github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-04-24 23:27:25 -04:00
Code Issues Projects Releases Packages Wiki Activity

Ensure CI is run in FIPS 140 approved only mode (#64024)

Browse source 
We were depending on the BouncyCastle FIPS own mechanics to set
itself in approved only mode since we run with the Security
Manager enabled. The check during startup seems to happen before we
set our restrictive SecurityManager though in
org.elasticsearch.bootstrap.Elasticsearch , and this means that
BCFIPS would not be in approved only mode, unless explicitly
configured so.

This commit sets the appropriate JVM property to explicitly set
BCFIPS in approved only mode in CI and adds tests to ensure that we
will be running with BCFIPS in approved only mode when we expect to.
It also sets xpack.security.fips_mode.enabled to true for all test clusters
used in fips mode and sets the distribution to the default one. It adds a
password to the elasticsearch keystore for all test clusters that run in fips
mode.
Moreover, it changes a few unit tests where we would use bcrypt even in
FIPS 140 mode. These would still pass since we are bundling our own
bcrypt implementation, but are now changed to use FIPS 140 approved
algorithms instead for better coverage.

It also addresses a number of tests that would fail in approved only mode
Mainly:

    Tests that use PBKDF2 with a password less than 112 bits (14char). We
    elected to change the passwords used everywhere to be at least 14
    characters long instead of mandating
    the use of pbkdf2_stretch because both pbkdf2 and
    pbkdf2_stretch are supported and allowed in fips mode and it makes sense
    to test with both. We could possibly figure out the password algorithm used
    for each test and adjust password length accordingly only for pbkdf2 but
    there is little value in that. It's good practice to use strong passwords so if
    our docs and tests use longer passwords, then it's for the best. The approach
    is brittle as there is no guarantee that the next test that will be added won't
    use a short password, so we add some testing documentation too.
    This leaves us with a possible coverage gap since we do support passwords
    as short as 6 characters but we only test with > 14 chars but the
    validation itself was not tested even before. Tests can be added in a followup,
    outside of fips related context.

    Tests that use a PKCS12 keystore and were not already muted.

    Tests that depend on running test clusters with a basic license or
    using the OSS distribution as FIPS 140 support is not available in
    neither of these.

Finally, it adds some information around FIPS 140 testing in our testing
documentation reference so that developers can hopefully keep in
mind fips 140 related intricacies when writing/changing docs.
This commit is contained in:
Ioannis Kakavas 2020-12-23 21:00:49 +02:00 • committed by GitHub
parent 6493e6575e
commit bd873698bc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
177 changed files with 1075 additions and 584 deletions
Download patch file Download diff file Expand all files Collapse all files

75
TESTING.asciidoc
View file

@ -556,6 +556,81 @@ repository without fetching latest. For these use cases, you can set the system
property `tests.bwc.git_fetch_latest` to `false` and the BWC builds will skip
fetching the latest from the remote.
== Testing in FIPS 140-2 mode
We have a CI matrix job that periodically runs all our tests with the JVM configured
to be FIPS 140-2 compliant with the use of the BouncyCastle FIPS approved Security Provider.
FIPS 140-2 imposes certain requirements that affect how our tests should be set up or what
can be tested. This section summarizes what one needs to take into consideration so that
tests won't fail when run in fips mode.
=== Muting tests in FIPS 140-2 mode
If the following limitations cannot be observed, or there is a need to actually test some use
case that is not available/allowed in fips mode, the test can be muted. For unit tests or Java
rest tests one can use
------------------------------------------------
assumeFalse("Justification why this cannot be run in FIPS mode", inFipsJvm());
------------------------------------------------
For specific YAML rest tests one can use
------------------------------------------------
- skip:
features: fips_140
reason: "Justification why this cannot be run in FIPS mode"
------------------------------------------------
For disabling entire types of tests for subprojects, one can use for example:
------------------------------------------------
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
------------------------------------------------
in `build.gradle`.
=== Limitations
The following should be taken into consideration when writing new tests or adjusting existing ones:
==== TLS
`JKS` and `PKCS#12` keystores cannot be used in FIPS mode. If the test depends on being able to use
a keystore, it can be muted when needed ( see `ESTestCase#inFipsJvm` ). Alternatively, one can use
PEM encoded files for keys and certificates for the tests or for setting up TLS in a test cluster.
Also, when in FIPS 140 mode, hostname verification for TLS cannot be turned off so if you are using
`*.verification_mode: none` , you'd need to mute the test in fips mode.
When using TLS, ensure that private keys used are longer than 2048 bits, or mute the test in fips mode.
==== Password hashing algorithm
Test clusters are configured with `xpack.security.fips_mode.enabled` set to true. This means that
FIPS 140-2 related bootstrap checks are enabled and the test cluster will fail to form if the
password hashing algorithm is set to something else than a PBKDF2 based one. You can delegate the choice
of algorithm to i.e. `SecurityIntegTestCase#getFastStoredHashAlgoForTests` if you don't mind the
actual algorithm used, or depend on default values for the test cluster nodes.
==== Password length
While using `pbkdf2` as the password hashing algorithm, FIPS 140-2 imposes a requirement that
passwords are longer than 14 characters. You can either ensure that all test user passwords in
your test are longer than 14 characters and use i.e. `SecurityIntegTestCase#getFastStoredHashAlgoForTests`
to randomly select a hashing algorithm, or use `pbkdf2_stretch` that doesn't have the same
limitation.
==== Keystore Password
In FIPS 140-2 mode, the elasticsearch keystore needs to be password protected with a password
of appropriate length. This is handled automatically in `fips.gradle` and the keystore is unlocked
on startup by the test clusters tooling in order to have secure settings available. However, you
might need to take into consideration that the keystore is password-protected with `keystore-password`
if you need to interact with it in a test.
== How to write good tests?
=== Base classes for test cases

12
build.gradle
View file

@ -176,7 +176,17 @@ tasks.register("verifyVersions") {
*/
boolean bwc_tests_enabled = true
final String bwc_tests_disabled_issue = "" /* place a PR link here when committing bwc changes */
String bwc_tests_disabled_issue = "" /* place a PR link here when committing bwc changes */
/*
* FIPS 140-2 behavior was fixed in 7.11.0. Before that there is no way to run elasticsearch in a
* JVM that is properly configured to be in fips mode with BCFIPS. For now we need to disable
* all bwc testing in fips mode.
*/
if ( BuildParams.inFipsJvm ) {
bwc_tests_enabled = false
bwc_tests_disabled_issue = "https://github.com/elastic/elasticsearch/issues/66772"
}
if (bwc_tests_enabled == false) {
if (bwc_tests_disabled_issue.isEmpty()) {
throw new GradleException("bwc_tests_disabled_issue must be set when bwc_tests_enabled == false")

2
buildSrc/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchNode.java
View file

@ -511,7 +511,7 @@ public class ElasticsearchNode implements TestClusterConfiguration {
if (keystoreSettings.isEmpty() == false || keystoreFiles.isEmpty() == false) {
logToProcessStdout("Adding " + keystoreSettings.size() + " keystore settings and " + keystoreFiles.size() + " keystore files");
keystoreSettings.forEach((key, value) -> runKeystoreCommandWithPassword(keystorePassword, value.toString(), "add", "-x", key));
keystoreSettings.forEach((key, value) -> runKeystoreCommandWithPassword(keystorePassword, value.toString(), "add", key));
for (Map.Entry<String, File> entry : keystoreFiles.entrySet()) {
File file = entry.getValue();

6
client/rest-high-level/build.gradle
View file

@ -75,14 +75,14 @@ File pkiTrustCert = file("./src/test/resources/org/elasticsearch/client/security
tasks.named("integTest").configure {
systemProperty 'tests.rest.async', 'false'
systemProperty 'tests.rest.cluster.username', System.getProperty('tests.rest.cluster.username', 'test_user')
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-password')
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-user-password')
}
// Requires https://github.com/elastic/elasticsearch/pull/64403 to have this moved to task avoidance api.
TaskProvider<RestIntegTestTask> asyncIntegTest = tasks.register("asyncIntegTest", RestIntegTestTask) {
systemProperty 'tests.rest.async', 'true'
systemProperty 'tests.rest.cluster.username', System.getProperty('tests.rest.cluster.username', 'test_user')
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-password')
systemProperty 'tests.rest.cluster.password', System.getProperty('tests.rest.cluster.password', 'test-user-password')
}
tasks.named("check").configure {
@ -113,7 +113,7 @@ testClusters.all {
keystore 'xpack.security.transport.ssl.truststore.secure_password', 'testnode'
extraConfigFile 'roles.yml', file('roles.yml')
user username: System.getProperty('tests.rest.cluster.username', 'test_user'),
password: System.getProperty('tests.rest.cluster.password', 'test-password'),
password: System.getProperty('tests.rest.cluster.password', 'test-user-password'),
role: System.getProperty('tests.rest.cluster.role', 'admin')
user username: 'admin_user', password: 'admin-password'

2
client/rest-high-level/src/test/java/org/elasticsearch/client/SecurityIT.java
View file

@ -222,7 +222,7 @@ public class SecurityIT extends ESRestHighLevelClientTestCase {
}
private static PutUserRequest randomPutUserRequest(User user, boolean enabled) {
final char[] password = randomAlphaOfLengthBetween(6, 10).toCharArray();
final char[] password = randomAlphaOfLengthBetween(14, 19).toCharArray();
return new PutUserRequest(user, password, enabled, RefreshPolicy.IMMEDIATE);
}

2
client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/CRUDDocumentationIT.java
View file

@ -845,7 +845,7 @@ public class CRUDDocumentationIT extends ESRestHighLevelClientTestCase {
Integer remotePort = host.getPort();
String remoteHost = host.getHostName();
String user = "test_user";
String password = "test-password";
String password = "test-user-password";
// tag::reindex-request-remote
request.setRemoteInfo(

27
client/rest-high-level/src/test/java/org/elasticsearch/client/documentation/SecurityDocumentationIT.java
View file

