|
| 1 | +/* |
| 2 | + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one |
| 3 | + * or more contributor license agreements. Licensed under the Elastic License |
| 4 | + * 2.0; you may not use this file except in compliance with the Elastic License |
| 5 | + * 2.0. |
| 6 | + */ |
| 7 | + |
| 8 | +package org.elasticsearch.xpack.remotecluster; |
| 9 | + |
| 10 | +import io.netty.handler.codec.http.HttpMethod; |
| 11 | + |
| 12 | +import org.elasticsearch.action.search.SearchResponse; |
| 13 | +import org.elasticsearch.client.Request; |
| 14 | +import org.elasticsearch.client.RequestOptions; |
| 15 | +import org.elasticsearch.client.Response; |
| 16 | +import org.elasticsearch.client.ResponseException; |
| 17 | +import org.elasticsearch.common.settings.Settings; |
| 18 | +import org.elasticsearch.core.Strings; |
| 19 | +import org.elasticsearch.search.SearchHit; |
| 20 | +import org.elasticsearch.search.SearchResponseUtils; |
| 21 | +import org.elasticsearch.test.cluster.ElasticsearchCluster; |
| 22 | +import org.elasticsearch.test.cluster.util.resource.Resource; |
| 23 | +import org.junit.ClassRule; |
| 24 | +import org.junit.rules.RuleChain; |
| 25 | +import org.junit.rules.TestRule; |
| 26 | + |
| 27 | +import java.io.IOException; |
| 28 | +import java.util.Arrays; |
| 29 | +import java.util.List; |
| 30 | +import java.util.Locale; |
| 31 | +import java.util.Map; |
| 32 | +import java.util.concurrent.atomic.AtomicReference; |
| 33 | +import java.util.stream.Collectors; |
| 34 | + |
| 35 | +import static org.hamcrest.Matchers.containsInAnyOrder; |
| 36 | +import static org.hamcrest.Matchers.containsString; |
| 37 | +import static org.hamcrest.Matchers.equalTo; |
| 38 | + |
| 39 | +public class RemoteClusterSecurityCrossClusterApiKeySigningIT extends AbstractRemoteClusterSecurityTestCase { |
| 40 | + |
| 41 | + private static final AtomicReference<Map<String, Object>> API_KEY_MAP_REF = new AtomicReference<>(); |
| 42 | + |
| 43 | + static { |
| 44 | + fulfillingCluster = ElasticsearchCluster.local() |
| 45 | + .name("fulfilling-cluster") |
| 46 | + .apply(commonClusterConfig) |
| 47 | + .setting("remote_cluster_server.enabled", "true") |
| 48 | + .setting("remote_cluster.port", "0") |
| 49 | + .setting("xpack.security.remote_cluster_server.ssl.enabled", "true") |
| 50 | + .setting("xpack.security.remote_cluster_server.ssl.key", "remote-cluster.key") |
| 51 | + .setting("xpack.security.remote_cluster_server.ssl.certificate", "remote-cluster.crt") |
| 52 | + .configFile("signing_ca.crt", Resource.fromClasspath("signing/root.crt")) |
| 53 | + .setting("cluster.remote.signing.certificate_authorities", "signing_ca.crt") |
| 54 | + .keystore("xpack.security.remote_cluster_server.ssl.secure_key_passphrase", "remote-cluster-password") |
| 55 | + .build(); |
| 56 | + |
| 57 | + queryCluster = ElasticsearchCluster.local() |
| 58 | + .name("query-cluster") |
| 59 | + .apply(commonClusterConfig) |
| 60 | + .setting("xpack.security.remote_cluster_client.ssl.enabled", "true") |
| 61 | + .setting("xpack.security.remote_cluster_client.ssl.certificate_authorities", "remote-cluster-ca.crt") |
| 62 | + .configFile("signing.crt", Resource.fromClasspath("signing/signing.crt")) |
| 63 | + .setting("cluster.remote.my_remote_cluster.signing.certificate", "signing.crt") |
| 64 | + .configFile("signing.key", Resource.fromClasspath("signing/signing.key")) |
| 65 | + .setting("cluster.remote.my_remote_cluster.signing.key", "signing.key") |
| 66 | + .keystore("cluster.remote.my_remote_cluster.credentials", () -> { |
| 67 | + if (API_KEY_MAP_REF.get() == null) { |
| 68 | + final Map<String, Object> apiKeyMap = createCrossClusterAccessApiKey(""" |
| 69 | + { |
