Skip to content

Commit 6e58e5b

Browse files
retareta
committed
[FEATURE] Built-in secure transports support
Signed-off-by: Andriy Redko <andriy.redko@aiven.io>
1 parent 77a1193 commit 6e58e5b

File tree

15 files changed

+1186
-3
lines changed

15 files changed

+1186
-3
lines changed

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
112112
- [Tiered caching] Make IndicesRequestCache implementation configurable [EXPERIMENTAL] ([#12533](https://github.com/opensearch-project/OpenSearch/pull/12533))
113113
- Add kuromoji_completion analyzer and filter ([#4835](https://github.com/opensearch-project/OpenSearch/issues/4835))
114114
- The org.opensearch.bootstrap.Security should support codebase for JAR files with classifiers ([#12586](https://github.com/opensearch-project/OpenSearch/issues/12586))
115+
- Built-in secure transports support ([#12435](https://github.com/opensearch-project/OpenSearch/pull/12435))
115116

116117
### Dependencies
117118
- Bump `peter-evans/find-comment` from 2 to 3 ([#12288](https://github.com/opensearch-project/OpenSearch/pull/12288))

‎modules/transport-netty4/src/main/java/org/opensearch/http/netty4/ssl/SecureNetty4HttpServerTransport.java

+166
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
/*
2+
* Copyright 2015-2017 floragunn GmbH
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
*/
17+
18+
/*
19+
* SPDX-License-Identifier: Apache-2.0
20+
*
21+
* The OpenSearch Contributors require contributions made to
22+
* this file be licensed under the Apache-2.0 license or a
23+
* compatible open source license.
24+
*
25+
* Modifications Copyright OpenSearch Contributors. See
26+
* GitHub history for details.
27+
*/
28+
29+
package org.opensearch.http.netty4.ssl;
30+
31+
import org.apache.logging.log4j.LogManager;
32+
import org.apache.logging.log4j.Logger;
33+
import org.opensearch.common.network.NetworkService;
34+
import org.opensearch.common.settings.ClusterSettings;
35+
import org.opensearch.common.settings.Settings;
36+
import org.opensearch.common.util.BigArrays;
37+
import org.opensearch.core.xcontent.NamedXContentRegistry;
38+
import org.opensearch.http.HttpChannel;
39+
import org.opensearch.http.HttpHandlingSettings;
40+
import org.opensearch.http.netty4.Netty4HttpChannel;
41+
import org.opensearch.http.netty4.Netty4HttpServerTransport;
42+
import org.opensearch.plugins.SecureTransportSettingsProvider;
43+
import org.opensearch.telemetry.tracing.Tracer;
44+
import org.opensearch.threadpool.ThreadPool;
45+
import org.opensearch.transport.SharedGroupFactory;
46+
47+
import javax.net.ssl.SSLContext;
48+
import javax.net.ssl.SSLEngine;
49+
50+
import io.netty.channel.Channel;
51+
import io.netty.channel.ChannelHandler;
52+
import io.netty.channel.ChannelHandlerContext;
53+
import io.netty.handler.codec.DecoderException;
54+
import io.netty.handler.ssl.ApplicationProtocolNames;
55+
import io.netty.handler.ssl.ApplicationProtocolNegotiationHandler;
56+
import io.netty.handler.ssl.SslHandler;
57+
58+
public class SecureNetty4HttpServerTransport extends Netty4HttpServerTransport {
59+
private static final Logger logger = LogManager.getLogger(SecureNetty4HttpServerTransport.class);
60+
private final SecureTransportSettingsProvider secureTransportSettingsProvider;
61+
private final SecureTransportSettingsProvider.ServerExceptionHandler exceptionHandler;
62+
63+
public SecureNetty4HttpServerTransport(
64+
final Settings settings,
65+
final NetworkService networkService,
66+
final BigArrays bigArrays,
67+
