Skip to content

Commit 1861e8a

Browse files
tvernumtvernum
authored
Use same system index pattern in restricted names (#84180)
The index pattern that was used for the ".security" system index was not identical to the pattern used in RestrictedIndices. The consequence was that it would be possible for a user without restricted indices access to create an index that would get caught by the system indices pattern, which could lead to confusion. In 8.0 all system indices are automatically restricted, using the index name pattern from the system index descriptor, so in 7.17 we are changing the restricted index name to cover the same set of names as the system index descriptor
1 parent 01a0dae commit 1861e8a

File tree

4 files changed

+132
-2
lines changed

4 files changed

+132
-2
lines changed

‎docs/changelog/84180.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 84180
2+
summary: Unify index name pattern between security system-index and RBAC restricted names
3+
area: Authorization
4+
type: enhancement
5+
issues: []

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/index/RestrictedIndicesNames.java‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,17 @@
77

88
package org.elasticsearch.xpack.core.security.index;
99

10+
import org.apache.lucene.util.automaton.Automata;
1011
import org.apache.lucene.util.automaton.Automaton;
12+
import org.apache.lucene.util.automaton.Operations;
1113
import org.elasticsearch.common.util.set.Sets;
14+
import org.elasticsearch.core.List;
1215
import org.elasticsearch.xpack.core.security.support.Automatons;
1316

1417
import java.util.Arrays;
1518
import java.util.Collections;
1619
import java.util.Set;
20+
import java.util.function.Predicate;
1721

1822
public final class RestrictedIndicesNames {
1923
public static final String INTERNAL_SECURITY_MAIN_INDEX_6 = ".security-6";
@@ -23,6 +27,17 @@ public final class RestrictedIndicesNames {
2327
public static final String INTERNAL_SECURITY_TOKENS_INDEX_7 = ".security-tokens-7";
2428
public static final String SECURITY_TOKENS_ALIAS = ".security-tokens";
2529

30+
// See o.e.x.security.Security#getSecurityMainIndexDescriptor, o.e.x.security.Security#getSecurityTokensIndexDescriptor
31+
private static final Automaton SECURITY_INDEX_AUTOMATON = Operations.concatenate(
32+
List.of(
33+
Operations.union(Automata.makeString(SECURITY_MAIN_ALIAS), Automata.makeString(SECURITY_TOKENS_ALIAS)),
34+
Automata.makeChar('-'),
35+
Automata.makeCharRange('0', '9'),
36+
Automata.makeAnyString()
37+
)
38+
);
39+
private static final Predicate<String> SECURITY_INDEX_PREDICATE = Automatons.predicate(SECURITY_INDEX_AUTOMATON);
40+
2641
// public for tests
2742
public static final String ASYNC_SEARCH_PREFIX = ".async-search";
2843
private static final Automaton ASYNC_SEARCH_AUTOMATON = Automatons.patterns(ASYNC_SEARCH_PREFIX + "*");
@@ -39,11 +54,13 @@ public final class RestrictedIndicesNames {
3954
);
4055

4156
public static boolean isRestricted(String concreteIndexName) {
42-
return RESTRICTED_NAMES.contains(concreteIndexName) || concreteIndexName.startsWith(ASYNC_SEARCH_PREFIX);
57+
return RESTRICTED_NAMES.contains(concreteIndexName)
58+
|| concreteIndexName.startsWith(ASYNC_SEARCH_PREFIX)
59+
|| SECURITY_INDEX_PREDICATE.test(concreteIndexName);
4360
}
4461

4562
public static final Automaton NAMES_AUTOMATON = Automatons.unionAndMinimize(
46-
Arrays.asList(Automatons.patterns(RESTRICTED_NAMES), ASYNC_SEARCH_AUTOMATON)
63+
Arrays.asList(Automatons.patterns(RESTRICTED_NAMES), ASYNC_SEARCH_AUTOMATON, SECURITY_INDEX_AUTOMATON)
4764
);
4865