@ -158,9 +158,9 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
public void testGetUsers() throws Exception {
final RestHighLevelClient client = highLevelClient();
String[] usernames = new String[] {"user1", "user2", "user3"};
addUser(client, usernames[0], randomAlphaOfLengthBetween(6, 10));
addUser(client, usernames[1], randomAlphaOfLengthBetween(6, 10));
addUser(client, usernames[2], randomAlphaOfLengthBetween(6, 10));
addUser(client, usernames[0], randomAlphaOfLengthBetween(14, 18));
addUser(client, usernames[1], randomAlphaOfLengthBetween(14, 18));
addUser(client, usernames[2], randomAlphaOfLengthBetween(14, 18));
{
//tag::get-users-request
GetUsersRequest request = new GetUsersRequest(usernames[0]);
@ -253,7 +253,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
{
//tag::put-user-password-request
char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
User user = new User("example", Collections.singletonList("superuser"));
PutUserRequest request = PutUserRequest.withPassword(user, password, true, RefreshPolicy.NONE);
//end::put-user-password-request
@ -272,7 +272,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
byte[] salt = new byte[32];
// no need for secure random in a test; it could block and would not be reproducible anyway
random().nextBytes(salt);
char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
User user = new User("example2", Collections.singletonList("superuser"));
//tag::put-user-hash-request
@ -328,7 +328,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
public void testDeleteUser() throws Exception {
RestHighLevelClient client = highLevelClient();
addUser(client, "testUser", "testPassword");
addUser(client, "testUser", "testUserPassword");
{
// tag::delete-user-request
@ -568,7 +568,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
public void testEnableUser() throws Exception {
RestHighLevelClient client = highLevelClient();
char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
User enable_user = new User("enable_user", Collections.singletonList("superuser"));
PutUserRequest putUserRequest = PutUserRequest.withPassword(enable_user, password, true, RefreshPolicy.IMMEDIATE);
PutUserResponse putUserResponse = client.security().putUser(putUserRequest, RequestOptions.DEFAULT);
@ -613,7 +613,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
public void testDisableUser() throws Exception {
RestHighLevelClient client = highLevelClient();
char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
User disable_user = new User("disable_user", Collections.singletonList("superuser"));
PutUserRequest putUserRequest = PutUserRequest.withPassword(disable_user, password, true, RefreshPolicy.IMMEDIATE);
PutUserResponse putUserResponse = client.security().putUser(putUserRequest, RequestOptions.DEFAULT);
@ -1185,8 +1185,9 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
public void testChangePassword() throws Exception {
RestHighLevelClient client = highLevelClient();
char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] newPassword = new char[]{'n', 'e', 'w', 'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
char[] newPassword =
new char[]{'n', 'e', 'w', '-', 't', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
User user = new User("change_password_user", Collections.singletonList("superuser"), Collections.emptyMap(), null, null);
PutUserRequest putUserRequest = PutUserRequest.withPassword(user, password, true, RefreshPolicy.NONE);
PutUserResponse putUserResponse = client.security().putUser(putUserRequest, RequestOptions.DEFAULT);
@ -1405,14 +1406,14 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
{
// Setup user
User token_user = new User("token_user", Collections.singletonList("kibana_user"));
PutUserRequest putUserRequest = PutUserRequest.withPassword(token_user, "password".toCharArray(), true,
PutUserRequest putUserRequest = PutUserRequest.withPassword(token_user, "test-user-password".toCharArray(), true,
RefreshPolicy.IMMEDIATE);
PutUserResponse putUserResponse = client.security().putUser(putUserRequest, RequestOptions.DEFAULT);
assertTrue(putUserResponse.isCreated());
}
{
// tag::create-token-password-request
final char[] password = new char[]{'p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
final char[] password = new char[]{'t', 'e', 's', 't', '-', 'u','s','e','r','-','p', 'a', 's', 's', 'w', 'o', 'r', 'd'};
CreateTokenRequest createTokenRequest = CreateTokenRequest.passwordGrant("token_user", password);
// end::create-token-password-request
@ -1482,7 +1483,7 @@ public class SecurityDocumentationIT extends ESRestHighLevelClientTestCase {
String refreshToken;
{
// Setup users
final char[] password = "password".toCharArray();
final char[] password = "test-user-password".toCharArray();
User user = new User("user", Collections.singletonList("kibana_user"));
PutUserRequest putUserRequest = PutUserRequest.withPassword(user, password, true, RefreshPolicy.IMMEDIATE);
PutUserResponse putUserResponse = client.security().putUser(putUserRequest, RequestOptions.DEFAULT);

4
client/rest/src/test/java/org/elasticsearch/client/documentation/RestClientDocumentation.java
View file

@ -359,7 +359,7 @@ public class RestClientDocumentation {
final CredentialsProvider credentialsProvider =
new BasicCredentialsProvider();
credentialsProvider.setCredentials(AuthScope.ANY,
new UsernamePasswordCredentials("user", "password"));
new UsernamePasswordCredentials("user", "test-user-password"));
RestClientBuilder builder = RestClient.builder(
new HttpHost("localhost", 9200))
@ -378,7 +378,7 @@ public class RestClientDocumentation {
final CredentialsProvider credentialsProvider =
new BasicCredentialsProvider();
credentialsProvider.setCredentials(AuthScope.ANY,
new UsernamePasswordCredentials("user", "password"));
new UsernamePasswordCredentials("user", "test-user-password"));
RestClientBuilder builder = RestClient.builder(
new HttpHost("localhost", 9200))

17
distribution/docker/build.gradle
View file

@ -204,13 +204,17 @@ def createAndSetWritable(Object... locations) {
}
}
tasks.register("copyKeystore", Sync) {
tasks.register("copyNodeKeyMaterial", Sync) {
from project(':x-pack:plugin:core')
.file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks')
.files(
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.pem',
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.crt'
)
into "${buildDir}/certs"
doLast {
file("${buildDir}/certs").setReadable(true, false)
file("${buildDir}/certs/testnode.jks").setReadable(true, false)
file("${buildDir}/certs/testnode.pem").setReadable(true, false)
file("${buildDir}/certs/testnode.crt").setReadable(true, false)
}
}
@ -230,7 +234,7 @@ elasticsearch_distributions {
tasks.named("preProcessFixture").configure {
dependsOn elasticsearch_distributions.docker_default, elasticsearch_distributions.docker_oss
dependsOn "copyKeystore"
dependsOn "copyNodeKeyMaterial"
doLast {
// tests expect to have an empty repo
project.delete(
@ -250,7 +254,10 @@ tasks.named("preProcessFixture").configure {
tasks.named("processTestResources").configure {
from project(':x-pack:plugin:core')
.file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks')
.files(
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.pem',
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.crt'
)
}
tasks.register("integTest", Test) {

18
distribution/docker/docker-compose.yml
View file

@ -23,14 +23,17 @@ services:
- xpack.security.audit.enabled=true
- xpack.security.authc.realms.file.file1.order=0
- xpack.security.authc.realms.native.native1.order=1
- xpack.security.transport.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.http.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.security.http.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.http.ssl.verification_mode=certificate
- xpack.security.transport.ssl.verification_mode=certificate
- xpack.license.self_generated.type=trial
volumes:
- ./build/repo:/tmp/es-repo
- ./build/certs/testnode.jks:/usr/share/elasticsearch/config/testnode.jks
- ./build/certs/testnode.pem:/usr/share/elasticsearch/config/testnode.pem
- ./build/certs/testnode.crt:/usr/share/elasticsearch/config/testnode.crt
- ./build/logs/default-1:/usr/share/elasticsearch/logs
- ./docker-test-entrypoint.sh:/docker-test-entrypoint.sh
ports:
@ -71,14 +74,17 @@ services:
- xpack.security.audit.enabled=true
- xpack.security.authc.realms.file.file1.order=0
- xpack.security.authc.realms.native.native1.order=1
- xpack.security.transport.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.http.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.security.http.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.http.ssl.verification_mode=certificate
- xpack.security.transport.ssl.verification_mode=certificate
- xpack.license.self_generated.type=trial
volumes:
- ./build/repo:/tmp/es-repo
- ./build/certs/testnode.jks:/usr/share/elasticsearch/config/testnode.jks
- ./build/certs/testnode.pem:/usr/share/elasticsearch/config/testnode.pem
- ./build/certs/testnode.crt:/usr/share/elasticsearch/config/testnode.crt
- ./build/logs/default-2:/usr/share/elasticsearch/logs
- ./docker-test-entrypoint.sh:/docker-test-entrypoint.sh
ports:

4
distribution/docker/docker-test-entrypoint.sh
View file

@ -2,6 +2,6 @@
cd /usr/share/elasticsearch/bin/
./elasticsearch-users useradd x_pack_rest_user -p x-pack-test-password -r superuser || true
echo "testnode" > /tmp/password
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.transport.ssl.keystore.secure_password'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.http.ssl.keystore.secure_password'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.transport.ssl.secure_key_passphrase'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.http.ssl.secure_key_passphrase'
/usr/local/bin/docker-entrypoint.sh | tee /usr/share/elasticsearch/logs/console.log

21
distribution/docker/src/test/java/org/elasticsearch/docker/test/DockerYmlTestSuiteIT.java
View file

@ -45,7 +45,6 @@ public class DockerYmlTestSuiteIT extends ESClientYamlSuiteTestCase {
private static final String USER = "x_pack_rest_user";
private static final String PASS = "x-pack-test-password";
private static final String KEYSTORE_PASS = "testnode";
public DockerYmlTestSuiteIT(ClientYamlTestCandidate testCandidate) {
super(testCandidate);
@ -103,23 +102,24 @@ public class DockerYmlTestSuiteIT extends ESClientYamlSuiteTestCase {
client().performRequest(health);
}
static Path keyStore;
static Path trustedCertFile;
@BeforeClass
public static void getKeyStore() {
public static void getTrustedCert() {
try {
keyStore = PathUtils.get(DockerYmlTestSuiteIT.class.getResource("/testnode.jks").toURI());
trustedCertFile = PathUtils.get(DockerYmlTestSuiteIT.class.getResource("/testnode.crt").toURI());
} catch (URISyntaxException e) {
throw new ElasticsearchException("exception while reading the store", e);
throw new ElasticsearchException("exception while reading the certificate", e);
}
if (Files.exists(keyStore) == false) {
throw new IllegalStateException("Keystore file [" + keyStore + "] does not exist.");
if (Files.exists(trustedCertFile) == false) {
throw new IllegalStateException("Certificate file [" + trustedCertFile + "] does not exist.");
}
}
@AfterClass
public static void clearKeyStore() {
keyStore = null;
public static void clearTrustedCert() {
trustedCertFile = null;
}
@Override
@ -130,8 +130,7 @@ public class DockerYmlTestSuiteIT extends ESClientYamlSuiteTestCase {
String token = basicAuthHeaderValue(USER, new SecureString(PASS.toCharArray()));
return Settings.builder()
.put(ThreadContext.PREFIX + ".Authorization", token)
.put(ESRestTestCase.TRUSTSTORE_PATH, keyStore)
.put(ESRestTestCase.TRUSTSTORE_PASSWORD, KEYSTORE_PASS)
.put(ESRestTestCase.CERTIFICATE_AUTHORITIES, trustedCertFile)
.build();
}

4
distribution/tools/keystore-cli/src/test/java/org/elasticsearch/common/settings/HasPasswordKeyStoreCommandTests.java
View file

@ -55,13 +55,13 @@ public class HasPasswordKeyStoreCommandTests extends KeyStoreCommandTestCase {
}
public void testSucceedsWhenKeystoreHasPassword() throws Exception {
createKeystore("password");
createKeystore("keystore-password");
String output = execute();
assertThat(output, containsString("Keystore is password-protected"));
}
public void testSilentSucceedsWhenKeystoreHasPassword() throws Exception {
createKeystore("password");
createKeystore("keystre-password");
String output = execute("--silent");
assertThat(output, is(emptyString()));
}

4
docs/build.gradle
View file

@ -55,7 +55,7 @@ testClusters.matching { it.name == "integTest"}.configureEach {
setting 'xpack.license.self_generated.type', 'trial'
setting 'indices.lifecycle.history_index_enabled', 'false'
systemProperty 'es.rollup_v2_feature_flag_enabled', 'true'
keystorePassword 's3cr3t'
keystorePassword 'keystore-password'
}
// enable regexes in painless so our tests don't complain about example snippets that use them
@ -106,7 +106,7 @@ ext.docsFileTree = fileTree(projectDir) {
exclude 'README.asciidoc'
// Broken code snippet tests
exclude 'reference/graph/explore.asciidoc'
if (Boolean.parseBoolean(System.getProperty("tests.fips.enabled"))) {
if (BuildParams.inFipsJvm) {
// We don't install/support this plugin in FIPS 140
exclude 'plugins/ingest-attachment.asciidoc'
// We can't conditionally control output, this would be missing the ingest-attachment plugin