final ThreadPool threadPool,
68+
final NamedXContentRegistry namedXContentRegistry,
69+
final Dispatcher dispatcher,
70+
final ClusterSettings clusterSettings,
71+
final SharedGroupFactory sharedGroupFactory,
72+
final SecureTransportSettingsProvider secureTransportSettingsProvider,
73+
final Tracer tracer
74+
) {
75+
super(
76+
settings,
77+
networkService,
78+
bigArrays,
79+
threadPool,
80+
namedXContentRegistry,
81+
dispatcher,
82+
clusterSettings,
83+
sharedGroupFactory,
84+
tracer
85+
);
86+
this.secureTransportSettingsProvider = secureTransportSettingsProvider;
87+
this.exceptionHandler = secureTransportSettingsProvider.buildHttpServerExceptionHandler(settings, this)
88+
.orElse(SecureTransportSettingsProvider.ServerExceptionHandler.NOOP);
89+
}
90+
91+
@Override
92+
public ChannelHandler configureServerChannelHandler() {
93+
return new SslHttpChannelHandler(this, handlingSettings);
94+
}
95+
96+
@Override
97+
public void onException(HttpChannel channel, Exception cause0) {
98+
Throwable cause = cause0;
99+
100+
if (cause0 instanceof DecoderException && cause0 != null) {
101+
cause = cause0.getCause();
102+
}
103+
104+
exceptionHandler.onError(cause);
105+
logger.error("Exception during establishing a SSL connection: " + cause, cause);
106+
super.onException(channel, cause0);
107+
}
108+
109+
protected class SslHttpChannelHandler extends Netty4HttpServerTransport.HttpChannelHandler {
110+
/**
111+
* Application negotiation handler to select either HTTP 1.1 or HTTP 2 protocol, based
112+
* on client/server ALPN negotiations.
113+
*/
114+
private class Http2OrHttpHandler extends ApplicationProtocolNegotiationHandler {
115+
protected Http2OrHttpHandler() {
116+
super(ApplicationProtocolNames.HTTP_1_1);
117+
}
118+
119+
@Override
120+
protected void configurePipeline(ChannelHandlerContext ctx, String protocol) throws Exception {
121+
if (ApplicationProtocolNames.HTTP_2.equals(protocol)) {
122+
configureDefaultHttp2Pipeline(ctx.pipeline());
123+
} else if (ApplicationProtocolNames.HTTP_1_1.equals(protocol)) {
124+
configureDefaultHttpPipeline(ctx.pipeline());
125+
} else {
126+
throw new IllegalStateException("Unknown application protocol: " + protocol);
127+
}
128+
}
129+
130+
@Override
131+
public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) throws Exception {
132+
super.exceptionCaught(ctx, cause);
133+
Netty4HttpChannel channel = ctx.channel().attr(HTTP_CHANNEL_KEY).get();
134+
if (channel != null) {
135+
if (cause instanceof Error) {
136+
onException(channel, new Exception(cause));
137+
} else {
138+
onException(channel, (Exception) cause);
139+
}
140+
}
141+
}
142+
}
143+
144+
protected SslHttpChannelHandler(final Netty4HttpServerTransport transport, final HttpHandlingSettings handlingSettings) {
145+
super(transport, handlingSettings);
146+
}
147+
148+
@Override
149+
protected void initChannel(Channel ch) throws Exception {
150+
super.initChannel(ch);
151+
152+
final SSLEngine sslEngine = secureTransportSettingsProvider.buildSecureHttpServerEngine(
153+
settings,
154+
SecureNetty4HttpServerTransport.this
155+
).orElseGet(SSLContext.getDefault()::createSSLEngine);
156+
157+
final SslHandler sslHandler = new SslHandler(sslEngine);
158+
ch.pipeline().addFirst("ssl_http", sslHandler);
159+
}
160+
161+
@Override
162+
protected void configurePipeline(Channel ch) {
163+
ch.pipeline().addLast(new Http2OrHttpHandler());
164+
}
165+
}
166+
}

‎modules/transport-netty4/src/main/java/org/opensearch/transport/Netty4ModulePlugin.java

