Skip to content

Commit 78389f0

Browse files
albertzaharovitsalbertzaharovits
committed
Fix deprecation of audit log settings (#36175)
I have botched deprecating the "prefix" logfile audit settings in #34475 , by not registering them. This commit fixes it and also adds a test that these deprecated settings are indeed still working and are dynamic. Closes #36162
1 parent 290fbe5 commit 78389f0

File tree

3 files changed

+54
-4
lines changed

3 files changed

+54
-4
lines changed

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/DeprecatedLoggingAuditTrail.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,11 @@ public DeprecatedLoggingAuditTrail(Settings settings, ClusterService clusterServ
9999
// always read before `localNodeInfo` and `includeRequestBody`.
100100
this.events = parse(LoggingAuditTrail.INCLUDE_EVENT_SETTINGS.get(newSettings),
101101
LoggingAuditTrail.EXCLUDE_EVENT_SETTINGS.get(newSettings));
102-
}, Arrays.asList(LoggingAuditTrail.EMIT_HOST_ADDRESS_SETTING, LoggingAuditTrail.EMIT_HOST_NAME_SETTING,
103-
LoggingAuditTrail.EMIT_NODE_NAME_SETTING, LoggingAuditTrail.INCLUDE_EVENT_SETTINGS,
104-
LoggingAuditTrail.EXCLUDE_EVENT_SETTINGS, LoggingAuditTrail.INCLUDE_REQUEST_BODY));
102+
}, Arrays.asList(LoggingAuditTrail.EMIT_HOST_ADDRESS_SETTING, LoggingAuditTrail.DEPRECATED_EMIT_HOST_ADDRESS_SETTING,
103+
LoggingAuditTrail.EMIT_HOST_NAME_SETTING, LoggingAuditTrail.DEPRECATED_EMIT_NODE_NAME_SETTING,
104+
LoggingAuditTrail.EMIT_NODE_NAME_SETTING, LoggingAuditTrail.DEPRECATED_EMIT_NODE_NAME_SETTING,
105+
LoggingAuditTrail.INCLUDE_EVENT_SETTINGS, LoggingAuditTrail.EXCLUDE_EVENT_SETTINGS,
106+
LoggingAuditTrail.INCLUDE_REQUEST_BODY));
105107
clusterService.getClusterSettings().addAffixUpdateConsumer(LoggingAuditTrail.FILTER_POLICY_IGNORE_PRINCIPALS,
106108
(policyName, filtersList) -> {
107109
final Optional<EventFilterPolicy> policy = eventFilterPolicyRegistry.get(policyName);

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,8 @@ public LoggingAuditTrail(Settings settings, ClusterService clusterService, Threa
184184
// `entryCommonFields` and `includeRequestBody` writes happen-before! `events` is
185185
// always read before `entryCommonFields` and `includeRequestBody`.
186186
this.events = parse(INCLUDE_EVENT_SETTINGS.get(newSettings), EXCLUDE_EVENT_SETTINGS.get(newSettings));
187-
}, Arrays.asList(EMIT_HOST_ADDRESS_SETTING, EMIT_HOST_NAME_SETTING, EMIT_NODE_NAME_SETTING, EMIT_NODE_ID_SETTING,
187+
}, Arrays.asList(EMIT_HOST_ADDRESS_SETTING, DEPRECATED_EMIT_HOST_ADDRESS_SETTING, EMIT_HOST_NAME_SETTING,
188+
DEPRECATED_EMIT_HOST_NAME_SETTING, EMIT_NODE_NAME_SETTING, DEPRECATED_EMIT_NODE_NAME_SETTING, EMIT_NODE_ID_SETTING,
188189
INCLUDE_EVENT_SETTINGS, EXCLUDE_EVENT_SETTINGS, INCLUDE_REQUEST_BODY));
189190
clusterService.getClusterSettings().addAffixUpdateConsumer(FILTER_POLICY_IGNORE_PRINCIPALS, (policyName, filtersList) -> {
190191
final Optional<EventFilterPolicy> policy = eventFilterPolicyRegistry.get(policyName);
@@ -759,8 +760,11 @@ private static String effectiveRealmName(Authentication authentication) {
759760

