Skip to content

Commit

Permalink
Merge branch '2.x' into backport/backport-2993-to-2.x
Browse files Browse the repository at this point in the history
  • Loading branch information
@cwperks
cwperks authored Jul 31, 2023
2 parents c551a2d + 46d1804 commit b53662a
Show file tree
Hide file tree
Showing 19 changed files with 618 additions and 291 deletions.
11 changes: 7 additions & 4 deletions src/main/java/com/amazon/dlic/auth/ldap/backend/LDAPAuthorizationBackend.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,9 @@
import org.opensearch.security.user.AuthCredentials;
import org.opensearch.security.user.User;

import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD;
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD;

public class LDAPAuthorizationBackend implements AuthorizationBackend {

private static final AtomicInteger CONNECTION_COUNTER = new AtomicInteger();
Expand Down Expand Up @@ -580,7 +583,7 @@ private static void configureSSL(final ConnectionConfig config, final Settings s
} else {
final KeyStore trustStore = PemKeyReader.loadKeyStore(
PemKeyReader.resolve(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_FILEPATH, settings, configPath, !trustAll),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD.getSetting(settings),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_TYPE)
);

Expand All @@ -594,11 +597,11 @@ private static void configureSSL(final ConnectionConfig config, final Settings s
configPath,
enableClientAuth
),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(settings, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_TYPE)
);
final String keyStorePassword = settings.get(
SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD,
final String keyStorePassword = SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(
settings,
SSLConfigConstants.DEFAULT_STORE_PASSWORD
);

Expand Down
12 changes: 6 additions & 6 deletions src/main/java/com/amazon/dlic/util/SettingsBasedSSLConfigurator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@
import org.opensearch.security.ssl.util.SSLConfigConstants;
import org.opensearch.security.support.PemKeyReader;

import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD;
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD;

public class SettingsBasedSSLConfigurator {
private static final Logger log = LogManager.getLogger(SettingsBasedSSLConfigurator.class);

Expand Down Expand Up @@ -328,7 +331,7 @@ private void initFromKeyStore() throws SSLConfigException {
configPath,
!isTrustAllEnabled()
),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD.getSetting(settings),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_TYPE)
);
} catch (Exception e) {
Expand All @@ -350,7 +353,7 @@ private void initFromKeyStore() throws SSLConfigException {
configPath,
enableSslClientAuth
),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(settings, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_TYPE)
);
} catch (Exception e) {
Expand All @@ -360,10 +363,7 @@ private void initFromKeyStore() throws SSLConfigException {
);
}

String keyStorePassword = settings.get(
SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD,
SSLConfigConstants.DEFAULT_STORE_PASSWORD
);
String keyStorePassword = SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(settings, SSLConfigConstants.DEFAULT_STORE_PASSWORD);
effectiveKeyPassword = keyStorePassword == null || keyStorePassword.isEmpty() ? null : keyStorePassword.toCharArray();
effectiveKeyAlias = getSetting(CERT_ALIAS);

Expand Down
14 changes: 3 additions & 11 deletions src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ public final class OpenSearchSecurityPlugin extends OpenSearchSecuritySSLPlugin
private volatile ConfigurationRepository cr;
private volatile AdminDNs adminDns;
private volatile ClusterService cs;
private static volatile DiscoveryNode localNode;
private volatile AtomicReference<DiscoveryNode> localNode = new AtomicReference<>();
private volatile AuditLog auditLog;
private volatile BackendRegistry backendRegistry;
private volatile SslExceptionHandler sslExceptionHandler;
Expand Down Expand Up @@ -772,7 +772,7 @@ public <T extends TransportResponse> void sendRequest(
TransportRequestOptions options,
TransportResponseHandler<T> handler
) {
si.sendRequestDecorate(sender, connection, action, request, options, handler);
si.sendRequestDecorate(sender, connection, action, request, options, handler, localNode.get());
}
};
}
Expand Down Expand Up @@ -1797,7 +1797,7 @@ public void onNodeStarted(DiscoveryNode localNode) {
if (!SSLConfig.isSslOnlyMode() && !client && !disabled) {
cr.initOnNodeStart();
}
this.localNode = localNode;
this.localNode.set(localNode);
final Set<ModuleInfo> securityModules = ReflectionHelper.getModulesLoaded();
log.info("{} OpenSearch Security modules loaded so far: {}", securityModules.size(), securityModules);
}
Expand Down Expand Up @@ -1877,14 +1877,6 @@ private static String handleKeyword(final String field) {
return field;
}

