You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by sa...@apache.org on 2016/05/21 19:07:42 UTC
[1/5] lucene-solr:branch_6_0: SOLR-5776: refactor SSLConfig so that
SSLTestConfig can provide SSLContexts using a NullSecureRandom to prevent SSL
tests from blocking on entropy starved machines
Repository: lucene-solr
Updated Branches:
refs/heads/branch_6_0 4031d3fd4 -> 3cc008253
SOLR-5776: refactor SSLConfig so that SSLTestConfig can provide SSLContexts using a NullSecureRandom to prevent SSL tests from blocking on entropy starved machines
(cherry picked from commit f45bd03ca2cc301dcec4e68c49d961c306d8f434)
Conflicts:
solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/a81e3cf0
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/a81e3cf0
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/a81e3cf0
Branch: refs/heads/branch_6_0
Commit: a81e3cf04692bf372edf098bbead17c315a9a755
Parents: 4031d3f
Author: Chris Hostetter <ho...@apache.org>
Authored: Tue May 3 14:01:23 2016 -0700
Committer: Steve Rowe <sa...@apache.org>
Committed: Sat May 21 13:04:40 2016 -0400
----------------------------------------------------------------------
.../solr/client/solrj/embedded/SSLConfig.java | 71 +++++++++-----
.../org/apache/solr/util/SSLTestConfig.java | 98 +++++++++++++++++++-
2 files changed, 143 insertions(+), 26 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/a81e3cf0/solr/core/src/java/org/apache/solr/client/solrj/embedded/SSLConfig.java
----------------------------------------------------------------------
diff --git a/solr/core/src/java/org/apache/solr/client/solrj/embedded/SSLConfig.java b/solr/core/src/java/org/apache/solr/client/solrj/embedded/SSLConfig.java
index f777951..60f383c 100644
--- a/solr/core/src/java/org/apache/solr/client/solrj/embedded/SSLConfig.java
+++ b/solr/core/src/java/org/apache/solr/client/solrj/embedded/SSLConfig.java
@@ -77,38 +77,63 @@ public class SSLConfig {
/**
* Returns an SslContextFactory that should be used by a jetty server based on the specified
- * configuration, or null if no SSL should be used.
+ * SSLConfig param which may be null.
*
- * The specified sslConfig will be completely ignored if the "tests.jettySsl" system property is
- * true - in which case standard "javax.net.ssl.*" system properties will be used instead, along
- * with "tests.jettySsl.clientAuth"
+ * if the SSLConfig param is non-null, then this method will return the results of
+ * {@link #createContextFactory()}.
*
- * @see #isSSLMode
+ * If the SSLConfig param is null, then this method will return null unless the
+ * <code>tests.jettySsl</code> system property is true, in which case standard "javax.net.ssl.*"
+ * system properties will be used instead, along with "tests.jettySsl.clientAuth".
+ *
+ * @see #createContextFactory()
*/
public static SslContextFactory createContextFactory(SSLConfig sslConfig) {
- if (sslConfig == null) {
- if (Boolean.getBoolean("tests.jettySsl")) {
- return configureSslFromSysProps();
- }
- return null;
+ if (sslConfig != null) {
+ return sslConfig.createContextFactory();
}
+ // else...
+ if (Boolean.getBoolean("tests.jettySsl")) {
+ return configureSslFromSysProps();
+ }
+ // else...
+ return null;
+ }
+
+ /**
+ * Returns an SslContextFactory that should be used by a jetty server based on this SSLConfig instance,
+ * or null if SSL should not be used.
+ *
+ * The default implementation generates a simple factory according to the keystore, truststore,
+ * and clientAuth properties of this object.
+ *
+ * @see #getKeyStore
+ * @see #getKeyStorePassword
+ * @see #isClientAuthMode
+ * @see #getTrustStore
+ * @see #getTrustStorePassword
+ */
+ public SslContextFactory createContextFactory() {
- if (!sslConfig.isSSLMode())
- return null;
-
+ if (! isSSLMode()) {
+ return null;
+ }
+ // else...
