Skip to content

Commit af00bcd

Browse files
slobodanadamovicslobodanadamovic
committed
move to using new constructor part 3
1 parent 4981394 commit af00bcd

File tree

3 files changed

+70
-69
lines changed

3 files changed

+70
-69
lines changed

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterAccessTransportInterceptor.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import org.elasticsearch.tasks.TaskCancellationService;
2323
import org.elasticsearch.threadpool.ThreadPool;
2424
import org.elasticsearch.transport.RemoteConnectionManager;
25+
import org.elasticsearch.transport.RemoteConnectionManager.RemoteClusterAliasWithCredentials;
2526
import org.elasticsearch.transport.SendRequestTransportException;
2627
import org.elasticsearch.transport.Transport;
2728
import org.elasticsearch.transport.TransportInterceptor;
@@ -81,7 +82,7 @@ public class CrossClusterAccessTransportInterceptor implements RemoteClusterTran
8182

8283
private final Function<
8384
Transport.Connection,
84-
Optional<RemoteConnectionManager.RemoteClusterAliasWithCredentials>> remoteClusterCredentialsResolver;
85+
Optional<RemoteClusterAliasWithCredentials>> remoteClusterCredentialsResolver;
8586
private final CrossClusterAccessAuthenticationService crossClusterAccessAuthcService;
8687
private final AuthenticationService authcService;
8788
private final AuthorizationService authzService;
@@ -120,7 +121,7 @@ public CrossClusterAccessTransportInterceptor(
120121
SecurityContext securityContext,
121122
ThreadPool threadPool,
122123
Settings settings,
123-
Function<Transport.Connection, Optional<RemoteConnectionManager.RemoteClusterAliasWithCredentials>> remoteClusterCredentialsResolver
124+
Function<Transport.Connection, Optional<RemoteClusterAliasWithCredentials>> remoteClusterCredentialsResolver
124125
) {
125126
this.remoteClusterCredentialsResolver = remoteClusterCredentialsResolver;
126127
this.crossClusterAccessAuthcService = crossClusterAccessAuthcService;
@@ -164,7 +165,7 @@ public <T extends TransportResponse> void sendRequest(
164165
* Returns cluster credentials if the connection is remote, and cluster credentials are set up for the target cluster.
165166
*/
166167
private Optional<RemoteClusterCredentials> getRemoteClusterCredentials(Transport.Connection connection) {
167-
final Optional<RemoteConnectionManager.RemoteClusterAliasWithCredentials> remoteClusterAliasWithCredentials =
168+
final Optional<RemoteClusterAliasWithCredentials> remoteClusterAliasWithCredentials =
168169
remoteClusterCredentialsResolver.apply(connection);
169170
if (remoteClusterAliasWithCredentials.isEmpty()) {
170171
logger.trace("Connection is not remote");
@@ -325,7 +326,7 @@ private static IllegalArgumentException illegalArgumentExceptionWithDebugLog(Str
325326
@Override
326327
public boolean isRemoteClusterConnection(Transport.Connection connection) {
327328
return remoteClusterCredentialsResolver.apply(connection)
328-
.map(RemoteConnectionManager.RemoteClusterAliasWithCredentials::clusterAlias)
329+
.map(RemoteClusterAliasWithCredentials::clusterAlias)
329330
.isPresent();
330331
}
331332

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptor.java‎

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,8 @@
1616
import org.elasticsearch.common.util.concurrent.EsExecutors;
1717
import org.elasticsearch.common.util.concurrent.RunOnce;
1818
import org.elasticsearch.common.util.concurrent.ThreadContext;
19-
import org.elasticsearch.license.XPackLicenseState;
2019
import org.elasticsearch.tasks.Task;
2120
import org.elasticsearch.threadpool.ThreadPool;
22-
import org.elasticsearch.transport.RemoteConnectionManager.RemoteClusterAliasWithCredentials;
2321
import org.elasticsearch.transport.SendRequestTransportException;
2422
import org.elasticsearch.transport.Transport;
2523
import org.elasticsearch.transport.TransportChannel;
@@ -35,16 +33,11 @@
3533
import org.elasticsearch.xpack.core.security.transport.ProfileConfigurations;
3634
import org.elasticsearch.xpack.core.ssl.SSLService;
3735
import org.elasticsearch.xpack.core.ssl.SslProfile;
38-
import org.elasticsearch.xpack.security.authc.AuthenticationService;
39-
import org.elasticsearch.xpack.security.authc.CrossClusterAccessAuthenticationService;
40-
import org.elasticsearch.xpack.security.authz.AuthorizationService;
4136
import org.elasticsearch.xpack.security.authz.AuthorizationUtils;
4237
import org.elasticsearch.xpack.security.authz.PreAuthorizationUtils;
4338

