Skip to content

Commit db3e499

Browse files
committed
Merge remote-tracking branch 'upstream/main' into entitlements/nio-files-1
2 parents 2592d97 + 877963c commit db3e499

File tree

19 files changed

+538
-371
lines changed

19 files changed

+538
-371
lines changed
Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.gradle.internal.dependencies.patches.hdfs;
11+
12+
import org.gradle.api.artifacts.transform.CacheableTransform;
13+
import org.gradle.api.artifacts.transform.InputArtifact;
14+
import org.gradle.api.artifacts.transform.TransformAction;
15+
import org.gradle.api.artifacts.transform.TransformOutputs;
16+
import org.gradle.api.artifacts.transform.TransformParameters;
17+
import org.gradle.api.file.FileSystemLocation;
18+
import org.gradle.api.provider.Provider;
19+
import org.gradle.api.tasks.Classpath;
20+
import org.gradle.api.tasks.Input;
21+
import org.gradle.api.tasks.Optional;
22+
import org.jetbrains.annotations.NotNull;
23+
import org.objectweb.asm.ClassReader;
24+
import org.objectweb.asm.ClassVisitor;
25+
import org.objectweb.asm.ClassWriter;
26+
27+
import java.io.File;
28+
import java.io.FileOutputStream;
29+
import java.io.IOException;
30+
import java.io.InputStream;
31+
import java.util.Enumeration;
32+
import java.util.HashMap;
33+
import java.util.List;
34+
import java.util.Locale;
35+
import java.util.Map;
36+
import java.util.function.Function;
37+
import java.util.jar.JarEntry;
38+
import java.util.jar.JarFile;
39+
import java.util.jar.JarOutputStream;
40+
import java.util.regex.Pattern;
41+
42+
import static java.util.Map.entry;
43+
44+
@CacheableTransform
45+
public abstract class HdfsClassPatcher implements TransformAction<HdfsClassPatcher.Parameters> {
46+
47+
record JarPatchers(String artifactTag, Pattern artifactPattern, Map<String, Function<ClassWriter, ClassVisitor>> jarPatchers) {}
48+
49+
static final List<JarPatchers> allPatchers = List.of(
50+
new JarPatchers(
51+
"hadoop-common",
52+
Pattern.compile("hadoop-common-(?!.*tests)"),
53+
Map.ofEntries(
54+
entry("org/apache/hadoop/util/ShutdownHookManager.class", ShutdownHookManagerPatcher::new),
55+
entry("org/apache/hadoop/util/Shell.class", ShellPatcher::new),
56+
entry("org/apache/hadoop/security/UserGroupInformation.class", SubjectGetSubjectPatcher::new)
57+
)
58+
),
59+
new JarPatchers(
60+
"hadoop-client-api",
61+
Pattern.compile("hadoop-client-api.*"),
62+
Map.ofEntries(
63+
entry("org/apache/hadoop/util/ShutdownHookManager.class", ShutdownHookManagerPatcher::new),
64+
entry("org/apache/hadoop/util/Shell.class", ShellPatcher::new),
65+
entry("org/apache/hadoop/security/UserGroupInformation.class", SubjectGetSubjectPatcher::new),
66+
entry("org/apache/hadoop/security/authentication/client/KerberosAuthenticator.class", SubjectGetSubjectPatcher::new)
67+
)
68+
)
69+
);
70+
71+
interface Parameters extends TransformParameters {
72+
@Input
73+
@Optional
74+
List<String> getMatchingArtifacts();
75+
76+
void setMatchingArtifacts(List<String> matchingArtifacts);
77+
}
78+
79+
@Classpath
80+
@InputArtifact
81+
public abstract Provider<FileSystemLocation> getInputArtifact();
82+
83+
@Override
84+
public void transform(@NotNull TransformOutputs outputs) {
85+
File inputFile = getInputArtifact().get().getAsFile();
86+
87+
List<String> matchingArtifacts = getParameters().getMatchingArtifacts();
88+
List<JarPatchers> patchersToApply = allPatchers.stream()
89+
.filter(jp -> matchingArtifacts.contains(jp.artifactTag()) && jp.artifactPattern().matcher(inputFile.getName()).find())
90+
.toList();
91+
if (patchersToApply.isEmpty()) {
92+
outputs.file(getInputArtifact());
93+
} else {
94+
patchersToApply.forEach(patchers -> {
95+
System.out.println("Patching " + inputFile.getName());
96+
97+
Map<String, Function<ClassWriter, ClassVisitor>> jarPatchers = new HashMap<>(patchers.jarPatchers());
98+
File outputFile = outputs.file(inputFile.getName().replace(".jar", "-patched.jar"));
99+
100+
patchJar(inputFile, outputFile, jarPatchers);
101+
102+
if (jarPatchers.isEmpty() == false) {
103+
throw new IllegalArgumentException(
104+
String.format(
105+
Locale.ROOT,
106+
"error patching [%s] with [%s]: the jar does not contain [%s]",
107+
inputFile.getName(),
108+
patchers.artifactPattern().toString(),
109+
String.join(", ", jarPatchers.keySet())
110+
)
111+
);
112+
}
113+
});
114+
}
115+
}
116+
117+
private static void patchJar(File inputFile, File outputFile, Map<String, Function<ClassWriter, ClassVisitor>> jarPatchers) {
118+
try (JarFile jarFile = new JarFile(inputFile); JarOutputStream jos = new JarOutputStream(new FileOutputStream(outputFile))) {
119+
Enumeration<JarEntry> entries = jarFile.entries();
120+
while (entries.hasMoreElements()) {
121+
JarEntry entry = entries.nextElement();
122+
String entryName = entry.getName();
123+
// Add the entry to the new JAR file
124+
jos.putNextEntry(new JarEntry(entryName));
125+
126+
Function<ClassWriter, ClassVisitor> classPatcher = jarPatchers.remove(entryName);
127+
if (classPatcher != null) {
128+
byte[] classToPatch = jarFile.getInputStream(entry).readAllBytes();
129+
130+
ClassReader classReader = new ClassReader(classToPatch);
131+
ClassWriter classWriter = new ClassWriter(classReader, 0);
132+
classReader.accept(classPatcher.apply(classWriter), 0);
133+
134+
jos.write(classWriter.toByteArray());
135+
} else {
136+
// Read the entry's data and write it to the new JAR
137+
try (InputStream is = jarFile.getInputStream(entry)) {
138+
is.transferTo(jos);
139+
}
140+
}
141+
jos.closeEntry();
142+
}
143+
} catch (IOException ex) {
144+
throw new RuntimeException(ex);
145+
}
146+
}
147+
}

