Skip to content

Commit 1550bc4

Browse files
jkakavasjasontedor
jkakavas
authored and
jasontedor
committed
Use settings from the context in BootstrapChecks (#32908)
Use settings from the context in BootstrapChecks instead of passing them in the constructor
1 parent 05924e8 commit 1550bc4

7 files changed

+29
-45
lines changed

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140JKSKeystoreBootstrapCheck.java

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,6 @@
1313

1414
public class FIPS140JKSKeystoreBootstrapCheck implements BootstrapCheck {
1515

16-
private final boolean fipsModeEnabled;
17-
18-
FIPS140JKSKeystoreBootstrapCheck(Settings settings) {
19-
this.fipsModeEnabled = XPackSettings.FIPS_MODE_ENABLED.get(settings);
20-
}
21-
2216
/**
2317
* Test if the node fails the check.
2418
*
@@ -28,7 +22,7 @@ public class FIPS140JKSKeystoreBootstrapCheck implements BootstrapCheck {
2822
@Override
2923
public BootstrapCheckResult check(BootstrapContext context) {
3024

31-
if (fipsModeEnabled) {
25+
if (XPackSettings.FIPS_MODE_ENABLED.get(context.settings)) {
3226
final Settings settings = context.settings;
3327
Settings keystoreTypeSettings = settings.filter(k -> k.endsWith("keystore.type"))
3428
.filter(k -> settings.get(k).equalsIgnoreCase("jks"));
@@ -50,6 +44,6 @@ public BootstrapCheckResult check(BootstrapContext context) {
5044

5145
@Override
5246
public boolean alwaysEnforce() {
53-
return fipsModeEnabled;
47+
return true;
5448
}
5549
}

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheck.java

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import org.elasticsearch.bootstrap.BootstrapContext;
1111
import org.elasticsearch.license.License;
1212
import org.elasticsearch.license.LicenseService;
13+
import org.elasticsearch.xpack.core.XPackSettings;
1314

1415
import java.util.EnumSet;
1516

@@ -21,15 +22,9 @@ final class FIPS140LicenseBootstrapCheck implements BootstrapCheck {
2122
static final EnumSet<License.OperationMode> ALLOWED_LICENSE_OPERATION_MODES =
2223
EnumSet.of(License.OperationMode.PLATINUM, License.OperationMode.TRIAL);
2324

24-
private final boolean isInFipsMode;
25-
26-
FIPS140LicenseBootstrapCheck(boolean isInFipsMode) {
27-
this.isInFipsMode = isInFipsMode;
28-
}
29-
3025
@Override
3126
public BootstrapCheckResult check(BootstrapContext context) {
32-
if (isInFipsMode) {
27+
if (XPackSettings.FIPS_MODE_ENABLED.get(context.settings)) {
3328
License license = LicenseService.getLicense(context.metaData);
3429
if (license != null && ALLOWED_LICENSE_OPERATION_MODES.contains(license.operationMode()) == false) {
3530
return BootstrapCheckResult.failure("FIPS mode is only allowed with a Platinum or Trial license");

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheck.java

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,12 @@
77

88
import org.elasticsearch.bootstrap.BootstrapCheck;
99
import org.elasticsearch.bootstrap.BootstrapContext;
10-
import org.elasticsearch.common.settings.Settings;
1110
import org.elasticsearch.xpack.core.XPackSettings;
1211

1312
import java.util.Locale;
1413

1514
public class FIPS140PasswordHashingAlgorithmBootstrapCheck implements BootstrapCheck {
1615

17-
private final boolean fipsModeEnabled;
18-
19-
FIPS140PasswordHashingAlgorithmBootstrapCheck(final Settings settings) {
20-
this.fipsModeEnabled = XPackSettings.FIPS_MODE_ENABLED.get(settings);
21-
}
22-
2316
/**
2417
* Test if the node fails the check.
2518
*
@@ -28,7 +21,7 @@ public class FIPS140PasswordHashingAlgorithmBootstrapCheck implements BootstrapC
2821
*/
2922
@Override
3023
public BootstrapCheckResult check(final BootstrapContext context) {
31-
if (fipsModeEnabled) {
24+
if (XPackSettings.FIPS_MODE_ENABLED.get(context.settings)) {
3225
final String selectedAlgorithm = XPackSettings.PASSWORD_HASHING_ALGORITHM.get(context.settings);
3326
if (selectedAlgorithm.toLowerCase(Locale.ROOT).startsWith("pbkdf2") == false) {
3427
return BootstrapCheckResult.failure("Only PBKDF2 is allowed for password hashing in a FIPS-140 JVM. Please set the " +

