|
| 1 | +/* |
| 2 | + * SPDX-License-Identifier: Apache-2.0 |
| 3 | + * |
| 4 | + * The OpenSearch Contributors require contributions made to |
| 5 | + * this file be licensed under the Apache-2.0 license or a |
| 6 | + * compatible open source license. |
| 7 | + * |
| 8 | + * Modifications Copyright OpenSearch Contributors. See |
| 9 | + * GitHub history for details. |
| 10 | + */ |
| 11 | +package org.opensearch.security.api; |
| 12 | + |
| 13 | +import java.util.ArrayList; |
| 14 | +import java.util.Collection; |
| 15 | +import java.util.Collections; |
| 16 | +import java.util.List; |
| 17 | +import java.util.Set; |
| 18 | +import java.util.StringJoiner; |
| 19 | +import java.util.stream.Collectors; |
| 20 | + |
| 21 | +import com.carrotsearch.randomizedtesting.RandomizedContext; |
| 22 | +import com.google.common.collect.ImmutableList; |
| 23 | +import com.fasterxml.jackson.databind.JsonNode; |
| 24 | +import org.apache.commons.lang3.tuple.Pair; |
| 25 | +import org.junit.Test; |
| 26 | + |
| 27 | +import org.opensearch.security.dlic.rest.api.Endpoint; |
| 28 | +import org.opensearch.security.dlic.rest.api.ssl.SslCertificatesInfoNodesRequest; |
| 29 | +import org.opensearch.test.framework.certificate.TestCertificates; |
| 30 | +import org.opensearch.test.framework.cluster.LocalOpenSearchCluster; |
| 31 | +import org.opensearch.test.framework.cluster.TestRestClient; |
| 32 | + |
| 33 | +import static org.hamcrest.CoreMatchers.containsString; |
| 34 | +import static org.hamcrest.CoreMatchers.is; |
| 35 | +import static org.hamcrest.MatcherAssert.assertThat; |
| 36 | +import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.CERTS_INFO_ACTION; |
| 37 | +import static org.opensearch.security.support.ConfigConstants.SECURITY_RESTAPI_ADMIN_ENABLED; |
| 38 | + |
| 39 | +public class SslCertsRestApiIntegrationTest extends AbstractApiIntegrationTest { |
| 40 | + |
| 41 | + final static String REST_API_ADMIN_SSL_INFO = "rest-api-admin-ssl-info"; |
| 42 | + |
| 43 | + static { |
| 44 | + clusterSettings.put(SECURITY_RESTAPI_ADMIN_ENABLED, true); |
| 45 | + testSecurityConfig.withRestAdminUser(REST_ADMIN_USER, allRestAdminPermissions()) |
| 46 | + .withRestAdminUser(REST_API_ADMIN_SSL_INFO, restAdminPermission(Endpoint.SSL, CERTS_INFO_ACTION)); |
| 47 | + } |
| 48 | + |
| 49 | + protected String sslCertsPath(String... path) { |
| 50 | + final var fullPath = new StringJoiner("/"); |
| 51 | + fullPath.add(super.apiPath("ssl", "certs")); |
| 52 | + if (path != null) { |
| 53 | + for (final var p : path) { |
| 54 | + fullPath.add(p); |
| 55 | + } |
| 56 | + } |
| 57 | + return fullPath.toString(); |
| 58 | + } |
| 59 | + |
| 60 | + @Test |
| 61 | + public void forbiddenForRegularUser() throws Exception { |
| 62 | + withUser(NEW_USER, client -> forbidden(() -> client.get(sslCertsPath()))); |
| 63 | + } |
| 64 | + |
| 65 | + @Test |
| 66 | + public void forbiddenForAdminUser() throws Exception { |
| 67 | + withUser(ADMIN_USER_NAME, client -> forbidden(() -> client.get(sslCertsPath()))); |
| 68 | + } |
| 69 | + |
| 70 | + @Test |
| 71 | + public void availableForTlsAdmin() throws Exception { |
| 72 | + withUser(ADMIN_USER_NAME, localCluster.getAdminCertificate(), this::verifySSLCertsInfo); |
| 73 | + } |
| 74 | + |
| 75 | + @Test |
| 76 | + public void availableForRestAdmin() throws Exception { |
| 77 | + withUser(REST_ADMIN_USER, this::verifySSLCertsInfo); |
| 78 | + withUser(REST_API_ADMIN_SSL_INFO, this::verifySSLCertsInfo); |
| 79 | + } |
| 80 | + |
| 81 | + private void verifySSLCertsInfo(final TestRestClient client) throws Exception { |
| 82 | + assertSSLCertsInfo( |
| 83 | + nodesWithOrder(), |
| 84 | + Set.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE), |
| 85 | + ok(() -> client.get(sslCertsPath())) |
| 86 | + ); |
| 87 | + if (localCluster.nodes().size() > 1) { |
| 88 | + final var randomNodes = randomNodes(); |
| 89 | + final var nodeIds = randomNodes.stream() |
| 90 | + .map(Pair::getRight) |
| 91 | + .map(n -> n.esNode().getNodeEnvironment().nodeId()) |
| 92 | + .collect(Collectors.joining(",")); |
| 93 | + assertSSLCertsInfo( |
| 94 | + randomNodes, |
| 95 | + Set.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE), |
| 96 | + ok(() -> client.get(sslCertsPath(nodeIds))) |
| 97 | + ); |
| 98 | + } |
| 99 | + final var randomCertType = randomFrom( |
| 100 | + List.of(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE, SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE) |
| 101 | + ); |
| 102 | + assertSSLCertsInfo( |
| 103 | + nodesWithOrder(), |
| 104 | + Set.of(randomCertType), |
