Skip to content

Commit 678738a

Browse files
ldematteldematte
authored
[Entitlements] Add URLConnection instrumentation (#123503)
1 parent 7560e2e commit 678738a

File tree

11 files changed

+474
-12
lines changed

11 files changed

+474
-12
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,9 +322,57 @@ public interface EntitlementChecker {
322322

323323
void check$java_net_Socket$connect(Class<?> callerClass, Socket that, SocketAddress endpoint, int backlog);
324324

325-
// Network miscellanea
325+
// URLConnection (java.net + sun.net.www)
326+
327+
void check$java_net_URL$openConnection(Class<?> callerClass, java.net.URL that);
328+
326329
void check$java_net_URL$openConnection(Class<?> callerClass, java.net.URL that, Proxy proxy);
327330

331+
void check$java_net_URL$openStream(Class<?> callerClass, java.net.URL that);
332+
333+
void check$java_net_URL$getContent(Class<?> callerClass, java.net.URL that);
334+
335+
void check$java_net_URL$getContent(Class<?> callerClass, java.net.URL that, Class<?>[] classes);
336+
337+
void check$java_net_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that);
338+
339+
void check$java_net_URLConnection$getContentLengthLong(Class<?> callerClass, java.net.URLConnection that);
340+
341+
void check$java_net_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that);
342+
343+
void check$java_net_URLConnection$getContentEncoding(Class<?> callerClass, java.net.URLConnection that);
344+
345+
void check$java_net_URLConnection$getExpiration(Class<?> callerClass, java.net.URLConnection that);
346+
347+
void check$java_net_URLConnection$getDate(Class<?> callerClass, java.net.URLConnection that);
348+
349+
void check$java_net_URLConnection$getLastModified(Class<?> callerClass, java.net.URLConnection that);
350+
351+
void check$java_net_URLConnection$getHeaderFieldInt(Class<?> callerClass, java.net.URLConnection that, String name, int defaultValue);
352+
353+
void check$java_net_URLConnection$getHeaderFieldLong(Class<?> callerClass, java.net.URLConnection that, String name, long defaultValue);
354+
355+
void check$java_net_URLConnection$getHeaderFieldDate(Class<?> callerClass, java.net.URLConnection that, String name, long defaultValue);
356+
357+
void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that);
358+
359+
void check$java_net_URLConnection$getContent(Class<?> callerClass, java.net.URLConnection that, Class<?>[] classes);
360+
361+
// Using java.net.URLConnection for "that" as sun.net.www.URLConnection is not exported
362+
void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, String name);
363+
364+
void check$sun_net_www_URLConnection$getHeaderFields(Class<?> callerClass, java.net.URLConnection that);
365+
366+
void check$sun_net_www_URLConnection$getHeaderFieldKey(Class<?> callerClass, java.net.URLConnection that, int n);
367+
368+
void check$sun_net_www_URLConnection$getHeaderField(Class<?> callerClass, java.net.URLConnection that, int n);
369+
370+
void check$sun_net_www_URLConnection$getContentType(Class<?> callerClass, java.net.URLConnection that);
371+
372+
void check$sun_net_www_URLConnection$getContentLength(Class<?> callerClass, java.net.URLConnection that);
373+
374+
// Network miscellanea
375+
328376
// HttpClient#send and sendAsync are abstract, so we instrument their internal implementations
329377
void check$jdk_internal_net_http_HttpClientImpl$send(
330378
Class<?> callerClass,

‎libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
import org.elasticsearch.core.SuppressForbidden;
1313

