natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Hostname verification for node-to-node encryption 

patch by Stefan Podkowinski; reviewed by Robert Stupp for CASSANDRA-9220
This commit is contained in:
Stefan Podkowinski 2016-03-28 13:02:50 +02:00 committed by Robert Stupp
parent b6ff7f6c0d
commit c9c9c42263
4 changed files with 36 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
3.6
* Add require_endpoint_verification opt for internode encryption (CASSANDRA-9220)
* Add auto import java.util for UDF code block (CASSANDRA-11392)
* Add --hex-format option to nodetool getsstables (CASSANDRA-11337)
* sstablemetadata should print sstable min/max token (CASSANDRA-7159)

1
conf/cassandra.yaml
View File

@ -906,6 +906,7 @@ server_encryption_options:
# store_type: JKS
# cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA]
# require_client_auth: false
# require_endpoint_verification: false
# enable or disable client/server encryption.
client_encryption_options:

1
src/java/org/apache/cassandra/config/EncryptionOptions.java
View File

@ -30,6 +30,7 @@ public abstract class EncryptionOptions
public String algorithm = "SunX509";
public String store_type = "JKS";
public boolean require_client_auth = false;
public boolean require_endpoint_verification = false;
public static class ClientEncryptionOptions extends EncryptionOptions
{

42
src/java/org/apache/cassandra/security/SSLFactory.java
View File

@ -31,6 +31,7 @@ import java.util.List;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLParameters;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.TrustManager;
@ -60,10 +61,9 @@ public final class SSLFactory
SSLContext ctx = createSSLContext(options, true);
SSLServerSocket serverSocket = (SSLServerSocket)ctx.getServerSocketFactory().createServerSocket();
serverSocket.setReuseAddress(true);
String[] suites = filterCipherSuites(serverSocket.getSupportedCipherSuites(), options.cipher_suites);
serverSocket.setEnabledCipherSuites(suites);
serverSocket.setNeedClientAuth(options.require_client_auth);
prepareSocket(serverSocket, options);
serverSocket.bind(new InetSocketAddress(address, port), 500);
return serverSocket;
}
@ -72,8 +72,7 @@ public final class SSLFactory
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port, localAddress, localPort);
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
prepareSocket(socket, options);
return socket;
}
@ -82,8 +81,7 @@ public final class SSLFactory
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port);
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
prepareSocket(socket, options);
return socket;
}
@ -92,11 +90,37 @@ public final class SSLFactory
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket();
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
socket.setEnabledCipherSuites(suites);
prepareSocket(socket, options);
return socket;
}
/** Sets relevant socket options specified in encryption settings */
private static void prepareSocket(SSLServerSocket serverSocket, EncryptionOptions options)
{
String[] suites = filterCipherSuites(serverSocket.getSupportedCipherSuites(), options.cipher_suites);
if(options.require_endpoint_verification)
{
SSLParameters sslParameters = serverSocket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
serverSocket.setSSLParameters(sslParameters);
}
serverSocket.setEnabledCipherSuites(suites);
serverSocket.setNeedClientAuth(options.require_client_auth);
}
/** Sets relevant socket options specified in encryption settings */
private static void prepareSocket(SSLSocket socket, EncryptionOptions options)
{
String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
if(options.require_endpoint_verification)
{
SSLParameters sslParameters = socket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
socket.setSSLParameters(sslParameters);
}
socket.setEnabledCipherSuites(suites);
}
@SuppressWarnings("resource")
public static SSLContext createSSLContext(EncryptionOptions options, boolean buildTruststore) throws IOException
{