forked from elastic/elasticsearch
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'elastic/6.x' into retention-lease-backg…
…round-sync-6.x * elastic/6.x: Fix testRestoreIncreasesPrimaryTerms on 6.x (elastic#38314) SQL: Remove exceptions from Analyzer (elastic#38260) (elastic#38287) SQL: Move metrics tracking inside PlanExecutor (elastic#38259) (elastic#38288) Backport of elastic#38311: Move TokenService to seqno powered cas Handle scheduler exceptions (elastic#38183) Mute MlMigrationFullClusterRestartIT#testMigration (elastic#38316) 6.x Backport of elastic#38278: Move ML Optimistic Concurrency Control to Seq No Cleanup construction of interceptors (elastic#38296) Throw if two inner_hits have the same name (elastic#37645) (elastic#38194) AsyncTwoPhaseIndexerTests race condition fixed elastic#38195 Backport#37830 Enable SSL in reindex with security QA tests (elastic#38293) Ensure ILM policies run safely on leader indices (elastic#38140) Introduce ssl settings to reindex from remote (elastic#38292) Fix ordering problem in add or renew lease test (elastic#38281) Mute ReplicationTrackerRetentionLeaseTests#testAddOrRenewRetentionLease (elastic#38276) Fix NPE in Logfile Audit Filter (elastic#38120) (elastic#38271) Enable trace log in FollowerFailOverIT (elastic#38148) SQL: Generate relevant error message when grouping functions are not used in GROUP BY (elastic#38017)
- Loading branch information
Showing
142 changed files
with
2,712 additions
and
550 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
161 changes: 161 additions & 0 deletions
161
modules/reindex/src/main/java/org/elasticsearch/index/reindex/ReindexSslConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,161 @@ | ||
| /* | ||
| * Licensed to Elasticsearch under one or more contributor | ||
| * license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright | ||
| * ownership. Elasticsearch licenses this file to you under | ||
| * the Apache License, Version 2.0 (the "License"); you may | ||
| * not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| package org.elasticsearch.index.reindex; | ||
|
|
||
| import org.apache.http.conn.ssl.DefaultHostnameVerifier; | ||
| import org.apache.http.conn.ssl.NoopHostnameVerifier; | ||
| import org.apache.http.nio.conn.ssl.SSLIOSessionStrategy; | ||
| import org.elasticsearch.common.Strings; | ||
| import org.elasticsearch.common.settings.SecureSetting; | ||
| import org.elasticsearch.common.settings.SecureString; | ||
| import org.elasticsearch.common.settings.Setting; | ||
| import org.elasticsearch.common.settings.Settings; | ||
| import org.elasticsearch.common.ssl.SslConfiguration; | ||
| import org.elasticsearch.common.ssl.SslConfigurationKeys; | ||
| import org.elasticsearch.common.ssl.SslConfigurationLoader; | ||
| import org.elasticsearch.env.Environment; | ||
| import org.elasticsearch.watcher.FileChangesListener; | ||
| import org.elasticsearch.watcher.FileWatcher; | ||
| import org.elasticsearch.watcher.ResourceWatcherService; | ||
|
|
||
| import javax.net.ssl.HostnameVerifier; | ||
| import javax.net.ssl.SSLContext; | ||
| import java.io.IOException; | ||
| import java.io.UncheckedIOException; | ||
| import java.nio.file.Path; | ||
| import java.util.ArrayList; | ||
| import java.util.Collections; | ||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.function.Function; | ||
|
|
||
| import static org.elasticsearch.common.settings.Setting.listSetting; | ||
| import static org.elasticsearch.common.settings.Setting.simpleString; | ||
|
|
||
| /** | ||
| * Loads "reindex.ssl.*" configuration from Settings, and makes the applicable configuration (trust manager / key manager / hostname | ||
| * verification / cipher-suites) available for reindex-from-remote. | ||
| */ | ||
| class ReindexSslConfig { | ||
|
|
||
| private static final Map<String, Setting<?>> SETTINGS = new HashMap<>(); | ||
| private static final Map<String, Setting<SecureString>> SECURE_SETTINGS = new HashMap<>(); | ||
|
|
||
| static { | ||
| Setting.Property[] defaultProperties = new Setting.Property[] { Setting.Property.NodeScope, Setting.Property.Filtered }; | ||