+
SslContextFactory factory = new SslContextFactory(false);
- if (sslConfig.getKeyStore() != null)
- factory.setKeyStorePath(sslConfig.getKeyStore());
- if (sslConfig.getKeyStorePassword() != null)
- factory.setKeyStorePassword(sslConfig.getKeyStorePassword());
- factory.setNeedClientAuth(sslConfig.isClientAuthMode());
+ if (getKeyStore() != null)
+ factory.setKeyStorePath(getKeyStore());
+ if (getKeyStorePassword() != null)
+ factory.setKeyStorePassword(getKeyStorePassword());
+
+ factory.setNeedClientAuth(isClientAuthMode());
- if (sslConfig.isClientAuthMode()) {
- if (sslConfig.getTrustStore() != null)
- factory.setTrustStorePath(sslConfig.getTrustStore());
- if (sslConfig.getTrustStorePassword() != null)
- factory.setTrustStorePassword(sslConfig.getTrustStorePassword());
+ if (isClientAuthMode()) {
+ if (getTrustStore() != null)
+ factory.setTrustStorePath(getTrustStore());
+ if (getTrustStorePassword() != null)
+ factory.setTrustStorePassword(getTrustStorePassword());
}
return factory;
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/a81e3cf0/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index 35a5eac..eb98fc4 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -21,6 +21,8 @@ import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.SecureRandomSpi;
import java.security.UnrecoverableKeyException;
import javax.net.ssl.SSLContext;
@@ -41,6 +43,7 @@ import org.apache.solr.client.solrj.impl.HttpClientConfigurer;
import org.apache.solr.common.params.SolrParams;
import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
public class SSLTestConfig extends SSLConfig {
public static File TEST_KEYSTORE = ExternalPaths.SERVER_HOME == null ? null
@@ -79,7 +82,10 @@ public class SSLTestConfig extends SSLConfig {
/**
* Builds a new SSLContext for HTTP <b>clients</b> to use when communicating with servers which have
- * been configured based on the settings of this object. Also explicitly allows the use of self-signed
+ * been configured based on the settings of this object.
+ *
+ * NOTE: Uses a completely insecure {@link SecureRandom} instance to prevent tests from blocking
+ * due to lack of entropy, also explicitly allows the use of self-signed
* certificates (since that's what is almost always used during testing).
*/
public SSLContext buildClientSSLContext() throws KeyManagementException,
@@ -88,7 +94,8 @@ public class SSLTestConfig extends SSLConfig {
assert isSSLMode();
SSLContextBuilder builder = SSLContexts.custom();
-
+ builder.setSecureRandom(NullSecureRandom.INSTANCE);
+
// NOTE: KeyStore & TrustStore are swapped because they are from configured from server perspective...
// we are a client - our keystore contains the keys the server trusts, and vice versa
builder.loadTrustMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), new TrustSelfSignedStrategy()).build();
@@ -102,6 +109,54 @@ public class SSLTestConfig extends SSLConfig {
}
/**
+ * Builds a new SSLContext for jetty servers which have been configured based on the settings of
+ * this object.
+ *
+ * NOTE: Uses a completely insecure {@link SecureRandom} instance to prevent tests from blocking
+ * due to lack of entropy, also explicitly allows the use of self-signed
+ * certificates (since that's what is almost always used during testing).
+ * almost always used during testing).
+ */
+ public SSLContext buildServerSSLContext() throws KeyManagementException,
+ UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {
+
+ assert isSSLMode();
+
+ SSLContextBuilder builder = SSLContexts.custom();
+ builder.setSecureRandom(NullSecureRandom.INSTANCE);
+
+ builder.loadKeyMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), getKeyStorePassword().toCharArray());
+
+ if (isClientAuthMode()) {
+ builder.loadTrustMaterial(buildKeyStore(getTrustStore(), getTrustStorePassword()), new TrustSelfSignedStrategy()).build();
+
+ }
+
+ return builder.build();
+ }
+
+ /**
+ * Returns an SslContextFactory using {@link buildServerSSLContext} if SSL should be used, else returns null.
+ */
+ @Override
+ public SslContextFactory createContextFactory() {
+ if (!isSSLMode()) {
+ return null;
+ }
+ // else...
