Skip to content

Commit ce19061

Browse files
jfredenjfreden
committed
fixup! Clean
1 parent ff98d0d commit ce19061

File tree

7 files changed

+30
-42
lines changed

7 files changed

+30
-42
lines changed

‎x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySignatureManagerIntegTests.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@
1212
import org.elasticsearch.common.ssl.PemKeyConfig;
1313
import org.elasticsearch.test.SecurityIntegTestCase;
1414

15-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_CERT_PATH;
16-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_ALIAS;
17-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_PATH;
18-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_SECURE_PASSWORD;
19-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_TYPE;
20-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEY_PATH;
15+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_CERT_PATH;
16+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_ALIAS;
17+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_PATH;
18+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_SECURE_PASSWORD;
19+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_TYPE;
20+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEY_PATH;
2121
import static org.hamcrest.Matchers.equalToIgnoringCase;
2222

2323
public class CrossClusterApiKeySignatureManagerIntegTests extends SecurityIntegTestCase {

‎x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/transport/CrossClusterSigningConfigReloaderIntegTests.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,14 @@
2828

2929
import javax.net.ssl.KeyManagerFactory;
3030

31-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_CERT_PATH;
32-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_ALGORITHM;
33-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_ALIAS;
34-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_PATH;
35-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_SECURE_PASSWORD;
36-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEYSTORE_TYPE;
37-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEY_PATH;
38-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SIGNING_KEY_SECURE_PASSPHRASE;
31+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_CERT_PATH;
32+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_ALGORITHM;
33+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_ALIAS;
34+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_PATH;
35+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_SECURE_PASSWORD;
36+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEYSTORE_TYPE;
37+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEY_PATH;
38+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SIGNING_KEY_SECURE_PASSPHRASE;
3939
import static org.hamcrest.Matchers.equalTo;
4040

4141
public class CrossClusterSigningConfigReloaderIntegTests extends SecurityIntegTestCase {
@@ -302,7 +302,7 @@ private void addAndRemoveClusterConfigsRuntime(
302302
} finally {
303303
var builder = Settings.builder();
304304
for (var clusterAlias : clusterAliases) {
305-
CrossClusterApiKeySignatureSettings.getDynamicSettings().forEach(setting -> {
305+
CrossClusterApiKeySigningSettings.getDynamicSettings().forEach(setting -> {
306306
builder.putNull(setting.getConcreteSettingForNamespace(clusterAlias).getKey());
307307
});
308308
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -420,7 +420,7 @@
420420
import org.elasticsearch.xpack.security.support.SecuritySystemIndices;
421421
import org.elasticsearch.xpack.security.transport.CrossClusterAccessTransportInterceptor;
422422
import org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureManager;
423-
import org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings;
423+
import org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings;
424424
import org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningConfigReloader;
425425
import org.elasticsearch.xpack.security.transport.RemoteClusterTransportInterceptor;
426426
import org.elasticsearch.xpack.security.transport.SecurityHttpSettings;
@@ -1310,10 +1310,6 @@ private List<CustomAuthenticator> getCustomAuthenticatorFromExtensions(SecurityE
13101310
}
13111311
}
13121312

1313-
private void createCrossClusterApiKeySigning() {
1314-
1315-
}
1316-
13171313
private ServiceAccountService createServiceAccountService(
13181314
List<Object> components,
13191315
CacheInvalidatorRegistry cacheInvalidatorRegistry,
@@ -1581,7 +1577,7 @@ public static List<Setting<?>> getSettings(List<SecurityExtension> securityExten
15811577
settingsList.add(CachingServiceAccountTokenStore.CACHE_MAX_TOKENS_SETTING);
15821578
settingsList.add(SimpleRole.CACHE_SIZE_SETTING);
15831579
settingsList.add(NativeRoleMappingStore.LAST_LOAD_CACHE_ENABLED_SETTING);
1584-
settingsList.addAll(CrossClusterApiKeySignatureSettings.getSettings());
1580+
settingsList.addAll(CrossClusterApiKeySigningSettings.getSettings());
15851581

15861582
// hide settings
15871583
settingsList.add(Setting.stringListSetting(SecurityField.setting("hide_settings"), Property.NodeScope, Property.Filtered));

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySignatureManager.java‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,9 @@
2424
import java.nio.file.Files;
2525
import java.nio.file.Path;
2626
import java.security.GeneralSecurityException;
27-
import java.security.InvalidKeyException;
28-
import java.security.NoSuchAlgorithmException;
2927
import java.security.PrivateKey;
3028
import java.security.Signature;
31-
import java.security.SignatureException;
3229
import java.security.cert.CertificateEncodingException;
33-
import java.security.cert.CertificateException;
3430
import java.security.cert.X509Certificate;
3531
import java.util.Arrays;
3632
import java.util.Collection;
@@ -46,8 +42,8 @@
4642
import javax.net.ssl.X509ExtendedTrustManager;
4743
import javax.net.ssl.X509KeyManager;
4844

49-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.KEYSTORE_ALIAS_SUFFIX;
50-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SETTINGS_PART_SIGNING;
45+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.KEYSTORE_ALIAS_SUFFIX;
46+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SETTINGS_PART_SIGNING;
5147

