-
Notifications
You must be signed in to change notification settings - Fork 273
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Optimize the Fls/Dls/FieldMasking data structure to only include the concrete indices from the current request #4706
Closed
+184
−39
Closed
Changes from all commits
Commits
Show all changes
16 commits
Select commit
Hold shift + click to select a range
0b9e0ed
WIP on FLS and Field Masking optimization
cwperks 24b642b
Keep resolved datastreams because IndexResolverReplacer.Resolved does…
cwperks cec16db
Same with DLS
cwperks 29d8d9c
Remove debug statement
cwperks 7e32bcf
Remove change in ConfigModelV7
cwperks 9cd69d1
Resolve data streams as well
cwperks 93a3604
Revert change in test
cwperks 27282b6
Handle null
cwperks 944d26f
Remove sysout
cwperks 8be5c83
Merge branch 'main' into filtered-fls
cwperks f6c51a7
Add FlsAndFieldMaskingLogsTests
cwperks d0c84e2
Add more tests
cwperks aa8e720
Add test with scroll
cwperks 47e1062
Keep full header map if min node version in the cluster is 2.17 or be…
cwperks d8cf257
Remove subMap check as it does not add much value
cwperks c1574a7
Merge branch 'main' into filtered-fls
cwperks File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
136 changes: 136 additions & 0 deletions
136
src/integrationTest/java/org/opensearch/security/FlsAndFieldMaskingLogsTests.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,136 @@ | ||
/* | ||
* Copyright OpenSearch Contributors | ||
* SPDX-License-Identifier: Apache-2.0 | ||
* | ||
* The OpenSearch Contributors require contributions made to | ||
* this file be licensed under the Apache-2.0 license or a | ||
* compatible open source license. | ||
* | ||
*/ | ||
package org.opensearch.security; | ||
|
||
import java.io.IOException; | ||
import java.util.List; | ||
import java.util.Map; | ||
import java.util.stream.Collectors; | ||
import java.util.stream.Stream; | ||
|
||
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope; | ||
import org.junit.BeforeClass; | ||
import org.junit.ClassRule; | ||
import org.junit.Rule; | ||
import org.junit.Test; | ||
import org.junit.runner.RunWith; | ||
|
||
import org.opensearch.action.admin.indices.create.CreateIndexRequest; | ||
import org.opensearch.action.index.IndexRequest; | ||
import org.opensearch.action.index.IndexResponse; | ||
import org.opensearch.action.search.SearchRequest; | ||
import org.opensearch.action.search.SearchResponse; | ||
import org.opensearch.client.Client; | ||
import org.opensearch.client.RestHighLevelClient; | ||
import org.opensearch.plugin.mapper.MapperSizePlugin; | ||
import org.opensearch.test.framework.TestSecurityConfig; | ||
import org.opensearch.test.framework.cluster.ClusterManager; | ||
import org.opensearch.test.framework.cluster.LocalCluster; | ||
import org.opensearch.test.framework.log.LogsRule; | ||
|
||
import static org.opensearch.action.support.WriteRequest.RefreshPolicy.IMMEDIATE; | ||
import static org.opensearch.client.RequestOptions.DEFAULT; | ||
import static org.opensearch.security.FlsAndFieldMaskingTests.assertSearchHitsDoNotContainField; | ||
import static org.opensearch.security.Song.FIELD_STARS; | ||
import static org.opensearch.security.Song.SONGS; | ||
import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL; | ||
import static org.opensearch.test.framework.TestSecurityConfig.Role.ALL_ACCESS; | ||
import static org.opensearch.test.framework.cluster.SearchRequestFactory.searchRequestWithScroll; | ||
|
||
@RunWith(com.carrotsearch.randomizedtesting.RandomizedRunner.class) | ||
@ThreadLeakScope(ThreadLeakScope.Scope.NONE) | ||
public class FlsAndFieldMaskingLogsTests { | ||
|
||
static final TestSecurityConfig.User ADMIN_USER = new TestSecurityConfig.User("admin").roles(ALL_ACCESS); | ||
static final TestSecurityConfig.Role FLS_ROLE = new TestSecurityConfig.Role("fls_exclude_stars_reader").clusterPermissions( | ||