4439
import java.util.Map;
45-
import java.util.Optional;
4640
import java.util.concurrent.Executor;
47-
import java.util.function.Function;
4841

4942
import static org.elasticsearch.core.Strings.format;
5043

@@ -73,35 +66,6 @@ public SecurityServerTransportInterceptor(
7366
this.profileFilters = this.remoteClusterTransportInterceptor.getProfileFilters(profileConfigurations, destructiveOperations);
7467
}
7568

76-
SecurityServerTransportInterceptor(
77-
Settings settings,
78-
ThreadPool threadPool,
79-
AuthenticationService authcService,
80-
AuthorizationService authzService,
81-
SSLService sslService,
82-
SecurityContext securityContext,
83-
DestructiveOperations destructiveOperations,
84-
CrossClusterAccessAuthenticationService crossClusterAccessAuthcService,
85-
XPackLicenseState licenseState,
86-
// Inject for simplified testing
87-
Function<Transport.Connection, Optional<RemoteClusterAliasWithCredentials>> remoteClusterCredentialsResolver
88-
) {
89-
this.threadPool = threadPool;
90-
this.securityContext = securityContext;
91-
this.remoteClusterTransportInterceptor = new CrossClusterAccessTransportInterceptor(
92-
crossClusterAccessAuthcService,
93-
authcService,
94-
authzService,
95-
licenseState,
96-
securityContext,
97-
threadPool,
98-
settings,
99-
remoteClusterCredentialsResolver
100-
);
101-
final Map<String, SslProfile> profileConfigurations = ProfileConfigurations.get(settings, sslService, false);
102-
this.profileFilters = remoteClusterTransportInterceptor.getProfileFilters(profileConfigurations, destructiveOperations);
103-
}
104-
10569
@Override
10670
public AsyncSender interceptSender(AsyncSender sender) {
10771
return interceptForAllRequests(remoteClusterTransportInterceptor.interceptSender(sender));

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/SecurityServerTransportInterceptorTests.java‎

Lines changed: 65 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
*/
77
package org.elasticsearch.xpack.security.transport;
88

9+
import com.carrotsearch.randomizedtesting.annotations.Repeat;
10+
911
import org.elasticsearch.ElasticsearchSecurityException;
1012
import org.elasticsearch.TransportVersion;
1113
import org.elasticsearch.TransportVersions;
@@ -112,6 +114,7 @@
112114
import static org.mockito.Mockito.verify;
113115
import static org.mockito.Mockito.when;
114116

117+
@Repeat(iterations = 1000)
115118
public class SecurityServerTransportInterceptorTests extends ESTestCase {
116119

117120
private Settings settings;
@@ -637,17 +640,22 @@ public void testSendWithCrossClusterAccessHeadersWithUnsupportedLicense() throws
637640
final SecurityServerTransportInterceptor interceptor = new SecurityServerTransportInterceptor(
638641
settings,
639642
threadPool,
640-
mock(AuthenticationService.class),
641-
mock(AuthorizationService.class),
642643
mockSslService(),
643644
securityContext,
644645
new DestructiveOperations(
645646
Settings.EMPTY,
646647
new ClusterSettings(Settings.EMPTY, Collections.singleton(DestructiveOperations.REQUIRES_NAME_SETTING))
647648
),
648-
mock(CrossClusterAccessAuthenticationService.class),
649-
unsupportedLicenseState,
650-
mockRemoteClusterCredentialsResolver(remoteClusterAlias)
649+
new CrossClusterAccessTransportInterceptor(
650+
mock(CrossClusterAccessAuthenticationService.class),
651+
mock(AuthenticationService.class),
652+
mock(AuthorizationService.class),
653+
unsupportedLicenseState,
654+
securityContext,
655+
threadPool,
656+
settings,
657+
mockRemoteClusterCredentialsResolver(remoteClusterAlias)
658+
)
651659
);
652660

653661
final AsyncSender sender = interceptor.interceptSender(mock(AsyncSender.class, ignored -> {
@@ -774,17 +782,24 @@ private void doTestSendWithCrossClusterAccessHeaders(
774782
final SecurityServerTransportInterceptor interceptor = new SecurityServerTransportInterceptor(
775783
settings,
776784
threadPool,
777-
mock(AuthenticationService.class),
778-
authzService,
779785
mockSslService(),
780786
securityContext,
781787
new DestructiveOperations(
782788
Settings.EMPTY,
783789
new ClusterSettings(Settings.EMPTY, Collections.singleton(DestructiveOperations.REQUIRES_NAME_SETTING))
784790
),
785-
mock(CrossClusterAccessAuthenticationService.class),
786-
mockLicenseState,
787-
ignored -> Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray())))
791+
new CrossClusterAccessTransportInterceptor(
792+
mock(CrossClusterAccessAuthenticationService.class),
793+
mock(AuthenticationService.class),
794+
authzService,
795+
mockLicenseState,
796+
securityContext,
797+
threadPool,
798+
settings,
799+
ignored -> Optional.of(
800+
new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray()))
801+
)
802+
)
788803
);
789804

