Skip to content

Commit 7d0b3da

Browse files
salvatore-campagnasalvatore-campagna
authored
Merge branch 'main' into feature/synthtic-source-recovery-default
2 parents ad7d742 + 0cf0009 commit 7d0b3da

File tree

14 files changed

+345
-267
lines changed

14 files changed

+345
-267
lines changed

‎.buildkite/pipelines/intake.template.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ steps:
9696
- trigger: elasticsearch-dra-workflow
9797
label: Trigger DRA snapshot workflow
9898
async: true
99-
branches: "main 8.* 7.17"
99+
branches: "main 9.* 8.* 7.17"
100100
build:
101101
branch: "$BUILDKITE_BRANCH"
102102
commit: "$BUILDKITE_COMMIT"

‎.buildkite/pipelines/intake.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ steps:
9797
- trigger: elasticsearch-dra-workflow
9898
label: Trigger DRA snapshot workflow
9999
async: true
100-
branches: "main 8.* 7.17"
100+
branches: "main 9.* 8.* 7.17"
101101
build:
102102
branch: "$BUILDKITE_BRANCH"
103103
commit: "$BUILDKITE_COMMIT"

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/EntitlementTest.java‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import java.lang.annotation.ElementType;
13+
import java.lang.annotation.Retention;
14+
import java.lang.annotation.RetentionPolicy;
15+
import java.lang.annotation.Target;
16+
17+
@Target(ElementType.METHOD)
18+
@Retention(RetentionPolicy.RUNTIME)
19+
public @interface EntitlementTest {
20+
enum ExpectedAccess {
21+
PLUGINS,
22+
ES_MODULES_ONLY,
23+
ALWAYS_DENIED
24+
}
25+
26+
ExpectedAccess expectedAccess();
27+
28+
int fromJavaVersion() default -1;
29+
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
import java.nio.file.attribute.UserPrincipal;
2323
import java.util.Scanner;
2424

25+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
26+
2527
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
2628
class FileCheckActions {
2729

@@ -43,38 +45,47 @@ private static Path readWriteFile() {
4345
return testRootDir.resolve("read_write_file");
4446
}
4547

48+
@EntitlementTest(expectedAccess = PLUGINS)
4649
static void createScannerFile() throws FileNotFoundException {
4750
new Scanner(readFile().toFile());
4851
}
4952

53+
@EntitlementTest(expectedAccess = PLUGINS)
5054
static void createScannerFileWithCharset() throws IOException {
5155
new Scanner(readFile().toFile(), StandardCharsets.UTF_8);
5256
}
5357

58+
@EntitlementTest(expectedAccess = PLUGINS)
5459
static void createScannerFileWithCharsetName() throws FileNotFoundException {
5560
new Scanner(readFile().toFile(), "UTF-8");
5661
}
5762

63+
@EntitlementTest(expectedAccess = PLUGINS)
5864
static void createFileOutputStreamString() throws IOException {
5965
new FileOutputStream(readWriteFile().toString()).close();
6066
}
6167

68+
@EntitlementTest(expectedAccess = PLUGINS)
6269
static void createFileOutputStreamStringWithAppend() throws IOException {
6370
new FileOutputStream(readWriteFile().toString(), false).close();
6471
}
6572

73+
@EntitlementTest(expectedAccess = PLUGINS)
6674
static void createFileOutputStreamFile() throws IOException {
6775
new FileOutputStream(readWriteFile().toFile()).close();
6876
}
6977

78+
@EntitlementTest(expectedAccess = PLUGINS)
7079
static void createFileOutputStreamFileWithAppend() throws IOException {
7180
new FileOutputStream(readWriteFile().toFile(), false).close();
7281
}
7382

83+
@EntitlementTest(expectedAccess = PLUGINS)
7484
static void filesProbeContentType() throws IOException {
7585
Files.probeContentType(readFile());
7686
}
7787

88+
@EntitlementTest(expectedAccess = PLUGINS)
7889
static void filesSetOwner() throws IOException {
7990
UserPrincipal owner = EntitledActions.getFileOwner(readWriteFile());
8091
Files.setOwner(readWriteFile(), owner); // set to existing owner, just trying to execute the method

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 183 additions & 135 deletions
Large diffs are not rendered by default.

