8000 Merge branch 'security_fix_1_2' · nibin/elasticsearch-http-basic@c2286d2 · GitHub
[go: up one dir, main page]

Skip to content

Commit c2286d2

Browse files
author
Ernesto
committed
Merge branch 'security_fix_1_2'
2 parents ae48fc1 + 8f3012f commit c2286d2

17 files changed

+1654
-78
lines changed

.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,9 @@
66
*~
77
deploy.sh
88
.gradle
9+
.DS_Store
10+
.classpath
11+
.metadata/
12+
.project
13+
.settings/
14+
data/

README.md

Lines changed: 102 additions & 12 deletions
8000
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,25 @@
1+
2+
**IMPORTANT NOTICE**: versions 1.0.4 and 1.1.0 are *insecure and should not be used*.
3+
They have a bug that allows an attacker to get ip authentication by setting
4+
its ip on the 'Host' header. A fix is provided for now for versions v1.2.0 and
5+
v.1.3.0 of the plugin.
6+
17
# HTTP Basic auth for ElasticSearch
28

3-
This plugin provides an extension of ElasticSearchs HTTP Transport module to enable HTTP Basic authorization.
9+
This plugin provides an extension of ElasticSearchs HTTP Transport module to enable HTTP Basic authorization and
10+
Ip based authorization.
411

5-
Requesting / does not request authentication to simplify health check configuration.
12+
Requesting `/` does not request authentication to simplify health check configuration.
613

714
There is no way to configure this on a per index basis.
815

16+
917
## Version Mapping
1018

1119
| Http Basic Plugin | elasticsearch |
1220
|-----------------------------|-----------------------|
13-
| 1.2.0(master) | 1.2.0 |
21+
| v1.3.0(master) | 1.3.0 |
22+
| v1.2.0 | 1.2.0 |
1423
| 1.1.0 | 1.0.0 |
1524
| 1.0.4 | 0.90.7 |
1625

@@ -22,35 +31,116 @@ Download the current version from https://github.com/Asquera/elasticsearch-http-
2231

2332
Once the plugin is installed it can be configured in the [elasticsearch modules configuration file](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-configuration.html#settings). See the [elasticserach directory layout information](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/setup-dir-layout.html) for more information about the default paths of an ES installation.
2433

25-
| Setting key | Default value | Notes |
26-
|-----------------------------|------------------------------|-------------------------------------------------------------------------|
27-
| `http.basic.enabled` | true | **true** disables the default ES HTTP Transport module |
28-
| `http.basic.user` | "admin" | |
29-
| `http.basic.pasword` | "admin_pw" | |
30-
| `http.basic.whitelist` | ["localhost", "127.0.0.1"] | |
31-
| `http.basic.log` | false | enables pugin logging to ES log |
32-
| `http.basic.xforward` | "" | example [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For) |
34+
| Setting key | Default value | Notes |
35+
|-----------------------------------|------------------------------|-------------------------------------------------------------------------|
36+
| `http.basic.enabled` | true | **true** disables the default ES HTTP Transport module |
37+
| `http.basic.user` | "admin" | |
38+
| `http.basic.password` | "admin_pw" | |
39+
| `http.basic.ipwhitelist` | ["localhost", "127.0.0.1"] | uses Host Name Resolution from [java.net.InetAddress](http://docs.oracle.com/javase/7/docs/api/java/net/InetAddress.html) |
40+
| `http.basic.trusted_proxy_chains` | [] | Set an array of trusted proxies ips chains |
41+
| `http.basic.log` | false | enables plugin logging to ES log. Unauthenticated requests are always logged. |
42+
| `http.basic.xforward` | "" | most common is [X-Forwarded-For](http://en.wikipedia.org/wiki/X-Forwarded-For) |
3343

