@@ -307,6 +307,7 @@ public Iterator<Setting<?>> settings() {
307307 "ssl" ,
308308 (key ) -> Setting .groupSetting (key + "." , Property .Dynamic , Property .NodeScope , Property .Filtered ),
309309 TYPE_DEPENDENCY );
310+
310311 /**
311312 * Proxy setting to allow users to send requests to a remote cluster that requires a proxy base path.
312313 */
@@ -482,24 +483,36 @@ public HttpExporter(final Config config, final SSLService sslService, final Thre
482483 * Because it is not possible to re-read the secure settings during a dynamic update, we cannot rebuild the {@link SSLIOSessionStrategy}
483484 * (see {@link #configureSecurity(RestClientBuilder, Config, SSLService)} if this exporter has been configured with secure settings
484485 */
485- public static void registerSettingValidators (ClusterService clusterService ) {
486+ public static void registerSettingValidators (ClusterService clusterService , SSLService sslService ) {
486487 clusterService .getClusterSettings ().addAffixUpdateConsumer (SSL_SETTING ,
487488 (ignoreKey , ignoreSettings ) -> {
488489 // no-op update. We only care about the validator
489490 },
490- (namespace , settings ) -> {
491- final List <String > secureSettings = SSLConfigurationSettings .withoutPrefix ()
492- .getSecureSettingsInUse (settings )
493- .stream ()
494- .map (Setting ::getKey )
495- .collect (Collectors .toList ());
496- if (secureSettings .isEmpty () == false ) {
497- throw new IllegalStateException ("Cannot dynamically update SSL settings for the exporter [" + namespace
498- + "] as it depends on the secure setting(s) [" + Strings .collectionToCommaDelimitedString (secureSettings ) + "]" );
499- }
491+ (key , settings ) -> {
492+ validateSslSettings (key , settings );
493+ configureSslStrategy (settings , null , sslService );
500494 });
501495 }
502496
497+ /**
498+ * Validates that secure settings are not being used to rebuild the {@link SSLIOSessionStrategy}.
499+ *
500+ * @param exporter Name of the exporter to validate
501+ * @param settings Settings for the exporter
502+ * @throws IllegalStateException if any secure settings are used in the SSL configuration
503+ */
504+ private static void validateSslSettings (String exporter , Settings settings ) {
505+ final List <String > secureSettings = SSLConfigurationSettings .withoutPrefix ()
506+ .getSecureSettingsInUse (settings )
507+ .stream ()
508+ .map (Setting ::getKey )
509+ .collect (Collectors .toList ());
510+ if (secureSettings .isEmpty () == false ) {
511+ throw new IllegalStateException ("Cannot dynamically update SSL settings for the exporter [" + exporter
512+ + "] as it depends on the secure setting(s) [" + Strings .collectionToCommaDelimitedString (secureSettings ) + "]" );
513+ }
514+ }
515+
503516 /**
504517 * Create a {@link RestClientBuilder} from the HTTP Exporter's {@code config}.
505518 *
@@ -658,6 +671,30 @@ private static void configureHeaders(final RestClientBuilder builder, final Conf
658671 private static void configureSecurity (final RestClientBuilder builder , final Config config , final SSLService sslService ) {
659672 final Setting <Settings > concreteSetting = SSL_SETTING .getConcreteSettingForNamespace (config .name ());
660673 final Settings sslSettings = concreteSetting .get (config .settings ());
674+ final SSLIOSessionStrategy sslStrategy = configureSslStrategy (sslSettings , concreteSetting , sslService );
675+ final CredentialsProvider credentialsProvider = createCredentialsProvider (config );
676+ List <String > hostList = HOST_SETTING .getConcreteSettingForNamespace (config .name ()).get (config .settings ());
677+ // sending credentials in plaintext!
678+ if (credentialsProvider != null && hostList .stream ().findFirst ().orElse ("" ).startsWith ("https" ) == false ) {
679+ logger .warn ("exporter [{}] is not using https, but using user authentication with plaintext " +
680+ "username/password!" , config .name ());
681+ }
682+
683+ if (sslStrategy != null ) {
684+ builder .setHttpClientConfigCallback (new SecurityHttpClientConfigCallback (sslStrategy , credentialsProvider ));
685+ }
686+ }
687+
688+ /**
689+ * Configures the {@link SSLIOSessionStrategy} to use. Relies on {@link #registerSettingValidators(ClusterService, SSLService)}
690+ * to prevent invalid usage of secure settings in the SSL strategy.
691+ * @param sslSettings The exporter's SSL settings
692+ * @param concreteSetting Settings to use for {@link SSLConfiguration} if secure settings are used
693+ * @param sslService The SSL Service used to create the SSL Context necessary for TLS / SSL communication
694+ * @return Appropriately configured instance of {@link SSLIOSessionStrategy}
695+ */
696+ private static SSLIOSessionStrategy configureSslStrategy (final Settings sslSettings , final Setting <Settings > concreteSetting ,
697+ final SSLService sslService ) {
661698 final SSLIOSessionStrategy sslStrategy ;
662699 if (SSLConfigurationSettings .withoutPrefix ().getSecureSettingsInUse (sslSettings ).isEmpty ()) {
663700 // This configuration does not use secure settings, so it is possible that is has been dynamically updated.
@@ -670,17 +707,7 @@ private static void configureSecurity(final RestClientBuilder builder, final Con
670707 final SSLConfiguration sslConfiguration = sslService .getSSLConfiguration (concreteSetting .getKey ());
671708 sslStrategy = sslService .sslIOSessionStrategy (sslConfiguration );
672709 }
673- final CredentialsProvider credentialsProvider = createCredentialsProvider (config );
674- List <String > hostList = HOST_SETTING .getConcreteSettingForNamespace (config .name ()).get (config .settings ());
675- // sending credentials in plaintext!
676- if (credentialsProvider != null && hostList .stream ().findFirst ().orElse ("" ).startsWith ("https" ) == false ) {
677- logger .warn ("exporter [{}] is not using https, but using user authentication with plaintext " +
678- "username/password!" , config .name ());
679- }
680-
681- if (sslStrategy != null ) {
682- builder .setHttpClientConfigCallback (new SecurityHttpClientConfigCallback (sslStrategy , credentialsProvider ));
683- }
710+ return sslStrategy ;
684711 }
685712
686713 /**
0 commit comments