Skip to content

Commit 5a51029

Browse files
kumargukumargu
committed
Fix broken tests
Signed-off-by: Gulshan Kumar <[email protected]>
1 parent 1b6692e commit 5a51029

File tree

11 files changed

+350
-0
lines changed

11 files changed

+350
-0
lines changed

‎plugins/repository-azure/src/yamlRestTest/resources/rest-api-spec/test/repository_azure/test.policy

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
grant {
10+
permission java.net.NetPermission "accessUnixDomainSocket";
11+
permission java.net.SocketPermission "*", "connect,resolve";
12+
};

‎plugins/repository-hdfs/src/test/resources/org/opensearch/repositories/hdfs/test.policy

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
/*
10+
* Licensed to Elasticsearch under one or more contributor
11+
* license agreements. See the NOTICE file distributed with
12+
* this work for additional information regarding copyright
13+
* ownership. Elasticsearch licenses this file to you under
14+
* the Apache License, Version 2.0 (the "License"); you may
15+
* not use this file except in compliance with the License.
16+
* You may obtain a copy of the License at
17+
*
18+
* http://www.apache.org/licenses/LICENSE-2.0
19+
*
20+
* Unless required by applicable law or agreed to in writing,
21+
* software distributed under the License is distributed on an
22+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23+
* KIND, either express or implied. See the License for the
24+
* specific language governing permissions and limitations
25+
* under the License.
26+
*/
27+
28+
/*
29+
* Modifications Copyright OpenSearch Contributors. See
30+
* GitHub history for details.
31+
*/
32+
33+
grant {
34+
// Hadoop UserGroupInformation, HdfsConstants, PipelineAck clinit
35+
permission java.lang.RuntimePermission "getClassLoader";
36+
37+
// UserGroupInformation (UGI) Metrics clinit
38+
permission java.lang.RuntimePermission "accessDeclaredMembers";
39+
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
40+
41+
// Needed so that Hadoop can load the correct classes for SPI and JAAS
42+
// org.apache.hadoop.security.SecurityUtil clinit
43+
// org.apache.hadoop.security.UserGroupInformation.newLoginContext()
44+
permission java.lang.RuntimePermission "setContextClassLoader";
45+
46+
// org.apache.hadoop.util.StringUtils clinit
47+
permission java.util.PropertyPermission "*", "read,write";
48+
49+
// org.apache.hadoop.util.ShutdownHookManager clinit
50+
permission java.lang.RuntimePermission "shutdownHooks";
51+
52+
// JAAS is used by Hadoop for authentication purposes
53+
// The Hadoop Login JAAS module modifies a Subject's private credentials and principals
54+
// The Hadoop RPC Layer must be able to read these credentials, and initiate Kerberos connections
55+
56+
// org.apache.hadoop.security.UserGroupInformation.getCurrentUser()
57+
permission javax.security.auth.AuthPermission "getSubject";
58+
59+
// org.apache.hadoop.security.UserGroupInformation.doAs()
60+
permission javax.security.auth.AuthPermission "doAs";
61+
62+
// org.apache.hadoop.security.UserGroupInformation.getCredentialsInternal()
63+
permission javax.security.auth.PrivateCredentialPermission "org.apache.hadoop.security.Credentials * \"*\"", "read";
64+
65+
// Hadoop depends on the Kerberos login module for kerberos authentication
66+
// com.sun.security.auth.module.Krb5LoginModule.login()
67+
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.krb5";
68+
69+
// com.sun.security.auth.module.Krb5LoginModule.commit()
70+
permission javax.security.auth.AuthPermission "modifyPrivateCredentials";
71+
permission javax.security.auth.AuthPermission "modifyPrincipals";
72+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KeyTab * \"*\"", "read";
73+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KerberosTicket * \"*\"", "read";
74+
75+
// Hadoop depends on OS level user information for simple authentication
76+
// Unix: UnixLoginModule: com.sun.security.auth.module.UnixSystem.UnixSystem init
77+
permission java.lang.RuntimePermission "loadLibrary.jaas";
78+
permission java.lang.RuntimePermission "loadLibrary.jaas_unix";
79+
// Windows: NTLoginModule: com.sun.security.auth.module.NTSystem.loadNative
80+
permission java.lang.RuntimePermission "loadLibrary.jaas_nt";
81+
permission javax.security.auth.AuthPermission "modifyPublicCredentials";
82+
83+
// org.apache.hadoop.security.SaslRpcServer.init()
84+
permission java.security.SecurityPermission "putProviderProperty.SaslPlainServer";
85+
86+
// org.apache.hadoop.security.SaslPlainServer.SecurityProvider.SecurityProvider init
87+
permission java.security.SecurityPermission "insertProvider.SaslPlainServer";
88+
89+
// org.apache.hadoop.security.SaslRpcClient.getServerPrincipal -> KerberosPrincipal init
90+
permission javax.security.auth.kerberos.ServicePermission "*", "initiate";
91+
92+
// hdfs client opens socket connections for to access repository
93+
permission java.net.SocketPermission "*", "connect";
94+
95+
// client binds to the address returned from the host name of any principal set up as a service principal
96+
// org.apache.hadoop.ipc.Client.Connection.setupConnection
97+
permission java.net.SocketPermission "localhost:0", "listen,resolve";
98+
};

