You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by eo...@apache.org on 2021/05/13 07:46:15 UTC
[pulsar] 21/46: Enable Conscrypt for Jetty in the Broker and in the
Proxy (#10541)
This is an automated email from the ASF dual-hosted git repository.
eolivelli pushed a commit to branch 2.7.2_ds_tmp
in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 5bc23c6aead321fa1c6142d96b4563a2243e108a
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Wed May 12 07:02:56 2021 +0300
Enable Conscrypt for Jetty in the Broker and in the Proxy (#10541)
* Add jetty-alpn-conscrypt-server jar
* Enable Conscrypt / OpenSSL provider if it is available
* Use conscrypt 2.5.2
* Set default hostname verifier for Conscrypt
* Move TlsHostnameVerifier for pulsar-client to pulsar-common
* Use Pulsar's TlsHostnameVerifier with Conscrypt
* Add conscrypt.version property for managing conscrypt version in pom.xml
* Update LICENSE file
* Add comments about HostnameVerifier in Conscrypt
---
distribution/server/src/assemble/LICENSE.bin.txt | 7 +-
pom.xml | 245 +++++++++++----------
pulsar-broker/pom.xml | 5 +
.../pulsar/broker/admin/AdminApiTlsAuthTest.java | 2 +-
.../AuthenticationTlsHostnameVerificationTest.java | 4 +-
.../client/impl/AdminApiKeyStoreTlsAuthTest.java | 2 +-
.../org/apache/pulsar/client/impl/ClientCnx.java | 4 +-
.../org/apache/pulsar/common}/tls/DomainType.java | 2 +-
.../pulsar/common}/tls/InetAddressUtils.java | 2 +-
.../pulsar/common}/tls/NoopHostnameVerifier.java | 2 +-
.../pulsar/common}/tls/PublicSuffixList.java | 2 +-
.../pulsar/common}/tls/PublicSuffixMatcher.java | 2 +-
.../org/apache/pulsar/common}/tls/SubjectName.java | 2 +-
.../pulsar/common}/tls/TlsHostnameVerifier.java | 2 +-
.../apache/pulsar/common/util/SecurityUtility.java | 117 +++++++++-
.../util/keystoretls/KeyStoreSSLContext.java | 16 +-
.../SslContextFactoryWithAutoRefresh.java | 3 +
pulsar-discovery-service/pom.xml | 5 +
pulsar-functions/worker/pom.xml | 5 +
pulsar-proxy/pom.xml | 5 +
.../pulsar/proxy/server/DirectProxyHandler.java | 2 +-
tiered-storage/file-system/pom.xml | 8 +-
22 files changed, 304 insertions(+), 140 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index 56be02c..6808141 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -321,9 +321,10 @@ The Apache Software License, Version 2.0
- com.fasterxml.jackson.module-jackson-module-jaxb-annotations-2.11.1.jar
- com.fasterxml.jackson.module-jackson-module-jsonSchema-2.11.1.jar
* Caffeine -- com.github.ben-manes.caffeine-caffeine-2.6.2.jar
- * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-1.12.0.jar
* Joda -- org.joda-joda-convert-2.2.1.jar
- * Bitbucket -- org.bitbucket.b_c-jose4j-0.7.2.jar
+ * Conscrypt -- org.conscrypt-conscrypt-openjdk-uber-2.5.2.jar
+ * Proto Google Common Protos -- com.google.api.grpc-proto-google-common-protos-1.17.0.jar
+ * Bitbucket -- org.bitbucket.b_c-jose4j-0.7.6.jar
* Gson
- com.google.code.gson-gson-2.8.6.jar
- io.gsonfire-gson-fire-1.8.4.jar
@@ -447,6 +448,8 @@ The Apache Software License, Version 2.0
- org.eclipse.jetty.websocket-websocket-common-9.4.39.v20210325.jar
- org.eclipse.jetty.websocket-websocket-server-9.4.39.v20210325.jar
- org.eclipse.jetty.websocket-websocket-servlet-9.4.39.v20210325.jar
+ - org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.39.v20210325.jar
+ - org.eclipse.jetty-jetty-alpn-server-9.4.39.v20210325.jar
* SnakeYaml -- org.yaml-snakeyaml-1.26.jar
* RocksDB - org.rocksdb-rocksdbjni-6.10.2.jar
* Google Error Prone Annotations - com.google.errorprone-error_prone_annotations-2.3.4.jar
diff --git a/pom.xml b/pom.xml
index d415f8b..348ef7a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,121 +28,123 @@
<version>18</version>
</parent>
<groupId>org.apache.pulsar</groupId>
- <artifactId>pulsar</artifactId>
- <version>2.7.2.1.0.0</version>
- <name>Pulsar</name>
- <description>Pulsar is a distributed pub-sub messaging platform with a very
- flexible messaging model and an intuitive client API.</description>
- <url>https://github.com/apache/pulsar</url>
-
- <organization>
- <name>Apache Software Foundation</name>
- <url>http://www.apache.org/</url>
- </organization>
- <inceptionYear>2017</inceptionYear>
-
- <developers>
- <developer>
- <organization>Apache Pulsar developers</organization>
- <organizationUrl>http://pulsar.apache.org/</organizationUrl>
- </developer>
- </developers>
-
- <licenses>
- <license>
- <name>Apache License, Version 2.0</name>
- <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
- <distribution>repo</distribution>
- </license>
- </licenses>
-
- <scm>
- <url>https://github.com/apache/pulsar</url>
- <connection>scm:git:https://github.com/apache/pulsar.git</connection>