1414
import java.io.IOException;
15+
import java.net.URI;
16+
import java.net.URLConnection;
1517
import java.nio.file.Files;
1618
import java.nio.file.Path;
1719
import java.nio.file.Paths;
@@ -57,4 +59,8 @@ public static Path createTempDirectoryForWrite() throws IOException {
5759
public static Path createTempSymbolicLink() throws IOException {
5860
return Files.createSymbolicLink(readDir().resolve("entitlements-link-" + random.nextLong()), readWriteDir());
5961
}
62+
63+
public static URLConnection createHttpURLConnection() throws IOException {
64+
return URI.create("http://127.0.0.1:12345/").toURL().openConnection();
65+
}
6066
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/NetworkAccessCheckActions.java‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818
import java.net.ServerSocket;
1919
import java.net.Socket;
2020
import java.net.SocketException;
21-
import java.net.URI;
22-
import java.net.URISyntaxException;
2321
import java.nio.ByteBuffer;
2422
import java.nio.channels.AsynchronousServerSocketChannel;
2523
import java.nio.channels.AsynchronousSocketChannel;
@@ -75,12 +73,6 @@ static void socketConnect() throws IOException {
7573
}
7674
}
7775

78-
static void urlOpenConnectionWithProxy() throws URISyntaxException, IOException {
79-
var url = new URI("http://localhost").toURL();
80-
var urlConnection = url.openConnection(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(0)));
81-
assert urlConnection != null;
82-
}
83-
8476
static void createLDAPCertStore() {
8577
try {
8678
// We pass down null params to provoke a InvalidAlgorithmParameterException

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,6 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
143143
entry("server_socket_bind", forPlugins(NetworkAccessCheckActions::serverSocketBind)),
144144
entry("server_socket_accept", forPlugins(NetworkAccessCheckActions::serverSocketAccept)),
145145

146-
entry("url_open_connection_proxy", forPlugins(NetworkAccessCheckActions::urlOpenConnectionWithProxy)),
147146
entry("http_client_send", forPlugins(VersionSpecificNetworkChecks::httpClientSend)),
148147
entry("http_client_send_async", forPlugins(VersionSpecificNetworkChecks::httpClientSendAsync)),
149148
entry("create_ldap_cert_store", forPlugins(NetworkAccessCheckActions::createLDAPCertStore)),
@@ -194,7 +193,8 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
194193
getTestEntries(NioFileSystemActions.class),
195194
getTestEntries(PathActions.class),
196195
getTestEntries(SpiActions.class),
197-
getTestEntries(SystemActions.class)
196+
getTestEntries(SystemActions.class),
197+
getTestEntries(URLConnectionNetworkActions.class)
198198
)
199199
.flatMap(Function.identity())
200200
.filter(entry -> entry.getValue().fromJavaVersion() == null || Runtime.version().feature() >= entry.getValue().fromJavaVersion())

