Skip to content

Commit da520a0

Browse files
cwperkscwperks
authored
Replace deprecated SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION setting in tests (#5746)
Signed-off-by: Craig Perkins <[email protected]>
1 parent 5e5f608 commit da520a0

File tree

10 files changed

+48
-71
lines changed

10 files changed

+48
-71
lines changed

‎bwc-test/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ def String extractVersion(versionStr) {
138138
node.setting("plugins.security.ssl.transport.pemcert_filepath", "esnode.pem")
139139
node.setting("plugins.security.ssl.transport.pemkey_filepath", "esnode-key.pem")
140140
node.setting("plugins.security.ssl.transport.pemtrustedcas_filepath", "root-ca.pem")
141-
node.setting("plugins.security.ssl.transport.enforce_hostname_verification", "false")
141+
node.setting("transport.ssl.enforce_hostname_verification", "false")
142142
node.setting("plugins.security.ssl.http.enabled", "true")
143143
node.setting("plugins.security.ssl.http.pemcert_filepath", "esnode.pem")
144144
node.setting("plugins.security.ssl.http.pemkey_filepath", "esnode-key.pem")

‎src/integrationTest/java/org/opensearch/security/TlsHostnameVerificationTests.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,14 @@
1717
import org.junit.Test;
1818
import org.junit.runner.RunWith;
1919

20-
import org.opensearch.security.ssl.util.SSLConfigConstants;
2120
import org.opensearch.security.support.ConfigConstants;
2221
import org.opensearch.test.framework.certificate.TestCertificates;
2322
import org.opensearch.test.framework.cluster.ClusterManager;
2423
import org.opensearch.test.framework.cluster.LocalCluster;
2524
import org.opensearch.test.framework.log.LogsRule;
2625

26+
import static org.opensearch.common.network.NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY;
27+
2728
@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class)
2829
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
2930
public class TlsHostnameVerificationTests {
@@ -34,9 +35,7 @@ public class TlsHostnameVerificationTests {
3435
public LocalCluster.Builder clusterBuilder = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
3536
.anonymousAuth(false)
3637
.loadConfigurationIntoIndex(false)
37-
.nodeSettings(
38-
Map.of(ConfigConstants.SECURITY_SSL_ONLY, true, SSLConfigConstants.SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, true)
39-
)
38+
.nodeSettings(Map.of(ConfigConstants.SECURITY_SSL_ONLY, true, TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, true))
4039
.sslOnly(true);
4140

4241
@Test

‎src/main/java/org/opensearch/security/ssl/OpenSearchSecuritySSLPlugin.java‎

Lines changed: 15 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818
package org.opensearch.security.ssl;
1919

2020
import java.nio.file.Path;
21-
import java.security.AccessController;
22-
import java.security.PrivilegedAction;
2321
import java.util.ArrayList;
2422
import java.util.Collection;
2523
import java.util.Collections;
@@ -41,7 +39,6 @@
4139
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
4240
import org.opensearch.cluster.node.DiscoveryNodes;
4341
import org.opensearch.cluster.service.ClusterService;
44-
import org.opensearch.common.Booleans;
4542
import org.opensearch.common.network.NetworkModule;
4643
import org.opensearch.common.network.NetworkService;
4744
import org.opensearch.common.settings.ClusterSettings;
@@ -71,6 +68,7 @@
7168
import org.opensearch.rest.RestController;
7269
import org.opensearch.rest.RestHandler;
7370
import org.opensearch.script.ScriptService;
71+
import org.opensearch.secure_sm.AccessController;
7472
import org.opensearch.security.DefaultObjectMapper;
7573
import org.opensearch.security.NonValidatingObjectMapper;
7674
import org.opensearch.security.filter.SecurityRestFilter;
@@ -94,6 +92,7 @@
9492
import io.netty.handler.ssl.OpenSsl;
9593
import io.netty.util.internal.PlatformDependent;
9694

95+
import static org.opensearch.common.network.NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY;
9796
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_CLIENTAUTH_MODE;
9897
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_ENABLED;
9998
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_ENABLED_CIPHERS;
@@ -104,11 +103,12 @@
104103
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_PEMKEY_PASSWORD;
105104
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_PEMTRUSTEDCAS_FILEPATH;
106105
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_AUX_TRUSTSTORE_FILEPATH;
106+
import static org.opensearch.security.ssl.util.SSLConfigConstants.SECURITY_SSL_TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY;
107107

