Skip to content

Commit 26fed96

Browse files
moschemosche
authored
Merge branch '9.1' into backport/9.1/pr-130826
2 parents fb7ffea + 7952796 commit 26fed96

File tree

65 files changed

+1251
-620
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+1251
-620
lines changed

‎docs/changelog/131113.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 131113
2+
summary: Including `max_tokens` through the Service API for Anthropic
3+
area: Machine Learning
4+
type: bug
5+
issues: []

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ private static PolicyManager createPolicyManager(
161161
PathLookup pathLookup,
162162
Policy serverPolicyPatch,
163163
Function<Class<?>, PolicyManager.PolicyScope> scopeResolver,
164-
Map<String, Collection<Path>> pluginSourcePaths
164+
Map<String, Collection<Path>> pluginSourcePathsResolver
165165
) {
166166
FilesEntitlementsValidation.validate(pluginPolicies, pathLookup);
167167

@@ -170,7 +170,7 @@ private static PolicyManager createPolicyManager(
170170
HardcodedEntitlements.agentEntitlements(),
171171
pluginPolicies,
172172
scopeResolver,
173-
pluginSourcePaths,
173+
pluginSourcePathsResolver::get,
174174
pathLookup
175175
);
176176
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PathLookup.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,17 @@
99

1010
package org.elasticsearch.entitlement.runtime.policy;
1111

12+
import org.elasticsearch.core.PathUtils;
13+
1214
import java.nio.file.Path;
1315
import java.util.stream.Stream;
1416

1517
/**
1618
* Resolves paths for known directories checked by entitlements.
1719
*/
1820
public interface PathLookup {
21+
Class<?> DEFAULT_FILESYSTEM_CLASS = PathUtils.getDefaultFileSystem().getClass();
22+
1923
enum BaseDir {
2024
USER_HOME,
2125
CONFIG,
@@ -37,4 +41,6 @@ enum BaseDir {
3741
* paths of the given {@code baseDir}.
3842
*/
3943
Stream<Path> resolveSettingPaths(BaseDir baseDir, String settingName);
44+
45+
boolean isPathOnDefaultFilesystem(Path path);
4046
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PathLookupImpl.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,4 +75,9 @@ public Stream<Path> resolveSettingPaths(BaseDir baseDir, String settingName) {
7575
.toList();
7676
return getBaseDirPaths(baseDir).flatMap(path -> relativePaths.stream().map(path::resolve));
7777
}
78+
79+
@Override
80+
public boolean isPathOnDefaultFilesystem(Path path) {
81+
return path.getFileSystem().getClass() == DEFAULT_FILESYSTEM_CLASS;
82+
}
7883
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java‎

Lines changed: 37 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99

1010
package org.elasticsearch.entitlement.runtime.policy;
1111

12-
import org.elasticsearch.core.PathUtils;
1312
import org.elasticsearch.core.Strings;
1413
import org.elasticsearch.core.SuppressForbidden;
1514
import org.elasticsearch.entitlement.instrumentation.InstrumentationService;
@@ -58,7 +57,7 @@
5857
*/
5958
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
6059
public class PolicyCheckerImpl implements PolicyChecker {
61-
static final Class<?> DEFAULT_FILESYSTEM_CLASS = PathUtils.getDefaultFileSystem().getClass();
60+
6261
protected final Set<Package> suppressFailureLogPackages;
6362
/**
6463
* Frames originating from this module are ignored in the permission logic.
@@ -81,15 +80,14 @@ public PolicyCheckerImpl(
8180
this.pathLookup = pathLookup;
8281
}
8382

84-
private static boolean isPathOnDefaultFilesystem(Path path) {
85-
var pathFileSystemClass = path.getFileSystem().getClass();
86-
if (path.getFileSystem().getClass() != DEFAULT_FILESYSTEM_CLASS) {
83+
private boolean isPathOnDefaultFilesystem(Path path) {
84+
if (pathLookup.isPathOnDefaultFilesystem(path) == false) {
8785
PolicyManager.generalLogger.trace(
8886
() -> Strings.format(
8987
"File entitlement trivially allowed: path [%s] is for a different FileSystem class [%s], default is [%s]",
9088
path.toString(),
91-
pathFileSystemClass.getName(),
92-
DEFAULT_FILESYSTEM_CLASS.getName()
89+
path.getFileSystem().getClass().getName(),
90+
PathLookup.DEFAULT_FILESYSTEM_CLASS.getName()
9391
)
9492
);
9593
return false;
@@ -139,7 +137,7 @@ private void neverEntitled(Class<?> callerClass, Supplier<String> operationDescr
139137
requestingClass,
140138
operationDescription.get()
141139
),
142-
callerClass,
140+
requestingClass,
143141
entitlements
144142
);
145143
}
@@ -217,7 +215,7 @@ public void checkFileRead(Class<?> callerClass, Path path) {
217215

