Skip to content

Commit 435a592

Browse files
tvernumtvernum
committed
Move createSslEngine to profile
1 parent 0da7fd7 commit 435a592

File tree

6 files changed

+67
-108
lines changed

6 files changed

+67
-108
lines changed

‎modules/transport-netty4/src/main/java/org/elasticsearch/transport/netty4/TLSConfig.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,26 +13,26 @@
1313

1414
import javax.net.ssl.SSLEngine;
1515

16-
public record TLSConfig(SslConfiguration sslConfiguration, EngineProvider engineProvider) {
16+
public record TLSConfig(EngineProvider engineProvider) {
1717

1818
public boolean isTLSEnabled() {
19-
return sslConfiguration != null;
19+
return engineProvider != null;
2020
}
2121

2222
public SSLEngine createServerSSLEngine() {
2323
assert isTLSEnabled();
24-
SSLEngine sslEngine = engineProvider.create(sslConfiguration, null, -1);
24+
SSLEngine sslEngine = engineProvider.create(null, -1);
2525
sslEngine.setUseClientMode(false);
2626
return sslEngine;
2727
}
2828

2929
public static TLSConfig noTLS() {
30-
return new TLSConfig(null, null);
30+
return new TLSConfig(null);
3131
}
3232

3333
@FunctionalInterface
3434
public interface EngineProvider {
3535

36-
SSLEngine create(SslConfiguration configuration, String host, int port);
36+
SSLEngine create(String host, int port);
3737
}
3838
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/SSLService.java‎

Lines changed: 19 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -319,41 +319,6 @@ public SSLSocketFactory sslSocketFactory(SslConfiguration configuration) {
319319
return securitySSLSocketFactory;
320320
}
321321

322-
/**
323-
* Creates an {@link SSLEngine} based on the provided configuration. This SSLEngine can be used for a connection that requires
324-
* hostname verification assuming the provided
325-
* host and port are correct. The SSLEngine created by this method is most useful for clients with hostname verification enabled
326-
*
327-
* @param configuration the ssl configuration
328-
* @param host the host of the remote endpoint. If using hostname verification, this should match what is in the remote
329-
* endpoint's certificate
330-
* @param port the port of the remote endpoint
331-
* @return {@link SSLEngine}
332-
* @see #getSSLConfiguration(String)
333-
*/
334-
public SSLEngine createSSLEngine(SslConfiguration configuration, String host, int port) {
335-
SSLContext sslContext = sslContext(configuration);
336-
SSLEngine sslEngine = sslContext.createSSLEngine(host, port);
337-
String[] ciphers = supportedCiphers(sslEngine.getSupportedCipherSuites(), configuration.getCipherSuites(), false);
338-
String[] supportedProtocols = configuration.supportedProtocols().toArray(Strings.EMPTY_ARRAY);
339-
SSLParameters parameters = new SSLParameters(ciphers, supportedProtocols);
340-
if (configuration.verificationMode().isHostnameVerificationEnabled() && host != null) {
341-
// By default, an SSLEngine will not perform hostname verification. In order to perform hostname verification
342-
// we need to specify a EndpointIdentificationAlgorithm. We use the HTTPS algorithm to prevent against
343-
// man in the middle attacks for all of our connections.
344-
parameters.setEndpointIdentificationAlgorithm("HTTPS");
345-
}
346-
// we use the cipher suite order so that we can prefer the ciphers we set first in the list
347-
parameters.setUseCipherSuitesOrder(true);
348-
configuration.clientAuth().configure(parameters);
349-
350-
// many SSLEngine options can be configured using either SSLParameters or direct methods on the engine itself, but there is one
351-
// tricky aspect; if you set a value directly on the engine and then later set the SSLParameters the value set directly on the
352-
// engine will be overwritten by the value in the SSLParameters
353-
sslEngine.setSSLParameters(parameters);
354-
return sslEngine;
355-
}
356-
357322
/**
358323
* Returns whether the provided settings results in a valid configuration that can be used for server connections
359324
*
@@ -847,7 +812,25 @@ public SSLIOSessionStrategy ioSessionStrategy4() {
847812