+
+
+ SslContextFactory factory = new SslContextFactory(false);
+ try {
+ factory.setSslContext(buildServerSSLContext());
+ } catch (Exception e) {
+ throw new RuntimeException("ssl context init failure: " + e.getMessage(), e);
+ }
+ factory.setNeedClientAuth(isClientAuthMode());
+ return factory;
+ }
+
+ /**
* Constructs a KeyStore using the specified filename and password
*/
protected static KeyStore buildKeyStore(String keyStoreLocation, String password) {
@@ -202,5 +257,42 @@ public class SSLTestConfig extends SSLConfig {
System.clearProperty("javax.net.ssl.trustStore");
System.clearProperty("javax.net.ssl.trustStorePassword");
}
-
+
+ /**
+ * A mocked up instance of SecureRandom that always does the minimal amount of work to generate
+ * "random" numbers. This is to prevent blocking issues that arise in platform default
+ * SecureRandom instances due to too many instances / not enough random entropy.
+ * Tests do not need secure SSL.
+ */
+ private static class NullSecureRandom extends SecureRandom {
+ public static final SecureRandom INSTANCE = new NullSecureRandom();
+
+ /** SPI Used to init all instances */
+ private static final SecureRandomSpi NULL_SPI = new SecureRandomSpi() {
+ /** NOOP: returns new uninitialized byte[] */
+ public byte[] engineGenerateSeed(int numBytes) {
+ return new byte[numBytes];
+ }
+ /** NOOP */
+ public void engineNextBytes(byte[] bytes) { /* NOOP */ }
+ /** NOOP */
+ public void engineSetSeed(byte[] seed) { /* NOOP */ }
+ };
+
+ private NullSecureRandom() {
+ super(NULL_SPI, null) ;
+ }
+
+ /** NOOP: returns new uninitialized byte[] */
+ public byte[] generateSeed(int numBytes) {
+ return new byte[numBytes];
+ }
+ /** NOOP */
+ synchronized public void nextBytes(byte[] bytes) { /* NOOP */ }
+ /** NOOP */
+ synchronized public void setSeed(byte[] seed) { /* NOOP */ }
+ /** NOOP */
+ synchronized public void setSeed(long seed) { /* NOOP */ }
+
+ }
}
[5/5] lucene-solr:branch_6_0: SOLR-8970: Change SSLTestConfig to use
a keystore file that is included as a resource in the test-framework jar so
users subclassing SolrTestCaseJ4 don't need to preserve magic paths
Posted by sa...@apache.org.
SOLR-8970: Change SSLTestConfig to use a keystore file that is included as a resource in the test-framework jar so users subclassing SolrTestCaseJ4 don't need to preserve magic paths
(cherry picked from commit 76063648ae05a935459f2ea5ed53c4df1caa713d)
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/3cc00825
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/3cc00825
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/3cc00825
Branch: refs/heads/branch_6_0
Commit: 3cc008253513977d1554de3be1c34f35bc4461ae
Parents: fb9b7dc
Author: Chris Hostetter <ho...@apache.org>
Authored: Wed May 11 16:28:07 2016 -0700
Committer: Steve Rowe <sa...@apache.org>
Committed: Sat May 21 14:16:30 2016 -0400
----------------------------------------------------------------------
solr/CHANGES.txt | 9 ++
solr/test-framework/build.xml | 6 ++
.../org/apache/solr/util/SSLTestConfig.java | 95 ++++++++++++++++---
.../resources/SSLTestConfig.testing.keystore | Bin 0 -> 2208 bytes
4 files changed, 97 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/3cc00825/solr/CHANGES.txt
----------------------------------------------------------------------
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 7dd3b36..803b55b 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -101,6 +101,15 @@ Other Changes
* SOLR-9115: Get rid of javax.xml.bind.DatatypeConverter in SimplePostTool
for Java 9 compatibility. (Uwe Schindler)
+* SOLR-5776,SOLR-9068,SOLR-8970:
+ - Refactor SSLConfig so that SSLTestConfig can provide SSLContexts using a NullSecureRandom
+ to prevent SSL tests from blocking on entropy starved machines.
+ - SSLTestConfig: Alternate (psuedo random) NullSecureRandom for Constants.SUN_OS.
+ - SSLTestConfig: Replace NullSecureRandom w/ NotSecurePsuedoRandom.
+ - Change SSLTestConfig to use a keystore file that is included as a resource in the
+ test-framework jar so users subclassing SolrTestCaseJ4 don't need to preserve magic paths.
