diff --git a/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java b/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java index 28761a4666..fa9299454d 100644 --- a/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java +++ b/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java @@ -1118,10 +1118,10 @@ public void onPreQueryPhase(SearchContext context) { @Override public void onNewReaderContext(ReaderContext readerContext) { - final boolean interClusterRequest = HeaderHelper.isInterClusterRequest(threadPool.getThreadContext()); + final boolean localClusterNodeRequest = HeaderHelper.isLocalClusterNodeRequest(threadPool.getThreadContext()); if (Origin.LOCAL.toString() .equals(threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_ORIGIN)) - && (interClusterRequest || HeaderHelper.isDirectRequest(threadPool.getThreadContext())) + && (localClusterNodeRequest || HeaderHelper.isDirectRequest(threadPool.getThreadContext())) ) { readerContext.putInContext("_opendistro_security_scroll_auth_local", Boolean.TRUE); @@ -1135,10 +1135,10 @@ public void onNewReaderContext(ReaderContext readerContext) { @Override public void onNewScrollContext(ReaderContext readerContext) { - final boolean interClusterRequest = HeaderHelper.isInterClusterRequest(threadPool.getThreadContext()); + final boolean localClusterNodeRequest = HeaderHelper.isLocalClusterNodeRequest(threadPool.getThreadContext()); if (Origin.LOCAL.toString() .equals(threadPool.getThreadContext().getTransient(ConfigConstants.OPENDISTRO_SECURITY_ORIGIN)) - && (interClusterRequest || HeaderHelper.isDirectRequest(threadPool.getThreadContext())) + && (localClusterNodeRequest || HeaderHelper.isDirectRequest(threadPool.getThreadContext())) ) { readerContext.putInContext("_opendistro_security_scroll_auth_local", Boolean.TRUE); diff --git a/src/main/java/org/opensearch/security/action/whoami/TransportWhoAmIAction.java b/src/main/java/org/opensearch/security/action/whoami/TransportWhoAmIAction.java index 4bc6238765..4e41727c40 100644 --- a/src/main/java/org/opensearch/security/action/whoami/TransportWhoAmIAction.java +++ b/src/main/java/org/opensearch/security/action/whoami/TransportWhoAmIAction.java @@ -69,8 +69,8 @@ protected void doExecute(Task task, WhoAmIRequest request, ActionListener void ap threadContext.putPersistent(ConfigConstants.OPENDISTRO_SECURITY_AUTHENTICATED_USER, new UserSubjectImpl(threadPool, user)); } final boolean userIsAdmin = isUserAdmin(user, adminDns); - final boolean interClusterRequest = HeaderHelper.isInterClusterRequest(threadContext); - final boolean trustedClusterRequest = HeaderHelper.isTrustedClusterRequest(threadContext); + final boolean localClusterNodeRequest = HeaderHelper.isLocalClusterNodeRequest(threadContext); + final boolean remoteClusterNodeRequest = HeaderHelper.isRemoteClusterNodeRequest(threadContext); final boolean confRequest = "true".equals( HeaderHelper.getSafeFromHeader(threadContext, ConfigConstants.OPENDISTRO_SECURITY_CONF_REQUEST_HEADER) ); final boolean passThroughRequest = action.startsWith("indices:admin/seq_no") || action.equals(WhoAmIAction.NAME); - final boolean internalRequest = (interClusterRequest || HeaderHelper.isDirectRequest(threadContext)) + final boolean internalRequest = (localClusterNodeRequest || HeaderHelper.isDirectRequest(threadContext)) && action.startsWith("internal:") && !action.startsWith("internal:transport/proxy"); @@ -337,7 +337,7 @@ private void ap } if (Origin.LOCAL.toString().equals(threadContext.getTransient(ConfigConstants.OPENDISTRO_SECURITY_ORIGIN)) - && (interClusterRequest || HeaderHelper.isDirectRequest(threadContext)) + && (localClusterNodeRequest || HeaderHelper.isDirectRequest(threadContext)) && (injectedRoles == null) && (user == null)) { @@ -355,12 +355,14 @@ private void ap boolean skipSecurityIfDualMode = threadContext.getTransient( ConfigConstants.SECURITY_SSL_DUAL_MODE_SKIP_SECURITY ) == Boolean.TRUE; - if ((interClusterRequest || trustedClusterRequest || request.remoteAddress() == null) + if ((localClusterNodeRequest || remoteClusterNodeRequest || request.remoteAddress() == null) && !compatConfig.transportInterClusterAuthEnabled()) { chain.proceed(task, action, request, listener); return; - } else if ((interClusterRequest || trustedClusterRequest || request.remoteAddress() == null || skipSecurityIfDualMode) - && compatConfig.transportInterClusterPassiveAuthEnabled()) { + } else if ((localClusterNodeRequest + || remoteClusterNodeRequest + || request.remoteAddress() == null + || skipSecurityIfDualMode) && compatConfig.transportInterClusterPassiveAuthEnabled()) { log.info("Transport auth in passive mode and no user found. Injecting default user"); user = User.DEFAULT_TRANSPORT_USER; threadContext.putTransient(ConfigConstants.OPENDISTRO_SECURITY_USER, user); diff --git a/src/main/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeaders.java b/src/main/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeaders.java index b4e35d96cc..fa3068f535 100644 --- a/src/main/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeaders.java +++ b/src/main/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeaders.java @@ -73,7 +73,7 @@ public static void prepare( ) throws PrivilegesEvaluationException { DlsFlsLegacyHeaders preparedHeaders = new DlsFlsLegacyHeaders(context, config, metadata, doFilterLevelDls); - if (context.getRequest() instanceof ClusterSearchShardsRequest && HeaderHelper.isTrustedClusterRequest(threadContext)) { + if (context.getRequest() instanceof ClusterSearchShardsRequest && HeaderHelper.isRemoteClusterNodeRequest(threadContext)) { // Special case: Another cluster tries to initiate a cross cluster search and will talk directly to // the shards on our cluster. In this case, we do send the information as response headers. // The other cluster has code to correctly evaluate these response headers diff --git a/src/main/java/org/opensearch/security/support/HeaderHelper.java b/src/main/java/org/opensearch/security/support/HeaderHelper.java index b5abc9a6c7..7f80e9be98 100644 --- a/src/main/java/org/opensearch/security/support/HeaderHelper.java +++ b/src/main/java/org/opensearch/security/support/HeaderHelper.java @@ -35,7 +35,7 @@ public class HeaderHelper { - public static boolean isInterClusterRequest(final ThreadContext context) { + public static boolean isLocalClusterNodeRequest(final ThreadContext context) { return context.getTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_INTERCLUSTER_REQUEST) == Boolean.TRUE; } @@ -67,7 +67,7 @@ public static String getSafeFromHeader(final ThreadContext context, final String return null; } - if (isInterClusterRequest(context) || isTrustedClusterRequest(context) || isDirectRequest(context)) { + if (isLocalClusterNodeRequest(context) || isRemoteClusterNodeRequest(context) || isDirectRequest(context)) { return context.getHeader(headerName); } @@ -85,7 +85,7 @@ public static Serializable deserializeSafeFromHeader(final ThreadContext context return null; } - public static boolean isTrustedClusterRequest(final ThreadContext context) { + public static boolean isRemoteClusterNodeRequest(final ThreadContext context) { return context.getTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_TRUSTED_CLUSTER_REQUEST) == Boolean.TRUE; } } diff --git a/src/main/java/org/opensearch/security/transport/SecurityRequestHandler.java b/src/main/java/org/opensearch/security/transport/SecurityRequestHandler.java index be24ea3d70..605a891260 100644 --- a/src/main/java/org/opensearch/security/transport/SecurityRequestHandler.java +++ b/src/main/java/org/opensearch/security/transport/SecurityRequestHandler.java @@ -267,8 +267,8 @@ protected void messageReceivedDecorate( // if transport channel is not a netty channel but a direct or local channel (e.g. send via network) then allow it (regardless // of beeing a internal: or shard request) // also allow when issued from a remote cluster for cross cluster search - if (!HeaderHelper.isInterClusterRequest(getThreadContext()) - && !HeaderHelper.isTrustedClusterRequest(getThreadContext()) + if (!HeaderHelper.isLocalClusterNodeRequest(getThreadContext()) + && !HeaderHelper.isRemoteClusterNodeRequest(getThreadContext()) && !HeaderHelper.isExtensionRequest(getThreadContext()) && !task.getAction().equals("internal:transport/handshake") && (task.getAction().startsWith("internal:") || task.getAction().contains("["))) { @@ -310,9 +310,9 @@ protected void messageReceivedDecorate( getThreadContext().putTransient(ConfigConstants.OPENDISTRO_SECURITY_ORIGIN, Origin.TRANSPORT.toString()); } - // network intercluster request or cross search cluster request - if (!(HeaderHelper.isInterClusterRequest(getThreadContext()) - || HeaderHelper.isTrustedClusterRequest(getThreadContext()) + // local cluster node request or cross-cluster request + if (!(HeaderHelper.isLocalClusterNodeRequest(getThreadContext()) + || HeaderHelper.isRemoteClusterNodeRequest(getThreadContext()) || HeaderHelper.isExtensionRequest(getThreadContext()))) { final OpenSearchException exception = ExceptionUtils.clusterWrongNodeCertConfigException(principal); log.error(exception.toString()); @@ -379,13 +379,13 @@ protected void addAdditionalContextValues( final String principal ) throws Exception { - boolean isInterClusterRequest = requestEvalProvider.isInterClusterRequest(request, localCerts, peerCerts, principal); + boolean isNodeCertificateRequest = requestEvalProvider.isInterClusterRequest(request, localCerts, peerCerts, principal); final boolean isTraceEnabled = log.isTraceEnabled(); - if (isInterClusterRequest) { + if (isNodeCertificateRequest) { if (cs.getClusterName().value().equals(getThreadContext().getHeader("_opendistro_security_remotecn"))) { if (isTraceEnabled && !action.startsWith("internal:")) { - log.trace("Is inter cluster request ({}/{}/{})", action, request.getClass(), request.remoteAddress()); + log.trace("Is local cluster node request ({}/{}/{})", action, request.getClass(), request.remoteAddress()); } getThreadContext().putTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_INTERCLUSTER_REQUEST, Boolean.TRUE); @@ -395,7 +395,7 @@ protected void addAdditionalContextValues( } else { if (isTraceEnabled) { - log.trace("Is not an inter cluster request"); + log.trace("Is not a node certificate request"); } } diff --git a/src/test/java/org/opensearch/security/support/HeaderHelperTests.java b/src/test/java/org/opensearch/security/support/HeaderHelperTests.java new file mode 100644 index 0000000000..315eb2ad2f --- /dev/null +++ b/src/test/java/org/opensearch/security/support/HeaderHelperTests.java @@ -0,0 +1,39 @@ +/* + * SPDX-License-Identifier: Apache-2.0 + * + * The OpenSearch Contributors require contributions made to + * this file be licensed under the Apache-2.0 license or a + * compatible open source license. + */ + +package org.opensearch.security.support; + +import org.apache.lucene.tests.util.LuceneTestCase; + +import org.opensearch.common.settings.Settings; +import org.opensearch.common.util.concurrent.ThreadContext; + +public class HeaderHelperTests extends LuceneTestCase { + + public void testLocalClusterNodeRequest() { + final ThreadContext context = new ThreadContext(Settings.EMPTY); + + assertFalse(HeaderHelper.isLocalClusterNodeRequest(context)); + + context.putTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_INTERCLUSTER_REQUEST, Boolean.TRUE); + + assertTrue(HeaderHelper.isLocalClusterNodeRequest(context)); + assertFalse(HeaderHelper.isRemoteClusterNodeRequest(context)); + } + + public void testRemoteClusterNodeRequest() { + final ThreadContext context = new ThreadContext(Settings.EMPTY); + + assertFalse(HeaderHelper.isRemoteClusterNodeRequest(context)); + + context.putTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_TRUSTED_CLUSTER_REQUEST, Boolean.TRUE); + + assertTrue(HeaderHelper.isRemoteClusterNodeRequest(context)); + assertFalse(HeaderHelper.isLocalClusterNodeRequest(context)); + } +}