- <developerConnection>scm:git:ssh://git@github.com:apache/pulsar.git</developerConnection>
- </scm>
-
- <ciManagement>
- <system>Travis</system>
- <url>https://travis-ci.org/apache/pulsar</url>
- </ciManagement>
-
- <issueManagement>
- <system>Github</system>
- <url>https://github.com/apache/pulsar/issues</url>
- </issueManagement>
-
- <properties>
- <!--config keys to congiure test selection -->
- <include>*</include>
- <exclude/>
- <groups/>
- <excludedGroups/>
-
- <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
- <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
- <redirectTestOutputToFile>true</redirectTestOutputToFile>
- <testReuseFork>true</testReuseFork>
- <testForkCount>4</testForkCount>
- <testRealAWS>false</testRealAWS>
- <testRetryCount>1</testRetryCount>
- <docker.organization>apachepulsar</docker.organization>
-
- <!-- pin the protobuf-shaded version to make the pulsar build friendly to intellij -->
- <pulsar.protobuf.shaded.version>2.1.0-incubating</pulsar.protobuf.shaded.version>
-
- <!-- apache commons -->
- <commons-compress.version>1.19</commons-compress.version>
-
- <bookkeeper.version>4.12.0</bookkeeper.version>
- <zookeeper.version>3.5.7</zookeeper.version>
- <netty.version>4.1.60.Final</netty.version>
- <netty-tc-native.version>2.0.36.Final</netty-tc-native.version>
- <jetty.version>9.4.39.v20210325</jetty.version>
- <jersey.version>2.31</jersey.version>
- <athenz.version>1.10.9</athenz.version>
- <prometheus.version>0.5.0</prometheus.version>
- <aspectj.version>1.9.2</aspectj.version>
- <vertx.version>3.5.3</vertx.version>
- <rocksdb.version>6.10.2</rocksdb.version>
- <slf4j.version>1.7.25</slf4j.version>
- <commons.collections.version>3.2.2</commons.collections.version>
- <log4j2.version>2.10.0</log4j2.version>
- <bouncycastle.version>1.68</bouncycastle.version>
- <bouncycastlefips.version>1.0.2</bouncycastlefips.version>
- <jackson.version>2.11.1</jackson.version>
- <jackson.databind.version>2.11.1</jackson.databind.version>
- <reflections.version>0.9.11</reflections.version>
- <swagger.version>1.5.21</swagger.version>
- <puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
- <dockerfile-maven.version>1.4.13</dockerfile-maven.version>
- <typetools.version>0.5.0</typetools.version>
- <protobuf2.version>2.4.1</protobuf2.version>
- <protobuf3.version>3.11.4</protobuf3.version>
- <protoc3.version>${protobuf3.version}</protoc3.version>
- <grpc.version>1.18.0</grpc.version>
- <protoc-gen-grpc-java.version>${grpc.version}</protoc-gen-grpc-java.version>
- <gson.version>2.8.6</gson.version>
- <sketches.version>0.8.3</sketches.version>
- <hbc-core.version>2.2.0</hbc-core.version>
- <cassandra-driver-core.version>3.6.0</cassandra-driver-core.version>
- <aerospike-client.version>4.4.8</aerospike-client.version>
- <kafka-client.version>2.3.0</kafka-client.version>
- <rabbitmq-client.version>5.1.1</rabbitmq-client.version>
- <aws-sdk.version>1.11.774</aws-sdk.version>
- <avro.version>1.9.1</avro.version>
- <joda.version>2.10.1</joda.version>
- <jclouds.version>2.2.1</jclouds.version>
- <sqlite-jdbc.version>3.8.11.2</sqlite-jdbc.version>
- <mysql-jdbc.version>8.0.11</mysql-jdbc.version>
- <postgresql-jdbc.version>42.2.12</postgresql-jdbc.version>
- <clickhouse-jdbc.version>0.2.4</clickhouse-jdbc.version>
- <mariadb-jdbc.version>2.6.0</mariadb-jdbc.version>
- <hdfs-offload-version3>3.2.0</hdfs-offload-version3>
- <org.eclipse.jetty-hdfs-offload>9.3.24.v20180605</org.eclipse.jetty-hdfs-offload>
- <elasticsearch.version>7.9.1</elasticsearch.version>
- <presto.version>334</presto.version>
- <flink.version>1.6.0</flink.version>
+
+ <artifactId>pulsar</artifactId>
+ <version>2.7.2.1.0.0</version>
+ <name>Pulsar</name>
+ <description>Pulsar is a distributed pub-sub messaging platform with a very
+flexible messaging model and an intuitive client API.</description>
+ <url>https://github.com/apache/pulsar</url>
+
+ <organization>
+ <name>Apache Software Foundation</name>
+ <url>http://www.apache.org/</url>
+ </organization>
+ <inceptionYear>2017</inceptionYear>
+
+ <developers>
+ <developer>
+ <organization>Apache Pulsar developers</organization>
+ <organizationUrl>http://pulsar.apache.org/</organizationUrl>
+ </developer>
+ </developers>
+
+ <licenses>
+ <license>
+ <name>Apache License, Version 2.0</name>
+ <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <distribution>repo</distribution>
+ </license>
+ </licenses>
+
+ <scm>
+ <url>https://github.com/apache/pulsar</url>
+ <connection>scm:git:https://github.com/apache/pulsar.git</connection>
+ <developerConnection>scm:git:ssh://git@github.com:apache/pulsar.git</developerConnection>
+ </scm>
+