‎plugins/repository-hdfs/src/test/resources/rest-api-spec/test/hdfs_repository/test.policy

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
/*
10+
* Licensed to Elasticsearch under one or more contributor
11+
* license agreements. See the NOTICE file distributed with
12+
* this work for additional information regarding copyright
13+
* ownership. Elasticsearch licenses this file to you under
14+
* the Apache License, Version 2.0 (the "License"); you may
15+
* not use this file except in compliance with the License.
16+
* You may obtain a copy of the License at
17+
*
18+
* http://www.apache.org/licenses/LICENSE-2.0
19+
*
20+
* Unless required by applicable law or agreed to in writing,
21+
* software distributed under the License is distributed on an
22+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23+
* KIND, either express or implied. See the License for the
24+
* specific language governing permissions and limitations
25+
* under the License.
26+
*/
27+
28+
/*
29+
* Modifications Copyright OpenSearch Contributors. See
30+
* GitHub history for details.
31+
*/
32+
33+
grant {
34+
// Hadoop UserGroupInformation, HdfsConstants, PipelineAck clinit
35+
permission java.lang.RuntimePermission "getClassLoader";
36+
37+
// UserGroupInformation (UGI) Metrics clinit
38+
permission java.lang.RuntimePermission "accessDeclaredMembers";
39+
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
40+
41+
// Needed so that Hadoop can load the correct classes for SPI and JAAS
42+
// org.apache.hadoop.security.SecurityUtil clinit
43+
// org.apache.hadoop.security.UserGroupInformation.newLoginContext()
44+
permission java.lang.RuntimePermission "setContextClassLoader";
45+
46+
// org.apache.hadoop.util.StringUtils clinit
47+
permission java.util.PropertyPermission "*", "read,write";
48+
49+
// org.apache.hadoop.util.ShutdownHookManager clinit
50+
permission java.lang.RuntimePermission "shutdownHooks";
51+
52+
// JAAS is used by Hadoop for authentication purposes
53+
// The Hadoop Login JAAS module modifies a Subject's private credentials and principals
54+
// The Hadoop RPC Layer must be able to read these credentials, and initiate Kerberos connections
55+
56+
// org.apache.hadoop.security.UserGroupInformation.getCurrentUser()
57+
permission javax.security.auth.AuthPermission "getSubject";
58+
59+
// org.apache.hadoop.security.UserGroupInformation.doAs()
60+
permission javax.security.auth.AuthPermission "doAs";
61+
62+
// org.apache.hadoop.security.UserGroupInformation.getCredentialsInternal()
63+
permission javax.security.auth.PrivateCredentialPermission "org.apache.hadoop.security.Credentials * \"*\"", "read";
64+
65+
// Hadoop depends on the Kerberos login module for kerberos authentication
66+
// com.sun.security.auth.module.Krb5LoginModule.login()
67+
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.krb5";
68+
69+
// com.sun.security.auth.module.Krb5LoginModule.commit()
70+
permission javax.security.auth.AuthPermission "modifyPrivateCredentials";
71+
permission javax.security.auth.AuthPermission "modifyPrincipals";
72+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KeyTab * \"*\"", "read";
73+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KerberosTicket * \"*\"", "read";
74+
75+
// Hadoop depends on OS level user information for simple authentication
76+
// Unix: UnixLoginModule: com.sun.security.auth.module.UnixSystem.UnixSystem init
77+
permission java.lang.RuntimePermission "loadLibrary.jaas";
78+
permission java.lang.RuntimePermission "loadLibrary.jaas_unix";
79+
// Windows: NTLoginModule: com.sun.security.auth.module.NTSystem.loadNative
80+
permission java.lang.RuntimePermission "loadLibrary.jaas_nt";
81+
permission javax.security.auth.AuthPermission "modifyPublicCredentials";
82+
83+
// org.apache.hadoop.security.SaslRpcServer.init()
84+
permission java.security.SecurityPermission "putProviderProperty.SaslPlainServer";
85+
86+
// org.apache.hadoop.security.SaslPlainServer.SecurityProvider.SecurityProvider init
87+
permission java.security.SecurityPermission "insertProvider.SaslPlainServer";
88+
89+
// org.apache.hadoop.security.SaslRpcClient.getServerPrincipal -> KerberosPrincipal init
90+
permission javax.security.auth.kerberos.ServicePermission "*", "initiate";
91+
92+
// hdfs client opens socket connections for to access repository
93+
permission java.net.SocketPermission "*", "connect";
94+
95+
// client binds to the address returned from the host name of any principal set up as a service principal
96+
// org.apache.hadoop.ipc.Client.Connection.setupConnection
97+
permission java.net.SocketPermission "localhost:0", "listen,resolve";
98+
};

