You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by sn...@apache.org on 2015/10/28 14:24:21 UTC
[1/3] cassandra git commit: Support encrypted and plain traffic on
the same port
Repository: cassandra
Updated Branches:
refs/heads/cassandra-3.0 13e9fd55f -> 690372755
Support encrypted and plain traffic on the same port
patch by Norman Maurer; reviewed by Robert Stupp for CASSANDRA-10559
Project: http://git-wip-us.apache.org/repos/asf/cassandra/repo
Commit: http://git-wip-us.apache.org/repos/asf/cassandra/commit/32a6f205
Tree: http://git-wip-us.apache.org/repos/asf/cassandra/tree/32a6f205
Diff: http://git-wip-us.apache.org/repos/asf/cassandra/diff/32a6f205
Branch: refs/heads/cassandra-3.0
Commit: 32a6f2059aa3888fc0223cabcdff2ea2c9b97b21
Parents: cedcf07
Author: Norman Maurer <no...@apache.org>
Authored: Wed Oct 28 14:17:18 2015 +0100
Committer: Robert Stupp <sn...@snazy.de>
Committed: Wed Oct 28 14:17:18 2015 +0100
----------------------------------------------------------------------
CHANGES.txt | 1 +
NEWS.txt | 2 +
conf/cassandra.yaml | 2 +
.../cassandra/config/EncryptionOptions.java | 1 +
.../org/apache/cassandra/transport/Server.java | 76 ++++++++++++++++++--
5 files changed, 75 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cassandra/blob/32a6f205/CHANGES.txt
----------------------------------------------------------------------
diff --git a/CHANGES.txt b/CHANGES.txt
index 5b46eac..998dd22 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
2.1.12
+ * Support encrypted and plain traffic on the same port (CASSANDRA-10559)
* Do STCS in DTCS windows (CASSANDRA-10276)
* Don't try to get ancestors from half-renamed sstables (CASSANDRA-10501)
* Avoid repetition of JVM_OPTS in debian package (CASSANDRA-10251)
http://git-wip-us.apache.org/repos/asf/cassandra/blob/32a6f205/NEWS.txt
----------------------------------------------------------------------
diff --git a/NEWS.txt b/NEWS.txt
index 67a545b..c6ea6c0 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -18,6 +18,8 @@ using the provided 'sstableupgrade' tool.
New features
------------
+ - Native protocol server now allows both SSL and non-SSL connections on
+ the same port.
- Switching racks is no longer an allowed operation on a node which has
data. Instead, the node will need to be decommissioned and rebootstrapped.
If moving from the SimpleSnitch, make sure the rack containing all current
http://git-wip-us.apache.org/repos/asf/cassandra/blob/32a6f205/conf/cassandra.yaml
----------------------------------------------------------------------
diff --git a/conf/cassandra.yaml b/conf/cassandra.yaml
index e0ef878..0d0282b 100644
--- a/conf/cassandra.yaml
+++ b/conf/cassandra.yaml
@@ -781,6 +781,8 @@ server_encryption_options:
# enable or disable client/server encryption.
client_encryption_options:
enabled: false
+ # If enabled and optional is set to true encrypted and unencrypted connections are handled.
