You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by jo...@apache.org on 2023/09/25 20:43:17 UTC
[cassandra] branch cassandra-5.0 updated (d16e8d3653 -> a4be70930f)
This is an automated email from the ASF dual-hosted git repository.
jonmeredith pushed a change to branch cassandra-5.0
in repository https://gitbox.apache.org/repos/asf/cassandra.git
from d16e8d3653 Do not create sstable files before registering in txn
new b9586501a6 Internode legacy SSL storage port certificate is not hot reloaded on update
new a4be70930f Merge branch 'cassandra-4.1' into cassandra-5.0
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
CHANGES.txt | 1 +
examples/ssl-factory/build.xml | 2 +-
.../cassandra/net/InboundConnectionInitiator.java | 4 +-
.../org/apache/cassandra/net/InboundSockets.java | 12 +++
.../cassandra/net/InternodeConnectionUtils.java | 1 +
.../cassandra/net/MessagingServiceMBeanImpl.java | 10 +-
.../cassandra/net/OutboundConnectionInitiator.java | 3 +-
.../org/apache/cassandra/security/SSLFactory.java | 82 +++++++++-------
.../cassandra/transport/PipelineConfigurator.java | 8 +-
.../apache/cassandra/transport/SimpleClient.java | 3 +-
.../test/AbstractEncryptionOptionsImpl.java | 2 +-
.../security/DefaultSslContextFactoryTest.java | 2 +-
.../security/PEMBasedSslContextFactoryTest.java | 4 +-
.../apache/cassandra/security/SSLFactoryTest.java | 105 ++++++++++++++-------
14 files changed, 153 insertions(+), 86 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org
[cassandra] 01/01: Merge branch 'cassandra-4.1' into cassandra-5.0
Posted by jo...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jonmeredith pushed a commit to branch cassandra-5.0
in repository https://gitbox.apache.org/repos/asf/cassandra.git
commit a4be70930f4d1bd24ac30b79cf146265da5f3c2f
Merge: d16e8d3653 b9586501a6
Author: Jon Meredith <jo...@apache.org>
AuthorDate: Mon Sep 25 14:25:31 2023 -0600
Merge branch 'cassandra-4.1' into cassandra-5.0
CHANGES.txt | 1 +
examples/ssl-factory/build.xml | 2 +-
.../cassandra/net/InboundConnectionInitiator.java | 4 +-
.../org/apache/cassandra/net/InboundSockets.java | 12 +++
.../cassandra/net/InternodeConnectionUtils.java | 1 +
.../cassandra/net/MessagingServiceMBeanImpl.java | 10 +-
.../cassandra/net/OutboundConnectionInitiator.java | 3 +-
.../org/apache/cassandra/security/SSLFactory.java | 82 +++++++++-------
.../cassandra/transport/PipelineConfigurator.java | 8 +-
.../apache/cassandra/transport/SimpleClient.java | 3 +-
.../test/AbstractEncryptionOptionsImpl.java | 2 +-
.../security/DefaultSslContextFactoryTest.java | 2 +-
.../security/PEMBasedSslContextFactoryTest.java | 4 +-
.../apache/cassandra/security/SSLFactoryTest.java | 105 ++++++++++++++-------
14 files changed, 153 insertions(+), 86 deletions(-)
diff --cc CHANGES.txt
index e5f38dbd9a,d902ca1e1c..c0ffd79145
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@@ -1,211 -1,6 +1,212 @@@
-4.1.4
+5.0-alpha2
+ * Do not create sstable files before registering in txn (CASSANDRA-18737)
+ * Do not log stacktrace on mismatched cache and schema version and checksum error in AutoSavingCache (CASSANDRA-18862)
+ * Remove wrong assertion in SSTableLoader (CASSANDRA-18840)
+ * Fix accessing java.nio.Bits.TOTAL_CAPACITY in Java17 (CASSANDRA-18848)
+ * Remove metrics-reporter-config dependency (CASSANDRA-18743)
+ * Fix SAI's SegmentMetadata min and max primary keys (CASSANDRA-18734)
+ * Remove commons-codec dependency (CASSANDRA-18772)
+Merged from 4.1:
+ * Internode legacy SSL storage port certificate is not hot reloaded on update (CASSANDRA-18681)
* Nodetool paxos-only repair is no longer incremental (CASSANDRA-18466)
+Merged from 4.0:
+ * JMH improvements - faster build and async profiler (CASSANDRA-18871)
+ * Enable 3rd party JDK installations for Debian package (CASSANDRA-18844)
+Merged from 3.11:
+Merged from 3.0:
+ * Add cqlshrc.sample and credentials.sample into Debian package (CASSANDRA-18818)
+
+
+5.0-alpha1
+ * Fix rpm installations to work with jdk17 (CASSANDRA-18817)
+ * Fix Depends and Build-Depends for Java for Debian packages (CASSANDRA-18809)
+ * Update command line flags --add-exports and --add-opens for JDK17 (CASSANDRA-18439)
+ * Update commons-lang3 to 3.13.0 (CASSANDRA-18789)
+ * Forbid SAI indexes with analysis options on primary key columns (CASSANDRA-18782)
+ * Expose bootstrap failure state via JMX and nodetool info (CASSANDRA-18749)
+ * Reduce size of per-SSTable index components for SAI (CASSANDRA-18673)
+ * Remove unnecessary Netty dependencies after upgrade to version 4.1.96 (CASSANDRA-18729)
+ * Prevent InaccessibleObjectException when the Leak Detector is traversing objects (CASSANDRA-18708)
+ * Remove legacy command line options from cassandra-stress (CASSANDRA-18529)
+ * Remove commitlog_sync_batch_window_in_ms (CASSANDRA-17161)
+ * Upgrade JMH from 1.21 to 1.36 (CASSANDRA-18696)
+ * Add guardrail for vector dimensions (CASSANDRA-18730)
+ * Upgraded Netty to 4.1.96, added BouncyCastle dependency (CASSANDRA-17992)
+ * Fix for (unsupported) big endian unaligned architecture, eg s390x (CASSANDRA-17723)
+ * CIDR filtering authorizer (CASSANDRA-18592)
+ * Remove 3.x from the versions checked for prepared statement behaviour (CASSANDRA-18695)
+ * Add vector similarity functions (CASSANDRA-18640)
+ * Lift MessagingService.minimum_version to 40 (CASSANDRA-18314)
+ * Introduce pluggable crypto providers and default to AmazonCorrettoCryptoProvider (CASSANDRA-18624)
+ * Improved DeletionTime serialization (CASSANDRA-18648)
+ * CEP-7: Storage Attached Indexes (CASSANDRA-16052)
+ * Add equals/hashCode override for ServerEncryptionOptions (CASSANDRA-18428)
+ * Upgrade ECJ to version 3.33.0 (CASSANDRA-18190)
+ * Fix ClassCastException from jdk GaloisCounterMode when using JDK17 provider (CASSANDRA-18180)
+ * Drop JDK8, add JDK17 (CASSANDRA-18255)
+ * Remove WaitingOnFreeMemtableSpace and DroppedMutations metrics (CASSANDRA-18298)
+ * Upgrade Jamm version to 0.4.0 (CASSANDRA-17884, CASSANDRA-16304, CASSANDRA-18329)
+ * Remove legacy 3.0/3.11 buffer pool metrics (CASSANDRA-18313)
+ * Add AzureSnitch (CASSANDRA-18646)
+ * Implementation of the Unified Compaction Strategy as described in CEP-26 (CASSANDRA-18397)
+ * Upgrade commons cli to 1.5.0 (CASSANDRA-18659)
+ * Disable the deprecated keyspace/table thresholds and convert them to guardrails (CASSANDRA-18617)
+ * Deprecate CloudstackSnitch and remove duplicate code in snitches (CASSANDRA-18438)
+ * Add support for vectors in UDFs (CASSANDRA-18613)
+ * Improve vector value validation errors (CASSANDRA-18652)
+ * Upgrade Guava to 32.0.1 (CASSANDRA-18645)
+ * Add duration and count of partition keys to sstablemetadata (CASSANDRA-18639)
+ * Remove deprecated compaction_tombstone_warning_threshold and compaction_large_partition_warning_threshold from yaml (CASSANDRA-18626)
+ * Enhance nodetool compactionstats with additional metrics (CASSANDRA-18305)
+ * Added support for type VECTOR<type, dimension> (CASSANDRA-18504)