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/URLConnectionNetworkActions.java‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import org.elasticsearch.core.CheckedConsumer;
13+
import org.elasticsearch.core.SuppressForbidden;
14+
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
15+
16+
import java.io.IOException;
17+
import java.io.InputStream;
18+
import java.net.ConnectException;
19+
import java.net.HttpURLConnection;
20+
import java.net.InetSocketAddress;
21+
import java.net.MalformedURLException;
22+
import java.net.Proxy;
23+
import java.net.URI;
24+
import java.net.URISyntaxException;
25+
import java.net.URL;
26+
import java.net.URLConnection;
27+
28+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
29+
30+
@SuppressWarnings("unused") // everything is called via reflection
31+
class URLConnectionNetworkActions {
32+
33+
private static final URL HTTP_URL;
34+
35+
static {
36+
try {
37+
HTTP_URL = URI.create("http://127.0.0.1/").toURL();
38+
} catch (MalformedURLException e) {
39+
throw new RuntimeException(e);
40+
}
41+
}
42+
43+
private static void withPlainNetworkConnection(CheckedConsumer<URLConnection, Exception> connectionConsumer) throws Exception {
44+
// Create a HttpURLConnection with minimal overrides to test calling directly into URLConnection methods as much as possible
45+
var conn = new HttpURLConnection(HTTP_URL) {
46+
@Override
47+
public void connect() {}
48+
49+
@Override
50+
public void disconnect() {}
51+
52+
@Override
53+
public boolean usingProxy() {
54+
return false;
55+
}
56+
57+
@Override
58+
public InputStream getInputStream() throws IOException {
59+
// Mock an attempt to call connect
60+
throw new ConnectException();
61+
}
62+
};
63+
64+
try {
65+
connectionConsumer.accept(conn);
66+
} catch (java.net.ConnectException e) {
67+
// It's OK, it means we passed entitlement checks, and we tried to connect
68+
}
69+
}
70+
71+
private static void withJdkHttpConnection(CheckedConsumer<HttpURLConnection, Exception> connectionConsumer) throws Exception {
72+
var conn = EntitledActions.createHttpURLConnection();
73+
// Be sure we got the connection implementation we want
74+
assert HttpURLConnection.class.isAssignableFrom(conn.getClass());
75+
try {
76+
connectionConsumer.accept((HttpURLConnection) conn);
77+
} catch (java.net.ConnectException e) {
78+
// It's OK, it means we passed entitlement checks, and we tried to connect
79+
}
80+
}
81+
82+
@EntitlementTest(expectedAccess = PLUGINS)
83+
static void urlOpenConnection() throws Exception {
84+
URI.create("http://127.0.0.1:12345/").toURL().openConnection();
85+
}
86+
87+
@EntitlementTest(expectedAccess = PLUGINS)
88+
@SuppressForbidden(reason = "just testing, not a real connection")
89+
static void urlOpenConnectionWithProxy() throws URISyntaxException, IOException {
90+
var url = new URI("http://localhost").toURL();
91+
var urlConnection = url.openConnection(new Proxy(Proxy.Type.HTTP, new InetSocketAddress(0)));
92+
assert urlConnection != null;
93+
}
94+
95+
@EntitlementTest(expectedAccess = PLUGINS)
96+
static void urlOpenStream() throws Exception {
97+
try {
98+
URI.create("http://127.0.0.1:12345/").toURL().openStream().close();
99+
} catch (java.net.ConnectException e) {
100+
// It's OK, it means we passed entitlement checks, and we tried to connect
101+
}
102+
}
103+
104+
@EntitlementTest(expectedAccess = PLUGINS)
105+
static void urlGetContent() throws Exception {
106+
try {
107+
URI.create("http://127.0.0.1:12345/").toURL().getContent();
108+
} catch (java.net.ConnectException e) {
109+
// It's OK, it means we passed entitlement checks, and we tried to connect
110+
}
111+
}
112+
113+
@EntitlementTest(expectedAccess = PLUGINS)
114+
static void urlGetContentWithClasses() throws Exception {
115+
try {
116+
URI.create("http://127.0.0.1:12345/").toURL().getContent(new Class<?>[] { String.class });
117+
} catch (java.net.ConnectException e) {
118+
// It's OK, it means we passed entitlement checks, and we tried to connect
119+
}
120+
}
121+
122+
@EntitlementTest(expectedAccess = PLUGINS)
123+
static void baseUrlConnectionGetContentLength() throws Exception {
124+
withPlainNetworkConnection(URLConnection::getContentLength);
125+
}
126+
127+
