mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-25 09:28:27 +00:00
parent
941c215d52
commit
f9bf10f2b6
@ -101,7 +101,7 @@ public class SSLService {
|
|||||||
private final Map<String, SSLConfiguration> sslConfigurations;
|
private final Map<String, SSLConfiguration> sslConfigurations;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* A mapping from a SSLConfiguration to a pre-built context.
|
* A mapping from an SSLConfiguration to a pre-built context.
|
||||||
* <p>
|
* <p>
|
||||||
* This is managed separately to the {@link #sslConfigurations} map, so that a single configuration (by object equality)
|
* This is managed separately to the {@link #sslConfigurations} map, so that a single configuration (by object equality)
|
||||||
* always maps to the same {@link SSLContextHolder}, even if it is being used within a different context-name.
|
* always maps to the same {@link SSLContextHolder}, even if it is being used within a different context-name.
|
||||||
@ -253,7 +253,7 @@ public class SSLService {
|
|||||||
String[] supportedProtocols = configuration.supportedProtocols().toArray(Strings.EMPTY_ARRAY);
|
String[] supportedProtocols = configuration.supportedProtocols().toArray(Strings.EMPTY_ARRAY);
|
||||||
SSLParameters parameters = new SSLParameters(ciphers, supportedProtocols);
|
SSLParameters parameters = new SSLParameters(ciphers, supportedProtocols);
|
||||||
if (configuration.verificationMode().isHostnameVerificationEnabled() && host != null) {
|
if (configuration.verificationMode().isHostnameVerificationEnabled() && host != null) {
|
||||||
// By default, a SSLEngine will not perform hostname verification. In order to perform hostname verification
|
// By default, an SSLEngine will not perform hostname verification. In order to perform hostname verification
|
||||||
// we need to specify a EndpointIdentificationAlgorithm. We use the HTTPS algorithm to prevent against
|
// we need to specify a EndpointIdentificationAlgorithm. We use the HTTPS algorithm to prevent against
|
||||||
// man in the middle attacks for all of our connections.
|
// man in the middle attacks for all of our connections.
|
||||||
parameters.setEndpointIdentificationAlgorithm("HTTPS");
|
parameters.setEndpointIdentificationAlgorithm("HTTPS");
|
||||||
@ -303,7 +303,7 @@ public class SSLService {
|
|||||||
Objects.requireNonNull(sslConfiguration, "SSL Configuration cannot be null");
|
Objects.requireNonNull(sslConfiguration, "SSL Configuration cannot be null");
|
||||||
SSLContextHolder holder = sslContexts.get(sslConfiguration);
|
SSLContextHolder holder = sslContexts.get(sslConfiguration);
|
||||||
if (holder == null) {
|
if (holder == null) {
|
||||||
throw new IllegalArgumentException("did not find a SSLContext for [" + sslConfiguration.toString() + "]");
|
throw new IllegalArgumentException("did not find an SSLContext for [" + sslConfiguration.toString() + "]");
|
||||||
}
|
}
|
||||||
return holder;
|
return holder;
|
||||||
}
|
}
|
||||||
@ -636,7 +636,7 @@ public class SSLService {
|
|||||||
while (sessionIds.hasMoreElements()) {
|
while (sessionIds.hasMoreElements()) {
|
||||||
byte[] sessionId = sessionIds.nextElement();
|
byte[] sessionId = sessionIds.nextElement();
|
||||||
SSLSession session = sslSessionContext.getSession(sessionId);
|
SSLSession session = sslSessionContext.getSession(sessionId);
|
||||||
// a SSLSession could be null as there is no lock while iterating, the session cache
|
// an SSLSession could be null as there is no lock while iterating, the session cache
|
||||||
// could have evicted a value, the session could be timed out, or the session could
|
// could have evicted a value, the session could be timed out, or the session could
|
||||||
// have already been invalidated, which removes the value from the session cache in the
|
// have already been invalidated, which removes the value from the session cache in the
|
||||||
// sun implementation
|
// sun implementation
|
||||||
|
@ -712,7 +712,7 @@ public class SSLServiceTests extends ESTestCase {
|
|||||||
SSLContext sslContext = sslService.sslContext(sslService.sslConfiguration(Settings.EMPTY));
|
SSLContext sslContext = sslService.sslContext(sslService.sslConfiguration(Settings.EMPTY));
|
||||||
try (CloseableHttpClient client = HttpClients.custom().setSSLContext(sslContext).build()) {
|
try (CloseableHttpClient client = HttpClients.custom().setSSLContext(sslContext).build()) {
|
||||||
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
||||||
// This will result in a SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
// This will result in an SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||||
// truststore trusts all common public CAs so the handshake will succeed
|
// truststore trusts all common public CAs so the handshake will succeed
|
||||||
privilegedConnect(() -> client.execute(new HttpGet("https://www.elastic.co/")).close());
|
privilegedConnect(() -> client.execute(new HttpGet("https://www.elastic.co/")).close());
|
||||||
}
|
}
|
||||||
@ -745,7 +745,7 @@ public class SSLServiceTests extends ESTestCase {
|
|||||||
client.start();
|
client.start();
|
||||||
|
|
||||||
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
// Execute a GET on a site known to have a valid certificate signed by a trusted public CA
|
||||||
// This will result in a SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
// This will result in an SSLHandshakeException if the SSLContext does not trust the CA, but the default
|
||||||
// truststore trusts all common public CAs so the handshake will succeed
|
// truststore trusts all common public CAs so the handshake will succeed
