Skip to content

Commit cce3476

Browse files
retareta
committed
[FEATURE] Improve built-in secure transports support
Signed-off-by: Andriy Redko <andriy.redko@aiven.io>
1 parent b0d26dd commit cce3476

9 files changed

+147
-199
lines changed

‎src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java

+10-12
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@
107107
import org.opensearch.extensions.ExtensionsManager;
108108
import org.opensearch.http.HttpServerTransport;
109109
import org.opensearch.http.HttpServerTransport.Dispatcher;
110+
import org.opensearch.http.netty4.ssl.SecureNetty4HttpServerTransport;
110111
import org.opensearch.identity.Subject;
111112
import org.opensearch.identity.noop.NoopSubject;
112113
import org.opensearch.index.IndexModule;
@@ -117,6 +118,7 @@
117118
import org.opensearch.plugins.ExtensionAwarePlugin;
118119
import org.opensearch.plugins.IdentityPlugin;
119120
import org.opensearch.plugins.MapperPlugin;
121+
import org.opensearch.plugins.SecureHttpTransportSettingsProvider;
120122
import org.opensearch.plugins.SecureSettingsFactory;
121123
import org.opensearch.plugins.SecureTransportSettingsProvider;
122124
import org.opensearch.repositories.RepositoriesService;
@@ -156,7 +158,6 @@
156158
import org.opensearch.security.filter.SecurityFilter;
157159
import org.opensearch.security.filter.SecurityRestFilter;
158160
import org.opensearch.security.http.NonSslHttpServerTransport;
159-
import org.opensearch.security.http.SecureHttpServerTransport;
160161
import org.opensearch.security.http.XFFResolver;
161162
import org.opensearch.security.identity.SecurityTokenManager;
162163
import org.opensearch.security.privileges.PrivilegesEvaluator;
@@ -239,7 +240,6 @@ public final class OpenSearchSecurityPlugin extends OpenSearchSecuritySSLPlugin
239240
private volatile PrivilegesEvaluator evaluator;
240241
private volatile UserService userService;
241242
private volatile RestLayerPrivilegesEvaluator restLayerEvaluator;
242-
private volatile ThreadPool threadPool;
243243
private volatile ConfigurationRepository cr;
244244
private volatile AdminDNs adminDns;
245245
private volatile ClusterService cs;
@@ -927,7 +927,7 @@ public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
927927
NetworkService networkService,
928928
Dispatcher dispatcher,
929929
ClusterSettings clusterSettings,
930-
SecureTransportSettingsProvider secureTransportSettingsProvider,
930+
SecureHttpTransportSettingsProvider secureHttpTransportSettingsProvider,
931931
Tracer tracer
932932
) {
933933

@@ -942,7 +942,7 @@ public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
942942
networkService,
943943
dispatcher,
944944
clusterSettings,
945-
secureTransportSettingsProvider,
945+
secureHttpTransportSettingsProvider,
946946
tracer
947947
);
948948
}
@@ -958,7 +958,7 @@ public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
958958
evaluateSslExceptionHandler()
959959
);
960960
// TODO close odshst
961-
final SecureHttpServerTransport odshst = new SecureHttpServerTransport(
961+
final SecureNetty4HttpServerTransport odshst = new SecureNetty4HttpServerTransport(
962962
migrateSettings(settings),
963963
networkService,
964964
bigArrays,
@@ -967,9 +967,8 @@ public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
967967
validatingDispatcher,
968968
clusterSettings,
969969
sharedGroupFactory,
970-
secureTransportSettingsProvider,
971-
tracer,
972-
securityRestHandler
970+
secureHttpTransportSettingsProvider,
971+
tracer
973972
);
974973

975974
return Collections.singletonMap("org.opensearch.security.http.SecurityHttpServerTransport", () -> odshst);
@@ -985,9 +984,8 @@ public Map<String, Supplier<HttpServerTransport>> getSecureHttpTransports(
985984
dispatcher,
986985
clusterSettings,
987986
sharedGroupFactory,
988-
secureTransportSettingsProvider,
989-
tracer,
990-
securityRestHandler
987+
secureHttpTransportSettingsProvider,
988+
tracer
991989
)
992990
);
993991
}
@@ -2032,7 +2030,7 @@ public SecurityTokenManager getTokenManager() {
20322030