+64
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,14 @@
4646
import org.opensearch.core.xcontent.NamedXContentRegistry;
4747
import org.opensearch.http.HttpServerTransport;
4848
import org.opensearch.http.netty4.Netty4HttpServerTransport;
49+
import org.opensearch.http.netty4.ssl.SecureNetty4HttpServerTransport;
4950
import org.opensearch.plugins.NetworkPlugin;
5051
import org.opensearch.plugins.Plugin;
52+
import org.opensearch.plugins.SecureTransportSettingsProvider;
5153
import org.opensearch.telemetry.tracing.Tracer;
5254
import org.opensearch.threadpool.ThreadPool;
5355
import org.opensearch.transport.netty4.Netty4Transport;
56+
import org.opensearch.transport.netty4.ssl.SecureNetty4ServerTransport;
5457

5558
import java.util.Arrays;
5659
import java.util.Collections;
@@ -61,7 +64,9 @@
6164
public class Netty4ModulePlugin extends Plugin implements NetworkPlugin {
6265

6366
public static final String NETTY_TRANSPORT_NAME = "netty4";
67+
public static final String NETTY_SECURE_TRANSPORT_NAME = "netty4-secure";
6468
public static final String NETTY_HTTP_TRANSPORT_NAME = "netty4";
69+
public static final String NETTY_SECURE_HTTP_TRANSPORT_NAME = "netty4-secure";
6570

6671
private final SetOnce<SharedGroupFactory> groupFactory = new SetOnce<>();
6772

@@ -144,6 +149,65 @@ public Map<String, Supplier<HttpServerTransport>> getHttpTransports(
144149
);
145150
}
146151

152+
@Override
153+
public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
154+
Settings settings,
155+
ThreadPool threadPool,
156+
BigArrays bigArrays,
157+
PageCacheRecycler pageCacheRecycler,
158+
CircuitBreakerService circuitBreakerService,
159+
NamedXContentRegistry xContentRegistry,
160+
NetworkService networkService,
161+
HttpServerTransport.Dispatcher dispatcher,
162+
ClusterSettings clusterSettings,
163+
SecureTransportSettingsProvider secureTransportSettingsProvider,
164+
Tracer tracer
165+
) {
166+
return Collections.singletonMap(
167+
NETTY_SECURE_HTTP_TRANSPORT_NAME,
168+
() -> new SecureNetty4HttpServerTransport(
169+
settings,
170+
networkService,
171+
bigArrays,
172+
threadPool,
173+
xContentRegistry,
174+
dispatcher,
175+
clusterSettings,
176+
getSharedGroupFactory(settings),
177+
secureTransportSettingsProvider,
178+
tracer
179+
)
180+
);
181+
}
182+
183+
@Override
184+
public Map<String, Supplier<Transport>> getSecureTransports(
185+
Settings settings,
186+
ThreadPool threadPool,
187+
PageCacheRecycler pageCacheRecycler,
188+
CircuitBreakerService circuitBreakerService,
189+
NamedWriteableRegistry namedWriteableRegistry,
190+
NetworkService networkService,
191+
SecureTransportSettingsProvider secureTransportSettingsProvider,
192+
Tracer tracer
193+
) {
194+
return Collections.singletonMap(
195+
NETTY_SECURE_TRANSPORT_NAME,
196+
() -> new SecureNetty4ServerTransport(
197+
settings,
198+
Version.CURRENT,
199+
threadPool,
200+
networkService,
201+
pageCacheRecycler,
202+
namedWriteableRegistry,
203+
circuitBreakerService,
204+
getSharedGroupFactory(settings),
205+
secureTransportSettingsProvider,
206+
tracer
207+
)
208+
);
209+
}
210+
147211
SharedGroupFactory getSharedGroupFactory(Settings settings) {
148212
SharedGroupFactory groupFactory = this.groupFactory.get();
149213
if (groupFactory != null) {

‎modules/transport-netty4/src/main/java/org/opensearch/transport/netty4/ssl/DualModeSslHandler.java