+ optional: false
keystore: conf/.keystore
keystore_password: cassandra
# require_client_auth: false
http://git-wip-us.apache.org/repos/asf/cassandra/blob/32a6f205/src/java/org/apache/cassandra/config/EncryptionOptions.java
----------------------------------------------------------------------
diff --git a/src/java/org/apache/cassandra/config/EncryptionOptions.java b/src/java/org/apache/cassandra/config/EncryptionOptions.java
index 945a15b..31f8b4a 100644
--- a/src/java/org/apache/cassandra/config/EncryptionOptions.java
+++ b/src/java/org/apache/cassandra/config/EncryptionOptions.java
@@ -36,6 +36,7 @@ public abstract class EncryptionOptions
public static class ClientEncryptionOptions extends EncryptionOptions
{
public boolean enabled = false;
+ public boolean optional = false;
}
public static class ServerEncryptionOptions extends EncryptionOptions
http://git-wip-us.apache.org/repos/asf/cassandra/blob/32a6f205/src/java/org/apache/cassandra/transport/Server.java
----------------------------------------------------------------------
diff --git a/src/java/org/apache/cassandra/transport/Server.java b/src/java/org/apache/cassandra/transport/Server.java
index c21a669..02f17b0 100644
--- a/src/java/org/apache/cassandra/transport/Server.java
+++ b/src/java/org/apache/cassandra/transport/Server.java
@@ -22,6 +22,7 @@ import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.util.EnumMap;
+import java.util.List;
import java.util.Map;
import java.util.concurrent.Callable;
import java.util.concurrent.ConcurrentHashMap;
@@ -29,9 +30,11 @@ import java.util.concurrent.atomic.AtomicBoolean;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
+import io.netty.buffer.ByteBuf;
import io.netty.channel.epoll.Epoll;
import io.netty.channel.epoll.EpollEventLoopGroup;
import io.netty.channel.epoll.EpollServerSocketChannel;
+import io.netty.handler.codec.ByteToMessageDecoder;
import io.netty.util.Version;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -170,8 +173,16 @@ public class Server implements CassandraDaemon.Server
final EncryptionOptions.ClientEncryptionOptions clientEnc = DatabaseDescriptor.getClientEncryptionOptions();
if (clientEnc.enabled)
{
- logger.info("Enabling encrypted CQL connections between client and server");
- bootstrap.childHandler(new SecureInitializer(this, clientEnc));
+ if (clientEnc.optional)
+ {
+ logger.info("Enabling optionally encrypted CQL connections between client and server");
+ bootstrap.childHandler(new OptionalSecureInitializer(this, clientEnc));
+ }
+ else
+ {
+ logger.info("Enabling encrypted CQL connections between client and server");
+ bootstrap.childHandler(new SecureInitializer(this, clientEnc));
+ }
}
else
{
@@ -309,12 +320,12 @@ public class Server implements CassandraDaemon.Server
}
}
- private static class SecureInitializer extends Initializer
+ protected abstract static class AbstractSecureIntializer extends Initializer
{
private final SSLContext sslContext;
private final EncryptionOptions encryptionOptions;
- public SecureInitializer(Server server, EncryptionOptions encryptionOptions)
+ protected AbstractSecureIntializer(Server server, EncryptionOptions encryptionOptions)
{
super(server);
this.encryptionOptions = encryptionOptions;
@@ -328,14 +339,65 @@ public class Server implements CassandraDaemon.Server
}
}
- protected void initChannel(Channel channel) throws Exception
- {
+ protected final SslHandler createSslHandler() {
SSLEngine sslEngine = sslContext.createSSLEngine();
sslEngine.setUseClientMode(false);
sslEngine.setEnabledCipherSuites(encryptionOptions.cipher_suites);
sslEngine.setNeedClientAuth(encryptionOptions.require_client_auth);
sslEngine.setEnabledProtocols(SSLFactory.ACCEPTED_PROTOCOLS);
- SslHandler sslHandler = new SslHandler(sslEngine);
+ return new SslHandler(sslEngine);
+ }
+ }
+
+ private static class OptionalSecureInitializer extends AbstractSecureIntializer
+ {
+ public OptionalSecureInitializer(Server server, EncryptionOptions encryptionOptions)
+ {
+ super(server, encryptionOptions);
+ }
+
+ protected void initChannel(final Channel channel) throws Exception
+ {
+ super.initChannel(channel);
+ channel.pipeline().addFirst("sslDetectionHandler", new ByteToMessageDecoder()
+ {
+ @Override
+ protected void decode(ChannelHandlerContext channelHandlerContext, ByteBuf byteBuf, List<Object> list) throws Exception
+ {
+ if (byteBuf.readableBytes() < 5)
+ {
+ // To detect if SSL must be used we need to have at least 5 bytes, so return here and try again
+ // once more bytes a ready.
+ return;
+ }
+ if (SslHandler.isEncrypted(byteBuf))
+ {
+ // Connection uses SSL/TLS, replace the detection handler with a SslHandler and so use
+ // encryption.
+ SslHandler sslHandler = createSslHandler();
+ channelHandlerContext.pipeline().replace(this, "ssl", sslHandler);
+ }
+ else
+ {
+ // Connection use no TLS/SSL encryption, just remove the detection handler and continue without
+ // SslHandler in the pipeline.
