Skip to content

Commit 87fa285

Browse files
sscarduziosscarduzio
committed
missing stuff
1 parent 1139f51 commit 87fa285

File tree

4 files changed

+202
-7
lines changed

4 files changed

+202
-7
lines changed

‎src/test/java/org/elasticsearch/rest/action/readonlyrest/acl/test/ACLTest.java

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,25 @@
2828

2929
public class ACLTest {
3030
private static ACL acl;
31-
32-
@BeforeClass
33-
public static void setUpBeforeClass() throws Exception {
31+
public static ACL mkACL(String fileName) {
32+
ACL _acl = null;
3433
try {
35-
byte[] encoded = Files.readAllBytes(Paths.get(System.getProperty("user.dir") + "/src/test/test_rules.yml"));
34+
byte[] encoded = Files.readAllBytes(Paths.get(System.getProperty("user.dir") + fileName));
3635
String str = Charsets.UTF_8.decode(ByteBuffer.wrap(encoded)).toString();
3736
Settings s = Settings.builder().loadFromSource(str).build();
38-
acl = new ACL(s);
37+
_acl = new ACL(s);
3938
} catch (IOException e) {
4039
e.printStackTrace();
4140
}
41+
return _acl;
42+
}
4243

44+
@BeforeClass
45+
public static void setUpBeforeClass() throws Exception {
46+
acl = mkACL("/src/test/test_rules.yml");
4347
}
4448

45-
private RequestContext mockReq(String uri, String address, String apiKey, String authKey, Integer bodyLength, Method method, String xForwardedForHeader, final String[] _indices, String action) throws Throwable {
49+
public static RequestContext mockReq(String uri, String address, String apiKey, String authKey, Integer bodyLength, Method method, String xForwardedForHeader, final String[] _indices, String action) throws Throwable {
4650
RestRequest r = mock(RestRequest.class, RETURNS_DEEP_STUBS);
4751
when(r.method()).thenReturn(method);
4852
when(r.uri()).thenReturn(uri);
@@ -232,7 +236,7 @@ public final void testActionWildcard() throws Throwable {
232236
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
233237
assertEquals(res.getBlock().getName(), "12");
234238
}
235-
239+
236240
@Test
237241
public final void testActionWildcardExactMatch() throws Throwable {
238242
RequestContext rc = mockReq("/public-idx/_search?q=item.getName():fishingpole&size=200", "1.1.1.1", "", "", 0, Method.POST, null, null, "action*");

‎src/test/java/org/elasticsearch/rest/action/readonlyrest/acl/test/KibanaACLTest.java

