mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-09 14:34:43 +00:00
parent
941c215d52
commit
f9bf10f2b6
@ -101,7 +101,7 @@ public class SSLService {
|
||||
private final Map<String, SSLConfiguration> sslConfigurations;
|
||||
|
||||
/**
|
||||
* A mapping from a SSLConfiguration to a pre-built context.
|
||||
* A mapping from an SSLConfiguration to a pre-built context.
|
||||
* <p>
|
||||
* This is managed separately to the {@link #sslConfigurations} map, so that a single configuration (by object equality)
|
||||
* always maps to the same {@link SSLContextHolder}, even if it is being used within a different context-name.
|
||||
@ -253,7 +253,7 @@ public class SSLService {
|
||||
String[] supportedProtocols = configuration.supportedProtocols().toArray(Strings.EMPTY_ARRAY);
|
||||
SSLParameters parameters = new SSLParameters(ciphers, supportedProtocols);
|
||||
if (configuration.verificationMode().isHostnameVerificationEnabled() && host != null) {
|
||||
// By default, a SSLEngine will not perform hostname verification. In order to perform hostname verification
|
||||
// By default, an SSLEngine will not perform hostname verification. In order to perform hostname verification
|
||||
// we need to specify a EndpointIdentificationAlgorithm. We use the HTTPS algorithm to prevent against
|
||||
// man in the middle attacks for all of our connections.
|
||||
parameters.setEndpointIdentificationAlgorithm("HTTPS");
|
||||
@ -303,7 +303,7 @@ public class SSLService {
|
||||
Objects.requireNonNull(sslConfiguration, "SSL Configuration cannot be null");
|
||||
SSLContextHolder holder = sslContexts.get(sslConfiguration);
|
||||
if (holder == null) {
|
||||
throw new IllegalArgumentException("did not find a SSLContext for [" + sslConfiguration.toString() + "]");
|
||||
throw new IllegalArgumentException("did not find an SSLContext for [" + sslConfiguration.toString() + "]");
|
||||
}
|
||||
return holder;
|
||||
}
|
||||
@ -636,7 +636,7 @@ public class SSLService {
|
||||
while (sessionIds.hasMoreElements()) {
|
||||
byte[] sessionId = sessionIds.nextElement();
|
||||
SSLSession session = sslSessionContext.getSession(sessionId);
|
||||
// a SSLSession could be null as there is no lock while iterating, the session cache
|
||||
// an SSLSession could be null as there is no lock while iterating, the session cache
|
||||
// could have evicted a value, the session could be timed out, or the session could
|
||||
// have already been invalidated, which removes the value from the session cache in the
|
||||
// sun implementation
|
||||
|
@ -712,7 +712,7 @@ public class SSLServiceTests extends ESTestCase {
|
||||
SSLContext sslContext = sslService.sslContext(sslService.sslConfiguration(Settings.EMPTY));
|
||||
try (CloseableHttpClient client = HttpClients.custom().setSSLContext(sslContext).build()) {
|
||||
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
||||
// This will result in a SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||
// This will result in an SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||
// truststore trusts all common public CAs so the handshake will succeed
|
||||
privilegedConnect(() -> client.execute(new HttpGet("https://www.elastic.co/")).close());
|
||||
}
|
||||
@ -745,7 +745,7 @@ public class SSLServiceTests extends ESTestCase {
|
||||
client.start();
|
||||
|
||||
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
||||
// This will result in a SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||
// This will result in an SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||
// truststore trusts all common public CAs so the handshake will succeed
|
||||
client.execute(new HttpHost("elastic.co", 443, "https"), new HttpGet("/"), new AssertionCallback()).get();
|
||||
}
|
||||
|
@ -529,7 +529,7 @@ public class CertificateGenerateTool extends EnvironmentAwareCommand {
|
||||
terminal.println(" the certificate and private key will also be included in the output file.");
|
||||
}
|
||||
terminal.println("* Information about each instance");
|
||||
terminal.println(" * An instance is any piece of the Elastic Stack that requires a SSL certificate.");
|
||||
terminal.println(" * An instance is any piece of the Elastic Stack that requires an SSL certificate.");
|
||||
terminal.println(" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats");
|
||||
terminal.println(" may all require a certificate and private key.");
|
||||
terminal.println(" * The minimum required value for each instance is a name. This can simply be the");
|
||||
|
@ -149,7 +149,7 @@ public class CertificateTool extends LoggingAwareMultiCommand {
|
||||
"signing requests for use with SSL/TLS in the Elastic stack.";
|
||||
|
||||
static final String INSTANCE_EXPLANATION =
|
||||
" * An instance is any piece of the Elastic Stack that requires a SSL certificate.\n" +
|
||||
" * An instance is any piece of the Elastic Stack that requires an SSL certificate.\n" +
|
||||
" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats\n" +
|
||||
" may all require a certificate and private key.\n" +
|
||||
" * The minimum required value for each instance is a name. This can simply be the\n" +
|
||||
|
@ -59,7 +59,7 @@ public class LdapUserSearchSessionFactoryTests extends LdapTestCase {
|
||||
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
||||
/*
|
||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* verification tests since a re-established connection does not perform hostname verification.
|
||||
*/
|
||||
|
||||
|
@ -85,7 +85,7 @@ public class OpenLdapTests extends ESTestCase {
|
||||
Path truststore = getDataPath(LDAPTRUST_PATH);
|
||||
/*
|
||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* verification tests since a re-established connection does not perform hostname verification.
|
||||
*/
|
||||
MockSecureSettings mockSecureSettings = new MockSecureSettings();
|
||||
|
@ -53,7 +53,7 @@ public class OpenLdapUserSearchSessionFactoryTests extends ESTestCase {
|
||||
Path caPath = getDataPath(LDAPCACERT_PATH);
|
||||
/*
|
||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* verification tests since a re-established connection does not perform hostname verification.
|
||||
*/
|
||||
globalSettings = Settings.builder()
|
||||
|
@ -43,7 +43,7 @@ public class ADLdapUserSearchSessionFactoryTests extends AbstractActiveDirectory
|
||||
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
||||
/*
|
||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* verification tests since a re-established connection does not perform hostname verification.
|
||||
*/
|
||||
|
||||
|
@ -78,7 +78,7 @@ public abstract class AbstractActiveDirectoryTestCase extends ESTestCase {
|
||||
});
|
||||
/*
|
||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||
* verification tests since a re-established connection does not perform hostname verification.
|
||||
*/
|
||||
Settings.Builder builder = Settings.builder().put("path.home", createTempDir());
|
||||
|
Loading…
x
Reference in New Issue
Block a user