| 70 | + "search": [ |
| 71 | + { |
| 72 | + "names": ["index*", "not_found_index"] |
| 73 | + } |
| 74 | + ] |
| 75 | + }"""); |
| 76 | + API_KEY_MAP_REF.set(apiKeyMap); |
| 77 | + } |
| 78 | + return (String) API_KEY_MAP_REF.get().get("encoded"); |
| 79 | + }) |
| 80 | + .keystore("cluster.remote.invalid_remote.credentials", randomEncodedApiKey()) |
| 81 | + .build(); |
| 82 | + } |
| 83 | + |
| 84 | + @ClassRule |
| 85 | + // Use a RuleChain to ensure that fulfilling cluster is started before query cluster |
| 86 | + public static TestRule clusterRule = RuleChain.outerRule(fulfillingCluster).around(queryCluster); |
| 87 | + |
| 88 | + public void testCrossClusterSearchWithCrossClusterApiKeySigning() throws Exception { |
| 89 | + indexTestData(); |
| 90 | + assertCrossClusterSearchSuccessfulWithResult(); |
| 91 | + |
| 92 | + // Change the CA to something that doesn't trust the signing cert |
| 93 | + updateClusterSettingsFulfillingCluster( |
| 94 | + Settings.builder().put("cluster.remote.signing.certificate_authorities", "transport-ca.crt").build() |
| 95 | + ); |
| 96 | + assertCrossClusterAuthFail(); |
| 97 | + |
| 98 | + // Update settings on query cluster to ignore unavailable remotes |
| 99 | + updateClusterSettings(Settings.builder().put("cluster.remote.my_remote_cluster.skip_unavailable", Boolean.toString(true)).build()); |
| 100 | + |
| 101 | + assertCrossClusterSearchSuccessfulWithoutResult(); |
| 102 | + |
| 103 | + // TODO add test for certificate identity configured for API key but no signature provided (should 401) |
| 104 | + |
| 105 | + // TODO add test for certificate identity not configured for API key but signature provided (should 200) |
| 106 | + |
| 107 | + // TODO add test for certificate identity not configured for API key but wrong signature provided (should 401) |
| 108 | + |
| 109 | + // TODO add test for certificate identity regex matching (should 200) |
| 110 | + } |
| 111 | + |
| 112 | + private void assertCrossClusterAuthFail() { |
| 113 | + var responseException = assertThrows(ResponseException.class, () -> simpleCrossClusterSearch(randomBoolean())); |
| 114 | + assertThat(responseException.getResponse().getStatusLine().getStatusCode(), equalTo(401)); |
| 115 | + assertThat(responseException.getMessage(), containsString("Failed to verify cross cluster api key signature certificate from [(")); |
| 116 | + } |
| 117 | + |
| 118 | + private void assertCrossClusterSearchSuccessfulWithoutResult() throws IOException { |
| 119 | + boolean alsoSearchLocally = randomBoolean(); |
| 120 | + final Response response = simpleCrossClusterSearch(alsoSearchLocally); |
| 121 | + assertOK(response); |
| 122 | + } |
| 123 | + |
| 124 | + private void assertCrossClusterSearchSuccessfulWithResult() throws IOException { |
| 125 | + boolean alsoSearchLocally = randomBoolean(); |
| 126 | + final Response response = simpleCrossClusterSearch(alsoSearchLocally); |
| 127 | + assertOK(response); |
| 128 | + final SearchResponse searchResponse; |
| 129 | + try (var parser = responseAsParser(response)) { |
| 130 | + searchResponse = SearchResponseUtils.parseSearchResponse(parser); |
| 131 | + } |
| 132 | + try { |
| 133 | + final List<String> actualIndices = Arrays.stream(searchResponse.getHits().getHits()) |
| 134 | + .map(SearchHit::getIndex) |
| 135 | + .collect(Collectors.toList()); |
| 136 | + if (alsoSearchLocally) { |
| 137 | + assertThat(actualIndices, containsInAnyOrder("index1", "local_index")); |
| 138 | + } else { |
| 139 | + assertThat(actualIndices, containsInAnyOrder("index1")); |
| 140 | + } |
| 141 | + } finally { |
| 142 | + searchResponse.decRef(); |
| 143 | + } |
| 144 | + } |
| 145 | + |
