Skip to content

Commit 7797f0a

Browse files
tvernumtvernum
committed
fix mocks in 'SecurityServerTransportInterceptorTests'
1 parent ac9c5f4 commit 7797f0a

File tree

1 file changed

+52
-20
lines changed

1 file changed

+52
-20
lines changed

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptorTests.java‎

Lines changed: 52 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@
2121
import org.elasticsearch.common.settings.ClusterSettings;
2222
import org.elasticsearch.common.settings.SecureString;
2323
import org.elasticsearch.common.settings.Settings;
24+
import org.elasticsearch.common.ssl.DefaultJdkTrustConfig;
25+
import org.elasticsearch.common.ssl.EmptyKeyConfig;
2426
import org.elasticsearch.common.ssl.SslClientAuthenticationMode;
2527
import org.elasticsearch.common.ssl.SslConfiguration;
28+
import org.elasticsearch.common.ssl.SslConfigurationLoader;
2629
import org.elasticsearch.common.ssl.SslKeyConfig;
2730
import org.elasticsearch.common.ssl.SslTrustConfig;
2831
import org.elasticsearch.common.ssl.SslVerificationMode;
@@ -59,6 +62,7 @@
5962
import org.elasticsearch.xpack.core.security.user.SystemUser;
6063
import org.elasticsearch.xpack.core.security.user.User;
6164
import org.elasticsearch.xpack.core.ssl.SSLService;
65+
import org.elasticsearch.xpack.core.ssl.SslProfile;
6266
import org.elasticsearch.xpack.security.Security;
6367
import org.elasticsearch.xpack.security.audit.AuditUtil;
6468
import org.elasticsearch.xpack.security.authc.ApiKeyService;
@@ -148,7 +152,7 @@ public void testSendAsync() throws Exception {
148152
threadPool,
149153
mock(AuthenticationService.class),
150154
mock(AuthorizationService.class),
151-
mock(SSLService.class),
155+
mockSslService(),
152156
securityContext,
153157
new DestructiveOperations(
154158
Settings.EMPTY,
@@ -199,7 +203,7 @@ public void testSendAsyncSwitchToSystem() throws Exception {
199203
threadPool,
200204
mock(AuthenticationService.class),
201205
mock(AuthorizationService.class),
202-
mock(SSLService.class),
206+
mockSslService(),
203207
securityContext,
204208
new DestructiveOperations(
205209
Settings.EMPTY,
@@ -243,7 +247,7 @@ public void testSendWithoutUser() throws Exception {
243247
threadPool,
244248
mock(AuthenticationService.class),
245249
mock(AuthorizationService.class),
246-
mock(SSLService.class),
250+
mockSslService(),
247251
securityContext,
248252
new DestructiveOperations(
249253
Settings.EMPTY,
@@ -305,7 +309,7 @@ public void testSendToNewerVersionSetsCorrectVersion() throws Exception {
305309
threadPool,
306310
mock(AuthenticationService.class),
307311
mock(AuthorizationService.class),
308-
mock(SSLService.class),
312+
mockSslService(),
309313
securityContext,
310314
new DestructiveOperations(
311315
Settings.EMPTY,
@@ -373,7 +377,7 @@ public void testSendToOlderVersionSetsCorrectVersion() throws Exception {
373377
threadPool,
374378
mock(AuthenticationService.class),
375379
mock(AuthorizationService.class),
376-
mock(SSLService.class),
380+
mockSslService(),
377381
securityContext,
378382
new DestructiveOperations(
379383
Settings.EMPTY,
@@ -439,7 +443,7 @@ public void testSetUserBasedOnActionOrigin() {
439443
threadPool,
440444
mock(AuthenticationService.class),
441445
mock(AuthorizationService.class),
442-
mock(SSLService.class),
446+
mockSslService(),
443447
securityContext,
444448
new DestructiveOperations(
445449
Settings.EMPTY,
@@ -606,7 +610,7 @@ public void testSendWithCrossClusterAccessHeadersWithUnsupportedLicense() throws
606610
threadPool,
607611
mock(AuthenticationService.class),
608612
mock(AuthorizationService.class),
609-
mock(SSLService.class),
613+
mockSslService(),
610614
securityContext,
611615
new DestructiveOperations(
612616
Settings.EMPTY,
@@ -743,7 +747,7 @@ private void doTestSendWithCrossClusterAccessHeaders(
743747
threadPool,
744748
mock(AuthenticationService.class),
745749
authzService,
746-
mock(SSLService.class),
750+
mockSslService(),
747751
securityContext,
748752
new DestructiveOperations(
749753
Settings.EMPTY,
@@ -881,7 +885,7 @@ public void testSendWithUserIfCrossClusterAccessHeadersConditionNotMet() throws
881885
threadPool,
882886
mock(AuthenticationService.class),
883887
authzService,
884-
mock(SSLService.class),
888+
mockSslService(),
885889
securityContext,
886890
new DestructiveOperations(
887891
Settings.EMPTY,
@@ -940,7 +944,7 @@ public void testSendWithCrossClusterAccessHeadersThrowsOnOldConnection() throws
940944
threadPool,
941945
mock(AuthenticationService.class),
942946
mock(AuthorizationService.class),
943-
mock(SSLService.class),
947+
mockSslService(),
944948
securityContext,
945949
new DestructiveOperations(
946950
Settings.EMPTY,
@@ -1039,7 +1043,7 @@ public void testSendRemoteRequestFailsIfUserHasNoRemoteIndicesPrivileges() throw
10391043
threadPool,
10401044
mock(AuthenticationService.class),
10411045
authzService,
1042-
mock(SSLService.class),
1046+
mockSslService(),
10431047
securityContext,
10441048
new DestructiveOperations(
10451049
Settings.EMPTY,
@@ -1107,9 +1111,9 @@ public void testProfileFiltersCreatedDifferentlyForDifferentTransportAndRemoteCl
11071111
if (randomBoolean()) {
11081112
builder.put("xpack.security.remote_cluster_client.ssl.enabled", randomBoolean()); // client SSL won't be processed
11091113
}
1110-
final SSLService sslService = mock(SSLService.class);
11111114

