Skip to content

Commit 0da7fd7

Browse files
tvernumtvernum
committed
Change Netty4Transport to use SslProfile
1 parent 812fe47 commit 0da7fd7

File tree

5 files changed

+79
-73
lines changed

5 files changed

+79
-73
lines changed

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/core/security/transport/ProfileConfigurations.java‎

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import org.elasticsearch.transport.TransportSettings;
1212
import org.elasticsearch.xpack.core.XPackSettings;
1313
import org.elasticsearch.xpack.core.ssl.SSLService;
14+
import org.elasticsearch.xpack.core.ssl.SslProfile;
1415

1516
import java.util.HashMap;
1617
import java.util.Map;
@@ -73,12 +74,12 @@ private ProfileConfigurations() {}
7374
* as an entry for the "default" profile. If the remote_cluster feature is enabled, it also
7475
* contains an entry for the synthetic "_remote_cluster" profile.
7576
*/
76-
public static Map<String, SslConfiguration> get(Settings settings, SSLService sslService, boolean sslEnabledOnly) {
77+
public static Map<String, SslProfile> get(Settings settings, SSLService sslService, boolean sslEnabledOnly) {
7778
final boolean transportSslEnabled = XPackSettings.TRANSPORT_SSL_ENABLED.get(settings);
7879
final boolean remoteClusterPortEnabled = REMOTE_CLUSTER_SERVER_ENABLED.get(settings);
7980
final boolean remoteClusterServerSslEnabled = remoteClusterPortEnabled && REMOTE_CLUSTER_SERVER_SSL_ENABLED.get(settings);
8081

81-
final Map<String, SslConfiguration> profileConfigurations = new HashMap<>();
82+
final Map<String, SslProfile> profileConfigurations = new HashMap<>();
8283

8384
if (sslEnabledOnly) {
8485
if (transportSslEnabled == false && remoteClusterServerSslEnabled == false) {
@@ -87,10 +88,7 @@ public static Map<String, SslConfiguration> get(Settings settings, SSLService ss
8788
// The single TRANSPORT_SSL_ENABLED setting determines whether SSL is enabled for both
8889
// the default transport profile and any custom transport profiles. That is, SSL is
8990
// always either enabled or disabled together for default and custom transport profiles.
90-
profileConfigurations.put(
91-
REMOTE_CLUSTER_PROFILE,
92-
sslService.getSSLConfiguration(XPackSettings.REMOTE_CLUSTER_SERVER_SSL_PREFIX)
93-
);
91+
profileConfigurations.put(REMOTE_CLUSTER_PROFILE, sslService.profile(XPackSettings.REMOTE_CLUSTER_SERVER_SSL_PREFIX));
9492
return profileConfigurations;
9593
} else if (remoteClusterServerSslEnabled == false) {
9694
populateFromTransportProfiles(settings, sslService, profileConfigurations);
@@ -103,10 +101,7 @@ public static Map<String, SslConfiguration> get(Settings settings, SSLService ss
103101
populateFromTransportProfiles(settings, sslService, profileConfigurations);
104102
if (remoteClusterPortEnabled) {
105103
assert profileConfigurations.containsKey(REMOTE_CLUSTER_PROFILE) == false;
106-
profileConfigurations.put(
107-
REMOTE_CLUSTER_PROFILE,
108-
sslService.getSSLConfiguration(XPackSettings.REMOTE_CLUSTER_SERVER_SSL_PREFIX)
109-
);
104+
profileConfigurations.put(REMOTE_CLUSTER_PROFILE, sslService.profile(XPackSettings.REMOTE_CLUSTER_SERVER_SSL_PREFIX));
110105
}
111106

112107
return profileConfigurations;
@@ -115,9 +110,9 @@ public static Map<String, SslConfiguration> get(Settings settings, SSLService ss
115110
private static void populateFromTransportProfiles(
116111
Settings settings,
117112
SSLService sslService,
118-
Map<String, SslConfiguration> profileConfigurations
113+
Map<String, SslProfile> profileConfigurations
119114
) {
120-
final SslConfiguration defaultConfiguration = sslService.getSSLConfiguration(setting("transport.ssl."));
115+
final SslProfile defaultProfile = sslService.profile(setting("transport.ssl."));
121116

