Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Format SSLConfigConstants.java and fix typos #5145

Merged

Conversation

finnegancarroll
Copy link
Contributor

Description

Some *mostly non functional formatting changes to SSLConfigConstants.

  • Sort global setting configs by transport type.
  • Replace hard coded setting prefixes with static constants.
  • Fix typo in constant name SSECURITY_SSL_HTTP_CRL_FILE -> SECURITY_SSL_HTTP_CRL_FILE
  • SSL_TRANSPORT_CLIENT_PREFIX has a typo and is set as plugins.security.ssl.transportclient. but should read ...transport.client. to match documented settings.
    Within the plugin SSL_TRANSPORT_CLIENT_PREFIX is only referenced by CertType and TRANSPORT_CLIENT.sslConfigPrefix() is never invoked so SSL_TRANSPORT_CLIENT_PREFIX is effectively unused.

The last two changes could break compatibility if some other component is referencing these public variables.
Searching the project on github I don't see any references and 3.0 release is maybe a good opportunity to make these changes.

Issues Resolved

N/A

Testing

N/A

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Replace hard coded setting prefixes with static constants.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…used in plugin.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
…TTP_CRL_FILE.

Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
@finnegancarroll finnegancarroll marked this pull request as ready for review February 27, 2025 18:13
@finnegancarroll finnegancarroll changed the title Format SSLConfigConstants.java and fix non functional typos Format SSLConfigConstants.java and fix typos Feb 27, 2025
@cwperks
Copy link
Member

cwperks commented Feb 27, 2025

TransportClient was removed in OS 2.0: opensearch-project/OpenSearch#1669

Looks like we still have lingering references in this repo that could be removed. Thank you for this PR @finnegancarroll!

Signed-off-by: Finn Carroll <carrofin@amazon.com>
@finnegancarroll
Copy link
Contributor Author

TransportClient was removed in OS 2.0: opensearch-project/OpenSearch#1669

I think SSL_TRANSPORT_CLIENT_PREFIX is still needed to support security settings of the transport layer when acting as a client during node-to-node communication.

@finnegancarroll
Copy link
Contributor Author

finnegancarroll commented Feb 27, 2025

While this failed test is asserting on a bunch of settings touched in this PR I think it's just unrelated flakiness due to the stack trace? It looks like maybe a race condition writing a config file in test setup.

I don't see failures running the same locally. Will try rerunning.

SecuritySettingsConfigurerTests > testBuildSecurityConfigMap FAILED
    java.nio.file.NoSuchFileException: /home/runner/work/security/security/build/testrun/citest/test-conf/opensearch-security/internal_users.yml
        at __randomizedtesting.SeedInfo.seed([D627558F3B581E7F:5BD917482C9E58EC]:0)
        at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:92)
        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
        at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:261)
        at java.base/java.nio.file.spi.FileSystemProvider.newOutputStream(FileSystemProvider.java:482)
        at java.base/java.nio.file.Files.newOutputStream(Files.java:228)
        at java.base/java.nio.file.Files.write(Files.java:3574)
        at org.opensearch.security.tools.democonfig.SecuritySettingsConfigurerTests.setUpInternalUsersYML(SecuritySettingsConfigurerTests.java:442)
        at org.opensearch.security.tools.democonfig.SecuritySettingsConfigurerTests.setUp(SecuritySettingsConfigurerTests.java:84)

Copy link

codecov bot commented Feb 27, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 0.00%. Comparing base (01dd98c) to head (d53752a).
Report is 5 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main   #5145       +/-   ##
==========================================
- Coverage   71.67%       0   -71.68%     
==========================================
  Files         337       0      -337     
  Lines       22783       0    -22783     
  Branches     3604       0     -3604     
==========================================
- Hits        16329       0    -16329     
+ Misses       4653       0     -4653     
+ Partials     1801       0     -1801     

see 337 files with indirect coverage changes

🚀 New features to boost your workflow:
  • Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@cwperks
Copy link
Member

cwperks commented Feb 27, 2025

@willyborankin Can you take a look as well? If there are effectively no usages of SSL_TRANSPORT_CLIENT_PREFIX then is that something that can be removed?

Signed-off-by: Finn Carroll <carrofin@amazon.com>
Signed-off-by: Finn Carroll <carrofin@amazon.com>
@willyborankin
Copy link
Collaborator

@willyborankin Can you take a look as well? If there are effectively no usages of SSL_TRANSPORT_CLIENT_PREFIX then is that something that can be removed?

We set up the client for extended SSL configuration at the transport layer.

@DarshitChanpura DarshitChanpura added the backport 2.x backport to 2.x branch label Mar 8, 2025
@willyborankin willyborankin merged commit 487fb05 into opensearch-project:main Mar 10, 2025
39 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Mar 10, 2025
Signed-off-by: Finn Carroll <carrofin@amazon.com>
Co-authored-by: Darshit Chanpura <dchanp@amazon.com>
(cherry picked from commit 487fb05)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x backport to 2.x branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants