XPackSettings; import org.elasticsearch.xpack.extensions.XPackExtension; import org.elasticsearch.xpack.extensions.XPackExtensionsService; -import org.elasticsearch.xpack.security.action.SecurityActionModule; import org.elasticsearch.xpack.security.action.filter.SecurityActionFilter; +import org.elasticsearch.xpack.security.action.interceptor.BulkShardRequestInterceptor; +import org.elasticsearch.xpack.security.action.interceptor.RequestInterceptor; +import org.elasticsearch.xpack.security.action.interceptor.SearchRequestInterceptor; +import org.elasticsearch.xpack.security.action.interceptor.UpdateRequestInterceptor; import org.elasticsearch.xpack.security.action.realm.ClearRealmCacheAction; import org.elasticsearch.xpack.security.action.realm.TransportClearRealmCacheAction; import org.elasticsearch.xpack.security.action.role.ClearRolesCacheAction; @@ -228,6 +232,7 @@ public class Security implements ActionPlugin, IngestPlugin, NetworkPlugin, Clus private final SetOnce securityContext = new SetOnce<>(); private final SetOnce threadContext = new SetOnce<>(); private final SetOnce tokenService = new SetOnce<>(); + private final SetOnce securityActionFilter = new SetOnce<>(); private final List bootstrapChecks; public Security(Settings settings, Environment env, XPackLicenseState licenseState, SSLService sslService) @@ -295,7 +300,6 @@ public class Security implements ActionPlugin, IngestPlugin, NetworkPlugin, Clus b.bind(AuditTrail.class).to(AuditTrailService.class); // interface used by some actions... } }); - modules.add(new SecurityActionModule(settings)); return modules; } @@ -418,6 +422,19 @@ public class Security implements ActionPlugin, IngestPlugin, NetworkPlugin, Clus securityInterceptor.set(new SecurityServerTransportInterceptor(settings, threadPool, authcService.get(), authzService, licenseState, sslService, securityContext.get(), destructiveOperations)); + final Set requestInterceptors; + if (XPackSettings.DLS_FLS_ENABLED.get(settings)) { + requestInterceptors = Sets.newHashSet( + new SearchRequestInterceptor(settings, threadPool, licenseState), + new UpdateRequestInterceptor(settings, threadPool, licenseState), + new BulkShardRequestInterceptor(settings, threadPool, licenseState)); + } else { + requestInterceptors = Collections.emptySet(); + } + + securityActionFilter.set(new SecurityActionFilter(settings, authcService.get(), authzService, licenseState, + requestInterceptors, threadPool, securityContext.get(), destructiveOperations)); + return components; } @@ -585,13 +602,13 @@ public class Security implements ActionPlugin, IngestPlugin, NetworkPlugin, Clus } @Override - public List> getActionFilters() { + public List getActionFilters() { if (enabled == false) { return emptyList(); } // registering the security filter only for nodes if (transportClientMode == false) { - return singletonList(SecurityActionFilter.class); + return singletonList(securityActionFilter.get()); } return emptyList(); } diff --git a/plugin/src/main/java/org/elasticsearch/xpack/security/action/SecurityActionModule.java b/plugin/src/main/java/org/elasticsearch/xpack/security/action/SecurityActionModule.java deleted file mode 100644 index 58cf6bae6b5..00000000000 --- a/plugin/src/main/java/org/elasticsearch/xpack/security/action/SecurityActionModule.java +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License; - * you may not use this file except in compliance with the Elastic License. - */ -package org.elasticsearch.xpack.security.action; - -import org.elasticsearch.common.inject.multibindings.Multibinder; -import org.elasticsearch.common.settings.Settings; -import org.elasticsearch.xpack.XPackSettings; -import org.elasticsearch.xpack.security.action.filter.SecurityActionFilter; -import org.elasticsearch.xpack.security.action.interceptor.BulkShardRequestInterceptor; -import org.elasticsearch.xpack.security.action.interceptor.RequestInterceptor; -import org.elasticsearch.xpack.security.action.interceptor.SearchRequestInterceptor; -import org.elasticsearch.xpack.security.action.interceptor.UpdateRequestInterceptor; -import org.elasticsearch.xpack.security.support.AbstractSecurityModule; - -public class SecurityActionModule extends AbstractSecurityModule.Node { - - public SecurityActionModule(Settings settings) { - super(settings); - } - - @Override - protected void configureNode() { - // we need to ensure that there's only a single instance of the action filters - bind(SecurityActionFilter.class).asEagerSingleton(); - - Multibinder multibinder - = Multibinder.newSetBinder(binder(), RequestInterceptor.class); - if (XPackSettings.DLS_FLS_ENABLED.get(settings)) { - multibinder.addBinding().to(SearchRequestInterceptor.class); - multibinder.addBinding().to(UpdateRequestInterceptor.class); - multibinder.addBinding().to(BulkShardRequestInterceptor.class); - } - } -}