Skip to content

Commit 492defb

Browse files
DaveCTurnerDaveCTurner
committed
Merge branch 'main' into 2025/03/08/snapshot-finalization-reduce-forking
2 parents 7b127bf + b9a9784 commit 492defb

File tree

33 files changed

+344
-305
lines changed

33 files changed

+344
-305
lines changed

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/EntitlementTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ enum ExpectedAccess {
2121
PLUGINS,
2222
ES_MODULES_ONLY,
2323
SERVER_ONLY,
24-
ALWAYS_DENIED
24+
ALWAYS_DENIED,
25+
ALWAYS_ALLOWED
2526
}
2627

2728
ExpectedAccess expectedAccess();

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,10 @@
5555
import javax.net.ssl.SSLContext;
5656

5757
import static java.util.Map.entry;
58+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_ALLOWED;
59+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
5860
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
61+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.SERVER_ONLY;
5962
import static org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction.CheckAction.alwaysDenied;
6063
import static org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction.CheckAction.deniedToPlugins;
6164
import static org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction.CheckAction.forPlugins;
@@ -65,20 +68,20 @@
6568
public class RestEntitlementsCheckAction extends BaseRestHandler {
6669
private static final Logger logger = LogManager.getLogger(RestEntitlementsCheckAction.class);
6770

68-
record CheckAction(CheckedRunnable<Exception> action, boolean isAlwaysDeniedToPlugins, Integer fromJavaVersion) {
71+
record CheckAction(CheckedRunnable<Exception> action, EntitlementTest.ExpectedAccess expectedAccess, Integer fromJavaVersion) {
6972
/**
7073
* These cannot be granted to plugins, so our test plugins cannot test the "allowed" case.
7174
*/
7275
static CheckAction deniedToPlugins(CheckedRunnable<Exception> action) {
73-
return new CheckAction(action, true, null);
76+
return new CheckAction(action, SERVER_ONLY, null);
7477
}
7578

7679
static CheckAction forPlugins(CheckedRunnable<Exception> action) {
77-
return new CheckAction(action, false, null);
80+
return new CheckAction(action, PLUGINS, null);
7881
}
7982

8083
static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
81-
return new CheckAction(action, true, null);
84+
return new CheckAction(action, ALWAYS_DENIED, null);
8285
}
8386
}
8487

@@ -125,7 +128,7 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
125128
entry("responseCache_setDefault", alwaysDenied(RestEntitlementsCheckAction::setDefaultResponseCache)),
126129
entry(
127130
"createInetAddressResolverProvider",
128-
new CheckAction(VersionSpecificNetworkChecks::createInetAddressResolverProvider, true, 18)
131+
new CheckAction(VersionSpecificNetworkChecks::createInetAddressResolverProvider, SERVER_ONLY, 18)
129132
),
130133
entry("createURLStreamHandlerProvider", alwaysDenied(RestEntitlementsCheckAction::createURLStreamHandlerProvider)),
131134
entry("createURLWithURLStreamHandler", alwaysDenied(RestEntitlementsCheckAction::createURLWithURLStreamHandler)),
@@ -233,9 +236,8 @@ private static Stream<Entry<String, CheckAction>> getTestEntries(Class<?> action
233236
}
234237
}
235238
};
236-
boolean deniedToPlugins = testAnnotation.expectedAccess() != PLUGINS;
237239
Integer fromJavaVersion = testAnnotation.fromJavaVersion() == -1 ? null : testAnnotation.fromJavaVersion();
238-
entries.add(entry(method.getName(), new CheckAction(runnable, deniedToPlugins, fromJavaVersion)));
240+
entries.add(entry(method.getName(), new CheckAction(runnable, testAnnotation.expectedAccess(), fromJavaVersion)));
239241
}
240242
return entries.stream();
241243
}
@@ -398,13 +400,17 @@ private static void receiveDatagramSocket() throws IOException {
398400
public static Set<String> getCheckActionsAllowedInPlugins() {
399401
return checkActions.entrySet()
400402
.stream()
401-
.filter(kv -> kv.getValue().isAlwaysDeniedToPlugins() == false)
403+
.filter(kv -> kv.getValue().expectedAccess().equals(PLUGINS) || kv.getValue().expectedAccess().equals(ALWAYS_ALLOWED))
402404
.map(Entry::getKey)
403405
.collect(Collectors.toSet());
404406
}
405407

