8000 feat: allow disabling whitelist · blogsit/elasticsearch-http-basic@1145f15 · GitHub
[go: up one dir, main page]
Skip to content

Commit 1145f15

Browse files
author
emiguez
committed
feat: allow disabling whitelist
The standard elasticsearch method for getting Array from the settings file always defaults to the default passed array. In order to allow disabling the whitelist the value can be checked first as a boolean (with `true` as default) and furthermore as whitelist Array fix #41
1 parent 0fe17c5 commit 1145f15

File tree

4 files changed

+30
-18
lines changed

4 files changed

+30
-18
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,11 @@ All notable changes to this project will be documented in this
44
file. This file is structured according to http://keepachangelog.com/
55

66
- - -
7-
8-
## [1.4.1-pre][unreleased]
7+
## [1.5.0][unreleased]
8+
### - Added
9+
- allow disabling ipwhitelist by setting its value to `false`
10+
- updated pom to depend on elasticsearch-parent project
11+
- better travis test for different ES versions
912

1013
### Changed
1114
- restored default healthcheck for authenticated users &&

‎README.md

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[![Build Status](https://travis-ci.org/emig/elasticsearch-http-basic.svg?branch=1.5)](https://travis-ci.org/emig/elasticsearch-http-basic)
1+
[![Build Status](https://travis-ci.org/Asquera/elasticsearch-http-basic.svg?branch=master)](https://travis-ci.org/Asquera/elasticsearch-http-basic)
22

33
**IMPORTANT NOTICE**: versions 1.0.4 is *insecure and should not be used*.
44
They have a bug that allows an attacker to get ip authentication by setting
@@ -18,15 +18,16 @@ There is no way to configure this on a per index basis.
1818

1919
| Http Basic Plugin | elasticsearch |
2020
|-----------------------------|-----------------------|
21-
| v1.4.0(master) | 1.4.0 |
21+
| v1.5.0(master) | 1.5.x |
22+
| v1.4.0 | 1.4.0 |
2223
| v1.3.0 | 1.3.0 |
2324
| v1.2.0 | 1.2.0 |
2425
| 1.1.0 | 1.0.0 |
2526
| 1.0.4 | 0.90.7 |
2627

2728
## Installation
2829

29-
Download the current version from https://github.com/Asquera/elasticsearch-http-basic/releases and copy it to `plugins/http-basic`.
30+
Download the desired version from https://github.com/Asquera/elasticsearch-http-basic/releases and copy it to `plugins/http-basic`.
3031

3132
## Configuration
3233

@@ -36,8 +37,8 @@ Once the plugin is installed it can be configured in the [elasticsearch modules
3637
|-----------------------------------|------------------------------|-------------------------------------------------------------------------|
3738
| `http.basic.enabled` | true | **true** disables the default ES HTTP Transport module |
3839
| `http.basic.user` | "admin" | |
39-
| `http.basic.password` | "admin_pw" | |
40-
| `http.basic.ipwhitelist` | ["localhost", "127.0.0.1"] | uses Host Name Resolution from [java.net.InetAddress](http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html) |
40+
| `http.basic.password` | "admin_pw" | |
41+
| `http.basic.ipwhitelist` | ["localhost", "127.0.0.1"] | If set to `false` no ip will be whitelisted. Uses Host Name Resolution from [java.net.InetAddress](http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html) |
4142
| `http.basic.trusted_proxy_chains` | [] | Set an array of trusted proxies ips chains |
4243
| `http.basic.log` | false | enables plugin logging to ES log. Unauthenticated requests are always logged. |
4344
| `http.basic.xforward` | "" | most common is [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For) |
@@ -123,14 +124,19 @@ http.basic.trusted_proxy_chains: ["1.1.1.1,2.2.2.2"]
123124

124125
## Testing
125126

127+
**note:** localhost is a whitelisted ip as default.
128+
Considering a default configuration with **my_username** and **my_password** configured.
129+
130+
Correct credentials
126131
```
127-
$ curl -v localhost:9200 # works
128-
$ curl -v --user my_username:my_password localhost:9200/foo # works
132+
$ curl -v localhost:9200 # works (returns 200) (by default localhost is configured as whitelisted ip)
133+
$ curl -v --user my_username:my_password no_local_host:9200/foo # works (returns 200) (if credentials are set in configuration)
129134
```
130135

131-
**note:** localhost is a whitelisted ip as default.
136+
Wrong credentials
132137
```
133-
$ curl -v --user my_username:password localhost:9200/foo # sends 401
138+
$ curl -v --user my_username:wrong_password no_local_host:9200/ # health check, returns 200 with "{\"OK\":{}}" although Unauthorized
139+
$ curl -v --user my_username:password no_local_host:9200/foo # returns 401
134140
```
135141

136142
## Development
@@ -139,8 +145,8 @@ $ curl -v --user my_username:password localhost:9200/foo # sends 401
139145
Maven is configured to run the unit and integration tests. This plugin makes
140146
use of [ES Integration Tests](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/integration-tests.html)
141147

142-
`mvn test` test runs all tests
143-
`mvn integration-test` test runs integration tests only
148+
`mvn test -Dtests.security.manager=false` test runs all tests
149+
`mvn integration-test -Dtests.security.manager=false` test runs integration tests only
144150

145151
## Issues
146152

‎src/main/java/com/asquera/elasticsearch/plugins/http/HttpBasicServer.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,12 @@ public class HttpBasicServer extends HttpServer {
5656

5757
this.user = settings.get("http.basic.user", "admin");
5858
this.password = settings.get("http.basic.password", "admin_pw");
59-
this.whitelist = new InetAddressWhitelist(
60-
settings.getAsArray("http.basic.ipwhitelist",
61-
new String[]{"localhost", "127.0.0.1"}));
59+
final boolean whitelistEnabled = settings.getAsBoolean("http.basic.ipwhitelist", true);
60+
String [] whitelisted = new String[0];
61+
if (whitelistEnabled) {
62+
whitelisted = settings.getAsArray("http.basic.ipwhitelist", new String[]{"localhost", "127.0.0.1"});
63+
}
64+
this.whitelist = new InetAddressWhitelist(whitelisted);
6265
this.proxyChains = new ProxyChains(
6366
settings.getAsArray(
6467
"http.basic.trusted_proxy_chains", new String[]{""}));

‎src/test/java/com/asquera/elasticsearch/plugins/http/auth/integration/EmptyWhitelistIntegrationTest.java renamed to ‎src/test/java/com/asquera/elasticsearch/plugins/http/auth/integration/DisabledWhitelistIntegrationTest.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,12 @@
3333
* Test a rest action that sets special response headers
3434
*/
3535
@ClusterScope(transportClientRatio = 0.0, scope = Scope.SUITE, numDataNodes = 1)
36-
public class EmptyWhitelistIntegrationTest extends HttpBasicServerPluginIntegrationTest {
36+
public class DisabledWhitelistIntegrationTest extends HttpBasicServerPluginIntegrationTest {
3737

3838
@Override
3939
protected Settings nodeSettings(int nodeOrdinal) {
4040
return builderWithPlugin().
41-
putArray("http.basic.ipwhitelist", "unkown")
41+
put("http.basic.ipwhitelist", false)
4242
.build();
4343
}
4444

0 commit comments

Comments
 (0)
0