Skip to content

Commit 079f1c7

Browse files
rjernstrjernst
authored
Move remaining check methods in RestEntitlementsCheckAction (#125351) (#125436)
All future check methods should be found reflectively with the EntitlementTest annotation.
1 parent c50e681 commit 079f1c7

File tree

5 files changed

+213
-272
lines changed

5 files changed

+213
-272
lines changed

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/LoadNativeLibrariesCheckActions.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,12 @@
99

1010
package org.elasticsearch.entitlement.qa.test;
1111

12+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
13+
14+
@SuppressWarnings({ "unused" /* called via reflection */ })
1215
class LoadNativeLibrariesCheckActions {
16+
17+
@EntitlementTest(expectedAccess = PLUGINS)
1318
static void runtimeLoad() {
1419
try {
1520
Runtime.getRuntime().load(FileCheckActions.readDir().resolve("libSomeLibFile.so").toString());
@@ -18,6 +23,7 @@ static void runtimeLoad() {
1823
}
1924
}
2025

26+
@EntitlementTest(expectedAccess = PLUGINS)
2127
static void systemLoad() {
2228
try {
2329
System.load(FileCheckActions.readDir().resolve("libSomeLibFile.so").toString());
@@ -26,6 +32,7 @@ static void systemLoad() {
2632
}
2733
}
2834

35+
@EntitlementTest(expectedAccess = PLUGINS)
2936
static void runtimeLoadLibrary() {
3037
try {
3138
Runtime.getRuntime().loadLibrary("SomeLib");
@@ -34,11 +41,14 @@ static void runtimeLoadLibrary() {
3441
}
3542
}
3643

44+
@EntitlementTest(expectedAccess = PLUGINS)
3745
static void systemLoadLibrary() {
3846
try {
3947
System.loadLibrary("SomeLib");
4048
} catch (UnsatisfiedLinkError ignored) {
4149
// The library does not exist, so we expect to fail loading it
4250
}
4351
}
52+
53+
private LoadNativeLibrariesCheckActions() {}
4454
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/NetworkAccessCheckActions.java‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,23 @@
1212
import org.elasticsearch.core.SuppressForbidden;
1313

1414
import java.io.IOException;
15+
import java.net.DatagramPacket;
16+
import java.net.DatagramSocket;
17+
import java.net.HttpURLConnection;
1518
import java.net.InetAddress;
1619
import java.net.InetSocketAddress;
20+
import java.net.MalformedURLException;
21+
import java.net.NetworkInterface;
1722
import java.net.Proxy;
23+
import java.net.ProxySelector;
24+
import java.net.ResponseCache;
1825
import java.net.ServerSocket;
1926
import java.net.Socket;
2027
import java.net.SocketException;
28+
import java.net.URL;
29+
import java.net.URLConnection;
30+
import java.net.URLStreamHandler;
31+
import java.net.spi.URLStreamHandlerProvider;
2132
import java.nio.ByteBuffer;
2233
import java.nio.channels.AsynchronousServerSocketChannel;
2334
import java.nio.channels.AsynchronousSocketChannel;
@@ -32,9 +43,17 @@
3243
import java.util.Arrays;
3344
import java.util.concurrent.ExecutionException;
3445

46+
import javax.net.ssl.HttpsURLConnection;
47+
import javax.net.ssl.SSLContext;
48+
49+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
50+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
51+
3552
@SuppressForbidden(reason = "Testing entitlement check on forbidden action")
53+
@SuppressWarnings({ "unused" /* called via reflection */, "deprecation" })
3654
class NetworkAccessCheckActions {
3755

56+
@EntitlementTest(expectedAccess = PLUGINS)
3857
static void serverSocketAccept() throws IOException {
3958
try (ServerSocket socket = new DummyImplementations.DummyBoundServerSocket()) {
4059
try {
@@ -49,30 +68,35 @@ static void serverSocketAccept() throws IOException {
4968
}
5069
}
5170