406-
public static Set<String> getAllCheckActions() {
407-
return checkActions.keySet();
408+
public static Set<String> getDeniableCheckActions() {
409+
return checkActions.entrySet()
410+
.stream()
411+
.filter(kv -> kv.getValue().expectedAccess().equals(ALWAYS_ALLOWED) == false)
412+
.map(Entry::getKey)
413+
.collect(Collectors.toSet());
408414
}
409415

410416
@Override

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedIT.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public EntitlementsDeniedIT(@Name("actionName") String actionName) {
2626

2727
@ParametersFactory
2828
public static Iterable<Object[]> data() {
29-
return RestEntitlementsCheckAction.getAllCheckActions().stream().map(action -> new Object[] { action }).toList();
29+
return RestEntitlementsCheckAction.getDeniableCheckActions().stream().map(action -> new Object[] { action }).toList();
3030
}
3131

3232
@Override

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedNonModularIT.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public EntitlementsDeniedNonModularIT(@Name("actionName") String actionName) {
2626

2727
@ParametersFactory
2828
public static Iterable<Object[]> data() {
29-
return RestEntitlementsCheckAction.getAllCheckActions().stream().map(action -> new Object[] { action }).toList();
29+
return RestEntitlementsCheckAction.getDeniableCheckActions().stream().map(action -> new Object[] { action }).toList();
3030
}
3131

3232
@Override

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/NotEntitledException.java‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,10 @@
99

1010
package org.elasticsearch.entitlement.runtime.api;
1111

12-
public class NotEntitledException extends SecurityException {
12+
import java.security.AccessControlException;
13+
14+
public class NotEntitledException extends AccessControlException {
1315
public NotEntitledException(String message) {
1416
super(message);
1517
}
16-
17-
public NotEntitledException(String message, Throwable cause) {
18-
super(message, cause);
19-
}
2018
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,12 @@
2323
import java.nio.file.Paths;
2424
import java.util.ArrayList;
2525
import java.util.Arrays;
26+
import java.util.HashSet;
27+
import java.util.LinkedHashMap;
2628
import java.util.List;
29+
import java.util.Map;
2730
import java.util.Objects;
31+
import java.util.Set;
2832
import java.util.function.BiConsumer;
2933

3034
import static java.util.Comparator.comparing;
@@ -42,27 +46,47 @@ record ExclusiveFileEntitlement(String componentName, String moduleName, FilesEn
4246
/**
4347
* An intermediary structure to help globally validate exclusive paths, and then build exclusive paths for individual modules.
4448
*/
45-
record ExclusivePath(String componentName, String moduleName, String path) {
49+
record ExclusivePath(String componentName, Set<String> moduleNames, String path) {
4650

4751
@Override
4852
public String toString() {
49-
return "[[" + componentName + "] [" + moduleName + "] [" + path + "]]";
53+
return "[[" + componentName + "] " + moduleNames + " [" + path + "]]";
5054
}
5155
}
5256

5357
static List<ExclusivePath> buildExclusivePathList(List<ExclusiveFileEntitlement> exclusiveFileEntitlements, PathLookup pathLookup) {
54-
List<ExclusivePath> exclusivePaths = new ArrayList<>();
58+
Map<String, ExclusivePath> exclusivePaths = new LinkedHashMap<>();
5559
for (ExclusiveFileEntitlement efe : exclusiveFileEntitlements) {
5660
for (FilesEntitlement.FileData fd : efe.filesEntitlement().filesData()) {
5761
if (fd.exclusive()) {
5862
List<Path> paths = fd.resolvePaths(pathLookup).toList();
5963
for (Path path : paths) {
60-
exclusivePaths.add(new ExclusivePath(efe.componentName(), efe.moduleName(), normalizePath(path)));
64+
String normalizedPath = normalizePath(path);
65+
var exclusivePath = exclusivePaths.computeIfAbsent(
66+
normalizedPath,
67+
k -> new ExclusivePath(efe.componentName(), new HashSet<>(), normalizedPath)
68+
);
69+
if (exclusivePath.componentName().equals(efe.componentName()) == false) {
70+
throw new IllegalArgumentException(
71+
"Path ["
72+
+ normalizedPath
73+
+ "] is already exclusive to ["
74+
+ exclusivePath.componentName()
75+
+ "]"
76+
+ exclusivePath.moduleNames
77+
+ ", cannot add exclusive access for ["
78+
+ efe.componentName()
79+
+ "]["
80+
+ efe.moduleName
81+
+ "]"
82+
);
83+
}
84+
exclusivePath.moduleNames.add(efe.moduleName());
6185
}
6286
}
6387
}
6488
}
65-
return exclusivePaths.stream().sorted(comparing(ExclusivePath::path, PATH_ORDER)).distinct().toList();
89+
return exclusivePaths.values().stream().sorted(comparing(ExclusivePath::path, PATH_ORDER)).distinct().toList();
6690
}
6791