108108
//For ES5 this class has only effect when SSL only plugin is installed
109109
public class OpenSearchSecuritySSLPlugin extends Plugin implements SystemIndexPlugin, NetworkPlugin {
110110
private static final Setting<Boolean> SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION = Setting.boolSetting(
111-
SSLConfigConstants.SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION,
111+
SECURITY_SSL_TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY,
112112
true,
113113
Property.NodeScope,
114114
Property.Filtered,
@@ -123,10 +123,6 @@ public class OpenSearchSecuritySSLPlugin extends Plugin implements SystemIndexPl
123123
Property.Deprecated
124124
);
125125

126-
private static boolean USE_NETTY_DEFAULT_ALLOCATOR = Booleans.parseBoolean(
127-
System.getProperty("opensearch.unsafe.use_netty_default_allocator"),
128-
false
129-
);
130126
protected final Logger log = LogManager.getLogger(this.getClass());
131127
public static final String CLIENT_TYPE = "client.type";
132128
protected final boolean client;
@@ -158,14 +154,7 @@ protected OpenSearchSecuritySSLPlugin(final Settings settings, final Path config
158154
this.configPath = null;
159155
SSLConfig = new SSLConfig(false, false);
160156

161-
AccessController.doPrivileged(new PrivilegedAction<Object>() {
162-
@Override
163-
public Object run() {
164-
System.setProperty("opensearch.set.netty.runtime.available.processors", "false");
165-
return null;
166-
}
167-
});
168-
157+
AccessController.doPrivileged(() -> System.setProperty("opensearch.set.netty.runtime.available.processors", "false"));
169158
return;
170159
}
171160
SSLConfig = new SSLConfig(settings);
@@ -198,13 +187,9 @@ public Object run() {
198187
sm.checkPermission(new SpecialPermission());
199188
}
200189

201-
AccessController.doPrivileged(new PrivilegedAction<Object>() {
202-
@Override
203-
public Object run() {
204-
System.setProperty(SSLConfigConstants.JDK_TLS_REJECT_CLIENT_INITIATED_RENEGOTIATION, "true");
205-
return null;
206-
}
207-
});
190+
AccessController.doPrivileged(
191+
() -> System.setProperty(SSLConfigConstants.JDK_TLS_REJECT_CLIENT_INITIATED_RENEGOTIATION, "true")
192+
);
208193
log.debug(
209194
"Client side initiated TLS renegotiation forcibly disabled. This can prevent DoS attacks. (jdk.tls.rejectClientInitiatedRenegotiation set to true)."
210195
);
@@ -213,21 +198,11 @@ public Object run() {
213198
}
214199
}
215200

216-
final SecurityManager sm = System.getSecurityManager();
217-
218-
if (sm != null) {
219-
sm.checkPermission(new SpecialPermission());
220-
}
221-
222201
// TODO check initialize native netty open ssl libs still neccessary
223-
AccessController.doPrivileged(new PrivilegedAction<Object>() {
224-
@Override
225-
public Object run() {
226-
System.setProperty("opensearch.set.netty.runtime.available.processors", "false");
227-
PlatformDependent.newFixedMpscQueue(1);
228-
OpenSsl.isAvailable();
229-
return null;
230-
}
202+
AccessController.doPrivileged(() -> {
203+
System.setProperty("opensearch.set.netty.runtime.available.processors", "false");
204+
PlatformDependent.newFixedMpscQueue(1);
205+
OpenSsl.isAvailable();
231206
});
232207

233208
this.settings = settings;
@@ -442,7 +417,7 @@ public List<Setting<?>> getSettings() {
442417
Property.Filtered
443418
)
444419
);
445-
if (!settings.stream().anyMatch(s -> s.getKey().equalsIgnoreCase(NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY))) {
420+
if (!settings.stream().anyMatch(s -> s.getKey().equalsIgnoreCase(TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY))) {
446421
settings.add(SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION);
447422
}
448423
if (!settings.stream()
@@ -751,14 +726,14 @@ protected Settings migrateSettings(Settings settings) {
751726

752727
if (!NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION.exists(settings)) {
753728
builder.put(
754-
NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY,
729+
TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY,
755730
SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION.get(settings)
756731
);
757732
} else {
758733
if (SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION.exists(settings)) {
759734
throw new OpenSearchException(
760735
"Only one of the settings ["
761-
+ NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY
736+
+ TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY
762737
+ ", "
763738
+ SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION.getKey()
764739
+ " (deprecated)] could be specified but not both"