122117
Set<String> profileNames = settings.getGroups("transport.profiles.", true).keySet();
123118
for (String profileName : profileNames) {
@@ -136,11 +131,11 @@ private static void populateFromTransportProfiles(
136131
}
137132
}
138133

139-
SslConfiguration configuration = sslService.getSSLConfiguration("transport.profiles." + profileName + "." + setting("ssl"));
140-
profileConfigurations.put(profileName, configuration);
134+
final SslProfile profile = sslService.profile("transport.profiles." + profileName + "." + setting("ssl"));
135+
profileConfigurations.put(profileName, profile);
141136
}
142137

143138
assert profileConfigurations.containsKey(TransportSettings.DEFAULT_PROFILE) == false;
144-
profileConfigurations.put(TransportSettings.DEFAULT_PROFILE, defaultConfiguration);
139+
profileConfigurations.put(TransportSettings.DEFAULT_PROFILE, defaultProfile);
145140
}
146141
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/core/security/transport/netty4/SecurityNetty4Transport.java‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
import org.elasticsearch.common.io.stream.NamedWriteableRegistry;
2525
import org.elasticsearch.common.network.NetworkService;
2626
import org.elasticsearch.common.settings.Settings;
27-
import org.elasticsearch.common.ssl.SslConfiguration;
2827
import org.elasticsearch.common.unit.ByteSizeValue;
2928
import org.elasticsearch.common.util.PageCacheRecycler;
3029
import org.elasticsearch.common.util.concurrent.ThreadContext;
@@ -47,6 +46,7 @@
4746
import org.elasticsearch.xpack.core.security.transport.ProfileConfigurations;
4847
import org.elasticsearch.xpack.core.security.transport.SecurityTransportExceptionHandler;
4948
import org.elasticsearch.xpack.core.ssl.SSLService;
49+
import org.elasticsearch.xpack.core.ssl.SslProfile;
5050
import org.elasticsearch.xpack.security.authc.CrossClusterAccessAuthenticationService;
5151

5252
import java.net.InetSocketAddress;
@@ -73,11 +73,11 @@ public class SecurityNetty4Transport extends Netty4Transport {
7373

7474
private final SecurityTransportExceptionHandler exceptionHandler;
7575
private final SSLService sslService;
76-
private final SslConfiguration defaultSslConfiguration;
77-
private final Map<String, SslConfiguration> profileConfigurations;
76+
private final SslProfile defaultSslProfile;
77+
private final Map<String, SslProfile> profiles;
7878
private final boolean transportSslEnabled;
7979
private final boolean remoteClusterServerSslEnabled;
80-
private final SslConfiguration remoteClusterClientSslConfiguration;
80+
private final SslProfile remoteClusterClientSslProfile;
8181
private final RemoteClusterClientBootstrapOptions remoteClusterClientBootstrapOptions;
8282
private final CrossClusterAccessAuthenticationService crossClusterAccessAuthenticationService;
8383

@@ -108,16 +108,16 @@ public SecurityNetty4Transport(
108108
this.sslService = sslService;
109109
this.transportSslEnabled = XPackSettings.TRANSPORT_SSL_ENABLED.get(settings);
110110
this.remoteClusterServerSslEnabled = REMOTE_CLUSTER_SERVER_SSL_ENABLED.get(settings);
111-
this.profileConfigurations = Collections.unmodifiableMap(ProfileConfigurations.get(settings, sslService, true));
112-
this.defaultSslConfiguration = this.profileConfigurations.get(TransportSettings.DEFAULT_PROFILE);
113-
assert this.transportSslEnabled == false || this.defaultSslConfiguration != null;
111+
this.profiles = Collections.unmodifiableMap(ProfileConfigurations.get(settings, sslService, true));
112+
this.defaultSslProfile = this.profiles.get(TransportSettings.DEFAULT_PROFILE);
113+
assert this.transportSslEnabled == false || this.defaultSslProfile != null;
114114

