This commit adds SuppressForbidden annotations to command line tools to
still allow to call System#exit() (see also issue 12596 in ES core).
Original commit: elastic/x-pack-elasticsearch@1dd3f1dcb1
The cache provides a get method with a callable to load the value into the cache. Our callable
performs authentication and then returns a value. The issue with this is that the cache will queue
concurrent calls if a value is already being loaded and return the result to all callers. This is
problematic since the key is only the username and we do not validate the credentials as part of
the get call. This means it is possible for valid credentials to be returned a null user and authentication
fails.
Additionally, another variant exists where it is possible for invalid credentials to be returned a valid
user, which allows an attacker to gain access by only knowing a username and issuing a large number
of concurrent requests.
Closeselastic/elasticsearch#860
Original commit: elastic/x-pack-elasticsearch@3d122d3bbb
Currently, Licensee#onChange is called with a license and its status, It would be
cleaner if it accepted the license's operationMode and status as parameters instead.
This hides the license responsible for the notification from the consumer plugins and only
provides the license information used by the commercial plugins to turn features on via
operationMode and status to act on whether the current license is enabled, in
grace_period or disabled.
Original commit: elastic/x-pack-elasticsearch@b0ea7ec32b
In the test we always create at least one type_ factory but the test incorrectly used type_1
as the first, when it should have been type_0
Original commit: elastic/x-pack-elasticsearch@e4128cbc26
This change allows for messages to be signed when message signing is enabled and a system
key is not present. This is accomplished by generating a random key on startup and then using
HKDF with HmacSHA1 to generate the keying material to be used to sign the messages. The random
key from the originating node is added to the signed message so that the signing key can be
derived on the receiving node.
When a system key is present, the system key is used for signing and the preexisting behavior
is maintained.
Closeselastic/elasticsearch#711
Original commit: elastic/x-pack-elasticsearch@c41fdc0ac3
This change removes obsolete forbidden API usage, cuts over
from an interface to an abstract class for IndexSearcherWrapper and
delegates all core cache keys to the wrapped reader.
Relates to elastic/elasticsearch#774
Original commit: elastic/x-pack-elasticsearch@3799bab0d9
Shield now supports the ability to disable or enable individual features based on the type of
license that is currently installed. The change replaces the LicenseService in shield with a
ShieldLicensee that is notified on changes to the license. The ShieldLicensee then updates
a ShieldLicenseState object, which contains the logic and methods to check for features being
enabled or disabled. The ShieldLicenseState object is used by consumers to check the status
of a feature. The decoupling of the feature enablement from the ShieldLicensee class was done
to work around circular dependency issues.
Closeselastic/elasticsearch#689
Original commit: elastic/x-pack-elasticsearch@442514496d
This commit removes Guava as a dependency. Note that Guava will remain
as a test-only dependency (transitively through Elasticsearch through
Jimfs).
Relates elastic/elasticsearchelastic/elasticsearch#13224
Original commit: elastic/x-pack-elasticsearch@fe23d5f25f
This commit catches up with master which removed the shard level injector
and changed the logic how the SearcherWrapper works and is installed.
The way we now install it is via a package private onModule(IndexModule) call.
There is no public API for this anymore.
The wrapper also doesn't need to watch the IndexShards state since now it will only
be used when the shard is STARTED or RECOVERED.
Original commit: elastic/x-pack-elasticsearch@42b9eeef3d
This commit removes all uses of com.google.common.net.InetAddresses
across the codebase. This is one of the few remaining steps in the
eventual removal of Guava as a dependency.
Relates elastic/elasticsearchelastic/elasticsearch#13224
Original commit: elastic/x-pack-elasticsearch@f6a0ed1395
This commit removes the use of com.google.common.cache.Cache,
com.google.common.cache.CacheBuilder and
com.google.common.cache.CacheLoader.
Relates elastic/elasticsearchelastic/elasticsearch#13224, elastic/elasticsearchelastic/elasticsearch#13717
Original commit: elastic/x-pack-elasticsearch@04c254ee95
Some tests are still using a node builder for nodes that need to load Shield, which is not currently
supported by elasticsearch. This changes some to use a MockNode and awaits fix a tribe test
that was previously testing nothing.
Original commit: elastic/x-pack-elasticsearch@57d0c902b6
This updates our test certificates to have more subject alternative names and adds a script
to make regeneration easier in the future. Also added are the private keys in PEM format and
a .p12 version of the keystore. In the future we may want to start supporting PKCS12 keystores
and this will be a starting point for that.
Original commit: elastic/x-pack-elasticsearch@92c94c9f28
