You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ud...@apache.org on 2016/06/15 16:18:00 UTC
[27/33] incubator-geode git commit: GEODE-420: Added
SSLEnabledComponents.java
GEODE-420: Added SSLEnabledComponents.java
Project: http://git-wip-us.apache.org/repos/asf/incubator-geode/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-geode/commit/12f69bed
Tree: http://git-wip-us.apache.org/repos/asf/incubator-geode/tree/12f69bed
Diff: http://git-wip-us.apache.org/repos/asf/incubator-geode/diff/12f69bed
Branch: refs/heads/feature/GEODE-420
Commit: 12f69bed22a29c7b23b7299d71f776ea36fa7ed1
Parents: b6480b7
Author: Udo Kohlmeyer <uk...@pivotal.io>
Authored: Wed Jun 15 10:06:42 2016 +1000
Committer: Udo Kohlmeyer <uk...@pivotal.io>
Committed: Thu Jun 16 02:17:16 2016 +1000
----------------------------------------------------------------------
.../distributed/ConfigurationProperties.java | 11 ++++
.../distributed/SSLEnabledComponents.java | 57 ++++++++++++++++++++
.../internal/AbstractDistributionConfig.java | 53 +++++++++++++++---
.../internal/DistributionConfig.java | 21 ++++++++
.../internal/DistributionConfigImpl.java | 39 ++++++++++++--
.../gemfire/internal/i18n/LocalizedStrings.java | 6 ++-
.../internal/DistributionConfigJUnitTest.java | 1 +
.../gemfire/internal/SSLConfigJUnitTest.java | 12 ++---
8 files changed, 181 insertions(+), 19 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
index 207ca0d..11db1d9 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
@@ -1616,10 +1616,21 @@ public interface ConfigurationProperties {
String LOCK_MEMORY = "lock-memory";
/**
* The static String definition of the <i>"shiro-init"</i> property
+ * <U>Since</U>: Geode 1.0
*/
String SECURITY_SHIRO_INIT = SECURITY_PREFIX + "shiro-init";
/**
* The static String definition of the <i>"distributed-transactions"</i> property
+ * <U>Since</U>: Geode 1.0
*/
String DISTRIBUTED_TRANSACTIONS = "distributed-transactions";
+ /**
+ * The static String definition of the <i>"ssl-enabled-components"</i> property
+ * <a name="ssl-enabled-components"/a></p>
+ * <U>Description</U>: This setting is a comma delimited fields which works in conjunction with the {@link #CLUSTER_SSL_PREFIX} properties.
+ * This property will determine which components will use SSL for their communications.</p>
+ * <U>Options</U>: "all","server","cluster","gateway","http","jmx" -- As described {@link SSLEnabledComponents}
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_ENABLED_COMPONENTS = "ssl-enabled-components";
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
new file mode 100644
index 0000000..a403662
--- /dev/null
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.gemstone.gemfire.distributed;
+
+/**
+ * This class defines all the static definitions for the {@link ConfigurationProperties#SSL_ENABLED_COMPONENTS}
+ * <U>Since</U>: Geode 1.0
+ */
+public interface SSLEnabledComponents {
+
+ /**
+ * This determines that all components will use the SSL for their communications.
+ * <U>Since</U>: Geode 1.0
+ */
+ String ALL = "all";
+ /**
+ * This determines that only the server components will use the SSL for their communications. This means that all communications
+ * between clients and servers will use SSL. In addition this also means that client-locator and server-locator communications will use SSL credentials.
+ * <U>Since</U>: Geode 1.0
+ */
+ String SERVER = "server";
+ /**
+ * This determines that only the inter-server (or server-to-server) communication will use the SSL.
+ * In addition this also means that server-locator communications will use SSL credentials.
+ * <U>Since</U>: Geode 1.0
+ */
+ String CLUSTER = "cluster";
+ /**
+ * This determines that only the jmx component will use the SSL for its communications.
+ * <U>Since</U>: Geode 1.0
+ */
+ String JMX = "jmx";
+ /**
+ * This determines that the http service component will use the SSL for its communications
+ * <U>Since</U>: Geode 1.0
+ */
+ String HTTP_SERVICE = "http";
+ /**
+ * This determines that the gateway component will use the SSL for its communications.
