-
Notifications
You must be signed in to change notification settings - Fork 281
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Andrey Pleskach <[email protected]> Signed-off-by: Andrey Pleskach <[email protected]>
- Loading branch information
1 parent
0d7af4d
commit a0a407c
Showing
15 changed files
with
723 additions
and
324 deletions.
There are no files selected for viewing
186 changes: 186 additions & 0 deletions
186
src/integrationTest/java/org/opensearch/security/api/SslCertsRestApiIntegrationTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,186 @@ | ||
| /* | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| * | ||
| * The OpenSearch Contributors require contributions made to | ||
| * this file be licensed under the Apache-2.0 license or a | ||
| * compatible open source license. | ||
| * | ||
| * Modifications Copyright OpenSearch Contributors. See | ||
| * GitHub history for details. | ||
| */ | ||
| package org.opensearch.security.api; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.Collection; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
| import java.util.Set; | ||
| import java.util.StringJoiner; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| import com.carrotsearch.randomizedtesting.RandomizedContext; | ||
| import com.google.common.collect.ImmutableList; | ||
| import com.fasterxml.jackson.databind.JsonNode; | ||
| import org.apache.commons.lang3.tuple.Pair; | ||
| import org.junit.Test; | ||
|
|
||
| import org.opensearch.security.dlic.rest.api.Endpoint; | ||
| import org.opensearch.security.dlic.rest.api.ssl.SslCertificatesInfoNodesRequest; | ||
| import org.opensearch.test.framework.certificate.TestCertificates; | ||
| import org.opensearch.test.framework.cluster.LocalOpenSearchCluster; | ||
| import org.opensearch.test.framework.cluster.TestRestClient; | ||
|
|
||
| import static org.hamcrest.CoreMatchers.containsString; | ||
| import static org.hamcrest.CoreMatchers.is; | ||
| import static org.hamcrest.MatcherAssert.assertThat; | ||
| import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.CERTS_INFO_ACTION; | ||
| import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ADMIN_ENABLED; | ||
|
|
||
| public class SslCertsRestApiIntegrationTest extends AbstractApiIntegrationTest { | ||
|
|
||
| final static String REST_API_ADMIN_SSL_INFO = "rest-api-admin-ssl-info"; | ||
|
|
||
| static { | ||
| clusterSettings.put(SECURITY_RESTAPI_ADMIN_ENABLED, true); | ||
| testSecurityConfig.withRestAdminUser(REST_ADMIN_USER, allRestAdminPermissions()) | ||
| .withRestAdminUser(REST_API_ADMIN_SSL_INFO, restAdminPermission(Endpoint.SSL, CERTS_INFO_ACTION)); | ||
| } | ||
|
|
||
| protected String sslCertsPath(String... path) { | ||
| final var fullPath = new StringJoiner("/"); | ||
| fullPath.add(super.apiPath("ssl", "certs")); | ||
| if (path != null) { | ||
| for (final var p : path) { | ||
| fullPath.add(p); | ||
| } | ||
| } | ||
| return fullPath.toString(); | ||
| } | ||
|
|
||
| @Test | ||
| public void forbiddenForRegularUser() throws Exception { | ||
| withUser(NEW_USER, client -> forbidden(() -> client.get(sslCertsPath()))); | ||
| } | ||
|
|
||
| @Test | ||
| public void forbiddenForAdminUser() throws Exception { | ||
| withUser(ADMIN_USER_NAME, client -> forbidden(() -> client.get(sslCertsPath()))); | ||
| } | ||
|
|
||
| @Test | ||
| public void availableForTlsAdmin() throws Exception { | ||
| withUser(ADMIN_USER_NAME, localCluster.getAdminCertificate(), this::verifySSLCertsInfo); | ||
| } | ||
|
|
||
| @Test | ||
| public void availableForRestAdmin() throws Exception { | ||
| withUser(REST_ADMIN_USER, this::verifySSLCertsInfo); | ||
| withUser(REST_API_ADMIN_SSL_INFO, this::verifySSLCertsInfo); | ||
| } | ||
|
|
||
| private void verifySSLCertsInfo(final TestRestClient client) throws Exception { | ||
| assertSSLCertsInfo( | ||
| nodesWithOrder(), | ||
| Set.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE), | ||
| ok(() -> client.get(sslCertsPath())) | ||
| ); | ||
| if (localCluster.nodes().size() > 1) { | ||
| final var randomNodes = randomNodes(); | ||
| final var nodeIds = randomNodes.stream() | ||
| .map(Pair::getRight) | ||
| .map(n -> n.esNode().getNodeEnvironment().nodeId()) | ||
| .collect(Collectors.joining(",")); | ||
| assertSSLCertsInfo( | ||
| randomNodes, | ||