115115
// Client configuration does not depend on whether the remote access port is enabled
116116
if (REMOTE_CLUSTER_CLIENT_SSL_ENABLED.get(settings)) {
117-
this.remoteClusterClientSslConfiguration = sslService.getSSLConfiguration(REMOTE_CLUSTER_CLIENT_SSL_PREFIX);
118-
assert this.remoteClusterClientSslConfiguration != null;
117+
this.remoteClusterClientSslProfile = sslService.profile(REMOTE_CLUSTER_CLIENT_SSL_PREFIX);
118+
assert this.remoteClusterClientSslProfile != null;
119119
} else {
120-
this.remoteClusterClientSslConfiguration = null;
120+
this.remoteClusterClientSslProfile = null;
121121
}
122122
this.remoteClusterClientBootstrapOptions = RemoteClusterClientBootstrapOptions.fromSettings(settings);
123123
}
@@ -131,20 +131,20 @@ protected void doStart() {
131131
public final ChannelHandler getServerChannelInitializer(String name) {
132132
if (remoteClusterPortEnabled && REMOTE_CLUSTER_PROFILE.equals(name)) {
133133
if (remoteClusterServerSslEnabled) {
134-
final SslConfiguration remoteClusterSslConfiguration = profileConfigurations.get(name);
135-
if (remoteClusterSslConfiguration == null) {
134+
final SslProfile remoteClusterSslProfile = profiles.get(name);
135+
if (remoteClusterSslProfile == null) {
136136
throw new IllegalStateException("remote cluster SSL is enabled but no configuration is found");
137137
}
138-
return getSslChannelInitializer(name, remoteClusterSslConfiguration);
138+
return getSslChannelInitializer(name, remoteClusterSslProfile);
139139
} else {
140140
return getNoSslChannelInitializer(name);
141141
}
142142
} else if (transportSslEnabled) {
143-
SslConfiguration configuration = profileConfigurations.get(name);
144-
if (configuration == null) {
143+
SslProfile profile = profiles.get(name);
144+
if (profile == null) {
145145
throw new IllegalStateException("unknown profile: " + name);
146146
}
147-
return getSslChannelInitializer(name, configuration);
147+
return getSslChannelInitializer(name, profile);
148148
} else {
149149
return getNoSslChannelInitializer(name);
150150
}
@@ -228,27 +228,27 @@ public void onException(TcpChannel channel, Exception e) {
228228
}
229229

230230
public class SslChannelInitializer extends ServerChannelInitializer {
231-
private final SslConfiguration configuration;
231+
private final SslProfile profile;
232232

233-
public SslChannelInitializer(String name, SslConfiguration configuration) {
233+
public SslChannelInitializer(String name, SslProfile profile) {
234234
super(name);
235-
this.configuration = configuration;
235+
this.profile = profile;
236236
}
237237

238238
@Override
239239
protected void initChannel(Channel ch) throws Exception {
240-
SSLEngine serverEngine = sslService.createSSLEngine(configuration, null, -1);
240+
SSLEngine serverEngine = profile.engine(null, -1);
241241
serverEngine.setUseClientMode(false);
242242
final SslHandler sslHandler = new SslHandler(serverEngine);
243-
sslHandler.setHandshakeTimeoutMillis(configuration.handshakeTimeoutMillis());
243+
sslHandler.setHandshakeTimeoutMillis(profile.configuration().handshakeTimeoutMillis());
244244
ch.pipeline().addFirst("sslhandler", sslHandler);
245245
super.initChannel(ch);
246246
assert ch.pipeline().first() == sslHandler : "SSL handler must be first handler in pipeline";
247247
}
248248
}
249249

250-
protected ServerChannelInitializer getSslChannelInitializer(final String name, final SslConfiguration configuration) {
251-
return new SslChannelInitializer(name, configuration);
250+
protected ServerChannelInitializer getSslChannelInitializer(final String name, final SslProfile profile) {
251+
return new SslChannelInitializer(name, profile);
252252
}
253253

254254
@Override
@@ -260,21 +260,23 @@ private class SecurityClientChannelInitializer extends ClientChannelInitializer
260260

261261
private final boolean hostnameVerificationEnabled;
262262
private final SNIHostName serverName;
263-
private final SslConfiguration channelSslConfiguration;
263+
private final SslProfile channelSslProfile;
264264