+ * Expose bootstrap and decommission state to nodetool info (CASSANDRA-18555)
+ * Fix SSTabledump errors when dumping data from index (CASSANDRA-17698)
+ * Avoid unnecessary deserialization of terminal arguments when executing CQL functions (CASSANDRA-18566)
+ * Remove dependency on pytz library for setting CQLSH timezones on Python version >= 3.9 (CASSANDRA-17433)
+ * Extend maximum expiration date (CASSANDRA-14227)
+ * Add guardrail for partition tombstones and deprecate compaction_tombstone_warning_threshold (CASSANDRA-17194)
+ * Print header and statistics for cassandra-stress output with arbitrary frequency (CASSANDRA-12972)
+ * CEP-25: Trie-indexed SSTable format (CASSANDRA-18398)
+ * Make cassandra-stress able to read all credentials from a file (CASSANDRA-18544)
+ * Add guardrail for partition size and deprecate compaction_large_partition_warning_threshold (CASSANDRA-18500)
+ * Add HISTORY command for CQLSH (CASSANDRA-15046)
+ * Fix sstable formats configuration (CASSANDRA-18441)
+ * Add guardrail to bound timestamps (CASSANDRA-18352)
+ * Add keyspace_name column to system_views.clients (CASSANDRA-18525)
+ * Moved system properties and envs to CassandraRelevantProperties and CassandraRelevantEnv respectively (CASSANDRA-17797)
+ * Add sstablepartitions offline tool to find large partitions in sstables (CASSANDRA-8720)
+ * Replace usages of json-simple dependency by Jackson (CASSANDRA-16855)
+ * When decommissioning should set Severity to limit traffic (CASSANDRA-18430)
+ * For Java11 and Java17 remove -XX:-UseBiasedLocking as it is the default already (CASSANDRA-17869)
+ * Upgrade commons-io to 2.11.0 (CASSANDRA-17364)
+ * Node Draining Should Abort All Current SSTables Imports (CASSANDRA-18373)
+ * Use snake case for the names of CQL native functions (CASSANDRA-18037)
+ * Use jdk-dependent checkstyle version to check the source code (CASSANDRA-18262)
+ * Provide summary of failed SessionInfo's in StreamResultFuture (CASSANDRA-17199)
+ * CEP-20: Dynamic Data Masking (CASSANDRA-17940)
+ * Add system_views.snapshots virtual table (CASSANDRA-18102)
+ * Update OpenHFT dependencies (chronicle-queue, chronicle-core, chronicle-bytes, chronicle-wire, chronicle-threads) (CASSANDRA-18049)
+ * Remove org.apache.cassandra.hadoop code (CASSANDRA-18323)
+ * Remove deprecated CQL functions dateOf and unixTimestampOf (CASSANDRA-18328)
+ * Remove DateTieredCompactionStrategy (CASSANDRA-18043)
+ * Add system_views.max_sstable_size and system_views.max_sstable_duration tables (CASSANDRA-18333)
+ * Extend implicit allow-filtering for virtual tables to clustering columns (CASSANDRA-18331)
+ * Upgrade maven-shade-plugin to 3.4.1 to fix shaded dtest JAR build (CASSANDRA-18136)
+ * Upgrade to Opcodes.ASM9 (CASSANDRA-17971)
+ * Add MaxSSTableSize and MaxSSTableDuration metrics and propagate them together with local read/write ratio to tablestats (CASSANDRA-18283)
+ * Add more logging around CompactionManager operations (CASSANDRA-18268)
+ * Reduce memory allocations of calls to ByteBufer.duplicate() made in org.apache.cassandra.transport.CBUtil#writeValue (CASSANDRA-18212)
+ * CEP-17: SSTable API (CASSANDRA-17056)
+ * Gossip stateMapOrdering does not have correct ordering when both EndpointState are in the bootstrapping set (CASSANDRA-18292)
+ * Snapshot only sstables containing mismatching ranges on preview repair mismatch (CASSANDRA-17561)
+ * More accurate skipping of sstables in read path (CASSANDRA-18134)