218216
@Override
219217
public void checkFileRead(Class<?> callerClass, Path path, boolean followLinks) throws NoSuchFileException {
220-
if (PolicyCheckerImpl.isPathOnDefaultFilesystem(path) == false) {
218+
if (isPathOnDefaultFilesystem(path) == false) {
221219
return;
222220
}
223221
var requestingClass = requestingClass(callerClass);
@@ -251,7 +249,7 @@ public void checkFileRead(Class<?> callerClass, Path path, boolean followLinks)
251249
requestingClass,
252250
realPath == null ? path : Strings.format("%s -> %s", path, realPath)
253251
),
254-
callerClass,
252+
requestingClass,
255253
entitlements
256254
);
257255
}
@@ -265,7 +263,7 @@ public void checkFileWrite(Class<?> callerClass, File file) {
265263

266264
@Override
267265
public void checkFileWrite(Class<?> callerClass, Path path) {
268-
if (PolicyCheckerImpl.isPathOnDefaultFilesystem(path) == false) {
266+
if (isPathOnDefaultFilesystem(path) == false) {
269267
return;
270268
}
271269
var requestingClass = requestingClass(callerClass);
@@ -283,7 +281,7 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
283281
requestingClass,
284282
path
285283
),
286-
callerClass,
284+
requestingClass,
287285
entitlements
288286
);
289287
}
@@ -360,8 +358,8 @@ public void checkAllNetworkAccess(Class<?> callerClass) {
360358
}
361359

362360
var classEntitlements = policyManager.getEntitlements(requestingClass);
363-
checkFlagEntitlement(classEntitlements, InboundNetworkEntitlement.class, requestingClass, callerClass);
364-
checkFlagEntitlement(classEntitlements, OutboundNetworkEntitlement.class, requestingClass, callerClass);
361+
checkFlagEntitlement(classEntitlements, InboundNetworkEntitlement.class, requestingClass);
362+
checkFlagEntitlement(classEntitlements, OutboundNetworkEntitlement.class, requestingClass);
365363
}
366364

367365
@Override
@@ -378,16 +376,15 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
378376

379377
ModuleEntitlements entitlements = policyManager.getEntitlements(requestingClass);
380378
if (entitlements.getEntitlements(WriteSystemPropertiesEntitlement.class).anyMatch(e -> e.properties().contains(property))) {
381-
entitlements.logger()
382-
.debug(
383-
() -> Strings.format(
384-
"Entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
385-
entitlements.componentName(),
386-
entitlements.moduleName(),
387-
requestingClass,
388-
property
389-
)
390-
);
379+
PolicyManager.generalLogger.debug(
380+
() -> Strings.format(
381+
"Entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
382+
entitlements.componentName(),
383+
entitlements.moduleName(),
384+
requestingClass,
385+
property
386+
)
387+
);
391388
return;
392389
}
393390
notEntitled(
@@ -398,7 +395,7 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
398395
requestingClass,
399396
property
400397
),
401-
callerClass,
398+
requestingClass,
402399
entitlements
403400
);
404401
}
@@ -439,8 +436,7 @@ Optional<StackWalker.StackFrame> findRequestingFrame(Stream<StackWalker.StackFra
439436
private void checkFlagEntitlement(
440437
ModuleEntitlements classEntitlements,
441438
Class<? extends Entitlement> entitlementClass,
442-
Class<?> requestingClass,
443-
Class<?> callerClass
439+
Class<?> requestingClass
444440
) {
445441
if (classEntitlements.hasEntitlement(entitlementClass) == false) {
446442
notEntitled(
@@ -451,27 +447,26 @@ private void checkFlagEntitlement(
451447
requestingClass,
452448
PolicyParser.buildEntitlementNameFromClass(entitlementClass)
453449
),
454-
callerClass,
450+
requestingClass,
455451
classEntitlements
456452
);
457453
}
458-
classEntitlements.logger()
459-
.debug(
460-
() -> Strings.format(
461-
"Entitled: component [%s], module [%s], class [%s], entitlement [%s]",
462-
classEntitlements.componentName(),
463-
classEntitlements.moduleName(),
464-
requestingClass,
465-
PolicyParser.buildEntitlementNameFromClass(entitlementClass)
466-
)
467-
);
454+
PolicyManager.generalLogger.debug(
455+
() -> Strings.format(
456+
"Entitled: component [%s], module [%s], class [%s], entitlement [%s]",
457+
classEntitlements.componentName(),
458+
classEntitlements.moduleName(),
459+
requestingClass,
460+
PolicyParser.buildEntitlementNameFromClass(entitlementClass)
461+
)
462+
);
468463
}
469464

