Add doPrivilege blocks for socket connect operations in plugins #22534

Tim-Brooks · 2017-01-10T17:14:30Z

This is related to #22116. A number of plugins (discovery-azure-classic, discovery-ec2, discovery-gce, repository-azure, repository-gcs, and repository-s3) open socket connections. As SocketPermissions are transitioned out of core, these plugins will require connect permission. This pull request wraps operations that require these permissions in doPrivileged blocks.

Tim-Brooks · 2017-01-10T17:19:10Z

With this pull request if I do the following the test package passes:

Move connect out of core
Put connect individually in all of the modified plugins
Silence modules requiring connect (netty, etc) that have not been modified by this PR

This will require a careful review to see if I caught all the places where connections occur in plugins (there were a lot, so it is possible I missed some).

s1monw

I left a bunch of comments. I think it's hard to really make sure we catch everything by review. We have to rely on the testing and the integration testing with these 3rd party storage backends must be improved. I think we are on that.

s1monw · 2017-01-11T10:54:17Z

plugins/discovery-ec2/src/main/java/org/elasticsearch/cloud/aws/util/SocketAccess.java

+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+public class SocketAccess {


can this class be final and abstract then notbody can instantiate it. We also need javadocs on this and all the methods

also explain why it's not in core?

I can make it final and abstract and add javadocs.

I did not put it in core because then it seems that core would require the SocketPermissions. That is also why I need versions in each plugin.

yeah I can see why I was just asking to put this info on the class so folks see immediately why we duplicate code

Ohhh. Yeah. I'll add docstrings to all of the classes with explanations.

s1monw · 2017-01-11T10:56:08Z

...s/discovery-ec2/src/main/java/org/elasticsearch/plugin/discovery/ec2/Ec2DiscoveryPlugin.java

-                    throw new RuntimeException(e);
-                }
-                return null;
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {


can you leave a comment why this is needed in this particular place?

Yes - I can add a comment.

s1monw · 2017-01-11T10:57:24Z

...s/discovery-ec2/src/main/java/org/elasticsearch/plugin/discovery/ec2/Ec2DiscoveryPlugin.java

@@ -194,14 +191,14 @@ static Settings getAvailabilityZoneNodeAttributes(Settings settings, String azMe
        try {
            url = new URL(azMetadataUrl);
            logger.debug("obtaining ec2 [placement/availability-zone] from ec2 meta-data url {}", url);
-            urlConnection = url.openConnection();


I wonder if we can leverage forbidden APIs to restrict the use of openConnection and add a dedicated method that does it with suppressforbidden on it?

shall we spin off anotehr issue for this?

I thought that would be good. On #22116 I left a comment a few days ago that maybe we should add another task on that issue to mark relevant APIs as forbidden?

s1monw · 2017-01-11T10:57:34Z

...s/discovery-ec2/src/main/java/org/elasticsearch/plugin/discovery/ec2/Ec2DiscoveryPlugin.java

            urlConnection.setConnectTimeout(2000);
        } catch (IOException e) {
            // should not happen, we know the url is not malformed, and openConnection does not actually hit network
            throw new UncheckedIOException(e);
        }

-        try (InputStream in = urlConnection.getInputStream();
+        try (InputStream in = SocketAccess.doPrivilegedIOException(urlConnection::getInputStream);


same here...

s1monw · 2017-01-11T10:59:28Z

plugins/discovery-gce/src/main/java/org/elasticsearch/cloud/gce/util/Access.java

+ * GCE's http client changes access levels. Additionally remote calls need SocketPermissions for 'connect'.
+ * This class wraps these operations in {@link AccessController#doPrivileged(PrivilegedAction)} blocks.
+ */
+public class Access {


can we make these classes consistent naming wise etc?

I specifically name this one differently, because it is used for other permissions than just socket permissions. The GCE plugin requires additional permissions.

// needed because of problems in gce permission java.lang.RuntimePermission "accessDeclaredMembers"; permission java.lang.RuntimePermission "setFactory"; permission java.lang.reflect.ReflectPermission "suppressAccessChecks";

And some of the usages of this class are unrelated to socket permissions. These usages preexist my PR.

