Merge branch 'main' into fix/preserve-response-headers-on-context-restore

Author: KishoreKicha14

.github/workflows/issue-dedupe.yml

@@ -0,0 +1,40 @@
+---
+name: Issue Dedupe Main
+on:
+  issues:
+    types: [opened]
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: 'Issue number to check for duplicates'
+        required: true
+        type: string
+
+jobs:
+  detect-issue:
+    if: >-
+      (github.event_name == 'workflow_dispatch' &&
+       github.repository == 'opensearch-project/security') ||
+      (github.event_name == 'issues' &&
+       github.event.issue.user.type != 'Bot' &&
+       github.repository == 'opensearch-project/security')
+    uses: opensearch-project/opensearch-build/.github/workflows/issue-dedupe-detect.yml@main
+    permissions:
+      contents: read
+      issues: write
+      id-token: write
+    secrets:
+      BEDROCK_ACCESS_ROLE_ISSUE_DEDUPE: ${{ secrets.BEDROCK_ACCESS_ROLE_ISSUE_DEDUPE }}
+    with:
+      issue_number: ${{ inputs.issue_number || '' }}
+      grace_days: ${{ vars.DUPLICATE_GRACE_DAYS || '7' }}
+
+  auto-close-issue:
+    if: github.event_name == 'schedule' && github.repository == 'opensearch-project/security'
+    uses: opensearch-project/opensearch-build/.github/workflows/issue-dedupe-autoclose.yml@main
+    permissions:
+      issues: write
+    with:
+      grace_days: ${{ vars.DUPLICATE_GRACE_DAYS || '7' }}

.github/workflows/pr_review.yml

@@ -0,0 +1,30 @@
+---
+name: PR Review
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  Code-Diff-Analyzer:
+    uses: opensearch-project/opensearch-build/.github/workflows/code-diff-analyzer.yml@main
+    if: github.repository == 'opensearch-project/security'
+    permissions:
+      id-token: write  # github oidc to assume aws roles
+      pull-requests: write  # to create or update comment (peter-evans/create-or-update-comment)
+    secrets:
+      BEDROCK_ACCESS_ROLE: ${{ secrets.BEDROCK_ACCESS_ROLE }}
+    with:
+      skip_diff_analyzer_with_label_name: 'skip-diff-analyzer'
+      update_pr_comment_with_analyzer_report: true
+
+  Code-Diff-Reviewer:
+    uses: opensearch-project/opensearch-build/.github/workflows/code-diff-reviewer.yml@main
+    needs: Code-Diff-Analyzer
+    if: github.repository == 'opensearch-project/security'
+    permissions:
+      id-token: write  # github oidc to assume aws roles
+      pull-requests: write  # to create or update comment (peter-evans/create-or-update-comment)
+    secrets:
+      BEDROCK_ACCESS_ROLE: ${{ secrets.BEDROCK_ACCESS_ROLE }}
+    with:
+      skip_diff_reviewer_with_label_name: 'skip-diff-reviewer'

build.gradle

@@ -614,6 +614,8 @@ allprojects {
                 integrationTestImplementation ('com.jayway.jsonpath:json-path:2.10.0') {
                     exclude(group: 'net.minidev', module: 'json-smart')
                 }
+                integrationTestImplementation "io.projectreactor.netty:reactor-netty-core:${versions.reactor_netty}"
+                integrationTestImplementation "io.projectreactor.netty:reactor-netty-http:${versions.reactor_netty}"
             }
         }
     }

src/integrationTest/java/org/opensearch/security/ResourceFocusedTests.java

@@ -13,6 +13,9 @@
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
 import java.util.stream.Collectors;
@@ -31,14 +34,22 @@
 import org.junit.Test;
 
 import org.opensearch.action.index.IndexRequest;
+import org.opensearch.common.collect.Tuple;
+import org.opensearch.common.settings.Settings;
+import org.opensearch.http.HttpTransportSettings;
 import org.opensearch.test.framework.AsyncActions;
 import org.opensearch.test.framework.TestSecurityConfig;
 import org.opensearch.test.framework.TestSecurityConfig.User;
 import org.opensearch.test.framework.cluster.ClusterManager;
 import org.opensearch.test.framework.cluster.LocalCluster;
+import org.opensearch.test.framework.cluster.ReactorHttpClient;
 import org.opensearch.test.framework.cluster.TestRestClient;
 import org.opensearch.transport.client.Client;
 
+import io.netty.handler.codec.http.FullHttpResponse;
+import io.netty.handler.codec.http.HttpResponseStatus;
+import reactor.netty.http.HttpProtocol;
+
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.opensearch.action.support.WriteRequest.RefreshPolicy.IMMEDIATE;
@@ -64,11 +75,13 @@ public class ResourceFocusedTests {
             )
             .on("*")
     );
+    private static Map<String, Object> NODE_SETTINGS = Map.of(HttpTransportSettings.SETTING_HTTP_HTTP3_ENABLED.getKey(), true);
 
     @ClassRule
     public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.THREE_CLUSTER_MANAGERS)
         .authc(AUTHC_HTTPBASIC_INTERNAL)
         .users(ADMIN_USER, LIMITED_USER)
+        .nodeSettings(NODE_SETTINGS)
         .anonymousAuth(false)
         .doNotFailOnForbidden(true)
         .build();
@@ -86,38 +99,41 @@ public void testUnauthenticatedFewBig() {
         // Tweaks:
         final RequestBodySize size = RequestBodySize.XLarge;
         final String requestPath = "/*/_search";
-        final int parrallelism = 5;
+        final int parallelism = 5;
         final int totalNumberOfRequests = 100;
 
