elasticsearch-transport 7.5.0 → 7.17.7

data/lib/elasticsearch/transport/client.rb

@@ -1,18 +1,32 @@
-# Licensed to Elasticsearch B.V under one or more agreements.
-# Elasticsearch B.V licenses this file to you under the Apache 2.0 License.
-# See the LICENSE file in the project root for more information
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 require 'base64'
+require 'elasticsearch/transport/meta_header'
 
 module Elasticsearch
   module Transport
-
     # Handles communication with an Elasticsearch cluster.
     #
     # See {file:README.md README} for usage and code examples.
     #
     class Client
-      DEFAULT_TRANSPORT_CLASS  = Transport::HTTP::Faraday
+      include MetaHeader
+      DEFAULT_TRANSPORT_CLASS = Transport::HTTP::Faraday
 
       DEFAULT_LOGGER = lambda do
         require 'logger'
@@ -36,9 +50,15 @@ module Elasticsearch
       DEFAULT_HOST = 'localhost:9200'.freeze
 
       # The default port to use if connecting using a Cloud ID.
+      # Updated from 9243 to 443 in client version 7.10.1
       #
       # @since 7.2.0
-      DEFAULT_CLOUD_PORT = 9243
+      DEFAULT_CLOUD_PORT = 443
+
+      # The default port to use if not otherwise specified.
+      #
+      # @since 7.2.0
+      DEFAULT_PORT = 9200
 
       # Returns the transport object.
       #
@@ -72,6 +92,8 @@ module Elasticsearch
       #
       # @option arguments [Boolean,Number] :retry_on_failure   Retry X times when request fails before raising and
       #                                                        exception (false by default)
+      # @option arguments [Number] :delay_on_retry  Delay in milliseconds between each retry (0 by default)
+      #
       # @option arguments Array<Number> :retry_on_status Retry when specific status codes are returned
       #
       # @option arguments [Boolean] :reload_on_failure Reload connections after failure (false by default)
@@ -99,6 +121,15 @@ module Elasticsearch
       #   The default is false. Responses will automatically be inflated if they are compressed.
       #   If a custom transport object is used, it must handle the request compression and response inflation.
       #
+      # @option api_key [String, Hash] :api_key Use API Key Authentication, either the base64 encoding of `id` and `api_key`
+      #                                         joined by a colon as a String, or a hash with the `id` and `api_key` values.
+      # @option opaque_id_prefix [String] :opaque_id_prefix set a prefix for X-Opaque-Id when initializing the client.
+      #                                                     This will be prepended to the id you set before each request
+      #                                                     if you're using X-Opaque-Id
+      # @option enable_meta_header [Boolean] :enable_meta_header Enable sending the meta data header to Cloud.
+      #                                                          (Default: true)
+      # @option ca_fingerprint [String] :ca_fingerprint provide this value to only trust certificates that are signed by a specific CA certificate
+      #
       # @yield [faraday] Access and configure the `Faraday::Connection` instance directly with a block
       #
       def initialize(arguments={}, &block)
@@ -108,61 +139,140 @@ module Elasticsearch
         @arguments[:tracer] ||= @arguments[:trace] ? DEFAULT_TRACER.call() : nil
         @arguments[:reload_connections] ||= false
         @arguments[:retry_on_failure]   ||= false
+        @arguments[:delay_on_retry]     ||= 0
         @arguments[:reload_on_failure]  ||= false
         @arguments[:randomize_hosts]    ||= false
         @arguments[:transport_options]  ||= {}
         @arguments[:http]               ||= {}
+        @arguments[:enable_meta_header] = arguments.fetch(:enable_meta_header) { true }
         @options[:http]                 ||= {}
 
+        set_api_key if (@api_key = @arguments[:api_key])
+        set_compatibility_header if ENV['ELASTIC_CLIENT_APIVERSIONING']
+
         @seeds = extract_cloud_creds(@arguments)
         @seeds ||= __extract_hosts(@arguments[:hosts] ||
-                                     @arguments[:host] ||
-                                     @arguments[:url] ||
-                                     @arguments[:urls] ||
-                                     ENV['ELASTICSEARCH_URL'] ||
-                                     DEFAULT_HOST)
+                                   @arguments[:host] ||
+                                   @arguments[:url] ||
+                                   @arguments[:urls] ||
+                                   ENV['ELASTICSEARCH_URL'] ||
+                                   DEFAULT_HOST)
 
