mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-12 16:05:28 +00:00
This commit adds the necessary changes to make SSL work on the transport layer by default. A large portion of the SSL configuration/settings was re-worked with this change. Some notable highlights include support for PEM cert/keys, reloadable SSL configuration, separate HTTP ssl configuration, and separate LDAP configuration. The following is a list of specific items addressed: * `SSLSettings` renamed to `SSLConfiguration` * `KeyConfig` and `TrustConfig` abstractions created. These hide the details of how `KeyManager[]` and `TrustManager[]` are loaded. These are also responsible for settings validation (ie keystore password is not null) * Configuration fallback is changed. Previously any setting would fallback to the "global" value (`xpack.security.ssl.*`). Now a keystore path, key path, ca paths, or truststore path must be specified otherwise the configuration for that key/trust will fallback to the global configuration. In other words if you want to change part of a keystore or truststore in a profile you need to supply all the information. This could be considered breaking if a user relied on the old fallback * JDK trusted certificates (`cacerts`) are trusted by default (breaking change). This can be disabled via a setting. * We now monitor the SSL files for changes and enable dynamic reloading of the configuration. This will make it easier for users when they are getting set up with certificates so they do not need to restart every time. This can be disabled via a setting * LDAP realms can now have their own SSL configurations * HTTP can now have its own SSL configuration * SSL is enabled by default on the transport layer only. Hostname verification is enabled as well. On startup if no global SSL settings are present and SSL is configured to be used, we auto generate one based on the default CA that is shipped. This process includes a best effort attempt to generate the subject alternative names. * `xpack.security.ssl.hostname_verification` is deprecated in favor of `xpack.security.ssl.hostname_verification.enabled` * added Bouncy Castle info to NOTICE * consolidated NOTICE and LICENSE files Closes elastic/elasticsearch#14 Closes elastic/elasticsearch#34 Closes elastic/elasticsearch#1483 Closes elastic/elasticsearch#1933 Addresses security portion of elastic/elasticsearch#673 Original commit: elastic/x-pack-elasticsearch@7c359db90b
206 lines
6.5 KiB
Groovy
206 lines
6.5 KiB
Groovy
import org.elasticsearch.gradle.MavenFilteringHack
|
|
import org.elasticsearch.gradle.test.NodeInfo
|
|
|
|
group 'org.elasticsearch.plugin'
|
|
|
|
apply plugin: 'elasticsearch.esplugin'
|
|
esplugin {
|
|
name 'x-pack'
|
|
description 'Elasticsearch Expanded Pack Plugin'
|
|
classname 'org.elasticsearch.xpack.XPackPlugin'
|
|
}
|
|
|
|
ext.versions = [
|
|
okhttp: '2.7.5'
|
|
]
|
|
|
|
// TODO: fix this! https://github.com/elastic/x-plugins/issues/1066
|
|
ext.compactProfile = 'full'
|
|
|
|
dependencyLicenses.enabled = false
|
|
|
|
dependencies {
|
|
// license deps
|
|
compile project(':x-plugins:elasticsearch:license:base')
|
|
testCompile project(':x-plugins:elasticsearch:license:licensor')
|
|
|
|
// shield deps
|
|
compile 'dk.brics.automaton:automaton:1.11-8'
|
|
compile 'com.unboundid:unboundid-ldapsdk:2.3.8'
|
|
compile 'org.bouncycastle:bcprov-jdk15on:1.54'
|
|
compile 'org.bouncycastle:bcpkix-jdk15on:1.54'
|
|
testCompile 'com.google.jimfs:jimfs:1.0'
|
|
|
|
// watcher deps
|
|
compile 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:r239'
|
|
compile 'com.google.guava:guava:16.0.1' // needed by watcher for the html sanitizer and shield tests for jimfs
|
|
compile 'com.sun.mail:javax.mail:1.5.3'
|
|
testCompile 'org.subethamail:subethasmtp:3.1.7'
|
|
// needed for subethasmtp, has @GuardedBy annotation
|
|
testCompile 'com.google.code.findbugs:jsr305:3.0.1'
|
|
|
|
// common test deps
|
|
testCompile 'org.elasticsearch:securemock:1.2'
|
|
testCompile 'org.slf4j:slf4j-log4j12:1.6.2'
|
|
testCompile 'org.slf4j:slf4j-api:1.6.2'
|
|
|
|
// mock web server
|
|
testCompile "com.squareup.okhttp:mockwebserver:${versions.okhttp}"
|
|
testCompile "com.squareup.okhttp:okhttp:${versions.okhttp}"
|
|
testCompile "com.squareup.okhttp:okhttp-ws:${versions.okhttp}"
|
|
testCompile 'com.squareup.okio:okio:1.6.0'
|
|
}
|
|
|
|
// we keep the source directories in the original structure of split plugins,
|
|
// in order to facilitate backports to 2.x. TODO: remove after 5.0 release
|
|
for (String module : ['', 'license-plugin/', 'shield/', 'watcher/', 'marvel/', 'graph/']) {
|
|
sourceSets {
|
|
main {
|
|
java.srcDir("${module}src/main/java")
|
|