+ <ciManagement>
+ <system>Travis</system>
+ <url>https://travis-ci.org/apache/pulsar</url>
+ </ciManagement>
+
+ <issueManagement>
+ <system>Github</system>
+ <url>https://github.com/apache/pulsar/issues</url>
+ </issueManagement>
+
+ <properties>
+ <!--config keys to congiure test selection -->
+ <include>*</include>
+ <exclude/>
+ <groups/>
+ <excludedGroups/>
+
+ <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+ <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+ <redirectTestOutputToFile>true</redirectTestOutputToFile>
+ <testReuseFork>true</testReuseFork>
+ <testForkCount>4</testForkCount>
+ <testRealAWS>false</testRealAWS>
+ <testRetryCount>1</testRetryCount>
+ <docker.organization>apachepulsar</docker.organization>
+
+ <!-- pin the protobuf-shaded version to make the pulsar build friendly to intellij -->
+ <pulsar.protobuf.shaded.version>2.1.0-incubating</pulsar.protobuf.shaded.version>
+
+ <!-- apache commons -->
+ <commons-compress.version>1.19</commons-compress.version>
+
+ <bookkeeper.version>4.12.0</bookkeeper.version>
+ <zookeeper.version>3.5.7</zookeeper.version>
+ <netty.version>4.1.60.Final</netty.version>
+ <netty-tc-native.version>2.0.36.Final</netty-tc-native.version>
+ <jetty.version>9.4.39.v20210325</jetty.version>
+ <conscrypt.version>2.5.2</conscrypt.version>
+ <jersey.version>2.31</jersey.version>
+ <athenz.version>1.10.9</athenz.version>
+ <prometheus.version>0.5.0</prometheus.version>
+ <aspectj.version>1.9.2</aspectj.version>
+ <vertx.version>3.5.3</vertx.version>
+ <rocksdb.version>6.10.2</rocksdb.version>
+ <slf4j.version>1.7.25</slf4j.version>
+ <commons.collections.version>3.2.2</commons.collections.version>
+ <log4j2.version>2.10.0</log4j2.version>
+ <bouncycastle.version>1.68</bouncycastle.version>
+ <bouncycastlefips.version>1.0.2</bouncycastlefips.version>
+ <jackson.version>2.11.1</jackson.version>
+ <jackson.databind.version>2.11.1</jackson.databind.version>
+ <reflections.version>0.9.11</reflections.version>
+ <swagger.version>1.5.21</swagger.version>
+ <puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
+ <dockerfile-maven.version>1.4.13</dockerfile-maven.version>
+ <typetools.version>0.5.0</typetools.version>
+ <protobuf2.version>2.4.1</protobuf2.version>
+ <protobuf3.version>3.11.4</protobuf3.version>
+ <protoc3.version>${protobuf3.version}</protoc3.version>
+ <grpc.version>1.18.0</grpc.version>
+ <protoc-gen-grpc-java.version>${grpc.version}</protoc-gen-grpc-java.version>
+ <gson.version>2.8.6</gson.version>
+ <sketches.version>0.8.3</sketches.version>
+ <hbc-core.version>2.2.0</hbc-core.version>
+ <cassandra-driver-core.version>3.6.0</cassandra-driver-core.version>
+ <aerospike-client.version>4.4.8</aerospike-client.version>
+ <kafka-client.version>2.3.0</kafka-client.version>
+ <rabbitmq-client.version>5.1.1</rabbitmq-client.version>
+ <aws-sdk.version>1.11.774</aws-sdk.version>
+ <avro.version>1.9.1</avro.version>
+ <joda.version>2.10.1</joda.version>
+ <jclouds.version>2.2.1</jclouds.version>
+ <sqlite-jdbc.version>3.8.11.2</sqlite-jdbc.version>
+ <mysql-jdbc.version>8.0.11</mysql-jdbc.version>
+ <postgresql-jdbc.version>42.2.12</postgresql-jdbc.version>
+ <clickhouse-jdbc.version>0.2.4</clickhouse-jdbc.version>
+ <mariadb-jdbc.version>2.6.0</mariadb-jdbc.version>
+ <hdfs-offload-version3>3.2.0</hdfs-offload-version3>
+ <org.eclipse.jetty-hdfs-offload>9.3.24.v20180605</org.eclipse.jetty-hdfs-offload>
+ <elasticsearch.version>7.9.1</elasticsearch.version>
+ <presto.version>334</presto.version>
+ <flink.version>1.6.0</flink.version>
<scala.binary.version>2.11</scala.binary.version>
<scala-library.version>2.11.12</scala-library.version>
<debezium.version>1.0.3.Final</debezium.version>
@@ -422,6 +424,18 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
+ <version>${jetty.version}</version>
+ </dependency>
+
+ <dependency>
+ <groupId>org.conscrypt</groupId>
+ <artifactId>conscrypt-openjdk-uber</artifactId>
+ <version>${conscrypt.version}</version>
+ </dependency>
+
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
<version>${jetty.version}</version>
</dependency>
@@ -1744,4 +1758,3 @@
</repositories>
</project>
-
diff --git a/pulsar-broker/pom.xml b/pulsar-broker/pom.xml
index c3c3dc5..b3209ec 100644
--- a/pulsar-broker/pom.xml
+++ b/pulsar-broker/pom.xml
@@ -184,6 +184,11 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
</dependency>
diff --git a/pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java b/pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java
index b623725..75b4564 100644
--- a/pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java
+++ b/pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/AdminApiTlsAuthTest.java