848813
@Override
849814
public SSLEngine engine(String host, int port) {
850-
return SSLService.this.createSSLEngine(this.configuration(), host, port);
815+
final SSLEngine sslEngine = this.context.createSSLEngine(host, port);
816+
final String[] ciphers = supportedCiphers(sslEngine.getSupportedCipherSuites(), this.sslConfiguration.getCipherSuites(), false);
817+
final String[] supportedProtocols = this.configuration().supportedProtocols().toArray(Strings.EMPTY_ARRAY);
818+
final SSLParameters parameters = new SSLParameters(ciphers, supportedProtocols);
819+
if (this.sslConfiguration.verificationMode().isHostnameVerificationEnabled() && host != null) {
820+
// By default, an SSLEngine will not perform hostname verification. In order to perform hostname verification
821+
// we need to specify a EndpointIdentificationAlgorithm. We use the HTTPS algorithm to prevent against
822+
// man in the middle attacks for all of our connections.
823+
parameters.setEndpointIdentificationAlgorithm("HTTPS");
824+
}
825+
// we use the cipher suite order so that we can prefer the ciphers we set first in the list
826+
parameters.setUseCipherSuitesOrder(true);
827+
this.sslConfiguration.clientAuth().configure(parameters);
828+
829+
// many SSLEngine options can be configured using either SSLParameters or direct methods on the engine itself, but there is one
830+
// tricky aspect; if you set a value directly on the engine and then later set the SSLParameters the value set directly on the
831+
// engine will be overwritten by the value in the SSLParameters
832+
sslEngine.setSSLParameters(parameters);
833+
return sslEngine;
851834
}
852835

853836
synchronized void reload() {

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/SSLServiceTests.java‎

Lines changed: 25 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -163,28 +163,16 @@ public void testThatCustomTruststoreCanBeSpecified() throws Exception {
163163
.build();
164164

165165
SslConfiguration configuration = SslSettingsLoader.load(customTruststoreSettings, null, env);
166-
SSLEngine sslEngineWithTruststore = sslService.createSSLEngine(configuration, null, -1);
166+
SslProfile profile = sslService.profile("transport.profiles.foo.xpack.security.ssl");
167+
assertThat(profile.configuration(), equalTo(configuration));
168+
assertThat(profile.configuration().getDependentFiles(), contains(testClientStore));
169+
SSLEngine sslEngineWithTruststore = profile.engine(null, -1);
167170
assertThat(sslEngineWithTruststore, is(not(nullValue())));
168171

169-
SslConfiguration defaultConfig = sslService.getSSLConfiguration("xpack.security.transport.ssl");
170-
SSLEngine sslEngine = sslService.createSSLEngine(defaultConfig, null, -1);
172+
SslProfile defaultProfile = sslService.profile("xpack.security.transport.ssl");
173+
SSLEngine sslEngine = defaultProfile.engine(null, -1);
171174
assertThat(sslEngineWithTruststore, is(not(sameInstance(sslEngine))));
172-
173-
final SslConfiguration profileConfiguration = sslService.getSSLConfiguration("transport.profiles.foo.xpack.security.ssl");
174-
assertThat(profileConfiguration, notNullValue());
175-
assertThat(profileConfiguration.getDependentFiles(), contains(testClientStore));
176-
177-
final SslProfile defaultSslProfile = sslService.profile(
178-
randomFrom("xpack.security.transport.ssl", "xpack.security.transport.ssl.")
179-
);
180-
assertThat(defaultSslProfile, notNullValue());
181-
assertThat(defaultSslProfile.configuration().trustConfig().getDependentFiles(), containsInAnyOrder(testnodeStore));
182-
183-
final SslProfile fooSslProfile = sslService.profile(
184-
randomFrom("transport.profiles.foo.xpack.security.ssl", "transport.profiles.foo.xpack.security.ssl.")
185-
);
186-
assertThat(fooSslProfile, notNullValue());
187-
assertThat(fooSslProfile.configuration().trustConfig().getDependentFiles(), containsInAnyOrder(testClientStore));
175+
assertThat(defaultProfile.configuration().getDependentFiles(), contains(testnodeStore));
188176
}
189177

190178
public void testThatSslContextCachingWorks() throws Exception {
@@ -230,10 +218,7 @@ public void testThatKeyStoreAndKeyCanHaveDifferentPasswords() throws Exception {
230218
.build();
231219

232220
final SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
233-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
234-
sslService.createSSLEngine(configuration, null, -1);
235-
236-
final SslProfile profile = sslService.profile("xpack.security.transport.ssl.");
221+
final SslProfile profile = sslService.profile("xpack.security.transport.ssl");
237222
profile.engine(null, -1);
238223
}
239224

