Skip to content

Commit 34aede6

Browse files
tvernumtvernum
authored
Deprecate implicit security on trial licenses (#38295)
In 6.x security is implicitly enabled on a trial license if transport SSL is enabled, or the trial is from pre-6.3. This is no longer true on 7.0, so this behaviour is now deprecated. Relates: #38009, #38075
1 parent ca21cb2 commit 34aede6

File tree

5 files changed

+87
-7
lines changed

5 files changed

+87
-7
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/license/XPackLicenseState.java

Lines changed: 38 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@
66
package org.elasticsearch.license;
77

88
import org.apache.logging.log4j.LogManager;
9+
import org.apache.logging.log4j.Logger;
910
import org.elasticsearch.Version;
1011
import org.elasticsearch.common.Nullable;
1112
import org.elasticsearch.common.Strings;
13+
import org.elasticsearch.common.logging.DeprecationLogger;
1214
import org.elasticsearch.common.logging.LoggerMessageFormat;
1315
import org.elasticsearch.common.settings.Settings;
1416
import org.elasticsearch.license.License.OperationMode;
@@ -266,30 +268,56 @@ private static class Status {
266268
}
267269
}
268270

271+
private final Logger logger;
272+
private final DeprecationLogger deprecationLogger;
269273
private final List<LicenseStateListener> listeners;
274+
270275
private final boolean isSecurityEnabled;
271276
private final boolean isSecurityExplicitlyEnabled;
272277

273278
private Status status = new Status(OperationMode.TRIAL, true);
274279
private boolean isSecurityEnabledByTrialVersion;
275280

276281
public XPackLicenseState(Settings settings) {
282+
this.logger = LogManager.getLogger(getClass());
283+
this.deprecationLogger = new DeprecationLogger(logger);
277284
this.listeners = new CopyOnWriteArrayList<>();
278285
this.isSecurityEnabled = XPackSettings.SECURITY_ENABLED.get(settings);
279-
// 6.0+ requires TLS for production licenses, so if TLS is enabled and security is enabled
280-
// we can interpret this as an explicit enabling of security if the security enabled
281-
// setting is not explicitly set
282-
this.isSecurityExplicitlyEnabled = isSecurityEnabled &&
283-
(settings.hasValue(XPackSettings.SECURITY_ENABLED.getKey()) || XPackSettings.TRANSPORT_SSL_ENABLED.get(settings));
286+
this.isSecurityExplicitlyEnabled = checkSecurityExplicitlyEnabled(settings);
284287
this.isSecurityEnabledByTrialVersion = false;
285288
}
286289

290+
/**
291+
* 6.0+ requires TLS for production licenses, so if TLS is enabled and security is enabled
292+
* we can interpret this as an explicit enabling of security if the security enabled
293+
* setting is not explicitly set.
294+
* This behaviour is deprecated, and will be removed in 7.0
295+
*/
296+
private boolean checkSecurityExplicitlyEnabled(Settings settings) {
297+
if (isSecurityEnabled) {
298+
if (settings.hasValue(XPackSettings.SECURITY_ENABLED.getKey())) {
299+
return true;
300+
}
301+
if (XPackSettings.TRANSPORT_SSL_ENABLED.get(settings)) {
302+
deprecationLogger.deprecated("Automatically enabling security because [{}] is true. " +
303+
"This behaviour will be removed in a future version of Elasticsearch. " +
304+
"Please set [{}] to true",
305+
XPackSettings.TRANSPORT_SSL_ENABLED.getKey(),
306+
XPackSettings.SECURITY_ENABLED.getKey());
307+
return true;
308+
}
309+
}
310+
return false;
311+
}
312+
287313
private XPackLicenseState(XPackLicenseState xPackLicenseState) {
288314
this.listeners = xPackLicenseState.listeners;
289315
this.isSecurityEnabled = xPackLicenseState.isSecurityEnabled;
290316
this.isSecurityExplicitlyEnabled = xPackLicenseState.isSecurityExplicitlyEnabled;
291317
this.status = xPackLicenseState.status;
292318
this.isSecurityEnabledByTrialVersion = xPackLicenseState.isSecurityEnabledByTrialVersion;
319+
this.logger = xPackLicenseState.logger;
320+
this.deprecationLogger = xPackLicenseState.deprecationLogger;
293321
}
294322