760761
public static void registerSettings(List<Setting<?>> settings) {
761762
settings.add(EMIT_HOST_ADDRESS_SETTING);
763+
settings.add(DEPRECATED_EMIT_HOST_ADDRESS_SETTING);
762764
settings.add(EMIT_HOST_NAME_SETTING);
765+
settings.add(DEPRECATED_EMIT_HOST_NAME_SETTING);
763766
settings.add(EMIT_NODE_NAME_SETTING);
767+
settings.add(DEPRECATED_EMIT_NODE_NAME_SETTING);
764768
settings.add(EMIT_NODE_ID_SETTING);
765769
settings.add(INCLUDE_EVENT_SETTINGS);
766770
settings.add(EXCLUDE_EVENT_SETTINGS);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/audit/logfile/AuditTrailSettingsUpdateTests.java‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@ protected Settings nodeSettings(int nodeOrdinal) {
6565
settingsBuilder.put("xpack.security.audit.outputs", "logfile");
6666
// add only startup filter policies
6767
settingsBuilder.put(startupFilterSettings);
68+
// Remove non-deprecated version of prefix settings so that we can test the deprecated variant
69+
settingsBuilder.remove(LoggingAuditTrail.EMIT_HOST_ADDRESS_SETTING.getKey());
70+
settingsBuilder.remove(LoggingAuditTrail.EMIT_HOST_NAME_SETTING.getKey());
71+
settingsBuilder.remove(LoggingAuditTrail.EMIT_NODE_NAME_SETTING.getKey());
6872
return settingsBuilder.build();
6973
}
7074

@@ -147,6 +151,46 @@ public void testDynamicHostSettings() {
147151
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is(false));
148152
}
149153

154+
public void testDynamicHostDeprecatedSettings() {
155+
final Settings.Builder settingsBuilder = Settings.builder();
156+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_NAME_SETTING.getKey(), true);
157+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_ADDRESS_SETTING.getKey(), true);
158+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_NODE_NAME_SETTING.getKey(), true);
159+
final boolean persistent = randomBoolean();
160+
updateSettings(settingsBuilder.build(), persistent);
161+
final LoggingAuditTrail loggingAuditTrail = (LoggingAuditTrail) internalCluster().getInstances(AuditTrailService.class)
162+
.iterator()
163+
.next()
164+
.getAuditTrails()
165+
.iterator()
166+
.next();
167+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.NODE_NAME_FIELD_NAME), startsWith("node_"));
168+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.HOST_ADDRESS_FIELD_NAME), is("127.0.0.1"));
169+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is("127.0.0.1"));
170+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_ADDRESS_SETTING.getKey(), false);
171+
updateSettings(settingsBuilder.build(), persistent);
172+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.NODE_NAME_FIELD_NAME), startsWith("node_"));
173+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_ADDRESS_FIELD_NAME), is(false));
174+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is("127.0.0.1"));
175+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_NAME_SETTING.getKey(), false);
176+
updateSettings(settingsBuilder.build(), persistent);
177+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.NODE_NAME_FIELD_NAME), startsWith("node_"));
178+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_ADDRESS_FIELD_NAME), is(false));
179+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is(false));
180+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_NODE_NAME_SETTING.getKey(), false);
181+
updateSettings(settingsBuilder.build(), persistent);
182+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.NODE_NAME_FIELD_NAME), is(false));
183+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_ADDRESS_FIELD_NAME), is(false));
184+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.containsKey(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is(false));
185+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_NAME_SETTING.getKey(), true);
186+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_HOST_ADDRESS_SETTING.getKey(), true);
187+
settingsBuilder.put(LoggingAuditTrail.DEPRECATED_EMIT_NODE_NAME_SETTING.getKey(), true);
188+
updateSettings(settingsBuilder.build(), persistent);
189+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.NODE_NAME_FIELD_NAME), startsWith("node_"));
190+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.HOST_ADDRESS_FIELD_NAME), is("127.0.0.1"));
191+
assertThat(loggingAuditTrail.entryCommonFields.commonFields.get(LoggingAuditTrail.HOST_NAME_FIELD_NAME), is("127.0.0.1"));
192+
}
193+
150194
public void testDynamicRequestBodySettings() {
151195
final boolean persistent = randomBoolean();
152196
final boolean enableRequestBody = randomBoolean();

0 commit comments

Comments
 (0)