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
package org.elasticsearch.rest.action.readonlyrest.acl.test;
2+
3+
import org.elasticsearch.plugin.readonlyrest.acl.ACL;
4+
import org.elasticsearch.plugin.readonlyrest.acl.RequestContext;
5+
import org.elasticsearch.plugin.readonlyrest.acl.blocks.Block;
6+
import org.elasticsearch.plugin.readonlyrest.acl.blocks.BlockExitResult;
7+
import org.junit.BeforeClass;
8+
import org.junit.Test;
9+
10+
import static org.junit.Assert.assertEquals;
11+
import static org.junit.Assert.assertFalse;
12+
import static org.junit.Assert.assertTrue;
13+
14+
public class KibanaACLTest {
15+
private static ACL acl;
16+
17+
@BeforeClass
18+
public static void setUpBeforeClass() throws Exception {
19+
acl = ACLTest.mkACL("/src/test/kibana_test_rules.yml");
20+
}
21+
22+
@Test
23+
public final void testKibanaROClusterAction() throws Throwable {
24+
RequestContext rc = ACLTest.mockReq("xyz", "1.1.1.1", "", "", 0, null, null, new String[]{"random-idx"}, "cluster:monitor/health");
25+
BlockExitResult res = acl.check(rc);
26+
assertTrue(res.isMatch());
27+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
28+
assertEquals(res.getBlock().getName(), "1");
29+
}
30+
31+
@Test
32+
public final void testKibanaROreadAction() throws Throwable {
33+
RequestContext rc = ACLTest.mockReq("xyz", "1.1.1.1", "", "", 0, null, null, new String[]{"random-idx"}, "indices:admin/get");
34+
BlockExitResult res = acl.check(rc);
35+
assertTrue(res.isMatch());
36+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
37+
assertEquals(res.getBlock().getName(), "1");
38+
}
39+
@Test
40+
public final void testKibanaROwriteKibanaDevNull() throws Throwable {
41+
RequestContext rc = ACLTest.mockReq("xyz", "1.1.1.1", "", "", 0, null, null, new String[]{".kibana-devnull"}, "indices:data/write/update");
42+
BlockExitResult res = acl.check(rc);
43+
assertTrue(res.isMatch());
44+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
45+
assertEquals(res.getBlock().getName(), "1");
46+
}
47+
48+
@Test
49+
public final void testKibanaROwriteAction_FORBID() throws Throwable {
50+
RequestContext rc = ACLTest.mockReq("xyz", "1.1.1.1", "", "", 0, null, null, new String[]{"random-idx"}, "indices:data/write/update");
51+
BlockExitResult res = acl.check(rc);
52+
assertFalse(res.isMatch());
53+
}
54+
55+
@Test
56+
public final void testKibanaRWreadAction() throws Throwable {
57+
RequestContext rc = ACLTest.mockReq("xyz", "2.2.2.2", "", "", 0, null, null, new String[]{"random-idx"}, "indices:admin/get");
58+
BlockExitResult res = acl.check(rc);
59+
assertTrue(res.isMatch());
60+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
61+
assertEquals(res.getBlock().getName(), "2");
62+
}
63+
@Test
64+
public final void testKibanaRWwriteAction() throws Throwable {
65+
RequestContext rc = ACLTest.mockReq("xyz", "2.2.2.2", "", "", 0, null, null, new String[]{"random-idx"}, "indices:data/write/update");
66+
BlockExitResult res = acl.check(rc);
67+
assertTrue(res.isMatch());
68+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
69+
assertEquals(res.getBlock().getName(), "2");
70+
}
71+
@Test
72+
public final void testKibanaRWClusterAction() throws Throwable {
73+
RequestContext rc = ACLTest.mockReq("xyz", "2.2.2.2", "", "", 0, null, null, new String[]{"random-idx"}, "cluster:monitor/health");
74+
BlockExitResult res = acl.check(rc);
75+
assertTrue(res.isMatch());
76+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
77+
assertEquals(res.getBlock().getName(), "2");
78+
}
79+
80+
@Test
81+
public final void testKibanaR0writeDashboard() throws Throwable {
82+
RequestContext rc = ACLTest.mockReq("xyz", "1.1.1.1", "", "", 0, null, null, new String[]{".kibana"}, "indices:data/write/update");
83+
BlockExitResult res = acl.check(rc);
84+
assertFalse(res.isMatch());
85+
}
86+
87+
@Test
88+
public final void testKibanaRWwriteDashboard() throws Throwable {
89+
RequestContext rc = ACLTest.mockReq("xyz", "2.2.2.2", "", "", 0, null, null, new String[]{".kibana"}, "indices:data/write/update");
90+
BlockExitResult res = acl.check(rc);
91+
assertTrue(res.isMatch());
92+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
93+
assertEquals(res.getBlock().getName(), "2");
94+
}
95+
96+
@Test
97+
public final void testKibanaR0PlusWriteDashboard() throws Throwable {
98+
RequestContext rc = ACLTest.mockReq("xyz", "3.3.3.3", "", "", 0, null, null, new String[]{".kibana"}, "indices:data/write/update");
99+
BlockExitResult res = acl.check(rc);
100+
assertTrue(res.isMatch());
101+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
102+
assertEquals(res.getBlock().getName(), "3");
103+
}
104+
105+
@Test
106+
public final void testKibanaR0PlusWriteKibanaDevnull() throws Throwable {
107+
RequestContext rc = ACLTest.mockReq("xyz", "3.3.3.3", "", "", 0, null, null, new String[]{".kibana-devnull"}, "indices:data/write/update");
108+
BlockExitResult res = acl.check(rc);
109+
assertTrue(res.isMatch());
110+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
111+
assertEquals(res.getBlock().getName(), "3");
112+
}
113+
114+
@Test
115+
public final void testKibanaR0WriteKibanaDevnull() throws Throwable {
116+
RequestContext rc = ACLTest.mockReq("xyz", "3.3.3.3", "", "", 0, null, null, new String[]{".kibana-devnull"}, "indices:data/write/update");
117+
BlockExitResult res = acl.check(rc);
118+
assertTrue(res.isMatch());
119+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
120+
assertEquals(res.getBlock().getName(), "3");
121+
}
122+
123+
@Test
124+
public final void testKibanaR0WriteDashboardCustomKibanaIdx() throws Throwable {
125+
RequestContext rc = ACLTest.mockReq("xyz", "4.4.4.4", "", "", 0, null, null, new String[]{"custom-kibana-idx"}, "indices:data/write/update");
126+
BlockExitResult res = acl.check(rc);
127+
assertTrue(res.isMatch());
128+
assertTrue(res.getBlock().getPolicy() == Block.Policy.ALLOW);
129+
assertEquals(res.getBlock().getName(), "4");
130+
}
131+
132+
}

‎src/test/kibana_test_rules.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
cluster:
2+
name: elasticsearch
3+
4+
index:
5+
number_of_replicas: 0
6+
number_of_shards: 1
7+
analysis:
8+
analyzer:
9+
eulang:
10+
type: custom
11+
tokenizer: standard
12+
filter: [standard, lowercase, asciifolding]
13+
location:
14+
type: custom
15+
tokenizer: standard
16+
filter: [standard, lowercase, asciifolding]
17+
18+
19+
network.host: _eth0:ipv4_
20+
transport.tcp.port : 9310
21+
http.bind_host: _eth0:ipv4_
22+
http.publish_address: _eth0:ipv4_
23+
discovery.zen.ping.multicast.enabled: false
24+
25+
readonlyrest:
26+
# (De)activate plugin
27+
enable: true
28+
29+
# HTTP response body in case of forbidden request.
30+
# If this is null or omitted, the name of the first violated access control rule is returned (useful for debugging!)
31+
response_if_req_forbidden: <h1>Forbidden</h1>
32+
33+
# Default policy is to forbid everything, so let's define a whitelist
34+
access_control_rules:
35+
36+
- name: 1
37+
type: allow
38+
hosts: 1.1.1.1
39+
kibana_access: ro
40+
41+
- name: 2
42+
type: allow
43+
hosts: 2.2.2.2
44+
kibana_access: rw
45+
46+
- name: 3
47+
type: allow
48+
hosts: 3.3.3.3
49+
kibana_access: ro+
50+
51+
- name: 4
52+
type: allow
53+
hosts: 4.4.4.4
54+
kibana_access: ro+
55+
kibana_index: custom-kibana-idx
56+
57+

‎src/test/test_rules.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,5 @@ readonlyrest:
8383
- name: 12
8484
type: allow
8585
actions: action*
86+
87+

0 commit comments

Comments
 (0)