@@ -250,8 +235,8 @@ public void testIncorrectKeyPasswordThrowsException() throws Exception {
250235
.setSecureSettings(secureSettings)
251236
.build();
252237
final SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
253-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
254-
sslService.createSSLEngine(configuration, null, -1);
238+
SslProfile profile = sslService.profile("xpack.security.transport.ssl");
239+
profile.engine(null, -1);
255240
fail("expected an exception");
256241
} catch (ElasticsearchException e) {
257242
assertThat(e, throwableWithMessage(startsWith("failed to load SSL configuration [xpack.security.transport.ssl] - ")));
@@ -268,10 +253,7 @@ public void testThatSSLv3IsNotEnabled() throws Exception {
268253
.put("xpack.security.transport.ssl.key", testnodeKey)
269254
.setSecureSettings(secureSettings)
270255
.build();
271-
SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
272-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
273-
SSLEngine engine = sslService.createSSLEngine(configuration, null, -1);
274-
assertThat(Arrays.asList(engine.getEnabledProtocols()), not(hasItem("SSLv3")));
256+
final SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
275257

276258
final SslProfile profile = sslService.profile("xpack.security.transport.ssl.");
277259
final String[] profileProtocols = profile.engine(null, -1).getEnabledProtocols();
@@ -281,11 +263,9 @@ public void testThatSSLv3IsNotEnabled() throws Exception {
281263

282264
public void testThatCreateClientSSLEngineWithoutAnySettingsWorks() throws Exception {
283265
SSLService sslService = new SSLService(env);
284-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
285-
SSLEngine sslEngine = sslService.createSSLEngine(configuration, null, -1);
286-
assertThat(sslEngine, notNullValue());
287-
288-
assertThat(sslService.profile("xpack.security.transport.ssl.").engine(null, -1), notNullValue());
266+
final SslProfile profile = sslService.profile("xpack.security.transport.ssl");
267+
final SSLEngine engine = profile.engine(null, -1);
268+
assertThat(engine, notNullValue());
289269
}
290270

291271
public void testThatCreateSSLEngineWithOnlyTruststoreWorks() throws Exception {
@@ -297,8 +277,8 @@ public void testThatCreateSSLEngineWithOnlyTruststoreWorks() throws Exception {
297277
.setSecureSettings(secureSettings)
298278
.build();
299279
SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
300-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.http.ssl");
301-
SSLEngine sslEngine = sslService.createSSLEngine(configuration, null, -1);
280+
SslProfile profile = sslService.profile("xpack.security.http.ssl");
281+
SSLEngine sslEngine = profile.engine(null, -1);
302282
assertThat(sslEngine, notNullValue());
303283

304284
assertThat(sslService.profile("xpack.security.http.ssl.").engine(null, -1), notNullValue());
@@ -496,16 +476,10 @@ public void testCiphersAndInvalidCiphersWork() throws Exception {
496476
.build();
497477
SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
498478

499-
final SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
500-
SSLEngine engine = sslService.createSSLEngine(configuration, null, -1);
501-
assertThat(engine, is(notNullValue()));
502-
String[] enabledCiphers = engine.getEnabledCipherSuites();
503-
assertThat(Arrays.asList(enabledCiphers), not(contains("foo", "bar")));
504-
505-
final SslProfile profile = sslService.profile("xpack.security.transport.ssl.");
506-
engine = profile.engine(null, -1);
479+
final SslProfile profile = sslService.profile("xpack.security.transport.ssl");
480+
var engine = profile.engine(null, -1);
507481
assertThat(engine, is(notNullValue()));
508-
enabledCiphers = engine.getEnabledCipherSuites();
482+
var enabledCiphers = engine.getEnabledCipherSuites();
509483
assertThat(Arrays.asList(enabledCiphers), not(contains("foo", "bar")));
510484
}
511485

@@ -544,13 +518,8 @@ public void testThatSSLEngineHasCipherSuitesOrderSet() throws Exception {
544518

545519
SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
546520

547-
final SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
548-
SSLEngine engine = sslService.createSSLEngine(configuration, null, -1);
549-
assertThat(engine, is(notNullValue()));
550-
assertTrue(engine.getSSLParameters().getUseCipherSuitesOrder());
551-
552-
final SslProfile profile = sslService.profile("xpack.security.transport.ssl.");
553-
engine = profile.engine(null, -1);
521+
final SslProfile profile = sslService.profile("xpack.security.transport.ssl");
522+
SSLEngine engine = profile.engine(null, -1);
554523
assertThat(engine, is(notNullValue()));
555524
assertTrue(engine.getSSLParameters().getUseCipherSuitesOrder());
556525
}
@@ -598,9 +567,10 @@ public void testThatSSLEngineHasProperCiphersAndProtocols() throws Exception {
598567
.put("xpack.security.transport.ssl.key", testnodeKey)
599568
.setSecureSettings(secureSettings)
600569
.build();
601-
SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
602-
SslConfiguration configuration = sslService.getSSLConfiguration("xpack.security.transport.ssl");
603-
SSLEngine engine = sslService.createSSLEngine(configuration, null, -1);
570+
final SSLService sslService = new SSLService(TestEnvironment.newEnvironment(buildEnvSettings(settings)));
571+
final SslProfile profile = sslService.profile("xpack.security.transport.ssl");
572+
final SSLEngine engine = profile.engine(null, -1);
573+
final SslConfiguration configuration = profile.configuration();
604574
final String[] ciphers = sslService.supportedCiphers(engine.getSupportedCipherSuites(), configuration.getCipherSuites(), false);
605575
final String[] getSupportedProtocols = configuration.supportedProtocols().toArray(Strings.EMPTY_ARRAY);
606576
assertThat(engine.getEnabledCipherSuites(), is(ciphers));

