You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by yu...@apache.org on 2016/10/20 14:48:26 UTC
[05/12] cassandra git commit: Merge branch 'cassandra-3.0' into
cassandra-3.X
Merge branch 'cassandra-3.0' into cassandra-3.X
Project: http://git-wip-us.apache.org/repos/asf/cassandra/repo
Commit: http://git-wip-us.apache.org/repos/asf/cassandra/commit/23bfcabf
Tree: http://git-wip-us.apache.org/repos/asf/cassandra/tree/23bfcabf
Diff: http://git-wip-us.apache.org/repos/asf/cassandra/diff/23bfcabf
Branch: refs/heads/trunk
Commit: 23bfcabfb37eee0cdabfdcfc46ed2c4b9709ccf3
Parents: d8c8366 86a73d4
Author: Yuki Morishita <yu...@apache.org>
Authored: Thu Oct 20 09:45:28 2016 -0500
Committer: Yuki Morishita <yu...@apache.org>
Committed: Thu Oct 20 09:45:28 2016 -0500
----------------------------------------------------------------------
CHANGES.txt | 1 +
.../apache/cassandra/security/SSLFactory.java | 53 ++++++++++++++++----
2 files changed, 43 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cassandra/blob/23bfcabf/CHANGES.txt
----------------------------------------------------------------------
diff --cc CHANGES.txt
index cdb2d1d,ec32945..cc82dea
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@@ -1,91 -1,5 +1,92 @@@
-3.0.10
+3.10
+ * Make the fanout size for LeveledCompactionStrategy to be configurable (CASSANDRA-11550)
+ * Add duration data type (CASSANDRA-11873)
+ * Fix timeout in ReplicationAwareTokenAllocatorTest (CASSANDRA-12784)
+ * Improve sum aggregate functions (CASSANDRA-12417)
+ * Make cassandra.yaml docs for batch_size_*_threshold_in_kb reflect changes in CASSANDRA-10876 (CASSANDRA-12761)
+ * cqlsh fails to format collections when using aliases (CASSANDRA-11534)
+ * Check for hash conflicts in prepared statements (CASSANDRA-12733)
+ * Exit query parsing upon first error (CASSANDRA-12598)
+ * Fix cassandra-stress to use single seed in UUID generation (CASSANDRA-12729)
+ * CQLSSTableWriter does not allow Update statement (CASSANDRA-12450)
+ * Config class uses boxed types but DD exposes primitive types (CASSANDRA-12199)
+ * Add pre- and post-shutdown hooks to Storage Service (CASSANDRA-12461)
+ * Add hint delivery metrics (CASSANDRA-12693)
+ * Remove IndexInfo cache from FileIndexInfoRetriever (CASSANDRA-12731)
+ * ColumnIndex does not reuse buffer (CASSANDRA-12502)
+ * cdc column addition still breaks schema migration tasks (CASSANDRA-12697)
+ * Upgrade metrics-reporter dependencies (CASSANDRA-12089)
+ * Tune compaction thread count via nodetool (CASSANDRA-12248)
+ * Add +=/-= shortcut syntax for update queries (CASSANDRA-12232)
+ * Include repair session IDs in repair start message (CASSANDRA-12532)
+ * Add a blocking task to Index, run before joining the ring (CASSANDRA-12039)
+ * Fix NPE when using CQLSSTableWriter (CASSANDRA-12667)
+ * Support optional backpressure strategies at the coordinator (CASSANDRA-9318)
+ * Make randompartitioner work with new vnode allocation (CASSANDRA-12647)
+ * Fix cassandra-stress graphing (CASSANDRA-12237)
+ * Allow filtering on partition key columns for queries without secondary indexes (CASSANDRA-11031)
+ * Fix Cassandra Stress reporting thread model and precision (CASSANDRA-12585)
+ * Add JMH benchmarks.jar (CASSANDRA-12586)
+ * Add row offset support to SASI (CASSANDRA-11990)
+ * Cleanup uses of AlterTableStatementColumn (CASSANDRA-12567)
+ * Add keep-alive to streaming (CASSANDRA-11841)
+ * Tracing payload is passed through newSession(..) (CASSANDRA-11706)
+ * avoid deleting non existing sstable files and improve related log messages (CASSANDRA-12261)
+ * json/yaml output format for nodetool compactionhistory (CASSANDRA-12486)
+ * Retry all internode messages once after a connection is
+ closed and reopened (CASSANDRA-12192)
+ * Add support to rebuild from targeted replica (CASSANDRA-9875)
+ * Add sequence distribution type to cassandra stress (CASSANDRA-12490)
+ * "SELECT * FROM foo LIMIT ;" does not error out (CASSANDRA-12154)