6892
static void validateExclusivePaths(List<ExclusivePath> exclusivePaths) {
@@ -97,7 +121,7 @@ private FileAccessTree(
97121
) {
98122
List<String> updatedExclusivePaths = new ArrayList<>();
99123
for (ExclusivePath exclusivePath : exclusivePaths) {
100-
if (exclusivePath.componentName().equals(componentName) == false || exclusivePath.moduleName().equals(moduleName) == false) {
124+
if (exclusivePath.componentName().equals(componentName) == false || exclusivePath.moduleNames().contains(moduleName) == false) {
101125
updatedExclusivePaths.add(exclusivePath.path());
102126
}
103127
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ public PathSettingFileData withExclusive(boolean exclusive) {
164164
public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
165165
Stream<String> result = pathLookup.settingResolver()
166166
.apply(setting)
167-
.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
167+
.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false)
168+
.distinct();
168169
return result.map(Path::of);
169170
}
170171

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTreeTests.java‎

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.util.HashMap;
2727
import java.util.List;
2828
import java.util.Map;
29+
import java.util.Set;
2930

3031
import static org.elasticsearch.core.PathUtils.getDefaultFileSystem;
3132
import static org.elasticsearch.entitlement.runtime.policy.FileAccessTree.buildExclusivePathList;
@@ -386,7 +387,7 @@ public void testDuplicateExclusivePaths() {
386387
original.moduleName(),
387388
new FilesEntitlement(List.of(originalFileData.withPlatform(WINDOWS)))
388389
);
389-
var originalExclusivePath = new ExclusivePath("component1", "module1", normalizePath(path("/a/b")));
390+
var originalExclusivePath = new ExclusivePath("component1", Set.of("module1"), normalizePath(path("/a/b")));
390391

391392
// Some basic tests
392393

@@ -406,27 +407,14 @@ public void testDuplicateExclusivePaths() {
406407
var distinctEntitlements = List.of(original, differentComponent, differentModule, differentPath);
407408
var distinctPaths = List.of(
408409
originalExclusivePath,
409-
new ExclusivePath("component2", original.moduleName(), originalExclusivePath.path()),
410-
new ExclusivePath(original.componentName(), "module2", originalExclusivePath.path()),
411-
new ExclusivePath(original.componentName(), original.moduleName(), normalizePath(path("/c/d")))
410+
new ExclusivePath("component2", Set.of(original.moduleName()), originalExclusivePath.path()),
411+
new ExclusivePath(original.componentName(), Set.of("module2"), originalExclusivePath.path()),
412+
new ExclusivePath(original.componentName(), Set.of(original.moduleName()), normalizePath(path("/c/d")))
412413
);
413-
assertEquals(
414-
"Distinct elements should not be combined",
415-
distinctPaths,
416-
buildExclusivePathList(distinctEntitlements, TEST_PATH_LOOKUP)
417-
);
418-
419-
// Do merge things we should
420-
421-
List<ExclusiveFileEntitlement> interleavedEntitlements = new ArrayList<>();
422-
distinctEntitlements.forEach(e -> {
423-
interleavedEntitlements.add(e);
424-
interleavedEntitlements.add(original);
425-
});
426-
assertEquals(
427-
"Identical elements should be combined wherever they are in the list",
428-
distinctPaths,
429-
buildExclusivePathList(interleavedEntitlements, TEST_PATH_LOOKUP)
414+
var iae = expectThrows(IllegalArgumentException.class, () -> buildExclusivePathList(distinctEntitlements, TEST_PATH_LOOKUP));
415+
assertThat(
416+
iae.getMessage(),
417+
equalTo("Path [/a/b] is already exclusive to [component1][module1], cannot add exclusive access for [component2][module1]")
430418
);
431419

432420
var equivalentEntitlements = List.of(original, differentMode, differentPlatform);
@@ -486,7 +474,7 @@ static FilesEntitlement entitlement(Map<String, String> value) {
486474
static List<ExclusivePath> exclusivePaths(String componentName, String moduleName, String... paths) {
487475
List<ExclusivePath> exclusivePaths = new ArrayList<>();
488476
for (String path : paths) {
489-
exclusivePaths.add(new ExclusivePath(componentName, moduleName, normalizePath(path(path))));
477+
exclusivePaths.add(new ExclusivePath(componentName, Set.of(moduleName), normalizePath(path(path))));
490478
}
491479
return exclusivePaths;
492480
}

