Added restriction to no allow index options for clusterInfoOnly endpoint

quux00 · Jan 21, 2025 · d0f39ed · d0f39ed
1 parent 75f31c8
commit d0f39ed
Show file tree

Hide file tree

Showing 4 changed files with 70 additions and 3 deletions.
diff --git a/...in/java/org/elasticsearch/action/admin/indices/resolve/TransportResolveClusterAction.java b/...in/java/org/elasticsearch/action/admin/indices/resolve/TransportResolveClusterAction.java
@@ -110,7 +110,7 @@ protected void doExecuteForked(Task task, ResolveClusterActionRequest request, A
                  *    just "*" since that could be an expensive operation on clusters with thousands of indices/aliases/datastreams
                  */
                 String[] dummyIndexExpr = new String[] { DUMMY_INDEX_FOR_OLDER_CLUSTERS };
-                remoteClusterIndices = remoteClusterService.groupIndices(request.indicesOptions(), dummyIndexExpr, false);
+                remoteClusterIndices = remoteClusterService.groupIndices(IndicesOptions.DEFAULT, dummyIndexExpr, false);
                 if (remoteClusterIndices.isEmpty()) {
                     // no remote clusters are configured on the primary "querying" cluster
                     listener.onResponse(new ResolveClusterActionResponse(Map.of()));

diff --git a/...r/src/main/java/org/elasticsearch/rest/action/admin/indices/RestResolveClusterAction.java b/...r/src/main/java/org/elasticsearch/rest/action/admin/indices/RestResolveClusterAction.java
@@ -21,7 +21,9 @@
 import org.elasticsearch.rest.action.RestToXContentListener;
 
 import java.io.IOException;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import static org.elasticsearch.rest.RestRequest.Method.GET;
 
@@ -47,6 +49,14 @@ protected BaseRestHandler.RestChannelConsumer prepareRequest(RestRequest request
         } else {
             indexExpressions = new String[0];
             clusterInfoOnly = true;
+            Set<String> indexOptions = requestIndexOptionsParams(request);
+            if (indexOptions.isEmpty() == false) {
+                // this restriction avoids problems with having to send wildcarded index expressions to older clusters
+                // when no index expression is provided by the user
+                throw new IllegalArgumentException(
+                    "No index options are allowed on _resolve/cluster when no index expression is specified, but received: " + indexOptions
+                );
+            }
         }
         ResolveClusterActionRequest resolveRequest = new ResolveClusterActionRequest(
             indexExpressions,
@@ -58,4 +68,21 @@ protected BaseRestHandler.RestChannelConsumer prepareRequest(RestRequest request
             .indices()
             .execute(TransportResolveClusterAction.TYPE, resolveRequest, new RestToXContentListener<>(channel));
     }
+
+    private static Set<String> requestIndexOptionsParams(RestRequest request) {
+        Set<String> indexOptions = new HashSet<>();
+        if (request.hasParam("expand_wildcards")) {
+            indexOptions.add("expand_wildcards");
+        }
+        if (request.hasParam("ignore_unavailable")) {
+            indexOptions.add("ignore_unavailable");
+        }
+        if (request.hasParam("allow_no_indices")) {
+            indexOptions.add("allow_no_indices");
+        }
+        if (request.hasParam("ignore_throttled")) {
+            indexOptions.add("ignore_throttled");
+        }
+        return indexOptions;
+    }
 }
diff --git a/...java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1ResolveClusterIT.java b/...java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS1ResolveClusterIT.java
@@ -12,6 +12,7 @@
 import org.elasticsearch.client.Response;
 import org.elasticsearch.client.ResponseException;
 import org.elasticsearch.core.Strings;
+import org.elasticsearch.core.Tuple;
 import org.elasticsearch.test.cluster.ElasticsearchCluster;
 import org.junit.ClassRule;
 import org.junit.rules.RuleChain;
@@ -261,11 +262,30 @@ public void testResolveClusterUnderRCS1() throws Exception {
             assertNull(remoteClusterResponse.get("error"));
             assertNotNull(remoteClusterResponse.get("version"));
         }
+        {
+            // TEST CASE 12: Query resolve/cluster with no index expression, but include index options - should return error
+            Request getRequest = new Request("GET", "_resolve/cluster");
+            Tuple<String, String> indexOptionTuple = randomFrom(
+                new Tuple<>("ignore_throttled", "false"),
+                new Tuple<>("expand_wildcards", "none"),
+                new Tuple<>("allow_no_indices", "true"),
+                new Tuple<>("ignore_unavailable", "true")
+            );
+            getRequest.addParameter(indexOptionTuple.v1(), indexOptionTuple.v2());
+
+            ResponseException exc = expectThrows(ResponseException.class, () -> performRequestWithRemoteSearchUser(getRequest));
+            assertThat(exc.getResponse().getStatusLine().getStatusCode(), is(400));
+            assertThat(
+                exc.getMessage(),
+                containsString("No index options are allowed on _resolve/cluster when no index expression is specified")
+            );
+            assertThat(exc.getMessage(), containsString(indexOptionTuple.v1()));
+        }
         // TODO: The security pathways are not using the new
         // RemoteClusterService.groupIndices(IndicesOptions indicesOptions, String[] indices, boolean returnLocalAll) method
         // so this use case still behaves badly - fix in follow on PR
         // {
-        // // TEST CASE 12: Resolution against wildcarded remote cluster expression that matches no remotes
+        // // TEST CASE 13: Resolution against wildcarded remote cluster expression that matches no remotes
         // final Request remoteOnly1 = new Request("GET", "_resolve/cluster/no_such_remote*:*");
         // Response response = performRequestWithRemoteSearchUser(remoteOnly1);
         // assertOK(response);