20332031
@Override
20342032
public Optional<SecureSettingsFactory> getSecureSettingFactory(Settings settings) {
2035-
return Optional.of(new OpenSearchSecureSettingsFactory(settings, sks, sslExceptionHandler));
2033+
return Optional.of(new OpenSearchSecureSettingsFactory(threadPool, sks, sslExceptionHandler, securityRestHandler));
20362034
}
20372035

20382036
public static class GuiceHolder implements LifecycleComponent {

‎src/main/java/org/opensearch/security/filter/SecurityRestFilter.java

+10-10
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@
5555
import org.opensearch.security.privileges.RestLayerPrivilegesEvaluator;
5656
import org.opensearch.security.securityconf.impl.AllowlistingSettings;
5757
import org.opensearch.security.securityconf.impl.WhitelistingSettings;
58+
import org.opensearch.security.ssl.http.netty.Netty4HttpRequestHeaderVerifier;
5859
import org.opensearch.security.ssl.transport.PrincipalExtractor;
5960
import org.opensearch.security.ssl.util.ExceptionUtils;
6061
import org.opensearch.security.ssl.util.SSLRequestHelper;
@@ -69,10 +70,6 @@
6970

7071
import static org.opensearch.security.OpenSearchSecurityPlugin.LEGACY_OPENDISTRO_PREFIX;
7172
import static org.opensearch.security.OpenSearchSecurityPlugin.PLUGINS_PREFIX;
72-
import static org.opensearch.security.http.SecureHttpServerTransport.CONTEXT_TO_RESTORE;
73-
import static org.opensearch.security.http.SecureHttpServerTransport.EARLY_RESPONSE;
74-
import static org.opensearch.security.http.SecureHttpServerTransport.IS_AUTHENTICATED;
75-
import static org.opensearch.security.http.SecureHttpServerTransport.UNCONSUMED_PARAMS;
7673

7774
public class SecurityRestFilter {
7875

@@ -128,15 +125,18 @@ public AuthczRestHandler(RestHandler original, AdminDNs adminDNs) {
128125

129126
@Override
130127
public void handleRequest(RestRequest request, RestChannel channel, NodeClient client) throws Exception {
131-
final Optional<SecurityResponse> maybeSavedResponse = NettyAttribute.popFrom(request, EARLY_RESPONSE);
128+
final Optional<SecurityResponse> maybeSavedResponse = NettyAttribute.popFrom(
129+
request,
130+
Netty4HttpRequestHeaderVerifier.EARLY_RESPONSE
131+
);
132132
if (maybeSavedResponse.isPresent()) {
133-
NettyAttribute.clearAttribute(request, CONTEXT_TO_RESTORE);
134-
NettyAttribute.clearAttribute(request, IS_AUTHENTICATED);
133+
NettyAttribute.clearAttribute(request, Netty4HttpRequestHeaderVerifier.CONTEXT_TO_RESTORE);
134+
NettyAttribute.clearAttribute(request, Netty4HttpRequestHeaderVerifier.IS_AUTHENTICATED);
135135
channel.sendResponse(maybeSavedResponse.get().asRestResponse());
136136
return;
137137
}
138138

139-
NettyAttribute.popFrom(request, CONTEXT_TO_RESTORE).ifPresent(storedContext -> {
139+
NettyAttribute.popFrom(request, Netty4HttpRequestHeaderVerifier.CONTEXT_TO_RESTORE).ifPresent(storedContext -> {
140140
// X_OPAQUE_ID will be overritten on restore - save to apply after restoring the saved context
141141
final String xOpaqueId = threadContext.getHeader(Task.X_OPAQUE_ID);
142142
storedContext.restore();
@@ -145,7 +145,7 @@ public void handleRequest(RestRequest request, RestChannel channel, NodeClient c
145145
}
146146
});
147147