295323
/**
@@ -309,8 +337,12 @@ void update(OperationMode mode, boolean active, @Nullable Version mostRecentTria
309337
// Before 6.3, Trial licenses would default having security enabled.
310338
// If this license was generated before that version, then treat it as if security is explicitly enabled
311339
if (mostRecentTrialVersion == null || mostRecentTrialVersion.before(Version.V_6_3_0)) {
312-
LogManager.getLogger(getClass()).info("Automatically enabling security for older trial license ({})",
340+
logger.info("Automatically enabling security for older trial license ({})",
313341
mostRecentTrialVersion == null ? "[pre 6.1.0]" : mostRecentTrialVersion.toString());
342+
deprecationLogger.deprecated(
343+
"Automatically enabling security because the current trial license was generated before 6.3.0. " +
344+
"This behaviour will be removed in a future version of Elasticsearch. " +
345+
"Please set [{}] to true", XPackSettings.SECURITY_ENABLED.getKey());
314346
isSecurityEnabledByTrialVersion = true;
315347
}
316348
}

‎x-pack/plugin/core/src/test/java/org/elasticsearch/license/XPackLicenseStateTests.java

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ public class XPackLicenseStateTests extends ESTestCase {
3333
/** Creates a license state with the given license type and active state, and checks the given method returns expected. */
3434
void assertAllowed(OperationMode mode, boolean active, Predicate<XPackLicenseState> predicate, boolean expected) {
3535
XPackLicenseState licenseState = new XPackLicenseState(Settings.EMPTY);
36-
licenseState.update(mode, active, null);
36+
licenseState.update(mode, active, Version.CURRENT);
3737
assertEquals(expected, predicate.test(licenseState));
3838
}
3939

@@ -91,6 +91,9 @@ public void testSecurityDefaults() {
9191
assertThat(licenseState.allowedRealmType(), is(XPackLicenseState.AllowedRealmType.ALL));
9292
assertThat(licenseState.isCustomRoleProvidersAllowed(), is(true));
9393

94+
assertWarnings("Automatically enabling security because [xpack.security.transport.ssl.enabled] is true." +
95+
" This behaviour will be removed in a future version of Elasticsearch. Please set [xpack.security.enabled] to true");
96+
9497
licenseState = new XPackLicenseState(Settings.EMPTY);
9598
assertThat(licenseState.isAuthAllowed(), is(false));
9699
assertThat(licenseState.isIpFilteringAllowed(), is(false));
@@ -239,6 +242,9 @@ public void testOldTrialDefaultsSecurityOn() {
239242
assertThat(licenseState.isDocumentAndFieldLevelSecurityAllowed(), is(true));
240243
assertThat(licenseState.allowedRealmType(), is(XPackLicenseState.AllowedRealmType.ALL));
241244
assertThat(licenseState.isCustomRoleProvidersAllowed(), is(true));
245+
246+
assertWarnings("Automatically enabling security because the current trial license was generated before 6.3.0." +
247+
" This behaviour will be removed in a future version of Elasticsearch. Please set [xpack.security.enabled] to true");
242248
}
243249

244250
public void testSecurityAckBasicToNotGoldOrStandard() {

‎x-pack/plugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/DeprecationChecks.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ private DeprecationChecks() {
5252
NodeDeprecationChecks::gcsRepositoryChanges,
5353
NodeDeprecationChecks::fileDiscoveryPluginRemoved,
5454
NodeDeprecationChecks::defaultSSLSettingsRemoved,
55+
NodeDeprecationChecks::transportSslEnabledWithoutSecurityEnabled,
5556
NodeDeprecationChecks::watcherNotificationsSecureSettingsCheck,
5657
NodeDeprecationChecks::auditIndexSettingsCheck
5758
));

‎x-pack/plugin/deprecation/src/main/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecks.java

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
import static org.elasticsearch.discovery.DiscoveryModule.DISCOVERY_HOSTS_PROVIDER_SETTING;
1616
import static org.elasticsearch.discovery.DiscoveryModule.DISCOVERY_TYPE_SETTING;
1717
import static org.elasticsearch.discovery.zen.SettingsBasedHostsProvider.DISCOVERY_ZEN_PING_UNICAST_HOSTS_SETTING;
18+
import static org.elasticsearch.xpack.core.XPackSettings.SECURITY_ENABLED;
19+
import static org.elasticsearch.xpack.core.XPackSettings.TRANSPORT_SSL_ENABLED;
1820