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,7 @@
222222
import org.elasticsearch.xpack.core.security.user.AnonymousUser;
223223
import org.elasticsearch.xpack.core.ssl.SSLConfigurationSettings;
224224
import org.elasticsearch.xpack.core.ssl.SSLService;
225+
import org.elasticsearch.xpack.core.ssl.SslProfile;
225226
import org.elasticsearch.xpack.core.ssl.TransportTLSBootstrapCheck;
226227
import org.elasticsearch.xpack.core.ssl.action.GetCertificateInfoAction;
227228
import org.elasticsearch.xpack.core.ssl.action.TransportGetCertificateInfoAction;
@@ -2031,10 +2032,11 @@ public boolean test(String profile, InetSocketAddress peerAddress) {
20312032
httpTransports.put(SecurityField.NAME4, () -> {
20322033
final boolean ssl = HTTP_SSL_ENABLED.get(settings);
20332034
final SSLService sslService = getSslService();
2034-
final SslConfiguration sslConfiguration;
20352035
final BiConsumer<Channel, ThreadContext> populateClientCertificate;
2036+
final TLSConfig tlsConfig;
20362037
if (ssl) {
2037-
sslConfiguration = sslService.getHttpTransportSSLConfiguration();
2038+
final SslProfile sslProfile = sslService.profile(XPackSettings.HTTP_SSL_PREFIX);
2039+
final SslConfiguration sslConfiguration = sslProfile.configuration();
20382040
if (SSLService.isConfigurationValidForServerUsage(sslConfiguration) == false) {
20392041
throw new IllegalArgumentException(
20402042
"a key must be provided to run as a server. the key should be configured using the "
@@ -2046,8 +2048,9 @@ public boolean test(String profile, InetSocketAddress peerAddress) {
20462048
} else {
20472049
populateClientCertificate = (channel, threadContext) -> {};
20482050
}
2051+
tlsConfig = new TLSConfig(sslProfile::engine);
20492052
} else {
2050-
sslConfiguration = null;
2053+
tlsConfig = TLSConfig.noTLS();
20512054
populateClientCertificate = (channel, threadContext) -> {};
20522055
}
20532056
final AuthenticationService authenticationService = this.authcService.get();
@@ -2061,7 +2064,7 @@ public boolean test(String profile, InetSocketAddress peerAddress) {
20612064
clusterSettings,
20622065
getNettySharedGroupFactory(settings),
20632066
telemetryProvider,
2064-
new TLSConfig(sslConfiguration, sslService::createSSLEngine),
2067+
tlsConfig,
20652068
acceptPredicate,
20662069
(httpRequest, channel, listener) -> {
20672070
HttpPreRequest httpPreRequest = HttpHeadersAuthenticatorUtils.asHttpPreRequest(httpRequest);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/netty4/SecurityNetty4HttpServerTransportCloseNotifyTests.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
import org.elasticsearch.threadpool.ThreadPool;
4444
import org.elasticsearch.transport.netty4.SharedGroupFactory;
4545
import org.elasticsearch.transport.netty4.TLSConfig;
46+
import org.elasticsearch.xpack.core.XPackSettings;
4647
import org.elasticsearch.xpack.core.ssl.SSLService;
4748

4849
import java.security.cert.CertificateException;
@@ -108,7 +109,7 @@ private HttpServer setupHttpServer(String tlsProtocols) throws CertificateExcept
108109
randomClusterSettings(),
109110
new SharedGroupFactory(settings),
110111
TelemetryProvider.NOOP,
111-
new TLSConfig(sslService.getHttpTransportSSLConfiguration(), sslService::createSSLEngine),
112+
new TLSConfig(sslService.profile(XPackSettings.HTTP_SSL_PREFIX)::engine),
112113
null,
113114
randomFrom((httpPreRequest, channel, listener) -> listener.onResponse(null), null)
114115
);

0 commit comments

Comments
 (0)