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,8 @@
99

1010
package org.elasticsearch.entitlement.runtime.policy;
1111

12-
import org.elasticsearch.core.SuppressForbidden;
1312
import org.elasticsearch.entitlement.runtime.policy.entitlements.FileEntitlement;
1413

15-
import java.io.File;
1614
import java.nio.file.Path;
1715
import java.util.ArrayList;
1816
import java.util.Arrays;
@@ -51,20 +49,10 @@ boolean canRead(Path path) {
5149
return checkPath(normalize(path), readPaths);
5250
}
5351

54-
@SuppressForbidden(reason = "Explicitly checking File apis")
55-
boolean canRead(File file) {
56-
return checkPath(normalize(file.toPath()), readPaths);
57-
}
58-
5952
boolean canWrite(Path path) {
6053
return checkPath(normalize(path), writePaths);
6154
}
6255

63-
@SuppressForbidden(reason = "Explicitly checking File apis")
64-
boolean canWrite(File file) {
65-
return checkPath(normalize(file.toPath()), writePaths);
66-
}
67-
6856
private static String normalize(Path path) {
6957
return path.toAbsolutePath().normalize().toString();
7058
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 3 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -169,23 +169,7 @@ private static void validateEntitlementsPerModule(String sourceName, String modu
169169
}
170170

171171
public void checkStartProcess(Class<?> callerClass) {
172-
neverEntitled(callerClass, "start process");
173-
}
174-
175-
private void neverEntitled(Class<?> callerClass, String operationDescription) {
176-
var requestingClass = requestingClass(callerClass);
177-
if (isTriviallyAllowed(requestingClass)) {
178-
return;
179-
}
180-
181-
throw new NotEntitledException(
182-
Strings.format(
183-
"Not entitled: caller [%s], module [%s], operation [%s]",
184-
callerClass,
185-
requestingClass.getModule() == null ? "<none>" : requestingClass.getModule().getName(),
186-
operationDescription
187-
)
188-
);
172+
neverEntitled(callerClass, () -> "start process");
189173
}
190174

191175
/**
@@ -241,31 +225,9 @@ public void checkChangeNetworkHandling(Class<?> callerClass) {
241225
checkChangeJVMGlobalState(callerClass);
242226
}
243227

244-
/**
245-
* Check for operations that can access sensitive network information, e.g. secrets, tokens or SSL sessions
246-
*/
247-
public void checkReadSensitiveNetworkInformation(Class<?> callerClass) {
248-
neverEntitled(callerClass, "access sensitive network information");
249-
}
250-
251228
@SuppressForbidden(reason = "Explicitly checking File apis")
252229
public void checkFileRead(Class<?> callerClass, File file) {
253-
var requestingClass = requestingClass(callerClass);
254-
if (isTriviallyAllowed(requestingClass)) {
255-
return;
256-
}
257-
258-
ModuleEntitlements entitlements = getEntitlements(requestingClass);
259-
if (entitlements.fileAccess().canRead(file) == false) {
260-
throw new NotEntitledException(
261-
Strings.format(
262-
"Not entitled: caller [%s], module [%s], entitlement [file], operation [read], path [%s]",
263-
callerClass,
264-
requestingClass.getModule(),
265-
file
266-
)
267-
);
268-
}
230+
checkFileRead(callerClass, file.toPath());
269231
}
270232

271233
public void checkFileRead(Class<?> callerClass, Path path) {
@@ -289,22 +251,7 @@ public void checkFileRead(Class<?> callerClass, Path path) {
289251

290252
@SuppressForbidden(reason = "Explicitly checking File apis")
291253
public void checkFileWrite(Class<?> callerClass, File file) {
292-
var requestingClass = requestingClass(callerClass);
293-
if (isTriviallyAllowed(requestingClass)) {
294-
return;
295-
}
296-
297-
ModuleEntitlements entitlements = getEntitlements(requestingClass);
298-
if (entitlements.fileAccess().canWrite(file) == false) {
299-
throw new NotEntitledException(
300-
Strings.format(
301-
"Not entitled: caller [%s], module [%s], entitlement [file], operation [write], path [%s]",
302-
callerClass,
303-
requestingClass.getModule(),
304-
file
305-
)
306-
);
307-
}
254+
checkFileWrite(callerClass, file.toPath());
308255
}
309256

310257
public void checkFileWrite(Class<?> callerClass, Path path) {

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyManagerTests.java‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,6 @@ public void testRequestingClassFastPath() throws IOException, ClassNotFoundExcep
238238
}
239239

240240
public void testRequestingModuleWithStackWalk() throws IOException, ClassNotFoundException {
241-
var agentsClass = new TestAgent();
242241
var entitlementsClass = makeClassInItsOwnModule(); // A class in the entitlements library itself
243242
var requestingClass = makeClassInItsOwnModule(); // This guy is always the right answer
244243
var instrumentedClass = makeClassInItsOwnModule(); // The class that called the check method
@@ -365,13 +364,6 @@ private static Class<?> makeClassInItsOwnModule() throws IOException, ClassNotFo
365364
return layer.findLoader("org.example.plugin").loadClass("q.B");
366365
}
367366