1921
/**
2022
* Node-specific deprecation checks
@@ -189,4 +191,17 @@ static DeprecationIssue defaultSSLSettingsRemoved(Settings nodeSettings, Plugins
189191
}
190192
return null;
191193
}
194+
195+
static DeprecationIssue transportSslEnabledWithoutSecurityEnabled(Settings nodeSettings, PluginsAndModules plugins) {
196+
if (TRANSPORT_SSL_ENABLED.get(nodeSettings) && nodeSettings.hasValue(SECURITY_ENABLED.getKey()) == false) {
197+
return new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
198+
"TLS/SSL in use, but security not explicitly enabled",
199+
"https://www.elastic.co/guide/en/elasticsearch/reference/master/breaking-changes-7.0.html" +
200+
"#trial-explicit-security",
201+
"security should be explicitly enabled (with [" + SECURITY_ENABLED.getKey() +
202+
"]), it will no longer be automatically enabled when transport SSL is enabled ([" +
203+
TRANSPORT_SSL_ENABLED.getKey() + "])");
204+
}
205+
return null;
206+
}
192207
}

‎x-pack/plugin/deprecation/src/test/java/org/elasticsearch/xpack/deprecation/NodeDeprecationChecksTests.java

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import org.elasticsearch.test.ESTestCase;
2121
import org.elasticsearch.test.VersionUtils;
2222
import org.elasticsearch.xpack.core.deprecation.DeprecationIssue;
23+
import org.hamcrest.Matchers;
2324
import org.junit.Before;
2425

2526
import java.util.Collections;
@@ -65,6 +66,17 @@ null, null, null, null, new FsInfo(0L, null, paths), null, null, null,
6566
assertEquals(singletonList(expected), issues);
6667
}
6768

69+
private void assertNoIssue(Settings settings) {
70+
Settings nodeSettings = Settings.builder()
71+
.put(settings)
72+
.put(CLUSTER_NAME_SETTING.getKey(), "elasticsearch")
73+
.put(NODE_NAME_SETTING.getKey(), "node_check")
74+
.put(DISCOVERY_TYPE_SETTING.getKey(), "single-node") // Needed due to NodeDeprecationChecks#discoveryConfigurationCheck
75+
.build();
76+
List<DeprecationIssue> issues = DeprecationChecks.filterChecks(NODE_SETTINGS_CHECKS, c -> c.apply(nodeSettings, pluginsAndModules));
77+
assertThat(issues, Matchers.empty());
78+
}
79+
6880
public void testHttpEnabledCheck() {
6981
DeprecationIssue expected = new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
7082
"HTTP Enabled setting removed",
@@ -303,4 +315,18 @@ public void testDefaultSSLSettingsCheck() {
303315
assertSettingsAndIssue("xpack.ssl.certificate_authorities",
304316
Strings.arrayToCommaDelimitedString(randomArray(1, 4, String[]::new, () -> randomAlphaOfLengthBetween(4, 16))), expected);
305317
}
318+
319+
public void testTransportSslEnabledWithoutSecurityEnabled() {
320+
DeprecationIssue expected = new DeprecationIssue(DeprecationIssue.Level.CRITICAL,
321+
"TLS/SSL in use, but security not explicitly enabled",
322+
"https://www.elastic.co/guide/en/elasticsearch/reference/master/breaking-changes-7.0.html" +
323+
"#trial-explicit-security",
324+
"security should be explicitly enabled (with [xpack.security.enabled])," +
325+
" it will no longer be automatically enabled when transport SSL is enabled ([xpack.security.transport.ssl.enabled])");
326+
assertSettingsAndIssue("xpack.security.transport.ssl.enabled", "true", expected);
327+
assertNoIssue(Settings.builder()
328+
.put("xpack.security.enabled", randomBoolean())
329+
.put("xpack.security.transport.ssl.enabled", randomBoolean())
330+
.build());
331+
}
306332
}

0 commit comments

Comments
 (0)