"cluster_composite_ops_ro" | ||
).indexPermissions("read").fls("~".concat(FIELD_STARS)).on("*"); | ||
static final TestSecurityConfig.User FLS_USER = new TestSecurityConfig.User("fls_user").roles(FLS_ROLE); | ||
|
||
@ClassRule | ||
public static final LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS) | ||
.anonymousAuth(false) | ||
.nodeSettings( | ||
Map.of("plugins.security.restapi.roles_enabled", List.of("user_" + ADMIN_USER.getName() + "__" + ALL_ACCESS.getName())) | ||
) | ||
.plugin(MapperSizePlugin.class) | ||
.authc(AUTHC_HTTPBASIC_INTERNAL) | ||
.users(ADMIN_USER, FLS_USER) | ||
.build(); | ||
|
||
private static List<String> createIndexWithDocs(String indexName, Song... songs) { | ||
try (Client client = cluster.getInternalNodeClient()) { | ||
client.admin() | ||
.indices() | ||
.create(new CreateIndexRequest(indexName).mapping(Map.of("_size", Map.of("enabled", true)))) | ||
.actionGet(); | ||
return Stream.of(songs).map(song -> { | ||
IndexResponse response = client.index(new IndexRequest(indexName).setRefreshPolicy(IMMEDIATE).source(song.asMap())) | ||
.actionGet(); | ||
return response.getId(); | ||
}).collect(Collectors.toList()); | ||
} | ||
} | ||
|
||
@Rule | ||
public LogsRule valveLogsRule = new LogsRule("org.opensearch.security.configuration.DlsFlsValveImpl"); | ||
|
||
@BeforeClass | ||
public static void createTestData() { | ||
createIndexWithDocs("fls_index", SONGS[0], SONGS[1]); | ||
createIndexWithDocs("fls_index_2", SONGS[0], SONGS[1]); | ||
createIndexWithDocs("other_index", SONGS[0], SONGS[1]); | ||
} | ||
|
||
@Test | ||
public void testFilteredFlsDlsConfigOnConcreteIndex() throws IOException { | ||
String indexName = "fls_index"; | ||
try (RestHighLevelClient restHighLevelClient = cluster.getRestHighLevelClient(FLS_USER)) { | ||
// search | ||
SearchResponse searchResponse = restHighLevelClient.search(new SearchRequest(indexName), DEFAULT); | ||
|
||
valveLogsRule.assertThatContainExactly( | ||
"Filtered DLS/FLS Config: EvaluatedDlsFlsConfig [dlsQueriesByIndex={}, flsByIndex={fls_index=[~stars]}, fieldMaskingByIndex={}]" | ||
); | ||
|
||
assertSearchHitsDoNotContainField(searchResponse, FIELD_STARS); | ||
} | ||
} | ||
|
||
@Test | ||
public void testFilteredFlsDlsConfigOnIndexPattern() throws IOException { | ||
try (RestHighLevelClient restHighLevelClient = cluster.getRestHighLevelClient(FLS_USER)) { | ||
// search with index pattern | ||
SearchResponse searchResponse = restHighLevelClient.search(new SearchRequest("fls_index*"), DEFAULT); | ||
|
||
valveLogsRule.assertThatContainExactly( | ||
"Filtered DLS/FLS Config: EvaluatedDlsFlsConfig [dlsQueriesByIndex={}, flsByIndex={fls_index=[~stars], fls_index_2=[~stars]}, fieldMaskingByIndex={}]" | ||
); | ||
|
||
assertSearchHitsDoNotContainField(searchResponse, FIELD_STARS); | ||
} | ||
} | ||
|
||
@Test | ||
public void testFilteredFlsDlsConfigWithScroll() throws IOException { | ||
String indexName = "fls_index"; | ||
try (RestHighLevelClient restHighLevelClient = cluster.getRestHighLevelClient(FLS_USER)) { | ||
// scroll | ||
SearchResponse searchResponse = restHighLevelClient.search(searchRequestWithScroll(indexName, 1), DEFAULT); | ||
|
||
valveLogsRule.assertThatContainExactly( | ||
"Filtered DLS/FLS Config: EvaluatedDlsFlsConfig [dlsQueriesByIndex={}, flsByIndex={fls_index=[~stars]}, fieldMaskingByIndex={}]" | ||
); | ||
|
||
assertSearchHitsDoNotContainField(searchResponse, FIELD_STARS); | ||
} | ||
} | ||
|
||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change is needed to ensure that the concrete index corresponding to any data streams in the request is resolved to.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we also want to set this as true in line 489/is there a reason this was not passed as true before?