| 146 | + private Response simpleCrossClusterSearch(boolean alsoSearchLocally) throws IOException { |
| 147 | + final var searchRequest = new Request( |
| 148 | + "GET", |
| 149 | + String.format( |
| 150 | + Locale.ROOT, |
| 151 | + "/%s%s:%s/_search?ccs_minimize_roundtrips=%s", |
| 152 | + alsoSearchLocally ? "local_index," : "", |
| 153 | + randomFrom("my_remote_cluster", "*", "my_remote_*"), |
| 154 | + randomFrom("index1", "*"), |
| 155 | + randomBoolean() |
| 156 | + ) |
| 157 | + ); |
| 158 | + return performRequestWithRemoteAccessUser(searchRequest); |
| 159 | + } |
| 160 | + |
| 161 | + private void indexTestData() throws Exception { |
| 162 | + configureRemoteCluster(); |
| 163 | + |
| 164 | + // Fulfilling cluster |
| 165 | + { |
| 166 | + // Index some documents, so we can attempt to search them from the querying cluster |
| 167 | + final Request bulkRequest = new Request("POST", "/_bulk?refresh=true"); |
| 168 | + bulkRequest.setJsonEntity(Strings.format(""" |
| 169 | + { "index": { "_index": "index1" } } |
| 170 | + { "foo": "bar" } |
| 171 | + { "index": { "_index": "index2" } } |
| 172 | + { "bar": "foo" } |
| 173 | + { "index": { "_index": "prefixed_index" } } |
| 174 | + { "baz": "fee" }\n""")); |
| 175 | + assertOK(performRequestAgainstFulfillingCluster(bulkRequest)); |
| 176 | + } |
| 177 | + |
| 178 | + // Query cluster |
| 179 | + { |
| 180 | + // Index some documents, to use them in a mixed-cluster search |
| 181 | + final var indexDocRequest = new Request("POST", "/local_index/_doc?refresh=true"); |
| 182 | + indexDocRequest.setJsonEntity("{\"local_foo\": \"local_bar\"}"); |
| 183 | + assertOK(client().performRequest(indexDocRequest)); |
| 184 | + |
| 185 | + // Create user role with privileges for remote and local indices |
| 186 | + final var putRoleRequest = new Request("PUT", "/_security/role/" + REMOTE_SEARCH_ROLE); |
| 187 | + putRoleRequest.setJsonEntity(""" |
| 188 | + { |
| 189 | + "description": "role with privileges for remote and local indices", |
| 190 | + "cluster": ["manage_own_api_key"], |
| 191 | + "indices": [ |
| 192 | + { |
| 193 | + "names": ["local_index"], |
| 194 | + "privileges": ["read"] |
| 195 | + } |
| 196 | + ], |
| 197 | + "remote_indices": [ |
| 198 | + { |
| 199 | + "names": ["index1", "not_found_index", "prefixed_index"], |
| 200 | + "privileges": ["read", "read_cross_cluster"], |
| 201 | + "clusters": ["my_remote_cluster"] |
| 202 | + } |
| 203 | + ] |
| 204 | + }"""); |
| 205 | + assertOK(adminClient().performRequest(putRoleRequest)); |
| 206 | + final var putUserRequest = new Request("PUT", "/_security/user/" + REMOTE_SEARCH_USER); |
| 207 | + putUserRequest.setJsonEntity(""" |
| 208 | + { |
| 209 | + "password": "x-pack-test-password", |
| 210 | + "roles" : ["remote_search"] |
| 211 | + }"""); |
| 212 | + assertOK(adminClient().performRequest(putUserRequest)); |
| 213 | + } |
| 214 | + } |
| 215 | + |
| 216 | + private void updateClusterSettingsFulfillingCluster(Settings settings) throws IOException { |
| 217 | + final var request = newXContentRequest(HttpMethod.PUT, "/_cluster/settings", (builder, params) -> { |
| 218 | + builder.startObject("persistent"); |
| 219 | + settings.toXContent(builder, params); |
| 220 | + return builder.endObject(); |
| 221 | + }); |
| 222 | + |
| 223 | + performRequestWithAdminUser(fulfillingClusterClient, request); |
| 224 | + } |
| 225 | + |
| 226 | + private Response performRequestWithRemoteAccessUser(final Request request) throws IOException { |
| 227 | + request.setOptions(RequestOptions.DEFAULT.toBuilder().addHeader("Authorization", basicAuthHeaderValue(REMOTE_SEARCH_USER, PASS))); |
| 228 | + return client().performRequest(request); |
| 229 | + } |
| 230 | +} |
0 commit comments