‎plugins/repository-hdfs/src/test/resources/rest-api-spec/test/secure_hdfs_repository/test.policy

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
/*
10+
* Licensed to Elasticsearch under one or more contributor
11+
* license agreements. See the NOTICE file distributed with
12+
* this work for additional information regarding copyright
13+
* ownership. Elasticsearch licenses this file to you under
14+
* the Apache License, Version 2.0 (the "License"); you may
15+
* not use this file except in compliance with the License.
16+
* You may obtain a copy of the License at
17+
*
18+
* http://www.apache.org/licenses/LICENSE-2.0
19+
*
20+
* Unless required by applicable law or agreed to in writing,
21+
* software distributed under the License is distributed on an
22+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23+
* KIND, either express or implied. See the License for the
24+
* specific language governing permissions and limitations
25+
* under the License.
26+
*/
27+
28+
/*
29+
* Modifications Copyright OpenSearch Contributors. See
30+
* GitHub history for details.
31+
*/
32+
33+
grant {
34+
// Hadoop UserGroupInformation, HdfsConstants, PipelineAck clinit
35+
permission java.lang.RuntimePermission "getClassLoader";
36+
37+
// UserGroupInformation (UGI) Metrics clinit
38+
permission java.lang.RuntimePermission "accessDeclaredMembers";
39+
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
40+
41+
// Needed so that Hadoop can load the correct classes for SPI and JAAS
42+
// org.apache.hadoop.security.SecurityUtil clinit
43+
// org.apache.hadoop.security.UserGroupInformation.newLoginContext()
44+
permission java.lang.RuntimePermission "setContextClassLoader";
45+
46+
// org.apache.hadoop.util.StringUtils clinit
47+
permission java.util.PropertyPermission "*", "read,write";
48+
49+
// org.apache.hadoop.util.ShutdownHookManager clinit
50+
permission java.lang.RuntimePermission "shutdownHooks";
51+
52+
// JAAS is used by Hadoop for authentication purposes
53+
// The Hadoop Login JAAS module modifies a Subject's private credentials and principals
54+
// The Hadoop RPC Layer must be able to read these credentials, and initiate Kerberos connections
55+
56+
// org.apache.hadoop.security.UserGroupInformation.getCurrentUser()
57+
permission javax.security.auth.AuthPermission "getSubject";
58+
59+
// org.apache.hadoop.security.UserGroupInformation.doAs()
60+
permission javax.security.auth.AuthPermission "doAs";
61+
62+
// org.apache.hadoop.security.UserGroupInformation.getCredentialsInternal()
63+
permission javax.security.auth.PrivateCredentialPermission "org.apache.hadoop.security.Credentials * \"*\"", "read";
64+
65+
// Hadoop depends on the Kerberos login module for kerberos authentication
66+
// com.sun.security.auth.module.Krb5LoginModule.login()
67+
permission java.lang.RuntimePermission "accessClassInPackage.sun.security.krb5";
68+
69+
// com.sun.security.auth.module.Krb5LoginModule.commit()
70+
permission javax.security.auth.AuthPermission "modifyPrivateCredentials";
71+
permission javax.security.auth.AuthPermission "modifyPrincipals";
72+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KeyTab * \"*\"", "read";
73+
permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KerberosTicket * \"*\"", "read";
74+
75+
// Hadoop depends on OS level user information for simple authentication
76+
// Unix: UnixLoginModule: com.sun.security.auth.module.UnixSystem.UnixSystem init
77+
permission java.lang.RuntimePermission "loadLibrary.jaas";
78+
permission java.lang.RuntimePermission "loadLibrary.jaas_unix";
79+
// Windows: NTLoginModule: com.sun.security.auth.module.NTSystem.loadNative
80+
permission java.lang.RuntimePermission "loadLibrary.jaas_nt";
81+
permission javax.security.auth.AuthPermission "modifyPublicCredentials";
82+
83+
// org.apache.hadoop.security.SaslRpcServer.init()
84+
permission java.security.SecurityPermission "putProviderProperty.SaslPlainServer";
85+
86+
// org.apache.hadoop.security.SaslPlainServer.SecurityProvider.SecurityProvider init
87+
permission java.security.SecurityPermission "insertProvider.SaslPlainServer";
88+
89+
// org.apache.hadoop.security.SaslRpcClient.getServerPrincipal -> KerberosPrincipal init
90+
permission javax.security.auth.kerberos.ServicePermission "*", "initiate";
91+
92+
// hdfs client opens socket connections for to access repository
93+
permission java.net.SocketPermission "*", "connect";
94+
95+
// client binds to the address returned from the host name of any principal set up as a service principal
96+
// org.apache.hadoop.ipc.Client.Connection.setupConnection
97+
permission java.net.SocketPermission "localhost:0", "listen,resolve";
98+
};

