Encrypted blob store repository - take I (#46170)

POC with GCM from BC

plugins/repository-azure/src/main/java/org/elasticsearch/repositories/azure/AzureRepository.java

@@ -124,7 +124,7 @@ protected AzureBlobStore createBlobStore() {
     }
 
     @Override
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return chunkSize;
     }
 

plugins/repository-gcs/src/main/java/org/elasticsearch/repositories/gcs/GoogleCloudStorageRepository.java

@@ -94,7 +94,7 @@ protected GoogleCloudStorageBlobStore createBlobStore() {
     }
 
     @Override
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return chunkSize;
     }
 

plugins/repository-hdfs/src/main/java/org/elasticsearch/repositories/hdfs/HdfsRepository.java

@@ -233,7 +233,7 @@ protected HdfsBlobStore createBlobStore() {
     }
 
     @Override
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return chunkSize;
     }
 }

plugins/repository-s3/src/main/java/org/elasticsearch/repositories/s3/S3Repository.java

@@ -207,7 +207,7 @@ protected BlobStore getBlobStore() {
     }
 
     @Override
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return chunkSize;
     }
 }

server/src/main/java/org/elasticsearch/repositories/blobstore/BlobStoreRepository.java

@@ -180,6 +180,8 @@ public abstract class BlobStoreRepository extends AbstractLifecycleComponent imp
 
     protected final ChecksumBlobStoreFormat<SnapshotInfo> snapshotFormat;
 
+    private final NamedXContentRegistry namedXContentRegistry;
+
     private final boolean readOnly;
 
     private final ChecksumBlobStoreFormat<BlobStoreIndexShardSnapshot> indexShardSnapshotFormat;
@@ -194,6 +196,10 @@ public abstract class BlobStoreRepository extends AbstractLifecycleComponent imp
 
     private final BlobPath basePath;
 
+    protected BlobStoreRepository(BlobStoreRepository other) {
+        this(other.metadata, other.namedXContentRegistry, other.threadPool, other.basePath);
+    }
+
     /**
      * Constructs new BlobStoreRepository
      * @param metadata   The metadata for this repository including name and settings
@@ -211,6 +217,7 @@ protected BlobStoreRepository(
         restoreRateLimiter = getRateLimiter(metadata.settings(), "max_restore_bytes_per_sec", new ByteSizeValue(40, ByteSizeUnit.MB));
         readOnly = metadata.settings().getAsBoolean("readonly", false);
         this.basePath = basePath;
+        this.namedXContentRegistry = namedXContentRegistry;
 
         indexShardSnapshotFormat = new ChecksumBlobStoreFormat<>(SNAPSHOT_CODEC, SNAPSHOT_NAME_FORMAT,
             BlobStoreIndexShardSnapshot::fromXContent, namedXContentRegistry, compress);
@@ -343,7 +350,7 @@ protected final boolean isCompress() {
      *
      * @return chunk size
      */
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return null;
     }
 

server/src/main/java/org/elasticsearch/repositories/fs/FsRepository.java

@@ -109,7 +109,7 @@ protected BlobStore createBlobStore() throws Exception {
     }
 
     @Override
-    protected ByteSizeValue chunkSize() {
+    public ByteSizeValue chunkSize() {
         return chunkSize;
     }
 }

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackPlugin.java

@@ -76,7 +76,6 @@
 import java.time.Clock;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -313,7 +312,7 @@ public static Path resolveConfigFile(Environment env, String name) {
     @Override
     public Map<String, Repository.Factory> getRepositories(Environment env, NamedXContentRegistry namedXContentRegistry,
                                                            ThreadPool threadPool) {
-        return Collections.singletonMap("source", SourceOnlySnapshotRepository.newRepositoryFactory());
+        return Map.of("source", SourceOnlySnapshotRepository.newRepositoryFactory());
     }
 
     @Override

x-pack/plugin/repository-encrypted/build.gradle

@@ -0,0 +1,16 @@
+evaluationDependsOn(xpackModule('core'))
+
+apply plugin: 'elasticsearch.esplugin'
+esplugin {
+    name 'repository-encrypted'
+    description 'Elasticsearch Expanded Pack Plugin - client-side encrypted repositories.'
+    classname 'org.elasticsearch.repositories.encrypted.EncryptedRepositoryPlugin'
+    extendedPlugins = ['x-pack-core']
+}
+
+dependencies {
+  compile "org.bouncycastle:bc-fips:1.0.1"
+  compile "org.bouncycastle:bcpkix-fips:1.0.3"
+}
+
+integTest.enabled = false

x-pack/plugin/repository-encrypted/licenses/bc-fips-1.0.1.jar.sha1

@@ -0,0 +1 @@
+ed8dd3144761eaa33b9c56f5e2bef85f1b731d6f

x-pack/plugin/repository-encrypted/licenses/bc-fips-LICENSE.txt

@@ -0,0 +1,12 @@
+Copyright (c) 2000 - 2019 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

x-pack/plugin/repository-encrypted/licenses/bcpkix-fips-1.0.3.jar.sha1

@@ -0,0 +1 @@
+33c47b105777c9dcc8a08188186bd35401366bd1

x-pack/plugin/repository-encrypted/licenses/bcpkix-fips-LICENSE.txt

@@ -0,0 +1,12 @@
+Copyright (c) 2000 - 2019 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.