+ channelHandlerContext.pipeline().remove(this);
+ }
+ }
+ });
+ }
+ }
+
+ private static class SecureInitializer extends AbstractSecureIntializer
+ {
+ public SecureInitializer(Server server, EncryptionOptions encryptionOptions)
+ {
+ super(server, encryptionOptions);
+ }
+
+ protected void initChannel(Channel channel) throws Exception
+ {
+ SslHandler sslHandler = createSslHandler();
super.initChannel(channel);
channel.pipeline().addFirst("ssl", sslHandler);
}
[3/3] cassandra git commit: Merge branch 'cassandra-2.2' into
cassandra-3.0
Posted by sn...@apache.org.
Merge branch 'cassandra-2.2' into cassandra-3.0
Project: http://git-wip-us.apache.org/repos/asf/cassandra/repo
Commit: http://git-wip-us.apache.org/repos/asf/cassandra/commit/69037275
Tree: http://git-wip-us.apache.org/repos/asf/cassandra/tree/69037275
Diff: http://git-wip-us.apache.org/repos/asf/cassandra/diff/69037275
Branch: refs/heads/cassandra-3.0
Commit: 69037275568d6fd753ee2ee40e7a5ac1751f459b
Parents: 13e9fd5 734a3bf
Author: Robert Stupp <sn...@snazy.de>
Authored: Wed Oct 28 14:20:02 2015 +0100
Committer: Robert Stupp <sn...@snazy.de>
Committed: Wed Oct 28 14:20:02 2015 +0100
----------------------------------------------------------------------
CHANGES.txt | 2 +-
NEWS.txt | 5 +++++
2 files changed, 6 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cassandra/blob/69037275/CHANGES.txt
----------------------------------------------------------------------
diff --cc CHANGES.txt
index 76b1a55,c4f606f..b4cc43b
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@@ -1,20 -1,13 +1,20 @@@
-2.2.4
+3.0
+ * Fix marking of indexes as built and removed (CASSANDRA-10601)
+ * Skip initialization of non-registered 2i instances, remove Index::getIndexName (CASSANDRA-10595)
+ * Fix batches on multiple tables (CASSANDRA-10554)
+ * Ensure compaction options are validated when updating KeyspaceMetadata (CASSANDRA-10569)
+ * Flatten Iterator Transformation Hierarchy (CASSANDRA-9975)
+ * Remove token generator (CASSANDRA-5261)
+ * RolesCache should not be created for any authenticator that does not requireAuthentication (CASSANDRA-10562)
+ * Fix LogTransaction checking only a single directory for files (CASSANDRA-10421)
- * Support encrypted and plain traffic on the same port (CASSANDRA-10559)
+ * Fix handling of range tombstones when reading old format sstables (CASSANDRA-10360)
+ * Aggregate with Initial Condition fails with C* 3.0 (CASSANDRA-10367)
+Merged from 2.2:
* Expose phi values from failure detector via JMX and tweak debug
and trace logging (CASSANDRA-9526)
- * Fix RangeNamesQueryPager (CASSANDRA-10509)
- * Deprecate Pig support (CASSANDRA-10542)
- * Reduce contention getting instances of CompositeType (CASSANDRA-10433)
Merged from 2.1:
+ * Support encrypted and plain traffic on the same port (CASSANDRA-10559)
* Do STCS in DTCS windows (CASSANDRA-10276)
- * Don't try to get ancestors from half-renamed sstables (CASSANDRA-10501)
* Avoid repetition of JVM_OPTS in debian package (CASSANDRA-10251)
* Fix potential NPE from handling result of SIM.highestSelectivityIndex (CASSANDRA-10550)
* Fix paging issues with partitions containing only static columns data (CASSANDRA-10381)
http://git-wip-us.apache.org/repos/asf/cassandra/blob/69037275/NEWS.txt
----------------------------------------------------------------------
[2/3] cassandra git commit: Merge branch 'cassandra-2.1' into
cassandra-2.2
Posted by sn...@apache.org.
