Allow JMX over SSL directly from nodetool

patch by Marcus Olsson, reviewed by jasobrown for CASSANDRA-9090

CHANGES.txt

@@ -1,4 +1,5 @@
 2.1.7
+ * Allow JMX over SSL directly from nodetool (CASSANDRA-9090)
  * Fix incorrect result for IN queries where column not found (CASSANDRA-9540)
  * ColumnFamilyStore.selectAndReference may block during compaction (CASSANDRA-9637)
  * Fix bug in cardinality check when compacting (CASSANDRA-9580)

bin/nodetool

@@ -56,6 +56,8 @@ fi
 # JMX Port passed via cmd line args (-p 9999 / --port 9999 / --port=9999)
 # should override the value from cassandra-env.sh
 ARGS=""
+JVM_ARGS=""
+SSL_FILE=$HOME/.cassandra/nodetool-ssl.properties
 while true
 do
   if [ ! $1 ]; then break; fi
@@ -71,6 +73,16 @@ do
       JMX_PORT=$2
       shift
       ;;
+    --ssl)
+      if [ -f $SSL_FILE ]
+      then 
+          SSL_ARGS=$(cat $SSL_FILE | tr '\n' ' ')
+      fi
+      JVM_ARGS="$JVM_ARGS -Dssl.enable=true $SSL_ARGS"
+      ;;
+    -D*)
+      JVM_ARGS="$JVM_ARGS $1"
+      ;;
     *)
       ARGS="$ARGS $1"
       ;;
@@ -91,6 +103,7 @@ esac
       -Dcassandra.storagedir="$cassandra_storagedir" \
       -Dlogback.configurationFile=logback-tools.xml \
       -Dstorage-config="$CASSANDRA_CONF" \
+      $JVM_ARGS \
       org.apache.cassandra.tools.NodeTool -p $JMX_PORT $ARGS
 
 # vi:ai sw=4 ts=4 tw=0 et

conf/cassandra-env.sh

@@ -286,6 +286,14 @@ else
   JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=false"
   JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true"
   JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.password.file=/etc/cassandra/jmxremote.password"
+#  JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=/path/to/keystore"
+#  JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=<keystore-password>"
+#  JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=/path/to/truststore"
+#  JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=<truststore-password>"
+#  JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=true"
+#  JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true"
+#  JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=<enabled-protocols>"
+#  JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=<enabled-cipher-suites>"
 fi
 
 # To use mx4j, an HTML interface for JMX, add mx4j-tools.jar to the lib/

src/java/org/apache/cassandra/tools/NodeProbe.java

@@ -27,6 +27,8 @@ import java.lang.management.MemoryUsage;
 import java.lang.management.RuntimeMXBean;
 import java.net.InetAddress;
 import java.net.UnknownHostException;
+import java.rmi.server.RMIClientSocketFactory;
+import java.rmi.server.RMISocketFactory;
 import java.text.SimpleDateFormat;
 import java.util.AbstractMap;
 import java.util.ArrayList;
@@ -58,6 +60,7 @@ import javax.management.remote.JMXConnectionNotification;
 import javax.management.remote.JMXConnector;
 import javax.management.remote.JMXConnectorFactory;
 import javax.management.remote.JMXServiceURL;
+import javax.rmi.ssl.SslRMIClientSocketFactory;
 
 import org.apache.cassandra.concurrent.JMXEnabledThreadPoolExecutorMBean;
 import org.apache.cassandra.db.ColumnFamilyStoreMBean;
@@ -182,6 +185,9 @@ public class NodeProbe implements AutoCloseable
             String[] creds = { username, password };
             env.put(JMXConnector.CREDENTIALS, creds);
         }
+
+        env.put("com.sun.jndi.rmi.factory.socket", getRMIClientSocketFactory());
+
         jmxc = JMXConnectorFactory.connect(jmxUrl, env);
         mbeanServerConn = jmxc.getMBeanServerConnection();
 
@@ -218,6 +224,14 @@ public class NodeProbe implements AutoCloseable
                 mbeanServerConn, ManagementFactory.RUNTIME_MXBEAN_NAME, RuntimeMXBean.class);
     }
 
+    private RMIClientSocketFactory getRMIClientSocketFactory() throws IOException
+    {
+        if (Boolean.parseBoolean(System.getProperty("ssl.enable")))
+            return new SslRMIClientSocketFactory();
+        else
+            return RMISocketFactory.getDefaultSocketFactory();
+    }
+
     public void close() throws IOException
     {
         jmxc.close();