@EntitlementTest(expectedAccess = PLUGINS)
128+
static void sunHttpConnectionGetContentLength() throws Exception {
129+
withJdkHttpConnection(URLConnection::getContentLength);
130+
}
131+
132+
@EntitlementTest(expectedAccess = PLUGINS)
133+
static void baseUrlConnectionGetContentType() throws Exception {
134+
withPlainNetworkConnection(URLConnection::getContentType);
135+
}
136+
137+
@EntitlementTest(expectedAccess = PLUGINS)
138+
static void sunHttpConnectionGetContentType() throws Exception {
139+
withJdkHttpConnection(URLConnection::getContentType);
140+
}
141+
142+
@EntitlementTest(expectedAccess = PLUGINS)
143+
static void baseUrlConnectionGetContentEncoding() throws Exception {
144+
withPlainNetworkConnection(URLConnection::getContentEncoding);
145+
}
146+
147+
@EntitlementTest(expectedAccess = PLUGINS)
148+
static void sunHttpConnectionGetContentEncoding() throws Exception {
149+
withJdkHttpConnection(URLConnection::getContentEncoding);
150+
}
151+
152+
@EntitlementTest(expectedAccess = PLUGINS)
153+
static void baseUrlConnectionGetExpiration() throws Exception {
154+
withPlainNetworkConnection(URLConnection::getExpiration);
155+
}
156+
157+
@EntitlementTest(expectedAccess = PLUGINS)
158+
static void sunHttpConnectionGetExpiration() throws Exception {
159+
withJdkHttpConnection(URLConnection::getExpiration);
160+
}
161+
162+
@EntitlementTest(expectedAccess = PLUGINS)
163+
static void baseUrlConnectionGetDate() throws Exception {
164+
withPlainNetworkConnection(URLConnection::getDate);
165+
}
166+
167+
@EntitlementTest(expectedAccess = PLUGINS)
168+
static void sunHttpConnectionGetDate() throws Exception {
169+
withJdkHttpConnection(URLConnection::getDate);
170+
}
171+
172+
@EntitlementTest(expectedAccess = PLUGINS)
173+
static void baseUrlConnectionGetLastModified() throws Exception {
174+
withPlainNetworkConnection(URLConnection::getLastModified);
175+
}
176+
177+
@EntitlementTest(expectedAccess = PLUGINS)
178+
static void sunHttpConnectionGetLastModified() throws Exception {
179+
withJdkHttpConnection(URLConnection::getLastModified);
180+
}
181+
182+
@EntitlementTest(expectedAccess = PLUGINS)
183+
static void baseUrlConnectionGetHeaderFieldInt() throws Exception {
184+
withPlainNetworkConnection(conn -> conn.getHeaderFieldInt("field", 0));
185+
}
186+
187+
@EntitlementTest(expectedAccess = PLUGINS)
188+
static void sunHttpConnectionGetHeaderFieldInt() throws Exception {
189+
withJdkHttpConnection(conn -> conn.getHeaderFieldInt("field", 0));
190+
}
191+
192+
@EntitlementTest(expectedAccess = PLUGINS)
193+
static void baseUrlConnectionGetHeaderFieldLong() throws Exception {
194+
withPlainNetworkConnection(conn -> conn.getHeaderFieldLong("field", 0));
195+
}
196+
197+
@EntitlementTest(expectedAccess = PLUGINS)
198+
static void sunHttpConnectionGetHeaderFieldLong() throws Exception {
199+
withJdkHttpConnection(conn -> conn.getHeaderFieldLong("field", 0));
200+
}
201+
202+
@EntitlementTest(expectedAccess = PLUGINS)
203+
static void baseUrlConnectionGetContent() throws Exception {
204+
withPlainNetworkConnection(URLConnection::getContent);
205+
}
206+
207+
@EntitlementTest(expectedAccess = PLUGINS)
208+
static void sunHttpConnectionGetContent() throws Exception {
209+
withJdkHttpConnection(URLConnection::getContent);
210+
}
211+
212+
@EntitlementTest(expectedAccess = PLUGINS)
213+
static void baseUrlConnectionGetContentWithClasses() throws Exception {
214+
withPlainNetworkConnection(conn -> conn.getContent(new Class<?>[] { String.class }));
215+
}
216+
217+
@EntitlementTest(expectedAccess = PLUGINS)
218+
static void sunHttpConnectionGetContentWithClasses() throws Exception {
219+
withJdkHttpConnection(conn -> conn.getContent(new Class<?>[] { String.class }));
220+
}
221+
}

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsTestRule.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ class EntitlementsTestRule implements TestRule {
3434
// entitlements that test methods may use, see EntitledActions
3535
private static final PolicyBuilder ENTITLED_POLICY = (builder, tempDir) -> {
3636
builder.value("manage_threads");
37+
builder.value("outbound_network");
3738
builder.value(
3839
Map.of(
3940
"files",

0 commit comments

Comments
 (0)