3444
Be aware that the password is stored in plain text.
3545

46+
## Ip based authentication
47+
48+
A client is **authenticated iff** its **request** is **trusted** and its **ip is whitelisted**.
49+
A Request from a client connected *directly* (direct client) is **trusted**. Its ip is the request ip.
50+
A Request form a client connected *via proxies* (remote client) is **trusted iff** there is a tail
51+
subchain of the request chain that matches a tail subchain of the trusted proxy chains.
52+
53+
**A tail subchain** of a chain "*A,B,C*" is a subchain that matches it by the end.
54+
Example: the 3 tail subchains of the ip chain *A,B,C* are:
55+
56+
(pseudo code) tailSubchains("A,B,C") --> ["A,B,C", "B,C", "C"]
57+
58+
The request chain of a remote client is obtained following these steps:
59+
60+
- read the request's xforward configured header field.
61+
- remove the xforwarded defined client's ip (first listed ip as defined by X-Forwarded-For) from it.
62+
- append the request ip to it.
63+
64+
The ip chain of a remote client is the ip previous to the longest trusted tail subchain .Is the ip used to check
65+
against the whitelist.
66+
67+
68+
### Request chain checks
69+
70+
Having the following configuration:
71+
72+
http.basic.xforward = 'X-Forwarded-For'
73+
http.basic.trusted_proxy_chains = ["B,C", "Z"]
74+
75+
#### Trusted cases:
76+
77+
- A remote client with ip *A* connects to [server] via proxies with ips *B* and *C*. *X-Forwarded-For* header has "*A,B*", removing the client's ip "*A*" and adding the request ip *C*, the resulting chain *B,C* matches a trusted tail subchain. Client's ip is A.
78+
79+
[A] --> B --> C --> [server]
80+
81+
- A remote client with ip *A* connects to [server] via proxies with ips *R*, *P*, *B* and *C*. *X-Forwarded-For* header has "*A,R,P,B*".
82+
Removing the client's ip "*A*" and adding the request ip *C* , the resulting chain ** matches a trusted tail subchain. **note**: in this case "*P*" is taken as the client's ip, and checked against the white list. Client's ip is P.
83+
84+
[A] --> R --> P --> B --> C --> [server]
85+
86+
- A remote client with ip *A* connects to [server] via *C*. *X-Forwarded-For* header has
87+
*A*, removing the client's ip *A* and adding the request ip *C*, the resulting chain *C* matches a trusted tail subchain. Client's ip is A.
88+
89+
[A] --> C --> [server]
90+
91+
- client *A* connects directly to [server]. *X-Forwarded-For* header is not set. Client's ip is A.
92+
93+
[A] --> [server]
94+
95+
#### Untrusted cases:
96+
97+
- A remote client with ip *A* connects to [server] via *D*. *X-Forwarded-For* header has
98+
"*A*", removing the client's ip "*A*" and adding the request ip *D*, the resulting chain *D* doesn't match any trusted sub ip chain.
99+
100+
[A] --> D --> [server]
101+
102+
- A remote client with ip *X* connects to proxy with ip *C* passing a faked *X-Forwarded-For* header "*R*". *C* will check the IP of the request and add it to the *X-Forwarded-For* field. the server will receive and *X-Forwarded-For* header
103+
as: "*R,X*", remove the client's ip "*R*", add the request ip "*C*" and finally drop the request, as "*X,C*" doesn't match the trusted ip.
104+
105+
[X] -- R --> C --> [server]
106+
107+
36108
### configuration example
37109

38-
The following code enables plugin logging, and sets user and password:
110+
The following code enables plugin logging, sets user and password, sets chain
111+
"1.1.1.1,2.2.2.2" as trusted , whitelists ip 3.3.3.3 and defines xforward
112+
header as the common 'X-Forwarded-For':
39113

40114
```
41115
http.basic.log: true
42116
http.basic.user: "some_user"
43117
http.basic.password: "some_password"
118+
http.basic.ipwhitelist: ["3.3.3.3"]
119+
http.basic.xforward: "X-Forwarded-For"
120+
http.basic.trusted_proxy_chains: ["1.1.1.1,2.2.2.2"]
44121
```
45122

46123
## Testing
47124

48125
```
49126
$ curl -v localhost:9200 # works
50127
$ curl -v --user my_username:my_password localhost:9200/foo # works
128+
```
129+
130+
**note:** localhost is a whitelisted ip as default.
131+
```
51132
$ curl -v --user my_username:password localhost:9200/foo # sends 401
52133
```
53134

135+
## Development
136+
137+
### Testing
138+
Maven is configured to run the unit and integration tests. This plugin makes
139+
use of [ES Integration Tests](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/integration-tests.html)
140+
141+
`mvn test` test runs all tests
142+
`mvn integration-test` test runs integration tests only
143+
54144
## Issues
55145

56146
Please file your issue here: https://github.com/Asquera/elasticsearch-http-basic/issues

pom.xml

Lines changed: 36 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,31 +13,53 @@
1313
<properties>
1414
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1515
<elasticsearch.version>1.2.0</elasticsearch.version>
16+
<lucene.version>4.8.1</lucene.version>
1617
</properties>
1718

1819
<dependencies>
20+
21+
<dependency>
22+
<groupId>org.apache.lucene</groupId>
23+
<artifactId>lucene-test-framework</artifactId>
24+
<version>${lucene.version}</version>
25+
<scope>test</scope>
26+
</dependency>
27+
28+
<dependency>
29+
<groupId>org.apache.httpcomponents</groupId>
30+
<artifactId>httpclient</artifactId>
31+
<version>4.3.5</version>
32+
<scope>test</scope>
33+
</dependency>
34+
1935
<dependency>
2036
<groupId>org.elasticsearch</groupId>
2137
<artifactId>elasticsearch</artifactId>
2238
<version>${elasticsearch.version}</version>
2339
</dependency>
2440

2541
<dependency>
26-
<groupId>org.testng</groupId>
27-
<artifactId>testng</artifactId>
28-
<version>6.8</version>
29-
<scope>test</scope>
30-
<exclusions>
31-
<exclusion>
32-
<groupId>org.hamcrest</groupId>
33-
<artifactId>hamcrest-core</artifactId>
34-
</exclusion>
35-
<exclusion>
36-
<groupId>junit</groupId>
37-
<artifactId>junit</artifactId>
38-
</exclusion>
39-
</exclusions>
42+
<groupId>org.elasticsearch</groupId>
43+
<artifactId>elasticsearch</artifactId>
44+
<version>${elasticsearch.version}</version>
45+
<type>test-jar</type>
46+
<scope>test</scope>
4047
</dependency>
48+
49+
<dependency>
50+
<groupId>org.hamcrest</groupId>
51+
<artifactId>hamcrest-all</artifactId>
52+
<version>1.3</version>
53+
<scope>test</scope>
54+
</dependency>
55+
56+
<dependency>
57+
<groupId>junit</groupId>
58+
<artifactId>junit</artifactId>
59+
<version>4.10</version>
60+
<scope>test</scope>
61+
</dependency>
62+
4163
</dependencies>
4264
<build>
4365
<!-- Create a zip file according to elasticsearch naming scheme -->

0 commit comments

Comments
 (0)
0