‎src/main/java/org/opensearch/security/ssl/util/SSLConfigConstants.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ public static String getStringAffixKeyForCertType(Setting.AffixSetting<String> a
236236
public static final String SECURITY_SSL_TRANSPORT_CLIENT_PEMTRUSTEDCAS_FILEPATH = SSL_TRANSPORT_CLIENT_PREFIX
237237
+ PEM_TRUSTED_CAS_FILEPATH;
238238

239-
public static final String SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION = SSL_TRANSPORT_PREFIX
239+
public static final String SECURITY_SSL_TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY = SSL_TRANSPORT_PREFIX
240240
+ "enforce_hostname_verification";
241241
public static final String SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION_RESOLVE_HOST_NAME = SSL_TRANSPORT_PREFIX
242242
+ "resolve_hostname";

‎src/test/java/org/opensearch/security/auditlog/sink/WebhookAuditLogTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ public void formatsTest() throws Exception {
100100
SSLConfigConstants.SECURITY_SSL_TRANSPORT_TRUSTSTORE_FILEPATH,
101101
FileHelper.getAbsoluteFilePathFromClassPath("auditlog/truststore.jks")
102102
)
103-
.put("plugins.security.ssl.transport.enforce_hostname_verification", false)
103+
.put("transport.ssl.enforce_hostname_verification", false)
104104
.build();
105105

106106
MockWebhookAuditLog auditlog = new MockWebhookAuditLog(settings, ConfigConstants.SECURITY_AUDIT_CONFIG_DEFAULT, null);

‎src/test/java/org/opensearch/security/ssl/OpenSearchSecuritySSLPluginTest.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
import static org.hamcrest.CoreMatchers.nullValue;
5050
import static org.hamcrest.MatcherAssert.assertThat;
5151
import static org.hamcrest.collection.IsMapContaining.hasKey;
52+
import static org.opensearch.common.network.NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY;
5253
import static org.junit.Assert.assertThrows;
5354

5455
public class OpenSearchSecuritySSLPluginTest extends AbstractSecurityUnitTest {
@@ -164,7 +165,7 @@ public void testRegisterSecureTransportWithDeprecatedSecuirtyPluginSettings() th
164165
.put(settings)
165166
.put(SecuritySettings.SSL_DUAL_MODE_SETTING.getKey(), true)
166167
.put(SSLConfigConstants.SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION_RESOLVE_HOST_NAME, false)
167-
.put(SSLConfigConstants.SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, false)
168+
.put(TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, false)
168169
.build();
169170

170171
try (OpenSearchSecuritySSLPlugin plugin = new OpenSearchSecuritySSLPlugin(deprecated, osPathHome, false)) {
@@ -189,7 +190,7 @@ public void testRegisterSecureTransportWithNetworkModuleSettings() throws IOExce
189190
.put(settings)
190191
.put(NetworkModule.TRANSPORT_SSL_DUAL_MODE_ENABLED_KEY, true)
191192
.put(NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_RESOLVE_HOST_NAME_KEY, false)
192-
.put(NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, false)
193+
.put(TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, false)
193194
.build();
194195

195196
try (OpenSearchSecuritySSLPlugin plugin = new OpenSearchSecuritySSLPlugin(migrated, osPathHome, false)) {
@@ -217,8 +218,8 @@ public void testRegisterSecureTransportWithDuplicateSettings() throws IOExceptio
217218
NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_RESOLVE_HOST_NAME_KEY
218219
),
219220
Tuple.tuple(
220-
SSLConfigConstants.SECURITY_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION,
221-
NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY
221+
SSLConfigConstants.SECURITY_SSL_TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY,
222+
TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY
222223
)
223224
);
224225

@@ -228,7 +229,7 @@ public void testRegisterSecureTransportWithDuplicateSettings() throws IOExceptio
228229
.put(duplicate.v1(), true)
229230
.put(NetworkModule.TRANSPORT_SSL_DUAL_MODE_ENABLED_KEY, true)
230231
.put(NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_RESOLVE_HOST_NAME_KEY, false)
231-
.put(NetworkModule.TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, false)
232+
.put(TRANSPORT_SSL_ENFORCE_HOSTNAME_VERIFICATION_KEY, false)
232233
.build();
233234

234235
try (OpenSearchSecuritySSLPlugin plugin = new OpenSearchSecuritySSLPlugin(migrated, osPathHome, false)) {

0 commit comments

Comments
 (0)