@@ -41,7 +41,7 @@ import org.apache.pulsar.client.admin.internal.JacksonConfigurator;
import org.apache.pulsar.client.api.Producer;
import org.apache.pulsar.client.api.PulsarClient;
import org.apache.pulsar.client.api.Schema;
-import org.apache.pulsar.client.impl.tls.NoopHostnameVerifier;
+import org.apache.pulsar.common.tls.NoopHostnameVerifier;
import org.apache.pulsar.common.policies.data.AuthAction;
import org.apache.pulsar.common.policies.data.ClusterData;
import org.apache.pulsar.common.policies.data.TenantInfo;
diff --git a/pulsar-broker/src/test/java/org/apache/pulsar/client/api/AuthenticationTlsHostnameVerificationTest.java b/pulsar-broker/src/test/java/org/apache/pulsar/client/api/AuthenticationTlsHostnameVerificationTest.java
index cf04a4f..54a847f 100644
--- a/pulsar-broker/src/test/java/org/apache/pulsar/client/api/AuthenticationTlsHostnameVerificationTest.java
+++ b/pulsar-broker/src/test/java/org/apache/pulsar/client/api/AuthenticationTlsHostnameVerificationTest.java
@@ -32,8 +32,8 @@ import org.apache.pulsar.broker.authentication.AuthenticationProviderBasic;
import org.apache.pulsar.broker.authentication.AuthenticationProviderTls;
import org.apache.pulsar.client.admin.PulsarAdmin;
import org.apache.pulsar.client.impl.auth.AuthenticationTls;
-import org.apache.pulsar.client.impl.tls.PublicSuffixMatcher;
-import org.apache.pulsar.client.impl.tls.TlsHostnameVerifier;
+import org.apache.pulsar.common.tls.PublicSuffixMatcher;
+import org.apache.pulsar.common.tls.TlsHostnameVerifier;
import org.apache.pulsar.common.policies.data.ClusterData;
import org.apache.pulsar.common.policies.data.TenantInfo;
import org.slf4j.Logger;
diff --git a/pulsar-broker/src/test/java/org/apache/pulsar/client/impl/AdminApiKeyStoreTlsAuthTest.java b/pulsar-broker/src/test/java/org/apache/pulsar/client/impl/AdminApiKeyStoreTlsAuthTest.java
index 7752f81..898c656 100644
--- a/pulsar-broker/src/test/java/org/apache/pulsar/client/impl/AdminApiKeyStoreTlsAuthTest.java
+++ b/pulsar-broker/src/test/java/org/apache/pulsar/client/impl/AdminApiKeyStoreTlsAuthTest.java
@@ -46,7 +46,7 @@ import org.apache.pulsar.client.admin.PulsarAdminException;
import org.apache.pulsar.client.admin.internal.JacksonConfigurator;
import org.apache.pulsar.client.api.ProducerConsumerBase;
import org.apache.pulsar.client.impl.auth.AuthenticationKeyStoreTls;
-import org.apache.pulsar.client.impl.tls.NoopHostnameVerifier;
+import org.apache.pulsar.common.tls.NoopHostnameVerifier;
import org.apache.pulsar.common.policies.data.ClusterData;
import org.apache.pulsar.common.policies.data.TenantInfo;
import org.apache.pulsar.common.util.keystoretls.KeyStoreSSLContext;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ClientCnx.java b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ClientCnx.java
index 8c1f8cc..4fb10e4 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ClientCnx.java
+++ b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ClientCnx.java
@@ -60,7 +60,9 @@ import org.apache.pulsar.client.api.PulsarClientException;
import org.apache.pulsar.client.api.PulsarClientException.TimeoutException;
import org.apache.pulsar.client.impl.BinaryProtoLookupService.LookupDataResult;
import org.apache.pulsar.client.impl.conf.ClientConfigurationData;
-import org.apache.pulsar.client.impl.tls.TlsHostnameVerifier;
+import org.apache.pulsar.common.tls.TlsHostnameVerifier;
+import org.apache.pulsar.client.impl.transaction.TransactionBufferHandler;
+import org.apache.pulsar.client.util.TimedCompletableFuture;
import org.apache.pulsar.common.api.AuthData;
import org.apache.pulsar.common.api.proto.PulsarApi;
import org.apache.pulsar.common.protocol.Commands;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/DomainType.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/DomainType.java
similarity index 95%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/DomainType.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/DomainType.java
index 5ed4f67..e4527b5 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/DomainType.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/DomainType.java
@@ -17,7 +17,7 @@
* under the License.
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
/**
* Domain types differentiated by Mozilla Public Suffix List.
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/InetAddressUtils.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/InetAddressUtils.java
similarity index 99%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/InetAddressUtils.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/InetAddressUtils.java
