10000 fixed security problem wrong usage of Host header. · Asquera/elasticsearch-http-basic@5bafc90 · GitHub
[go: up one dir, main page]

Skip to content
This repository was archived by the owner on Mar 4, 2019. It is now read-only.

Commit 5bafc90

Browse files
author
Ernesto
committed
fixed security problem wrong usage of Host header.
- remove usage of 'Host' header - add usage of trusted proxy chain - added unit and integration tests - updated log messages
1 parent ae48fc1 commit 5bafc90

17 files changed

+1645
-77
lines changed

.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,9 @@
66
*~
77
deploy.sh
88
.gradle
9+
.DS_Store
10+
.classpath
11+
.metadata/
12+
.project
13+
.settings/
14+
data/

README.md

Lines changed: 93 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
# HTTP Basic auth for ElasticSearch
22

3-
This plugin provides an extension of ElasticSearchs HTTP Transport module to enable HTTP Basic authorization.
3+
This plugin provides an extension of ElasticSearchs HTTP Transport module to enable HTTP Basic authorization and
4+
Ip based authorization.
45

5-
Requesting / does not request authentication to simplify health check configuration.
6+
Requesting `/` does not request authentication to simplify health check configuration.
67

78
There is no way to configure this on a per index basis.
89

@@ -22,35 +23,116 @@ Download the current version from https://github.com/Asquera/elasticsearch-http-
2223

2324
Once the plugin is installed it can be configured in the [elasticsearch modules configuration file](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html#settings). See the [elasticserach directory layout information](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-dir-layout.html) for more information about the default paths of an ES installation.
2425

25-
| Setting key | Default value | Notes |
26-
|-----------------------------|------------------------------|-------------------------------------------------------------------------|
27-
| `http.basic.enabled` | true | **true** disables the default ES HTTP Transport module |
28-
| `http.basic.user` | "admin" | |
29-
| `http.basic.pasword` | "admin_pw" | |
30-
| `http.basic.whitelist` | ["localhost", "127.0.0.1"] | |
31-
| `http.basic.log` | false | enables pugin logging to ES log |
32-
| `http.basic.xforward` | "" | example [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For) |
26+
| Setting key | Default value | Notes |
27+
|-----------------------------------|------------------------------|-------------------------------------------------------------------------|
28+
| `http.basic.enabled` | true | **true** disables the default ES HTTP Transport module |
29+
| `http.basic.user` | "admin" | |
30+
| `http.basic.password` | "admin_pw" | |
31+
| `http.basic.ipwhitelist` | ["localhost", "127.0.0.1"] | uses Host Name Resolution from [java.net.InetAddress](http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html) |
32+
| `http.basic.trusted_proxy_chains` | [] | Set an array of trusted proxies ips chains |
33+
| `http.basic.log` | false | enables plugin logging to ES log. Unauthenticated requests are always logged. |
34+
| `http.basic.xforward` | "" | most common is [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For) |
3335

3436
Be aware that the password is stored in plain text.
3537

38+
## Ip based authentication
39+
40+
A client is **authenticated iff** its **request** is **trusted** and its **ip is whitelisted**.
41+
A Request from a client connected *directly* (direct client) is **trusted**. Its ip is the request ip.
42+
A Request form a client connected *via proxies* (remote client) is **trusted iff** there is a tail
43+
subchain of the request chain that matches a tail subchain of the trusted proxy chains.
44+
45+
**A tail subchain** of a chain "*A,B,C*" is a subchain that matches it by the end.
46+
Example: the 3 tail subchains of the ip chain *A,B,C* are:
47+
48+
(pseudo code) tailSubchains("A,B,C") --> ["A,B,C", "B,C", "C"]
49+
50+
The request chain of a remote client is obtained following these steps:
51+
52+
- read the request's xforward configured header field.
53+
- remove the xforwarded defined client's ip (first listed ip as defined by X-Forwarded-For) from it.
54+
- append the request ip to it.
55+
56+
The ip chain of a remote client is the ip previous to the longest trusted tail subchain .Is the ip used to check
57+
against the whitelist.
58+
59+
60+
### Request chain checks
61+
62+
Having the following configuration:
63+
64+
http.basic.xforward = 'X-Forwarded-For'
65+
http.basic.trusted_proxy_chains = ["B,C", "Z"]
66+
67+
#### Trusted cases:
68+
69+
- A remote client with ip *A* connects to [server] via proxies with ips *B* and *C*. *X-Forwarded-For* header has "*A,B*", removing the client's ip "*A*" and adding the request ip *C*, the resulting chain *B,C* matches a trusted tail subchain. Client's ip is A.
70+
71+
[A] --> B --> C --> [server]
72+
73+
- A remote client with ip *A* connects to [server] via proxies with ips *R*, *P*, *B* and *C*. *X-Forwarded-For* header has "*A,R,P,B*".
74+
Removing the client's ip "*A*" and adding the request ip *C* , the resulting chain ** matches a trusted tail subchain. **note**: in this case "*P*" is taken as the client's ip, and checked against the white list. Client's ip is P.
75+
76+
[A] --> R --> P --> B --> C --> [server]
77+
78+
- A remote client with ip *A* connects to [server] via *C*. *X-Forwarded-For* header has
79+
*A*, removing the client's ip *A* and adding the request ip *C*, the resulting chain *C* matches a trusted tail subchain. Client's ip is A.
80+
81+
[A] --> C --> [server]
82+
83+
- client *A* connects directly to [server]. *X-Forwarded-For* header is not set. Client's ip is A.
84+
85+
[A] --> [server]
86+
87+
#### Untrusted cases:
88+
89+
- A remote client with ip *A* connects to [server] via *D*. *X-Forwarded-For* header has
90+
"*A*", removing the client's ip "*A*" and adding the request ip *D*, the resulting chain *D* doesn't match any trusted sub ip chain.
91+
92+
[A] --> D --> [server]
93+
94+
- A remote client with ip *X* connects to proxy with ip *C* passing a faked *X-Forwarded-For* header "*R*". *C* will check the IP of the request and add it to the *X-Forwarded-For* field. the server will receive and *X-Forwarded-For* header
95+
as: "*R,X*", remove the client's ip "*R*", add the request ip "*C*" and finally drop the request, as "*X,C*" doesn't match the trusted ip.
96+
97+
[X] -- R --> C --> [server]
98+
99+
36100
### configuration example
37101