71+
@EntitlementTest(expectedAccess = PLUGINS)
5272
static void serverSocketBind() throws IOException {
5373
try (ServerSocket socket = new DummyImplementations.DummyServerSocket()) {
5474
socket.bind(null);
5575
}
5676
}
5777

78+
@EntitlementTest(expectedAccess = PLUGINS)
5879
static void createSocketWithProxy() throws IOException {
5980
try (Socket socket = new Socket(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(0)))) {
6081
assert socket.isBound() == false;
6182
}
6283
}
6384

85+
@EntitlementTest(expectedAccess = PLUGINS)
6486
static void socketBind() throws IOException {
6587
try (Socket socket = new DummyImplementations.DummySocket()) {
6688
socket.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
6789
}
6890
}
6991

92+
@EntitlementTest(expectedAccess = PLUGINS)
7093
static void socketConnect() throws IOException {
7194
try (Socket socket = new DummyImplementations.DummySocket()) {
7295
socket.connect(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
7396
}
7497
}
7598

99+
@EntitlementTest(expectedAccess = PLUGINS)
76100
static void createLDAPCertStore() {
77101
try {
78102
// We pass down null params to provoke a InvalidAlgorithmParameterException
@@ -86,18 +110,21 @@ static void createLDAPCertStore() {
86110
}
87111
}
88112

113+
@EntitlementTest(expectedAccess = PLUGINS)
89114
static void serverSocketChannelBind() throws IOException {
90115
try (var serverSocketChannel = ServerSocketChannel.open()) {
91116
serverSocketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
92117
}
93118
}
94119

120+
@EntitlementTest(expectedAccess = PLUGINS)
95121
static void serverSocketChannelBindWithBacklog() throws IOException {
96122
try (var serverSocketChannel = ServerSocketChannel.open()) {
97123
serverSocketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 50);
98124
}
99125
}
100126

127+
@EntitlementTest(expectedAccess = PLUGINS)
101128
static void serverSocketChannelAccept() throws IOException {
102129
try (var serverSocketChannel = ServerSocketChannel.open()) {
103130
serverSocketChannel.configureBlocking(false);
@@ -110,18 +137,21 @@ static void serverSocketChannelAccept() throws IOException {
110137
}
111138
}
112139

140+
@EntitlementTest(expectedAccess = PLUGINS)
113141
static void asynchronousServerSocketChannelBind() throws IOException {
114142
try (var serverSocketChannel = AsynchronousServerSocketChannel.open()) {
115143
serverSocketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
116144
}
117145
}
118146

147+
@EntitlementTest(expectedAccess = PLUGINS)
119148
static void asynchronousServerSocketChannelBindWithBacklog() throws IOException {
120149
try (var serverSocketChannel = AsynchronousServerSocketChannel.open()) {
121150
serverSocketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 50);
122151
}
123152
}
124153

154+
@EntitlementTest(expectedAccess = PLUGINS)
125155
static void asynchronousServerSocketChannelAccept() throws IOException {
126156
try (var serverSocketChannel = AsynchronousServerSocketChannel.open()) {
127157
try {
@@ -134,6 +164,7 @@ static void asynchronousServerSocketChannelAccept() throws IOException {
134164
}
135165
}
136166

167+
@EntitlementTest(expectedAccess = PLUGINS)
137168
static void asynchronousServerSocketChannelAcceptWithHandler() throws IOException {
138169
try (var serverSocketChannel = AsynchronousServerSocketChannel.open()) {
139170
try {
@@ -153,12 +184,14 @@ public void failed(Throwable exc, Object attachment) {
153184
}
154185
}
155186

187+
@EntitlementTest(expectedAccess = PLUGINS)
156188
static void socketChannelBind() throws IOException {
157189
try (var socketChannel = SocketChannel.open()) {
158190
socketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
159191
}
160192
}
161193

194+
@EntitlementTest(expectedAccess = PLUGINS)
162195
static void socketChannelConnect() throws IOException {
163196
try (var socketChannel = SocketChannel.open()) {
164197
try {
@@ -170,12 +203,14 @@ static void socketChannelConnect() throws IOException {
170203
}
171204
}
172205