1112-
when(sslService.getSSLConfiguration("xpack.security.transport.ssl.")).thenReturn(
1115+
final SslProfile defaultProfile = mock(SslProfile.class);
1116+
when(defaultProfile.configuration()).thenReturn(
11131117
new SslConfiguration(
11141118
"xpack.security.transport.ssl",
11151119
randomBoolean(),
@@ -1122,8 +1126,8 @@ public void testProfileFiltersCreatedDifferentlyForDifferentTransportAndRemoteCl
11221126
randomLongBetween(1, 100000)
11231127
)
11241128
);
1125-
1126-
when(sslService.getSSLConfiguration("xpack.security.remote_cluster_server.ssl.")).thenReturn(
1129+
final SslProfile remoteProfile = mock(SslProfile.class);
1130+
when(defaultProfile.configuration()).thenReturn(
11271131
new SslConfiguration(
11281132
"xpack.security.remote_cluster_server.ssl",
11291133
randomBoolean(),
@@ -1136,8 +1140,13 @@ public void testProfileFiltersCreatedDifferentlyForDifferentTransportAndRemoteCl
11361140
randomLongBetween(1, 100000)
11371141
)
11381142
);
1143+
1144+
final SSLService sslService = mock(SSLService.class);
1145+
when(sslService.profile("xpack.security.transport.ssl.")).thenReturn(defaultProfile);
1146+
1147+
when(sslService.profile("xpack.security.remote_cluster_server.ssl.")).thenReturn(remoteProfile);
11391148
doThrow(new AssertionError("profile filters should not be configured for remote cluster client")).when(sslService)
1140-
.getSSLConfiguration("xpack.security.remote_cluster_client.ssl.");
1149+
.profile("xpack.security.remote_cluster_client.ssl.");
11411150

11421151
final var securityServerTransportInterceptor = new SecurityServerTransportInterceptor(
11431152
builder.build(),
@@ -1172,9 +1181,9 @@ public void testNoProfileFilterForRemoteClusterWhenTheFeatureIsDisabled() {
11721181
if (randomBoolean()) {
11731182
builder.put("xpack.security.remote_cluster_client.ssl.enabled", randomBoolean()); // client SSL won't be processed
11741183
}
1175-
final SSLService sslService = mock(SSLService.class);
11761184

1177-
when(sslService.getSSLConfiguration("xpack.security.transport.ssl.")).thenReturn(
1185+
final SslProfile profile = mock(SslProfile.class);
1186+
when(profile.configuration()).thenReturn(
11781187
new SslConfiguration(
11791188
"xpack.security.transport.ssl",
11801189
randomBoolean(),
@@ -1187,11 +1196,15 @@ public void testNoProfileFilterForRemoteClusterWhenTheFeatureIsDisabled() {
11871196
randomLongBetween(1, 100000)
11881197
)
11891198
);
1199+
1200+
final SSLService sslService = mock(SSLService.class);
1201+
when(sslService.profile("xpack.security.transport.ssl.")).thenReturn(profile);
1202+
11901203
doThrow(new AssertionError("profile filters should not be configured for remote cluster server when the port is disabled")).when(
11911204
sslService
1192-
).getSSLConfiguration("xpack.security.remote_cluster_server.ssl.");
1205+
).profile("xpack.security.remote_cluster_server.ssl.");
11931206
doThrow(new AssertionError("profile filters should not be configured for remote cluster client")).when(sslService)
1194-
.getSSLConfiguration("xpack.security.remote_cluster_client.ssl.");
1207+
.profile("xpack.security.remote_cluster_client.ssl.");
11951208

11961209
final var securityServerTransportInterceptor = new SecurityServerTransportInterceptor(
11971210
builder.build(),
@@ -1213,6 +1226,25 @@ public void testNoProfileFilterForRemoteClusterWhenTheFeatureIsDisabled() {
12131226
assertThat(profileFilters.get("default").isExtractClientCert(), is(transportSslEnabled));
12141227
}
12151228

1229+
private static SSLService mockSslService() {
1230+
final SslConfiguration defaultConfiguration = new SslConfiguration(
1231+
"",
1232+
false,
1233+
DefaultJdkTrustConfig.DEFAULT_INSTANCE,
1234+
EmptyKeyConfig.INSTANCE,
1235+
SslVerificationMode.FULL,
1236+
SslClientAuthenticationMode.NONE,
1237+
List.of("TLS_AES_256_GCM_SHA384"),
1238+
List.of("TLSv1.3"),
1239+
-1
1240+
);
1241+
final SslProfile defaultProfile = mock(SslProfile.class);
1242+
when(defaultProfile.configuration()).thenReturn(defaultConfiguration);
1243+
final SSLService sslService = mock(SSLService.class);
1244+
when(sslService.profile("xpack.security.transport.ssl")).thenReturn(defaultProfile);
1245+
return sslService;
1246+
}
1247+
12161248
private String[] randomRoles() {
12171249
return generateRandomStringArray(3, 10, false, true);
12181250
}

0 commit comments

Comments
 (0)