790805
final AtomicBoolean calledWrappedSender = new AtomicBoolean(false);
@@ -912,21 +927,28 @@ public void testSendWithUserIfCrossClusterAccessHeadersConditionNotMet() throws
912927
final SecurityServerTransportInterceptor interceptor = new SecurityServerTransportInterceptor(
913928
settings,
914929
threadPool,
915-
mock(AuthenticationService.class),
916-
authzService,
917930
mockSslService(),
918931
securityContext,
919932
new DestructiveOperations(
920933
Settings.EMPTY,
921934
new ClusterSettings(Settings.EMPTY, Collections.singleton(DestructiveOperations.REQUIRES_NAME_SETTING))
922935
),
923-
mock(CrossClusterAccessAuthenticationService.class),
924-
mockLicenseState,
925-
ignored -> notRemoteConnection
926-
? Optional.empty()
927-
: (finalNoCredential
928-
? Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, null))
929-
: Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray()))))
936+
new CrossClusterAccessTransportInterceptor(
937+
mock(CrossClusterAccessAuthenticationService.class),
938+
mock(AuthenticationService.class),
939+
authzService,
940+
mockLicenseState,
941+
securityContext,
942+
threadPool,
943+
settings,
944+
ignored -> notRemoteConnection
945+
? Optional.empty()
946+
: (finalNoCredential
947+
? Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, null))
948+
: Optional.of(
949+
new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray()))
950+
))
951+
)
930952
);
931953

932954
final AtomicBoolean calledWrappedSender = new AtomicBoolean(false);
@@ -971,17 +993,24 @@ public void testSendWithCrossClusterAccessHeadersThrowsOnOldConnection() throws
971993
final SecurityServerTransportInterceptor interceptor = new SecurityServerTransportInterceptor(
972994
settings,
973995
threadPool,
974-
mock(AuthenticationService.class),
975-
mock(AuthorizationService.class),
976996
mockSslService(),
977997
securityContext,
978998
new DestructiveOperations(
979999
Settings.EMPTY,
9801000
new ClusterSettings(Settings.EMPTY, Collections.singleton(DestructiveOperations.REQUIRES_NAME_SETTING))
9811001
),
982-
mock(CrossClusterAccessAuthenticationService.class),
983-
mockLicenseState,
984-
ignored -> Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray())))
1002+
new CrossClusterAccessTransportInterceptor(
1003+
mock(CrossClusterAccessAuthenticationService.class),
1004+
mock(AuthenticationService.class),
1005+
mock(AuthorizationService.class),
1006+
mockLicenseState,
1007+
securityContext,
1008+
threadPool,
1009+
settings,
1010+
ignored -> Optional.of(
1011+
new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray()))
1012+
)
1013+
)
9851014
);
9861015

9871016
final AsyncSender sender = interceptor.interceptSender(new AsyncSender() {
@@ -1070,17 +1099,24 @@ public void testSendRemoteRequestFailsIfUserHasNoRemoteIndicesPrivileges() throw
10701099
final SecurityServerTransportInterceptor interceptor = new SecurityServerTransportInterceptor(
10711100
settings,
10721101
threadPool,
1073-
mock(AuthenticationService.class),
1074-
authzService,
10751102
mockSslService(),
10761103
securityContext,
10771104
new DestructiveOperations(
10781105
Settings.EMPTY,
10791106
new ClusterSettings(Settings.EMPTY, Collections.singleton(DestructiveOperations.REQUIRES_NAME_SETTING))
10801107
),
1081-
mock(CrossClusterAccessAuthenticationService.class),
1082-
mockLicenseState,
1083-
ignored -> Optional.of(new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray())))
1108+
new CrossClusterAccessTransportInterceptor(
1109+
mock(CrossClusterAccessAuthenticationService.class),
1110+
mock(AuthenticationService.class),
1111+
authzService,
1112+
mockLicenseState,
1113+
securityContext,
1114+
threadPool,
1115+
settings,
1116+
ignored -> Optional.of(
1117+
new RemoteClusterAliasWithCredentials(remoteClusterAlias, new SecureString(encodedApiKey.toCharArray()))
1118+
)
1119+
)
10841120
);
10851121

10861122
final AsyncSender sender = interceptor.interceptSender(new AsyncSender() {

0 commit comments

Comments
 (0)