         @send_get_body_as = @arguments[:send_get_body_as] || 'GET'
+        @opaque_id_prefix = @arguments[:opaque_id_prefix] || nil
+        @ca_fingerprint = @arguments.delete(:ca_fingerprint)
 
         if @arguments[:request_timeout]
-          @arguments[:transport_options][:request] = { :timeout => @arguments[:request_timeout] }
+          @arguments[:transport_options][:request] = { timeout: @arguments[:request_timeout] }
         end
 
         if @arguments[:transport]
           @transport = @arguments[:transport]
         else
-          transport_class  = @arguments[:transport_class] || DEFAULT_TRANSPORT_CLASS
-          if transport_class == Transport::HTTP::Faraday
-            @transport = transport_class.new(:hosts => @seeds, :options => @arguments) do |faraday|
-              block.call faraday if block
-              unless (h = faraday.builder.handlers.last) && h.name.start_with?("Faraday::Adapter")
-                faraday.adapter(@arguments[:adapter] || __auto_detect_adapter)
-              end
-            end
-          else
-            @transport = transport_class.new(:hosts => @seeds, :options => @arguments)
-          end
+          @transport_class = @arguments[:transport_class] || DEFAULT_TRANSPORT_CLASS
+          @transport = if @transport_class == Transport::HTTP::Faraday
+                         @arguments[:adapter] ||= __auto_detect_adapter
+                         set_meta_header # from include MetaHeader
+                         @transport_class.new(hosts: @seeds, options: @arguments) do |faraday|
+                           faraday.adapter(@arguments[:adapter])
+                           block&.call faraday
+                         end
+                       else
+                         set_meta_header # from include MetaHeader
+                         @transport_class.new(hosts: @seeds, options: @arguments)
+                       end
         end
       end
 
       # Performs a request through delegation to {#transport}.
       #
-      def perform_request(method, path, params={}, body=nil, headers=nil)
+      def perform_request(method, path, params = {}, body = nil, headers = nil)
         method = @send_get_body_as if 'GET' == method && body
+        if (opaque_id = params.delete(:opaque_id))
+          headers = {} if headers.nil?
+          opaque_id = @opaque_id_prefix ? "#{@opaque_id_prefix}#{opaque_id}" : opaque_id
+          headers.merge!('X-Opaque-Id' => opaque_id)
+        end
+        validate_ca_fingerprints if @ca_fingerprint
         transport.perform_request(method, path, params, body, headers)
       end
 
       private
 
+      def set_api_key
+        @api_key = __encode(@api_key) if @api_key.is_a? Hash
+        add_header('Authorization' => "ApiKey #{@api_key}")
+        @arguments.delete(:user)
+        @arguments.delete(:password)
+      end
+
+      def set_compatibility_header
+        return unless ['1', 'true'].include?(ENV['ELASTIC_CLIENT_APIVERSIONING'])
+        return if instance_variable_get('@options').dig(:transport_options, :headers, 'Accept')
+
+        add_header(
+          {
+            'Accept' => 'application/vnd.elasticsearch+json; compatible-with=7',
+            'Content-Type' => 'application/vnd.elasticsearch+json; compatible-with=7'
+          }
+        )
+      end
+
+      def validate_ca_fingerprints
+        transport.connections.connections.each do |connection|
+          unless connection.host[:scheme] == 'https'
+            raise Elasticsearch::Transport::Transport::Error, 'CA fingerprinting can\'t be configured over http'
+          end
+
+          next if connection.verified
+
+          ctx = OpenSSL::SSL::SSLContext.new
+          socket = TCPSocket.new(connection.host[:host], connection.host[:port])
+          ssl = OpenSSL::SSL::SSLSocket.new(socket, ctx)
+          ssl.connect
+          cert_store = ssl.peer_cert_chain
+          matching_certs = cert_store.select do |cert|
+            OpenSSL::Digest::SHA256.hexdigest(cert.to_der).upcase == @ca_fingerprint.upcase.gsub(':', '')
+          end
+          if matching_certs.empty?
+            raise Elasticsearch::Transport::Transport::Error,
+                  'Server certificate CA fingerprint does not match the value configured in ca_fingerprint'
+          end
+
+          connection.verified = true
+        end
+      end
+
+      def add_header(header)
+        headers = @arguments[:transport_options]&.[](:headers) || {}
+        headers.merge!(header)
+        @arguments[:transport_options].merge!(
+          headers: headers
+        )
+      end
+
       def extract_cloud_creds(arguments)
-        return unless arguments[:cloud_id]
+        return unless arguments[:cloud_id] && !arguments[:cloud_id].empty?
+
         name = arguments[:cloud_id].split(':')[0]
         cloud_url, elasticsearch_instance = Base64.decode64(arguments[:cloud_id].gsub("#{name}:", '')).split('$')
-        [ { scheme: 'https',
+
+        if cloud_url.include?(':')
+          url, port = cloud_url.split(':')
+          host = "#{elasticsearch_instance}.#{url}"
+        else
+          host = "#{elasticsearch_instance}.#{cloud_url}"
+          port = arguments[:port] || DEFAULT_CLOUD_PORT
+        end
+        [
+          {
+            scheme: 'https',
             user: arguments[:user],
             password: arguments[:password],
-            host: "#{elasticsearch_instance}.#{cloud_url}",
-            port: arguments[:port] || DEFAULT_CLOUD_PORT } ]
+            host: host,
+            port: port.to_i
+          }
+        ]
       end
 