index 1a9bf61..65f9b37 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/InetAddressUtils.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/InetAddressUtils.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import java.util.regex.Pattern;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/NoopHostnameVerifier.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/NoopHostnameVerifier.java
similarity index 96%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/NoopHostnameVerifier.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/NoopHostnameVerifier.java
index 7962e3e..edc734c 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/NoopHostnameVerifier.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/NoopHostnameVerifier.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixList.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixList.java
similarity index 97%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixList.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixList.java
index eb1671a..4cc3415 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixList.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixList.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import java.util.Collections;
import java.util.List;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixMatcher.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixMatcher.java
similarity index 99%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixMatcher.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixMatcher.java
index 05d2eca..45c2bd3 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/PublicSuffixMatcher.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/PublicSuffixMatcher.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import java.net.IDN;
import java.util.Collection;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/SubjectName.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/SubjectName.java
similarity index 96%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/SubjectName.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/SubjectName.java
index 2885b88..04034e3 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/SubjectName.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/SubjectName.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import lombok.Data;
diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/TlsHostnameVerifier.java b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/TlsHostnameVerifier.java
similarity index 99%
rename from pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/TlsHostnameVerifier.java
rename to pulsar-common/src/main/java/org/apache/pulsar/common/tls/TlsHostnameVerifier.java
index 5357656..9a2964d 100644
--- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/tls/TlsHostnameVerifier.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/tls/TlsHostnameVerifier.java
@@ -21,7 +21,7 @@
* From Apache HTTP client
*/
-package org.apache.pulsar.client.impl.tls;
+package org.apache.pulsar.common.tls;
import java.net.InetAddress;
import java.net.UnknownHostException;
diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java
index aba2f92..fcf2b19 100644
--- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/SecurityUtility.java
@@ -29,6 +29,8 @@ import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
+import java.lang.reflect.Method;
+import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.KeyFactory;
import java.security.KeyManagementException;
@@ -49,6 +51,8 @@ import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
import java.util.Collection;
import java.util.Set;
+import java.util.concurrent.ScheduledExecutorService;
+import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
@@ -58,6 +62,9 @@ import javax.net.ssl.TrustManagerFactory;
import lombok.extern.slf4j.Slf4j;
import org.apache.commons.lang3.StringUtils;
+import org.apache.pulsar.common.classification.InterfaceAudience;
+import org.apache.pulsar.common.classification.InterfaceStability;
+import org.apache.pulsar.common.tls.TlsHostnameVerifier;
import org.eclipse.jetty.util.ssl.SslContextFactory;
/**
@@ -69,6 +76,9 @@ public class SecurityUtility {
public static final Provider BC_PROVIDER = getProvider();
public static final String BC_FIPS_PROVIDER_CLASS = "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider";
public static final String BC_NON_FIPS_PROVIDER_CLASS = "org.bouncycastle.jce.provider.BouncyCastleProvider";
+ public static final String CONSCRYPT_PROVIDER_CLASS = "org.conscrypt.OpenSSLProvider";
+ public static final Provider CONSCRYPT_PROVIDER = loadConscryptProvider();
+
// Security.getProvider("BC") / Security.getProvider("BCFIPS").