plugins/repository-hdfs/hadoop-client-api/src/patcher/java/org/elasticsearch/hdfs/patch/MethodReplacement.java renamed to build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/dependencies/patches/hdfs/MethodReplacement.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* License v3.0 only", or the "Server Side Public License, v 1".
88
*/
99

10-
package org.elasticsearch.hdfs.patch;
10+
package org.elasticsearch.gradle.internal.dependencies.patches.hdfs;
1111

1212
import org.objectweb.asm.MethodVisitor;
1313
import org.objectweb.asm.Opcodes;

plugins/repository-hdfs/hadoop-client-api/src/patcher/java/org/elasticsearch/hdfs/patch/ShellPatcher.java renamed to build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/dependencies/patches/hdfs/ShellPatcher.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* License v3.0 only", or the "Server Side Public License, v 1".
88
*/
99

10-
package org.elasticsearch.hdfs.patch;
10+
package org.elasticsearch.gradle.internal.dependencies.patches.hdfs;
1111

1212
import org.objectweb.asm.ClassVisitor;
1313
import org.objectweb.asm.ClassWriter;

plugins/repository-hdfs/hadoop-client-api/src/patcher/java/org/elasticsearch/hdfs/patch/ShutdownHookManagerPatcher.java renamed to build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/dependencies/patches/hdfs/ShutdownHookManagerPatcher.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* License v3.0 only", or the "Server Side Public License, v 1".
88
*/
99

10-
package org.elasticsearch.hdfs.patch;
10+
package org.elasticsearch.gradle.internal.dependencies.patches.hdfs;
1111

1212
import org.objectweb.asm.ClassVisitor;
1313
import org.objectweb.asm.ClassWriter;

plugins/repository-hdfs/hadoop-client-api/src/patcher/java/org/elasticsearch/hdfs/patch/SubjectGetSubjectPatcher.java renamed to build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/dependencies/patches/hdfs/SubjectGetSubjectPatcher.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* License v3.0 only", or the "Server Side Public License, v 1".
88
*/
99

10-
package org.elasticsearch.hdfs.patch;
10+
package org.elasticsearch.gradle.internal.dependencies.patches.hdfs;
1111

1212
import org.objectweb.asm.ClassVisitor;
1313
import org.objectweb.asm.ClassWriter;

docs/changelog/117642.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 117642
2+
summary: Adding endpoint creation validation to `ElasticInferenceService`
3+
area: Machine Learning
4+
type: enhancement
5+
issues: []

libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@
7373
import java.nio.file.attribute.PosixFilePermission;
7474
import java.nio.file.attribute.UserPrincipal;
7575
import java.nio.file.spi.FileSystemProvider;
76+
import java.security.KeyStore;
77+
import java.security.Provider;
7678
import java.security.cert.CertStoreParameters;
7779
import java.util.List;
7880
import java.util.Locale;
@@ -629,12 +631,50 @@ public interface EntitlementChecker {
629631

630632
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
631633

634+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, char[] password);
635+
636+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, KeyStore.LoadStoreParameter param);
637+
638+
void check$java_security_KeyStore$Builder$$newInstance(Class<?> callerClass, File file, KeyStore.ProtectionParameter protection);
639+
640+
void check$java_security_KeyStore$Builder$$newInstance(
641+
Class<?> callerClass,
642+
String type,
643+
Provider provider,
644+
File file,
645+
KeyStore.ProtectionParameter protection
646+
);
647+
632648
void check$java_util_Scanner$(Class<?> callerClass, File source);
633649

634650
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);
635651

636652
void check$java_util_Scanner$(Class<?> callerClass, File source, Charset charset);
637653

654+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name);
655+
656+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name, boolean verify);
657+
658+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file);
659+
660+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify);
661+
662+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode);
663+
664+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode, Runtime.Version version);
665+
666+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name);
667+
668+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name, Charset charset);
669+
670+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file);
671+
672+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode);
673+
674+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, Charset charset);
675+
676+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode, Charset charset);
677+
638678
// nio
639679
void check$java_nio_file_Files$$getOwner(Class<?> callerClass, Path path, LinkOption... options);
640680

0 commit comments

Comments
 (0)