+ * Prepare for JDK17 experimental support (CASSANDRA-18179, CASSANDRA-18258)
+ * Remove Scripted UDFs internals; hooks to be added later in CASSANDRA-17281 (CASSANDRA-18252)
+ * Update JNA to 5.13.0 (CASSANDRA-18050)
+ * Make virtual tables decide if they implicitly enable ALLOW FILTERING (CASSANDRA-18238)
+ * Add row, tombstone, and sstable count to nodetool profileload (CASSANDRA-18022)
+ * Coordinator level metrics for read response and mutation row and column counts (CASSANDRA-18155)
+ * Add CQL functions for dynamic data masking (CASSANDRA-17941)
+ * Print friendly error when nodetool attempts to connect to uninitialized server (CASSANDRA-11537)
+ * Use G1GC by default, and update default G1GC settings (CASSANDRA-18027)
+ * SimpleSeedProvider can resolve multiple IP addresses per DNS record (CASSANDRA-14361)
+ * Remove mocking in InternalNodeProbe spying on StorageServiceMBean (CASSANDRA-18152)
+ * Add compaction_properties column to system.compaction_history table and nodetool compactionhistory command (CASSANDRA-18061)
+ * Remove ProtocolVersion entirely from the CollectionSerializer ecosystem (CASSANDRA-18114)
+ * Fix serialization error in new getsstables --show-levels option (CASSANDRA-18140)
+ * Use checked casts when reading vints as ints (CASSANDRA-18099)
+ * Add Mutation Serialization Caching (CASSANDRA-17998)
+ * Only reload compaction strategies if disk boundaries change (CASSANDRA-17874)
+ * CEP-10: Simulator Java11 Support (CASSANDRA-17178)
+ * Set the major compaction type correctly for compactionstats (CASSANDRA-18055)
+ * Print exception message without stacktrace when nodetool commands fail on probe.getOwnershipWithPort() (CASSANDRA-18079)
+ * Add option to print level in nodetool getsstables output (CASSANDRA-18023)
+ * Implement a guardrail for not having zero default_time_to_live on tables with TWCS (CASSANDRA-18042)
+ * Add CQL scalar functions for collection aggregation (CASSANDRA-18060)
+ * Make cassandra.replayList property for CommitLogReplayer possible to react on keyspaces only (CASSANDRA-18044)
+ * Add Mathematical functions (CASSANDRA-17221)
+ * Make incremental backup configurable per table (CASSANDRA-15402)
+ * Change shebangs of Python scripts to resolve Python 3 from env command (CASSANDRA-17832)
+ * Add reasons to guardrail messages and consider guardrails in the error message for needed ALLOW FILTERING (CASSANDRA-17967)
+ * Add support for CQL functions on collections, tuples and UDTs (CASSANDRA-17811)
+ * Add flag to exclude nodes from local DC when running nodetool rebuild (CASSANDRA-17870)
+ * Adding endpoint verification option to client_encryption_options (CASSANDRA-18034)
+ * Replace 'wcwidth.py' with pypi module (CASSANDRA-17287)
+ * Add nodetool forcecompact to remove tombstoned or ttl'd data ignoring GC grace for given table and partition keys (CASSANDRA-17711)
+ * Offer IF (NOT) EXISTS in cqlsh completion for CREATE TYPE, DROP TYPE, CREATE ROLE and DROP ROLE (CASSANDRA-16640)
+ * Nodetool bootstrap resume will now return an error if the operation fails (CASSANDRA-16491)
+ * Disable resumable bootstrap by default (CASSANDRA-17679)
+ * Include Git SHA in --verbose flag for nodetool version (CASSANDRA-17753)
+ * Update Byteman to 4.0.20 and Jacoco to 0.8.8 (CASSANDRA-16413)
+ * Add memtable option among possible tab completions for a table (CASSANDRA-17982)
+ * Adds a trie-based memtable implementation (CASSANDRA-17240)
+ * Further improves precision of memtable heap tracking (CASSANDRA-17240)