206+
@EntitlementTest(expectedAccess = PLUGINS)
173207
static void asynchronousSocketChannelBind() throws IOException {
174208
try (var socketChannel = AsynchronousSocketChannel.open()) {
175209
socketChannel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
176210
}
177211
}
178212

213+
@EntitlementTest(expectedAccess = PLUGINS)
179214
static void asynchronousSocketChannelConnect() throws IOException, InterruptedException {
180215
try (var socketChannel = AsynchronousSocketChannel.open()) {
181216
var future = socketChannel.connect(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
@@ -189,6 +224,7 @@ static void asynchronousSocketChannelConnect() throws IOException, InterruptedEx
189224
}
190225
}
191226

227+
@EntitlementTest(expectedAccess = PLUGINS)
192228
static void asynchronousSocketChannelConnectWithCompletion() throws IOException {
193229
try (var socketChannel = AsynchronousSocketChannel.open()) {
194230
socketChannel.connect(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), null, new CompletionHandler<>() {
@@ -203,12 +239,14 @@ public void failed(Throwable exc, Object attachment) {
203239
}
204240
}
205241

242+
@EntitlementTest(expectedAccess = PLUGINS)
206243
static void datagramChannelBind() throws IOException {
207244
try (var channel = DatagramChannel.open()) {
208245
channel.bind(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0));
209246
}
210247
}
211248

249+
@EntitlementTest(expectedAccess = PLUGINS)
212250
static void datagramChannelConnect() throws IOException {
213251
try (var channel = DatagramChannel.open()) {
214252
channel.configureBlocking(false);
@@ -221,18 +259,165 @@ static void datagramChannelConnect() throws IOException {
221259
}
222260
}
223261

262+
@EntitlementTest(expectedAccess = PLUGINS)
224263
static void datagramChannelSend() throws IOException {
225264
try (var channel = DatagramChannel.open()) {
226265
channel.configureBlocking(false);
227266
channel.send(ByteBuffer.wrap(new byte[] { 0 }), new InetSocketAddress(InetAddress.getLoopbackAddress(), 1234));
228267
}
229268
}
230269