|
||||||
client.execute(new HttpHost("elastic.co", 443, "https"), new HttpGet("/"), new AssertionCallback()).get();
|
client.execute(new HttpHost("elastic.co", 443, "https"), new HttpGet("/"), new AssertionCallback()).get();
|
||||||
}
|
}
|
||||||
|
@ -529,7 +529,7 @@ public class CertificateGenerateTool extends EnvironmentAwareCommand {
|
|||||||
terminal.println(" the certificate and private key will also be included in the output file.");
|
terminal.println(" the certificate and private key will also be included in the output file.");
|
||||||
}
|
}
|
||||||
terminal.println("* Information about each instance");
|
terminal.println("* Information about each instance");
|
||||||
terminal.println(" * An instance is any piece of the Elastic Stack that requires a SSL certificate.");
|
terminal.println(" * An instance is any piece of the Elastic Stack that requires an SSL certificate.");
|
||||||
terminal.println(" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats");
|
terminal.println(" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats");
|
||||||
terminal.println(" may all require a certificate and private key.");
|
terminal.println(" may all require a certificate and private key.");
|
||||||
terminal.println(" * The minimum required value for each instance is a name. This can simply be the");
|
terminal.println(" * The minimum required value for each instance is a name. This can simply be the");
|
||||||
|
@ -149,7 +149,7 @@ public class CertificateTool extends LoggingAwareMultiCommand {
|
|||||||
"signing requests for use with SSL/TLS in the Elastic stack.";
|
"signing requests for use with SSL/TLS in the Elastic stack.";
|
||||||
|
|
||||||
static final String INSTANCE_EXPLANATION =
|
static final String INSTANCE_EXPLANATION =
|
||||||
" * An instance is any piece of the Elastic Stack that requires a SSL certificate.\n" +
|
" * An instance is any piece of the Elastic Stack that requires an SSL certificate.\n" +
|
||||||
" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats\n" +
|
" Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats\n" +
|
||||||
" may all require a certificate and private key.\n" +
|
" may all require a certificate and private key.\n" +
|
||||||
" * The minimum required value for each instance is a name. This can simply be the\n" +
|
" * The minimum required value for each instance is a name. This can simply be the\n" +
|
||||||
|
@ -59,7 +59,7 @@ public class LdapUserSearchSessionFactoryTests extends LdapTestCase {
|
|||||||
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
||||||
/*
|
/*
|
||||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||||
* verification tests since a re-established connection does not perform hostname verification.
|
* verification tests since a re-established connection does not perform hostname verification.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
@ -85,7 +85,7 @@ public class OpenLdapTests extends ESTestCase {
|
|||||||
Path truststore = getDataPath(LDAPTRUST_PATH);
|
Path truststore = getDataPath(LDAPTRUST_PATH);
|
||||||
/*
|
/*
|
||||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||||
* verification tests since a re-established connection does not perform hostname verification.
|
* verification tests since a re-established connection does not perform hostname verification.
|
||||||
*/
|
*/
|
||||||
MockSecureSettings mockSecureSettings = new MockSecureSettings();
|
MockSecureSettings mockSecureSettings = new MockSecureSettings();
|
||||||
|
@ -53,7 +53,7 @@ public class OpenLdapUserSearchSessionFactoryTests extends ESTestCase {
|
|||||||
Path caPath = getDataPath(LDAPCACERT_PATH);
|
Path caPath = getDataPath(LDAPCACERT_PATH);
|
||||||
/*
|
/*
|
||||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||||
* verification tests since a re-established connection does not perform hostname verification.
|
* verification tests since a re-established connection does not perform hostname verification.
|
||||||
*/
|
*/
|
||||||
globalSettings = Settings.builder()
|
globalSettings = Settings.builder()
|
||||||
|
@ -43,7 +43,7 @@ public class ADLdapUserSearchSessionFactoryTests extends AbstractActiveDirectory
|
|||||||
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
Environment env = TestEnvironment.newEnvironment(Settings.builder().put("path.home", createTempDir()).build());
|
||||||
/*
|
/*
|
||||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||||
* verification tests since a re-established connection does not perform hostname verification.
|
* verification tests since a re-established connection does not perform hostname verification.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
@ -78,7 +78,7 @@ public abstract class AbstractActiveDirectoryTestCase extends ESTestCase {
|
|||||||
});
|
});
|
||||||
/*
|
/*
|
||||||
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
* Prior to each test we reinitialize the socket factory with a new SSLService so that we get a new SSLContext.
|
||||||
* If we re-use a SSLContext, previously connected sessions can get re-established which breaks hostname
|
* If we re-use an SSLContext, previously connected sessions can get re-established which breaks hostname
|
||||||
* verification tests since a re-established connection does not perform hostname verification.
|
* verification tests since a re-established connection does not perform hostname verification.
|
||||||
*/
|
*/
|
||||||
Settings.Builder builder = Settings.builder().put("path.home", createTempDir());
|
Settings.Builder builder = Settings.builder().put("path.home", createTempDir());
|
||||||
|
Loading…
x
Reference in New Issue
Block a user