Validate build hash in handshake #65601
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There is no guarantee of wire compatibility between nodes running different builds of the same version, but today we do not validate whether two communicating nodes are compatible or not. This results in confusing failures that look like serialization bugs, and it usually takes nontrivial effort to determine that the failure is in fact due to the user running incompatible builds. This commit adds the build hash to the transport service handshake and validates that matching versions have matching build hashes. Closes elastic#65249
DaveCTurner
added
>enhancement
:Distributed Coordination/Network
elasticmachine
added
the
Team:Distributed (Obsolete)
|
Pinging @elastic/es-distributed (Team:Distributed) |
|
NB I opened this PR against |
original-brownbear
approved these changes
Dec 1, 2020
| private static final Logger logger = LogManager.getLogger(TransportService.class); | ||
|
|
||
| private static final String PERMIT_HANDSHAKES_FROM_INCOMPATIBLE_BUILDS_KEY = "es.unsafely_permit_handshake_from_incompatible_builds"; | ||
| private static final boolean PERMIT_HANDSHAKES_FROM_INCOMPATIBLE_BUILDS = getPermitHandshakesFromIncompatibleBuilds(); |
There was a problem hiding this comment.
NIT: maybe just put the logic in this method in a static { } block below these two constants to make this easier to read in one go?
There was a problem hiding this comment.
Ah yeah not sure why I didn't do that. Done in 8132bf3
| if (PERMIT_HANDSHAKES_FROM_INCOMPATIBLE_BUILDS) { | ||
| logger.warn("transport handshakes from incompatible builds are unsafely permitted on this node; remove system property [" + | ||
| PERMIT_HANDSHAKES_FROM_INCOMPATIBLE_BUILDS_KEY + "] to resolve this warning"); | ||
| DeprecationLogger.getLogger(TransportService.class).deprecate("permit_handshake_from_incompatible_builds", |
There was a problem hiding this comment.
NIT: little much to log two messages for one thing? This seems like it's kind of a dev-only option anyway, why bother with the deprecation logger?
There was a problem hiding this comment.
Ehh I worry we'll get people using this, and the two logs are for two separate aspects. Deprecation logs don't go into the main server log (by default at least) but I think this deserves a visible warning whenever it's used.
DaveCTurner
added a commit
that referenced
this pull request
Dec 2, 2020
DaveCTurner
deleted the
2020-11-27-validate-build-hash-in-handshake-7x
branch
DaveCTurner
added a commit
to DaveCTurner/elasticsearch
that referenced
this pull request
Dec 2, 2020
DaveCTurner
added a commit
that referenced
this pull request
Dec 2, 2020
DaveCTurner
added a commit
to DaveCTurner/elasticsearch
that referenced
this pull request
Dec 2, 2020
Today in `7.x` there is a deprecated system property that bypasses the check that prevents nodes of incompatible builds from communicating. This commit removes the system property in `master` so that the check is always enforced. Relates elastic#65601, elastic#65249
jrodewig
added a commit
that referenced
this pull request
Sep 16, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is no guarantee of wire compatibility between nodes running
different builds of the same version, but today we do not validate
whether two communicating nodes are compatible or not. This results in
confusing failures that look like serialization bugs, and it usually
takes nontrivial effort to determine that the failure is in fact due to
the user running incompatible builds.
This commit adds the build hash to the transport service handshake and
validates that matching versions have matching build hashes.
Closes #65249