Remove connect SocketPermissions from core

core/src/main/resources/org/elasticsearch/bootstrap/security.policy

@@ -55,8 +55,8 @@ grant {
   // third party code, to safeguard these against unprivileged code like scripts.
   permission org.elasticsearch.SpecialPermission;
 
-  // Allow connecting to the internet anywhere
-  permission java.net.SocketPermission "*", "connect,resolve";
+  // Allow host/ip name service lookups
+  permission java.net.SocketPermission "*", "resolve";
 
   // Allow read access to all system properties
   permission java.util.PropertyPermission "*", "read";

core/src/main/resources/org/elasticsearch/bootstrap/test-framework.policy

@@ -64,6 +64,22 @@ grant codeBase "${codebase.junit-4.11.jar}" {
 };
 
 grant codeBase "${codebase.mocksocket-1.1.jar}" {
-  // mocksocket accepts socket connections
-  permission java.net.SocketPermission "*", "accept";
+  // mocksocket makes and accepts socket connections
+  permission java.net.SocketPermission "*", "accept,connect";
+};
+
+
+grant codeBase "${codebase.rest-6.0.0-alpha1-SNAPSHOT.jar}" {
+  // rest makes socket connections for rest tests
+  permission java.net.SocketPermission "*", "connect";
+};
+
+grant codeBase "${codebase.httpcore-nio-4.4.5.jar}" {
+  // httpcore makes socket connections for rest tests
+  permission java.net.SocketPermission "*", "connect";
+};
+
+grant codeBase "${codebase.httpasyncclient-4.1.2.jar}" {
+  // httpasyncclient makes socket connections for rest tests
+  permission java.net.SocketPermission "*", "connect";
 };

modules/reindex/src/main/plugin-metadata/plugin-security.policy

@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+grant {
+   // reindex opens socket connections using the rest client
+   permission java.net.SocketPermission "*", "connect";
+};

modules/repository-url/src/main/java/org/elasticsearch/common/blobstore/url/URLBlobContainer.java

@@ -29,6 +29,9 @@
 import java.io.InputStream;
 import java.net.URL;
 import java.nio.file.NoSuchFileException;
+import java.security.AccessController;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Map;
 
 /**
@@ -102,7 +105,7 @@ public boolean blobExists(String blobName) {
     @Override
     public InputStream readBlob(String name) throws IOException {
         try {
-            return new BufferedInputStream(new URL(path, name).openStream(), blobStore.bufferSizeInBytes());
+            return new BufferedInputStream(getInputStream(new URL(path, name)), blobStore.bufferSizeInBytes());
         } catch (FileNotFoundException fnfe) {
             throw new NoSuchFileException("[" + name + "] blob not found");
         }
@@ -113,4 +116,12 @@ public void writeBlob(String blobName, InputStream inputStream, long blobSize) t
         throw new UnsupportedOperationException("URL repository doesn't support this operation");
     }
 
+    private static InputStream getInputStream(URL url) throws IOException {
+        try {
+            return AccessController.doPrivileged((PrivilegedExceptionAction<InputStream>) url::openStream);
+        } catch (PrivilegedActionException e) {
+            throw (IOException) e.getCause();
+        }
+    }
+
 }

modules/repository-url/src/main/plugin-metadata/plugin-security.policy

@@ -0,0 +1,22 @@
+/*
+ * Licensed to Elasticsearch under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+grant {
+  permission java.net.SocketPermission "*", "connect";
+};

modules/transport-netty4/src/main/plugin-metadata/plugin-security.policy

@@ -18,8 +18,8 @@
  */
 
 grant {
-   // netty accepts socket connections
-   permission java.net.SocketPermission "*", "accept";
+   // netty makes and accepts socket connections
+   permission java.net.SocketPermission "*", "accept,connect";
 };
 
 grant codeBase "${codebase.netty-common-4.1.7.Final.jar}" {

plugins/discovery-azure-classic/src/main/plugin-metadata/plugin-security.policy

@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+grant {
+  // azure client opens socket connections for discovery
+  permission java.net.SocketPermission "*", "connect";
+};