       # Normalizes and returns hosts configuration.
@@ -195,39 +305,47 @@ module Elasticsearch
 
       def __parse_host(host)
         host_parts = case host
-        when String
-          if host =~ /^[a-z]+\:\/\//
-            # Construct a new `URI::Generic` directly from the array returned by URI::split.
-            # This avoids `URI::HTTP` and `URI::HTTPS`, which supply default ports.
-            uri = URI::Generic.new(*URI.split(host))
-
-            { :scheme => uri.scheme,
-              :user => uri.user,
-              :password => uri.password,
-              :host => uri.host,
-              :path => uri.path,
-              :port => uri.port }
-          else
-            host, port = host.split(':')
-            { :host => host,
-              :port => port }
-          end
-        when URI
-          { :scheme => host.scheme,
-            :user => host.user,
-            :password => host.password,
-            :host => host.host,
-            :path => host.path,
-            :port => host.port }
-        when Hash
-          host
+                     when String
+                       if host =~ /^[a-z]+\:\/\//
+                         # Construct a new `URI::Generic` directly from the array returned by URI::split.
+                         # This avoids `URI::HTTP` and `URI::HTTPS`, which supply default ports.
+                         uri = URI::Generic.new(*URI.split(host))
+                         default_port = uri.scheme == 'https' ? 443 : DEFAULT_PORT
+                         {
+                           scheme: uri.scheme,
+                           user: uri.user,
+                           password: uri.password,
+                           host: uri.host,
+                           path: uri.path,
+                           port: uri.port || default_port
+                         }
+                       else
+                         host, port = host.split(':')
+                         { host: host, port: port }
+                       end
+                     when URI
+                       {
+                         scheme: host.scheme,
+                         user: host.user,
+                         password: host.password,
+                         host: host.host,
+                         path: host.path,
+                         port: host.port
+                       }
+                     when Hash
+                       host
+                     else
+                       raise ArgumentError, "Please pass host as a String, URI or Hash -- #{host.class} given."
+                     end
+        if @api_key
+          # Remove Basic Auth if using API KEY
+          host_parts.delete(:user)
+          host_parts.delete(:password)
         else
-          raise ArgumentError, "Please pass host as a String, URI or Hash -- #{host.class} given."
+          @options[:http][:user] ||= host_parts[:user]
+          @options[:http][:password] ||= host_parts[:password]
         end
 
-        @options[:http][:user] ||= host_parts[:user]
-        @options[:http][:password] ||= host_parts[:password]
-
         host_parts[:port] = host_parts[:port].to_i if host_parts[:port]
         host_parts[:path].chomp!('/') if host_parts[:path]
         host_parts
@@ -255,6 +373,13 @@ module Elasticsearch
           ::Faraday.default_adapter
         end
       end
+
+      # Encode credentials for the Authorization Header
+      # Credentials is the base64 encoding of id and api_key joined by a colon
+      # @see https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html
+      def __encode(api_key)
+        Base64.strict_encode64([api_key[:id], api_key[:api_key]].join(':'))
+      end
     end
   end
 end

