natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

client_encryption_options to use enabled 

Patch by aleksey reviewed by vijay for CASSANDRA-4994
This commit is contained in:
Vijay Parthasarathy 2012-11-27 00:35:52 -08:00
parent ef47089101
commit e3f48f2e34
10 changed files with 33 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
conf/cassandra.yaml
View File

@ -634,20 +634,16 @@ server_encryption_options:
# cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
# enable or disable client/server encryption.
# The available internode options are: none, all
client_encryption_options:
internode_encryption: none
enabled: false
keystore: conf/.keystore
keystore_password: cassandra
truststore: conf/.truststore
truststore_password: cassandra
# More advanced defaults below:
# protocol: TLS
# algorithm: SunX509
# store_type: JKS
# cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
# internode_compression controls whether traffic between nodes is
# compressed.
# can be: all - all traffic is compressed

3
src/java/org/apache/cassandra/cli/CliSessionState.java
View File

@ -22,6 +22,7 @@ import java.io.PrintStream;
import org.apache.cassandra.cli.transport.FramedTransportFactory;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
import org.apache.cassandra.tools.NodeProbe;
import org.apache.thrift.transport.TTransportFactory;
@ -43,7 +44,7 @@ public class CliSessionState
public boolean verbose = false; // verbose output
public int schema_mwt = 10 * 1000; // Schema migration wait time (secs.)
public TTransportFactory transportFactory = new FramedTransportFactory();
public EncryptionOptions encOptions = new EncryptionOptions();
public EncryptionOptions encOptions = new ClientEncryptionOptions();
/*
* Streams to read/write from

8
src/java/org/apache/cassandra/config/Config.java
View File

@ -18,6 +18,8 @@
package org.apache.cassandra.config;
import org.apache.cassandra.cache.SerializingCacheProvider;
import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
import org.apache.cassandra.io.util.NativeAllocator;
/**
@ -127,10 +129,10 @@ public class Config
public RequestSchedulerId request_scheduler_id;
public RequestSchedulerOptions request_scheduler_options;
public EncryptionOptions server_encryption_options = new EncryptionOptions();
public EncryptionOptions client_encryption_options = new EncryptionOptions();
public ServerEncryptionOptions server_encryption_options = new ServerEncryptionOptions();
public ClientEncryptionOptions client_encryption_options = new ClientEncryptionOptions();
// this encOptions is for backward compatibility (a warning is logged by DatabaseDescriptor)
public EncryptionOptions encryption_options;
public ServerEncryptionOptions encryption_options;
public InternodeCompression internode_compression = InternodeCompression.none;

6
src/java/org/apache/cassandra/config/DatabaseDescriptor.java
View File

@ -33,6 +33,8 @@ import org.slf4j.LoggerFactory;
import org.apache.cassandra.auth.*;
import org.apache.cassandra.cache.IRowCacheProvider;
import org.apache.cassandra.config.Config.RequestSchedulerId;
import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
import org.apache.cassandra.db.ColumnFamilyStore;
import org.apache.cassandra.db.DefsTable;
import org.apache.cassandra.db.SystemTable;
@ -1094,12 +1096,12 @@ public class DatabaseDescriptor
conf.dynamic_snitch_badness_threshold = dynamicBadnessThreshold;
}
public static EncryptionOptions getServerEncryptionOptions()
public static ServerEncryptionOptions getServerEncryptionOptions()
{
return conf.server_encryption_options;
}
public static EncryptionOptions getClientEncryptionOptions()
public static ClientEncryptionOptions getClientEncryptionOptions()
{
return conf.client_encryption_options;
}

20
src/java/org/apache/cassandra/config/EncryptionOptions.java
View File

@ -17,9 +17,8 @@
*/
package org.apache.cassandra.config;
public class EncryptionOptions
public abstract class EncryptionOptions
{
public InternodeEncryption internode_encryption = InternodeEncryption.none;
public String keystore = "conf/.keystore";
public String keystore_password = "cassandra";
public String truststore = "conf/.truststore";
@ -29,12 +28,17 @@ public class EncryptionOptions
public String algorithm = "SunX509";
public String store_type = "JKS";
public static enum InternodeEncryption
public static class ClientEncryptionOptions extends EncryptionOptions
{
all,
none,
dc,
rack
public boolean enabled = false;
}
public static class ServerEncryptionOptions extends EncryptionOptions
{
public static enum InternodeEncryption
{
all, none, dc, rack
}
public InternodeEncryption internode_encryption = InternodeEncryption.none;
}
}

