big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-13992. KMS should load SSL configuration the same way as SSLFactory. Contributed by John Zhuge.

Browse Source
This commit is contained in:
Xiao Chen 2017-01-27 10:49:26 -08:00
parent 1a16431bd0
commit ebd40056a0
3 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java
View File

@ -128,9 +128,10 @@ public SSLFactory(Mode mode, Configuration conf) {
throw new IllegalArgumentException("mode cannot be NULL"); throw new IllegalArgumentException("mode cannot be NULL");
} }
this.mode = mode; this.mode = mode;
requireClientCert = conf.getBoolean(SSL_REQUIRE_CLIENT_CERT_KEY, Configuration sslConf = readSSLConfiguration(conf, mode);
requireClientCert = sslConf.getBoolean(SSL_REQUIRE_CLIENT_CERT_KEY,
SSL_REQUIRE_CLIENT_CERT_DEFAULT); SSL_REQUIRE_CLIENT_CERT_DEFAULT);
Configuration sslConf = readSSLConfiguration(mode);
Class<? extends KeyStoresFactory> klass Class<? extends KeyStoresFactory> klass
= conf.getClass(KEYSTORES_FACTORY_CLASS_KEY, = conf.getClass(KEYSTORES_FACTORY_CLASS_KEY,
@ -149,9 +150,11 @@ public SSLFactory(Mode mode, Configuration conf) {
} }
} }
private Configuration readSSLConfiguration(Mode mode) { public static Configuration readSSLConfiguration(Configuration conf,
Mode mode) {
Configuration sslConf = new Configuration(false); Configuration sslConf = new Configuration(false);
sslConf.setBoolean(SSL_REQUIRE_CLIENT_CERT_KEY, requireClientCert); sslConf.setBoolean(SSL_REQUIRE_CLIENT_CERT_KEY, conf.getBoolean(
SSL_REQUIRE_CLIENT_CERT_KEY, SSL_REQUIRE_CLIENT_CERT_DEFAULT));
String sslConfResource; String sslConfResource;
if (mode == Mode.CLIENT) { if (mode == Mode.CLIENT) {
sslConfResource = conf.get(SSL_CLIENT_CONF_KEY, sslConfResource = conf.get(SSL_CLIENT_CONF_KEY,

21
hadoop-common-project/hadoop-kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMSWebServer.java
View File