+ * <U>Since</U>: Geode 1.0
+ */
+ String GATEWAY = "gateway";
+}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
index f53727b..2ffef75 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
@@ -29,9 +29,12 @@ import java.util.Map;
import java.util.Set;
import java.util.StringTokenizer;
+import org.apache.commons.lang.StringUtils;
+
import com.gemstone.gemfire.InternalGemFireException;
import com.gemstone.gemfire.InvalidValueException;
import com.gemstone.gemfire.UnmodifiableException;
+import com.gemstone.gemfire.distributed.SSLEnabledComponents;
import com.gemstone.gemfire.internal.AbstractConfig;
import com.gemstone.gemfire.internal.ConfigSource;
import com.gemstone.gemfire.internal.SocketCreator;
@@ -367,12 +370,9 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
// Minimum 3 ports are required to start a Gemfire data node,
// One for each, UDP, FD_SOCk protocols and Cache Server.
if (value[1] - value[0] < 2) {
- throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_COULD_NOT_SET_0_TO_1_BECAUSE_ITS_VALUE_CAN_NOT_BE_LESS_THAN_2.
- toLocalizedString(new Object[] {
- MEMBERSHIP_PORT_RANGE,
- value[0] + "-" + value[1],
- Integer.valueOf(3)
- }));
+ throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_COULD_NOT_SET_0_TO_1_BECAUSE_ITS_VALUE_CAN_NOT_BE_LESS_THAN_2.toLocalizedString(new Object[] {
+ MEMBERSHIP_PORT_RANGE, value[0] + "-" + value[1], Integer.valueOf(3)
+ }));
}
return value;
}
@@ -467,6 +467,45 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
return value;
}
+ /**
+ * First check if sslComponents are in the list of valid components. If so, check that no other *-ssl-* properties other than cluster-ssl-* are set.
+ * This would mean one is mixing the "old" with the "new"
+ */
+ @ConfigAttributeChecker(name = SSL_ENABLED_COMPONENTS)
+ protected String checkLegacySSLWhenSSLEnabledComponentsSet(String value) {
+ if (value != null && value.length() > 0) {
+ String[] components = value.split(",");
+ for (String component : components) {
+ switch (component) {
+ case SSLEnabledComponents.ALL:
+ case SSLEnabledComponents.CLUSTER:
+ case SSLEnabledComponents.SERVER:
+ case SSLEnabledComponents.GATEWAY:
+ case SSLEnabledComponents.JMX:
+ case SSLEnabledComponents.HTTP_SERVICE:
+ continue;
+ default:
+ throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_0_INVALID_TRY_1.toLocalizedString(new Object[] {
+ value, StringUtils.join(new String[] {
+ SSLEnabledComponents.ALL,
+ SSLEnabledComponents.CLUSTER,
+ SSLEnabledComponents.SERVER,
+ SSLEnabledComponents.GATEWAY,
+ SSLEnabledComponents.JMX,
+ SSLEnabledComponents.HTTP_SERVICE
+ }, ",")
+ }));
+ }
+ }
+ if(getJmxManagerSSLEnabled() || getHttpServiceSSLEnabled() || getServerSSLEnabled() || getGatewaySSLEnabled())
+ {
+ throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_SET_INVALID_DEPRECATED_SSL_SET
+ .toLocalizedString());
+ }
+ }
+ return value;
+ }
+
// AbstractConfig overriding methods
@Override
@@ -922,6 +961,8 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
m.put(SECURITY_SHIRO_INIT, "The name of the shiro configuration file in the classpath, e.g. shiro.ini");
+ m.put(SSL_ENABLED_COMPONENTS,"A comma delimited list of components that require SSL communications");
+
dcAttDescriptions = Collections.unmodifiableMap(m);
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfig.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfig.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfig.java
index 5ca327c..3cbe3f2 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfig.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfig.java
@@ -19,6 +19,7 @@ package com.gemstone.gemfire.distributed.internal;
import com.gemstone.gemfire.distributed.ConfigurationProperties;
import com.gemstone.gemfire.distributed.DistributedSystem;
+import com.gemstone.gemfire.distributed.SSLEnabledComponents;
import com.gemstone.gemfire.internal.Config;
import com.gemstone.gemfire.internal.ConfigSource;
import com.gemstone.gemfire.internal.logging.InternalLogWriter;
@@ -4050,6 +4051,26 @@ public interface DistributionConfig extends Config, LogConfig {
@ConfigAttribute(type = String.class)
String SERVER_SSL_ALIAS_NAME = SERVER_SSL_ALIAS;
+ /**
+ * Returns the value of the {@link ConfigurationProperties#SSL_ENABLED_COMPONENTS}
+ * property.
+ */
+ @ConfigAttributeGetter(name = SSL_ENABLED_COMPONENTS)
+ String getSSLEnabledComponents();
+
+ /**
+ * Sets the value of the {@link ConfigurationProperties#SSL_ENABLED_COMPONENTS}
+ * property.