4
docs/reference/cluster/nodes-reload-secure-settings.asciidoc
View file

@ -57,11 +57,11 @@ node of the cluster:
--------------------------------------------------
POST _nodes/reload_secure_settings
{
"secure_settings_password":"s3cr3t"
"secure_settings_password":"keystore-password"
}
POST _nodes/nodeId1,nodeId2/reload_secure_settings
{
"secure_settings_password":"s3cr3t"
"secure_settings_password":"keystore-password"
}
--------------------------------------------------
// TEST[setup:node]

2
docs/reference/setup/secure-settings.asciidoc
View file

@ -35,7 +35,7 @@ using the `bin/elasticsearch-keystore add` command, call:
----
POST _nodes/reload_secure_settings
{
"secure_settings_password": "s3cr3t" <1>
"secure_settings_password": "keystore-password" <1>
}
----
// NOTCONSOLE

9
gradle/fips.gradle
View file

@ -1,7 +1,6 @@
import org.elasticsearch.gradle.ExportElasticsearchBuildResourcesTask
import org.elasticsearch.gradle.info.BuildParams
import org.elasticsearch.gradle.testclusters.ElasticsearchCluster
import org.elasticsearch.gradle.testclusters.ElasticsearchCluster
import org.elasticsearch.gradle.testclusters.TestDistribution
// Common config when running with a FIPS-140 runtime JVM
if (BuildParams.inFipsJvm) {
@ -44,6 +43,7 @@ if (BuildParams.inFipsJvm) {
}
}
testClusters.all {
setTestDistribution(TestDistribution.DEFAULT)
extraConfigFile "fips_java.security", fipsSecurity
extraConfigFile "fips_java.policy", fipsPolicy
extraConfigFile "cacerts.bcfks", fipsTrustStore
@ -53,6 +53,10 @@ if (BuildParams.inFipsJvm) {
systemProperty 'javax.net.ssl.trustStorePassword', 'password'
systemProperty 'javax.net.ssl.keyStorePassword', 'password'
systemProperty 'javax.net.ssl.keyStoreType', 'BCFKS'
systemProperty 'org.bouncycastle.fips.approved_only', 'true'
setting 'xpack.security.fips_mode.enabled', 'true'
setting 'xpack.license.self_generated.type', 'trial'
keystorePassword 'keystore-password'
}
}
project.tasks.withType(Test).configureEach { Test task ->
@ -65,6 +69,7 @@ if (BuildParams.inFipsJvm) {
task.systemProperty('java.security.properties', String.format(Locale.ROOT, "=%s", fipsSecurity))
task.systemProperty('java.security.policy', String.format(Locale.ROOT, "=%s", fipsPolicy))
task.systemProperty('javax.net.ssl.trustStore', fipsTrustStore)
task.systemProperty('org.bouncycastle.fips.approved_only', 'true')
}
}
}

3
libs/ssl-config/src/test/java/org/elasticsearch/common/ssl/SslConfigurationLoaderTests.java
View file

@ -103,6 +103,7 @@ public class SslConfigurationLoaderTests extends ESTestCase {
}
public void testLoadTrustFromPkcs12() {
assumeFalse("Can't use JKS/PKCS12 keystores in a FIPS JVM", inFipsJvm());
final Settings.Builder builder = Settings.builder().put("test.ssl.truststore.path", "ca-all/ca.p12");
if (randomBoolean()) {
builder.put("test.ssl.truststore.password", "p12-pass");
@ -125,6 +126,7 @@ public class SslConfigurationLoaderTests extends ESTestCase {
}
public void testLoadTrustFromJKS() {
assumeFalse("Can't use JKS/PKCS12 keystores in a FIPS JVM", inFipsJvm());
final Settings.Builder builder = Settings.builder().put("test.ssl.truststore.path", "ca-all/ca.jks");
if (randomBoolean()) {
builder.put("test.ssl.truststore.password", "jks-pass");
@ -170,6 +172,7 @@ public class SslConfigurationLoaderTests extends ESTestCase {
}
public void testLoadKeysFromPKCS12() {
assumeFalse("Can't use JKS/PKCS12 keystores in a FIPS JVM", inFipsJvm());
final Settings.Builder builder = Settings.builder()
.put("test.ssl.keystore.path", "cert-all/certs.p12");
if (randomBoolean()) {

1
libs/ssl-config/src/test/java/org/elasticsearch/common/ssl/StoreTrustConfigTests.java
View file

@ -78,6 +78,7 @@ public class StoreTrustConfigTests extends ESTestCase {
}
public void testIncorrectPasswordFailsWithMeaningfulMessage() throws Exception {
assumeFalse("Can't use JKS/PKCS12 keystores in a FIPS JVM", inFipsJvm());
final Path ks = getDataPath("/certs/ca1/ca.p12");
final StoreTrustConfig trustConfig = new StoreTrustConfig(ks, new char[0], "PKCS12", DEFAULT_ALGORITHM);
assertThat(trustConfig.getDependentFiles(), Matchers.containsInAnyOrder(ks));

8
modules/geo/build.gradle
View file

@ -18,6 +18,8 @@
*/
apply plugin: 'elasticsearch.yaml-rest-test'
import org.elasticsearch.gradle.info.BuildParams
esplugin {
description 'Placeholder plugin for geospatial features in ES. only registers geo_shape field mapper for now'
classname 'org.elasticsearch.geo.GeoPlugin'
@ -32,3 +34,9 @@ artifacts {
restTests(project.file('src/yamlRestTest/resources/rest-api-spec/test'))
}
tasks.named("test").configure { enabled = false }
if (BuildParams.inFipsJvm){
// The geo module is replaced by spatial in the default distribution and in FIPS 140 mode, we set the testclusters to
// use the default distribution, so there is no need to run these tests
tasks.named("yamlRestTest").configure{enabled = false }
}

6
modules/lang-painless/src/yamlRestTest/resources/rest-api-spec/test/painless/71_context_api.yml
View file

@ -1,4 +1,7 @@
"Action to list contexts":
- skip:
features: fips_140
reason: "The tests expect to be run with OSS distribution"
- do:
scripts_painless_context: {}
- match: { contexts.0: aggregation_selector}
@ -6,6 +9,9 @@
---
"Action to get all API values for score context":
- skip:
features: fips_140
reason: "The tests expect to be run with OSS distribution"
- do:
scripts_painless_context:
context: score

10
modules/transport-netty4/src/javaRestTest/java/org/elasticsearch/rest/Netty4HeadBodyIsEmptyIT.java
View file

@ -123,6 +123,16 @@ public class Netty4HeadBodyIsEmptyIT extends ESRestTestCase {
builder.endObject();
Request request = new Request("PUT", "/_template/template");
if (inFipsJvm()) {
request.setOptions(expectWarnings(
"legacy template [template] has index patterns [*] matching patterns from existing composable templates " +
"[ilm-history,.triggered_watches,.watch-history-14,.slm-history,synthetics,metrics,.deprecation-indexing-template," +
".watches,logs] with patterns (ilm-history => [ilm-history-5*],.triggered_watches => [.triggered_watches*]," +
".watch-history-14 => [.watcher-history-14*],.slm-history => [.slm-history-5*],synthetics => [synthetics-*-*]" +
",metrics => [metrics-*-*],.deprecation-indexing-template => [.logs-deprecation-elasticsearch]," +
".watches => [.watches*],logs => [logs-*-*]); this template [template] may be ignored in favor " +
"of a composable template at index creation time"));
}
request.setJsonEntity(Strings.toString(builder));
client().performRequest(request);
headTestCase("/_template/template", emptyMap(), greaterThan(0));

2
plugins/discovery-ec2/qa/amazon-ec2/src/yamlRestTest/java/org/elasticsearch/discovery/ec2/AmazonEC2Fixture.java
View file

@ -124,7 +124,7 @@ public class AmazonEC2Fixture extends AbstractHttpFixture {
+ "\"AccessKeyId\": \"" + "ec2_integration_test_access_key" + "\","
+ "\"Expiration\": \"" + DateUtils.formatISO8601Date(expiration) + "\","
+ "\"RoleArn\": \"" + "test" + "\","
+ "\"SecretAccessKey\": \"" + "test" + "\","
+ "\"SecretAccessKey\": \"" + "ec2_integration_test_secret_key" + "\","
+ "\"Token\": \"" + "test" + "\""
+ "}";

2
plugins/discovery-ec2/src/test/java/org/elasticsearch/discovery/ec2/AbstractEC2MockAPITestCase.java
View file

@ -75,7 +75,7 @@ public abstract class AbstractEC2MockAPITestCase extends ESTestCase {
final String endpoint = "http://" + InetAddresses.toUriString(address.getAddress()) + ":" + address.getPort();
final MockSecureSettings mockSecure = new MockSecureSettings();
mockSecure.setString(Ec2ClientSettings.ACCESS_KEY_SETTING.getKey(), accessKey);
mockSecure.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret");
mockSecure.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret_key");
return Settings.builder().put(Ec2ClientSettings.ENDPOINT_SETTING.getKey(), endpoint).setSecureSettings(mockSecure).build();
}

8
plugins/discovery-ec2/src/test/java/org/elasticsearch/discovery/ec2/Ec2DiscoveryPluginTests.java
View file

@ -110,7 +110,7 @@ public class Ec2DiscoveryPluginTests extends ESTestCase {
public void testClientSettingsReInit() throws IOException {
final MockSecureSettings mockSecure1 = new MockSecureSettings();
mockSecure1.setString(Ec2ClientSettings.ACCESS_KEY_SETTING.getKey(), "ec2_access_1");
mockSecure1.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret_1");
mockSecure1.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret_key_1");
final boolean mockSecure1HasSessionToken = randomBoolean();
if (mockSecure1HasSessionToken) {
mockSecure1.setString(Ec2ClientSettings.SESSION_TOKEN_SETTING.getKey(), "ec2_session_token_1");
@ -125,7 +125,7 @@ public class Ec2DiscoveryPluginTests extends ESTestCase {
.build();
final MockSecureSettings mockSecure2 = new MockSecureSettings();
mockSecure2.setString(Ec2ClientSettings.ACCESS_KEY_SETTING.getKey(), "ec2_access_2");
mockSecure2.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret_2");
mockSecure2.setString(Ec2ClientSettings.SECRET_KEY_SETTING.getKey(), "ec2_secret_key_2");
final boolean mockSecure2HasSessionToken = randomBoolean();
if (mockSecure2HasSessionToken) {
mockSecure2.setString(Ec2ClientSettings.SESSION_TOKEN_SETTING.getKey(), "ec2_session_token_2");
@ -143,7 +143,7 @@ public class Ec2DiscoveryPluginTests extends ESTestCase {
{
final AWSCredentials credentials = ((AmazonEC2Mock) clientReference.client()).credentials.getCredentials();
assertThat(credentials.getAWSAccessKeyId(), is("ec2_access_1"));
assertThat(credentials.getAWSSecretKey(), is("ec2_secret_1"));
assertThat(credentials.getAWSSecretKey(), is("ec2_secret_key_1"));
if (mockSecure1HasSessionToken) {
assertThat(credentials, instanceOf(BasicSessionCredentials.class));
assertThat(((BasicSessionCredentials)credentials).getSessionToken(), is("ec2_session_token_1"));
@ -177,7 +177,7 @@ public class Ec2DiscoveryPluginTests extends ESTestCase {
try (AmazonEc2Reference clientReference = plugin.ec2Service.client()) {
final AWSCredentials credentials = ((AmazonEC2Mock) clientReference.client()).credentials.getCredentials();
assertThat(credentials.getAWSAccessKeyId(), is("ec2_access_2"));
assertThat(credentials.getAWSSecretKey(), is("ec2_secret_2"));
assertThat(credentials.getAWSSecretKey(), is("ec2_secret_key_2"));
if (mockSecure2HasSessionToken) {
assertThat(credentials, instanceOf(BasicSessionCredentials.class));
assertThat(((BasicSessionCredentials)credentials).getSessionToken(), is("ec2_session_token_2"));

