Merge branch 'master' into security-app-privs

Author: tvernum

.ci/matrix-build-javas.yml

@@ -7,3 +7,4 @@
 
 ES_BUILD_JAVA:
   - java10
+  - java11

.ci/matrix-runtime-javas.yml

@@ -8,3 +8,4 @@
 ES_RUNTIME_JAVA:
   - java8
   - java10
+  - java11

buildSrc/src/main/resources/forbidden/jdk-signatures.txt

@@ -88,7 +88,8 @@ java.lang.Thread#getAllStackTraces()
 
 @defaultMessage Stopping threads explicitly leads to inconsistent states. Use interrupt() instead.
 java.lang.Thread#stop()
-java.lang.Thread#stop(java.lang.Throwable)
+# uncomment when https://github.com/elastic/elasticsearch/issues/31715 is fixed
+# java.lang.Thread#stop(java.lang.Throwable)
 
 @defaultMessage Please do not terminate the application
 java.lang.System#exit(int)

distribution/bwc/build.gradle

@@ -18,12 +18,14 @@
  */
 
 
+
 import org.apache.tools.ant.taskdefs.condition.Os
 import org.elasticsearch.gradle.LoggedExec
 import org.elasticsearch.gradle.Version
 
-import static org.elasticsearch.gradle.BuildPlugin.getJavaHome
+import java.nio.charset.StandardCharsets
 
+import static org.elasticsearch.gradle.BuildPlugin.getJavaHome
 /**
  * This is a dummy project which does a local checkout of the previous
  * wire compat version's branch, and builds a snapshot. This allows backcompat
@@ -147,12 +149,16 @@ subprojects {
 
   task buildBwcVersion(type: Exec) {
     dependsOn checkoutBwcBranch, writeBuildMetadata
+    // send RUNTIME_JAVA_HOME so the build doesn't fails on newer version the branch doesn't know about
+    environment('RUNTIME_JAVA_HOME', getJavaHome(it, rootProject.ext.minimumRuntimeVersion.getMajorVersion() as int))
     workingDir = checkoutDir
+    // we are building branches that are officially built with JDK 8, push JAVA8_HOME to JAVA_HOME for these builds
     if (["5.6", "6.0", "6.1"].contains(bwcBranch)) {
-      // we are building branches that are officially built with JDK 8, push JAVA8_HOME to JAVA_HOME for these builds
       environment('JAVA_HOME', getJavaHome(it, 8))
     } else if ("6.2".equals(bwcBranch)) {
       environment('JAVA_HOME', getJavaHome(it, 9))
+    } else if (["6.3", "6.x"].contains(bwcBranch)) {
+      environment('JAVA_HOME', getJavaHome(it, 10))
     } else {
       environment('JAVA_HOME', project.compilerJavaHome)
     }
@@ -177,6 +183,8 @@ subprojects {
     } else if (showStacktraceName.equals("ALWAYS_FULL")) {
       args "--full-stacktrace"
     }
+    standardOutput = new IndentingOutputStream(System.out)
+    errorOutput = new IndentingOutputStream(System.err)
     doLast {
       List missing = artifactFiles.grep { file ->
         false == file.exists()
@@ -196,3 +204,27 @@ subprojects {
     }
   }
 }
+
+class IndentingOutputStream extends OutputStream {
+
+  public static final byte[] INDENT = "  [bwc] ".getBytes(StandardCharsets.UTF_8)
+  private final OutputStream delegate
+
+  public IndentingOutputStream(OutputStream delegate) {
+      this.delegate = delegate
+  }
+
+  @Override
+  public void write(int b) {
+    write([b] as int[], 0, 1)
+  }
+
+  public void write(int[] bytes, int offset, int length) {
+    for (int i = 0; i < bytes.length; i++) {
+      delegate.write(bytes[i])
+      if (bytes[i] == '\n') {
+        delegate.write(INDENT)
+      }
+    }
+  }
+}

docs/build.gradle

@@ -39,6 +39,15 @@ integTestCluster {
   setting 'reindex.remote.whitelist', '127.0.0.1:*'
 }
 
+// remove when https://github.com/elastic/elasticsearch/issues/31305 is fixed
+if (rootProject.ext.compilerJavaVersion.isJava11()) {
+  integTestRunner {
+    systemProperty 'tests.rest.blacklist', [
+            'plugins/ingest-attachment/line_164',
+            'plugins/ingest-attachment/line_117'
+    ].join(',')
+  }
+}
 // Build the cluster with all plugins
 
 project.rootProject.subprojects.findAll { it.parent.path == ':plugins' }.each { subproj ->

docs/reference/search/request/rescore.asciidoc

@@ -29,8 +29,7 @@ The query rescorer executes a second query only on the Top-K results
 returned by the <<search-request-query,`query`>> and
 <<search-request-post-filter,`post_filter`>> phases. The
 number of docs which will be examined on each shard can be controlled by
-the `window_size` parameter, which defaults to
-<<search-request-from-size,`from` and `size`>>.
+the `window_size` parameter, which defaults to 10.
 