470-
private void notEntitled(String message, Class<?> callerClass, ModuleEntitlements entitlements) {
465+
private void notEntitled(String message, Class<?> requestingClass, ModuleEntitlements entitlements) {
471466
var exception = new NotEntitledException(message);
472467
// Don't emit a log for suppressed packages, e.g. packages containing self tests
473-
if (suppressFailureLogPackages.contains(callerClass.getPackage()) == false) {
474-
entitlements.logger().warn("Not entitled: {}", message, exception);
468+
if (suppressFailureLogPackages.contains(requestingClass.getPackage()) == false) {
469+
entitlements.logger(requestingClass).warn("Not entitled: {}", message, exception);
475470
}
476471
throw exception;
477472
}
@@ -482,7 +477,7 @@ public void checkEntitlementPresent(Class<?> callerClass, Class<? extends Entitl
482477
if (policyManager.isTriviallyAllowed(requestingClass)) {
483478
return;
484479
}
485-
checkFlagEntitlement(policyManager.getEntitlements(requestingClass), entitlementClass, requestingClass, callerClass);
480+
checkFlagEntitlement(policyManager.getEntitlements(requestingClass), entitlementClass, requestingClass);
486481
}
487482

488483
@Override

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,11 @@
2222
import java.nio.file.Paths;
2323
import java.util.ArrayList;
2424
import java.util.Collection;
25+
import java.util.Collections;
2526
import java.util.HashSet;
2627
import java.util.List;
2728
import java.util.Map;
29+
import java.util.Objects;
2830
import java.util.Set;
2931
import java.util.concurrent.ConcurrentHashMap;
3032
import java.util.function.Function;
@@ -122,8 +124,7 @@ protected record ModuleEntitlements(
122124
String componentName,
123125
String moduleName,
124126
Map<Class<? extends Entitlement>, List<Entitlement>> entitlementsByType,
125-
FileAccessTree fileAccess,
126-
Logger logger
127+
FileAccessTree fileAccess
127128
) {
128129

129130
public ModuleEntitlements {
@@ -141,6 +142,12 @@ public <E extends Entitlement> Stream<E> getEntitlements(Class<E> entitlementCla
141142
}
142143
return entitlements.stream().map(entitlementClass::cast);
143144
}
145+
146+
Logger logger(Class<?> requestingClass) {
147+
var packageName = requestingClass.getPackageName();
148+
var loggerSuffix = "." + componentName + "." + ((moduleName == null) ? ALL_UNNAMED : moduleName) + "." + packageName;
149+
return LogManager.getLogger(PolicyManager.class.getName() + loggerSuffix);
150+
}
144151
}
145152

146153
private FileAccessTree getDefaultFileAccess(Collection<Path> componentPaths) {
@@ -149,13 +156,7 @@ private FileAccessTree getDefaultFileAccess(Collection<Path> componentPaths) {
149156

150157
// pkg private for testing
151158
ModuleEntitlements defaultEntitlements(String componentName, Collection<Path> componentPaths, String moduleName) {
152-
return new ModuleEntitlements(
153-
componentName,
154-
moduleName,
155-
Map.of(),
156-
getDefaultFileAccess(componentPaths),
157-
getLogger(componentName, moduleName)
158-
);
159+
return new ModuleEntitlements(componentName, moduleName, Map.of(), getDefaultFileAccess(componentPaths));
159160
}
160161