plugins/discovery-ec2/src/main/plugin-metadata/plugin-security.policy

@@ -24,4 +24,7 @@ grant {
   // NOTE: no tests fail without this, but we know the problem
   // exists in AWS sdk, and tests here are not thorough
   permission java.lang.RuntimePermission "getClassLoader";
+
+  // ec2 client opens socket connections for discovery
+  permission java.net.SocketPermission "*", "connect";
 };

plugins/discovery-gce/src/main/plugin-metadata/plugin-security.policy

@@ -22,4 +22,7 @@ grant {
   permission java.lang.RuntimePermission "accessDeclaredMembers";
   permission java.lang.RuntimePermission "setFactory";
   permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+
+  // gce client opens socket connections for discovery
+  permission java.net.SocketPermission "*", "connect";
 };

plugins/repository-azure/src/main/plugin-metadata/plugin-security.policy

@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+grant {
+  // azure client opens socket connections for to access repository
+  permission java.net.SocketPermission "*", "connect";
+};

plugins/repository-gcs/src/main/plugin-metadata/plugin-security.policy

@@ -23,4 +23,7 @@ grant {
   permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
   permission java.net.URLPermission "http://www.googleapis.com/*", "*";
   permission java.net.URLPermission "https://www.googleapis.com/*", "*";
+
+  // gcs client opens socket connections for to access repository
+  permission java.net.SocketPermission "*", "connect";
 };

plugins/repository-hdfs/src/main/java/org/elasticsearch/repositories/hdfs/HdfsBlobContainer.java

@@ -19,12 +19,14 @@
 package org.elasticsearch.repositories.hdfs;
 
 import org.apache.hadoop.fs.CreateFlag;
+import org.apache.hadoop.fs.FSDataInputStream;
 import org.apache.hadoop.fs.FSDataOutputStream;
 import org.apache.hadoop.fs.FileContext;
 import org.apache.hadoop.fs.FileStatus;
 import org.apache.hadoop.fs.Options.CreateOpts;
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.fs.PathFilter;
+import org.elasticsearch.SpecialPermission;
 import org.elasticsearch.common.Nullable;
 import org.elasticsearch.common.blobstore.BlobMetaData;
 import org.elasticsearch.common.blobstore.BlobPath;
@@ -36,6 +38,9 @@
 import java.io.InputStream;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.NoSuchFileException;
+import java.security.AccessController;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.Collections;
 import java.util.EnumSet;
 import java.util.LinkedHashMap;
@@ -56,12 +61,7 @@ final class HdfsBlobContainer extends AbstractBlobContainer {
     @Override
     public boolean blobExists(String blobName) {
         try {
-            return store.execute(new Operation<Boolean>() {
-                @Override
-                public Boolean run(FileContext fileContext) throws IOException {
-                    return fileContext.util().exists(new Path(path, blobName));
-                }
-            });
+            return store.execute(fileContext -> fileContext.util().exists(new Path(path, blobName)));
         } catch (Exception e) {
             return false;
         }
@@ -73,22 +73,14 @@ public void deleteBlob(String blobName) throws IOException {
             throw new NoSuchFileException("Blob [" + blobName + "] does not exist");
         }
 
-        store.execute(new Operation<Boolean>() {
-            @Override
-            public Boolean run(FileContext fileContext) throws IOException {
-                return fileContext.delete(new Path(path, blobName), true);
-            }
-        });
+        store.execute(fileContext -> fileContext.delete(new Path(path, blobName), true));
     }
 
     @Override
     public void move(String sourceBlobName, String targetBlobName) throws IOException {
-        store.execute(new Operation<Void>() {
-            @Override
-            public Void run(FileContext fileContext) throws IOException {
-                fileContext.rename(new Path(path, sourceBlobName), new Path(path, targetBlobName));
-                return null;
-            }
+        store.execute((Operation<Void>) fileContext -> {
+            fileContext.rename(new Path(path, sourceBlobName), new Path(path, targetBlobName));
+            return null;
         });
     }
 