+ * Define executeLocally() at the ReadQuery Level (CASSANDRA-12474)
+ * Extend read/write failure messages with a map of replica addresses
+ to error codes in the v5 native protocol (CASSANDRA-12311)
+ * Fix rebuild of SASI indexes with existing index files (CASSANDRA-12374)
+ * Let DatabaseDescriptor not implicitly startup services (CASSANDRA-9054, 12550)
+ * Fix clustering indexes in presence of static columns in SASI (CASSANDRA-12378)
+ * Fix queries on columns with reversed type on SASI indexes (CASSANDRA-12223)
+ * Added slow query log (CASSANDRA-12403)
+ * Count full coordinated request against timeout (CASSANDRA-12256)
+ * Allow TTL with null value on insert and update (CASSANDRA-12216)
+ * Make decommission operation resumable (CASSANDRA-12008)
+ * Add support to one-way targeted repair (CASSANDRA-9876)
+ * Remove clientutil jar (CASSANDRA-11635)
+ * Fix compaction throughput throttle (CASSANDRA-12366, CASSANDRA-12717)
+ * Delay releasing Memtable memory on flush until PostFlush has finished running (CASSANDRA-12358)
+ * Cassandra stress should dump all setting on startup (CASSANDRA-11914)
+ * Make it possible to compact a given token range (CASSANDRA-10643)
+ * Allow updating DynamicEndpointSnitch properties via JMX (CASSANDRA-12179)
+ * Collect metrics on queries by consistency level (CASSANDRA-7384)
+ * Add support for GROUP BY to SELECT statement (CASSANDRA-10707)
+ * Deprecate memtable_cleanup_threshold and update default for memtable_flush_writers (CASSANDRA-12228)
+ * Upgrade to OHC 0.4.4 (CASSANDRA-12133)
+ * Add version command to cassandra-stress (CASSANDRA-12258)
+ * Create compaction-stress tool (CASSANDRA-11844)
+ * Garbage-collecting compaction operation and schema option (CASSANDRA-7019)
+ * Add beta protocol flag for v5 native protocol (CASSANDRA-12142)
+ * Support filtering on non-PRIMARY KEY columns in the CREATE
+ MATERIALIZED VIEW statement's WHERE clause (CASSANDRA-10368)
+ * Unify STDOUT and SYSTEMLOG logback format (CASSANDRA-12004)
+ * COPY FROM should raise error for non-existing input files (CASSANDRA-12174)
+ * Faster write path (CASSANDRA-12269)
+ * Option to leave omitted columns in INSERT JSON unset (CASSANDRA-11424)
+ * Support json/yaml output in nodetool tpstats (CASSANDRA-12035)
+ * Expose metrics for successful/failed authentication attempts (CASSANDRA-10635)
+ * Prepend snapshot name with "truncated" or "dropped" when a snapshot
+ is taken before truncating or dropping a table (CASSANDRA-12178)
+ * Optimize RestrictionSet (CASSANDRA-12153)
+ * cqlsh does not automatically downgrade CQL version (CASSANDRA-12150)
+ * Omit (de)serialization of state variable in UDAs (CASSANDRA-9613)
+ * Create a system table to expose prepared statements (CASSANDRA-8831)
+ * Reuse DataOutputBuffer from ColumnIndex (CASSANDRA-11970)
+ * Remove DatabaseDescriptor dependency from SegmentedFile (CASSANDRA-11580)
+ * Add supplied username to authentication error messages (CASSANDRA-12076)
+ * Remove pre-startup check for open JMX port (CASSANDRA-12074)
+ * Remove compaction Severity from DynamicEndpointSnitch (CASSANDRA-11738)
+ * Restore resumable hints delivery (CASSANDRA-11960)
+ * Properly report LWT contention (CASSANDRA-12626)
+Merged from 3.0:
+ * Fix potential socket leak (CASSANDRA-12329)
* Fix ViewTest.testCompaction (CASSANDRA-12789)
* Improve avg aggregate functions (CASSANDRA-12417)
* Preserve quoted reserved keyword column names in MV creation (CASSANDRA-11803)
http://git-wip-us.apache.org/repos/asf/cassandra/blob/23bfcabf/src/java/org/apache/cassandra/security/SSLFactory.java
----------------------------------------------------------------------
diff --cc src/java/org/apache/cassandra/security/SSLFactory.java
index 2e59b06,56a3a3f..7216e2c
--- a/src/java/org/apache/cassandra/security/SSLFactory.java
+++ b/src/java/org/apache/cassandra/security/SSLFactory.java
@@@ -59,12 -59,22 +59,19 @@@ public final class SSLFactor
