-
Notifications
You must be signed in to change notification settings - Fork 25k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Introduce ssl settings to reindex from remote (#38292)
Adds reindex.ssl.* settings for reindex from remote. This uses the ssl-config/ internal library to parse and load SSL configuration and files. This is applied when using the low level rest client to connect to a remote ES node Backport of: #37527 Relates: #37287 Resolves: #29755
- Loading branch information
Showing
25 changed files
with
646 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
161 changes: 161 additions & 0 deletions
161
modules/reindex/src/main/java/org/elasticsearch/index/reindex/ReindexSslConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,161 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.index.reindex; | ||
|
|
||
| import org.apache.http.conn.ssl.DefaultHostnameVerifier; | ||
| import org.apache.http.conn.ssl.NoopHostnameVerifier; | ||
| import org.apache.http.nio.conn.ssl.SSLIOSessionStrategy; | ||
| import org.elasticsearch.common.Strings; | ||
| import org.elasticsearch.common.settings.SecureSetting; | ||
| import org.elasticsearch.common.settings.SecureString; | ||
| import org.elasticsearch.common.settings.Setting; | ||
| import org.elasticsearch.common.settings.Settings; | ||
| import org.elasticsearch.common.ssl.SslConfiguration; | ||
| import org.elasticsearch.common.ssl.SslConfigurationKeys; | ||
| import org.elasticsearch.common.ssl.SslConfigurationLoader; | ||
| import org.elasticsearch.env.Environment; | ||
| import org.elasticsearch.watcher.FileChangesListener; | ||
| import org.elasticsearch.watcher.FileWatcher; | ||
| import org.elasticsearch.watcher.ResourceWatcherService; | ||
|
|
||
| import javax.net.ssl.HostnameVerifier; | ||
| import javax.net.ssl.SSLContext; | ||
| import java.io.IOException; | ||
| import java.io.UncheckedIOException; | ||
| import java.nio.file.Path; | ||
| import java.util.ArrayList; | ||
| import java.util.Collections; | ||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.function.Function; | ||
|
|
||
| import static org.elasticsearch.common.settings.Setting.listSetting; | ||
| import static org.elasticsearch.common.settings.Setting.simpleString; | ||
|
|
||
| /** | ||
| * Loads "reindex.ssl.*" configuration from Settings, and makes the applicable configuration (trust manager / key manager / hostname | ||
| * verification / cipher-suites) available for reindex-from-remote. | ||
| */ | ||
| class ReindexSslConfig { | ||
|
|
||
| private static final Map<String, Setting<?>> SETTINGS = new HashMap<>(); | ||
| private static final Map<String, Setting<SecureString>> SECURE_SETTINGS = new HashMap<>(); | ||
|
|
||
| static { | ||
| Setting.Property[] defaultProperties = new Setting.Property[] { Setting.Property.NodeScope, Setting.Property.Filtered }; | ||
| Setting.Property[] deprecatedProperties = new Setting.Property[] { Setting.Property.Deprecated, Setting.Property.NodeScope, | ||
| Setting.Property.Filtered }; | ||
| for (String key : SslConfigurationKeys.getStringKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| final Setting.Property[] properties = SslConfigurationKeys.isDeprecated(key) ? deprecatedProperties : defaultProperties; | ||
| SETTINGS.put(settingName, simpleString(settingName, properties)); | ||
| } | ||
| for (String key : SslConfigurationKeys.getListKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| final Setting.Property[] properties = SslConfigurationKeys.isDeprecated(key) ? deprecatedProperties : defaultProperties; | ||
| SETTINGS.put(settingName, listSetting(settingName, Collections.emptyList(), Function.identity(), properties)); | ||
| } | ||
| for (String key : SslConfigurationKeys.getSecureStringKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| SECURE_SETTINGS.put(settingName, SecureSetting.secureString(settingName, null)); | ||
| } | ||
| } | ||
|
|
||
| private final SslConfiguration configuration; | ||
| private volatile SSLContext context; | ||
|
|
||
| public static List<Setting<?>> getSettings() { | ||
| List<Setting<?>> settings = new ArrayList<>(); | ||
| settings.addAll(SETTINGS.values()); | ||
| settings.addAll(SECURE_SETTINGS.values()); | ||
| return settings; | ||
| } | ||
|
|
||
| ReindexSslConfig(Settings settings, Environment environment, ResourceWatcherService resourceWatcher) { | ||
| final SslConfigurationLoader loader = new SslConfigurationLoader("reindex.ssl.") { | ||
|
|
||
| @Override | ||
| protected String getSettingAsString(String key) { | ||
| return settings.get(key); | ||
| } | ||
|
|
||
| @Override | ||
| protected char[] getSecureSetting(String key) { | ||
| final Setting<SecureString> setting = SECURE_SETTINGS.get(key); | ||
| if (setting == null) { | ||
| throw new IllegalArgumentException("The secure setting [" + key + "] is not registered"); | ||
| } | ||
| return setting.get(settings).getChars(); | ||
| } | ||
|
|
||
| @Override | ||
| protected List<String> getSettingAsList(String key) throws Exception { | ||
| return settings.getAsList(key); | ||
| } | ||
| }; | ||
| configuration = loader.load(environment.configFile()); | ||
| reload(); | ||
|
|
||
| final FileChangesListener listener = new FileChangesListener() { | ||
| @Override | ||
| public void onFileCreated(Path file) { | ||
| onFileChanged(file); | ||
| } | ||
|
|
||
| @Override | ||
| public void onFileDeleted(Path file) { | ||
| onFileChanged(file); | ||
| } | ||
|
|
||
| @Override | ||
| public void onFileChanged(Path file) { | ||
| ReindexSslConfig.this.reload(); | ||
| } | ||
| }; | ||
| for (Path file : configuration.getDependentFiles()) { | ||
| try { | ||
| final FileWatcher watcher = new FileWatcher(file); | ||
| watcher.addListener(listener); | ||
| resourceWatcher.add(watcher, ResourceWatcherService.Frequency.HIGH); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException("cannot watch file [" + file + "]", e); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private void reload() { | ||
| this.context = configuration.createSslContext(); | ||
| } | ||
|
|
||
| /** | ||
| * Encapsulate the loaded SSL configuration as a HTTP-client {@link SSLIOSessionStrategy}. | ||
| * The returned strategy is immutable, but successive calls will return different objects that may have different | ||
| * configurations if the underlying key/certificate files are modified. | ||
| */ | ||
| SSLIOSessionStrategy getStrategy() { | ||
| final HostnameVerifier hostnameVerifier = configuration.getVerificationMode().isHostnameVerificationEnabled() | ||
| ? new DefaultHostnameVerifier() | ||
| : new NoopHostnameVerifier(); | ||
| final String[] protocols = configuration.getSupportedProtocols().toArray(Strings.EMPTY_ARRAY); | ||
| final String[] cipherSuites = configuration.getCipherSuites().toArray(Strings.EMPTY_ARRAY); | ||
| return new SSLIOSessionStrategy(context, protocols, cipherSuites, hostnameVerifier); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.