Skip to content

[Entitlements] Add some missing instrumentation (nio providers) #122004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 7, 2025
Merged

[Entitlements] Add some missing instrumentation (nio providers) #122004

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions ...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
import java.nio.channels.DatagramChannel;
import java.nio.channels.ServerSocketChannel;
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.SelectorProvider;
import java.nio.charset.Charset;
import java.nio.file.OpenOption;
import java.nio.file.Path;
Expand Down Expand Up @@ -214,6 +215,8 @@ public interface EntitlementChecker {

void check$jdk_vm_ci_services_Services$$loadSingle(Class<?> callerClass, Class<?> service, boolean required);

void check$java_nio_charset_spi_CharsetProvider$(Class<?> callerClass);

/// /////////////////
//
// Network access
Expand Down Expand Up @@ -411,6 +414,16 @@ public interface EntitlementChecker {

void check$sun_nio_ch_DatagramChannelImpl$receive(Class<?> callerClass, DatagramChannel that, ByteBuffer dst);

// providers (SPI)

// protected constructors
void check$java_nio_channels_spi_SelectorProvider$(Class<?> callerClass);

void check$java_nio_channels_spi_AsynchronousChannelProvider$(Class<?> callerClass);

// provider methods (dynamic)
void checkSelectorProviderInheritedChannel(Class<?> callerClass, SelectorProvider that);

/// /////////////////
//
// Load native libraries
Expand Down
82 changes: 82 additions & 0 deletions ...test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/DummyImplementations.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,24 @@
import java.net.DatagramSocketImpl;
import java.net.InetAddress;
import java.net.NetworkInterface;
import java.net.ProtocolFamily;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.SocketAddress;
import java.net.SocketException;
import java.net.SocketImpl;
import java.nio.channels.AsynchronousChannelGroup;
import java.nio.channels.AsynchronousServerSocketChannel;
import java.nio.channels.AsynchronousSocketChannel;
import java.nio.channels.DatagramChannel;
import java.nio.channels.Pipe;
import java.nio.channels.ServerSocketChannel;
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.AbstractSelector;
import java.nio.channels.spi.AsynchronousChannelProvider;
import java.nio.channels.spi.SelectorProvider;
import java.nio.charset.Charset;
import java.nio.charset.spi.CharsetProvider;
import java.security.cert.Certificate;
import java.text.BreakIterator;
import java.text.Collator;
Expand All @@ -35,8 +48,11 @@
import java.text.spi.DateFormatSymbolsProvider;
import java.text.spi.DecimalFormatSymbolsProvider;
import java.text.spi.NumberFormatProvider;
import java.util.Iterator;
import java.util.Locale;
import java.util.Map;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.ThreadFactory;
import java.util.spi.CalendarDataProvider;
import java.util.spi.CalendarNameProvider;
import java.util.spi.CurrencyNameProvider;
Expand Down Expand Up @@ -486,4 +502,70 @@ protected void connect(InetAddress address, int port) throws SocketException {}
private static RuntimeException unexpected() {
return new IllegalStateException("This method isn't supposed to be called");
}

static class DummySelectorProvider extends SelectorProvider {
@Override
public DatagramChannel openDatagramChannel() throws IOException {
return null;
}

@Override
public DatagramChannel openDatagramChannel(ProtocolFamily family) throws IOException {
return null;
}

@Override
public Pipe openPipe() throws IOException {
return null;
}

@Override
public AbstractSelector openSelector() throws IOException {
return null;
}

@Override
public ServerSocketChannel openServerSocketChannel() throws IOException {
return null;
}

@Override
public SocketChannel openSocketChannel() throws IOException {
return null;
}
}

static class DummyAsynchronousChannelProvider extends AsynchronousChannelProvider {
@Override
public AsynchronousChannelGroup openAsynchronousChannelGroup(int nThreads, ThreadFactory threadFactory) throws IOException {
return null;
}

@Override
public AsynchronousChannelGroup openAsynchronousChannelGroup(ExecutorService executor, int initialSize) throws IOException {
return null;
}

@Override
public AsynchronousServerSocketChannel openAsynchronousServerSocketChannel(AsynchronousChannelGroup group) throws IOException {
return null;
}