+ (hossman)
+
================== 6.0.0 ==================
Consult the LUCENE_CHANGES.txt file for additional, low level, changes in this release
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/3cc00825/solr/test-framework/build.xml
----------------------------------------------------------------------
diff --git a/solr/test-framework/build.xml b/solr/test-framework/build.xml
index 021076d..1e0d7b5 100644
--- a/solr/test-framework/build.xml
+++ b/solr/test-framework/build.xml
@@ -38,9 +38,15 @@
</target>
<target name="compile-core" depends="resolve, compile-solr-core, compile-test-framework">
+ <!-- TODO: why does test-framework override compile-core to use this special classpath? -->
<compile srcdir="${src.dir}" destdir="${build.dir}/classes/java">
<classpath refid="test.base.classpath"/>
</compile>
+
+ <!-- Copy the resources folder (if existent) -->
+ <copy todir="${build.dir}/classes/java">
+ <fileset dir="${resources.dir}" erroronmissingdir="no"/>
+ </copy>
</target>
<!-- redefine the clover setup, because we dont want to run clover for the test-framework -->
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/3cc00825/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index c89ed66..7f6ab2e 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -27,6 +27,7 @@ import java.security.SecureRandomSpi;
import java.security.UnrecoverableKeyException;
import javax.net.ssl.SSLContext;
+import java.net.MalformedURLException;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
@@ -47,24 +48,92 @@ import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
import org.eclipse.jetty.util.ssl.SslContextFactory;
+/**
+ * An {@link SSLConfig} that supports reading key/trust store information directly from resource
+ * files provided with the Solr test-framework classes
+ */
public class SSLTestConfig extends SSLConfig {
+
+ /** @deprecated No longer used except by {@link #setSSLSystemProperties} */
public static File TEST_KEYSTORE = ExternalPaths.SERVER_HOME == null ? null
- : new File(ExternalPaths.SERVER_HOME, "../etc/test/solrtest.keystore");
+ : new File(ExternalPaths.SERVER_HOME, "../etc/test/solrtest.keystore");
+ /** @deprecated No longer used except by {@link #setSSLSystemProperties} */
private static String TEST_KEYSTORE_PATH = TEST_KEYSTORE != null
- && TEST_KEYSTORE.exists() ? TEST_KEYSTORE.getAbsolutePath() : null;
- private static String TEST_KEYSTORE_PASSWORD = "secret";
+ && TEST_KEYSTORE.exists() ? TEST_KEYSTORE.getAbsolutePath() : null;
+
+ private static final String TEST_KEYSTORE_RESOURCE = "SSLTestConfig.testing.keystore";
+ private static final String TEST_KEYSTORE_PASSWORD = "secret";
+
+ private final Resource keyStore;
+ private final Resource trustStore;
+ /** Creates an SSLTestConfig that does not use SSL or client authentication */
public SSLTestConfig() {
this(false, false);
}
-
+
+ /**
+ * Create an SSLTestConfig based on a few caller specified options. As needed,
+ * keystore/truststore information will be pulled from a hardocded resource file provided
+ * by the solr test-framework.
+ *
+ * @param useSSL - wether SSL should be required.
+ * @param clientAuth - whether client authentication should be required.
+ */
public SSLTestConfig(boolean useSSL, boolean clientAuth) {
- this(useSSL, clientAuth, TEST_KEYSTORE_PATH, TEST_KEYSTORE_PASSWORD, TEST_KEYSTORE_PATH, TEST_KEYSTORE_PASSWORD);
+ super(useSSL, clientAuth, null, TEST_KEYSTORE_PASSWORD, null, TEST_KEYSTORE_PASSWORD);
+ trustStore = keyStore = Resource.newClassPathResource(TEST_KEYSTORE_RESOURCE);
+ if (null == keyStore || ! keyStore.exists() ) {
+ throw new IllegalStateException("Unable to locate keystore resource file in classpath: "
+ + TEST_KEYSTORE_RESOURCE);
+ }
}
-
+
+ /**
+ * Create an SSLTestConfig using explicit paths for files
+ * @deprecated - use {@link SSLConfig} directly
+ */
+ @Deprecated
public SSLTestConfig(boolean useSSL, boolean clientAuth, String keyStore, String keyStorePassword, String trustStore, String trustStorePassword) {
super(useSSL, clientAuth, keyStore, keyStorePassword, trustStore, trustStorePassword);
+ this.keyStore = tryNewResource(keyStore, "KeyStore");
+ this.trustStore = tryNewResource(trustStore, "TrustStore");
+ }
+
+ /**
+ * Helper utility for building resources from arbitrary user input paths/urls
+ * if input is null, returns null; otherwise attempts to build Resource and verifies that Resource exists.
