import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public <Request extends ActionRequest, Response extends ActionResponse> void apply(Task task, String action,
        Request request, ActionListener<Response> listener, ActionFilterChain<Request, Response> chain) {
    if (false == action.equals(SearchAction.NAME)) {
        chain.proceed(task, action, request, listener);
        return;
    }
    if (context.getHeader(EXAMPLE_HEADER) != null) {
        throw new IllegalArgumentException("Hurray! Sent the header!");
    }
    String auth = context.getHeader(AUTHORIZATION_HEADER);
    if (auth == null) {
        ElasticsearchSecurityException e = new ElasticsearchSecurityException("Authentication required",
                RestStatus.UNAUTHORIZED);
        e.addHeader("WWW-Authenticate", "Basic realm=auth-realm");
        throw e;
    }
    if (false == REQUIRED_AUTH.equals(auth)) {
        throw new ElasticsearchSecurityException("Bad Authorization", RestStatus.FORBIDDEN);
    }
    chain.proceed(task, action, request, listener);
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
/**
 * Create a user context from the given request
 * 
 * @param   cache - The cache of user projects to create ACLs
 * @return  an OpenshiftRequestContext 
 * @throws  All exceptions
 */
public OpenshiftRequestContext create(final RestRequest request, final UserProjectCache cache) throws Exception {
    logRequest(request, cache);

    Set<String> projects = new HashSet<>();
    boolean isClusterAdmin = false;
    String user = utils.getUser(request);
    String token = utils.getBearerToken(request);
    if (StringUtils.isNotBlank(token)){
        user = utils.assertUser(request);
        isClusterAdmin = utils.isOperationsUser(request);
        projects = listProjectsFor(user, token);
        if(user.contains("\\")){
            user = user.replace("\\", "/");
        }
        utils.setUser(request, user);
    } else if (utils.isClientCertAuth(request) && StringUtils.isBlank(token) && StringUtils.isBlank(user)) {
        return OpenshiftRequestContext.EMPTY; // nothing more we can do here
    } else {
        String message = "Incorrect authentication credentials were given - must provide client cert, or token with optional username, or all of these.";
        LOGGER.debug(message);
        throw new ElasticsearchSecurityException(message);
    }

    return new OpenshiftRequestContext(user, token, isClusterAdmin, projects, getKibanaIndex(user, isClusterAdmin), this.kibanaIndexMode);
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
protected void checkRequest(final RestRequest request, final RestChannel channel) {
    
    if(SSLRequestHelper.containsBadHeader(threadContext, "_sg_ssl_")) {
        final ElasticsearchException exception = ExceptionUtils.createBadHeaderException();
        errorHandler.logError(exception, request, 1);
        throw exception;
    }
    
    try {
        if(SSLRequestHelper.getSSLInfo(settings, configPath, request, null) == null) {
            logger.error("Not an SSL request");
            throw new ElasticsearchSecurityException("Not an SSL request", RestStatus.INTERNAL_SERVER_ERROR);
        }
    } catch (SSLPeerUnverifiedException e) {
        logger.error("No client certificates found but such are needed (SG 8).");
        errorHandler.logError(e, request, 0);
        throw ExceptionsHelper.convertToElastic(e);
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException exceptionProcessingRequest(final RestRequest request, final Exception e) {
    final ElasticsearchSecurityException se = super.exceptionProcessingRequest(request, e);
    String outToken = "";
    if (e instanceof ElasticsearchException) {
        final ElasticsearchException kae = (ElasticsearchException) e;
        if (kae.getHeader("kerberos_out_token") != null) {
            outToken = " " + kae.getHeader("kerberos_out_token").get(0);
        }
    }

    se.addHeader(KrbConstants.WWW_AUTHENTICATE, KrbConstants.NEGOTIATE + outToken);

    if (logger.isDebugEnabled()) {
        logger.debug("exception for rest request: {}", e.toString());
    }

    return se;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public void process(RestRequest request, RestChannel channel, RestFilterChain chain) throws Exception {
    boolean continueProcessing = true;