// also used to get Factories. e.g. CertificateFactory.getInstance("X.509", "BCFIPS")
public static final String BC_FIPS = "BCFIPS";
@@ -106,6 +116,54 @@ public class SecurityUtility {
}
}
+ private static Provider loadConscryptProvider() {
+ Provider provider;
+ try {
+ provider = (Provider) Class.forName(CONSCRYPT_PROVIDER_CLASS).newInstance();
+ } catch (ReflectiveOperationException e) {
+ log.warn("Unable to get security provider for class {}", CONSCRYPT_PROVIDER_CLASS, e);
+ return null;
+ }
+
+ // Configure Conscrypt's default hostname verifier to use Pulsar's TlsHostnameVerifier which
+ // is more relaxed than the Conscrypt HostnameVerifier checking for RFC 2818 conformity.
+ //
+ // Certificates used in Pulsar docs and examples aren't strictly RFC 2818 compliant since they use the
+ // deprecated way of specifying the hostname in the CN field of the subject DN of the certificate.
+ // RFC 2818 recommends the use of SAN (subjectAltName) extension for specifying the hostname in the dNSName
+ // field of the subjectAltName extension.
+ //
+ // Conscrypt's default HostnameVerifier has dropped support for the deprecated method of specifying the hostname
+ // in the CN field. Pulsar's TlsHostnameVerifier continues to support the CN field.
+ //
+ // more details of Conscrypt's hostname verification:
+ // https://github.com/google/conscrypt/blob/master/IMPLEMENTATION_NOTES.md#hostname-verification
+ // there's a bug in Conscrypt while setting a custom HostnameVerifier,
+ // https://github.com/google/conscrypt/issues/1015 and therefore this solution alone
+ // isn't sufficient to configure Conscrypt's hostname verifier. The method processConscryptTrustManager
+ // contains the workaround.
+ try {
+ HostnameVerifier hostnameVerifier = new TlsHostnameVerifier();
+ Class<?> conscryptClazz = Class.forName("org.conscrypt.Conscrypt");
+ Object wrappedHostnameVerifier = conscryptClazz
+ .getMethod("wrapHostnameVerifier",
+ new Class[]{HostnameVerifier.class}).invoke(null, hostnameVerifier);
+ Method setDefaultHostnameVerifierMethod =
+ conscryptClazz
+ .getMethod("setDefaultHostnameVerifier",
+ new Class[]{Class.forName("org.conscrypt.ConscryptHostnameVerifier")});
+ setDefaultHostnameVerifierMethod.invoke(null, wrappedHostnameVerifier);
+ } catch (Exception e) {
+ log.warn("Unable to set default hostname verifier for Conscrypt", e);
+ }
+
+ Security.addProvider(provider);
+ if (log.isDebugEnabled()) {
+ log.debug("Added security provider '{}' from class {}", provider.getName(), CONSCRYPT_PROVIDER_CLASS);
+ }
+ return provider;
+ }
+
/**
* Get Bouncy Castle provider from classpath, and call Security.addProvider.
* Throw Exception if failed.
