Security authn via netty channel validator (#95112)

Hooks "REST" authN, as a "validator", into the new netty channel interceptor for http headers.

Author: albertzaharovits

docs/changelog/95112.yaml

@@ -0,0 +1,5 @@
+pr: 95112
+summary: Header validator with Security
+area: Authentication
+type: enhancement
+issues: []

modules/transport-netty4/src/main/java/module-info.java

@@ -23,4 +23,5 @@
 
  exports org.elasticsearch.http.netty4;
  exports org.elasticsearch.transport.netty4;
+ exports org.elasticsearch.http.netty4.internal to org.elasticsearch.security;
 }

modules/transport-netty4/src/main/java/org/elasticsearch/http/netty4/Netty4HttpHeaderValidator.java

@@ -9,7 +9,6 @@
 package org.elasticsearch.http.netty4;
 
 import io.netty.buffer.Unpooled;
-import io.netty.channel.Channel;
 import io.netty.channel.ChannelHandlerContext;
 import io.netty.channel.ChannelInboundHandlerAdapter;
 import io.netty.handler.codec.DecoderResult;
@@ -21,8 +20,8 @@
 
 import org.elasticsearch.action.ActionListener;
 import org.elasticsearch.action.support.ContextPreservingActionListener;
-import org.elasticsearch.common.TriConsumer;
 import org.elasticsearch.common.util.concurrent.ThreadContext;
+import org.elasticsearch.http.netty4.internal.HttpValidator;
 import org.elasticsearch.transport.Transports;
 
 import java.util.ArrayDeque;
@@ -35,17 +34,12 @@
 
 public class Netty4HttpHeaderValidator extends ChannelInboundHandlerAdapter {
 
- public static final TriConsumer<HttpRequest, Channel, ActionListener<Void>> NOOP_VALIDATOR = ((
- httpRequest,
- channel,
- listener) -> listener.onResponse(null));
-
- private final TriConsumer<HttpRequest, Channel, ActionListener<Void>> validator;
+ private final HttpValidator validator;
  private final ThreadContext threadContext;
  private ArrayDeque<HttpObject> pending = new ArrayDeque<>(4);
  private State state = WAITING_TO_START;
 
- public Netty4HttpHeaderValidator(TriConsumer<HttpRequest, Channel, ActionListener<Void>> validator, ThreadContext threadContext) {
+ public Netty4HttpHeaderValidator(HttpValidator validator, ThreadContext threadContext) {
  this.validator = validator;
  this.threadContext = threadContext;
  }
@@ -129,7 +123,7 @@ private void requestStart(ChannelHandlerContext ctx) {
  );
  // this prevents thread-context changes to propagate beyond the validation, as netty worker threads are reused
  try (ThreadContext.StoredContext ignore = threadContext.newStoredContext()) {
- validator.apply(httpRequest, ctx.channel(), contextPreservingActionListener);
+ validator.validate(httpRequest, ctx.channel(), contextPreservingActionListener);
  }
  }
  }

modules/transport-netty4/src/main/java/org/elasticsearch/http/netty4/Netty4HttpRequest.java

@@ -11,7 +11,6 @@
 import io.netty.buffer.ByteBuf;
 import io.netty.buffer.Unpooled;
 import io.netty.handler.codec.http.DefaultFullHttpRequest;
-import io.netty.handler.codec.http.DefaultHttpHeaders;
 import io.netty.handler.codec.http.FullHttpRequest;
 import io.netty.handler.codec.http.HttpHeaderNames;
 import io.netty.handler.codec.http.HttpHeaders;
@@ -41,59 +40,35 @@ public class Netty4HttpRequest implements HttpRequest {
 
  private final FullHttpRequest request;
  private final BytesReference content;
- private final HttpHeadersMap headers;
+ private final Map<String, List<String>> headers;
  private final AtomicBoolean released;
  private final Exception inboundException;
  private final boolean pooled;
-
  private final int sequence;
 
  Netty4HttpRequest(int sequence, FullHttpRequest request) {
- this(
- sequence,
- request,
- new HttpHeadersMap(request.headers()),
- new AtomicBoolean(false),
- true,
- Netty4Utils.toBytesReference(request.content())
- );
+ this(sequence, request, new AtomicBoolean(false), true, Netty4Utils.toBytesReference(request.content()));
  }
 
  Netty4HttpRequest(int sequence, FullHttpRequest request, Exception inboundException) {
- this(
- sequence,
- request,
- new HttpHeadersMap(request.headers()),
- new AtomicBoolean(false),
- true,
- Netty4Utils.toBytesReference(request.content()),
- inboundException
- );
+ this(sequence, request, new AtomicBoolean(false), true, Netty4Utils.toBytesReference(request.content()), inboundException);
  }
 