| 105 | + ok(() -> client.get(String.format("%s?cert_type=%s", sslCertsPath(), randomCertType))) |
| 106 | + ); |
| 107 | + |
| 108 | + } |
| 109 | + |
| 110 | + private void assertSSLCertsInfo( |
| 111 | + final List<Pair<Integer, LocalOpenSearchCluster.Node>> expectedNode, |
| 112 | + final Set<String> expectedCertTypes, |
| 113 | + final TestRestClient.HttpResponse response |
| 114 | + ) { |
| 115 | + final var body = response.bodyAsJsonNode(); |
| 116 | + final var prettyStringBody = body.toPrettyString(); |
| 117 | + |
| 118 | + final var _nodes = body.get("_nodes"); |
| 119 | + assertThat(prettyStringBody, _nodes.get("total").asInt(), is(expectedNode.size())); |
| 120 | + assertThat(prettyStringBody, _nodes.get("successful").asInt(), is(expectedNode.size())); |
| 121 | + assertThat(prettyStringBody, _nodes.get("failed").asInt(), is(0)); |
| 122 | + assertThat(prettyStringBody, body.get("cluster_name").asText(), is(localCluster.getClusterName())); |
| 123 | + |
| 124 | + final var nodes = body.get("nodes"); |
| 125 | + |
| 126 | + for (final var nodeWithOrder : expectedNode) { |
| 127 | + final var esNode = nodeWithOrder.getRight().esNode(); |
| 128 | + final var node = nodes.get(esNode.getNodeEnvironment().nodeId()); |
| 129 | + assertThat(prettyStringBody, node.get("name").asText(), is(nodeWithOrder.getRight().getNodeName())); |
| 130 | + assertThat(prettyStringBody, node.has("certificates")); |
| 131 | + final var certificates = node.get("certificates"); |
| 132 | + if (expectedCertTypes.contains(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE)) { |
| 133 | + assertThat(prettyStringBody, certificates.get(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE).isArray()); |
| 134 | + assertThat(prettyStringBody, certificates.get(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE).size(), is(1)); |
| 135 | + verifyCertsJson(nodeWithOrder.getLeft(), certificates.get(SslCertificatesInfoNodesRequest.HTTP_CERT_TYPE).get(0)); |
| 136 | + } |
| 137 | + if (expectedCertTypes.contains(SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE)) { |
| 138 | + assertThat(prettyStringBody, certificates.get(SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE).isArray()); |
| 139 | + assertThat(prettyStringBody, certificates.get(SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE).size(), is(1)); |
| 140 | + verifyCertsJson(nodeWithOrder.getLeft(), certificates.get(SslCertificatesInfoNodesRequest.TRANSPORT_CERT_TYPE).get(0)); |
| 141 | + } |
| 142 | + } |
| 143 | + |
| 144 | + } |
| 145 | + |
| 146 | + private void verifyCertsJson(final int nodeNumber, final JsonNode jsonNode) { |
| 147 | + assertThat(jsonNode.toPrettyString(), jsonNode.get("issuer_dn").asText(), is(TestCertificates.CA_SUBJECT)); |
| 148 | + assertThat( |
| 149 | + jsonNode.toPrettyString(), |
| 150 | + jsonNode.get("subject_dn").asText(), |
| 151 | + is(String.format(TestCertificates.NODE_SUBJECT_PATTERN, nodeNumber)) |
| 152 | + ); |
| 153 | + assertThat( |
| 154 | + jsonNode.toPrettyString(), |
| 155 | + jsonNode.get("san").asText(), |
| 156 | + containsString(String.format("node-%s.example.com", nodeNumber)) |
| 157 | + ); |
| 158 | + assertThat(jsonNode.toPrettyString(), jsonNode.has("not_before")); |
| 159 | + assertThat(jsonNode.toPrettyString(), jsonNode.has("not_after")); |
| 160 | + } |
| 161 | + |
| 162 | + private List<Pair<Integer, LocalOpenSearchCluster.Node>> randomNodes() { |
| 163 | + final var nodesWithOrder = nodesWithOrder(); |
| 164 | + int leaveElements = randomIntBetween(1, nodesWithOrder.size() - 1); |
| 165 | + return randomSubsetOf(leaveElements, nodesWithOrder); |
| 166 | + } |
| 167 | + |
| 168 | + private List<Pair<Integer, LocalOpenSearchCluster.Node>> nodesWithOrder() { |
| 169 | + final var list = ImmutableList.<Pair<Integer, LocalOpenSearchCluster.Node>>builder(); |
| 170 | + for (int i = 0; i < localCluster.nodes().size(); i++) |
| 171 | + list.add(Pair.of(i, localCluster.nodes().get(i))); |
| 172 | + return list.build(); |
| 173 | + } |
| 174 | + |
| 175 | + public <T> List<T> randomSubsetOf(int size, Collection<T> collection) { |
| 176 | + if (size > collection.size()) { |
| 177 | + throw new IllegalArgumentException( |
| 178 | + "Can't pick " + size + " random objects from a collection of " + collection.size() + " objects" |
| 179 | + ); |
| 180 | + } |
| 181 | + List<T> tempList = new ArrayList<>(collection); |
| 182 | + Collections.shuffle(tempList, RandomizedContext.current().getRandom()); |
| 183 | + return tempList.subList(0, size); |
| 184 | + } |
| 185 | + |
| 186 | +} |
0 commit comments