148-
NettyAttribute.popFrom(request, UNCONSUMED_PARAMS).ifPresent(unconsumedParams -> {
148+
NettyAttribute.popFrom(request, Netty4HttpRequestHeaderVerifier.UNCONSUMED_PARAMS).ifPresent(unconsumedParams -> {
149149
for (String unconsumedParam : unconsumedParams) {
150150
// Consume the parameter on the RestRequest
151151
request.param(unconsumedParam);
@@ -155,7 +155,7 @@ public void handleRequest(RestRequest request, RestChannel channel, NodeClient c
155155
final SecurityRequestChannel requestChannel = SecurityRequestFactory.from(request, channel);
156156

157157
// Authenticate request
158-
if (!NettyAttribute.popFrom(request, IS_AUTHENTICATED).orElse(false)) {
158+
if (!NettyAttribute.popFrom(request, Netty4HttpRequestHeaderVerifier.IS_AUTHENTICATED).orElse(false)) {
159159
// we aren't authenticated so we should skip this step
160160
checkAndAuthenticateRequest(requestChannel);
161161
}

‎src/main/java/org/opensearch/security/http/NonSslHttpServerTransport.java

+4-23
Original file line numberDiff line numberDiff line change
@@ -34,22 +34,15 @@
3434
import org.opensearch.http.HttpHandlingSettings;
3535
import org.opensearch.http.netty4.Netty4HttpServerTransport;
3636
import org.opensearch.http.netty4.ssl.SecureNetty4HttpServerTransport;
37-
import org.opensearch.plugins.SecureTransportSettingsProvider;
38-
import org.opensearch.security.filter.SecurityRestFilter;
39-
import org.opensearch.security.ssl.http.netty.Netty4ConditionalDecompressor;
40-
import org.opensearch.security.ssl.http.netty.Netty4HttpRequestHeaderVerifier;
37+
import org.opensearch.plugins.SecureHttpTransportSettingsProvider;
4138
import org.opensearch.telemetry.tracing.Tracer;
4239
import org.opensearch.threadpool.ThreadPool;
4340
import org.opensearch.transport.SharedGroupFactory;
4441

4542
import io.netty.channel.Channel;
4643
import io.netty.channel.ChannelHandler;
47-
import io.netty.channel.ChannelInboundHandlerAdapter;
4844

4945
public class NonSslHttpServerTransport extends SecureNetty4HttpServerTransport {
50-
51-
private final ChannelInboundHandlerAdapter headerVerifier;
52-
5346
public NonSslHttpServerTransport(
5447
final Settings settings,
5548
final NetworkService networkService,
@@ -59,9 +52,8 @@ public NonSslHttpServerTransport(
5952
final Dispatcher dispatcher,
6053
final ClusterSettings clusterSettings,
6154
final SharedGroupFactory sharedGroupFactory,
62-
final SecureTransportSettingsProvider secureTransportSettingsProvider,
63-
final Tracer tracer,
64-
final SecurityRestFilter restFilter
55+
final SecureHttpTransportSettingsProvider secureHttpTransportSettingsProvider,
56+
final Tracer tracer
6557
) {
6658
super(
6759
settings,
@@ -72,10 +64,9 @@ public NonSslHttpServerTransport(
7264
dispatcher,
7365
clusterSettings,
7466
sharedGroupFactory,
75-
secureTransportSettingsProvider,
67+
secureHttpTransportSettingsProvider,
7668
tracer
7769
);
78-
headerVerifier = new Netty4HttpRequestHeaderVerifier(restFilter, threadPool, settings);
7970
}
8071

8172
@Override
@@ -94,14 +85,4 @@ protected void initChannel(Channel ch) throws Exception {
9485
super.initChannel(ch);
9586
}
9687
}
97-
98-
@Override
99-
protected ChannelInboundHandlerAdapter createHeaderVerifier() {
100-
return headerVerifier;
101-
}
102-
103-
@Override
104-
protected ChannelInboundHandlerAdapter createDecompressor() {
105-
return new Netty4ConditionalDecompressor();
106-
}
10788
}

‎src/main/java/org/opensearch/security/http/SecureHttpServerTransport.java

-101
This file was deleted.

0 commit comments

Comments
 (0)