@@ -209,10 +267,11 @@ public class SecurityUtility {
TrustManager[] trustManagers = null;
KeyManager[] keyManagers = null;
- trustManagers = setupTrustCerts(ksh, allowInsecureConnection, trustCertficates);
+ trustManagers = setupTrustCerts(ksh, allowInsecureConnection, trustCertficates, CONSCRYPT_PROVIDER);
keyManagers = setupKeyManager(ksh, privateKey, certificates);
- SSLContext sslCtx = SSLContext.getInstance("TLS");
+ SSLContext sslCtx = CONSCRYPT_PROVIDER != null ? SSLContext.getInstance("TLS", CONSCRYPT_PROVIDER)
+ : SSLContext.getInstance("TLS");
sslCtx.init(keyManagers, trustManagers, new SecureRandom());
sslCtx.getDefaultSSLParameters();
return sslCtx;
@@ -231,12 +290,15 @@ public class SecurityUtility {
}
private static TrustManager[] setupTrustCerts(KeyStoreHolder ksh, boolean allowInsecureConnection,
- Certificate[] trustCertficates) throws NoSuchAlgorithmException, KeyStoreException {
+ Certificate[] trustCertficates, Provider securityProvider)
+ throws NoSuchAlgorithmException, KeyStoreException {
TrustManager[] trustManagers;
if (allowInsecureConnection) {
trustManagers = InsecureTrustManagerFactory.INSTANCE.getTrustManagers();
} else {
- TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ TrustManagerFactory tmf = securityProvider != null
+ ? TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm(), securityProvider)
+ : TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
if (trustCertficates == null || trustCertficates.length == 0) {
tmf.init((KeyStore) null);
@@ -248,10 +310,54 @@ public class SecurityUtility {
}
trustManagers = tmf.getTrustManagers();
+
+ for (TrustManager trustManager : trustManagers) {
+ processConscryptTrustManager(trustManager);
+ }
+ }
+ return trustManagers;
+ }
+
+ /***
+ * Conscrypt TrustManager instances will be configured to use the Pulsar {@link TlsHostnameVerifier}
+ * class.
+ * This method is used as a workaround for https://github.com/google/conscrypt/issues/1015
+ * when Conscrypt / OpenSSL is used as the TLS security provider.
+ *
+ * @param trustManagers the array of TrustManager instances to process.
+ * @return same instance passed as parameter
+ */
+ @InterfaceAudience.Private
+ public static TrustManager[] processConscryptTrustManagers(TrustManager[] trustManagers) {
+ for (TrustManager trustManager : trustManagers) {
+ processConscryptTrustManager(trustManager);
}
return trustManagers;
}
+ // workaround https://github.com/google/conscrypt/issues/1015
+ private static void processConscryptTrustManager(TrustManager trustManager) {
+ if (trustManager.getClass().getName().equals("org.conscrypt.TrustManagerImpl")) {
+ try {
+ Class<?> conscryptClazz = Class.forName("org.conscrypt.Conscrypt");
+ Object hostnameVerifier = conscryptClazz.getMethod("getHostnameVerifier",
+ new Class[]{TrustManager.class}).invoke(null, trustManager);
+ if (hostnameVerifier == null) {
+ Object defaultHostnameVerifier = conscryptClazz.getMethod("getDefaultHostnameVerifier",
+ new Class[]{TrustManager.class}).invoke(null, trustManager);
+ if (defaultHostnameVerifier != null) {
+ conscryptClazz.getMethod("setHostnameVerifier", new Class[]{
+ TrustManager.class,
+ Class.forName("org.conscrypt.ConscryptHostnameVerifier")
+ }).invoke(null, trustManager, defaultHostnameVerifier);
+ }
+ }
+ } catch (ReflectiveOperationException e) {
+ log.warn("Unable to set hostname verifier for Conscrypt TrustManager implementation", e);
+ }
+ }
+ }
+
public static X509Certificate[] loadCertificatesFromPemFile(String certFilePath) throws KeyManagementException {
X509Certificate[] certificates = null;
@@ -411,6 +517,9 @@ public class SecurityUtility {
super();
sslCtxRefresher = new DefaultSslContextBuilder(tlsAllowInsecureConnection, tlsTrustCertsFilePath,
tlsCertificateFilePath, tlsKeyFilePath, tlsRequireTrustedClientCertOnConnect, certRefreshInSec);
+ if (CONSCRYPT_PROVIDER != null) {
+ setProvider(CONSCRYPT_PROVIDER.getName());
+ }
}
@Override
diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/KeyStoreSSLContext.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/KeyStoreSSLContext.java
index e6c1af8..c7b4cfe 100644
--- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/KeyStoreSSLContext.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/KeyStoreSSLContext.java
@@ -40,6 +40,7 @@ import javax.net.ssl.SSLException;
import javax.net.ssl.TrustManagerFactory;
import lombok.Getter;