265265
SecurityClientChannelInitializer(DiscoveryNode node, ConnectionProfile connectionProfile) {
266266
final String transportProfile = connectionProfile.getTransportProfile();
267267
logger.trace("initiating security client channel with transport profile [{}]", transportProfile);
268268
// Only client connections to a new RCS remote cluster can have transport profile of _remote_cluster
269269
// All other client connections use the default transport profile regardless of the transport profile used on the server side.
270270
if (REMOTE_CLUSTER_PROFILE.equals(transportProfile)) {
271-
this.channelSslConfiguration = remoteClusterClientSslConfiguration;
271+
this.channelSslProfile = remoteClusterClientSslProfile;
272272
} else {
273273
assert TransportSettings.DEFAULT_PROFILE.equals(transportProfile);
274-
this.channelSslConfiguration = defaultSslConfiguration;
274+
this.channelSslProfile = defaultSslProfile;
275275
}
276-
if (this.channelSslConfiguration != null) {
277-
this.hostnameVerificationEnabled = this.channelSslConfiguration.verificationMode().isHostnameVerificationEnabled();
276+
if (this.channelSslProfile != null) {
277+
this.hostnameVerificationEnabled = this.channelSslProfile.configuration()
278+
.verificationMode()
279+
.isHostnameVerificationEnabled();
278280
} else {
279281
this.hostnameVerificationEnabled = false;
280282
}
@@ -293,29 +295,27 @@ private class SecurityClientChannelInitializer extends ClientChannelInitializer
293295
@Override
294296
protected void initChannel(Channel ch) throws Exception {
295297
super.initChannel(ch);
296-
if (channelSslConfiguration != null) {
298+
if (channelSslProfile != null) {
297299
ch.pipeline()
298-
.addFirst(
299-
new ClientSslHandlerInitializer(channelSslConfiguration, sslService, hostnameVerificationEnabled, serverName)
300-
);
300+
.addFirst(new ClientSslHandlerInitializer(channelSslProfile, sslService, hostnameVerificationEnabled, serverName));
301301
}
302302
}
303303
}
304304

305305
private static class ClientSslHandlerInitializer extends ChannelOutboundHandlerAdapter {
306306

307307
private final boolean hostnameVerificationEnabled;
308-
private final SslConfiguration sslConfiguration;
308+
private final SslProfile sslProfile;
309309
private final SSLService sslService;
310310
private final SNIServerName serverName;
311311

312312
private ClientSslHandlerInitializer(
313-
SslConfiguration sslConfiguration,
313+
SslProfile sslProfile,
314314
SSLService sslService,
315315
boolean hostnameVerificationEnabled,
316316
SNIServerName serverName
317317
) {
318-
this.sslConfiguration = sslConfiguration;
318+
this.sslProfile = sslProfile;
319319
this.hostnameVerificationEnabled = hostnameVerificationEnabled;
320320
this.sslService = sslService;
321321
this.serverName = serverName;
@@ -328,9 +328,9 @@ public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, Sock
328328
if (hostnameVerificationEnabled) {
329329
InetSocketAddress inetSocketAddress = (InetSocketAddress) remoteAddress;
330330
// we create the socket based on the name given. don't reverse DNS
331-
sslEngine = sslService.createSSLEngine(sslConfiguration, inetSocketAddress.getHostString(), inetSocketAddress.getPort());
331+
sslEngine = sslProfile.engine(inetSocketAddress.getHostString(), inetSocketAddress.getPort());
332332
} else {
333-
sslEngine = sslService.createSSLEngine(sslConfiguration, null, -1);
333+
sslEngine = sslProfile.engine(null, -1);
334334
}
335335

336336
sslEngine.setUseClientMode(true);
@@ -341,7 +341,7 @@ public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, Sock
341341
}
342342
final ChannelPromise connectPromise = ctx.newPromise();
343343
final SslHandler sslHandler = new SslHandler(sslEngine);
344-
sslHandler.setHandshakeTimeoutMillis(sslConfiguration.handshakeTimeoutMillis());
344+
sslHandler.setHandshakeTimeoutMillis(sslProfile.configuration().handshakeTimeoutMillis());
345345
ctx.pipeline().replace(this, "ssl", sslHandler);
346346
final Future<?> handshakePromise = sslHandler.handshakeFuture();
347347
Netty4Utils.addListener(connectPromise, result -> {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptor.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
import org.elasticsearch.xpack.core.security.user.SystemUser;
4848
import org.elasticsearch.xpack.core.security.user.User;
4949
import org.elasticsearch.xpack.core.ssl.SSLService;
50+
import org.elasticsearch.xpack.core.ssl.SslProfile;
5051
import org.elasticsearch.xpack.security.Security;
5152
import org.elasticsearch.xpack.security.action.SecurityActionMapper;
5253
import org.elasticsearch.xpack.security.audit.AuditUtil;
@@ -482,16 +483,16 @@ public <T extends TransportRequest> TransportRequestHandler<T> interceptHandler(
482483
}
483484

