Enforce transport TLS on Basic with Security #42150
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If a basic license enables security, then we should also enforce TLS on the transport interface. This was already the case for Standard/Gold/Platinum licenses. For Basic, security defaults to disabled, so some of the process around checking whether security is actuallY enabled is more complex now that we need to account for basic licenses.
tvernum
added
>bug
:Security/TLS
|
Pinging @elastic/es-security |
tvernum
commented
May 15, 2019
| /** | ||
| * Returns <code>true</code> iff the license is a production licnese | ||
| */ | ||
| public boolean isProductionLicense() { |
There was a problem hiding this comment.
I replaced this with an explicit "is TLS required" method in XPackLicenseState.
I droppped the "production license" terminology, because it was a bit confusing (which is why this gap has only just been identified).
Why wasn't basic a production license before? Should it be one? It's perfectly fine to run basic in production, even though it doesn't have paid support.
I moved it from License to XPackLicenseState because
- All the "is XXX allowed" methods are there, so that seemed more reasonable from an appropriate compartmentalisation problem (and helps with discoverability of the code)
- To do the "is TLS required" method well it needs to look at whether security is explicitly enabled, for which all the logic is in XPackLicenseState.
tvernum
commented
May 15, 2019
| Settings.builder().put("xpack.security.transport.ssl.enabled", false).build(), build)).getMessage()); | ||
| } | ||
| , randomBoolean()).build(), MetaData.EMPTY_META_DATA)).isSuccess()); | ||
| } |
There was a problem hiding this comment.
The old method felt very much like it was using randomness to test a variety of scenarios, so I took the opportunity to split it out.
jkakavas
approved these changes
May 15, 2019
| if (XPackLicenseState.isTransportTlsRequired(license, context.settings())) { | ||
| return BootstrapCheckResult.failure("Transport SSL must be enabled if security is enabled on a [" + | ||
| license.operationMode().description() + "] license. " + | ||
| "Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting " + |
There was a problem hiding this comment.
Wouldn't it also be enough to not explicitly set xpack.security.enabled to true when in basic. I don't think it's worth trying to fit in the message cause I can't think of a way to not make the wording too confusing, but just raising in case you have any ideas around it
jasontedor
pushed a commit
that referenced
this pull request
May 15, 2019
If a basic license enables security, then we should also enforce TLS on the transport interface. This was already the case for Standard/Gold/Platinum licenses. For Basic, security defaults to disabled, so some of the process around checking whether security is actuallY enabled is more complex now that we need to account for basic licenses.
jasontedor
pushed a commit
that referenced
this pull request
May 15, 2019
If a basic license enables security, then we should also enforce TLS on the transport interface. This was already the case for Standard/Gold/Platinum licenses. For Basic, security defaults to disabled, so some of the process around checking whether security is actuallY enabled is more complex now that we need to account for basic licenses.
jasontedor
pushed a commit
that referenced
this pull request
May 15, 2019
If a basic license enables security, then we should also enforce TLS on the transport interface. This was already the case for Standard/Gold/Platinum licenses. For Basic, security defaults to disabled, so some of the process around checking whether security is actuallY enabled is more complex now that we need to account for basic licenses.
gurkankaymak
pushed a commit
to gurkankaymak/elasticsearch
that referenced
this pull request
May 27, 2019
If a basic license enables security, then we should also enforce TLS on the transport interface. This was already the case for Standard/Gold/Platinum licenses. For Basic, security defaults to disabled, so some of the process around checking whether security is actuallY enabled is more complex now that we need to account for basic licenses.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If a basic license enables security, then we should also enforce TLS
on the transport interface.
This was already the case for Standard/Gold/Platinum licenses.
For Basic, security defaults to disabled, so some of the process
around checking whether security is actually enabled is more complex
now that we need to account for basic licenses.