+ * Fix formatting of metrics documentation (CASSANDRA-17961)
+ * Keep sstable level when streaming for decommission and move (CASSANDRA-17969)
+ * Add Unavailables metric for CASWrite in the docs (CASSANDRA-16357)
+ * Make Cassandra logs able to be viewed in the virtual table system_views.system_logs (CASSANDRA-17946)
+ * IllegalArgumentException in Gossiper#order due to concurrent mutations to elements being applied (CASSANDRA-17908)
+ * Include estimated active compaction remaining write size when starting a new compaction (CASSANDRA-17931)
+ * Mixed mode support for internode authentication during TLS upgrades (CASSANDRA-17923)
+ * Revert Mockito downgrade from CASSANDRA-17750 (CASSANDRA-17496)
+ * Add --older-than and --older-than-timestamp options for nodetool clearsnapshots (CASSANDRA-16860)
+ * Fix "open RT bound as its last item" exception (CASSANDRA-17810)
+ * Fix leak of non-standard Java types in JMX MBeans `org.apache.cassandra.db:type=StorageService`
+ and `org.apache.cassandra.db:type=RepairService` as clients using JMX cannot handle them. More details in NEWS.txt (CASSANDRA-17668)
+ * Deprecate Throwables.propagate usage (CASSANDRA-14218)
+ * Allow disabling hotness persistence for high sstable counts (CASSANDRA-17868)
+ * Prevent NullPointerException when changing neverPurgeTombstones from true to false (CASSANDRA-17897)
+ * Add metrics around storage usage and compression (CASSANDRA-17898)
+ * Remove usage of deprecated javax certificate classes (CASSANDRA-17867)
+ * Make sure preview repairs don't optimise streams unless configured to (CASSANDRA-17865)
+ * Optionally avoid hint transfer during decommission (CASSANDRA-17808)
+ * Make disabling auto snapshot on selected tables possible (CASSANDRA-10383)
+ * Introduce compaction priorities to prevent upgrade compaction inability to finish (CASSANDRA-17851)
+ * Prevent a user from manually removing ephemeral snapshots (CASSANDRA-17757)
+ * Remove dependency on Maven Ant Tasks (CASSANDRA-17750)
+ * Update ASM(9.1 to 9.3), Mockito(1.10.10 to 1.12.13) and ByteBuddy(3.2.4 to 4.7.0) (CASSANDRA-17835)
+ * Add the ability for operators to loosen the definition of "empty" for edge cases (CASSANDRA-17842)
+ * Fix potential out of range exception on column index downsampling (CASSANDRA-17839)
+ * Introduce target directory to vtable output for sstable_tasks and for compactionstats (CASSANDRA-13010)
+ * Read/Write/Truncate throw RequestFailure in a race condition with callback timeouts, should return Timeout instead (CASSANDRA-17828)
+ * Add ability to log load profiles at fixed intervals (CASSANDRA-17821)
+ * Protect against Gossip backing up due to a quarantined endpoint without version information (CASSANDRA-17830)
+ * NPE in org.apache.cassandra.cql3.Attributes.getTimeToLive (CASSANDRA-17822)
+ * Add guardrail for column size (CASSANDRA-17151)
+ * When doing a host replacement, we need to check that the node is a live node before failing with "Cannot replace a live node..." (CASSANDRA-17805)
+ * Add support to generate a One-Shot heap dump on unhandled exceptions (CASSANDRA-17795)
+ * Rate-limit new client connection auth setup to avoid overwhelming bcrypt (CASSANDRA-17812)
+ * DataOutputBuffer#scratchBuffer can use off-heap or on-heap memory as a means to control memory allocations (CASSANDRA-16471)
+ * Add ability to read the TTLs and write times of the elements of a collection and/or UDT (CASSANDRA-8877)
+ * Removed Python < 2.7 support from formatting.py (CASSANDRA-17694)
