[Entitlements] Refactor Network Entitlement #120391
Conversation
…network entitlements
ldematte
added
:Core/Infra/Core
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java
Show resolved
Hide resolved
libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java
Show resolved
Hide resolved
| @Override | ||
| public void check$java_net_Socket$bind(Class<?> callerClass, Socket that, SocketAddress endpoint) { | ||
| policyManager.checkNetworkAccess(callerClass, NetworkEntitlement.LISTEN_ACTION); | ||
| policyManager.checkOutboundNetworkAccess(callerClass); |
There was a problem hiding this comment.
Nope, this is on purpose: as I wrote in the description, I believe that bind on a client socket should be inbound outbound.
True, it was "listen" before, but "listen" was separate, a "3rd option", maybe also for this reason.
On a client socket, bind will make the OS bind :) this side of the connection to a port and interface/address, instead of using any local address/any available port.
There was a problem hiding this comment.
As opposed to bind on a server socket, which is basically a pre-step for accept, so it is definitely inbound. But correct me if you think this is incorrect
There was a problem hiding this comment.
Makes sense, totally missed your comment in the description 👍
| @Override | ||
| public void check$sun_nio_ch_SocketChannelImpl$bind(Class<?> callerClass, SocketChannel that, SocketAddress local) { | ||
| policyManager.checkNetworkAccess(callerClass, NetworkEntitlement.LISTEN_ACTION); | ||
| policyManager.checkOutboundNetworkAccess(callerClass); |
...src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java
Show resolved
Hide resolved
…titlements-refactoring
💔 Backport failed
You can use sqren/backport to manually backport by running |
4 participants
This PR introduces specific Inbound (listen/accept/receive) and Outbound (connect/send) network entitlements, in place of the current NetworkEntitlement with actions.
Some changes are almost 1-1, with the exception of listen (bind): the SecurityManager "listen" permission is applied to every
bindfunction (sometimes indirectly from a ctor); on server or datagram sockets, this should be thought as an inbound operation; on client sockets, it should not. I changed the checks and policies to reflect that.Additional changes:
HttpClientBuilderImpl#bind, as discussed during this PR reviewHttpClient#send/sendAsyncRelates to ES-10355