You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by ha...@apache.org on 2020/08/25 01:17:13 UTC
[skywalking] branch grpc-reload-crt created (now cdadea5)
This is an automated email from the ASF dual-hosted git repository.
hanahmily pushed a change to branch grpc-reload-crt
in repository https://gitbox.apache.org/repos/asf/skywalking.git.
at cdadea5 Hot reload gRPC certs of OAP.
This branch includes the following new commits:
new cdadea5 Hot reload gRPC certs of OAP.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[skywalking] 01/01: Hot reload gRPC certs of OAP.
Posted by ha...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
hanahmily pushed a commit to branch grpc-reload-crt
in repository https://gitbox.apache.org/repos/asf/skywalking.git
commit cdadea55e12024ebe6e8d5af557cc82bea4cf97d
Author: Gao Hongtao <ha...@gmail.com>
AuthorDate: Tue Aug 25 09:16:09 2020 +0800
Hot reload gRPC certs of OAP.
Signed-off-by: Gao Hongtao <ha...@gmail.com>
---
.../oap/server/core/CoreModuleProvider.java | 4 +-
oap-server/server-library/library-server/pom.xml | 6 ++
.../library/server/grpc/DynamicSslContext.java | 101 +++++++++++++++++++++
.../oap/server/library/server/grpc/GRPCServer.java | 26 +++---
.../server/SharingServerModuleProvider.java | 5 +-
5 files changed, 123 insertions(+), 19 deletions(-)
diff --git a/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/CoreModuleProvider.java b/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/CoreModuleProvider.java
index 80521ca..4038fb2 100755
--- a/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/CoreModuleProvider.java
+++ b/oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/CoreModuleProvider.java
@@ -180,8 +180,8 @@ public class CoreModuleProvider extends ModuleProvider {
if (moduleConfig.isGRPCSslEnabled()) {
grpcServer = new GRPCServer(moduleConfig.getGRPCHost(), moduleConfig.getGRPCPort(),
- Paths.get(moduleConfig.getGRPCSslCertChainPath()).toFile(),
- Paths.get(moduleConfig.getGRPCSslKeyPath()).toFile()
+ moduleConfig.getGRPCSslCertChainPath(),
+ moduleConfig.getGRPCSslKeyPath()
);
} else {
grpcServer = new GRPCServer(moduleConfig.getGRPCHost(), moduleConfig.getGRPCPort());
diff --git a/oap-server/server-library/library-server/pom.xml b/oap-server/server-library/library-server/pom.xml
index 4f1ae56..562acf5 100644
--- a/oap-server/server-library/library-server/pom.xml
+++ b/oap-server/server-library/library-server/pom.xml
@@ -30,6 +30,12 @@
<dependencies>
<dependency>
+ <groupId>org.apache.skywalking</groupId>
+ <artifactId>library-util</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+
+ <dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-netty</artifactId>
</dependency>
diff --git a/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/DynamicSslContext.java b/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/DynamicSslContext.java
new file mode 100644
index 0000000..182239e
--- /dev/null
+++ b/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/DynamicSslContext.java
@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.skywalking.oap.server.library.server.grpc;
+
+import io.grpc.netty.GrpcSslContexts;
+import io.netty.buffer.ByteBufAllocator;
+import io.netty.handler.ssl.ApplicationProtocolNegotiator;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslProvider;
+import java.nio.file.Paths;
+import java.util.List;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSessionContext;
+import org.apache.skywalking.oap.server.library.util.MultipleFilesChangeMonitor;
+
+public class DynamicSslContext extends SslContext {
+ private final MultipleFilesChangeMonitor monitor;
+ private volatile SslContext ctx;
+
+ public DynamicSslContext(final String privateKeyFile, final String certChainFile) {
+ updateContext(privateKeyFile, certChainFile);
+ monitor = new MultipleFilesChangeMonitor(
+ 10,
+ readableContents -> updateContext(privateKeyFile, certChainFile),
+ certChainFile,
+ privateKeyFile);
+ }
+
+ private void updateContext(final String privateKeyFile, final String certChainFile) {
+ try {
+ ctx = GrpcSslContexts
+ .configure(SslContextBuilder
+ .forServer(Paths.get(certChainFile).toFile(), Paths.get(privateKeyFile).toFile()), SslProvider.OPENSSL)
+ .build();
+ } catch (SSLException e) {
+ throw new IllegalArgumentException(e);
+ }
+ }
+
+ void start() {
+ monitor.start();
+ }
+
+ @Override
+ public final boolean isClient() {
+ return ctx.isClient();
+ }
+
+ @Override
+ public final List<String> cipherSuites() {
+ return ctx.cipherSuites();
+ }
+
+ @Override
+ public final long sessionCacheSize() {
+ return ctx.sessionCacheSize();
+ }
+
+ @Override
+ public final long sessionTimeout() {
+ return ctx.sessionTimeout();
+ }
+
+ @Override
+ public final ApplicationProtocolNegotiator applicationProtocolNegotiator() {
+ return ctx.applicationProtocolNegotiator();
+ }
+
+ @Override
+ public final SSLEngine newEngine(ByteBufAllocator alloc) {