+ * Cleanup pylint issues with pylexotron.py (CASSANDRA-17779)
+ * NPE bug in streaming checking if SSTable is being repaired (CASSANDRA-17801)
+ * Users of NativeLibrary should handle lack of JNA appropriately when running in client mode (CASSANDRA-17794)
+ * Warn on unknown directories found in system keyspace directory rather than kill node during startup checks (CASSANDRA-17777)
+ * Log duplicate rows sharing a partition key found in verify and scrub (CASSANDRA-17789)
+ * Add separate thread pool for Secondary Index building so it doesn't block compactions (CASSANDRA-17781)
+ * Added JMX call to getSSTableCountPerTWCSBucket for TWCS (CASSANDRA-17774)
+ * When doing a host replacement, -Dcassandra.broadcast_interval_ms is used to know when to check the ring but checks that the ring wasn't changed in -Dcassandra.ring_delay_ms, changes to ring delay should not depend on when we publish load stats (CASSANDRA-17776)
+ * When bootstrap fails, CassandraRoleManager may attempt to do read queries that fail with "Cannot read from a bootstrapping node", and increments unavailables counters (CASSANDRA-17754)
+ * Add guardrail to disallow DROP KEYSPACE commands (CASSANDRA-17767)
+ * Remove ephemeral snapshot marker file and introduce a flag to SnapshotManifest (CASSANDRA-16911)
+ * Add a virtual table that exposes currently running queries (CASSANDRA-15241)
+ * Allow sstableloader to specify table without relying on path (CASSANDRA-16584)
+ * Fix TestGossipingPropertyFileSnitch.test_prefer_local_reconnect_on_listen_address (CASSANDRA-17700)
+ * Add ByteComparable API (CASSANDRA-6936)
+ * Add guardrail for maximum replication factor (CASSANDRA-17500)
+ * Increment CQLSH to version 6.2.0 for release 4.2 (CASSANDRA-17646)
+ * Adding support to perform certificate based internode authentication (CASSANDRA-17661)
+ * Option to disable CDC writes of repaired data (CASSANDRA-17666)
+ * When a node is bootstrapping it gets the whole gossip state but applies in random order causing some cases where StorageService will fail causing an instance to not show up in TokenMetadata (CASSANDRA-17676)
+ * Add CQLSH command SHOW REPLICAS (CASSANDRA-17577)
+ * Add guardrail to allow disabling of SimpleStrategy (CASSANDRA-17647)
+ * Change default directory permission to 750 in packaging (CASSANDRA-17470)
+ * Adding support for TLS client authentication for internode communication (CASSANDRA-17513)
+ * Add new CQL function maxWritetime (CASSANDRA-17425)
+ * Add guardrail for ALTER TABLE ADD / DROP / REMOVE column operations (CASSANDRA-17495)
+ * Rename DisableFlag class to EnableFlag on guardrails (CASSANDRA-17544)
+Merged from 4.1:
* Waiting indefinitely on ReceivedMessage response in StreamSession#receive() can cause deadlock (CASSANDRA-18733)
* Allow empty keystore_password in encryption_options (CASSANDRA-18778)
* Skip ColumnFamilyStore#topPartitions initialization when client or tool mode (CASSANDRA-18697)
diff --cc examples/ssl-factory/build.xml
index d803aebd0d,d803aebd0d..53ba12dc4e
--- a/examples/ssl-factory/build.xml
+++ b/examples/ssl-factory/build.xml
@@@ -20,7 -20,7 +20,7 @@@
<project default="jar" name="ssl-factory-example">
<property name="cassandra.dir" value="../.." />
-- <property name="cassandra.dir.lib" value="${cassandra.dir}/lib" />
++ <property name="cassandra.dir.lib" value="${cassandra.dir}/build/lib" />
<property name="cassandra.classes" value="${cassandra.dir}/build/classes/main" />