Merge branch 'cassandra-2.1' into cassandra-2.2
Project: http://git-wip-us.apache.org/repos/asf/cassandra/repo
Commit: http://git-wip-us.apache.org/repos/asf/cassandra/commit/734a3bfa
Tree: http://git-wip-us.apache.org/repos/asf/cassandra/tree/734a3bfa
Diff: http://git-wip-us.apache.org/repos/asf/cassandra/diff/734a3bfa
Branch: refs/heads/cassandra-3.0
Commit: 734a3bfa782bb0489878cd14c2f589d662c22f11
Parents: 5a356a7 32a6f20
Author: Robert Stupp <sn...@snazy.de>
Authored: Wed Oct 28 14:18:25 2015 +0100
Committer: Robert Stupp <sn...@snazy.de>
Committed: Wed Oct 28 14:18:25 2015 +0100
----------------------------------------------------------------------
CHANGES.txt | 1 +
NEWS.txt | 5 ++
conf/cassandra.yaml | 2 +
.../cassandra/config/EncryptionOptions.java | 1 +
.../org/apache/cassandra/transport/Server.java | 77 ++++++++++++++++++--
5 files changed, 78 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cassandra/blob/734a3bfa/CHANGES.txt
----------------------------------------------------------------------
diff --cc CHANGES.txt
index 9021e9d,998dd22..c4f606f
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@@ -1,10 -1,5 +1,11 @@@
-2.1.12
+2.2.4
+ * Expose phi values from failure detector via JMX and tweak debug
+ and trace logging (CASSANDRA-9526)
+ * Fix RangeNamesQueryPager (CASSANDRA-10509)
+ * Deprecate Pig support (CASSANDRA-10542)
+ * Reduce contention getting instances of CompositeType (CASSANDRA-10433)
+Merged from 2.1:
+ * Support encrypted and plain traffic on the same port (CASSANDRA-10559)
* Do STCS in DTCS windows (CASSANDRA-10276)
* Don't try to get ancestors from half-renamed sstables (CASSANDRA-10501)
* Avoid repetition of JVM_OPTS in debian package (CASSANDRA-10251)
http://git-wip-us.apache.org/repos/asf/cassandra/blob/734a3bfa/NEWS.txt
----------------------------------------------------------------------
diff --cc NEWS.txt
index 028d26d,c6ea6c0..94567d6
--- a/NEWS.txt
+++ b/NEWS.txt
@@@ -13,23 -13,21 +13,28 @@@ restore snapshots created with the prev
'sstableloader' tool. You can upgrade the file format of your snapshots
using the provided 'sstableupgrade' tool.
-2.1.12
-======
+2.2.4
+=====
+
+Deprecation
+-----------
+ - Pig support has been deprecated, and will be removed in 3.0.
+ Please see CASSANDRA-10542 for more details.
+
+Operations
+----------
+ - Switching racks is no longer an allowed operation on a node which has
+ data. Instead, the node will need to be decommissioned and rebootstrapped.
+ If moving from the SimpleSnitch, make sure the rack containing all current
+ nodes is named "rack1".
+ New features
+ ------------
+ - Native protocol server now allows both SSL and non-SSL connections on
+ the same port.
- - Switching racks is no longer an allowed operation on a node which has
- data. Instead, the node will need to be decommissioned and rebootstrapped.
- If moving from the SimpleSnitch, make sure the rack containing all current
- nodes is named "rack1". To override this behavior when manually wiping
- the node and bootstrapping, use -Dcassandra.ignore_rack=true.
+
-2.1.11
+2.2.3
=====
Upgrading
http://git-wip-us.apache.org/repos/asf/cassandra/blob/734a3bfa/conf/cassandra.yaml
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cassandra/blob/734a3bfa/src/java/org/apache/cassandra/transport/Server.java
----------------------------------------------------------------------
diff --cc src/java/org/apache/cassandra/transport/Server.java
index d610bff,02f17b0..c56564c
--- a/src/java/org/apache/cassandra/transport/Server.java
+++ b/src/java/org/apache/cassandra/transport/Server.java
@@@ -30,20 -30,17 +30,22 @@@ import java.util.concurrent.atomic.Atom
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.netty.bootstrap.ServerBootstrap;
+ import io.netty.buffer.ByteBuf;
+import io.netty.channel.*;
import io.netty.channel.epoll.Epoll;
import io.netty.channel.epoll.EpollEventLoopGroup;
import io.netty.channel.epoll.EpollServerSocketChannel;
-import io.netty.handler.codec.ByteToMessageDecoder;
-import io.netty.util.Version;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
+import io.netty.channel.group.ChannelGroup;
+import io.netty.channel.group.DefaultChannelGroup;
import io.netty.channel.nio.NioEventLoopGroup;
import io.netty.channel.socket.nio.NioServerSocketChannel;
++import io.netty.handler.codec.ByteToMessageDecoder;
+import io.netty.handler.ssl.SslHandler;
+import io.netty.util.Version;
import io.netty.util.concurrent.EventExecutor;
import io.netty.util.concurrent.GlobalEventExecutor;
import io.netty.util.internal.logging.InternalLoggerFactory;