4966
private RestrictedIndicesNames() {}

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/index/RestrictedIndicesNamesTests.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
package org.elasticsearch.xpack.core.security.index;
9+
10+
import org.apache.lucene.util.automaton.CharacterRunAutomaton;
11+
import org.elasticsearch.test.ESTestCase;
12+
13+
import static org.hamcrest.CoreMatchers.is;
14+
15+
public class RestrictedIndicesNamesTests extends ESTestCase {
16+
17+
private final CharacterRunAutomaton RUN_AUTOMATON = new CharacterRunAutomaton(RestrictedIndicesNames.NAMES_AUTOMATON);
18+
19+
public void testAsyncSearchNames() {
20+
testIndex(".async-search", true);
21+
testIndex(".async-search" + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 8), true);
22+
testIndex(".async-search" + (randomBoolean() ? "-" : "") + randomInt(), true);
23+
testIndex("async-search" + (randomBoolean() ? "-" : "") + randomInt(), false);
24+
testIndex(".asynchronous-search" + (randomBoolean() ? "-" : "") + randomInt(), false);
25+
testIndex(".not-async-search" + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 8), false);
26+
}
27+
28+
public void testSecurityNames() {
29+
testIndex(".security", true);
30+
testIndex(".security-6", true);
31+
testIndex(".security-7", true);
32+
testIndex(".security-" + randomIntBetween(0, 999_999), true);
33+
testIndex(".security-" + randomIntBetween(0, 99) + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 20), true);
34+
35+
testIndex(".security-tokens-7", true);
36+
testIndex(".security-tokens-" + randomIntBetween(0, 99) + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 20), true);
37+
38+
testIndex("security", false);
39+
testIndex(randomAlphaOfLength(1) + "security", false);
40+
testIndex("security-6", false);
41+
testIndex("@security-6", false);
42+
testIndex(".not-security-7", false);
43+
testIndex(".security-", false);
44+
testIndex("security-tokens", false);
45+
testIndex("security-tokens-7", false);
46+
testIndex("_security-tokens", false);
47+
testIndex(".security-" + randomAlphaOfLengthBetween(1, 3), false);
48+
testIndex(".security-tokens-" + randomAlphaOfLengthBetween(1, 3), false);
49+
testIndex(".security" + randomAlphaOfLengthBetween(1, 10), false);
50+
testIndex(".security-tokens" + randomAlphaOfLengthBetween(1, 10), false);
51+
testIndex(".security" + randomIntBetween(1, 9), false);
52+
testIndex(".security-" + randomAlphaOfLength(1) + randomIntBetween(1, 9), false);
53+
testIndex(".security" + randomAlphaOfLength(1) + randomIntBetween(1, 9), false);
54+
}
55+
56+
private void testIndex(String name, boolean expected) {
57+
assertThat("For index [" + name + "]", RestrictedIndicesNames.isRestricted(name), is(expected));
58+
assertThat("For index [" + name + "]", RUN_AUTOMATON.run(name), is(expected));
59+
}
60+
61+
}

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/SecuritySystemIndexTests.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
package org.elasticsearch.xpack.security;
9+
10+
import org.elasticsearch.test.ESTestCase;
11+
import org.elasticsearch.xpack.core.security.index.RestrictedIndicesNames;
12+
13+
import java.util.function.Consumer;
14+
15+
import static org.hamcrest.Matchers.is;
16+
17+
public class SecuritySystemIndexTests extends ESTestCase {
18+
19+
public void testSystemIndexNameIsRestricted() {
20+
Consumer<String> check = idx -> assertThat(
21+
"For index [" + idx + "]",
22+
Security.SECURITY_MAIN_INDEX_DESCRIPTOR.matchesIndexPattern(idx)
23+
|| Security.SECURITY_TOKEN_INDEX_DESCRIPTOR.matchesIndexPattern(idx),
24+
is(RestrictedIndicesNames.isRestricted(idx))
25+
);
26+
27+
check.accept(".security-" + randomIntBetween(0, 99));
28+
check.accept(".security" + randomIntBetween(0, 99));
29+
30+
check.accept(".security-" + randomAlphaOfLengthBetween(1, 12));
31+
check.accept(".security" + randomAlphaOfLengthBetween(1, 12));
32+
33+
check.accept(".security-" + randomIntBetween(0, 99) + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 12));
34+
check.accept(".security-" + randomAlphaOfLengthBetween(1, 12) + (randomBoolean() ? "-" : "") + randomIntBetween(0, 99));
35+
36+
check.accept(".security-tokens-" + randomAlphaOfLengthBetween(1, 12));
37+
check.accept(".security-tokens-" + randomIntBetween(1, 99));
38+
check.accept(".security-tokens-" + randomIntBetween(1, 99) + (randomBoolean() ? "-" : "") + randomAlphaOfLengthBetween(1, 12));
39+
40+
check.accept("." + randomAlphaOfLengthBetween(1, 12) + "-security");
41+
42+
check.accept(randomAlphaOfLengthBetween(1, 3) + "security");
43+
check.accept(randomAlphaOfLengthBetween(1, 3) + ".security");
44+
check.accept(randomAlphaOfLengthBetween(1, 3) + ".security-6");
45+
check.accept(randomAlphaOfLengthBetween(1, 3) + "security-tokens-7");
46+
}
47+
}

0 commit comments

Comments
 (0)