<property name="cassandra.test.lib" value="${cassandra.dir}/build/test/lib" />
<property name="build.src" value="${basedir}/src" />
diff --cc src/java/org/apache/cassandra/net/InboundConnectionInitiator.java
index b6bd17567c,3067b587c9..c76d9b0375
--- a/src/java/org/apache/cassandra/net/InboundConnectionInitiator.java
+++ b/src/java/org/apache/cassandra/net/InboundConnectionInitiator.java
@@@ -62,11 -60,7 +62,12 @@@ import org.apache.cassandra.utils.memor
import static java.lang.Math.*;
import static java.util.concurrent.TimeUnit.MILLISECONDS;
+import static org.apache.cassandra.auth.IInternodeAuthenticator.InternodeConnectionDirection.INBOUND;
import static org.apache.cassandra.concurrent.ExecutorFactory.Global.executorFactory;
+import static org.apache.cassandra.net.InternodeConnectionUtils.DISCARD_HANDLER_NAME;
++import static org.apache.cassandra.net.InternodeConnectionUtils.SSL_FACTORY_CONTEXT_DESCRIPTION;
+import static org.apache.cassandra.net.InternodeConnectionUtils.SSL_HANDLER_NAME;
+import static org.apache.cassandra.net.InternodeConnectionUtils.certificates;
import static org.apache.cassandra.net.MessagingService.*;
import static org.apache.cassandra.net.SocketFactory.WIRETRACE;
import static org.apache.cassandra.net.SocketFactory.newSslHandler;
diff --cc src/java/org/apache/cassandra/net/InternodeConnectionUtils.java
index fd3d1bd69e,0000000000..c6c029dfc5
mode 100644,000000..100644
--- a/src/java/org/apache/cassandra/net/InternodeConnectionUtils.java
+++ b/src/java/org/apache/cassandra/net/InternodeConnectionUtils.java
@@@ -1,92 -1,0 +1,93 @@@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.cassandra.net;
+
+import java.nio.channels.ClosedChannelException;
+import java.security.cert.Certificate;
+import javax.net.ssl.SSLPeerUnverifiedException;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.netty.buffer.ByteBuf;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import io.netty.handler.ssl.SslHandler;
+
+/**
+ * Class that contains certificate utility methods.
+ */
+public class InternodeConnectionUtils
+{
+ public static String SSL_HANDLER_NAME = "ssl";
+ public static String DISCARD_HANDLER_NAME = "discard";
++ public static String SSL_FACTORY_CONTEXT_DESCRIPTION = "server_encryption_options";
+ private static final Logger logger = LoggerFactory.getLogger(InternodeConnectionUtils.class);
+
+ public static Certificate[] certificates(Channel channel)
+ {
+ final SslHandler sslHandler = (SslHandler) channel.pipeline().get(SSL_HANDLER_NAME);
+ Certificate[] certificates = null;
+ if (sslHandler != null)
+ {
+ try
+ {
+ certificates = sslHandler.engine()
+ .getSession()
+ .getPeerCertificates();
+ }
+ catch (SSLPeerUnverifiedException e)
+ {
+ logger.debug("Failed to get peer certificates for peer {}", channel.remoteAddress(), e);
+ }
+ }
+ return certificates;
+ }
+
+ public static boolean isSSLError(final Throwable cause)
+ {
+ return (cause instanceof ClosedChannelException)
+ && cause.getCause() == null
+ && cause.getStackTrace()[0].getClassName().contains("SslHandler")
+ && cause.getStackTrace()[0].getMethodName().contains("channelInactive");
+ }
+
+ /**
+ * Discard handler releases the received data silently. when internode authentication fails, the channel is closed,
+ * but the pending buffered data may still be fired through the pipeline. To avoid that, authentication handler is
+ * replaced with this DiscardHandler to release all the buffered data, to avoid handling unauthenticated data in the
+ * following handlers.