resources.srcDir("${module}src/main/resources")
|
|
}
|
|
test {
|
|
java.srcDir("${module}src/test/java")
|
|
resources.srcDir("${module}src/test/resources")
|
|
}
|
|
}
|
|
}
|
|
|
|
compileJava.options.compilerArgs << "-Xlint:-deprecation,-rawtypes,-serial,-try,-unchecked"
|
|
compileTestJava.options.compilerArgs << "-Xlint:-deprecation,-rawtypes,-serial,-try,-unchecked"
|
|
|
|
ext.expansions = [
|
|
'project.version': version,
|
|
]
|
|
|
|
processResources {
|
|
from(sourceSets.main.resources.srcDirs) {
|
|
exclude '**/public.key'
|
|
inputs.properties(expansions)
|
|
MavenFilteringHack.filter(it, expansions)
|
|
}
|
|
String licenseKeyName = System.getProperty('license.key', 'dev')
|
|
String licenseKeyPath = "license-plugin/keys/${licenseKeyName}/public.key"
|
|
if (file(licenseKeyPath).exists() == false) {
|
|
throw new GradleException("no public key found for '${licenseKeyName}'")
|
|
}
|
|
from licenseKeyPath
|
|
}
|
|
|
|
processTestResources {
|
|
from(sourceSets.test.resources.srcDirs) {
|
|
exclude '**/*.key'
|
|
exclude '**/*.jks'
|
|
exclude '**/*.p12'
|
|
inputs.properties(expansions)
|
|
MavenFilteringHack.filter(it, expansions)
|
|
}
|
|
}
|
|
|
|
forbiddenPatterns {
|
|
exclude '**/*.key'
|
|
exclude '**/*.p12'
|
|
exclude '**/*.der'
|
|
}
|
|
|
|
// TODO: standardize packaging config for plugins
|
|
bundlePlugin {
|
|
from(projectDir) {
|
|
include 'LICENSE.txt'
|
|
include 'NOTICE.txt'
|
|
}
|
|
from('bin/x-pack') {
|
|
into 'bin'
|
|
}
|
|
from('shield/bin/x-pack') {
|
|
into 'bin'
|
|
}
|
|
from('shield/config/x-pack') {
|
|
into 'config'
|
|
}
|
|
from('watcher/bin/x-pack') {
|
|
into 'bin'
|
|
}
|
|
}
|
|
|
|
integTest {
|
|
// TODO: fix this rest test to not depend on a hardcoded port!
|
|
systemProperty 'tests.rest.blacklist', 'getting_started/10_monitor_cluster_health/*'
|
|
cluster {
|
|
setting 'xpack.monitoring.agent.interval', '3s'
|
|
setupCommand 'setupDummyUser', 'bin/x-pack/users', 'useradd', 'test_user', '-p', 'changeme', '-r', 'superuser'
|
|
waitCondition = { NodeInfo node, AntBuilder ant ->
|
|
File tmpFile = new File(node.cwd, 'wait.success')
|
|
ant.get(src: "http://${node.httpUri()}",
|
|
dest: tmpFile.toString(),
|
|
username: "test_user",
|
|
password: "changeme",
|
|
ignoreerrors: true, // do not fail on error, so logging buffers can be flushed by the wait task
|
|
retries: 10)
|
|
return tmpFile.exists()
|
|
}
|
|
}
|
|
}
|
|
|
|
// TODO: don't publish test artifacts just to run messy tests, fix the tests!
|
|
// https://github.com/elastic/x-plugins/issues/724
|
|
configurations {
|
|
testArtifacts.extendsFrom testRuntime
|
|
}
|
|
task testJar(type: Jar) {
|
|
classifier "test"
|
|
from sourceSets.test.output
|
|
}
|
|
artifacts {
|
|
// normal es plugins do not publish the jar but we need to since users need it for Transport Clients and extensions
|
|
archives jar
|
|
testArtifacts testJar
|
|
}
|
|
|
|
run {
|
|
setupCommand 'setupDummyUser', 'bin/x-pack/users', 'useradd', 'test_user', '-p', 'changeme', '-r', 'superuser'
|
|
}
|
|
|
|
// classes are missing, e.g. com.ibm.icu.lang.UCharacter
|
|
thirdPartyAudit.excludes = [
|
|
// uses internal java api: sun.misc.Unsafe
|
|
'com.google.common.cache.Striped64',
|
|
'com.google.common.cache.Striped64$1',
|
|
'com.google.common.cache.Striped64$Cell',
|
|
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator',
|
|
'com.google.common.primitives.UnsignedBytes$LexicographicalComparatorHolder$UnsafeComparator$1',
|
|
]
|
|
|
|
// someone figure out what the x-plugins logic should be
|
|
licenseHeaders.enabled = false
|
|
|
|
forbiddenApisMain {
|
|
signaturesURLs += [file('signatures.txt').toURI().toURL()]
|
|
}
|
|
|
|
modifyPom { MavenPom pom ->
|
|
pom.withXml { XmlProvider xml ->
|
|
// first find if we have dependencies at all, and grab the node
|
|
NodeList depsNodes = xml.asNode().get('dependencies')
|
|
if (depsNodes.isEmpty()) {
|
|
return
|
|
}
|
|
|
|
// find the 'base' dependency and replace it with the correct name because the project name is
|
|
// always used even when the pom of the other project is correct
|
|
Iterator<Node> childNodeIter = depsNodes.get(0).children().iterator()
|
|
while (childNodeIter.hasNext()) {
|
|
Node depNode = childNodeIter.next()
|
|
String groupId = depNode.get('groupId').get(0).text()
|
|
Node artifactIdNode = depNode.get('artifactId').get(0)
|
|
String artifactId = artifactIdNode.text()
|
|
String scope = depNode.get("scope").get(0).text()
|
|
if (groupId.equals('org.elasticsearch') && artifactId.equals('base')) {
|
|
artifactIdNode.replaceNode(new Node(null, 'artifactId', 'license-core'))
|
|
} else if ('test'.equals(scope)) {
|
|
childNodeIter.remove()
|
|
}
|
|
}
|
|
}
|
|
}
|