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -309,9 +309,9 @@ public Security(Settings settings, final Path configPath) {
309309
new PkiRealmBootstrapCheck(getSslService()),
310310
new TLSLicenseBootstrapCheck(),
311311
new FIPS140SecureSettingsBootstrapCheck(settings, env),
312-
new FIPS140JKSKeystoreBootstrapCheck(settings),
313-
new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings),
314-
new FIPS140LicenseBootstrapCheck(XPackSettings.FIPS_MODE_ENABLED.get(settings))));
312+
new FIPS140JKSKeystoreBootstrapCheck(),
313+
new FIPS140PasswordHashingAlgorithmBootstrapCheck(),
314+
new FIPS140LicenseBootstrapCheck()));
315315
checks.addAll(InternalRealms.getBootstrapChecks(settings, env));
316316
this.bootstrapChecks = Collections.unmodifiableList(checks);
317317
Automatons.updateMaxDeterminizedStates(settings);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/FIPS140JKSKeystoreBootstrapCheckTests.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,53 +14,53 @@ public class FIPS140JKSKeystoreBootstrapCheckTests extends ESTestCase {
1414
public void testNoKeystoreIsAllowed() {
1515
final Settings.Builder settings = Settings.builder()
1616
.put("xpack.security.fips_mode.enabled", "true");
17-
assertFalse(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
17+
assertFalse(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
1818
}
1919

2020
public void testSSLKeystoreTypeIsNotAllowed() {
2121
final Settings.Builder settings = Settings.builder()
2222
.put("xpack.security.fips_mode.enabled", "true")
2323
.put("xpack.ssl.keystore.path", "/this/is/the/path")
2424
.put("xpack.ssl.keystore.type", "JKS");
25-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
25+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
2626
}
2727

2828
public void testSSLImplicitKeystoreTypeIsNotAllowed() {
2929
final Settings.Builder settings = Settings.builder()
3030
.put("xpack.security.fips_mode.enabled", "true")
3131
.put("xpack.ssl.keystore.path", "/this/is/the/path")
3232
.put("xpack.ssl.keystore.type", "JKS");
33-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
33+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
3434
}
3535

3636
public void testTransportSSLKeystoreTypeIsNotAllowed() {
3737
final Settings.Builder settings = Settings.builder()
3838
.put("xpack.security.fips_mode.enabled", "true")
3939
.put("xpack.security.transport.ssl.keystore.path", "/this/is/the/path")
4040
.put("xpack.security.transport.ssl.keystore.type", "JKS");
41-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
41+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
4242
}
4343

4444
public void testHttpSSLKeystoreTypeIsNotAllowed() {
4545
final Settings.Builder settings = Settings.builder()
4646
.put("xpack.security.fips_mode.enabled", "true")
4747
.put("xpack.security.http.ssl.keystore.path", "/this/is/the/path")
4848
.put("xpack.security.http.ssl.keystore.type", "JKS");
49-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
49+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
5050
}
5151

5252
public void testRealmKeystoreTypeIsNotAllowed() {
5353
final Settings.Builder settings = Settings.builder()
5454
.put("xpack.security.fips_mode.enabled", "true")
5555
.put("xpack.security.authc.realms.ldap.ssl.keystore.path", "/this/is/the/path")
5656
.put("xpack.security.authc.realms.ldap.ssl.keystore.type", "JKS");
57-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
57+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
5858
}
5959

6060
public void testImplicitRealmKeystoreTypeIsNotAllowed() {
6161
final Settings.Builder settings = Settings.builder()
6262
.put("xpack.security.fips_mode.enabled", "true")
6363
.put("xpack.security.authc.realms.ldap.ssl.keystore.path", "/this/is/the/path");
64-
assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
64+
assertTrue(new FIPS140JKSKeystoreBootstrapCheck().check(new BootstrapContext(settings.build(), null)).isFailure());
6565
}
6666
}

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/FIPS140LicenseBootstrapCheckTests.java

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,29 @@
1717
public class FIPS140LicenseBootstrapCheckTests extends ESTestCase {
1818