diff --git a/...java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS2ResolveClusterIT.java b/...java/org/elasticsearch/xpack/remotecluster/RemoteClusterSecurityRCS2ResolveClusterIT.java
@@ -13,6 +13,7 @@
 import org.elasticsearch.client.ResponseException;
 import org.elasticsearch.common.UUIDs;
 import org.elasticsearch.core.Strings;
+import org.elasticsearch.core.Tuple;
 import org.elasticsearch.test.cluster.ElasticsearchCluster;
 import org.elasticsearch.test.cluster.util.resource.Resource;
 import org.elasticsearch.test.junit.RunnableTestRuleAdapter;
@@ -356,9 +357,28 @@ public void testResolveCluster() throws Exception {
             assertNull(remoteClusterResponse.get("error"));
             assertNotNull(remoteClusterResponse.get("version"));
         }
+        {
+            // TEST CASE 12: Query resolve/cluster with no index expression, but include index options - should return error
+            Request getRequest = new Request("GET", "_resolve/cluster");
+            Tuple<String, String> indexOptionTuple = randomFrom(
+                new Tuple<>("ignore_throttled", "false"),
+                new Tuple<>("expand_wildcards", "none"),
+                new Tuple<>("allow_no_indices", "true"),
+                new Tuple<>("ignore_unavailable", "true")
+            );
+            getRequest.addParameter(indexOptionTuple.v1(), indexOptionTuple.v2());
+
+            ResponseException exc = expectThrows(ResponseException.class, () -> performRequestWithRemoteSearchUser(getRequest));
+            assertThat(exc.getResponse().getStatusLine().getStatusCode(), is(400));
+            assertThat(
+                exc.getMessage(),
+                containsString("No index options are allowed on _resolve/cluster when no index expression is specified")
+            );
+            assertThat(exc.getMessage(), containsString(indexOptionTuple.v1()));
+        }
         // TODO: fix this in a follow-on PR
         // {
-        // // TEST CASE 12: Resolution against wildcarded remote cluster expression that matches no remotes
+        // // TEST CASE 13: Resolution against wildcarded remote cluster expression that matches no remotes
         // final Request remoteOnly1 = new Request("GET", "_resolve/cluster/no_such_remote*:*");
         // Response response = performRequestWithRemoteSearchUser(remoteOnly1);
         // assertOK(response);