-        runResourceTest(size, requestPath, parrallelism, totalNumberOfRequests);
+        runResourceTest(size, requestPath, parallelism, totalNumberOfRequests);
+        runResourceTestWithGenericClient(size, requestPath, parallelism, totalNumberOfRequests);
     }
 
     @Test
     public void testUnauthenticatedManyMedium() {
         // Tweaks:
         final RequestBodySize size = RequestBodySize.Medium;
         final String requestPath = "/*/_search";
-        final int parrallelism = 20;
+        final int parallelism = 20;
         final int totalNumberOfRequests = 10_000;
 
-        runResourceTest(size, requestPath, parrallelism, totalNumberOfRequests);
+        runResourceTest(size, requestPath, parallelism, totalNumberOfRequests);
+        runResourceTestWithGenericClient(size, requestPath, parallelism, totalNumberOfRequests);
     }
 
     @Test
     public void testUnauthenticatedTonsSmall() {
         // Tweaks:
         final RequestBodySize size = RequestBodySize.Small;
         final String requestPath = "/*/_search";
-        final int parrallelism = 100;
+        final int parallelism = 100;
         final int totalNumberOfRequests = 15_000;
 
-        runResourceTest(size, requestPath, parrallelism, totalNumberOfRequests);
+        runResourceTest(size, requestPath, parallelism, totalNumberOfRequests);
+        runResourceTestWithGenericClient(size, requestPath, parallelism, totalNumberOfRequests);
     }
 
     private void runResourceTest(
         final RequestBodySize size,
         final String requestPath,
-        final int parrallelism,
+        final int parallelism,
         final int totalNumberOfRequests
     ) {
         final byte[] compressedRequestBody = createCompressedRequestBody(size);
@@ -127,14 +143,40 @@ private void runResourceTest(
                 post.setEntity(new ByteArrayEntity(compressedRequestBody, ContentType.APPLICATION_JSON));
                 TestRestClient.HttpResponse response = client.executeRequest(post);
                 return response.getStatusCode();
-            }, parrallelism, totalNumberOfRequests);
+            }, parallelism, totalNumberOfRequests);
 
             AsyncActions.getAll(requests, 2, TimeUnit.MINUTES).forEach((responseCode) -> {
                 assertThat(responseCode, equalTo(HttpStatus.SC_UNAUTHORIZED));
             });
         }
     }
 
+    private void runResourceTestWithGenericClient(
+        final RequestBodySize size,
+        final String requestPath,
+        final int parallelism,
+        final int totalNumberOfRequests
+    ) {
+        final byte[] compressedRequestBody = createCompressedRequestBody(size);
+        try (
+            final ReactorHttpClient client = cluster.getGenericClient(
+                HttpProtocol.HTTP3,
+                true,
+                Settings.builder().loadFromMap(NODE_SETTINGS).build()
+            )
+        ) {
+            List<Tuple<String, byte[]>> requestUris = new ArrayList<>();
+            for (int i = 0; i < totalNumberOfRequests; i++) {
+                requestUris.add(Tuple.tuple(requestPath, compressedRequestBody));
+            }
+
+            final Collection<FullHttpResponse> responses = client.post(requestUris, parallelism);
+            responses.stream()
+                .map(FullHttpResponse::status)
+                .forEach(responseCode -> assertThat(responseCode, equalTo(HttpResponseStatus.UNAUTHORIZED)));
+        }
+    }
+
     static enum RequestBodySize {
         Small(1),
         Medium(1_000),

src/integrationTest/java/org/opensearch/test/framework/cluster/OpenSearchClientProvider.java

@@ -65,10 +65,13 @@
 import org.opensearch.client.RestClient;
 import org.opensearch.client.RestClientBuilder;
 import org.opensearch.client.RestHighLevelClient;
+import org.opensearch.common.settings.Settings;
 import org.opensearch.security.support.PemKeyReader;
 import org.opensearch.test.framework.certificate.CertificateData;
 import org.opensearch.test.framework.certificate.TestCertificates;
 
+import reactor.netty.http.HttpProtocol;
+
 import static org.opensearch.security.ssl.util.SSLConfigConstants.DEFAULT_STORE_TYPE;
 import static org.opensearch.test.framework.cluster.TestRestClientConfiguration.getBasicAuthHeader;
 
@@ -227,13 +230,19 @@ default TestRestClient getRestClient(CertificateData useCertificateData, Header.
         return getRestClient(Arrays.asList(headers), useCertificateData);
     }
 
+    /**
+     * Returns a generic HTTP/1.1/HTTP 2.0/HTTP 3.0 client.
+     */
+    default ReactorHttpClient getGenericClient(HttpProtocol protocol, boolean secure, Settings settings) {
+        return new ReactorHttpClient(true, true, settings, getHttpAddress());
+    }
+
     default TestRestClient getRestClient(Header... headers) {
         return getRestClient((CertificateData) null, headers);
     }
 
     default TestRestClient getRestClient(List<Header> headers) {
         return createGenericClientRestClient(new TestRestClientConfiguration().headers(headers));
-
     }
 
     default TestRestClient getRestClient(List<Header> headers, CertificateData useCertificateData) {