public static DiscoveryNode getLocalNode() {
return localNode;
}

public static void setLocalNode(DiscoveryNode node) {
localNode = node;
}

public static class GuiceHolder implements LifecycleComponent {

private static RepositoriesService repositoriesService;
Expand Down
11 changes: 7 additions & 4 deletions src/main/java/org/opensearch/security/auditlog/sink/ExternalOpenSearchSink.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@
import org.opensearch.security.support.ConfigConstants;
import org.opensearch.security.support.PemKeyReader;

import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD;
import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD;

public final class ExternalOpenSearchSink extends AuditLogSink {

private static final List<String> DEFAULT_TLS_PROTOCOLS = Arrays.asList(new String[] { "TLSv1.2", "TLSv1.1" });
Expand Down Expand Up @@ -169,7 +172,7 @@ public ExternalOpenSearchSink(
} else {
final KeyStore trustStore = PemKeyReader.loadKeyStore(
PemKeyReader.resolve(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_FILEPATH, settings, configPath, true),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD.getSetting(settings),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_TYPE)
);

Expand All @@ -181,11 +184,11 @@ public ExternalOpenSearchSink(
configPath,
enableSslClientAuth
),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(settings, SSLConfigConstants.DEFAULT_STORE_PASSWORD),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_TYPE)
);
final String keyStorePassword = settings.get(
SSLConfigConstants.SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD,
final String keyStorePassword = SECURITY_SSL_TRANSPORT_KEYSTORE_PASSWORD.getSetting(
settings,
SSLConfigConstants.DEFAULT_STORE_PASSWORD
);
effectiveKeyPassword = keyStorePassword == null || keyStorePassword.isEmpty() ? null : keyStorePassword.toCharArray();
Expand Down
7 changes: 3 additions & 4 deletions src/main/java/org/opensearch/security/auditlog/sink/WebhookSink.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@
import org.opensearch.security.support.ConfigConstants;
import org.opensearch.security.support.PemKeyReader;

import static org.opensearch.security.ssl.SecureSSLSettings.SSLSetting.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD;

public class WebhookSink extends AuditLogSink {

/* HttpClient is thread safe */
Expand Down Expand Up @@ -339,10 +341,7 @@ public KeyStore run() {
configPath,
false
),
settings.get(
SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD,
SSLConfigConstants.DEFAULT_STORE_PASSWORD
),
SECURITY_SSL_TRANSPORT_TRUSTSTORE_PASSWORD.getSetting(settings),
settings.get(SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_TYPE)
);
}
Expand Down
25 changes: 25 additions & 0 deletions src/main/java/org/opensearch/security/configuration/DlsFlsFilterLeafReader.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
import org.apache.lucene.index.SortedNumericDocValues;
import org.apache.lucene.index.SortedSetDocValues;
import org.apache.lucene.index.StoredFieldVisitor;
import org.apache.lucene.index.StoredFields;
import org.apache.lucene.index.TermState;
import org.apache.lucene.index.Terms;
import org.apache.lucene.index.TermsEnum;
Expand Down Expand Up @@ -473,6 +474,24 @@ public void close() throws IOException {
}
}

private class DlsFlsStoredFields extends StoredFields {
private final StoredFields in;

public DlsFlsStoredFields(StoredFields storedFields) {
this.in = storedFields;
}

@Override
public void document(final int docID, StoredFieldVisitor visitor) throws IOException {
visitor = getDlsFlsVisitor(visitor);
try {
in.document(docID, visitor);
} finally {
finishVisitor(visitor);
}
}
}

@Override
protected StoredFieldsReader doGetSequentialStoredFieldsReader(final StoredFieldsReader reader) {
return new DlsFlsStoredFieldsReader(reader);
Expand Down Expand Up @@ -1284,6 +1303,12 @@ public TermState termState() throws IOException {

}

@Override
public StoredFields storedFields() throws IOException {
ensureOpen();
return new DlsFlsStoredFields(in.storedFields());
}

private String getRuntimeActionName() {
return (String) threadContext.getTransient(ConfigConstants.OPENDISTRO_SECURITY_ACTION_NAME);
}
Expand Down
Loading

0 comments on commit b53662a

Please sign in to comment.