From b98110a36b5cec3ff5c5f91f6fdeb194a90d894d Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Mon, 20 Jan 2025 13:17:18 -0500 Subject: [PATCH] Fix Netty4 header verifier inbound handler to deal with upgrade requests Signed-off-by: Andriy Redko --- .../Netty4HttpRequestHeaderVerifier.java | 5 ++-- .../security/test/helper/rest/RestHelper.java | 30 +++++++------------ 2 files changed, 12 insertions(+), 23 deletions(-) diff --git a/src/main/java/org/opensearch/security/ssl/http/netty/Netty4HttpRequestHeaderVerifier.java b/src/main/java/org/opensearch/security/ssl/http/netty/Netty4HttpRequestHeaderVerifier.java index 9afd6b0e22..ed06f312b6 100644 --- a/src/main/java/org/opensearch/security/ssl/http/netty/Netty4HttpRequestHeaderVerifier.java +++ b/src/main/java/org/opensearch/security/ssl/http/netty/Netty4HttpRequestHeaderVerifier.java @@ -30,13 +30,12 @@ import io.netty.channel.ChannelHandler.Sharable; import io.netty.channel.ChannelHandlerContext; import io.netty.channel.SimpleChannelInboundHandler; -import io.netty.handler.codec.http.DefaultHttpRequest; import io.netty.handler.codec.http.HttpRequest; import io.netty.util.AttributeKey; import io.netty.util.ReferenceCountUtil; @Sharable -public class Netty4HttpRequestHeaderVerifier extends SimpleChannelInboundHandler { +public class Netty4HttpRequestHeaderVerifier extends SimpleChannelInboundHandler { public static final AttributeKey IS_AUTHENTICATED = AttributeKey.newInstance("opensearch-http-is-authenticated"); public static final AttributeKey SHOULD_DECOMPRESS = AttributeKey.newInstance("opensearch-http-should-decompress"); public static final AttributeKey CONTEXT_TO_RESTORE = AttributeKey.newInstance( @@ -67,7 +66,7 @@ public Netty4HttpRequestHeaderVerifier(SecurityRestFilter restFilter, ThreadPool } @Override - public void channelRead0(ChannelHandlerContext ctx, DefaultHttpRequest msg) throws Exception { + public void channelRead0(ChannelHandlerContext ctx, HttpRequest msg) throws Exception { // DefaultHttpRequest should always be first and contain headers ReferenceCountUtil.retain(msg); diff --git a/src/test/java/org/opensearch/security/test/helper/rest/RestHelper.java b/src/test/java/org/opensearch/security/test/helper/rest/RestHelper.java index 81dd89badf..e80714c369 100644 --- a/src/test/java/org/opensearch/security/test/helper/rest/RestHelper.java +++ b/src/test/java/org/opensearch/security/test/helper/rest/RestHelper.java @@ -39,7 +39,6 @@ import java.util.regex.Matcher; import java.util.regex.Pattern; import javax.net.ssl.SSLContext; -import javax.net.ssl.SSLEngine; import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.databind.JsonNode; @@ -64,10 +63,9 @@ import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider; import org.apache.hc.client5.http.impl.nio.PoolingAsyncClientConnectionManagerBuilder; import org.apache.hc.client5.http.nio.AsyncClientConnectionManager; -import org.apache.hc.client5.http.ssl.ClientTlsStrategyBuilder; +import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; import org.apache.hc.client5.http.ssl.NoopHostnameVerifier; import org.apache.hc.core5.concurrent.FutureCallback; -import org.apache.hc.core5.function.Factory; import org.apache.hc.core5.http.ConnectionClosedException; import org.apache.hc.core5.http.ContentType; import org.apache.hc.core5.http.Header; @@ -78,8 +76,7 @@ import org.apache.hc.core5.http.ProtocolVersion; import org.apache.hc.core5.http.io.entity.EntityUtils; import org.apache.hc.core5.http.io.entity.StringEntity; -import org.apache.hc.core5.http.nio.ssl.TlsStrategy; -import org.apache.hc.core5.reactor.ssl.TlsDetails; +import org.apache.hc.core5.reactor.ssl.SSLBufferMode; import org.apache.hc.core5.ssl.SSLContextBuilder; import org.apache.hc.core5.ssl.SSLContexts; import org.apache.hc.core5.util.Timeout; @@ -363,27 +360,20 @@ protected final CloseableHttpAsyncClient getHTTPClient() throws Exception { protocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" }; } - final TlsStrategy tlsStrategy = ClientTlsStrategyBuilder.create() - .setSslContext(sslContext) - .setTlsVersions(protocols) - .setHostnameVerifier(NoopHostnameVerifier.INSTANCE) - // See please https://issues.apache.org/jira/browse/HTTPCLIENT-2219 - .setTlsDetailsFactory(new Factory() { - @Override - public TlsDetails create(final SSLEngine sslEngine) { - return new TlsDetails(sslEngine.getSession(), sslEngine.getApplicationProtocol()); - } - }) - .build(); + final DefaultClientTlsStrategy tlsStrategy = new DefaultClientTlsStrategy( + sslContext, + protocols, + null, + SSLBufferMode.STATIC, + NoopHostnameVerifier.INSTANCE + ); final AsyncClientConnectionManager cm = PoolingAsyncClientConnectionManagerBuilder.create().setTlsStrategy(tlsStrategy).build(); hcb.setConnectionManager(cm); } - final RequestConfig.Builder requestConfigBuilder = RequestConfig.custom() - .setResponseTimeout(Timeout.ofSeconds(60)) - .setProtocolUpgradeEnabled(false); + final RequestConfig.Builder requestConfigBuilder = RequestConfig.custom().setResponseTimeout(Timeout.ofSeconds(60)); return hcb.setDefaultRequestConfig(requestConfigBuilder.build()).disableAutomaticRetries().build(); }