Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport 1.3] Add early rejection from RestHandler for unauthorized requests #3559

Closed
12 tasks done
peternied opened this issue Oct 17, 2023 · 0 comments
Closed
12 tasks done

[Backport 1.3] Add early rejection from RestHandler for unauthorized requests #3559

peternied opened this issue Oct 17, 2023 · 0 comments
Assignees
@peternied
Labels
triaged Issues labeled as 'Triaged' have been reviewed and are deemed actionable.

Comments

@peternied
Copy link
Member

peternied commented Oct 17, 2023 •
edited
Loading

The change included in #3418 [1] should be backported to 1.3 along with anything critical path for this change. Being that there are significant architectural changes between the the 2.x codebase and 1.x best effort should be used to get as many tests and features as possible.

Exit Criteria
@github-actions github-actions bot added the untriaged Require the attention of the repository maintainers and may need to be prioritized label Oct 17, 2023
@davidlago davidlago added triaged Issues labeled as 'Triaged' have been reviewed and are deemed actionable. and removed untriaged Require the attention of the repository maintainers and may need to be prioritized labels Oct 17, 2023
@peternied peternied removed their assignment Oct 17, 2023
This was referenced Nov 3, 2023
Merged
Merged
Merged
Closed
Merged
willyborankin pushed a commit that referenced this issue Nov 27, 2023
@peternied @cwperks
@opensearch-trigger-bot @github-actions @DarshitChanpura
[Backport 1.3] Add early rejection from RestHandler for unauthorized …
c608fae 
…requests (#3418) (#3675)

### Description

Includes:
- Backport f7c47af of #3418
- Backport 2dab119 of #3717
- Backport f27dee2 of #3583

---

Previously unauthorized requests were fully processed and rejected once
they reached the RestHandler. This allocations more memory and resources
for these requests that might not be useful if they are already detected
as unauthorized. Using the headerVerifer and decompressor customization
from [1], perform an early authorization check when only the headers are
available, save an 'early response' for transmission and do not perform
the decompression on the request to speed up closing out the connection.

```mermaid
graph TD

    oA["Receive Request Headers<br>(Orginal)"] --> oB[Decompress Request]
    oB --> oC[RestHandler]
       oC --> osrf[Intercept Request]
    subgraph sp[Security Plugin]
       osrf --> oD[Check Authorization]
       oD --> oE{Authorized?}
       oE -->|Yes| oF[Process and Respond]
       oE -->|No| oG[Reject Request]
   end
   oF --> oH[Forward to Request Handler]



    H["Receive Request Headers<br>(Updated)"] --> I[HeaderVerifier]
    subgraph nsp[Security Plugin]
       I --> J{Authorized?}
       J -->|Yes| K[Decompress Request]
       J -->|No| N[Save Early Response]
    end
    K --> L[RestHandler]
    N --> L
    L --> M[Intercept Request]
    subgraph n2sp[Security Plugin]
       M --> n2D["Check Authorization<br>(Cached)"]
       n2D --> nE{Authorized?}
       nE -->|Yes| nF[Process and Respond]
       nE -->|No| nG[Reject Request]
   end
   nF --> nH[Forward to Request Handler]

class oA,oB old;
class H,I,K,N,n2D new;
classDef old fill:#f9d0c4,stroke:#f28b82;
classDef new fill:#cfe8fc,stroke:#68a9ef;

```

### Issues Resolved
- Related #3559

### Check List
- [X] New functionality includes testing
- [ ] ~New functionality has been documented~
- [X] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and
signing off your commits, please check
[here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).

---------

Signed-off-by: Peter Nied <petern@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <craig5008@gmail.com>
Signed-off-by: Peter Nied <peternied@hotmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
Co-authored-by: Craig Perkins <cwperx@amazon.com>
Co-authored-by: opensearch-trigger-bot[bot] <98922864+opensearch-trigger-bot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Darshit Chanpura <dchanp@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@peternied peternied

Labels
triaged Issues labeled as 'Triaged' have been reviewed and are deemed actionable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@peternied @davidlago