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
package org.opensearch.transport.netty4.ssl;
12+
13+
import org.apache.logging.log4j.LogManager;
14+
import org.apache.logging.log4j.Logger;
15+
import org.opensearch.common.settings.Settings;
16+
import org.opensearch.plugins.SecureTransportSettingsProvider;
17+
import org.opensearch.transport.TcpTransport;
18+
19+
import javax.net.ssl.SSLContext;
20+
import javax.net.ssl.SSLEngine;
21+
import javax.net.ssl.SSLException;
22+
23+
import java.nio.charset.StandardCharsets;
24+
import java.security.NoSuchAlgorithmException;
25+
import java.util.List;
26+
27+
import io.netty.buffer.ByteBuf;
28+
import io.netty.buffer.Unpooled;
29+
import io.netty.channel.ChannelFutureListener;
30+
import io.netty.channel.ChannelHandlerContext;
31+
import io.netty.channel.ChannelPipeline;
32+
import io.netty.handler.codec.ByteToMessageDecoder;
33+
import io.netty.handler.ssl.SslHandler;
34+
35+
/**
36+
* Modifies the current pipeline dynamically to enable TLS
37+
*/
38+
public class DualModeSslHandler extends ByteToMessageDecoder {
39+
40+
private static final Logger logger = LogManager.getLogger(DualModeSslHandler.class);
41+
private final Settings settings;
42+
private final SecureTransportSettingsProvider secureTransportSettingsProvider;
43+
private final TcpTransport transport;
44+
private final SslHandler providedSSLHandler;
45+
46+
public DualModeSslHandler(
47+
final Settings settings,
48+
final SecureTransportSettingsProvider secureTransportSettingsProvider,
49+
final TcpTransport transport
50+
) {
51+
this(settings, secureTransportSettingsProvider, transport, null);
52+
}
53+
54+
protected DualModeSslHandler(
55+
final Settings settings,
56+
final SecureTransportSettingsProvider secureTransportSettingsProvider,
57+
final TcpTransport transport,
58+
SslHandler providedSSLHandler
59+
) {
60+
this.settings = settings;
61+
this.secureTransportSettingsProvider = secureTransportSettingsProvider;
62+
this.transport = transport;
63+
this.providedSSLHandler = providedSSLHandler;
64+
}
65+
66+
@Override
67+
protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {
68+
// Will use the first six bytes to detect a protocol.
69+
if (in.readableBytes() < 6) {
70+
return;
71+
}
72+
int offset = in.readerIndex();
73+
if (in.getCharSequence(offset, 6, StandardCharsets.UTF_8).equals(SecureConnectionTestUtil.DUAL_MODE_CLIENT_HELLO_MSG)) {
74+
logger.debug("Received DualSSL Client Hello message");
75+
ByteBuf responseBuffer = Unpooled.buffer(6);
76+
responseBuffer.writeCharSequence(SecureConnectionTestUtil.DUAL_MODE_SERVER_HELLO_MSG, StandardCharsets.UTF_8);
77+
ctx.writeAndFlush(responseBuffer).addListener(ChannelFutureListener.CLOSE);
78+
return;
79+
}
80+
81+
if (SslUtils.isTLS(in)) {
82+
logger.debug("Identified request as SSL request");
83+
enableSsl(ctx);
84+
} else {
85+
logger.debug("Identified request as non SSL request, running in HTTP mode as dual mode is enabled");
86+
ctx.pipeline().remove(this);
87+
}
88+
}
89+
90+
private void enableSsl(ChannelHandlerContext ctx) throws SSLException, NoSuchAlgorithmException {
91+
final SSLEngine sslEngine = secureTransportSettingsProvider.buildSecureServerTransportEngine(settings, transport)
92+
.orElseGet(SSLContext.getDefault()::createSSLEngine);
93+
94+
SslHandler sslHandler;
95+
if (providedSSLHandler != null) {
96+
sslHandler = providedSSLHandler;
97+
} else {
98+
sslHandler = new SslHandler(sslEngine);
99+
}
100+
ChannelPipeline p = ctx.pipeline();
101+
p.addAfter("port_unification_handler", "ssl_server", sslHandler);
102+
p.remove(this);
103+
logger.debug("Removed port unification handler and added SSL handler as incoming request is SSL");
104+
}
105+
}

0 commit comments

Comments
 (0)