6
plugins/examples/build.gradle
View file

@ -1,9 +1,15 @@
import org.elasticsearch.gradle.info.BuildParams
// Subprojects aren't published so do not assemble
gradle.projectsEvaluated {
subprojects {
project.tasks.matching { it.name.equals('assemble') }.configureEach {
enabled = false
}
if (BuildParams.inFipsJvm) {
project.tasks.configureEach {
enabled = false
}
}
}
}

2
plugins/repository-azure/src/internalClusterTest/java/org/elasticsearch/repositories/azure/AzureBlobStoreRepositoryTests.java
View file

@ -85,7 +85,7 @@ public class AzureBlobStoreRepositoryTests extends ESMockAPIBasedRepositoryInteg
@Override
protected Settings nodeSettings(int nodeOrdinal) {
final String key = Base64.getEncoder().encodeToString(randomAlphaOfLength(10).getBytes(StandardCharsets.UTF_8));
final String key = Base64.getEncoder().encodeToString(randomAlphaOfLength(14).getBytes(StandardCharsets.UTF_8));
final MockSecureSettings secureSettings = new MockSecureSettings();
String accountName = DEFAULT_ACCOUNT_NAME;
secureSettings.setString(AzureStorageSettings.ACCOUNT_SETTING.getConcreteSettingForNamespace("test").getKey(), accountName);

2
plugins/repository-azure/src/test/java/org/elasticsearch/repositories/azure/AzureBlobContainerRetriesTests.java
View file

@ -144,7 +144,7 @@ public class AzureBlobContainerRetriesTests extends ESTestCase {
final MockSecureSettings secureSettings = new MockSecureSettings();
secureSettings.setString(ACCOUNT_SETTING.getConcreteSettingForNamespace(clientName).getKey(), "account");
final String key = Base64.getEncoder().encodeToString(randomAlphaOfLength(10).getBytes(UTF_8));
final String key = Base64.getEncoder().encodeToString(randomAlphaOfLength(14).getBytes(UTF_8));
secureSettings.setString(KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(), key);
clientSettings.setSecureSettings(secureSettings);

2
plugins/repository-gcs/build.gradle
View file

@ -236,7 +236,7 @@ def encodedCredentials = {
tasks.register("createServiceAccountFile") {
doLast {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA")
keyPairGenerator.initialize(1024)
keyPairGenerator.initialize(2048)
KeyPair keyPair = keyPairGenerator.generateKeyPair()
String encodedKey = Base64.getEncoder().encodeToString(keyPair.private.getEncoded())

2
plugins/repository-gcs/src/test/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageServiceTests.java
View file

@ -143,7 +143,7 @@ public class GoogleCloudStorageServiceTests extends ESTestCase {
private byte[] serviceAccountFileContent(String projectId) throws Exception {
final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
keyPairGenerator.initialize(1024);
keyPairGenerator.initialize(2048);
final KeyPair keyPair = keyPairGenerator.generateKeyPair();
final String encodedKey = Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded());
final XContentBuilder serviceAccountBuilder = jsonBuilder().startObject()

2
plugins/repository-gcs/src/test/java/org/elasticsearch/repositories/gcs/TestUtils.java
View file

@ -37,7 +37,7 @@ final class TestUtils {
static byte[] createServiceAccount(final Random random) {
try {
final KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
keyPairGenerator.initialize(1024);
keyPairGenerator.initialize(2048);
final String privateKey = Base64.getEncoder().encodeToString(keyPairGenerator.generateKeyPair().getPrivate().getEncoded());
final ByteArrayOutputStream out = new ByteArrayOutputStream();

4
plugins/repository-s3/build.gradle
View file

@ -112,8 +112,8 @@ boolean s3DisableChunkedEncoding = (new Random(Long.parseUnsignedLong(BuildParam
// credentials hard-coded in.
if (!s3PermanentAccessKey && !s3PermanentSecretKey && !s3PermanentBucket && !s3PermanentBasePath) {
s3PermanentAccessKey = 'access_key'
s3PermanentSecretKey = 'secret_key'
s3PermanentAccessKey = 's3_test_access_key'
s3PermanentSecretKey = 's3_test_secret_key'
s3PermanentBucket = 'bucket'
s3PermanentBasePath = 'base_path'

4
plugins/repository-s3/src/internalClusterTest/java/org/elasticsearch/repositories/s3/S3BlobStoreRepositoryTests.java
View file

@ -122,8 +122,8 @@ public class S3BlobStoreRepositoryTests extends ESMockAPIBasedRepositoryIntegTes
@Override
protected Settings nodeSettings(int nodeOrdinal) {
final MockSecureSettings secureSettings = new MockSecureSettings();
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "access");
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "secret");
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "test_access_key");
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace("test").getKey(), "test_secret_key");
final Settings.Builder builder = Settings.builder()
.put(ThreadPool.ESTIMATED_TIME_INTERVAL_SETTING.getKey(), 0) // We have tests that verify an exact wait time

6
plugins/repository-s3/src/test/java/org/elasticsearch/repositories/s3/S3BlobContainerRetriesTests.java
View file

@ -122,8 +122,10 @@ public class S3BlobContainerRetriesTests extends AbstractBlobContainerRetriesTes
}
final MockSecureSettings secureSettings = new MockSecureSettings();
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(), "access");
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(), "secret");
secureSettings.setString(S3ClientSettings.ACCESS_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(),
"test_access_key");
secureSettings.setString(S3ClientSettings.SECRET_KEY_SETTING.getConcreteSettingForNamespace(clientName).getKey(),
"test_secret_key");
clientSettings.setSecureSettings(secureSettings);
service.refreshAndClearCache(S3ClientSettings.load(clientSettings.build()));

6
qa/os/src/test/java/org/elasticsearch/packaging/test/KeystoreManagementTests.java
View file

@ -273,7 +273,7 @@ public class KeystoreManagementTests extends PackagingTestCase {
*/
public void test60DockerEnvironmentVariablePassword() throws Exception {
assumeTrue(distribution().isDocker());
String password = "password";
String password = "keystore-password";
Path dockerKeystore = installation.config("elasticsearch.keystore");
Path localKeystoreFile = getKeystoreFileFromDockerContainer(password, dockerKeystore);
@ -297,7 +297,7 @@ public class KeystoreManagementTests extends PackagingTestCase {
try {
tempDir = createTempDir(DockerTests.class.getSimpleName());
String password = "password";
String password = "keystore-password";
String passwordFilename = "password.txt";
Files.writeString(tempDir.resolve(passwordFilename), password + "\n");
Files.setPosixFilePermissions(tempDir.resolve(passwordFilename), p600);
@ -327,7 +327,7 @@ public class KeystoreManagementTests extends PackagingTestCase {
*/
public void test62DockerEnvironmentVariableBadPassword() throws Exception {
assumeTrue(distribution().isDocker());
String password = "password";
String password = "keystore-password";
Path dockerKeystore = installation.config("elasticsearch.keystore");
Path localKeystoreFile = getKeystoreFileFromDockerContainer(password, dockerKeystore);

17
qa/remote-clusters/build.gradle
View file

@ -31,13 +31,17 @@ dependencies {
testImplementation project(':client:rest-high-level')
}
tasks.register("copyKeystore", Sync) {
tasks.register("copyNodeKeyMaterial", Sync) {
from project(':x-pack:plugin:core')
.file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks')
.files(
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.pem',
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.crt'
)
into "${buildDir}/certs"
doLast {
file("${buildDir}/certs").setReadable(true, false)
file("${buildDir}/certs/testnode.jks").setReadable(true, false)
file("${buildDir}/certs/testnode.pem").setReadable(true, false)
file("${buildDir}/certs/testnode.crt").setReadable(true, false)
}
}
@ -52,7 +56,7 @@ elasticsearch_distributions {
}
tasks.named("preProcessFixture").configure {
dependsOn "copyKeystore", elasticsearch_distributions.docker
dependsOn "copyNodeKeyMaterial", elasticsearch_distributions.docker
doLast {
// tests expect to have an empty repo
project.delete(
@ -89,7 +93,10 @@ def createAndSetWritable(Object... locations) {
tasks.named("processTestResources").configure {
from project(':x-pack:plugin:core')
.file('src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.jks')
.files(
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.pem',
'src/test/resources/org/elasticsearch/xpack/security/transport/ssl/certs/simple/testnode.crt'
)
}
tasks.register("integTest", Test) {

18
qa/remote-clusters/docker-compose.yml
View file

@ -23,14 +23,17 @@ services:
- xpack.security.audit.enabled=true
- xpack.security.authc.realms.file.file1.order=0
- xpack.security.authc.realms.native.native1.order=1
- xpack.security.transport.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.http.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.security.http.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.http.ssl.verification_mode=certificate
- xpack.security.transport.ssl.verification_mode=certificate
- xpack.license.self_generated.type=trial
volumes:
- ./build/repo:/tmp/es-repo
- ./build/certs/testnode.jks:/usr/share/elasticsearch/config/testnode.jks
- ./build/certs/testnode.pem:/usr/share/elasticsearch/config/testnode.pem
- ./build/certs/testnode.crt:/usr/share/elasticsearch/config/testnode.crt
- ./build/logs/default-1:/usr/share/elasticsearch/logs
- ./docker-test-entrypoint.sh:/docker-test-entrypoint.sh
ports:
@ -72,14 +75,17 @@ services:
- xpack.security.audit.enabled=true
- xpack.security.authc.realms.file.file1.order=0
- xpack.security.authc.realms.native.native1.order=1
- xpack.security.transport.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.http.ssl.keystore.path=/usr/share/elasticsearch/config/testnode.jks
- xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.security.http.ssl.key=/usr/share/elasticsearch/config/testnode.pem
- xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/testnode.crt
- xpack.http.ssl.verification_mode=certificate
- xpack.security.transport.ssl.verification_mode=certificate
- xpack.license.self_generated.type=trial
volumes:
- ./build/repo:/tmp/es-repo
- ./build/certs/testnode.jks:/usr/share/elasticsearch/config/testnode.jks
- ./build/certs/testnode.pem:/usr/share/elasticsearch/config/testnode.pem
- ./build/certs/testnode.crt:/usr/share/elasticsearch/config/testnode.crt
- ./build/logs/default-2:/usr/share/elasticsearch/logs
- ./docker-test-entrypoint.sh:/docker-test-entrypoint.sh
ports:

4
qa/remote-clusters/docker-test-entrypoint.sh
View file

@ -2,6 +2,6 @@
cd /usr/share/elasticsearch/bin/
./elasticsearch-users useradd x_pack_rest_user -p x-pack-test-password -r superuser || true
echo "testnode" > /tmp/password
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.transport.ssl.keystore.secure_password'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.http.ssl.keystore.secure_password'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.transport.ssl.secure_key_passphrase'
cat /tmp/password | ./elasticsearch-keystore add -x -f -v 'xpack.security.http.ssl.secure_key_passphrase'
/usr/local/bin/docker-entrypoint.sh | tee /usr/share/elasticsearch/logs/console.log

20
qa/remote-clusters/src/test/java/org/elasticsearch/cluster/remote/test/AbstractMultiClusterRemoteTestCase.java
View file

@ -48,7 +48,6 @@ public abstract class AbstractMultiClusterRemoteTestCase extends ESRestTestCase
private static final String USER = "x_pack_rest_user";
private static final String PASS = "x-pack-test-password";
private static final String KEYSTORE_PASS = "testnode";
@Override
protected boolean preserveClusterUponCompletion() {
@ -123,23 +122,23 @@ public abstract class AbstractMultiClusterRemoteTestCase extends ESRestTestCase
return getDistribution().equals("oss");
}
static Path keyStore;
static Path trustedCertFile;
@BeforeClass
public static void getKeyStore() {
public static void getTrustedCert() {
try {
keyStore = PathUtils.get(AbstractMultiClusterRemoteTestCase.class.getResource("/testnode.jks").toURI());
trustedCertFile = PathUtils.get(AbstractMultiClusterRemoteTestCase.class.getResource("/testnode.crt").toURI());
} catch (URISyntaxException e) {
throw new ElasticsearchException("exception while reading the store", e);
throw new ElasticsearchException("exception while reading the certificate file", e);
}
if (Files.exists(keyStore) == false) {
throw new IllegalStateException("Keystore file [" + keyStore + "] does not exist.");
if (Files.exists(trustedCertFile) == false) {
throw new IllegalStateException("Certificate file [" + trustedCertFile + "] does not exist.");
}
}
@AfterClass
public static void clearKeyStore() {
keyStore = null;
public static void clearTrustedCert() {
trustedCertFile = null;
}
@Override
@ -150,8 +149,7 @@ public abstract class AbstractMultiClusterRemoteTestCase extends ESRestTestCase
String token = basicAuthHeaderValue(USER, new SecureString(PASS.toCharArray()));
return Settings.builder()
.put(ThreadContext.PREFIX + ".Authorization", token)
.put(ESRestTestCase.TRUSTSTORE_PATH, keyStore)
.put(ESRestTestCase.TRUSTSTORE_PASSWORD, KEYSTORE_PASS)
.put(ESRestTestCase.CERTIFICATE_AUTHORITIES, trustedCertFile)
.build();
}

4
rest-api-spec/src/main/resources/rest-api-spec/test/nodes.reload_secure_settings/10_basic.yml
View file

@ -24,7 +24,9 @@ setup:
---
"node_reload_secure_settings test correct(empty) password":
- skip:
features: fips_140
reason: "In FIPS 140 mode, we use a password protected elasticsearch keystore"
- do:
nodes.reload_secure_settings: {}

8
server/src/internalClusterTest/java/org/elasticsearch/action/admin/ReloadSecureSettingsIT.java
View file

@ -32,6 +32,7 @@ import org.elasticsearch.plugins.Plugin;
import org.elasticsearch.plugins.PluginsService;
import org.elasticsearch.plugins.ReloadablePlugin;
import org.elasticsearch.test.ESIntegTestCase;
import org.junit.BeforeClass;
import java.io.InputStream;
import java.nio.file.Files;
@ -54,6 +55,13 @@ import static org.hamcrest.Matchers.containsString;
@ESIntegTestCase.ClusterScope(minNumDataNodes = 2)
public class ReloadSecureSettingsIT extends ESIntegTestCase {
@BeforeClass
public static void disableInFips() {
// Reload secure settings with a password protected keystore is tested in ReloadSecureSettingsWithPasswordProtectedKeystoreRestIT
assumeFalse("Cannot run in FIPS mode since the keystore will be password protected and sending a password in the reload" +
"settings api call, require TLS to be configured for the transport layer", inFipsJvm());
}
public void testMissingKeystoreFile() throws Exception {
final PluginsService pluginsService = internalCluster().getInstance(PluginsService.class);
final MockReloadablePlugin mockReloadablePlugin = pluginsService.filterPlugins(MockReloadablePlugin.class)

6
test/fixtures/krb5kdc-fixture/src/main/resources/provision/kdc.conf.template vendored
View file

@ -24,9 +24,9 @@
kadmind_port = 749
max_life = 12h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = aes256-cts
# remove aes256-cts:normal since unlimited strength policy needs installed for java to use it.
supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
master_key_type = des3-cbc-sha1-kd
# This is the only supported enctype for fips 140-2
supported_enctypes = des3-cbc-sha1-kd:normal
}
[logging]

8
test/fixtures/krb5kdc-fixture/src/main/resources/provision/krb5.conf.template vendored
View file

@ -24,11 +24,13 @@
forwardable = true
ignore_acceptor_hostname = true
rdns = false
default_tgs_enctypes = rc4-hmac
default_tkt_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac
# des3-cbc-sha1-kd is the only enctype available in fips 140-2
default_tgs_enctypes = des3-cbc-sha1-kd
default_tkt_enctypes = des3-cbc-sha1-kd
permitted_enctypes = des3-cbc-sha1-kd
# udp_preference_limit = 1
kdc_timeout = 3000
allow_weak_enctypes = false
[realms]
${REALM_NAME} = {

8
test/fixtures/minio-fixture/docker-compose.yml vendored
View file

@ -5,8 +5,8 @@ services:
context: .
args:
bucket: "bucket"
accessKey: "access_key"
secretKey: "secret_key"
accessKey: "s3_test_access_key"
secretKey: "s3_test_secret_key"
dockerfile: Dockerfile
ports:
- "9000"
@ -16,8 +16,8 @@ services:
context: .
args:
bucket: "bucket"
accessKey: "access_key"
secretKey: "secret_key"
accessKey: "s3_test_access_key"
secretKey: "s3_test_secret_key"
dockerfile: Dockerfile
ports:
- "9000"

6
test/fixtures/s3-fixture/docker-compose.yml vendored
View file

@ -8,7 +8,7 @@ services:
port: 80
bucket: "bucket"
basePath: "base_path_integration_tests"
accessKey: "access_key"
accessKey: "s3_test_access_key"
dockerfile: Dockerfile
volumes:
- ./testfixtures_shared/shared:/fixture/shared
@ -23,7 +23,7 @@ services:
port: 80
bucket: "bucket"
basePath: "base_path"
accessKey: "access_key"
accessKey: "s3_test_access_key"
dockerfile: Dockerfile
volumes:
- ./testfixtures_shared/shared:/fixture/shared
@ -38,7 +38,7 @@ services:
port: 80
bucket: "bucket"
basePath: "base_path"
accessKey: "access_key"
accessKey: "s3_test_access_key"
dockerfile: Dockerfile
volumes:
- ./testfixtures_shared/shared:/fixture/shared

2
test/fixtures/s3-fixture/src/main/java/fixture/s3/S3HttpFixtureWithEC2.java vendored
View file

@ -79,7 +79,7 @@ public class S3HttpFixtureWithEC2 extends S3HttpFixtureWithSessionToken {
+ "\"AccessKeyId\": \"" + ec2AccessKey + "\","
+ "\"Expiration\": \"" + ZonedDateTime.now().plusDays(1L).format(DateTimeFormatter.ISO_DATE_TIME) + "\","
+ "\"RoleArn\": \"arn\","
+ "\"SecretAccessKey\": \"secret\","
+ "\"SecretAccessKey\": \"secret_access_key\","
+ "\"Token\": \"" + ec2SessionToken + "\""
+ "}";
}

2
x-pack/docs/build.gradle
View file

@ -706,7 +706,7 @@ tasks.named("buildRestTests").configure { buildRestTests ->
username: "jacknich"
body: >
{
"password" : "test-password",
"password" : "l0ng-r4nd0m-p@ssw0rd",
"roles" : [ "admin", "other_role1" ],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",

2
x-pack/docs/en/rest-api/security/change-password.asciidoc
View file

@ -55,7 +55,7 @@ The following example updates the password for the `jacknich` user:
--------------------------------------------------
POST /_security/user/jacknich/_password
{
"password" : "s3cr3t"
"password" : "new-test-password"
}
--------------------------------------------------
// TEST[setup:jacknich_user]

4
x-pack/docs/en/rest-api/security/create-users.asciidoc
View file

@ -112,7 +112,7 @@ The following example creates a user `jacknich`:
--------------------------------------------------
POST /_security/user/jacknich
{
"password" : "j@rV1s",
"password" : "l0ng-r4nd0m-p@ssw0rd",
"roles" : [ "admin", "other_role1" ],
"full_name" : "Jack Nicholson",
"email" : "jacknich@example.com",
@ -138,6 +138,6 @@ After you add a user, requests from that user can be authenticated. For example:
[source,shell]
--------------------------------------------------
curl -u jacknich:j@rV1s http://localhost:9200/_cluster/health
curl -u jacknich:l0ng-r4nd0m-p@ssw0rd http://localhost:9200/_cluster/health
--------------------------------------------------
// NOTCONSOLE

2
x-pack/docs/en/security/ccs-clients-integrations/cross-cluster.asciidoc
View file

@ -132,7 +132,7 @@ Finally, create a user on cluster `one` and apply the `cluster_two_logs` role:
-----------------------------------------------------------
POST /_security/user/alice
{
"password" : "somepassword",
"password" : "somepasswordhere",
"roles" : [ "cluster_two_logs" ],
"full_name" : "Alice",
"email" : "alice@example.com",

7
x-pack/plugin/async-search/qa/rest/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.esplugin'
apply plugin: 'elasticsearch.yaml-rest-test'
@ -20,3 +22,8 @@ testClusters.all {
}
tasks.named("test").configure { enabled = false }
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("yamlRestTest").configure{enabled = false }
}

11
x-pack/plugin/ccr/qa/build.gradle
View file

@ -1,6 +1,17 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.build'
tasks.named("test").configure { enabled = false }
dependencies {
api project(':test:framework')
}
gradle.projectsEvaluated {
subprojects {
tasks.withType(Test).configureEach {
// These fail in CI but only when run as part of checkPart2 and not individually.
// Tracked in : https://github.com/elastic/elasticsearch/issues/66661
onlyIf { BuildParams.inFipsJvm == false}
}
}
}