+ */
+ @ConfigAttributeSetter(name = SSL_ENABLED_COMPONENTS)
+ void setSSLEnabledComponents(String sslEnabledComponents);
+
+ /**
+ * The name of the {@link ConfigurationProperties#SSL_ENABLED_COMPONENTS} property
+ */
+ @ConfigAttribute(type = String.class)
+ String SSL_ENABLED_COMPONENTS_NAME = SSL_ENABLED_COMPONENTS;
+
//*************** Initializers to gather all the annotations in this class ************************
Map<String, ConfigAttribute> attributes = new HashMap<>();
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfigImpl.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfigImpl.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfigImpl.java
index 5276f3a..7ba8aee 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfigImpl.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/DistributionConfigImpl.java
@@ -228,7 +228,7 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
/**
* the Jgroups port ranges allowed
*/
- protected int[] membershipPortRange = DEFAULT_MEMBERSHIP_PORT_RANGE;
+ private int[] membershipPortRange = DEFAULT_MEMBERSHIP_PORT_RANGE;
/**
* Max wait time for the member before reconnecting to the DS in case of
@@ -241,9 +241,9 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
private int maxNumReconnectTries = DEFAULT_MAX_NUM_RECONNECT_TRIES;
- protected int asyncDistributionTimeout = DEFAULT_ASYNC_DISTRIBUTION_TIMEOUT;
- protected int asyncQueueTimeout = DEFAULT_ASYNC_QUEUE_TIMEOUT;
- protected int asyncMaxQueueSize = DEFAULT_ASYNC_MAX_QUEUE_SIZE;
+ private int asyncDistributionTimeout = DEFAULT_ASYNC_DISTRIBUTION_TIMEOUT;
+ private int asyncQueueTimeout = DEFAULT_ASYNC_QUEUE_TIMEOUT;
+ private int asyncMaxQueueSize = DEFAULT_ASYNC_MAX_QUEUE_SIZE;
/**
* @since GemFire 5.7
@@ -484,6 +484,8 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
private String httpServiceSSLAlias = clusterSSLAlias;
+ private String sslEnabledComponents;
+
private Map<String, ConfigSource> sourceMap = Collections.synchronizedMap(new HashMap<String, ConfigSource>());
protected String userCommandPackages = DEFAULT_USER_COMMAND_PACKAGES;
@@ -679,6 +681,7 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
this.httpServiceSSLAlias = other.getHTTPServiceSSLAlias();
this.jmxManagerSSLAlias = other.getJMXManagerSSLAlias();
this.serverSSLAlias = other.getServerSSLAlias();
+ this.sslEnabledComponents = ((DistributionConfigImpl) other).sslEnabledComponents;
}
/**
@@ -2336,6 +2339,16 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
serverSSLAlias = alias;
}
+ @Override
+ public String getSSLEnabledComponents() {
+ return sslEnabledComponents;
+ }
+
+ @Override
+ public void setSSLEnabledComponents(final String sslEnabledComponents) {
+ this.sslEnabledComponents = sslEnabledComponents;
+ }
+
/////////////////////// Utility Methods ///////////////////////
/**
@@ -3019,6 +3032,24 @@ public class DistributionConfigImpl extends AbstractDistributionConfig implement
} else if (!userDefinedProps.equals(other.userDefinedProps)) {
return false;
}
+ if (clusterSSLAlias != other.clusterSSLAlias) {
+ return false;
+ }
+ if (serverSSLAlias != other.serverSSLAlias) {
+ return false;
+ }
+ if (httpServiceSSLAlias != other.httpServiceSSLAlias) {
+ return false;
+ }
+ if (jmxManagerSSLAlias != other.jmxManagerSSLAlias) {
+ return false;
+ }
+ if (gatewaySSLAlias != other.gatewaySSLAlias) {
+ return false;
+ }
+ if (sslEnabledComponents != other.sslEnabledComponents) {
+ return false;
+ }
return true;
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/main/java/com/gemstone/gemfire/internal/i18n/LocalizedStrings.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/internal/i18n/LocalizedStrings.java b/geode-core/src/main/java/com/gemstone/gemfire/internal/i18n/LocalizedStrings.java
index 7256b95..01b6779 100755
--- a/geode-core/src/main/java/com/gemstone/gemfire/internal/i18n/LocalizedStrings.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/internal/i18n/LocalizedStrings.java
@@ -3766,6 +3766,10 @@ public class LocalizedStrings {
public static final StringId AbstractDistributionConfig_HTTP_SERVICE_SSL_ALIAS_0 = new StringId(6632,"SSL http service communication uses the this alias when determining the key to use from the keystore for SSL. Defaults to \"{0}\".");