 By default the scores from the original query and the rescore query are
 combined linearly to produce the final `_score` for each document. The

modules/lang-painless/src/test/java/org/elasticsearch/painless/ArrayTests.java

@@ -20,6 +20,7 @@
 package org.elasticsearch.painless;
 
 import org.apache.lucene.util.Constants;
+import org.elasticsearch.bootstrap.JavaVersion;
 import org.hamcrest.Matcher;
 
 import java.lang.invoke.MethodHandle;
@@ -41,7 +42,11 @@ protected String valueCtorCall(String valueType, int size) {
 
     @Override
     protected Matcher<String> outOfBoundsExceptionMessageMatcher(int index, int size) {
-        return equalTo(Integer.toString(index));
+        if (JavaVersion.current().compareTo(JavaVersion.parse("11")) < 0) {
+            return equalTo(Integer.toString(index));
+        } else{
+            return equalTo("Index " + Integer.toString(index) + " out of bounds for length " + Integer.toString(size));
+        }
     }
 
     public void testArrayLengthHelper() throws Throwable {

modules/transport-netty4/src/test/java/org/elasticsearch/transport/netty4/Netty4ScheduledPingTests.java

@@ -89,7 +89,7 @@ public void testScheduledPing() throws Exception {
         assertThat(nettyA.getPing().getFailedPings(), equalTo(0L));
         assertThat(nettyB.getPing().getFailedPings(), equalTo(0L));
 
-        serviceA.registerRequestHandler("sayHello", TransportRequest.Empty::new, ThreadPool.Names.GENERIC,
+        serviceA.registerRequestHandler("internal:sayHello", TransportRequest.Empty::new, ThreadPool.Names.GENERIC,
             new TransportRequestHandler<TransportRequest.Empty>() {
                 @Override
                 public void messageReceived(TransportRequest.Empty request, TransportChannel channel, Task task) {
@@ -104,7 +104,7 @@ public void messageReceived(TransportRequest.Empty request, TransportChannel cha
 
         int rounds = scaledRandomIntBetween(100, 5000);
         for (int i = 0; i < rounds; i++) {
-            serviceB.submitRequest(nodeA, "sayHello",
+            serviceB.submitRequest(nodeA, "internal:sayHello",
                 TransportRequest.Empty.INSTANCE, TransportRequestOptions.builder().withCompress(randomBoolean()).build(),
                 new TransportResponseHandler<TransportResponse.Empty>() {
                     @Override

plugins/ingest-attachment/build.gradle

@@ -25,11 +25,21 @@ esplugin {
 versions << [
   'tika': '1.18',
   'pdfbox': '2.0.9',
-  'bouncycastle': '1.55',
+  'bouncycastle': '1.59',
   'poi': '3.17',
   'mime4j': '0.8.1'
 ]
 
+if (rootProject.ext.compilerJavaVersion.isJava11()) {
+  // disabled until https://github.com/elastic/elasticsearch/issues/31456 is fixed.
+  integTestRunner {
+    systemProperty 'tests.rest.blacklist', [
+            'ingest_attachment/20_attachment_processor/Test indexed chars are configurable',
+            'ingest_attachment/20_attachment_processor/Test indexed chars are configurable per document'
+    ].join(',')
+  }
+}
+
 dependencies {
   // mandatory for tika
   compile "org.apache.tika:tika-core:${versions.tika}"

plugins/ingest-attachment/licenses/bcmail-jdk15on-1.55.jar.sha1

@@ -0,0 +1 @@
+db389ade95f48592908a84e7050a691c8834723c

plugins/ingest-attachment/licenses/bcmail-jdk15on-1.59.jar.sha1

@@ -0,0 +1 @@
+9cef0aab8a4bb849a8476c058ce3ff302aba3fff

plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.55.jar.sha1

@@ -0,0 +1 @@
+2507204241ab450456bdb8e8c0a8f986e418bd99

plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.59.jar.sha1

@@ -164,12 +164,11 @@ static PermissionCollection getRestrictedPermissions() {
         perms.add(new RuntimePermission("getClassLoader"));
         // ZipFile needs accessDeclaredMembers on JDK 10; cf. https://bugs.openjdk.java.net/browse/JDK-8187485
         if (JavaVersion.current().compareTo(JavaVersion.parse("10")) >= 0) {
-            /*
-             * See if this permission can be removed in JDK 11, bump the version here to 12 if not. If this permission can be removed, also
-             * remove the grant in the plugin-security.policy.
-             */
-            assert JavaVersion.current().compareTo(JavaVersion.parse("11")) < 0;
-            perms.add(new RuntimePermission("accessDeclaredMembers"));
+            if (JavaVersion.current().compareTo(JavaVersion.parse("11")) < 0) {
+                // TODO remove this and from plugin-security.policy when JDK 11 is the only one we support
+                // this is needed pre 11, but it's fixed in 11 : https://bugs.openjdk.java.net/browse/JDK-8187485
+                perms.add(new RuntimePermission("accessDeclaredMembers"));
+            }
         }
         perms.setReadOnly();
         return perms;