data/lib/elasticsearch/transport/meta_header.rb

@@ -0,0 +1,135 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+
+module Elasticsearch
+  module Transport
+    # Methods for the Elastic meta header used by Cloud.
+    # X-Elastic-Client-Meta HTTP header which is used by Elastic Cloud and can be disabled when
+    # instantiating the Client with the :enable_meta_header parameter set to `false`.
+    #
+    module MetaHeader
+      def set_meta_header
+        return if @arguments[:enable_meta_header] == false
+
+        service, version = meta_header_service_version
+
+        meta_headers = {
+          service.to_sym => version,
+          rb: RUBY_VERSION,
+          t: Elasticsearch::Transport::VERSION
+        }
+        meta_headers.merge!(meta_header_engine) if meta_header_engine
+        meta_headers.merge!(meta_header_adapter) if meta_header_adapter
+
+        add_header({ 'x-elastic-client-meta' => meta_headers.map { |k, v| "#{k}=#{v}" }.join(',') })
+      end
+
+      def meta_header_service_version
+        if enterprise_search?
+          Elastic::ENTERPRISE_SERVICE_VERSION
+        elsif elasticsearch?
+          Elastic::ELASTICSEARCH_SERVICE_VERSION
+        elsif defined?(Elasticsearch::VERSION)
+          [:es, client_meta_version(Elasticsearch::VERSION)]
+        else
+          [:es, client_meta_version(Elasticsearch::Transport::VERSION)]
+        end
+      end
+
+      def enterprise_search?
+        defined?(Elastic::ENTERPRISE_SERVICE_VERSION) &&
+          called_from?('enterprise-search-ruby')
+      end
+
+      def elasticsearch?
+        defined?(Elastic::ELASTICSEARCH_SERVICE_VERSION) &&
+          called_from?('elasticsearch')
+      end
+
+      def called_from?(service)
+        !caller.select { |c| c.match?(service) }.empty?
+      end
+
+      # We return the current version if it's a release, but if it's a pre/alpha/beta release we
+      # return <VERSION_NUMBER>p
+      #
+      def client_meta_version(version)
+        regexp = /^([0-9]+\.[0-9]+\.[0-9]+)(\.?[a-z0-9.-]+)?$/
+        match = version.match(regexp)
+        return "#{match[1]}p" if (match[2])
+
+        version
+      end
+
+      def meta_header_engine
+        case RUBY_ENGINE
+        when 'ruby'
+          {}
+        when 'jruby'
+          { jv: ENV_JAVA['java.version'], jr: JRUBY_VERSION }
+        when 'rbx'
+          { rbx: RUBY_VERSION }
+        else
+          { RUBY_ENGINE.to_sym => RUBY_VERSION }
+        end
+      end
+
+      # This function tries to define the version for the Faraday adapter. If it hasn't been loaded
+      # by the time we're calling this method, it's going to report the adapter (if we know it) but
+      # return 0 as the version. It won't report anything when using a custom adapter we don't
+      # identify.
+      #
+      # Returns a Hash<adapter_alias, version>
+      #
+      def meta_header_adapter
+        if @transport_class == Transport::HTTP::Faraday
+          version = '0'
+          adapter_version = case @arguments[:adapter]
+                   when :patron
+                     version = Patron::VERSION if defined?(::Patron::VERSION)
+                     {pt: version}
+                   when :net_http
+                     version = if defined?(Net::HTTP::VERSION)
+                                 Net::HTTP::VERSION
+                               elsif defined?(Net::HTTP::HTTPVersion)
+                                 Net::HTTP::HTTPVersion
+                               end
+                     {nh: version}
+                   when :typhoeus
+                     version = Typhoeus::VERSION if defined?(::Typhoeus::VERSION)
+                     {ty: version}
+                   when :httpclient
+                     version = HTTPClient::VERSION if defined?(HTTPClient::VERSION)
+                     {hc: version}
+                   when :net_http_persistent
+                     version = Net::HTTP::Persistent::VERSION if defined?(Net::HTTP::Persistent::VERSION)
+                     {np: version}
+                   else
+                     {}
+                   end
+          {fd: Faraday::VERSION}.merge(adapter_version)
+        elsif defined?(Transport::HTTP::Curb) && @transport_class == Transport::HTTP::Curb
+          {cl: Curl::CURB_VERSION}
+        elsif defined?(Transport::HTTP::Manticore) && @transport_class == Transport::HTTP::Manticore
+          {mc: Manticore::VERSION}
+        end
+      end
+    end
+  end
+end

data/lib/elasticsearch/transport/redacted.rb

@@ -1,6 +1,19 @@
-# Licensed to Elasticsearch B.V under one or more agreements.
-# Elasticsearch B.V licenses this file to you under the Apache 2.0 License.
-# See the LICENSE file in the project root for more information
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 module Elasticsearch
   module Transport