+ */
+ private static final Resource tryNewResource(String userInput, String type) {
+ if (null == userInput) {
+ return null;
+ }
+ Resource result;
+ try {
+ result = Resource.newResource(userInput);
+ } catch (MalformedURLException e) {
+ throw new IllegalArgumentException("Can't build " + type + " Resource: " + e.getMessage(), e);
+ }
+ if (! result.exists()) {
+ throw new IllegalArgumentException(type + " Resource does not exist " + result.getName());
+ }
+ return result;
+ }
+
+ /** NOTE: This method is meaningless unless you explicitly provide paths when constructing this instance
+ * @see #SSLTestConfig(boolean,boolean,String,String,String,String)
+ */
+ @Override
+ public String getKeyStore() {
+ return super.getKeyStore();
+ }
+ /** NOTE: This method is meaningless unless you explicitly provide paths when constructing this instance
+ * @see #SSLTestConfig(boolean,boolean,String,String,String,String)
+ */
+ @Override
+ public String getTrustStore() {
+ return super.getTrustStore();
}
/**
@@ -100,10 +169,10 @@ public class SSLTestConfig extends SSLConfig {
// NOTE: KeyStore & TrustStore are swapped because they are from configured from server perspective...
// we are a client - our keystore contains the keys the server trusts, and vice versa
- builder.loadTrustMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), new TrustSelfSignedStrategy()).build();
+ builder.loadTrustMaterial(buildKeyStore(keyStore, getKeyStorePassword()), new TrustSelfSignedStrategy()).build();
if (isClientAuthMode()) {
- builder.loadKeyMaterial(buildKeyStore(getTrustStore(), getTrustStorePassword()), getTrustStorePassword().toCharArray());
+ builder.loadKeyMaterial(buildKeyStore(trustStore, getTrustStorePassword()), getTrustStorePassword().toCharArray());
}
@@ -127,10 +196,10 @@ public class SSLTestConfig extends SSLConfig {
SSLContextBuilder builder = SSLContexts.custom();
builder.setSecureRandom(NotSecurePsuedoRandom.INSTANCE);
- builder.loadKeyMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), getKeyStorePassword().toCharArray());
+ builder.loadKeyMaterial(buildKeyStore(keyStore, getKeyStorePassword()), getKeyStorePassword().toCharArray());
if (isClientAuthMode()) {
- builder.loadTrustMaterial(buildKeyStore(getTrustStore(), getTrustStorePassword()), new TrustSelfSignedStrategy()).build();
+ builder.loadTrustMaterial(buildKeyStore(trustStore, getTrustStorePassword()), new TrustSelfSignedStrategy()).build();
}
@@ -161,11 +230,11 @@ public class SSLTestConfig extends SSLConfig {
/**
* Constructs a KeyStore using the specified filename and password
*/
- protected static KeyStore buildKeyStore(String keyStoreLocation, String password) {
+ protected static KeyStore buildKeyStore(Resource resource, String password) {
try {
- return CertificateUtils.getKeyStore(Resource.newResource(keyStoreLocation), "JKS", null, password);
+ return CertificateUtils.getKeyStore(resource, "JKS", null, password);
} catch (Exception ex) {
- throw new IllegalStateException("Unable to build KeyStore from file: " + keyStoreLocation, ex);
+ throw new IllegalStateException("Unable to build KeyStore from resource: " + resource.getName(), ex);
}
}
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/3cc00825/solr/test-framework/src/resources/SSLTestConfig.testing.keystore
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/resources/SSLTestConfig.testing.keystore b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore
new file mode 100644
index 0000000..bcc6ec0
Binary files /dev/null and b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore differ
[3/5] lucene-solr:branch_6_0: SOLR-9068 / SOLR-5776: Alternate
(psuedo random) NullSecureRandom for Constants.SUN_OS
Posted by sa...@apache.org.