38-
The following code enables plugin logging, and sets user and password:
102+
The following code enables plugin logging, sets user and password, sets chain
103+
"1.1.1.1,2.2.2.2" as trusted , whitelists ip 3.3.3.3 and defines xforward
104+
header as the common 'X-Forwarded-For':
39105

40106
```
41107
http.basic.log: true
42108
http.basic.user: "some_user"
43109
http.basic.password: "some_password"
110+
http.basic.ipwhitelist: ["3.3.3.3"]
111+
http.basic.xforward: "X-Forwarded-For"
112+
http.basic.trusted_proxy_chains: ["1.1.1.1,2.2.2.2"]
44113
```
45114

46115
## Testing
47116

48117
```
49118
$ curl -v localhost:9200 # works
50119
$ curl -v --user my_username:my_password localhost:9200/foo # works
120+
```
121+
122+
**note:** localhost is a whitelisted ip as default.
123+
```
51124
$ curl -v --user my_username:password localhost:9200/foo # sends 401
52125
```
53126

127+
## Development
128+
129+
### Testing
130+
Maven is configured to run the unit and integration tests. This plugin makes
131+
use of [ES Integration Tests](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/integration-tests.html)
132+
133+
`mvn test` test runs all tests
134+
`mvn integration-test` test runs integration tests only
135+
54136
## Issues
55137

56138
Please file your issue here: https://github.com/Asquera/elasticsearch-http-basic/issues

pom.xml

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,31 +13,53 @@
1313
<properties>
1414
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1515
<elasticsearch.version>1.2.0</elasticsearch.version>
16+
<lucene.version>4.8.1</lucene.version>
1617
</properties>
1718

1819
<dependencies>
20+
21+
<dependency>
22+
<groupId>org.apache.lucene</groupId>
23+
<artifactId>lucene-test-framework</artifactId>
24+
<version>${lucene.version}</version>
25+
<scope>test</scope>
26+
</dependency>
27+
28+
<dependency>
29+
<groupId>org.apache.httpcomponents</groupId>
30+
<artifactId>httpclient</artifactId>
31+
<version>4.3.5</version>
32+
<scope>test</scope>
33+
</dependency>
34+
1935
<dependency>
2036
<groupId>org.elasticsearch</groupId>
2137
<artifactId>elasticsearch</artifactId>
2238
<version>${elasticsearch.version}</version>
2339
</dependency>
2440

2541
<dependency>
26-
<groupId>org.testng</groupId>
27-
<artifactId>testng</artifactId>
28-
<version>6.8</version>
29-
<scope>test</scope>
30-
<exclusions>
31-
<exclusion>
32-
<groupId>org.hamcrest</groupId>
33-
<artifactId>hamcrest-core</artifactId>
34-
</exclusion>
35-
<exclusion>
36-
<groupId>junit</groupId>
37-
<artifactId>junit</artifactId>
38-
</exclusion>
39-
</exclusions>
42+
<groupId>org.elasticsearch</groupId>
43+
<artifactId>elasticsearch</artifactId>
44+
<version>${elasticsearch.version}</version>
45+
<type>test-jar</type>
46+
<scope>test</scope>
4047
</dependency>
48+
49+
<dependency>
50+
<groupId>org.hamcrest</groupId>
51+
<artifactId>hamcrest-all</artifactId>
52+
<version>1.3</version>
53+
<scope>test</scope>
54+
</dependency>
55+
56+
<dependency>
57+
<groupId>junit</groupId>
58+
<artifactId>junit</artifactId>
59+
<version>4.10</version>
60+
<scope>test</scope>
61+
</dependency>
62+
4163
</dependencies>
4264
<build>
4365
<!-- Create a zip file according to elasticsearch naming scheme -->

0 commit comments

Comments
 (0)
0