import lombok.extern.slf4j.Slf4j;
+import org.apache.pulsar.common.util.SecurityUtility;
import org.eclipse.jetty.util.ssl.SslContextFactory;
/**
@@ -152,7 +153,9 @@ public class KeyStoreSSLContext {
if (this.allowInsecureConnection) {
trustManagerFactory = InsecureTrustManagerFactory.INSTANCE;
} else {
- trustManagerFactory = TrustManagerFactory.getInstance(tmfAlgorithm);
+ trustManagerFactory = sslProviderString != null
+ ? TrustManagerFactory.getInstance(tmfAlgorithm, sslProviderString)
+ : TrustManagerFactory.getInstance(tmfAlgorithm);
KeyStore trustStore = KeyStore.getInstance(trustStoreTypeString);
char[] passwordChars = trustStorePassword.toCharArray();
trustStore.load(new FileInputStream(trustStorePath), passwordChars);
@@ -160,7 +163,9 @@ public class KeyStoreSSLContext {
}
// init
- sslContext.init(keyManagers, trustManagerFactory.getTrustManagers(), new SecureRandom());
+ sslContext.init(keyManagers, SecurityUtility
+ .processConscryptTrustManagers(trustManagerFactory.getTrustManagers()),
+ new SecureRandom());
this.sslContext = sslContext;
return sslContext;
}
@@ -336,6 +341,13 @@ public class KeyStoreSSLContext {
throws GeneralSecurityException, SSLException, FileNotFoundException, IOException {
SslContextFactory sslCtxFactory;
+ if (sslProviderString == null) {
+ Provider provider = SecurityUtility.CONSCRYPT_PROVIDER;
+ if (provider != null) {
+ sslProviderString = provider.getName();
+ }
+ }
+
sslCtxFactory = new SslContextFactoryWithAutoRefresh(
sslProviderString,
keyStoreTypeString,
diff --git a/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/SslContextFactoryWithAutoRefresh.java b/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/SslContextFactoryWithAutoRefresh.java
index e18e8c6..0882a3a 100644
--- a/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/SslContextFactoryWithAutoRefresh.java
+++ b/pulsar-common/src/main/java/org/apache/pulsar/common/util/keystoretls/SslContextFactoryWithAutoRefresh.java
@@ -54,6 +54,9 @@ public class SslContextFactoryWithAutoRefresh extends SslContextFactory {
trustStorePassword,
requireTrustedClientCertOnConnect,
certRefreshInSec);
+ if (sslProviderString != null) {
+ setProvider(sslProviderString);
+ }
}
@Override
diff --git a/pulsar-discovery-service/pom.xml b/pulsar-discovery-service/pom.xml
index 065a177..720bfc6 100644
--- a/pulsar-discovery-service/pom.xml
+++ b/pulsar-discovery-service/pom.xml
@@ -76,6 +76,11 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
</dependency>
diff --git a/pulsar-functions/worker/pom.xml b/pulsar-functions/worker/pom.xml
index fd3a43d..19ce6a4 100644
--- a/pulsar-functions/worker/pom.xml
+++ b/pulsar-functions/worker/pom.xml
@@ -90,6 +90,11 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
</dependency>
diff --git a/pulsar-proxy/pom.xml b/pulsar-proxy/pom.xml
index 3e8fab9..ab42b36 100644
--- a/pulsar-proxy/pom.xml
+++ b/pulsar-proxy/pom.xml
@@ -73,6 +73,11 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
</dependency>
diff --git a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java
index 3e3d668..43d6879 100644
--- a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java
+++ b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java
@@ -59,7 +59,7 @@ import org.apache.pulsar.PulsarVersion;
import org.apache.pulsar.client.api.Authentication;
import org.apache.pulsar.client.api.AuthenticationDataProvider;
import org.apache.pulsar.client.api.PulsarClientException;
-import org.apache.pulsar.client.impl.tls.TlsHostnameVerifier;
+import org.apache.pulsar.common.tls.TlsHostnameVerifier;
import org.apache.pulsar.common.allocator.PulsarByteBufAllocator;
import org.apache.pulsar.common.api.AuthData;
import org.apache.pulsar.common.api.proto.PulsarApi.CommandAuthChallenge;
diff --git a/tiered-storage/file-system/pom.xml b/tiered-storage/file-system/pom.xml
index 2e201d9..d0bc0f7 100644
--- a/tiered-storage/file-system/pom.xml
+++ b/tiered-storage/file-system/pom.xml
@@ -80,19 +80,21 @@
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-server</artifactId>
- <version>${jetty.version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>jetty-alpn-conscrypt-server</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
- <version>${jetty.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-util</artifactId>
- <version>${jetty.version}</version>
<scope>test</scope>
</dependency>
</dependencies>