484485
private Map<String, ServerTransportFilter> initializeProfileFilters(DestructiveOperations destructiveOperations) {
485-
final Map<String, SslConfiguration> profileConfigurations = ProfileConfigurations.get(settings, sslService, false);
486+
final Map<String, SslProfile> profileConfigurations = ProfileConfigurations.get(settings, sslService, false);
486487

487488
Map<String, ServerTransportFilter> profileFilters = Maps.newMapWithExpectedSize(profileConfigurations.size() + 1);
488489

489490
final boolean transportSSLEnabled = XPackSettings.TRANSPORT_SSL_ENABLED.get(settings);
490491
final boolean remoteClusterPortEnabled = REMOTE_CLUSTER_SERVER_ENABLED.get(settings);
491492
final boolean remoteClusterServerSSLEnabled = XPackSettings.REMOTE_CLUSTER_SERVER_SSL_ENABLED.get(settings);
492493

493-
for (Map.Entry<String, SslConfiguration> entry : profileConfigurations.entrySet()) {
494-
final SslConfiguration profileConfiguration = entry.getValue();
494+
for (Map.Entry<String, SslProfile> entry : profileConfigurations.entrySet()) {
495+
final SslConfiguration profileConfiguration = entry.getValue().configuration();
495496
final String profileName = entry.getKey();
496497
final boolean useRemoteClusterProfile = remoteClusterPortEnabled && profileName.equals(REMOTE_CLUSTER_PROFILE);
497498
if (useRemoteClusterProfile) {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/netty4/SecurityNetty4ServerTransport.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@
1313
import org.elasticsearch.common.io.stream.NamedWriteableRegistry;
1414
import org.elasticsearch.common.network.NetworkService;
1515
import org.elasticsearch.common.settings.Settings;
16-
import org.elasticsearch.common.ssl.SslConfiguration;
1716
import org.elasticsearch.common.util.PageCacheRecycler;
1817
import org.elasticsearch.core.Nullable;
1918
import org.elasticsearch.indices.breaker.CircuitBreakerService;
2019
import org.elasticsearch.threadpool.ThreadPool;
2120
import org.elasticsearch.transport.netty4.SharedGroupFactory;
2221
import org.elasticsearch.xpack.core.security.transport.netty4.SecurityNetty4Transport;
2322
import org.elasticsearch.xpack.core.ssl.SSLService;
23+
import org.elasticsearch.xpack.core.ssl.SslProfile;
2424
import org.elasticsearch.xpack.security.authc.CrossClusterAccessAuthenticationService;
2525
import org.elasticsearch.xpack.security.transport.filter.IPFilter;
2626

@@ -71,8 +71,8 @@ protected ChannelHandler getNoSslChannelInitializer(final String name) {
7171
}
7272

7373
@Override
74-
protected ServerChannelInitializer getSslChannelInitializer(final String name, final SslConfiguration configuration) {
75-
return new SecurityServerChannelInitializer(name, configuration);
74+
protected ServerChannelInitializer getSslChannelInitializer(final String name, final SslProfile profile) {
75+
return new SecurityServerChannelInitializer(name, profile);
7676
}
7777

7878
public class IPFilterServerChannelInitializer extends ServerChannelInitializer {
@@ -90,8 +90,8 @@ protected void initChannel(final Channel ch) throws Exception {
9090

9191
public class SecurityServerChannelInitializer extends SslChannelInitializer {
9292

93-
SecurityServerChannelInitializer(final String name, final SslConfiguration configuration) {
94-
super(name, configuration);
93+
SecurityServerChannelInitializer(final String name, final SslProfile profile) {
94+
super(name, profile);
9595
}
9696

9797
@Override

0 commit comments

Comments
 (0)