SOLR-9068 / SOLR-5776: Alternate (psuedo random) NullSecureRandom for Constants.SUN_OS
(cherry picked from commit a5586d29b23f7d032e6d8f0cf8758e56b09e0208)
Conflicts:
solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/d866ae79
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/d866ae79
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/d866ae79
Branch: refs/heads/branch_6_0
Commit: d866ae79db42c28c99aa7efd58848418b9d2e6a6
Parents: afbb0f5
Author: Chris Hostetter <ho...@apache.org>
Authored: Fri May 6 15:17:11 2016 -0700
Committer: Steve Rowe <sa...@apache.org>
Committed: Sat May 21 13:05:39 2016 -0400
----------------------------------------------------------------------
.../org/apache/solr/util/SSLTestConfig.java | 86 ++++++++++++++++----
1 file changed, 72 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/d866ae79/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index 13b4c21..9c31fc2 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -17,6 +17,7 @@
package org.apache.solr.util;
import java.io.File;
+import java.util.Random;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
@@ -41,6 +42,9 @@ import org.apache.solr.client.solrj.embedded.SSLConfig;
import org.apache.solr.client.solrj.impl.HttpClientUtil;
import org.apache.solr.client.solrj.impl.HttpClientConfigurer;
import org.apache.solr.common.params.SolrParams;
+
+import org.apache.lucene.util.Constants;
+
import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
import org.eclipse.jetty.util.ssl.SslContextFactory;
@@ -265,33 +269,87 @@ public class SSLTestConfig extends SSLConfig {
* Tests do not need secure SSL.
*/
private static class NullSecureRandom extends SecureRandom {
- public static final SecureRandom INSTANCE = new NullSecureRandom();
+
+ /**
+ * The one and only instance that should be used, specific impl may vary based on platform
+ * @see Constants#SUN_OS
+ * @see <a href="https://issues.apache.org/jira/browse/SOLR-9068">SOLR-9068</a>
+ */
+ public static final SecureRandom INSTANCE = Constants.SUN_OS
+ ? new NullSecureRandom(NullSecureRandomSpi.PSUEDO_RAND_INSTANCE)
+ : new NullSecureRandom(NullSecureRandomSpi.NULL_INSTANCE);
+
+ /** A source of psuedo random data if needed */
+ private static final Random RAND = new Random(42);
- /** SPI Used to init all instances */
- private static final SecureRandomSpi NULL_SPI = new SecureRandomSpi() {
- /** NOOP: returns new uninitialized byte[] */
+ /** SPI base class for all NullSecureRandom instances */
+ private static class NullSecureRandomSpi extends SecureRandomSpi {
+ private NullSecureRandomSpi() {
+ /* NOOP */
+ }
+ /**
+ * Helper method that can be used to fill an array with non-zero data.
+ * Default impl is No-Op
+ */
+ public byte[] fillData(byte[] data) {
+ return data; /* NOOP */
+ }
+ /** returns a new byte[] filled with static data */
+ @Override
public byte[] engineGenerateSeed(int numBytes) {
- return new byte[numBytes];
+ return fillData(new byte[numBytes]);
+ }
+ /** fills the byte[] with static data */
+ @Override
+ public void engineNextBytes(byte[] bytes) {
+ fillData(bytes);
}
/** NOOP */
- public void engineNextBytes(byte[] bytes) { /* NOOP */ }
- /** NOOP */
+ @Override
public void engineSetSeed(byte[] seed) { /* NOOP */ }
- };
+
+ /** Instance to use on platforms w/SSLEngines that work fine when SecureRandom returns constant bytes */
+ public static final NullSecureRandomSpi NULL_INSTANCE = new NullSecureRandomSpi();
+
+ /**
+ * Instance to use on platforms that need at least psuedo-random data for the SSLEngine to not break
+ * (Attempted workarround of Solaris SSL Padding bug: SOLR-9068)
+ */
+ public static final NullSecureRandomSpi PSUEDO_RAND_INSTANCE = new NullSecureRandomSpi() {
+ /**
+ * Fill with Psuedo-Random data.