@Override
public AsynchronousSocketChannel openAsynchronousSocketChannel(AsynchronousChannelGroup group) throws IOException {
return null;
}
}

static class DummyCharsetProvider extends CharsetProvider {
@Override
public Iterator<Charset> charsets() {
return null;
}

@Override
public Charset charsetForName(String charsetName) {
return null;
}
}
}
31 changes: 31 additions & 0 deletions ...titlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/SpiActions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@

package org.elasticsearch.entitlement.qa.test;

import java.io.IOException;
import java.nio.channels.Channel;
import java.nio.channels.spi.SelectorProvider;

import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;

class SpiActions {
Expand Down Expand Up @@ -72,5 +76,32 @@ static void createLocaleServiceProvider() {
new DummyImplementations.DummyLocaleServiceProvider();
}

@EntitlementTest(expectedAccess = ALWAYS_DENIED)
static void getInheritedChannel() throws IOException {
Channel channel = null;
try {
channel = SelectorProvider.provider().inheritedChannel();
} finally {
if (channel != null) {
channel.close();
}
}
}

@EntitlementTest(expectedAccess = ALWAYS_DENIED)
static void createSelectorProvider() {
new DummyImplementations.DummySelectorProvider();
}

@EntitlementTest(expectedAccess = ALWAYS_DENIED)
static void createAsynchronousChannelProvider() {
new DummyImplementations.DummyAsynchronousChannelProvider();
}

@EntitlementTest(expectedAccess = ALWAYS_DENIED)
static void createCharsetProvider() {
new DummyImplementations.DummyCharsetProvider();
}

private SpiActions() {}
}
8 changes: 8 additions & 0 deletions ...src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
import java.lang.instrument.Instrumentation;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.nio.channels.spi.SelectorProvider;
import java.nio.file.FileSystems;
import java.nio.file.OpenOption;
import java.nio.file.Path;
Expand Down Expand Up @@ -79,6 +80,13 @@ public static void initialize(Instrumentation inst) throws Exception {
"checkNewInputStream",
Path.class,
OpenOption[].class
),
INSTRUMENTATION_SERVICE.lookupImplementationMethod(
SelectorProvider.class,
"inheritedChannel",
SelectorProvider.provider().getClass(),
EntitlementChecker.class,
"checkSelectorProviderInheritedChannel"
)
).forEach(instrumentation -> checkMethods.put(instrumentation.targetMethod(), instrumentation.checkMethod()));

Expand Down
21 changes: 21 additions & 0 deletions .../main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@
import java.nio.channels.DatagramChannel;
import java.nio.channels.ServerSocketChannel;
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.SelectorProvider;
import java.nio.charset.Charset;
import java.nio.file.OpenOption;
import java.nio.file.Path;
Expand Down Expand Up @@ -289,6 +290,11 @@ public ElasticsearchEntitlementChecker(PolicyManager policyManager) {
policyManager.checkChangeJVMGlobalState(callerClass);
}

@Override
public void check$java_nio_charset_spi_CharsetProvider$(Class<?> callerClass) {
policyManager.checkChangeJVMGlobalState(callerClass);
}

@Override
public void check$com_sun_tools_jdi_VirtualMachineManagerImpl$$virtualMachineManager(Class<?> callerClass) {
policyManager.checkChangeJVMGlobalState(callerClass);
Expand Down Expand Up @@ -801,6 +807,21 @@ public ElasticsearchEntitlementChecker(PolicyManager policyManager) {
policyManager.checkInboundNetworkAccess(callerClass);
}

@Override
public void check$java_nio_channels_spi_SelectorProvider$(Class<?> callerClass) {
policyManager.checkChangeNetworkHandling(callerClass);
}

@Override
public void check$java_nio_channels_spi_AsynchronousChannelProvider$(Class<?> callerClass) {
policyManager.checkChangeNetworkHandling(callerClass);
}

@Override
public void checkSelectorProviderInheritedChannel(Class<?> callerClass, SelectorProvider that) {
policyManager.checkChangeNetworkHandling(callerClass);
}

@Override
public void check$java_lang_Runtime$load(Class<?> callerClass, Runtime that, String filename) {
// TODO: check filesystem entitlement READ
Expand Down