- private Netty4HttpRequest(
- int sequence,
- FullHttpRequest request,
- HttpHeadersMap headers,
- AtomicBoolean released,
- boolean pooled,
- BytesReference content
- ) {
- this(sequence, request, headers, released, pooled, content, null);
+ private Netty4HttpRequest(int sequence, FullHttpRequest request, AtomicBoolean released, boolean pooled, BytesReference content) {
+ this(sequence, request, released, pooled, content, null);
  }
 
  private Netty4HttpRequest(
  int sequence,
  FullHttpRequest request,
- HttpHeadersMap headers,
  AtomicBoolean released,
  boolean pooled,
  BytesReference content,
  Exception inboundException
  ) {
  this.sequence = sequence;
  this.request = request;
- this.headers = headers;
+ this.headers = getHttpHeadersAsMap(request.headers());
  this.content = content;
  this.pooled = pooled;
  this.released = released;
@@ -102,36 +77,7 @@ private Netty4HttpRequest(
 
  @Override
  public RestRequest.Method method() {
- HttpMethod httpMethod = request.method();
- if (httpMethod == HttpMethod.GET) return RestRequest.Method.GET;
-
- if (httpMethod == HttpMethod.POST) return RestRequest.Method.POST;
-
- if (httpMethod == HttpMethod.PUT) return RestRequest.Method.PUT;
-
- if (httpMethod == HttpMethod.DELETE) return RestRequest.Method.DELETE;
-
- if (httpMethod == HttpMethod.HEAD) {
- return RestRequest.Method.HEAD;
- }
-
- if (httpMethod == HttpMethod.OPTIONS) {
- return RestRequest.Method.OPTIONS;
- }
-
- if (httpMethod == HttpMethod.PATCH) {
- return RestRequest.Method.PATCH;
- }
-
- if (httpMethod == HttpMethod.TRACE) {
- return RestRequest.Method.TRACE;
- }
-
- if (httpMethod == HttpMethod.CONNECT) {
- return RestRequest.Method.CONNECT;
- }
-
- throw new IllegalArgumentException("Unexpected http method: " + httpMethod);
+ return translateRequestMethod(request.method());
  }
 
  @Override
@@ -170,7 +116,6 @@ public HttpRequest releaseAndCopy() {
  request.headers(),
  request.trailingHeaders()
  ),
- headers,
  new AtomicBoolean(false),
  false,
  Netty4Utils.toBytesReference(copiedContent)
@@ -210,28 +155,19 @@ public HttpVersion protocolVersion() {
 
  @Override
  public HttpRequest removeHeader(String header) {
- HttpHeaders headersWithoutContentTypeHeader = new DefaultHttpHeaders();
- headersWithoutContentTypeHeader.add(request.headers());
- headersWithoutContentTypeHeader.remove(header);
- HttpHeaders trailingHeaders = new DefaultHttpHeaders();
- trailingHeaders.add(request.trailingHeaders());
- trailingHeaders.remove(header);
+ HttpHeaders copiedHeadersWithout = request.headers().copy();
+ copiedHeadersWithout.remove(header);
+ HttpHeaders copiedTrailingHeadersWithout = request.trailingHeaders().copy();
+ copiedTrailingHeadersWithout.remove(header);
  FullHttpRequest requestWithoutHeader = new DefaultFullHttpRequest(
  request.protocolVersion(),
  request.method(),
  request.uri(),
  request.content(),
- headersWithoutContentTypeHeader,
- trailingHeaders
- );
- return new Netty4HttpRequest(
- sequence,
- requestWithoutHeader,
- new HttpHeadersMap(requestWithoutHeader.headers()),
- released,
- pooled,
- content
+ copiedHeadersWithout,
+ copiedTrailingHeadersWithout
  );
+ return new Netty4HttpRequest(sequence, requestWithoutHeader, released, pooled, content);
  }
 
  @Override
@@ -249,6 +185,46 @@ public Exception getInboundException() {
  return inboundException;
  }
 
+ public io.netty.handler.codec.http.HttpRequest getNettyRequest() {
+ return request;
+ }
+
+ public static RestRequest.Method translateRequestMethod(HttpMethod httpMethod) {
+ if (httpMethod == HttpMethod.GET) return RestRequest.Method.GET;
+
+ if (httpMethod == HttpMethod.POST) return RestRequest.Method.POST;
+
+ if (httpMethod == HttpMethod.PUT) return RestRequest.Method.PUT;
+
+ if (httpMethod == HttpMethod.DELETE) return RestRequest.Method.DELETE;
+
+ if (httpMethod == HttpMethod.HEAD) {
+ return RestRequest.Method.HEAD;
+ }
+
+ if (httpMethod == HttpMethod.OPTIONS) {
+ return RestRequest.Method.OPTIONS;
+ }
+
+ if (httpMethod == HttpMethod.PATCH) {
+ return RestRequest.Method.PATCH;
+ }
+
+ if (httpMethod == HttpMethod.TRACE) {
+ return RestRequest.Method.TRACE;
+ }
+
+ if (httpMethod == HttpMethod.CONNECT) {
+ return RestRequest.Method.CONNECT;
+ }
+
+ throw new IllegalArgumentException("Unexpected http method: " + httpMethod);
+ }
+
+ public static Map<String, List<String>> getHttpHeadersAsMap(HttpHeaders httpHeaders) {
+ return new HttpHeadersMap(httpHeaders);
+ }
+
  /**
  * A wrapper of {@link HttpHeaders} that implements a map to prevent copying unnecessarily. This class does not support modifications
  * and due to the underlying implementation, it performs case insensitive lookups of key to values.