+ * (Attempted workarround of Solaris SSL Padding bug: SOLR-9068)
+ */
+ @Override
+ public byte[] fillData(byte[] data) {
+ RAND.nextBytes(data);
+ return data;
+ }
+ };
+ }
- private NullSecureRandom() {
- super(NULL_SPI, null) ;
+ private NullSecureRandom(NullSecureRandomSpi spi) {
+ super(spi, null);
+ this.spi = spi;
}
- /** NOOP: returns new uninitialized byte[] */
+ private NullSecureRandomSpi spi;
+
+ /** fills a new byte[] with data from SPI */
+ @Override
public byte[] generateSeed(int numBytes) {
- return new byte[numBytes];
+ return spi.fillData(new byte[numBytes]);
+ }
+ /** fills the byte[] with data from SPI */
+ @Override
+ synchronized public void nextBytes(byte[] bytes) {
+ spi.fillData(bytes);
}
/** NOOP */
- synchronized public void nextBytes(byte[] bytes) { /* NOOP */ }
- /** NOOP */
+ @Override
synchronized public void setSeed(byte[] seed) { /* NOOP */ }
/** NOOP */
+ @Override
synchronized public void setSeed(long seed) { /* NOOP */ }
}
[2/5] lucene-solr:branch_6_0: SOLR-5776: javadoc typo
Posted by sa...@apache.org.
SOLR-5776: javadoc typo
(cherry picked from commit c0a287cb7601d691a33f9f0e155578e1575ab454)
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/afbb0f5d
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/afbb0f5d
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/afbb0f5d
Branch: refs/heads/branch_6_0
Commit: afbb0f5d08ec998c18903f84ac297f2ed7fd561b
Parents: a81e3cf
Author: Chris Hostetter <ho...@apache.org>
Authored: Tue May 3 18:27:32 2016 -0700
Committer: Steve Rowe <sa...@apache.org>
Committed: Sat May 21 13:05:30 2016 -0400
----------------------------------------------------------------------
.../src/java/org/apache/solr/util/SSLTestConfig.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/afbb0f5d/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index eb98fc4..13b4c21 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -136,7 +136,7 @@ public class SSLTestConfig extends SSLConfig {
}
/**
- * Returns an SslContextFactory using {@link buildServerSSLContext} if SSL should be used, else returns null.
+ * Returns an SslContextFactory using {@link #buildServerSSLContext} if SSL should be used, else returns null.
*/
@Override
public SslContextFactory createContextFactory() {
[4/5] lucene-solr:branch_6_0: SOLR-9068 / SOLR-5776: replace
NullSecureRandom w/ NotSecurePsuedoRandom
Posted by sa...@apache.org.
SOLR-9068 / SOLR-5776: replace NullSecureRandom w/ NotSecurePsuedoRandom
(cherry picked from commit ac0e73a521a66fc37638e884ab386b0173f79b0f)
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/fb9b7dcf
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/fb9b7dcf
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/fb9b7dcf
Branch: refs/heads/branch_6_0
Commit: fb9b7dcfbdb1ecf57cb0dfc3d2d722a96b471874
Parents: d866ae7
Author: Chris Hostetter <ho...@apache.org>
Authored: Fri May 6 22:46:10 2016 -0700
Committer: Steve Rowe <sa...@apache.org>
Committed: Sat May 21 13:06:00 2016 -0400
----------------------------------------------------------------------
.../org/apache/solr/util/SSLTestConfig.java | 88 +++++---------------
1 file changed, 23 insertions(+), 65 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/fb9b7dcf/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
----------------------------------------------------------------------
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index 9c31fc2..c89ed66 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -43,8 +43,6 @@ import org.apache.solr.client.solrj.impl.HttpClientUtil;
import org.apache.solr.client.solrj.impl.HttpClientConfigurer;
import org.apache.solr.common.params.SolrParams;
-import org.apache.lucene.util.Constants;
-
import org.eclipse.jetty.util.resource.Resource;
import org.eclipse.jetty.util.security.CertificateUtils;
import org.eclipse.jetty.util.ssl.SslContextFactory;
@@ -98,7 +96,7 @@ public class SSLTestConfig extends SSLConfig {
assert isSSLMode();
SSLContextBuilder builder = SSLContexts.custom();
- builder.setSecureRandom(NullSecureRandom.INSTANCE);
+ builder.setSecureRandom(NotSecurePsuedoRandom.INSTANCE);
// NOTE: KeyStore & TrustStore are swapped because they are from configured from server perspective...
// we are a client - our keystore contains the keys the server trusts, and vice versa
@@ -127,7 +125,7 @@ public class SSLTestConfig extends SSLConfig {
assert isSSLMode();
SSLContextBuilder builder = SSLContexts.custom();
- builder.setSecureRandom(NullSecureRandom.INSTANCE);
+ builder.setSecureRandom(NotSecurePsuedoRandom.INSTANCE);
builder.loadKeyMaterial(buildKeyStore(getKeyStore(), getKeyStorePassword()), getKeyStorePassword().toCharArray());
@@ -263,93 +261,53 @@ public class SSLTestConfig extends SSLConfig {
}
/**
- * A mocked up instance of SecureRandom that always does the minimal amount of work to generate
- * "random" numbers. This is to prevent blocking issues that arise in platform default
+ * A mocked up instance of SecureRandom that just uses {@link Random} under the covers.
