From aa8c8429cf95f4d4430d7036d45287c6ba4a8a9b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Oct 2024 18:41:44 +0530 Subject: [PATCH 1/3] Set gRPC security interceptor to highest priority --- .../security/filter/SecurityGrpcFilter.java | 2 +- .../filter/SecurityGrpcFilterTest.java | 34 +++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/opensearch/security/filter/SecurityGrpcFilter.java b/src/main/java/org/opensearch/security/filter/SecurityGrpcFilter.java index 3bdebbae21..0618ff9ac1 100644 --- a/src/main/java/org/opensearch/security/filter/SecurityGrpcFilter.java +++ b/src/main/java/org/opensearch/security/filter/SecurityGrpcFilter.java @@ -69,7 +69,7 @@ public List getOrderedGrpcInterceptors(ThreadContext thr @Override public int order() { - return 0; + return Integer.MIN_VALUE; } @Override diff --git a/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java b/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java index a65214b9dd..c5ade044dc 100644 --- a/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java +++ b/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java @@ -94,4 +94,38 @@ public void testNormalConfigurationReturnsInterceptor() { assertTrue(e.getMessage().contains("GuiceHolder") || e instanceof NullPointerException); } } + + @Test + public void testInterceptorOrderIsMinValue() { + Settings settings = Settings.builder().put(OpenSearchSecuritySSLPlugin.CLIENT_TYPE, "node").build(); + + securityGrpcFilter.initNodeSettings(settings); + + List interceptors = securityGrpcFilter.getOrderedGrpcInterceptors(threadContext); + + assertEquals("Should return exactly one interceptor", 1, interceptors.size()); + assertEquals( + "Security interceptor should have highest priority (Integer.MIN_VALUE)", + Integer.MIN_VALUE, + interceptors.get(0).order() + ); + } + + @Test + public void testInterceptorOrderEnsuresSecurityRunsFirst() { + Settings settings = Settings.builder().put(OpenSearchSecuritySSLPlugin.CLIENT_TYPE, "node").build(); + + securityGrpcFilter.initNodeSettings(settings); + + List interceptors = securityGrpcFilter.getOrderedGrpcInterceptors(threadContext); + + // Verify security interceptor runs before any other possible interceptor + // by checking its order is the minimum possible value + int securityOrder = interceptors.get(0).order(); + assertTrue("Security interceptor order should be less than 0", securityOrder < 0); + assertTrue( + "Security interceptor should have the lowest possible order value for highest priority", + securityOrder <= Integer.MIN_VALUE + ); + } } From 04918087b95ec0edf2f0c3b3f8b310a3edd6900b Mon Sep 17 00:00:00 2001 From: Aparajita Pandey Date: Tue, 3 Feb 2026 20:54:10 +0530 Subject: [PATCH 2/3] add test coverage for SecurityGrpcFilter interceptor ordering Signed-off-by: Aparajita Pandey --- .../filter/SecurityGrpcFilterTest.java | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java b/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java index c5ade044dc..1c950e94b4 100644 --- a/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java +++ b/src/test/java/org/opensearch/security/filter/SecurityGrpcFilterTest.java @@ -110,22 +110,4 @@ public void testInterceptorOrderIsMinValue() { interceptors.get(0).order() ); } - - @Test - public void testInterceptorOrderEnsuresSecurityRunsFirst() { - Settings settings = Settings.builder().put(OpenSearchSecuritySSLPlugin.CLIENT_TYPE, "node").build(); - - securityGrpcFilter.initNodeSettings(settings); - - List interceptors = securityGrpcFilter.getOrderedGrpcInterceptors(threadContext); - - // Verify security interceptor runs before any other possible interceptor - // by checking its order is the minimum possible value - int securityOrder = interceptors.get(0).order(); - assertTrue("Security interceptor order should be less than 0", securityOrder < 0); - assertTrue( - "Security interceptor should have the lowest possible order value for highest priority", - securityOrder <= Integer.MIN_VALUE - ); - } } From d48b79b8a3616d66833055ae799e2fde14b58dec Mon Sep 17 00:00:00 2001 From: Aparajita Pandey Date: Wed, 4 Feb 2026 09:19:34 +0530 Subject: [PATCH 3/3] Add ChangeLog Entry Signed-off-by: Aparajita Pandey --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 28761043a8..60f4979ea0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ## [Unreleased 3.x] ### Added +- Set gRPC security interceptor to highest priority ([#5940](https://github.com/opensearch-project/security/pull/5940)) ### Changed