public static final StringId AbstractDistributionConfig_JMX_MANAGER_SSL_ALIAS_0 = new StringId(6632,"SSL jmx communication uses the this alias when determining the key to use from the keystore for SSL. Defaults to \"{0}\".");
+ public static final StringId AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_0_INVALID_TRY_1 = new StringId(6633,"\"{0}\" is not in the valid set of {1}");
+
+ public static final StringId AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_SET_INVALID_DEPRECATED_SSL_SET = new StringId(6634,"When using ssl-enabled-components one cannot use any other SSL properties other than cluster-ssl-* or the corresponding aliases");
+
/** Testing strings, messageId 90000-99999 **/
/** These are simple messages for testing, translated with Babelfish. **/
@@ -3777,6 +3781,4 @@ public class LocalizedStrings {
public static final StringId DistributedRegion_INITIALIZING_REGION_COMPLETED_0 = new StringId(90005, "Initialization of region {0} completed");
-
-
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/test/java/com/gemstone/gemfire/distributed/internal/DistributionConfigJUnitTest.java
----------------------------------------------------------------------
diff --git a/geode-core/src/test/java/com/gemstone/gemfire/distributed/internal/DistributionConfigJUnitTest.java b/geode-core/src/test/java/com/gemstone/gemfire/distributed/internal/DistributionConfigJUnitTest.java
index 48cc42f..314f7d0 100644
--- a/geode-core/src/test/java/com/gemstone/gemfire/distributed/internal/DistributionConfigJUnitTest.java
+++ b/geode-core/src/test/java/com/gemstone/gemfire/distributed/internal/DistributionConfigJUnitTest.java
@@ -221,6 +221,7 @@ public class DistributionConfigJUnitTest {
@Test
public void testCheckerChecksValidAttribute() {
for (String att : checkers.keySet()) {
+ System.out.println("att = " + att);
assertTrue(attributes.containsKey(att));
Method checker = checkers.get(att);
assertEquals(checker.getParameterCount(), 1);
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/12f69bed/geode-core/src/test/java/com/gemstone/gemfire/internal/SSLConfigJUnitTest.java
----------------------------------------------------------------------
diff --git a/geode-core/src/test/java/com/gemstone/gemfire/internal/SSLConfigJUnitTest.java b/geode-core/src/test/java/com/gemstone/gemfire/internal/SSLConfigJUnitTest.java
index a8e4708..ff93ad7 100755
--- a/geode-core/src/test/java/com/gemstone/gemfire/internal/SSLConfigJUnitTest.java
+++ b/geode-core/src/test/java/com/gemstone/gemfire/internal/SSLConfigJUnitTest.java
@@ -333,19 +333,16 @@ public class SSLConfigJUnitTest {
String sslciphers = "any";
boolean requireAuth = true;
- boolean jmxManagerSsl = true;
boolean jmxManagerSslenabled = true;
String jmxManagerSslprotocols = "SSLv7";
String jmxManagerSslciphers = "RSA_WITH_GARBAGE";
boolean jmxManagerSslRequireAuth = true;
Properties gemFireProps = new Properties();
- gemFireProps.put(CLUSTER_SSL_ENABLED, String.valueOf(jmxManagerSslenabled));
- gemFireProps.put(CLUSTER_SSL_PROTOCOLS, jmxManagerSslprotocols);
- gemFireProps.put(CLUSTER_SSL_CIPHERS, jmxManagerSslciphers);
- gemFireProps.put(CLUSTER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(jmxManagerSslRequireAuth));
- //TODO -- UDO: We need to potentially have to implement JMX_MANAGER_SSL_ALIAS
- gemFireProps.put(JMX_MANAGER_SSL_ALIAS, "");
+ gemFireProps.put(JMX_MANAGER_SSL_ENABLED, String.valueOf(jmxManagerSslenabled));
+ gemFireProps.put(JMX_MANAGER_SSL_PROTOCOLS, jmxManagerSslprotocols);
+ gemFireProps.put(JMX_MANAGER_SSL_CIPHERS, jmxManagerSslciphers);
+ gemFireProps.put(JMX_MANAGER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(jmxManagerSslRequireAuth));
try{
DistributionConfigImpl config = new DistributionConfigImpl( gemFireProps );
}catch(IllegalArgumentException e){
@@ -360,6 +357,7 @@ public class SSLConfigJUnitTest {
gemFireProps.put(CLUSTER_SSL_CIPHERS, sslciphers);
gemFireProps.put(CLUSTER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(requireAuth));
+ gemFireProps.put(JMX_MANAGER_SSL_ENABLED, String.valueOf(jmxManagerSslenabled));
gemFireProps.put(JMX_MANAGER_SSL_PROTOCOLS, jmxManagerSslprotocols);
gemFireProps.put(JMX_MANAGER_SSL_CIPHERS, jmxManagerSslciphers);
gemFireProps.put(JMX_MANAGER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(jmxManagerSslRequireAuth));