| Setting.Property[] deprecatedProperties = new Setting.Property[] { Setting.Property.Deprecated, Setting.Property.NodeScope, | ||
| Setting.Property.Filtered }; | ||
| for (String key : SslConfigurationKeys.getStringKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| final Setting.Property[] properties = SslConfigurationKeys.isDeprecated(key) ? deprecatedProperties : defaultProperties; | ||
| SETTINGS.put(settingName, simpleString(settingName, properties)); | ||
| } | ||
| for (String key : SslConfigurationKeys.getListKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| final Setting.Property[] properties = SslConfigurationKeys.isDeprecated(key) ? deprecatedProperties : defaultProperties; | ||
| SETTINGS.put(settingName, listSetting(settingName, Collections.emptyList(), Function.identity(), properties)); | ||
| } | ||
| for (String key : SslConfigurationKeys.getSecureStringKeys()) { | ||
| String settingName = "reindex.ssl." + key; | ||
| SECURE_SETTINGS.put(settingName, SecureSetting.secureString(settingName, null)); | ||
| } | ||
| } | ||
|
|
||
| private final SslConfiguration configuration; | ||
| private volatile SSLContext context; | ||
|
|
||
| public static List<Setting<?>> getSettings() { | ||
| List<Setting<?>> settings = new ArrayList<>(); | ||
| settings.addAll(SETTINGS.values()); | ||
| settings.addAll(SECURE_SETTINGS.values()); | ||
| return settings; | ||
| } | ||
|
|
||
| ReindexSslConfig(Settings settings, Environment environment, ResourceWatcherService resourceWatcher) { | ||
| final SslConfigurationLoader loader = new SslConfigurationLoader("reindex.ssl.") { | ||
|
|
||
| @Override | ||
| protected String getSettingAsString(String key) { | ||
| return settings.get(key); | ||
| } | ||
|
|
||
| @Override | ||
| protected char[] getSecureSetting(String key) { | ||
| final Setting<SecureString> setting = SECURE_SETTINGS.get(key); | ||
| if (setting == null) { | ||
| throw new IllegalArgumentException("The secure setting [" + key + "] is not registered"); | ||
| } | ||
| return setting.get(settings).getChars(); | ||
| } | ||
|
|
||
| @Override | ||
| protected List<String> getSettingAsList(String key) throws Exception { | ||
| return settings.getAsList(key); | ||
| } | ||
| }; | ||
| configuration = loader.load(environment.configFile()); | ||
| reload(); | ||
|
|
||
| final FileChangesListener listener = new FileChangesListener() { | ||
| @Override | ||
| public void onFileCreated(Path file) { | ||
| onFileChanged(file); | ||
| } | ||
|
|
||
| @Override | ||
| public void onFileDeleted(Path file) { | ||
| onFileChanged(file); | ||
| } | ||
|
|
||
| @Override | ||
| public void onFileChanged(Path file) { | ||
| ReindexSslConfig.this.reload(); | ||
| } | ||
| }; | ||
| for (Path file : configuration.getDependentFiles()) { | ||
| try { | ||
| final FileWatcher watcher = new FileWatcher(file); | ||
| watcher.addListener(listener); | ||
| resourceWatcher.add(watcher, ResourceWatcherService.Frequency.HIGH); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException("cannot watch file [" + file + "]", e); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private void reload() { | ||
| this.context = configuration.createSslContext(); | ||
| } | ||
|
|
||
| /** | ||
| * Encapsulate the loaded SSL configuration as a HTTP-client {@link SSLIOSessionStrategy}. | ||
| * The returned strategy is immutable, but successive calls will return different objects that may have different | ||
| * configurations if the underlying key/certificate files are modified. | ||
| */ | ||
| SSLIOSessionStrategy getStrategy() { | ||
| final HostnameVerifier hostnameVerifier = configuration.getVerificationMode().isHostnameVerificationEnabled() | ||
| ? new DefaultHostnameVerifier() | ||
| : new NoopHostnameVerifier(); | ||
| final String[] protocols = configuration.getSupportedProtocols().toArray(Strings.EMPTY_ARRAY); | ||
| final String[] cipherSuites = configuration.getCipherSuites().toArray(Strings.EMPTY_ARRAY); | ||
| return new SSLIOSessionStrategy(context, protocols, cipherSuites, hostnameVerifier); | ||
| } | ||
| } |
Oops, something went wrong.