    try {
        if (enabled) {
            // create authenticates the request - if it returns null, this means
            // this plugin cannot handle this request, and should pass it to the
            // next plugin for processing e.g. client cert auth with no username/password
            // if create throws an exception, it means there was an issue with the token
            // and username and the request failed authentication
            final OpenshiftRequestContext requestContext = contextFactory.create(request, cache);
            if (requestContext == OpenshiftRequestContext.EMPTY) {
                return; // do not process in this plugin
            }
            request = utils.modifyRequest(request, requestContext);
            request.putInContext(OPENSHIFT_REQUEST_CONTEXT, requestContext);
            // grab the kibana version here out of "kbn-version" if we can
            // -- otherwise use the config one
            final String kbnVersion = getKibanaVersion(request);
            if (updateCache(requestContext, kbnVersion)) {
                kibanaSeed.setDashboards(requestContext, client, kbnVersion, cdmProjectPrefix);
                syncAcl(requestContext);
            }
        }
    } catch (ElasticsearchSecurityException ese) {
        LOGGER.info("Could not authenticate user");
        channel.sendResponse(new BytesRestResponse(RestStatus.UNAUTHORIZED));
        continueProcessing = false;
    } catch (Exception e) {
        LOGGER.error("Error handling request in {}", e, this.getClass().getSimpleName());
    } finally {
        if (continueProcessing) {
            chain.continueProcessing(request, channel);
        }
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
private String sha256(Path p) {
    
    if(!Files.isRegularFile(p, LinkOption.NOFOLLOW_LINKS)) {
        return "";
    }

    try {
        MessageDigest digester = MessageDigest.getInstance("SHA256");
        final String hash = org.bouncycastle.util.encoders.Hex.toHexString(digester.digest(Files.readAllBytes(p)));
        log.debug(hash +" :: "+p);
        return hash;
    } catch (Exception e) {
        throw new ElasticsearchSecurityException("Unable to digest file", e);
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
private AuthCredentials(final String username, byte[] password, Object nativeCredentials, String... backendRoles) {
    super();

    if (username == null || username.isEmpty()) {
        throw new IllegalArgumentException("username must not be null or empty");
    }

    this.username = username;
    // make defensive copy
    this.password = password == null ? null : Arrays.copyOf(password, password.length);
    
    if(this.password != null) {
        try {
            MessageDigest digester = MessageDigest.getInstance(DIGEST_ALGORITHM);
            internalPasswordHash = digester.digest(this.password);
        } catch (NoSuchAlgorithmException e) {
            throw new ElasticsearchSecurityException("Unable to digest password", e);
        }
    } else {
        internalPasswordHash = null;
    }
    
    if(password != null) {
        Arrays.fill(password, (byte) '\0');
        password = null;
    }
    
    this.nativeCredentials = nativeCredentials;
    nativeCredentials = null;
    
    if(backendRoles != null && backendRoles.length > 0) {
        this.backendRoles.addAll(Arrays.asList(backendRoles));
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public AuthCredentials extractCredentials(final RestRequest request, ThreadContext context) {
	
    if(context.getTransient(ConfigConstants.SG_XFF_DONE) !=  Boolean.TRUE) {
        throw new ElasticsearchSecurityException("xff not done");
    }
    
    final String userHeader = settings.get("user_header");
    final String rolesHeader = settings.get("roles_header");

    if(log.isDebugEnabled()) {
        log.debug("headers {}", request.getHeaders());
        log.debug("userHeader {}, value {}", userHeader, userHeader == null?null:request.header(userHeader));
        log.debug("rolesHeader {}, value {}", rolesHeader, rolesHeader == null?null:request.header(rolesHeader));
    }

    if (!Strings.isNullOrEmpty(userHeader) && !Strings.isNullOrEmpty((String) request.header(userHeader))) {

        String[] backendRoles = null;

        if (!Strings.isNullOrEmpty(rolesHeader) && !Strings.isNullOrEmpty((String) request.header(rolesHeader))) {
            backendRoles = ((String) request.header(rolesHeader)).split(",");
        }
        return new AuthCredentials((String) request.header(userHeader), backendRoles).markComplete();
    } else {
        if(log.isTraceEnabled()) {
            log.trace("No '{}' header, send 401", userHeader);
        }
        return null;
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
public TransportAddress resolve(final RestRequest request) throws ElasticsearchSecurityException {
    
    if(log.isTraceEnabled()) {
        log.trace("resolve {}", request.getRemoteAddress());
    }
    