31
x-pack/plugin/ccr/qa/downgrade-to-basic-license/build.gradle
View file

@ -25,27 +25,6 @@ tasks.register("writeJavaPolicy") {
if (policyFile.parentFile.exists() == false && policyFile.parentFile.mkdirs() == false) {
throw new GradleException("failed to create temporary directory [${tmp}]")
}
if (BuildParams.inFipsJvm) {
policyFile.write(
[
"grant {",
"permission java.security.SecurityPermission \"putProviderProperty.BCFIPS\";",
"permission java.security.SecurityPermission \"putProviderProperty.BCJSSE\";",
"permission java.lang.RuntimePermission \"getProtectionDomain\";",
"permission java.util.PropertyPermission \"java.runtime.name\", \"read\";",
"permission org.bouncycastle.crypto.CryptoServicesPermission \"tlsAlgorithmsEnabled\";",
"permission java.lang.RuntimePermission \"accessClassInPackage.sun.security.internal.spec\";",
"permission java.lang.RuntimePermission \"accessDeclaredMembers\";",
"permission java.util.PropertyPermission \"intellij.debug.agent\", \"read\";",
"permission java.util.PropertyPermission \"intellij.debug.agent\", \"write\";",
"permission org.bouncycastle.crypto.CryptoServicesPermission \"exportSecretKey\";",
"permission org.bouncycastle.crypto.CryptoServicesPermission \"exportPrivateKey\";",
"permission java.io.FilePermission \"\${javax.net.ssl.trustStore}\", \"read\";",
"permission java.io.FilePermission \"${-> testClusters."follow-cluster".getFirstNode().getServerLog()}\", \"read\";",
"};"
].join("\n")
)
} else {
policyFile.write(
[
"grant {",
@ -55,16 +34,11 @@ tasks.register("writeJavaPolicy") {
)
}
}
}
task "follow-cluster"(type: RestIntegTestTask) {
dependsOn 'writeJavaPolicy', "leader-cluster"
useCluster testClusters."leader-cluster"
if (BuildParams.inFipsJvm){
systemProperty 'java.security.policy', "=file://${policyFile}"
} else {
systemProperty 'java.security.policy', "file://${policyFile}"
}
systemProperty 'tests.target_cluster', 'follow'
nonInputProperties.systemProperty 'tests.leader_host', "${-> testClusters."leader-cluster".getAllHttpSocketURI().get(0)}"
nonInputProperties.systemProperty 'log', "${-> testClusters."follow-cluster".getFirstNode().getServerLog()}"
@ -81,3 +55,8 @@ testClusters."follow-cluster" {
tasks.named("check").configure { dependsOn "follow-cluster" }
// no unit tests for multi-cluster-search, only the rest integration test
tasks.named("test").configure { enabled = false }
// We can't run in FIPS mode with a basic license
tasks.withType(Test).configureEach {
onlyIf { BuildParams.inFipsJvm == false}
}

2
x-pack/plugin/core/build.gradle
View file

@ -53,6 +53,8 @@ dependencies {
testImplementation project(path: ':modules:lang-mustache')
testImplementation project(path: ':modules:analysis-common')
testImplementation project(":client:rest-high-level")
// Needed for Fips140ProviderVerificationTests
testCompileOnly('org.bouncycastle:bc-fips:1.0.2')
testImplementation(project(':x-pack:license-tools')) {
transitive = false

32
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/Fips140ProviderVerificationTests.java Normal file
View file

@ -0,0 +1,32 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License;
* you may not use this file except in compliance with the Elastic License.
*/
package org.elasticsearch.xpack.core;
import org.bouncycastle.crypto.CryptoServicesRegistrar;
import org.elasticsearch.test.ESTestCase;
import java.security.Security;
import static org.hamcrest.Matchers.containsString;
import static org.hamcrest.Matchers.equalTo;
public class Fips140ProviderVerificationTests extends ESTestCase {
public void testBcFipsProviderInUse() {
if (inFipsJvm()) {
assertThat(Security.getProviders().length > 0, equalTo(true));
assertThat(Security.getProviders()[0].getName(), containsString("BCFIPS"));
}
}
public void testInApprovedOnlyMode() {
if (inFipsJvm()) {
assertThat(CryptoServicesRegistrar.isInApprovedOnlyMode(), equalTo(true));
}
}
}

1
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/transport/ProfileConfigurationsTests.java
View file

@ -22,6 +22,7 @@ import java.util.Map;
public class ProfileConfigurationsTests extends ESTestCase {
public void testGetSecureTransportProfileConfigurations() {
assumeFalse("Can't run in a FIPS JVM, uses JKS/PKCS12 keystores", inFipsJvm());
final Settings settings = getBaseSettings()
.put("path.home", createTempDir())
.put("xpack.security.transport.ssl.verification_mode", VerificationMode.CERTIFICATE.name())

1
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/RestrictedTrustManagerTests.java
View file

@ -33,7 +33,6 @@ import java.util.Objects;
import java.util.regex.Pattern;
import java.util.stream.Collectors;
import static org.elasticsearch.test.ESIntegTestCase.inFipsJvm;
public class RestrictedTrustManagerTests extends ESTestCase {

3
x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ssl/SSLServiceTests.java
View file

@ -315,6 +315,7 @@ public class SSLServiceTests extends ESTestCase {
}
public void testThatHttpClientAuthDefaultsToNone() throws Exception {
assumeFalse("Can't run in a FIPS JVM, uses JKS/PKCS12 keystores", inFipsJvm());
MockSecureSettings secureSettings = new MockSecureSettings();
secureSettings.setString("xpack.security.transport.ssl.keystore.secure_password", "testnode");
secureSettings.setString("xpack.security.http.ssl.keystore.secure_password", "testnode");
@ -338,6 +339,7 @@ public class SSLServiceTests extends ESTestCase {
}
public void testThatTruststorePasswordIsRequired() throws Exception {
assumeFalse("Can't run in a FIPS JVM, uses JKS/PKCS12 keystores", inFipsJvm());
MockSecureSettings secureSettings = new MockSecureSettings();
secureSettings.setString("xpack.security.transport.ssl.keystore.secure_password", "testnode");
Settings settings = Settings.builder()
@ -354,6 +356,7 @@ public class SSLServiceTests extends ESTestCase {
}
public void testThatKeystorePasswordIsRequired() throws Exception {
assumeFalse("Can't run in a FIPS JVM, uses JKS/PKCS12 keystores", inFipsJvm());
Settings settings = Settings.builder()
.put("xpack.security.transport.ssl.keystore.path", testnodeStore)
.put("xpack.security.transport.ssl.keystore.type", testnodeStoreType)

7
x-pack/plugin/data-streams/qa/multi-node/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
File repoDir = file("$buildDir/testclusters/repo")
@ -19,3 +21,8 @@ testClusters.matching { it.name == "javaRestTest" }.configureEach {
//disabling ILM history as it disturbs testDSXpackUsage test
setting 'indices.lifecycle.history_index_enabled', 'false'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

8
x-pack/plugin/data-streams/qa/rest/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.yaml-rest-test'
apply plugin: 'elasticsearch.java-rest-test'
@ -18,3 +20,9 @@ testClusters.all {
// disable ILM history, since it disturbs tests using _all
setting 'indices.lifecycle.history_index_enabled', 'false'
}
if (BuildParams.inFipsJvm){
// These fail in CI but only when run as part of checkPart2 and not individually.
// Tracked in :
tasks.named("javaRestTest").configure{enabled = false }
tasks.named("yamlRestTest").configure{enabled = false }
}

6
x-pack/plugin/deprecation/qa/rest/build.gradle
View file

@ -1,4 +1,5 @@
import org.elasticsearch.gradle.util.GradleUtils
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.esplugin'
apply plugin: 'elasticsearch.java-rest-test'
@ -30,3 +31,8 @@ testClusters.all {
}
tasks.named("test").configure { enabled = false }
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

6
x-pack/plugin/enrich/qa/rest-with-security/build.gradle
View file

@ -1,9 +1,15 @@
apply plugin: 'elasticsearch.java-rest-test'
import org.elasticsearch.gradle.info.BuildParams
dependencies {
javaRestTestImplementation project(path: xpackModule('core'))
javaRestTestImplementation project(path: xpackModule('enrich:qa:common'))
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters.all {
testDistribution = 'DEFAULT'

8
x-pack/plugin/enrich/qa/rest/build.gradle
View file

@ -1,6 +1,8 @@
apply plugin: 'elasticsearch.java-rest-test'
apply plugin: 'elasticsearch.yaml-rest-test'
import org.elasticsearch.gradle.info.BuildParams
restResources {
restApi {
includeCore '_common', 'indices', 'index'
@ -12,6 +14,12 @@ dependencies {
javaRestTestImplementation project(path: xpackModule('enrich:qa:common'))
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
tasks.named("yamlRestTest").configure{enabled = false }
}
testClusters.all {
testDistribution = 'DEFAULT'
setting 'xpack.license.self_generated.type', 'basic'

5
x-pack/plugin/eql/qa/correctness/build.gradle
View file

@ -4,6 +4,7 @@ apply plugin: 'elasticsearch.testclusters'
tasks.named("test").configure { enabled = false }
import org.elasticsearch.gradle.testclusters.RunTask
import org.elasticsearch.gradle.info.BuildParams
restResources {
restApi {
@ -31,6 +32,10 @@ Boolean preserveData = providers.systemProperty('eql.test.preserve.data')
.map { s -> Boolean.parseBoolean(s) }
.getOrElse(false)
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters {
all {
plugin ':plugins:repository-gcs'

7
x-pack/plugin/eql/qa/rest/build.gradle
View file

@ -1,6 +1,8 @@
apply plugin: 'elasticsearch.java-rest-test'
apply plugin: 'elasticsearch.yaml-rest-test'
import org.elasticsearch.gradle.info.BuildParams
restResources {
restApi {
includeCore '_common', 'bulk', 'indices'
@ -12,6 +14,11 @@ dependencies {
javaRestTestImplementation project(path: xpackModule('eql:qa:common'))
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
tasks.named("yamlRestTest").configure{enabled = false }
}
testClusters.all {
testDistribution = 'DEFAULT'
setting 'xpack.license.self_generated.type', 'basic'

7
x-pack/plugin/eql/qa/security/build.gradle
View file

@ -1,9 +1,16 @@
apply plugin: 'elasticsearch.java-rest-test'
import org.elasticsearch.gradle.info.BuildParams
dependencies {
javaRestTestImplementation project(path: xpackModule('eql:qa:common'))
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters.all {
testDistribution = 'DEFAULT'
setting 'xpack.license.self_generated.type', 'basic'

7
x-pack/plugin/identity-provider/qa/idp-rest-tests/build.gradle
View file

@ -1,3 +1,4 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
dependencies {
@ -45,3 +46,9 @@ testClusters.all {
user username: "idp_admin", password: "idp-password", role: "idp_admin"
user username: "idp_user", password: "idp-password", role: "idp_user"
}
// We don't support the IDP in FIPS-140 mode, so no need to run java rest tests
tasks.named("javaRestTest").configure {
onlyIf { BuildParams.inFipsJvm == false }
}

6
x-pack/plugin/ilm/qa/multi-cluster/build.gradle
View file

@ -1,4 +1,5 @@
import org.elasticsearch.gradle.test.RestIntegTestTask
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.testclusters'
apply plugin: 'elasticsearch.standalone-test'
@ -57,3 +58,8 @@ testClusters.matching{ it.name == 'follow-cluster' }.configureEach {
tasks.named("check").configure { dependsOn 'follow-cluster' }
// no unit tests for this module, only the rest integration test
tasks.named("test").configure { enabled = false }
// Security is explicitly disabled for follow-cluster and leader-cluster, do not run these in FIPS mode
tasks.withType(Test).configureEach {
onlyIf { BuildParams.inFipsJvm == false}
}