| Set.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE), | ||
| ok(() -> client.get(sslCertsPath(nodeIds))) | ||
| ); | ||
| } | ||
| final var randomCertType = randomFrom( | ||
| List.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE) | ||
| ); | ||
| assertSSLCertsInfo( | ||
| nodesWithOrder(), | ||
| Set.of(randomCertType), | ||
| ok(() -> client.get(String.format("%s?cert_type=%s", sslCertsPath(), randomCertType))) | ||
| ); | ||
|
|
||
| } | ||
|
|
||
| private void assertSSLCertsInfo( | ||
| final List<Pair<Integer, LocalOpenSearchCluster.Node>> expectedNode, | ||
| final Set<String> expectedCertTypes, | ||
| final TestRestClient.HttpResponse response | ||
| ) { | ||
| final var body = response.bodyAsJsonNode(); | ||
| final var prettyStringBody = body.toPrettyString(); | ||
|
|
||
| final var _nodes = body.get("_nodes"); | ||
| assertThat(prettyStringBody, _nodes.get("total").asInt(), is(expectedNode.size())); | ||
| assertThat(prettyStringBody, _nodes.get("successful").asInt(), is(expectedNode.size())); | ||
| assertThat(prettyStringBody, _nodes.get("failed").asInt(), is(0)); | ||
| assertThat(prettyStringBody, body.get("cluster_name").asText(), is(localCluster.getClusterName())); | ||
|
|
||
| final var nodes = body.get("nodes"); | ||
|
|
||
| for (final var nodeWithOrder : expectedNode) { | ||
| final var esNode = nodeWithOrder.getRight().esNode(); | ||
| final var node = nodes.get(esNode.getNodeEnvironment().nodeId()); | ||
| assertThat(prettyStringBody, node.get("name").asText(), is(nodeWithOrder.getRight().getNodeName())); | ||
| if (expectedCertTypes.contains(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE)) { | ||
| assertThat(prettyStringBody, node.has("http_certificates")); | ||
| assertThat(prettyStringBody, node.get("http_certificates").isArray()); | ||
| assertThat(prettyStringBody, node.get("http_certificates").size(), is(1)); | ||
| verifyCertsJson(nodeWithOrder.getLeft(), node.get("http_certificates").get(0)); | ||
| } | ||
| if (expectedCertTypes.contains(SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE)) { | ||
| assertThat(prettyStringBody, node.has("transport_certificates")); | ||
| assertThat(prettyStringBody, node.get("transport_certificates").isArray()); | ||
| assertThat(prettyStringBody, node.get("transport_certificates").size(), is(1)); | ||
| verifyCertsJson(nodeWithOrder.getLeft(), node.get("transport_certificates").get(0)); | ||
| } | ||
| } | ||
|
|
||
| } | ||
|
|
||
| private void verifyCertsJson(final int nodeNumber, final JsonNode jsonNode) { | ||
| assertThat(jsonNode.toPrettyString(), jsonNode.get("issuer_dn").asText(), is(TestCertificates.CA_SUBJECT)); | ||
| assertThat( | ||
| jsonNode.toPrettyString(), | ||
| jsonNode.get("subject_dn").asText(), | ||
| is(String.format(TestCertificates.NODE_SUBJECT_PATTERN, nodeNumber)) | ||
| ); | ||
| assertThat( | ||
| jsonNode.toPrettyString(), | ||
| jsonNode.get("san").asText(), | ||
| containsString(String.format("node-%s.example.com", nodeNumber)) | ||
| ); | ||
| assertThat(jsonNode.toPrettyString(), jsonNode.has("not_before")); | ||
| assertThat(jsonNode.toPrettyString(), jsonNode.has("not_after")); | ||
| } | ||
|
|
||
| private List<Pair<Integer, LocalOpenSearchCluster.Node>> randomNodes() { | ||
| final var nodesWithOrder = nodesWithOrder(); | ||
| int leaveElements = randomIntBetween(1, nodesWithOrder.size() - 1); | ||
| return randomSubsetOf(leaveElements, nodesWithOrder); | ||
| } | ||
|
|
||
| private List<Pair<Integer, LocalOpenSearchCluster.Node>> nodesWithOrder() { | ||
| final var list = ImmutableList.<Pair<Integer, LocalOpenSearchCluster.Node>>builder(); | ||
| for (int i = 0; i < localCluster.nodes().size(); i++) | ||
| list.add(Pair.of(i, localCluster.nodes().get(i))); | ||
| return list.build(); | ||
| } | ||
|
|
||
| public <T> List<T> randomSubsetOf(int size, Collection<T> collection) { | ||
| if (size > collection.size()) { | ||
| throw new IllegalArgumentException( | ||
| "Can't pick " + size + " random objects from a collection of " + collection.size() + " objects" | ||
| ); | ||
| } | ||
| List<T> tempList = new ArrayList<>(collection); | ||
| Collections.shuffle(tempList, RandomizedContext.current().getRandom()); | ||
| return tempList.subList(0, size); | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.