Enable limited OpenSSL support #422
Conversation
Codecov Report
@@ Coverage Diff @@
## master #422 +/- ##
============================================
- Coverage 62.34% 62.11% -0.24%
+ Complexity 2874 2872 -2
============================================
Files 223 223
Lines 15992 16032 +40
Branches 2994 3008 +14
============================================
- Hits 9971 9959 -12
- Misses 4461 4503 +42
- Partials 1560 1570 +10
Continue to review full report at Codecov.
|
| if(Constants.JRE_IS_MINIMUM_JAVA11) { | ||
| text += "Since you are running Java "+Constants.JAVA_VERSION+" you should not experience any performance impact but maybe not all your ciphers are supported. If you experience problems upgrade to Java 11+"; | ||
| if (PlatformDependent.javaVersion() < 12) { | ||
| log.warn("Support for OpenSSL with Java 11 or prior versions require using Netty allocator. Set 'es.unsafe.use_netty_default_allocator' system property to true"); |
There was a problem hiding this comment.
What does the es.unsafe.use_netty_default_allocator property do and why is it necessary for supporting node to node communication with OpenSSL?
There was a problem hiding this comment.
The es.unsafe.use_netty_default_allocator System property is used by NettyAllocator to determine which ByteBufAllocator to use. With this property set to true, ES will use native Netty allocator, otherwise, it will use its own NettyAllocator.NoDirectBuffers allocator that does not support direct buffers. As openssl is supported through netty and uses tcnative that needs direct buffers, it is necessary to configure ES to use Netty allocator if openssl is required/preferred.
|
Please elaborate on how you tested these changes. |
|
Tested using |
Would be useful to manually test out the changes as well. This can be done by spinning up cluster of nodes with elasticsearch oss (in this case for es 7.6) with the security plugin built with these changes. As far as I remember before we removed support for OpenSSL, the tests were still passing but inter-cluster communication between nodes was failing for Java version <12. |
|
There is a difference in the test environment introduced in #339 that explains why tests were passing while inter-cluster communication was failing for Java 11 or prior versions. In the past, tests were running on the docker image without openssl installed and tests that exercise openssl functionality were disabled on |
Thanks for the explanation. |
(cherry picked from commit 663053a)
(cherry picked from commit 663053a)
Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.