1919
public void testBootstrapCheck() throws Exception {
20-
assertTrue(new FIPS140LicenseBootstrapCheck(false)
21-
.check(new BootstrapContext(Settings.EMPTY, MetaData.EMPTY_META_DATA)).isSuccess());
22-
assertTrue(new FIPS140LicenseBootstrapCheck(randomBoolean())
20+
assertTrue(new FIPS140LicenseBootstrapCheck()
2321
.check(new BootstrapContext(Settings.EMPTY, MetaData.EMPTY_META_DATA)).isSuccess());
22+
assertTrue(new FIPS140LicenseBootstrapCheck()
23+
.check(new BootstrapContext(Settings.builder().put("xpack.security.fips_mode.enabled", randomBoolean()).build(), MetaData
24+
.EMPTY_META_DATA)).isSuccess());
2425

25-
License license = TestUtils.generateSignedLicense(TimeValue.timeValueHours(24));
2626
MetaData.Builder builder = MetaData.builder();
27+
License license = TestUtils.generateSignedLicense(TimeValue.timeValueHours(24));
2728
TestUtils.putLicense(builder, license);
2829
MetaData metaData = builder.build();
30+
2931
if (FIPS140LicenseBootstrapCheck.ALLOWED_LICENSE_OPERATION_MODES.contains(license.operationMode())) {
30-
assertTrue(new FIPS140LicenseBootstrapCheck(true).check(new BootstrapContext(
32+
assertTrue(new FIPS140LicenseBootstrapCheck().check(new BootstrapContext(
3133
Settings.builder().put("xpack.security.fips_mode.enabled", true).build(), metaData)).isSuccess());
32-
assertTrue(new FIPS140LicenseBootstrapCheck(false).check(new BootstrapContext(
34+
assertTrue(new FIPS140LicenseBootstrapCheck().check(new BootstrapContext(
3335
Settings.builder().put("xpack.security.fips_mode.enabled", false).build(), metaData)).isSuccess());
3436
} else {
35-
assertTrue(new FIPS140LicenseBootstrapCheck(false).check(new BootstrapContext(
37+
assertTrue(new FIPS140LicenseBootstrapCheck().check(new BootstrapContext(
3638
Settings.builder().put("xpack.security.fips_mode.enabled", false).build(), metaData)).isSuccess());
37-
assertTrue(new FIPS140LicenseBootstrapCheck(true).check(new BootstrapContext(
39+
assertTrue(new FIPS140LicenseBootstrapCheck().check(new BootstrapContext(
3840
Settings.builder().put("xpack.security.fips_mode.enabled", true).build(), metaData)).isFailure());
3941
assertEquals("FIPS mode is only allowed with a Platinum or Trial license",
40-
new FIPS140LicenseBootstrapCheck(true).check(new BootstrapContext(
42+
new FIPS140LicenseBootstrapCheck().check(new BootstrapContext(
4143
Settings.builder().put("xpack.security.fips_mode.enabled", true).build(), metaData)).getMessage());
4244
}
4345
}

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheckTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public void testPBKDF2AlgorithmIsAllowed() {
2525
.put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2_10000")
2626
.build();
2727
final BootstrapCheck.BootstrapCheckResult result =
28-
new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
28+
new FIPS140PasswordHashingAlgorithmBootstrapCheck().check(new BootstrapContext(settings, null));
2929
assertFalse(result.isFailure());
3030
}
3131

@@ -35,7 +35,7 @@ public void testPBKDF2AlgorithmIsAllowed() {
3535
.put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2")
3636
.build();
3737
final BootstrapCheck.BootstrapCheckResult result =
38-
new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
38+
new FIPS140PasswordHashingAlgorithmBootstrapCheck().check(new BootstrapContext(settings, null));
3939
assertFalse(result.isFailure());
4040
}
4141
}
@@ -55,7 +55,7 @@ private void runBCRYPTTest(final boolean fipsModeEnabled, final String passwordH
5555
}
5656
final Settings settings = builder.build();
5757
final BootstrapCheck.BootstrapCheckResult result =
58-
new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
58+
new FIPS140PasswordHashingAlgorithmBootstrapCheck().check(new BootstrapContext(settings, null));
5959
assertThat(result.isFailure(), equalTo(fipsModeEnabled));
6060
}
6161

0 commit comments

Comments
 (0)