270+
@EntitlementTest(expectedAccess = PLUGINS)
231271
static void datagramChannelReceive() throws IOException {
232272
try (var channel = DatagramChannel.open()) {
233273
channel.configureBlocking(false);
234274
var buffer = new byte[1];
235275
channel.receive(ByteBuffer.wrap(buffer));
236276
}
237277
}
278+
279+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
280+
static void createURLStreamHandlerProvider() {
281+
var x = new URLStreamHandlerProvider() {
282+
@Override
283+
public URLStreamHandler createURLStreamHandler(String protocol) {
284+
return null;
285+
}
286+
};
287+
}
288+
289+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
290+
static void createURLWithURLStreamHandler() throws MalformedURLException {
291+
var x = new URL("http", "host", 1234, "file", new URLStreamHandler() {
292+
@Override
293+
protected URLConnection openConnection(URL u) {
294+
return null;
295+
}
296+
});
297+
}
298+
299+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
300+
static void createURLWithURLStreamHandler2() throws MalformedURLException {
301+
var x = new URL(null, "spec", new URLStreamHandler() {
302+
@Override
303+
protected URLConnection openConnection(URL u) {
304+
return null;
305+
}
306+
});
307+
}
308+
309+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
310+
static void setDefaultResponseCache() {
311+
ResponseCache.setDefault(null);
312+
}
313+
314+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
315+
static void setDefaultProxySelector() {
316+
ProxySelector.setDefault(null);
317+
}
318+
319+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
320+
static void setDefaultSSLContext() throws NoSuchAlgorithmException {
321+
SSLContext.setDefault(SSLContext.getDefault());
322+
}
323+
324+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
325+
static void setDefaultHostnameVerifier() {
326+
HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> false);
327+
}
328+
329+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
330+
static void setDefaultSSLSocketFactory() {
331+
HttpsURLConnection.setDefaultSSLSocketFactory(new DummyImplementations.DummySSLSocketFactory());
332+
}
333+
334+
@EntitlementTest(expectedAccess = PLUGINS)
335+
static void setHttpsConnectionProperties() {
336+
new DummyImplementations.DummyHttpsURLConnection().setSSLSocketFactory(new DummyImplementations.DummySSLSocketFactory());
337+
}
338+
339+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
340+
static void datagramSocket$$setDatagramSocketImplFactory() throws IOException {
341+
DatagramSocket.setDatagramSocketImplFactory(() -> { throw new IllegalStateException(); });
342+
}
343+
344+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
345+
static void httpURLConnection$$setFollowRedirects() {
346+
HttpURLConnection.setFollowRedirects(HttpURLConnection.getFollowRedirects());
347+
}
348+
349+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
350+
static void serverSocket$$setSocketFactory() throws IOException {
351+
ServerSocket.setSocketFactory(() -> { throw new IllegalStateException(); });
352+
}
353+
354+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
355+
static void socket$$setSocketImplFactory() throws IOException {
356+
Socket.setSocketImplFactory(() -> { throw new IllegalStateException(); });
357+
}
358+
359+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
360+
static void url$$setURLStreamHandlerFactory() {
361+
URL.setURLStreamHandlerFactory(__ -> { throw new IllegalStateException(); });
362+
}
363+
364+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
365+
static void urlConnection$$setFileNameMap() {
366+
URLConnection.setFileNameMap(__ -> { throw new IllegalStateException(); });
367+
}
368+
369+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
370+
static void urlConnection$$setContentHandlerFactory() {
371+
URLConnection.setContentHandlerFactory(__ -> { throw new IllegalStateException(); });
372+
}
373+
374+
@EntitlementTest(expectedAccess = PLUGINS)
375+
static void bindDatagramSocket() throws SocketException {
376+
try (var socket = new DatagramSocket(null)) {
377+
socket.bind(null);
378+
}
379+
}
380+
381+
@EntitlementTest(expectedAccess = PLUGINS)
382+
static void connectDatagramSocket() throws SocketException {
383+
try (var socket = new DummyImplementations.DummyDatagramSocket()) {
384+
socket.connect(new InetSocketAddress(1234));
385+
}
386+
}
387+
388+
@EntitlementTest(expectedAccess = PLUGINS)
389+
static void joinGroupDatagramSocket() throws IOException {
390+
try (var socket = new DummyImplementations.DummyDatagramSocket()) {
391+
socket.joinGroup(
392+
new InetSocketAddress(InetAddress.getByAddress(new byte[] { (byte) 230, 0, 0, 1 }), 1234),
393+
NetworkInterface.getByIndex(0)
394+
);
395+
}
396+
}
397+
398+
@EntitlementTest(expectedAccess = PLUGINS)
399+
static void leaveGroupDatagramSocket() throws IOException {
400+
try (var socket = new DummyImplementations.DummyDatagramSocket()) {
401+
socket.leaveGroup(
402+
new InetSocketAddress(InetAddress.getByAddress(new byte[] { (byte) 230, 0, 0, 1 }), 1234),
403+
NetworkInterface.getByIndex(0)
404+
);
405+
}
406+
}
407+
408+
@EntitlementTest(expectedAccess = PLUGINS)
409+
static void sendDatagramSocket() throws IOException {
410+
try (var socket = new DummyImplementations.DummyDatagramSocket()) {
411+
socket.send(new DatagramPacket(new byte[] { 0 }, 1, InetAddress.getLocalHost(), 1234));
412+
}
413+
}
414+
415+
@EntitlementTest(expectedAccess = PLUGINS)
416+
static void receiveDatagramSocket() throws IOException {
417+
try (var socket = new DummyImplementations.DummyDatagramSocket()) {
418+
socket.receive(new DatagramPacket(new byte[1], 1, InetAddress.getLocalHost(), 1234));
419+
}
420+
}
421+
422+
private NetworkAccessCheckActions() {}
238423
}

0 commit comments

Comments
 (0)