    if(enabled && request.getRemoteAddress() instanceof InetSocketAddress && request instanceof Netty4HttpRequest) {

        final InetSocketAddress isa = new InetSocketAddress(detector.detect((Netty4HttpRequest) request, threadContext), ((InetSocketAddress)request.getRemoteAddress()).getPort());
    
        if(isa.isUnresolved()) {           
            throw new ElasticsearchSecurityException("Cannot resolve address "+isa.getHostString());
        }
            
         
        if(log.isTraceEnabled()) {
            if(threadContext.getTransient(ConfigConstants.SG_XFF_DONE) == Boolean.TRUE) {
                log.trace("xff resolved {} to {}", request.getRemoteAddress(), isa);
            } else {
                log.trace("no xff done for {}",request.getClass());
            }
        }
        return new TransportAddress(isa);
    } else if(request.getRemoteAddress() instanceof InetSocketAddress){
        
        if(log.isTraceEnabled()) {
            log.trace("no xff done (enabled or no netty request) {},{},{},{}",enabled, request.getClass());

        }
        return new TransportAddress((InetSocketAddress)request.getRemoteAddress());
    } else {
        throw new ElasticsearchSecurityException("Cannot handle this request. Remote address is "+request.getRemoteAddress()+" with request class "+request.getClass());
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
private User impersonate(final TransportRequest tr, final User origPKIuser) throws ElasticsearchSecurityException {

        final String impersonatedUser = threadPool.getThreadContext().getHeader("sg_impersonate_as");
        
        if(Strings.isNullOrEmpty(impersonatedUser)) {
            return null; //nothing to do
        }
        
        if (!isInitialized()) {
            throw new ElasticsearchSecurityException("Could not check for impersonation because Search Guard is not yet initialized");
        }

        if (origPKIuser == null) {
            throw new ElasticsearchSecurityException("no original PKI user found");
        }

        User aU = origPKIuser;

        if (adminDns.isAdmin(impersonatedUser)) {
            throw new ElasticsearchSecurityException("'"+origPKIuser.getName() + "' is not allowed to impersonate as an adminuser  '" + impersonatedUser+"'");
        }
        
        try {
            if (impersonatedUser != null && !adminDns.isTransportImpersonationAllowed(new LdapName(origPKIuser.getName()), impersonatedUser)) {
                throw new ElasticsearchSecurityException("'"+origPKIuser.getName() + "' is not allowed to impersonate as '" + impersonatedUser+"'");
            } else if (impersonatedUser != null) {
                aU = new User(impersonatedUser);
                if(log.isDebugEnabled()) {
                    log.debug("Impersonate from '{}' to '{}'",origPKIuser.getName(), impersonatedUser);
                }
            }
        } catch (final InvalidNameException e1) {
            throw new ElasticsearchSecurityException("PKI does not have a valid name ('" + origPKIuser.getName() + "'), should never happen",
                    e1);
        }

        return aU;
    }
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException failedAuthentication(RestRequest request, AuthenticationToken token, ThreadContext context) {
    ElasticsearchSecurityException e = super.failedAuthentication(request, token, context);
    // set a custom header
    e.addHeader("WWW-Authenticate", "custom-challenge");
    return e;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException missingToken(RestRequest request, ThreadContext context) {
    ElasticsearchSecurityException e = super.missingToken(request, context);
    // set a custom header
    e.addHeader("WWW-Authenticate", "custom-challenge");
    return e;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException exceptionProcessingRequest(RestRequest request, Exception e, ThreadContext context) {
    ElasticsearchSecurityException se = super.exceptionProcessingRequest(request, e, context);
    // set a custom header
    se.addHeader("WWW-Authenticate", "custom-challenge");
    return se;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException authenticationRequired(String action, ThreadContext context) {
    ElasticsearchSecurityException se = super.authenticationRequired(action, context);
    // set a custom header
    se.addHeader("WWW-Authenticate", "custom-challenge");
    return se;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException unsuccessfulAuthentication(final RestRequest request, final AuthenticationToken token) {
    final ElasticsearchSecurityException e = super.unsuccessfulAuthentication(request, token);
    e.addHeader(KrbConstants.WWW_AUTHENTICATE, KrbConstants.NEGOTIATE);
    if (logger.isDebugEnabled()) {
        logger.debug("unsuccessfulAuthentication for rest request and token {}", token);
    }
    return e;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException missingToken(final RestRequest request) {
    final ElasticsearchSecurityException e = super.missingToken(request);
    e.addHeader(KrbConstants.WWW_AUTHENTICATE, KrbConstants.NEGOTIATE);
    if (logger.isDebugEnabled()) {
        logger.debug("missing token for rest request");
    }
    return e;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public ElasticsearchSecurityException authenticationRequired(final String action) {
    final ElasticsearchSecurityException se = super.authenticationRequired(action);
    se.addHeader(KrbConstants.WWW_AUTHENTICATE, KrbConstants.NEGOTIATE);