4
src/java/org/apache/cassandra/net/MessagingService.java
View File

@ -43,7 +43,7 @@ import org.apache.cassandra.concurrent.DebuggableThreadPoolExecutor;
import org.apache.cassandra.concurrent.Stage;
import org.apache.cassandra.concurrent.StageManager;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
import org.apache.cassandra.db.*;
import org.apache.cassandra.dht.BootStrapper;
import org.apache.cassandra.exceptions.ConfigurationException;
@ -396,7 +396,7 @@ public final class MessagingService implements MessagingServiceMBean
private List<ServerSocket> getServerSocket(InetAddress localEp) throws ConfigurationException
{
final List<ServerSocket> ss = new ArrayList<ServerSocket>(2);
if (DatabaseDescriptor.getServerEncryptionOptions().internode_encryption != EncryptionOptions.InternodeEncryption.none)
if (DatabaseDescriptor.getServerEncryptionOptions().internode_encryption != ServerEncryptionOptions.InternodeEncryption.none)
{
try
{

3
src/java/org/apache/cassandra/thrift/CustomTHsHaServer.java
View File

@ -36,7 +36,6 @@ import org.slf4j.LoggerFactory;
import org.apache.cassandra.concurrent.JMXEnabledThreadPoolExecutor;
import org.apache.cassandra.concurrent.NamedThreadFactory;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.thrift.server.TNonblockingServer;
import org.apache.thrift.server.TServer;
import org.apache.thrift.transport.TNonblockingServerTransport;
@ -352,7 +351,7 @@ public class CustomTHsHaServer extends TNonblockingServer
{
public TServer buildTServer(Args args)
{
if(!DatabaseDescriptor.getClientEncryptionOptions().internode_encryption.equals(EncryptionOptions.InternodeEncryption.none))
if (DatabaseDescriptor.getClientEncryptionOptions().enabled)
throw new RuntimeException("Client SSL is not supported for non-blocking sockets (hsha). Please remove client ssl from the configuration.");
final InetSocketAddress addr = args.addr;

3
src/java/org/apache/cassandra/thrift/CustomTNonBlockingServer.java
View File

@ -20,7 +20,6 @@ package org.apache.cassandra.thrift;
import java.net.InetSocketAddress;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.thrift.server.TNonblockingServer;
import org.apache.thrift.server.TServer;
import org.apache.thrift.transport.TNonblockingServerTransport;
@ -47,7 +46,7 @@ public class CustomTNonBlockingServer extends TNonblockingServer
{
public TServer buildTServer(Args args)
{
if(!DatabaseDescriptor.getClientEncryptionOptions().internode_encryption.equals(EncryptionOptions.InternodeEncryption.none))
if (DatabaseDescriptor.getClientEncryptionOptions().enabled)
throw new RuntimeException("Client SSL is not supported for non-blocking sockets. Please remove client ssl from the configuration.");
final InetSocketAddress addr = args.addr;

7
src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java
View File

@ -31,7 +31,7 @@ import org.slf4j.LoggerFactory;
import org.apache.cassandra.concurrent.NamedThreadFactory;
import org.apache.cassandra.config.DatabaseDescriptor;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
import org.apache.thrift.TException;
import org.apache.thrift.TProcessor;
import org.apache.thrift.protocol.TProtocol;
@ -243,13 +243,12 @@ public class CustomTThreadPoolServer extends TServer
TServerTransport serverTransport;
try
{
final EncryptionOptions clientEnc = DatabaseDescriptor.getClientEncryptionOptions();
if(EncryptionOptions.InternodeEncryption.all == clientEnc.internode_encryption)
final ClientEncryptionOptions clientEnc = DatabaseDescriptor.getClientEncryptionOptions();
if (clientEnc.enabled)
{
logger.info("enabling encrypted thrift connections between client and server");
TSSLTransportParameters params = new TSSLTransportParameters(clientEnc.protocol, clientEnc.cipher_suites);
params.setKeyStore(clientEnc.keystore, clientEnc.keystore_password);
params.setTrustStore(clientEnc.truststore, clientEnc.truststore_password);
TServerSocket sslServer = TSSLTransportFactory.getServerSocket(addr.getPort(), 0, addr.getAddress(), params);
serverTransport = new TCustomServerSocket(sslServer.getServerSocket(), args.keepAlive, args.sendBufferSize, args.recvBufferSize);
}

3
tools/stress/src/org/apache/cassandra/stress/Session.java
View File

@ -28,6 +28,7 @@ import java.util.concurrent.atomic.AtomicLong;
import org.apache.cassandra.cli.transport.FramedTransportFactory;
import org.apache.cassandra.config.CFMetaData;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
import org.apache.cassandra.exceptions.ConfigurationException;
import org.apache.cassandra.exceptions.SyntaxException;
import org.apache.cassandra.db.marshal.*;
@ -160,7 +161,7 @@ public class Session implements Serializable
public final String comparator;
public final boolean timeUUIDComparator;
public double traceProbability = 0.0;
public EncryptionOptions encOptions = new EncryptionOptions();
public EncryptionOptions encOptions = new ClientEncryptionOptions();
public TTransportFactory transportFactory = new FramedTransportFactory();
public Session(String[] arguments) throws IllegalArgumentException, SyntaxException