5248
public class CrossClusterApiKeySignatureManager implements ReloadableFileBasedSigningConfigProvider {
5349
private final Logger logger = LogManager.getLogger(getClass());
@@ -173,7 +169,7 @@ public boolean verify(X509CertificateSignature signature, String... headers) {
173169
try {
174170
// Make sure the provided certificate chain is trusted
175171
trustManager.checkClientTrusted(signature.certificates(), AUTH_TYPE);
176-
// TODO Make sure the signing certificate belongs to the correct DN (the api key identity)
172+
// TODO Make sure the signing certificate belongs to the correct DN (the configured api key cert identity)
177173
// Make sure signature is correct
178174
final Signature signer = Signature.getInstance(signature.algorithm());
179175
signer.initVerify(signature.certificates()[0]);
@@ -271,7 +267,6 @@ private X509KeyPair buildKeyPair(X509KeyManager keyManager, SslKeyConfig keyConf
271267
case 1 -> {
272268
final String aliasFromKeyStore = aliases.iterator().next();
273269
final X509Certificate[] chain = keyManager.getCertificateChain(aliasFromKeyStore);
274-
// TODO ideally we would not sent the root cert here. What's the best way to filter it out?
275270
yield new X509KeyPair(chain, keyManager.getPrivateKey(aliasFromKeyStore));
276271
}
277272
default -> throw new IllegalStateException(
@@ -303,7 +298,6 @@ private X509KeyPair buildKeyPair(X509KeyManager keyManager, SslKeyConfig keyConf
303298
throw new IllegalStateException("Key config missing certificate chain for alias [" + alias + "]");
304299
}
305300

306-
// TODO ideally we would not sent the root cert here. What's the best way to filter it out?
307301
return new X509KeyPair(chain, keyManager.getPrivateKey(alias));
308302
}
309303

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySigningConfigReloader.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@
3434
import java.util.function.Consumer;
3535
import java.util.stream.Collectors;
3636

37-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.SETTINGS_PART_SIGNING;
38-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.getDynamicSettings;
39-
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySignatureSettings.getSecureSettings;
37+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.SETTINGS_PART_SIGNING;
38+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.getDynamicSettings;
39+
import static org.elasticsearch.xpack.security.transport.CrossClusterApiKeySigningSettings.getSecureSettings;
4040

4141
/**
4242
* Responsible for reloading a provided {@link ReloadableFileBasedSigningConfigProvider} when updates are received from the following

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySignatureSettings.java‎ renamed to ‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySigningSettings.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
import javax.net.ssl.KeyManagerFactory;
2020

21-
public class CrossClusterApiKeySignatureSettings {
21+
public class CrossClusterApiKeySigningSettings {
2222
static final String SETTINGS_PART_SIGNING = "signing";
2323

2424
static final String KEYSTORE_ALIAS_SUFFIX = "keystore.alias";
@@ -128,8 +128,6 @@ public class CrossClusterApiKeySignatureSettings {
128128
key -> Setting.simpleString(key, "", Setting.Property.NodeScope, Setting.Property.Filtered, Setting.Property.Dynamic)
129129
);
130130

131-
// TODO SHOULD TRUST_RESTRICTIONS_X509_FIELDS BE ADDED!?
132-
133131
public static List<Setting.AffixSetting<?>> getDynamicSettings() {
134132
return List.of(
135133
SIGNING_KEYSTORE_ALIAS,

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/transport/CrossClusterApiKeySigningConfigReloaderTests.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public void setUp() throws Exception {
5252
public void testSimpleDynamicSettingsUpdate() {
5353
Settings settings = settingsBuilder.put("cluster.remote.my_remote.signing.keystore.alias", "mykey").build();
5454
var environment = TestEnvironment.newEnvironment(settings);
55-
var clusterSettings = new ClusterSettings(settings, new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings()));
55+
var clusterSettings = new ClusterSettings(settings, new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings()));
5656

5757
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(
5858
TestEnvironment.newEnvironment(settings),
@@ -88,7 +88,7 @@ public void testDynamicSettingsUpdateWithAddedFiles() throws Exception {
8888

8989
var clusterSettings = new ClusterSettings(
9090
settingsBuilder.build(),
91-
new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings())
91+
new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings())
9292
);
9393

9494
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(
@@ -121,7 +121,7 @@ public void testDynamicSettingsUpdateWithAddedFiles() throws Exception {
121121
}
122122

123123
public void testSimpleSecureSettingsReload() {
124-
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings()));
124+
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings()));
125125
var environment = TestEnvironment.newEnvironment(settingsBuilder.build());
126126
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(
127127
environment,
@@ -141,7 +141,7 @@ public void testSimpleSecureSettingsReload() {
141141
}
142142

143143
public void testSecureSettingsReloadNoMatchingSecureSettings() {
144-
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings()));
144+
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings()));
145145
var environment = TestEnvironment.newEnvironment(settingsBuilder.build());
146146
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(
147147
environment,
@@ -161,7 +161,7 @@ public void testSecureSettingsReloadNoMatchingSecureSettings() {
161161

162162
public void testFileUpdatedReloaded() throws Exception {
163163
var fileToMonitor = createTempFile();
164-
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings()));
164+
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings()));
165165
var initialSettings = settingsBuilder.put("cluster.remote.my_remote.signing.keystore.path", fileToMonitor).build();
166166
var environment = TestEnvironment.newEnvironment(initialSettings);
167167
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(
@@ -185,7 +185,7 @@ public void testFileUpdatedReloaded() throws Exception {
185185

186186
public void testFileDeletedReloaded() throws Exception {
187187
var fileToMonitor = createTempFile();
188-
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySignatureSettings.getDynamicSettings()));
188+
var clusterSettings = new ClusterSettings(Settings.EMPTY, new HashSet<>(CrossClusterApiKeySigningSettings.getDynamicSettings()));
189189
var initialSettings = settingsBuilder.put("cluster.remote.my_remote.signing.keystore.path", fileToMonitor).build();
190190
var environment = TestEnvironment.newEnvironment(initialSettings);
191191
var crossClusterApiKeySigningConfigReloader = new CrossClusterApiKeySigningConfigReloader(

0 commit comments

Comments
 (0)