    if (logger.isDebugEnabled()) {
        logger.debug("authentication required for action {}", action);
    }
    return se;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@SuppressWarnings("rawtypes")
public String assertUser(RestRequest request) throws Exception {
    String username = null;
    final String user = getUser(request);
    final String token = getBearerToken(request);
    ConfigBuilder builder = new ConfigBuilder().withOauthToken(token);
    try (DefaultOpenShiftClient osClient = new DefaultOpenShiftClient(builder.build())) {
        LOGGER.debug("Verifying user {} matches the given token.", user);
        Request okRequest = new Request.Builder()
                .addHeader(AUTHORIZATION_HEADER, "Bearer " + token)
                .url(osClient.getMasterUrl() + "oapi/v1/users/~")
                .build();
        Response response = null;
        try {
            response = osClient.getHttpClient().newCall(okRequest).execute();
            final String body = response.body().string();
            if (LOGGER.isDebugEnabled()) {
                LOGGER.debug("Response: code '{}' {}", response.code(), body);
            }
            if(response.code() != RestStatus.OK.getStatus()) {
                throw new ElasticsearchSecurityException("Could not authenticate with given token", RestStatus.UNAUTHORIZED);
            }
            Map<String, Object> userResponse = XContentHelper.convertToMap(new BytesArray(body), false).v2();
            if(userResponse.containsKey("metadata") && ((Map)userResponse.get("metadata")).containsKey("name")) {
                username = (String) ((Map)userResponse.get("metadata")).get("name");
            }
        }catch (Exception e) {
            LOGGER.debug("Exception trying to assertUser '{}'", e, user);
            throw e;
        }
        if(StringUtils.isNotBlank(username) && StringUtils.isNotBlank(user) && !user.equals(username)) {
            String message = String.format("The given username '%s' does not match the username '%s' associated with the token provided with the request.",
                                           user, username);
            LOGGER.debug(message);
        }
    }
    if (null == username) {
        throw new ElasticsearchSecurityException("Could not determine username from token", RestStatus.UNAUTHORIZED);
    }
    return username;
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
@Override
public User authenticate(final AuthCredentials credentials) {
    
    final Settings cfg = getConfigSettings();
    if (cfg == null) {
        throw new ElasticsearchSecurityException("Internal authentication backend not configured. May be Search Guard is not initialized. See http://docs.search-guard.com/v6/sgadmin");

    }

    String hashed = cfg.get(credentials.getUsername() + ".hash");

    if (hashed == null) {
        
        for(String username:cfg.names()) {
            String u = cfg.get(username + ".username");
            if(credentials.getUsername().equals(u)) {
                hashed = cfg.get(username+ ".hash");
                break;
            }
        }
        
        if(hashed == null) {
            throw new ElasticsearchSecurityException(credentials.getUsername() + " not found");
        }
    }
    
    final byte[] password = credentials.getPassword();
    
    if(password == null || password.length == 0) {
        throw new ElasticsearchSecurityException("empty passwords not supported");
    }

    ByteBuffer wrap = ByteBuffer.wrap(password);
    CharBuffer buf = StandardCharsets.UTF_8.decode(wrap);
    char[] array = new char[buf.limit()];
    buf.get(array);
    