public static SSLServerSocket getServerSocket(EncryptionOptions options, InetAddress address, int port) throws IOException
{
SSLContext ctx = createSSLContext(options, true);
- SSLServerSocket serverSocket = (SSLServerSocket) ctx.getServerSocketFactory().createServerSocket();
+ SSLServerSocket serverSocket = (SSLServerSocket)ctx.getServerSocketFactory().createServerSocket();
- serverSocket.setReuseAddress(true);
- prepareSocket(serverSocket, options);
- serverSocket.bind(new InetSocketAddress(address, port), 500);
-
- return serverSocket;
+ try
+ {
+ serverSocket.setReuseAddress(true);
- String[] suites = filterCipherSuites(serverSocket.getSupportedCipherSuites(), options.cipher_suites);
- serverSocket.setEnabledCipherSuites(suites);
- serverSocket.setNeedClientAuth(options.require_client_auth);
- serverSocket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
++ prepareSocket(serverSocket, options);
+ serverSocket.bind(new InetSocketAddress(address, port), 500);
+ return serverSocket;
+ }
+ catch (IllegalArgumentException | SecurityException | IOException e)
+ {
+ serverSocket.close();
+ throw e;
+ }
}
/** Create a socket and connect */
@@@ -72,8 -82,18 +79,16 @@@
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port, localAddress, localPort);
- prepareSocket(socket, options);
- return socket;
+ try
+ {
- String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
- socket.setEnabledCipherSuites(suites);
- socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
++ prepareSocket(socket, options);
+ return socket;
+ }
+ catch (IllegalArgumentException e)
+ {
+ socket.close();
+ throw e;
+ }
}
/** Create a socket and connect, using any local address */
@@@ -81,8 -101,18 +96,16 @@@
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port);
- prepareSocket(socket, options);
- return socket;
+ try
+ {
- String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
- socket.setEnabledCipherSuites(suites);
- socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
++ prepareSocket(socket, options);
+ return socket;
+ }
+ catch (IllegalArgumentException e)
+ {
+ socket.close();
+ throw e;
+ }
}
/** Just create a socket */
@@@ -90,37 -120,20 +113,45 @@@
{
SSLContext ctx = createSSLContext(options, true);
SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket();
- prepareSocket(socket, options);
- return socket;
+ try
+ {
- String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
- socket.setEnabledCipherSuites(suites);
- socket.setEnabledProtocols(ACCEPTED_PROTOCOLS);
++ prepareSocket(socket, options);
+ return socket;
+ }
+ catch (IllegalArgumentException e)
+ {
+ socket.close();
+ throw e;
+ }
}
+ /** Sets relevant socket options specified in encryption settings */
+ private static void prepareSocket(SSLServerSocket serverSocket, EncryptionOptions options)
+ {
+ String[] suites = filterCipherSuites(serverSocket.getSupportedCipherSuites(), options.cipher_suites);
+ if(options.require_endpoint_verification)
+ {
+ SSLParameters sslParameters = serverSocket.getSSLParameters();
+ sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+ serverSocket.setSSLParameters(sslParameters);
+ }
+ serverSocket.setEnabledCipherSuites(suites);
+ serverSocket.setNeedClientAuth(options.require_client_auth);
+ }
+
+ /** Sets relevant socket options specified in encryption settings */
+ private static void prepareSocket(SSLSocket socket, EncryptionOptions options)
+ {
+ String[] suites = filterCipherSuites(socket.getSupportedCipherSuites(), options.cipher_suites);
+ if(options.require_endpoint_verification)
+ {
+ SSLParameters sslParameters = socket.getSSLParameters();
+ sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
+ socket.setSSLParameters(sslParameters);
+ }
+ socket.setEnabledCipherSuites(suites);
+ }
+
@SuppressWarnings("resource")
public static SSLContext createSSLContext(EncryptionOptions options, boolean buildTruststore) throws IOException
{