In the other plugins I named the helper classes SocketAccess because that is the only thing I use them for.

ok can you add alls these infos into this class

s1monw · 2017-01-11T11:00:09Z

...epository-azure/src/main/java/org/elasticsearch/cloud/azure/blobstore/util/SocketAccess.java

+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+public class SocketAccess {


same here javadocs and naming consistency

s1monw · 2017-01-11T11:02:04Z

...epository-azure/src/main/java/org/elasticsearch/cloud/azure/blobstore/util/SocketAccess.java

+    }
+
+    @FunctionalInterface
+    public interface VoidOpException {


maybe name this StorageRunnable ?

s1monw · 2017-01-11T11:04:59Z

...ry-gcs/src/main/java/org/elasticsearch/common/blobstore/gcs/GoogleCloudStorageBlobStore.java

+            if (blobs.hasNext() == false || deletions.size() == MAX_BATCHING_REQUESTS) {
+                try {
+                    // Deletions are executed using a batch request
+                    BatchRequest batch = client.batch();


are we sure nothing else in this block needs a privileged block? I'd feel better if we kept the existing wrap

Yeah now that I take another look - I think client.objects().delete and delete.query need permissions. I can go back to wrapping the whole block.

s1monw · 2017-01-11T11:05:33Z

...s/repository-gcs/src/main/java/org/elasticsearch/common/blobstore/gcs/util/SocketAccess.java

+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+public class SocketAccess {


annoying :) I'd be nice if we could share it somehow

Tim-Brooks · 2017-01-11T15:18:28Z

Thanks for the review @s1monw. There are some immediate changes that you pointed out that I can work on implementing.

I responded to your comments with some specifics.

s1monw

LGTM I left a question about forbidden APIs

jasontedor

I noticed one thing.

jasontedor · 2017-01-17T15:23:38Z

plugins/discovery-ec2/src/main/java/org/elasticsearch/cloud/aws/util/SocketAccess.java

+    private static void checkSpecialPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SpecialPermission());


I think we can use a singleton instance?

jasontedor · 2017-01-17T15:24:18Z

plugins/discovery-gce/src/main/java/org/elasticsearch/cloud/gce/util/Access.java

+    private static void checkSpecialPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SpecialPermission());


Can we use a singleton instance?

jasontedor · 2017-01-17T15:24:31Z

...epository-azure/src/main/java/org/elasticsearch/cloud/azure/blobstore/util/SocketAccess.java

+    private static void checkSpecialPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SpecialPermission());


Singleton instance?

jasontedor · 2017-01-17T15:25:02Z

...s/repository-gcs/src/main/java/org/elasticsearch/common/blobstore/gcs/util/SocketAccess.java

+    private static void checkSpecialPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SpecialPermission());


One more opportunity to use a singleton instance?

jasontedor · 2017-01-17T15:25:23Z

plugins/repository-s3/src/main/java/org/elasticsearch/cloud/aws/util/SocketAccess.java

+    private static void checkSpecialPermission() {
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new SpecialPermission());


Last one? 😄

Tim-Brooks · 2017-01-17T16:28:46Z

That was my bad. I just used field extract in IDEA without thinking about making it a constant. I updated with new commit.

Tim-Brooks · 2017-01-17T20:31:22Z

@jasontedor I made the changes to make the permission a constant and the build is passing. Let me know if you are now okay with me merging this.

jasontedor

LGTM.

This commit fixes an issue that was missed in elastic#22534. `AWSCredentialsProvider.getCredentials()` appears to potentially open a socket connect. This operation needed to be wrapped in `doPrivileged()`. This should fix issue elastic#23271.

This commit fixes an issue that was missed in #22534. `AWSCredentialsProvider.getCredentials()` appears to potentially open a socket connect. This operation needed to be wrapped in `doPrivileged()`. This should fix issue #23271.

This commit adds a new fixture that emulates a S3 service in order to improve the existing integration tests. This is very similar to what has been made for Google Cloud Storage in elastic#28788, and such tests would have helped a lot to catch bugs like elastic#22534. The AmazonS3Fixture is brittle and only implements the very necessary stuff for the S3 repository to work, but at least it works and can be adapted for specific tests needs.

This commit adds a new fixture that emulates a S3 service in order to improve the existing integration tests. This is very similar to what has been made for Google Cloud Storage in #28788, and such tests would have helped a lot to catch bugs like #22534. The AmazonS3Fixture is brittle and only implements the very necessary stuff for the S3 repository to work, but at least it works and can be adapted for specific tests needs.