368-
private static Class<?> makeClassInItsOwnUnnamedModule() throws IOException, ClassNotFoundException {
369-
final Path home = createTempDir();
370-
Path jar = createMockPluginJar(home);
371-
var layer = createLayerForJar(jar, "org.example.plugin");
372-
return layer.findLoader("org.example.plugin").loadClass("q.B");
373-
}
374-
375367
private static PolicyManager policyManager(String agentsPackageName, Module entitlementsModule) {
376368
return new PolicyManager(createEmptyTestServerPolicy(), List.of(), Map.of(), c -> "test", agentsPackageName, entitlementsModule);
377369
}

‎muted-tests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,9 @@ tests:
389389
issue: https://github.com/elastic/elasticsearch/issues/121395
390390
- class: org.elasticsearch.test.rest.yaml.CcsCommonYamlTestSuiteIT
391391
issue: https://github.com/elastic/elasticsearch/issues/121407
392+
- class: org.elasticsearch.xpack.ml.integration.ClassificationIT
393+
method: testDependentVariableIsAliasToNested
394+
issue: https://github.com/elastic/elasticsearch/issues/121415
392395

393396
# Examples:
394397
#

‎rest-api-spec/src/main/resources/rest-api-spec/api/indices.resolve_cluster.json‎

Lines changed: 40 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,56 @@
11
{
2-
"indices.resolve_cluster":{
3-
"documentation":{
4-
"url":"https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-resolve-cluster-api.html",
5-
"description":"Resolves the specified index expressions to return information about each cluster, including the local cluster, if included."
2+
"indices.resolve_cluster": {
3+
"documentation": {
4+
"url": "https://www.elastic.co/guide/en/elasticsearch/reference/master/indices-resolve-cluster-api.html",
5+
"description": "Resolves the specified index expressions to return information about each cluster. If no index expression is provided, this endpoint will return information about all the remote clusters that are configured on the local cluster."
66
},
7-
"stability":"stable",
8-
"visibility":"public",
9-
"headers":{
10-
"accept": [ "application/json"]
7+
"stability": "stable",
8+
"visibility": "public",
9+
"headers": {
10+
"accept": ["application/json"]
1111
},
12-
"url":{
13-
"paths":[
12+
"url": {
13+
"paths": [
1414
{
15-
"path":"/_resolve/cluster/{name}",
16-
"methods":[
17-
"GET"
18-
],
19-
"parts":{
20-
"name":{
21-
"type":"list",
22-
"description":"A comma-separated list of cluster:index names or wildcard expressions"
15+
"path": "/_resolve/cluster",
16+
"methods": ["GET"]
17+
},
18+
{
19+
"path": "/_resolve/cluster/{name}",
20+
"methods": ["GET"],
21+
"parts": {
22+
"name": {
23+
"type": "list",
24+
"description": "A comma-separated list of cluster:index names or wildcard expressions"
2325
}
2426
}
2527
}
2628
]
2729
},
28-
"params":{
29-
"ignore_unavailable":{
30-
"type":"boolean",
31-
"description":"Whether specified concrete indices should be ignored when unavailable (missing or closed)"
30+
"params": {
31+
"ignore_unavailable": {
32+
"type": "boolean",
33+
"description": "Whether specified concrete indices should be ignored when unavailable (missing or closed). Only allowed when providing an index expression."
34+
},
35+
"ignore_throttled": {
36+
"type": "boolean",
37+
"description": "Whether specified concrete, expanded or aliased indices should be ignored when throttled. Only allowed when providing an index expression."
3238
},
33-
"ignore_throttled":{
34-
"type":"boolean",
35-
"description":"Whether specified concrete, expanded or aliased indices should be ignored when throttled"
39+
"allow_no_indices": {
40+
"type": "boolean",
41+
"description": "Whether to ignore if a wildcard indices expression resolves into no concrete indices. (This includes `_all` string or when no indices have been specified). Only allowed when providing an index expression."
3642
},
37-
"allow_no_indices":{
38-
"type":"boolean",
39-
"description":"Whether to ignore if a wildcard indices expression resolves into no concrete indices. (This includes `_all` string or when no indices have been specified)"
43+
"expand_wildcards": {
44+
"type": "enum",
45+
"options": ["open", "closed", "hidden", "none", "all"],
46+
"default": "open",
47+
"description": "Whether wildcard expressions should get expanded to open or closed indices (default: open). Only allowed when providing an index expression."
4048
},
41-
"expand_wildcards":{
42-
"type":"enum",
43-
"options":[
44-
"open",
45-
"closed",
46-
"hidden",
47-
"none",
48-
"all"
49-
],
50-
"default":"open",
51-
"description":"Whether wildcard expressions should get expanded to open or closed indices (default: open)"
49+
"timeout": {
50+
"type": "time",
51+
"description": "The maximum time to wait for remote clusters to respond"
5252
}
5353
}
5454
}
5555
}
56+

0 commit comments

Comments
 (0)