6
x-pack/plugin/ilm/qa/multi-node/build.gradle
View file

@ -1,4 +1,5 @@
import org.elasticsearch.gradle.util.GradleUtils
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
@ -30,3 +31,8 @@ testClusters.all {
setting 'logger.org.elasticsearch.xpack.core.ilm', 'TRACE'
setting 'logger.org.elasticsearch.xpack.ilm', 'TRACE'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

8
x-pack/plugin/ilm/qa/with-security/src/javaRestTest/java/org/elasticsearch/xpack/security/PermissionsIT.java
View file

@ -164,14 +164,14 @@ public class PermissionsIT extends ESRestTestCase {
"\"indices\": [{ \"names\": [\".slm-history*\"],\"privileges\": [\"all\"] }] }");
assertOK(adminClient().performRequest(roleRequest));
createUser("slm_admin", "slm-pass", "slm-manage");
createUser("slm_user", "slm-user-pass", "slm-read");
createUser("slm_admin", "slm-admin-password", "slm-manage");
createUser("slm_user", "slm-user-password", "slm-read");
final HighLevelClient hlAdminClient = new HighLevelClient(adminClient());
// Build two high level clients, each using a different user
final RestClientBuilder adminBuilder = RestClient.builder(adminClient().getNodes().toArray(new Node[0]));
final String adminToken = basicAuthHeaderValue("slm_admin", new SecureString("slm-pass".toCharArray()));
final String adminToken = basicAuthHeaderValue("slm_admin", new SecureString("slm-admin-password".toCharArray()));
configureClient(adminBuilder, Settings.builder()
.put(ThreadContext.PREFIX + ".Authorization", adminToken)
.build());
@ -179,7 +179,7 @@ public class PermissionsIT extends ESRestTestCase {
final RestHighLevelClient adminHLRC = new RestHighLevelClient(adminBuilder);
final RestClientBuilder userBuilder = RestClient.builder(adminClient().getNodes().toArray(new Node[0]));
final String userToken = basicAuthHeaderValue("slm_user", new SecureString("slm-user-pass".toCharArray()));
final String userToken = basicAuthHeaderValue("slm_user", new SecureString("slm-user-password".toCharArray()));
configureClient(userBuilder, Settings.builder()
.put(ThreadContext.PREFIX + ".Authorization", userToken)
.build());

7
x-pack/plugin/ml/qa/basic-multi-node/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
testClusters.all {
@ -11,3 +13,8 @@ testClusters.all {
setting 'indices.lifecycle.history_index_enabled', 'false'
setting 'slm.history_index_enabled', 'false'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

7
x-pack/plugin/ml/qa/disabled/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
//dependencies {
@ -10,3 +12,8 @@ testClusters.all {
setting 'xpack.security.enabled', 'false'
setting 'xpack.ml.enabled', 'false'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

7
x-pack/plugin/ml/qa/single-node-tests/build.gradle
View file

@ -1,3 +1,5 @@
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
testClusters.all {
@ -5,3 +7,8 @@ testClusters.all {
setting 'xpack.security.enabled', 'false'
setting 'xpack.license.self_generated.type', 'trial'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

2
x-pack/plugin/repositories-metering-api/qa/gcs/build.gradle
View file

@ -66,7 +66,7 @@ if (!gcsServiceAccount && !gcsBucket && !gcsBasePath) {
tasks.register("createServiceAccountFile") {
doLast {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA")
keyPairGenerator.initialize(1024)
keyPairGenerator.initialize(2048)
KeyPair keyPair = keyPairGenerator.generateKeyPair()
String encodedKey = Base64.getEncoder().encodeToString(keyPair.private.getEncoded())

4
x-pack/plugin/repositories-metering-api/qa/s3/build.gradle
View file

@ -27,8 +27,8 @@ String s3Bucket = System.getenv("amazon_s3_bucket")
String s3BasePath = System.getenv("amazon_s3_base_path")
if (!s3AccessKey && !s3SecretKey && !s3Bucket && !s3BasePath) {
s3AccessKey = 'access_key'
s3SecretKey = 'secret_key'
s3AccessKey = 's3_test_access_key'
s3SecretKey = 's3_test_secret_key'
s3Bucket = 'bucket'
s3BasePath = null
useFixture = true

7
x-pack/plugin/rollup/qa/rest/build.gradle
View file

@ -9,6 +9,8 @@ apply plugin: 'elasticsearch.standalone-rest-test'
apply plugin: 'elasticsearch.rest-test'
apply plugin: 'elasticsearch.rest-resources'
import org.elasticsearch.gradle.info.BuildParams
dependencies {
testImplementation project(path: xpackModule('rollup'))
}
@ -20,6 +22,11 @@ restResources {
}
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("integTest").configure{enabled = false }
tasks.named("testingConventions").configure{enabled = false }
}
testClusters.matching { it.name == "integTest" }.configureEach {
testDistribution = 'DEFAULT'
setting 'xpack.license.self_generated.type', 'basic'

2
x-pack/plugin/searchable-snapshots/qa/gcs/build.gradle
View file

@ -48,7 +48,7 @@ if (!gcsServiceAccount && !gcsBucket && !gcsBasePath) {
tasks.register("createServiceAccountFile") {
doLast {
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA")
keyPairGenerator.initialize(1024)
keyPairGenerator.initialize(2048)
KeyPair keyPair = keyPairGenerator.generateKeyPair()
String encodedKey = Base64.getEncoder().encodeToString(keyPair.private.getEncoded())

4
x-pack/plugin/searchable-snapshots/qa/minio/build.gradle
View file

@ -36,8 +36,8 @@ testClusters.matching { it.name == "integTest" }.configureEach {
testDistribution = 'DEFAULT'
plugin repositoryPlugin.path
keystore 's3.client.searchable_snapshots.access_key', 'access_key'
keystore 's3.client.searchable_snapshots.secret_key', 'secret_key'
keystore 's3.client.searchable_snapshots.access_key', 's3_test_access_key'
keystore 's3.client.searchable_snapshots.secret_key', 's3_test_secret_key'
setting 'xpack.license.self_generated.type', 'trial'
setting 's3.client.searchable_snapshots.protocol', 'http'
setting 's3.client.searchable_snapshots.endpoint', { "${-> fixtureAddress()}" }, IGNORE_VALUE

4
x-pack/plugin/searchable-snapshots/qa/s3/build.gradle
View file

@ -27,8 +27,8 @@ String s3Bucket = System.getenv("amazon_s3_bucket")
String s3BasePath = System.getenv("amazon_s3_base_path")
if (!s3AccessKey && !s3SecretKey && !s3Bucket && !s3BasePath) {
s3AccessKey = 'access_key'
s3SecretKey = 'secret_key'
s3AccessKey = 's3_test_access_key'
s3SecretKey = 's3_test_secret_key'
s3Bucket = 'bucket'
s3BasePath = null
useFixture = true

9
x-pack/plugin/security/qa/basic-enable-security/build.gradle
View file

@ -1,5 +1,6 @@
import org.elasticsearch.gradle.testclusters.StandaloneRestIntegTestTask
import org.elasticsearch.gradle.test.rest.JavaRestTestPlugin
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
@ -14,6 +15,11 @@ tasks.named("javaRestTest").configure {
systemProperty 'tests.has_security', 'false'
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters {
javaRestTest {
testDistribution = 'DEFAULT'
@ -31,6 +37,9 @@ tasks.register("javaRestTestWithSecurity", StandaloneRestIntegTestTask) {
systemProperty 'tests.has_security', 'true'
testClassesDirs = sourceSets.javaRestTest.output.classesDirs
classpath = sourceSets.javaRestTest.runtimeClasspath
onlyIf {
BuildParams.inFipsJvm == false
}
doFirst {
testClusters.javaRestTest {
// TODO Rene: revisit if using dedicated new cluster definitions would be more efficient.

7
x-pack/plugin/security/qa/security-basic/build.gradle
View file

@ -1,12 +1,19 @@
apply plugin: 'elasticsearch.java-rest-test'
import org.elasticsearch.gradle.info.BuildParams
dependencies {
javaRestTestImplementation project(path: xpackModule('core'), configuration: 'default')
javaRestTestImplementation project(path: xpackModule('security'), configuration: 'testArtifacts')
javaRestTestImplementation project(path: xpackModule('core'), configuration: 'testArtifacts')
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters.all {
testDistribution = 'DEFAULT'
numberOfNodes = 2

6
x-pack/plugin/security/qa/security-disabled/build.gradle
View file

@ -5,6 +5,7 @@
* For example: If a cluster has a pipeline with the set_security_user processor
* defined, it should be not fail
*/
import org.elasticsearch.gradle.info.BuildParams
apply plugin: 'elasticsearch.java-rest-test'
@ -24,3 +25,8 @@ testClusters.all {
setting 'xpack.license.self_generated.type', 'trial'
setting 'xpack.security.enabled', 'false'
}
if (BuildParams.inFipsJvm){
// Test clusters run with security disabled
tasks.named("javaRestTest").configure{enabled = false }
}

4
x-pack/plugin/security/qa/security-trial/src/javaRestTest/java/org/elasticsearch/xpack/security/apikey/ApiKeyRestIT.java
View file

@ -41,9 +41,9 @@ import static org.hamcrest.Matchers.notNullValue;
public class ApiKeyRestIT extends SecurityOnTrialLicenseRestTestCase {
private static final String SYSTEM_USER = "system_user";
private static final SecureString SYSTEM_USER_PASSWORD = new SecureString("sys-pass".toCharArray());
private static final SecureString SYSTEM_USER_PASSWORD = new SecureString("system-user-password".toCharArray());
private static final String END_USER = "end_user";
private static final SecureString END_USER_PASSWORD = new SecureString("user-pass".toCharArray());
private static final SecureString END_USER_PASSWORD = new SecureString("end-user-password".toCharArray());
@Before
public void createUsers() throws IOException {

7
x-pack/plugin/security/qa/tls-basic/build.gradle
View file

@ -1,11 +1,18 @@
apply plugin: 'elasticsearch.java-rest-test'
import org.elasticsearch.gradle.info.BuildParams
dependencies {
testImplementation project(path: xpackModule('core'), configuration: 'default')
testImplementation project(path: xpackModule('security'), configuration: 'testArtifacts')
testImplementation project(path: xpackModule('core'), configuration: 'testArtifacts')
}
if (BuildParams.inFipsJvm){
// This test cluster is using a BASIC license and FIPS 140 mode is not supported in BASIC
tasks.named("javaRestTest").configure{enabled = false }
}
testClusters.javaRestTest {
testDistribution = 'DEFAULT'
numberOfNodes = 2

5
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/AbstractPrivilegeTestCase.java
View file