This commit adds a new fixture that emulates an Azure Storage service in order to improve the existing integration tests. This is very similar to what has been made for Google Cloud Storage in elastic#28788 and for Amazon S3 in elastic#29296, and it would have helped a lot to catch bugs like elastic#22534.

This commit adds a new fixture that emulates an Azure Storage service in order to improve the existing integration tests. This is very similar to what has been made for Google Cloud Storage in #28788 and for Amazon S3 in #29296, and it would have helped a lot to catch bugs like #22534.

Tim-Brooks added 4 commits January 10, 2017 09:35

Add SocketAccess files for plugins

6870089

Add doPrivileged blocks to plugins

41178fb

Clean up privilege blocks in GCE discovery plugin

060a4c0

Merge remote-tracking branch 'upstream/master' into migrate_connect

6a89265

Tim-Brooks added :Core/Infra/Core Core issues without another label >enhancement review v6.0.0-alpha1 labels Jan 10, 2017

Tim-Brooks requested review from s1monw and jasontedor January 10, 2017 17:14

Tim-Brooks mentioned this pull request Jan 10, 2017

Only grant connect,accept permissions to transport-netty4 #22116

Closed

4 tasks

s1monw requested changes Jan 11, 2017

View reviewed changes

Tim-Brooks added 3 commits January 12, 2017 10:30

Merge remote-tracking branch 'upstream/master' into migrate_connect

ec69de3

Address some issues that arose in code review

2fb3da9

Add comment about required permissions

704561d

Tim-Brooks added :Core/Infra/Plugins Plugin API and infrastructure and removed :Core/Infra/Core Core issues without another label labels Jan 12, 2017

s1monw approved these changes Jan 17, 2017

View reviewed changes

jasontedor requested changes Jan 17, 2017

View reviewed changes

Tim-Brooks added 2 commits January 17, 2017 09:33

Store specialpermission in field

71f2a32

Make fields constants

5b166e5

jasontedor approved these changes Jan 18, 2017

View reviewed changes

Tim-Brooks merged commit 2766b08 into elastic:master Jan 18, 2017

Tim-Brooks deleted the migrate_connect branch January 18, 2017 16:12

Tim-Brooks mentioned this pull request Feb 21, 2017

Wrap getCredentials() in a doPrivileged() block #23297

Merged

tlrx mentioned this pull request Mar 29, 2018

Use fixture to test repository-s3 plugin #29296

Merged

tlrx mentioned this pull request Apr 3, 2018

Use fixture to test repository-azure plugin #29347

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add doPrivilege blocks for socket connect operations in plugins #22534

Add doPrivilege blocks for socket connect operations in plugins #22534

Tim-Brooks commented Jan 10, 2017

Tim-Brooks commented Jan 10, 2017 •

edited

Loading

s1monw left a comment

s1monw Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

s1monw Jan 17, 2017

Tim-Brooks Jan 17, 2017

s1monw Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

s1monw Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks Jan 11, 2017

s1monw Jan 11, 2017

Tim-Brooks commented Jan 11, 2017 •

edited

Loading

s1monw left a comment

jasontedor left a comment

jasontedor Jan 17, 2017

jasontedor Jan 17, 2017

jasontedor Jan 17, 2017

jasontedor Jan 17, 2017

jasontedor Jan 17, 2017

Tim-Brooks commented Jan 17, 2017

Tim-Brooks commented Jan 17, 2017

jasontedor left a comment

Add doPrivilege blocks for socket connect operations in plugins #22534

Add doPrivilege blocks for socket connect operations in plugins #22534

Conversation

Tim-Brooks commented Jan 10, 2017

Tim-Brooks commented Jan 10, 2017 • edited Loading

s1monw left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tim-Brooks commented Jan 11, 2017 • edited Loading

s1monw left a comment

Choose a reason for hiding this comment

jasontedor left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tim-Brooks commented Jan 17, 2017

Tim-Brooks commented Jan 17, 2017

jasontedor left a comment

Choose a reason for hiding this comment

Tim-Brooks commented Jan 10, 2017 •

edited

Loading

Tim-Brooks commented Jan 11, 2017 •

edited

Loading