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyManagerTests.java‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
import static org.elasticsearch.entitlement.runtime.policy.PolicyManager.ALL_UNNAMED;
3939
import static org.elasticsearch.entitlement.runtime.policy.PolicyManager.SERVER_COMPONENT_NAME;
4040
import static org.hamcrest.Matchers.aMapWithSize;
41+
import static org.hamcrest.Matchers.equalTo;
4142
import static org.hamcrest.Matchers.is;
4243
import static org.hamcrest.Matchers.sameInstance;
4344

@@ -444,9 +445,9 @@ public void testDuplicateEntitlements() {
444445
}
445446

446447
public void testFilesEntitlementsWithExclusive() {
447-
var baseTestPath = Path.of("/tmp").toAbsolutePath();
448-
var testPath1 = Path.of("/tmp/test").toAbsolutePath();
449-
var testPath2 = Path.of("/tmp/test/foo").toAbsolutePath();
448+
var baseTestPath = Path.of("/base").toAbsolutePath();
449+
var testPath1 = Path.of("/base/test").toAbsolutePath();
450+
var testPath2 = Path.of("/base/test/foo").toAbsolutePath();
450451
var iae = expectThrows(
451452
IllegalArgumentException.class,
452453
() -> new PolicyManager(
@@ -458,7 +459,7 @@ public void testFilesEntitlementsWithExclusive() {
458459
"test",
459460
List.of(
460461
new Scope(
461-
"test",
462+
"test.module1",
462463
List.of(
463464
new FilesEntitlement(
464465
List.of(FilesEntitlement.FileData.ofPath(testPath1, FilesEntitlement.Mode.READ).withExclusive(true))
@@ -472,7 +473,7 @@ public void testFilesEntitlementsWithExclusive() {
472473
"test",
473474
List.of(
474475
new Scope(
475-
"test",
476+
"test.module2",
476477
List.of(
477478
new FilesEntitlement(
478479
List.of(FilesEntitlement.FileData.ofPath(testPath1, FilesEntitlement.Mode.READ).withExclusive(true))
@@ -490,8 +491,13 @@ public void testFilesEntitlementsWithExclusive() {
490491
Set.of()
491492
)
492493
);
493-
assertTrue(iae.getMessage().contains("duplicate/overlapping exclusive paths found in files entitlements:"));
494-
assertTrue(iae.getMessage().contains(Strings.format("[test] [%s]]", testPath1.toString())));
494+
assertThat(
495+
iae.getMessage(),
496+
equalTo(
497+
"Path [/base/test] is already exclusive to [plugin1][test.module1],"
498+
+ " cannot add exclusive access for [plugin2][test.module2]"
499+
)
500+
);
495501

496502
iae = expectThrows(
497503
IllegalArgumentException.class,

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemKeyConfig.java‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,9 @@
1010
package org.elasticsearch.common.ssl;
1111

1212
import org.elasticsearch.core.Tuple;
13-
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
1413

1514
import java.io.IOException;
1615
import java.nio.file.Path;
17-
import java.security.AccessControlException;
1816
import java.security.GeneralSecurityException;
1917
import java.security.KeyStore;
2018
import java.security.PrivateKey;
@@ -126,10 +124,8 @@ private PrivateKey getPrivateKey(Path path) {
126124
throw new SslConfigException("could not load ssl private key file [" + path + "]");
127125
}
128126
return privateKey;
129-
} catch (AccessControlException e) {
127+
} catch (SecurityException e) {
130128
throw SslFileUtil.accessControlFailure(KEY_FILE_TYPE, List.of(path), e, configBasePath);
131-
} catch (NotEntitledException e) {
132-
throw SslFileUtil.notEntitledFailure(KEY_FILE_TYPE, List.of(path), e, configBasePath);
133129
} catch (IOException e) {
134130
throw SslFileUtil.ioException(KEY_FILE_TYPE, List.of(path), e);
135131
} catch (GeneralSecurityException e) {
@@ -140,7 +136,7 @@ private PrivateKey getPrivateKey(Path path) {
140136
private List<Certificate> getCertificates(Path path) {
141137
try {
142138
return PemUtils.readCertificates(Collections.singleton(path));
143-
} catch (AccessControlException e) {
139+
} catch (SecurityException e) {
144140
throw SslFileUtil.accessControlFailure(CERT_FILE_TYPE, List.of(path), e, configBasePath);
145141
} catch (IOException e) {
146142
throw SslFileUtil.ioException(CERT_FILE_TYPE, List.of(path), e);

0 commit comments

Comments
 (0)