@ -12,7 +12,7 @@ import org.elasticsearch.client.Request;
import org.elasticsearch.client.RequestOptions;
import org.elasticsearch.client.Response;
import org.elasticsearch.client.ResponseException;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.test.SecuritySingleNodeTestCase;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
@ -94,7 +94,8 @@ public abstract class AbstractPrivilegeTestCase extends SecuritySingleNodeTestCa
private void setUser(Request request, String user) {
RequestOptions.Builder options = RequestOptions.DEFAULT.toBuilder();
options.addHeader("Authorization", UsernamePasswordToken.basicAuthHeaderValue(user, new SecureString("passwd".toCharArray())));
options.addHeader("Authorization",
UsernamePasswordToken.basicAuthHeaderValue(user, SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
request.setOptions(options);
}
}

6
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/ClearRealmsCacheTests.java
View file

@ -188,8 +188,8 @@ public class ClearRealmsCacheTests extends SecurityIntegTestCase {
@Override
protected String configUsers() {
StringBuilder builder = new StringBuilder(SecuritySettingsSource.CONFIG_STANDARD_USER);
final String usersPasswdHashed = new String(getFastStoredHashAlgoForTests().hash(new SecureString
("passwd".toCharArray())));
final String usersPasswdHashed =
new String(getFastStoredHashAlgoForTests().hash(SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
for (String username : usernames) {
builder.append(username).append(":").append(usersPasswdHashed).append("\n");
}
@ -221,7 +221,7 @@ public class ClearRealmsCacheTests extends SecurityIntegTestCase {
private void testScenario(Scenario scenario) throws Exception {
Map<String, UsernamePasswordToken> tokens = new HashMap<>();
for (String user : usernames) {
tokens.put(user, new UsernamePasswordToken(user, new SecureString("passwd")));
tokens.put(user, new UsernamePasswordToken(user, SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
}
List<Realm> realms = new ArrayList<>();

6
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/ClusterPrivilegeIntegrationTests.java
View file

@ -10,8 +10,8 @@ import org.elasticsearch.action.admin.cluster.state.ClusterStateRequest;
import org.elasticsearch.client.Request;
import org.elasticsearch.cluster.SnapshotsInProgress;
import org.elasticsearch.common.Strings;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
import org.hamcrest.Matchers;
import org.junit.AfterClass;
@ -79,8 +79,8 @@ public class ClusterPrivilegeIntegrationTests extends AbstractPrivilegeTestCase
@Override
protected String configUsers() {
final String usersPasswdHashed = new String(Hasher.resolve(
randomFrom("pbkdf2", "pbkdf2_1000", "bcrypt", "bcrypt9")).hash(new SecureString("passwd".toCharArray())));
final Hasher passwdHasher = getFastStoredHashAlgoForTests();
final String usersPasswdHashed = new String(passwdHasher.hash(SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
return super.configUsers() +
"user_a:" + usersPasswdHashed + "\n" +
"user_b:" + usersPasswdHashed + "\n" +

6
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/CreateDocsIndexPrivilegeTests.java
View file

@ -7,7 +7,7 @@
package org.elasticsearch.integration;
import org.elasticsearch.client.Request;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
import org.junit.Before;
@ -43,8 +43,8 @@ public class CreateDocsIndexPrivilegeTests extends AbstractPrivilegeTestCase {
@Override
protected String configUsers() {
final String usersPasswdHashed = new String(Hasher.resolve(
randomFrom("pbkdf2", "pbkdf2_1000", "bcrypt", "bcrypt9")).hash(new SecureString("passwd".toCharArray())));
final Hasher passwdHasher = getFastStoredHashAlgoForTests();
final String usersPasswdHashed = new String(passwdHasher.hash(SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
return super.configUsers() +
"admin:" + usersPasswdHashed + "\n" +

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/DateMathExpressionIntegTests.java
View file

@ -22,6 +22,7 @@ import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.common.util.concurrent.ThreadContext;
import org.elasticsearch.index.query.QueryBuilders;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import java.util.Collections;
@ -33,7 +34,7 @@ import static org.hamcrest.Matchers.is;
public class DateMathExpressionIntegTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
protected String configUsers() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/DocumentAndFieldLevelSecurityTests.java
View file

@ -24,6 +24,7 @@ import org.elasticsearch.index.query.QueryBuilders;
import org.elasticsearch.indices.IndicesModule;
import org.elasticsearch.search.sort.SortOrder;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import java.util.Collections;
@ -44,7 +45,7 @@ import static org.hamcrest.Matchers.is;
public class DocumentAndFieldLevelSecurityTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
protected String configUsers() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/DocumentLevelSecurityRandomTests.java
View file

@ -11,6 +11,7 @@ import org.elasticsearch.action.search.SearchResponse;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.index.query.QueryBuilders;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.test.SecurityIntegTestCase;
@ -25,7 +26,7 @@ import static org.hamcrest.Matchers.equalTo;
public class DocumentLevelSecurityRandomTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
// can't add a second test method, because each test run creates a new instance of this class and that will will result
// in a new random value:

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/DocumentLevelSecurityTests.java
View file

@ -60,6 +60,7 @@ import org.elasticsearch.search.suggest.term.TermSuggestion;
import org.elasticsearch.search.suggest.term.TermSuggestionBuilder;
import org.elasticsearch.test.InternalSettingsPlugin;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.xpack.core.search.action.ClosePointInTimeAction;
import org.elasticsearch.xpack.core.search.action.ClosePointInTimeRequest;
@ -96,7 +97,7 @@ import static org.hamcrest.Matchers.notNullValue;
@LuceneTestCase.SuppressCodecs("*") // suppress test codecs otherwise test using completion suggester fails
public class DocumentLevelSecurityTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
protected Collection<Class<? extends Plugin>> nodePlugins() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/FieldLevelSecurityRandomTests.java
View file

@ -11,6 +11,7 @@ import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.index.query.QueryBuilders;
import org.elasticsearch.search.sort.SortOrder;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.test.SecurityIntegTestCase;
@ -32,7 +33,7 @@ import static org.hamcrest.Matchers.equalTo;
public class FieldLevelSecurityRandomTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
private static Set<String> allowedFields;
private static Set<String> disAllowedFields;

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/FieldLevelSecurityTests.java
View file

@ -46,6 +46,7 @@ import org.elasticsearch.search.fetch.subphase.highlight.HighlightBuilder;
import org.elasticsearch.search.sort.SortOrder;
import org.elasticsearch.test.InternalSettingsPlugin;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.xpack.core.search.action.ClosePointInTimeAction;
import org.elasticsearch.xpack.core.search.action.ClosePointInTimeRequest;
@ -83,7 +84,7 @@ import static org.hamcrest.Matchers.nullValue;
public class FieldLevelSecurityTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
protected Collection<Class<? extends Plugin>> nodePlugins() {

5
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/IndexPrivilegeIntegTests.java
View file

@ -11,6 +11,7 @@ import org.elasticsearch.client.Response;
import org.elasticsearch.client.ResponseException;
import org.elasticsearch.common.UUIDs;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.Hasher;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import org.junit.Before;
@ -120,8 +121,8 @@ public class IndexPrivilegeIntegTests extends AbstractPrivilegeTestCase {
@Override
protected String configUsers() {
final String usersPasswdHashed = new String(Hasher.resolve(
randomFrom("pbkdf2", "pbkdf2_1000", "bcrypt", "bcrypt9")).hash(new SecureString("passwd".toCharArray())));
final Hasher passwdHasher = getFastStoredHashAlgoForTests();
final String usersPasswdHashed = new String(passwdHasher.hash(SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
return super.configUsers() +
"admin:" + usersPasswdHashed + "\n" +

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/IndicesPermissionsWithAliasesWildcardsAndRegexsTests.java
View file

@ -9,6 +9,7 @@ import org.elasticsearch.action.admin.indices.alias.Alias;
import org.elasticsearch.action.get.GetResponse;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.XPackSettings;
import org.elasticsearch.test.SecurityIntegTestCase;
@ -22,7 +23,7 @@ import static org.hamcrest.Matchers.equalTo;
public class IndicesPermissionsWithAliasesWildcardsAndRegexsTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
protected String configUsers() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/KibanaSystemRoleIntegTests.java
View file

@ -11,6 +11,7 @@ import org.elasticsearch.action.delete.DeleteResponse;
import org.elasticsearch.action.index.IndexResponse;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import java.util.Locale;
@ -21,7 +22,7 @@ import static org.hamcrest.Matchers.is;
public class KibanaSystemRoleIntegTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
public String configUsers() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/KibanaUserRoleIntegTests.java
View file

@ -17,6 +17,7 @@ import org.elasticsearch.common.collect.ImmutableOpenMap;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.index.query.QueryBuilders;
import org.elasticsearch.test.NativeRealmIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import java.util.Map;
@ -32,7 +33,7 @@ import static org.hamcrest.Matchers.notNullValue;
public class KibanaUserRoleIntegTests extends NativeRealmIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("change_me".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Override
public String configRoles() {

3
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/MultipleIndicesPermissionsTests.java
View file

@ -26,6 +26,7 @@ import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.rest.RestStatus;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSource;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import org.junit.After;
import org.junit.Before;
@ -45,7 +46,7 @@ import static org.hamcrest.Matchers.is;
public class MultipleIndicesPermissionsTests extends SecurityIntegTestCase {
protected static final SecureString USERS_PASSWD = new SecureString("passwd".toCharArray());
protected static final SecureString USERS_PASSWD = SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
@Before
public void waitForSecurityIndexWritable() throws Exception {

8
x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/integration/PermissionPrecedenceTests.java
View file

@ -13,6 +13,7 @@ import org.elasticsearch.client.Client;
import org.elasticsearch.cluster.metadata.IndexTemplateMetadata;
import org.elasticsearch.common.settings.SecureString;
import org.elasticsearch.test.SecurityIntegTestCase;
import org.elasticsearch.test.SecuritySettingsSourceField;
import org.elasticsearch.xpack.core.security.authc.support.UsernamePasswordToken;
import java.util.Collections;
@ -49,7 +50,8 @@ public class PermissionPrecedenceTests extends SecurityIntegTestCase {
@Override
protected String configUsers() {
final String usersPasswdHashed = new String(getFastStoredHashAlgoForTests().hash(new SecureString("test123".toCharArray())));
final String usersPasswdHashed =
new String(getFastStoredHashAlgoForTests().hash(SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
return "admin:" + usersPasswdHashed + "\n" +
"client:" + usersPasswdHashed + "\n" +
"user:" + usersPasswdHashed + "\n";
@ -69,7 +71,7 @@ public class PermissionPrecedenceTests extends SecurityIntegTestCase {
@Override
protected SecureString nodeClientPassword() {
return new SecureString("test123".toCharArray());
return SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING;
}
public void testDifferentCombinationsOfIndices() throws Exception {
@ -98,7 +100,7 @@ public class PermissionPrecedenceTests extends SecurityIntegTestCase {
.setPatterns(Collections.singletonList("test_*"))::get, PutIndexTemplateAction.NAME, "user");
Map<String, String> headers = Collections.singletonMap(UsernamePasswordToken.BASIC_AUTH_HEADER, basicAuthHeaderValue("user",
new SecureString("test123")));
SecuritySettingsSourceField.TEST_PASSWORD_SECURE_STRING));
assertThrowsAuthorizationException(client.filterWithHeader(headers).admin().indices().prepareGetTemplates("template1")::get,
GetIndexTemplatesAction.NAME, "user");
}

Some files were not shown because too many files have changed in this diff Show more