+ return ctx.newEngine(alloc);
+ }
+
+ @Override
+ public final SSLEngine newEngine(ByteBufAllocator alloc, String peerHost, int peerPort) {
+ return ctx.newEngine(alloc, peerHost, peerPort);
+ }
+
+ @Override
+ public final SSLSessionContext sessionContext() {
+ return ctx.sessionContext();
+ }
+}
diff --git a/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/GRPCServer.java b/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/GRPCServer.java
index d2eb9ac..d404d01 100644
--- a/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/GRPCServer.java
+++ b/oap-server/server-library/library-server/src/main/java/org/apache/skywalking/oap/server/library/server/grpc/GRPCServer.java
@@ -18,16 +18,14 @@
package org.apache.skywalking.oap.server.library.server.grpc;
+import com.google.common.base.Strings;
import io.grpc.BindableService;
import io.grpc.ServerServiceDefinition;
-import io.grpc.netty.GrpcSslContexts;
import io.grpc.netty.NettyServerBuilder;
-import io.netty.handler.ssl.SslContextBuilder;
-import io.netty.handler.ssl.SslProvider;
-import java.io.File;
import java.io.IOException;
import java.net.InetSocketAddress;
import java.util.Objects;
+import java.util.Optional;
import java.util.concurrent.ArrayBlockingQueue;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.RejectedExecutionHandler;
@@ -48,9 +46,9 @@ public class GRPCServer implements Server {
private int maxMessageSize;
private io.grpc.Server server;
private NettyServerBuilder nettyServerBuilder;
- private SslContextBuilder sslContextBuilder;
- private File certChainFile;
- private File privateKeyFile;
+ private String certChainFile;
+ private String privateKeyFile;
+ private DynamicSslContext sslContext;
private int threadPoolSize = Runtime.getRuntime().availableProcessors() * 4;
private int threadPoolQueueSize = 10000;
@@ -83,11 +81,10 @@ public class GRPCServer implements Server {
* @param certChainFile `server.crt` file
* @param privateKeyFile `server.pem` file
*/
- public GRPCServer(String host, int port, File certChainFile, File privateKeyFile) {
+ public GRPCServer(String host, int port, String certChainFile, String privateKeyFile) {
this(host, port);
this.certChainFile = certChainFile;
this.privateKeyFile = privateKeyFile;
- this.sslContextBuilder = SslContextBuilder.forServer(certChainFile, privateKeyFile);
}
@Override
@@ -109,6 +106,10 @@ public class GRPCServer implements Server {
nettyServerBuilder = nettyServerBuilder.maxConcurrentCallsPerConnection(maxConcurrentCallsPerConnection)
.maxInboundMessageSize(maxMessageSize)
.executor(executor);
+ if (!Strings.isNullOrEmpty(privateKeyFile) && !Strings.isNullOrEmpty(certChainFile)) {
+ sslContext = new DynamicSslContext(privateKeyFile, certChainFile);
+ nettyServerBuilder.sslContext(sslContext);
+ }
LOGGER.info("Server started, host {} listening on {}", host, port);
}
@@ -123,10 +124,7 @@ public class GRPCServer implements Server {
@Override
public void start() throws ServerException {
try {
- if (sslContextBuilder != null) {
- nettyServerBuilder = nettyServerBuilder.sslContext(GrpcSslContexts.configure(sslContextBuilder, SslProvider.OPENSSL)
- .build());
- }
+ Optional.ofNullable(sslContext).ifPresent(DynamicSslContext::start);
server = nettyServerBuilder.build();
server.start();
} catch (IOException e) {
@@ -146,7 +144,7 @@ public class GRPCServer implements Server {
@Override
public boolean isSSLOpen() {
- return sslContextBuilder == null;
+ return !Strings.isNullOrEmpty(privateKeyFile) && !Strings.isNullOrEmpty(certChainFile);
}
@Override
diff --git a/oap-server/server-receiver-plugin/skywalking-sharing-server-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/sharing/server/SharingServerModuleProvider.java b/oap-server/server-receiver-plugin/skywalking-sharing-server-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/sharing/server/SharingServerModuleProvider.java
index 5091b7b..85f8a57 100644
--- a/oap-server/server-receiver-plugin/skywalking-sharing-server-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/sharing/server/SharingServerModuleProvider.java
+++ b/oap-server/server-receiver-plugin/skywalking-sharing-server-plugin/src/main/java/org/apache/skywalking/oap/server/receiver/sharing/server/SharingServerModuleProvider.java
@@ -18,7 +18,6 @@
package org.apache.skywalking.oap.server.receiver.sharing.server;
-import java.nio.file.Paths;
import java.util.Objects;
import org.apache.logging.log4j.util.Strings;
import org.apache.skywalking.apm.util.StringUtil;
@@ -97,8 +96,8 @@ public class SharingServerModuleProvider extends ModuleProvider {
grpcServer = new GRPCServer(
Strings.isBlank(config.getGRPCHost()) ? "0.0.0.0" : config.getGRPCHost(),
config.getGRPCPort(),
- Paths.get(config.getGRPCSslCertChainPath()).toFile(),
- Paths.get(config.getGRPCSslKeyPath()).toFile()
+ config.getGRPCSslCertChainPath(),
+ config.getGRPCSslKeyPath()
);
} else {
grpcServer = new GRPCServer(