‎server/src/test/java/org/opensearch/ExceptionSerializationTests.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@
162162

163163
public class ExceptionSerializationTests extends OpenSearchTestCase {
164164

165+
@AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/16731")
165166
public void testExceptionRegistration() throws ClassNotFoundException, IOException, URISyntaxException {
166167
final Set<Class<?>> notRegistered = new HashSet<>();
167168
final Set<Class<?>> hasDedicatedWrite = new HashSet<>();

‎server/src/test/resources/org/opensearch/bootstrap/test.policy

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ grant {
1111
permission java.util.PropertyPermission "*", "read,write";
1212
permission java.security.SecurityPermission "createPolicy.JavaPolicy";
1313
permission java.net.NetPermission "accessUnixDomainSocket";
14+
permission java.net.SocketPermission "*", "accept,connect";
1415
};
1516

1617
grant codeBase "${codebase.framework}" {

‎server/src/test/resources/org/opensearch/index/fielddata/ordinals/test.policy

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
grant {
10+
// allow to test Security policy and codebases
11+
permission java.util.PropertyPermission "*", "read,write";
12+
permission java.security.SecurityPermission "createPolicy.JavaPolicy";
13+
permission java.net.NetPermission "accessUnixDomainSocket";
14+
permission java.net.SocketPermission "*", "accept,connect";
15+
};

‎server/src/test/resources/org/opensearch/index/translog/test.policy

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
grant {
10+
// allow to test Security policy and codebases
11+
permission java.net.NetPermission "accessUnixDomainSocket";
12+
permission java.net.SocketPermission "*", "accept,connect";
13+
};

‎test/framework/src/test/java/org/opensearch/transport/nio/SimpleMockNioTransportTests.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ protected int channelsPerNodeConnection() {
9797
return 3;
9898
}
9999

100+
@AwaitsFix(bugUrl = "https://github.com/opensearch-project/OpenSearch/pull/16731")
100101
public void testConnectException() throws UnknownHostException {
101102
try {
102103
serviceA.connectToNode(

‎test/framework/src/test/resources/org/opensearch/bootstrap/test.policy

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,10 @@
88

99
grant codeBase "${codebase.opensearch-nio}" {
1010
permission java.net.NetPermission "accessUnixDomainSocket";
11+
permission java.net.SocketPermission "*", "connect,resolve";
1112
};
1213

1314
grant {
1415
permission java.net.NetPermission "accessUnixDomainSocket";
16+
permission java.net.SocketPermission "*", "connect,resolve";
1517
};

0 commit comments

Comments
 (0)