    Arrays.fill(password, (byte)0);
   
    try {
        if (OpenBSDBCrypt.checkPassword(hashed, array)) {
            final List<String> roles = cfg.getAsList(credentials.getUsername() + ".roles", Collections.emptyList());
            return new User(credentials.getUsername(), roles, credentials);
        } else {
            throw new ElasticsearchSecurityException("password does not match");
        }
    } finally {
        Arrays.fill(wrap.array(), (byte)0);
        Arrays.fill(buf.array(), '\0');
        Arrays.fill(array, '\0');
    }
}
 

import org.elasticsearch.ElasticsearchSecurityException; //导入依赖的package包/类
public DefaultSearchGuardKeyStore(final Settings settings, final Path configPath) {
    super();
    this.settings = settings;
    Environment _env;
    try {
        _env = new Environment(settings, configPath);
    } catch (IllegalStateException e) {
        _env = null;
    }
    env = _env;
    httpSSLEnabled = settings.getAsBoolean(SSLConfigConstants.SEARCHGUARD_SSL_HTTP_ENABLED,
            SSLConfigConstants.SEARCHGUARD_SSL_HTTP_ENABLED_DEFAULT);
    transportSSLEnabled = settings.getAsBoolean(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENABLED,
            SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENABLED_DEFAULT);
    final boolean useOpenSSLForHttpIfAvailable = settings.getAsBoolean(
            SSLConfigConstants.SEARCHGUARD_SSL_HTTP_ENABLE_OPENSSL_IF_AVAILABLE, true);
    final boolean useOpenSSLForTransportIfAvailable = settings.getAsBoolean(
            SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENABLE_OPENSSL_IF_AVAILABLE, true);

    boolean openSSLInfoLogged = false;
    
    if (httpSSLEnabled && useOpenSSLForHttpIfAvailable) {
        sslHTTPProvider = SslContext.defaultServerProvider();
        logOpenSSLInfos();
        openSSLInfoLogged = true;
    } else if (httpSSLEnabled) {
        sslHTTPProvider = SslProvider.JDK;
    } else {
        sslHTTPProvider = null;
    }

    if (transportSSLEnabled && useOpenSSLForTransportIfAvailable) {
        sslTransportClientProvider = SslContext.defaultClientProvider();
        sslTransportServerProvider = SslContext.defaultServerProvider();
        if(!openSSLInfoLogged) {
            logOpenSSLInfos();
        }
    } else if (transportSSLEnabled) {
        sslTransportClientProvider = sslTransportServerProvider = SslProvider.JDK;
    } else {
        sslTransportClientProvider = sslTransportServerProvider = null;
    }

    initEnabledSSLCiphers();
    initSSLConfig();
    printJCEWarnings();
    
    log.info("TLS Transport Client Provider : {}", sslTransportClientProvider);
    log.info("TLS Transport Server Provider : {}", sslTransportServerProvider);
    log.info("TLS HTTP Provider             : {}", sslHTTPProvider);
    

    log.debug("sslTransportClientProvider:{} with ciphers {}", sslTransportClientProvider,
            getEnabledSSLCiphers(sslTransportClientProvider, false));
    log.debug("sslTransportServerProvider:{} with ciphers {}", sslTransportServerProvider,
            getEnabledSSLCiphers(sslTransportServerProvider, false));
    log.debug("sslHTTPProvider:{} with ciphers {}", sslHTTPProvider, getEnabledSSLCiphers(sslHTTPProvider, true));
    
    log.info("Enabled TLS protocols for transport layer : {}", Arrays.asList(SSLConfigConstants.getSecureSSLProtocols(settings, false)));
    log.info("Enabled TLS protocols for HTTP layer      : {}", Arrays.asList(SSLConfigConstants.getSecureSSLProtocols(settings, true)));
    
    
    if(transportSSLEnabled && (getEnabledSSLCiphers(sslTransportClientProvider, false).isEmpty()
            || getEnabledSSLCiphers(sslTransportServerProvider, false).isEmpty())) {
        throw new ElasticsearchSecurityException("no valid cipher suites for transport protocol");
    }

    if(httpSSLEnabled && getEnabledSSLCiphers(sslHTTPProvider, true).isEmpty()) {
        throw new ElasticsearchSecurityException("no valid cipher suites for http");
    }
    
    if(transportSSLEnabled && SSLConfigConstants.getSecureSSLProtocols(settings, false).length == 0) {
        throw new ElasticsearchSecurityException("no ssl protocols for transport protocol");
    }
    
    if(httpSSLEnabled && SSLConfigConstants.getSecureSSLProtocols(settings, true).length == 0) {
        throw new ElasticsearchSecurityException("no ssl protocols for http");
    }
}