+ * This is to prevent blocking issues that arise in platform default
* SecureRandom instances due to too many instances / not enough random entropy.
* Tests do not need secure SSL.
*/
- private static class NullSecureRandom extends SecureRandom {
-
+ private static class NotSecurePsuedoRandom extends SecureRandom {
+ public static final SecureRandom INSTANCE = new NotSecurePsuedoRandom();
+ private static final Random RAND = new Random(42);
+
/**
- * The one and only instance that should be used, specific impl may vary based on platform
- * @see Constants#SUN_OS
- * @see <a href="https://issues.apache.org/jira/browse/SOLR-9068">SOLR-9068</a>
+ * Helper method that can be used to fill an array with non-zero data.
+ * (Attempted workarround of Solaris SSL Padding bug: SOLR-9068)
*/
- public static final SecureRandom INSTANCE = Constants.SUN_OS
- ? new NullSecureRandom(NullSecureRandomSpi.PSUEDO_RAND_INSTANCE)
- : new NullSecureRandom(NullSecureRandomSpi.NULL_INSTANCE);
-
- /** A source of psuedo random data if needed */
- private static final Random RAND = new Random(42);
+ private static final byte[] fillData(byte[] data) {
+ RAND.nextBytes(data);
+ return data;
+ }
- /** SPI base class for all NullSecureRandom instances */
- private static class NullSecureRandomSpi extends SecureRandomSpi {
- private NullSecureRandomSpi() {
- /* NOOP */
- }
- /**
- * Helper method that can be used to fill an array with non-zero data.
- * Default impl is No-Op
- */
- public byte[] fillData(byte[] data) {
- return data; /* NOOP */
- }
+ /** SPI Used to init all instances */
+ private static final SecureRandomSpi NOT_SECURE_SPI = new SecureRandomSpi() {
/** returns a new byte[] filled with static data */
- @Override
public byte[] engineGenerateSeed(int numBytes) {
return fillData(new byte[numBytes]);
}
/** fills the byte[] with static data */
- @Override
public void engineNextBytes(byte[] bytes) {
fillData(bytes);
}
/** NOOP */
- @Override
public void engineSetSeed(byte[] seed) { /* NOOP */ }
-
- /** Instance to use on platforms w/SSLEngines that work fine when SecureRandom returns constant bytes */
- public static final NullSecureRandomSpi NULL_INSTANCE = new NullSecureRandomSpi();
-
- /**
- * Instance to use on platforms that need at least psuedo-random data for the SSLEngine to not break
- * (Attempted workarround of Solaris SSL Padding bug: SOLR-9068)
- */
- public static final NullSecureRandomSpi PSUEDO_RAND_INSTANCE = new NullSecureRandomSpi() {
- /**
- * Fill with Psuedo-Random data.
- * (Attempted workarround of Solaris SSL Padding bug: SOLR-9068)
- */
- @Override
- public byte[] fillData(byte[] data) {
- RAND.nextBytes(data);
- return data;
- }
- };
- }
+ };
- private NullSecureRandom(NullSecureRandomSpi spi) {
- super(spi, null);
- this.spi = spi;
+ private NotSecurePsuedoRandom() {
+ super(NOT_SECURE_SPI, null) ;
}
- private NullSecureRandomSpi spi;
-
- /** fills a new byte[] with data from SPI */
- @Override
+ /** returns a new byte[] filled with static data */
public byte[] generateSeed(int numBytes) {
- return spi.fillData(new byte[numBytes]);
+ return fillData(new byte[numBytes]);
}
- /** fills the byte[] with data from SPI */
- @Override
+ /** fills the byte[] with static data */
synchronized public void nextBytes(byte[] bytes) {
- spi.fillData(bytes);
+ fillData(bytes);
}
/** NOOP */
- @Override
synchronized public void setSeed(byte[] seed) { /* NOOP */ }
/** NOOP */
- @Override
synchronized public void setSeed(long seed) { /* NOOP */ }
}