161162
// pkg private for testing
@@ -175,8 +176,7 @@ ModuleEntitlements policyEntitlements(
175176
componentName,
176177
moduleName,
177178
entitlements.stream().collect(groupingBy(Entitlement::getClass)),
178-
FileAccessTree.of(componentName, moduleName, filesEntitlement, pathLookup, componentPaths, exclusivePaths),
179-
getLogger(componentName, moduleName)
179+
FileAccessTree.of(componentName, moduleName, filesEntitlement, pathLookup, componentPaths, exclusivePaths)
180180
);
181181
}
182182

@@ -217,7 +217,7 @@ private static Set<Module> findSystemLayerModules() {
217217
.filter(m -> SYSTEM_LAYER_MODULES.contains(m) == false)
218218
.collect(Collectors.toUnmodifiableSet());
219219

220-
private final Map<String, Collection<Path>> pluginSourcePaths;
220+
private final Function<String, Collection<Path>> pluginSourcePathsResolver;
221221

222222
/**
223223
* Paths that are only allowed for a single module. Used to generate
@@ -231,7 +231,7 @@ public PolicyManager(
231231
List<Entitlement> apmAgentEntitlements,
232232
Map<String, Policy> pluginPolicies,
233233
Function<Class<?>, PolicyScope> scopeResolver,
234-
Map<String, Collection<Path>> pluginSourcePaths,
234+
Function<String, Collection<Path>> pluginSourcePathsResolver,
235235
PathLookup pathLookup
236236
) {
237237
this.serverEntitlements = buildScopeEntitlementsMap(requireNonNull(serverPolicy));
@@ -240,7 +240,7 @@ public PolicyManager(
240240
.stream()
241241
.collect(toUnmodifiableMap(Map.Entry::getKey, e -> buildScopeEntitlementsMap(e.getValue())));
242242
this.scopeResolver = scopeResolver;
243-
this.pluginSourcePaths = pluginSourcePaths;
243+
this.pluginSourcePathsResolver = pluginSourcePathsResolver;
244244
this.pathLookup = requireNonNull(pathLookup);
245245

246246
List<ExclusiveFileEntitlement> exclusiveFileEntitlements = new ArrayList<>();
@@ -286,21 +286,6 @@ private static void validateEntitlementsPerModule(
286286
}
287287
}
288288

289-
private static Logger getLogger(String componentName, String moduleName) {
290-
var loggerSuffix = "." + componentName + "." + ((moduleName == null) ? ALL_UNNAMED : moduleName);
291-
return MODULE_LOGGERS.computeIfAbsent(PolicyManager.class.getName() + loggerSuffix, LogManager::getLogger);
292-
}
293-
294-
/**
295-
* We want to use the same {@link Logger} object for a given name, because we want {@link ModuleEntitlements}
296-
* {@code equals} and {@code hashCode} to work.
297-
* <p>
298-
* This would not be required if LogManager
299-
* <a href="https://github.com/elastic/elasticsearch/issues/87511">memoized the loggers</a>,
300-
* but here we are.
301-
*/
302-
private static final ConcurrentHashMap<String, Logger> MODULE_LOGGERS = new ConcurrentHashMap<>();
303-
304289
protected ModuleEntitlements getEntitlements(Class<?> requestingClass) {
305290
return moduleEntitlementsMap.computeIfAbsent(requestingClass.getModule(), m -> computeEntitlements(requestingClass));
306291
}
@@ -334,7 +319,10 @@ protected final ModuleEntitlements computeEntitlements(Class<?> requestingClass)
334319
default -> {
335320
assert policyScope.kind() == PLUGIN;
336321
var pluginEntitlements = pluginsEntitlements.get(componentName);
337-
Collection<Path> componentPaths = pluginSourcePaths.getOrDefault(componentName, List.of());
322+
Collection<Path> componentPaths = Objects.requireNonNullElse(
323+
pluginSourcePathsResolver.apply(componentName),
324+
Collections.emptyList()
325+
);
338326
if (pluginEntitlements == null) {
339327
return defaultEntitlements(componentName, componentPaths, moduleName);
340328
} else {

0 commit comments

Comments
 (0)