@ -46,13 +46,7 @@ public class KMSWebServer {
private final HttpServer2 httpServer; private final HttpServer2 httpServer;
private final String scheme; private final String scheme;
KMSWebServer(Configuration cnf) throws Exception { KMSWebServer(Configuration conf, Configuration sslConf) throws Exception {
ConfigurationWithLogging conf = new ConfigurationWithLogging(cnf);
// Add SSL configuration file
conf.addResource(conf.get(SSLFactory.SSL_SERVER_CONF_KEY,
SSLFactory.SSL_SERVER_CONF_DEFAULT));
// Override configuration with deprecated environment variables. // Override configuration with deprecated environment variables.
deprecateEnv("KMS_TEMP", conf, HttpServer2.HTTP_TEMP_DIR_KEY, deprecateEnv("KMS_TEMP", conf, HttpServer2.HTTP_TEMP_DIR_KEY,
KMSConfiguration.KMS_SITE_XML); KMSConfiguration.KMS_SITE_XML);
@ -68,10 +62,10 @@ public class KMSWebServer {
KMSConfiguration.KMS_SITE_XML); KMSConfiguration.KMS_SITE_XML);
deprecateEnv("KMS_SSL_ENABLED", conf, deprecateEnv("KMS_SSL_ENABLED", conf,
KMSConfiguration.SSL_ENABLED_KEY, KMSConfiguration.KMS_SITE_XML); KMSConfiguration.SSL_ENABLED_KEY, KMSConfiguration.KMS_SITE_XML);
deprecateEnv("KMS_SSL_KEYSTORE_FILE", conf, deprecateEnv("KMS_SSL_KEYSTORE_FILE", sslConf,
SSLFactory.SSL_SERVER_KEYSTORE_LOCATION, SSLFactory.SSL_SERVER_KEYSTORE_LOCATION,
SSLFactory.SSL_SERVER_CONF_DEFAULT); SSLFactory.SSL_SERVER_CONF_DEFAULT);
deprecateEnv("KMS_SSL_KEYSTORE_PASS", conf, deprecateEnv("KMS_SSL_KEYSTORE_PASS", sslConf,
SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD, SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD,
SSLFactory.SSL_SERVER_CONF_DEFAULT); SSLFactory.SSL_SERVER_CONF_DEFAULT);
@ -88,7 +82,7 @@ public class KMSWebServer {
httpServer = new HttpServer2.Builder() httpServer = new HttpServer2.Builder()
.setName(NAME) .setName(NAME)
.setConf(conf) .setConf(conf)
.setSSLConf(conf) .setSSLConf(sslConf)
.authFilterConfigurationPrefix(KMSAuthenticationFilter.CONFIG_PREFIX) .authFilterConfigurationPrefix(KMSAuthenticationFilter.CONFIG_PREFIX)
.addEndpoint(endpoint) .addEndpoint(endpoint)
.build(); .build();
@ -147,8 +141,11 @@ public URL getKMSUrl() {
public static void main(String[] args) throws Exception { public static void main(String[] args) throws Exception {
StringUtils.startupShutdownMessage(KMSWebServer.class, args, LOG); StringUtils.startupShutdownMessage(KMSWebServer.class, args, LOG);
Configuration conf = KMSConfiguration.getKMSConf(); Configuration conf = new ConfigurationWithLogging(
KMSWebServer kmsWebServer = new KMSWebServer(conf); KMSConfiguration.getKMSConf());
Configuration sslConf = new ConfigurationWithLogging(
SSLFactory.readSSLConfiguration(conf, SSLFactory.Mode.SERVER));
KMSWebServer kmsWebServer = new KMSWebServer(conf, sslConf);
kmsWebServer.start(); kmsWebServer.start();
kmsWebServer.join(); kmsWebServer.join();
} }

11
hadoop-common-project/hadoop-kms/src/test/java/org/apache/hadoop/crypto/key/kms/server/MiniKMS.java
View File

@ -145,14 +145,17 @@ public void start() throws Exception {
final Configuration conf = KMSConfiguration.getKMSConf(); final Configuration conf = KMSConfiguration.getKMSConf();
conf.set(KMSConfiguration.HTTP_HOST_KEY, "localhost"); conf.set(KMSConfiguration.HTTP_HOST_KEY, "localhost");
conf.setInt(KMSConfiguration.HTTP_PORT_KEY, inPort); conf.setInt(KMSConfiguration.HTTP_PORT_KEY, inPort);
Configuration sslConf = null;
if (keyStore != null) { if (keyStore != null) {
conf.setBoolean(KMSConfiguration.SSL_ENABLED_KEY, true); conf.setBoolean(KMSConfiguration.SSL_ENABLED_KEY, true);
conf.set(SSLFactory.SSL_SERVER_KEYSTORE_LOCATION, keyStore); sslConf = SSLFactory.readSSLConfiguration(conf, SSLFactory.Mode.SERVER);
conf.set(SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD, keyStorePassword); sslConf.set(SSLFactory.SSL_SERVER_KEYSTORE_LOCATION, keyStore);
conf.set(SSLFactory.SSL_SERVER_KEYSTORE_TYPE, "jks"); sslConf.set(SSLFactory.SSL_SERVER_KEYSTORE_PASSWORD, keyStorePassword);
sslConf.set(SSLFactory.SSL_SERVER_KEYSTORE_TYPE, "jks");
} }
jetty = new KMSWebServer(conf); jetty = new KMSWebServer(conf, sslConf);
jetty.start(); jetty.start();
kmsURL = jetty.getKMSUrl(); kmsURL = jetty.getKMSUrl();
} }