@@ -98,11 +90,20 @@ public InputStream readBlob(String blobName) throws IOException {
             throw new NoSuchFileException("Blob [" + blobName + "] does not exist");
         }
         // FSDataInputStream does buffering internally
-        return store.execute(new Operation<InputStream>() {
-            @Override
-            public InputStream run(FileContext fileContext) throws IOException {
-                return fileContext.open(new Path(path, blobName), bufferSize);
-            }
+        return store.execute((Operation<InputStream>) fileContext -> {
+            FSDataInputStream is = fileContext.open(new Path(path, blobName), bufferSize);
+            return new InputStream() {
+                @Override
+                public int read() throws IOException {
+                    try {
+                        SpecialPermission.check();
+                        // FSDataInputStream can open connection on read()
+                        return AccessController.doPrivileged((PrivilegedExceptionAction<Integer>) is::read);
+                    } catch (PrivilegedActionException e) {
+                        throw (IOException) e.getCause();
+                    }
+                }
+            };
         });
     }
 
@@ -111,45 +112,33 @@ public void writeBlob(String blobName, InputStream inputStream, long blobSize) t
         if (blobExists(blobName)) {
             throw new FileAlreadyExistsException("blob [" + blobName + "] already exists, cannot overwrite");
         }
-        store.execute(new Operation<Void>() {
-            @Override
-            public Void run(FileContext fileContext) throws IOException {
-                Path blob = new Path(path, blobName);
-                // we pass CREATE, which means it fails if a blob already exists.
-                // NOTE: this behavior differs from FSBlobContainer, which passes TRUNCATE_EXISTING
-                // that should be fixed there, no need to bring truncation into this, give the user an error.
-                EnumSet<CreateFlag> flags = EnumSet.of(CreateFlag.CREATE, CreateFlag.SYNC_BLOCK);
-                CreateOpts[] opts = { CreateOpts.bufferSize(bufferSize) };
-                try (FSDataOutputStream stream = fileContext.create(blob, flags, opts)) {
-                    int bytesRead;
-                    byte[] buffer = new byte[bufferSize];
-                    while ((bytesRead = inputStream.read(buffer)) != -1) {
-                        stream.write(buffer, 0, bytesRead);
-                        //  For safety we also hsync each write as well, because of its docs:
-                        //  SYNC_BLOCK - to force closed blocks to the disk device
-                        // "In addition Syncable.hsync() should be called after each write,
-                        //  if true synchronous behavior is required"
-                        stream.hsync();
-                    }
+        store.execute((Operation<Void>) fileContext -> {
+            Path blob = new Path(path, blobName);
+            // we pass CREATE, which means it fails if a blob already exists.
+            // NOTE: this behavior differs from FSBlobContainer, which passes TRUNCATE_EXISTING
+            // that should be fixed there, no need to bring truncation into this, give the user an error.
+            EnumSet<CreateFlag> flags = EnumSet.of(CreateFlag.CREATE, CreateFlag.SYNC_BLOCK);
+            CreateOpts[] opts = { CreateOpts.bufferSize(bufferSize) };
+            try (FSDataOutputStream stream = fileContext.create(blob, flags, opts)) {
+                int bytesRead;
+                byte[] buffer = new byte[bufferSize];
+                while ((bytesRead = inputStream.read(buffer)) != -1) {
+                    stream.write(buffer, 0, bytesRead);
+                    //  For safety we also hsync each write as well, because of its docs:
+                    //  SYNC_BLOCK - to force closed blocks to the disk device
+                    // "In addition Syncable.hsync() should be called after each write,
+                    //  if true synchronous behavior is required"
+                    stream.hsync();
                 }
-                return null;
             }
+            return null;
         });
     }
 
     @Override
     public Map<String, BlobMetaData> listBlobsByPrefix(@Nullable final String prefix) throws IOException {
-        FileStatus[] files = store.execute(new Operation<FileStatus[]>() {
-            @Override
-            public FileStatus[] run(FileContext fileContext) throws IOException {
-                return (fileContext.util().listStatus(path, new PathFilter() {
-                    @Override
-                    public boolean accept(Path path) {
-                        return prefix == null || path.getName().startsWith(prefix);
-                    }
-                }));
-            }
-        });
+        FileStatus[] files = store.execute(fileContext -> (fileContext.util().listStatus(path,
+            path -> prefix == null || path.getName().startsWith(prefix))));
         Map<String, BlobMetaData> map = new LinkedHashMap<String, BlobMetaData>();
         for (FileStatus file : files) {
             map.put(file.getPath().getName(), new PlainBlobMetaData(file.getPath().getName(), file.getLen()));