plugins/ingest-attachment/licenses/bcprov-jdk15on-1.55.jar.sha1

@@ -21,6 +21,7 @@
 
 import org.apache.commons.io.IOUtils;
 import org.elasticsearch.ElasticsearchParseException;
+import org.elasticsearch.bootstrap.JavaVersion;
 import org.elasticsearch.ingest.IngestDocument;
 import org.elasticsearch.ingest.Processor;
 import org.elasticsearch.ingest.RandomDocumentPicks;
@@ -296,6 +297,7 @@ private Map<String, Object> parseDocument(String file, AttachmentProcessor proce
     }
 
     public void testIndexedChars() throws Exception {
+        assumeFalse("https://github.com/elastic/elasticsearch/issues/31305", JavaVersion.current().equals(JavaVersion.parse("11")));
         processor = new AttachmentProcessor(randomAlphaOfLength(10), "source_field",
             "target_field", EnumSet.allOf(AttachmentProcessor.Property.class), 19, false, null);
 

plugins/ingest-attachment/licenses/bcprov-jdk15on-1.59.jar.sha1

@@ -1,4 +1,4 @@
-/*
+1/*
  * Licensed to Elasticsearch under one or more contributor
  * license agreements. See the NOTICE file distributed with
  * this work for additional information regarding copyright
@@ -214,6 +214,25 @@ RestIntegTestTask integTestSecureHa = project.tasks.create('integTestSecureHa',
   description = "Runs rest tests against an elasticsearch cluster with HDFS configured with HA Namenode and secured by MIT Kerberos."
 }
 
+if (rootProject.ext.compilerJavaVersion.isJava11()) {
+  // TODO remove when: https://github.com/elastic/elasticsearch/issues/31498
+  integTestRunner {
+    systemProperty 'tests.rest.blacklist', [
+            'hdfs_repository/30_snapshot/take snapshot',
+            'hdfs_repository/40_restore/Create a snapshot and then restore it',
+            'hdfs_repository/20_repository_verify/HDFS Repository Verify',
+            'hdfs_repository/30_snapshot_get/Get a snapshot',
+            'hdfs_repository/20_repository_create/HDFS Repository Creation',
+            'hdfs_repository/20_repository_delete/HDFS Delete Repository',
+            'hdfs_repository/30_snapshot_readonly/Get a snapshot - readonly',
+    ].join(',')
+  }
+}
+if (rootProject.ext.runtimeJavaVersion.isJava11()) {
+  // TODO remove when: https://github.com/elastic/elasticsearch/issues/31498
+  integTestHa.enabled = false
+}
+
 // Determine HDFS Fixture compatibility for the current build environment.
 boolean fixtureSupported = false
 if (Os.isFamily(Os.FAMILY_WINDOWS)) {

plugins/ingest-attachment/src/main/java/org/elasticsearch/ingest/attachment/TikaImpl.java

@@ -18,15 +18,11 @@
  */
 package org.elasticsearch.repositories.hdfs;
 
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.greaterThan;
-
-import java.util.Collection;
-
 import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;
 import org.elasticsearch.action.admin.cluster.repositories.put.PutRepositoryResponse;
 import org.elasticsearch.action.admin.cluster.snapshots.create.CreateSnapshotResponse;
 import org.elasticsearch.action.admin.cluster.snapshots.restore.RestoreSnapshotResponse;
+import org.elasticsearch.bootstrap.JavaVersion;
 import org.elasticsearch.client.Client;
 import org.elasticsearch.cluster.ClusterState;
 import org.elasticsearch.common.settings.Settings;
@@ -35,6 +31,11 @@
 import org.elasticsearch.snapshots.SnapshotState;
 import org.elasticsearch.test.ESSingleNodeTestCase;
 
+import java.util.Collection;
+
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.greaterThan;
+
 @ThreadLeakFilters(filters = {HdfsClientThreadLeakFilter.class})
 public class HdfsTests extends ESSingleNodeTestCase {
 
@@ -44,6 +45,7 @@ protected Collection<Class<? extends Plugin>> getPlugins() {
     }
 
     public void testSimpleWorkflow() {
+        assumeFalse("https://github.com/elastic/elasticsearch/issues/31498", JavaVersion.current().equals(JavaVersion.parse("11")));
         Client client = client();
 
         PutRepositoryResponse putRepositoryResponse = client.admin().cluster().preparePutRepository("test-repo")