Numeric Passphrases Invalid SSL Config

mgaetano · April 8, 2020, 7:30pm

elasticsearch: 7.6.2
readonlyrest: 1.19.2

If the value of keystore_pass or key_pass only consists of numbers RoR throws Invalid ROR SSL configuration exception. This was found during an upgrade from ES 7.4.0, RoR 1.18.2 where this configuration was considered operational.

Note: error is thrown with or without quotations.

Example SSL Configuration

ssl:
  keystore_file: "keystore.jks"
  keystore_pass: "123456"
  key_pass: "123456"

Example Exception

java.lang.IllegalStateException: failed to load plugin class [tech.beshu.ror.es.ReadonlyRestPlugin]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:313) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:257) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) [elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) [elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) [elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) [elasticsearch-cli-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.6.2.jar:7.6.2]
Caused by: java.lang.reflect.InvocationTargetException
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 15 more
Caused by: org.elasticsearch.ElasticsearchException: Invalid ROR SSL configuration
        at tech.beshu.ror.es.ReadonlyRestPlugin.$anonfun$sslConfig$2(ReadonlyRestPlugin.scala:91) ~[?:?]
        at scala.util.Either.fold(Either.scala:192) ~[?:?]
        at tech.beshu.ror.es.ReadonlyRestPlugin.$anonfun$sslConfig$1(ReadonlyRestPlugin.scala:91) ~[?:?]
        at monix.eval.Task$Map.apply(Task.scala:4514) ~[?:?]
        at monix.eval.Task$Map.apply(Task.scala:4510) ~[?:?]
        at monix.eval.internal.TaskRunSyncUnsafe$.apply(TaskRunSyncUnsafe.scala:107) ~[?:?]
        at monix.eval.Task.runSyncUnsafeOpt(Task.scala:1096) ~[?:?]
        at monix.eval.Task.runSyncUnsafe(Task.scala:1063) ~[?:?]
        at tech.beshu.ror.es.ReadonlyRestPlugin.<init>(ReadonlyRestPlugin.scala:92) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 15 more
[2020-04-08T19:20:32,145][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [CGOMAASC605] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [tech.beshu.ror.es.ReadonlyRestPlugin]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.6.2.jar:7.6.2]
        at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.6.2.jar:7.6.2]
Caused by: java.lang.IllegalStateException: failed to load plugin class [tech.beshu.ror.es.ReadonlyRestPlugin]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:313) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:257) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 6 more
Caused by: java.lang.reflect.InvocationTargetException
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:313) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:257) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 6 more
Caused by: org.elasticsearch.ElasticsearchException: Invalid ROR SSL configuration
        at tech.beshu.ror.es.ReadonlyRestPlugin.$anonfun$sslConfig$2(ReadonlyRestPlugin.scala:91) ~[?:?]
        at scala.util.Either.fold(Either.scala:192) ~[?:?]
        at tech.beshu.ror.es.ReadonlyRestPlugin.$anonfun$sslConfig$1(ReadonlyRestPlugin.scala:91) ~[?:?]
        at monix.eval.Task$Map.apply(Task.scala:4514) ~[?:?]
        at monix.eval.Task$Map.apply(Task.scala:4510) ~[?:?]
        at monix.eval.internal.TaskRunSyncUnsafe$.apply(TaskRunSyncUnsafe.scala:107) ~[?:?]
        at monix.eval.Task.runSyncUnsafeOpt(Task.scala:1096) ~[?:?]
        at monix.eval.Task.runSyncUnsafe(Task.scala:1063) ~[?:?]
        at tech.beshu.ror.es.ReadonlyRestPlugin.<init>(ReadonlyRestPlugin.scala:92) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
        at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:313) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.node.Node.<init>(Node.java:257) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 6 more

sscarduzio · April 9, 2020, 7:17pm

Thanks for reporting, added to Jira (RORDEV-244)

strummer75 · April 14, 2020, 8:46pm

Getting the same issue myself for elasticsearch 7.5.1

strummer75 · April 15, 2020, 7:58pm

This was only happening for me with the tar.gz version of elasticsearch. I didn’t have this problem with the RPM version.

pondzix · June 30, 2020, 6:16am

Hi @mgaetano @strummer75 this issue should be fixed in next ROR release 1.21.0. Here are pre builds available so you could test

ES 7.6.2:

http://readonlyrest-data.s3.amazonaws.com/build/1.21.0-pre2/readonlyrest-1.21.0-pre2_es7.6.2.zip?AWSAccessKeyId=AKIA5SJIWBO54AGBERLX&Expires=1594102356&Signature=1E71VkkOLWKq4yeo0UNKjfPmJb4%3D

ES 7.5.1:

http://readonlyrest-data.s3.amazonaws.com/build/1.21.0-pre2/readonlyrest-1.21.0-pre2_es7.5.1.zip?AWSAccessKeyId=AKIA5SJIWBO54AGBERLX&Expires=1594102565&Signature=DpAnJp6IsIvc9dXfI%2Bu3Nsc5H5w%3D