+ */
+ public static class ByteBufDiscardHandler extends ChannelInboundHandlerAdapter
+ {
+ @Override
+ public void channelRead(ChannelHandlerContext ctx, Object msg)
+ {
+ if (msg instanceof ByteBuf)
+ {
+ ((ByteBuf) msg).release();
+ }
+ else
+ {
+ ctx.fireChannelRead(msg);
+ }
+ }
+ }
+}
diff --cc src/java/org/apache/cassandra/net/OutboundConnectionInitiator.java
index 1f1ef6478a,5de2a080d9..63b99a45db
--- a/src/java/org/apache/cassandra/net/OutboundConnectionInitiator.java
+++ b/src/java/org/apache/cassandra/net/OutboundConnectionInitiator.java
@@@ -63,11 -59,8 +63,12 @@@ import org.apache.cassandra.utils.concu
import org.apache.cassandra.utils.memory.BufferPools;
import static java.util.concurrent.TimeUnit.*;
-import static org.apache.cassandra.net.MessagingService.SSL_FACTORY_CONTEXT_DESCRIPTION;
-import static org.apache.cassandra.net.MessagingService.VERSION_40;
+import static org.apache.cassandra.auth.IInternodeAuthenticator.InternodeConnectionDirection.OUTBOUND;
+import static org.apache.cassandra.auth.IInternodeAuthenticator.InternodeConnectionDirection.OUTBOUND_PRECONNECT;
+import static org.apache.cassandra.net.InternodeConnectionUtils.DISCARD_HANDLER_NAME;
++import static org.apache.cassandra.net.InternodeConnectionUtils.SSL_FACTORY_CONTEXT_DESCRIPTION;
+import static org.apache.cassandra.net.InternodeConnectionUtils.SSL_HANDLER_NAME;
+import static org.apache.cassandra.net.InternodeConnectionUtils.certificates;
import static org.apache.cassandra.net.HandshakeProtocol.*;
import static org.apache.cassandra.net.ConnectionType.STREAMING;
import static org.apache.cassandra.net.OutboundConnectionInitiator.Result.incompatible;
@@@ -238,59 -220,6 +239,59 @@@ public class OutboundConnectionInitiato
pipeline.addLast("handshake", new Handler());
}
+ private SslContext getSslContext(SslFallbackConnectionType connectionType) throws IOException
+ {
+ boolean requireClientAuth = false;
+ if (connectionType == SslFallbackConnectionType.MTLS || connectionType == SslFallbackConnectionType.SSL)
+ {
+ requireClientAuth = true;
+ }
+ else if (connectionType == SslFallbackConnectionType.SERVER_CONFIG)
+ {
+ requireClientAuth = settings.withEncryption();
+ }
- return SSLFactory.getOrCreateSslContext(settings.encryption, requireClientAuth, ISslContextFactory.SocketType.CLIENT);
++ return SSLFactory.getOrCreateSslContext(settings.encryption, requireClientAuth, ISslContextFactory.SocketType.CLIENT, SSL_FACTORY_CONTEXT_DESCRIPTION);
+ }
+
+ }
+
+ /**
+ * Authenticates the server before an outbound connection is established. If a connection is SSL based connection
+ * Server's identity is verified during ssl handshake using root certificate in truststore. One may choose to ignore
+ * outbound authentication or perform required authentication for outbound connections in the implementation
+ * of IInternodeAuthenticator interface.
+ */
+ @VisibleForTesting
+ static class ServerAuthenticationHandler extends ByteToMessageDecoder
+ {
+ final OutboundConnectionSettings settings;
+
+ ServerAuthenticationHandler(OutboundConnectionSettings settings)
+ {
+ this.settings = settings;
+ }
+
+ @Override
+ protected void decode(ChannelHandlerContext channelHandlerContext, ByteBuf byteBuf, List<Object> list) throws Exception
+ {
+ // Extract certificates from SSL handler(handler with name "ssl").
+ final Certificate[] certificates = certificates(channelHandlerContext.channel());
+ if (!settings.authenticator.authenticate(settings.to.getAddress(), settings.to.getPort(), certificates, OUTBOUND))
+ {
+ // interrupt other connections, so they must attempt to re-authenticate
+ MessagingService.instance().interruptOutbound(settings.to);
+ logger.error("Authentication failed to " + settings.connectToId());
+
+ // To release all the pending buffered data, replace authentication handler with discard handler.
+ // This avoids pending inbound data to be fired through the pipeline
+ channelHandlerContext.pipeline().replace(this, DISCARD_HANDLER_NAME, new InternodeConnectionUtils.ByteBufDiscardHandler());
+ channelHandlerContext.pipeline().close();
+ }
+ else
+ {
+ channelHandlerContext.pipeline().remove(this);
+ }
+ }
}
private class Handler extends ByteToMessageDecoder
diff --cc src/java/org/apache/cassandra/security/SSLFactory.java
index e6da577202,51bde34258..5a175b3fd6
--- a/src/java/org/apache/cassandra/security/SSLFactory.java
+++ b/src/java/org/apache/cassandra/security/SSLFactory.java
@@@ -41,7 -42,7 +42,6 @@@ import io.netty.handler.ssl.OpenSsl
import io.netty.handler.ssl.SslContext;
import io.netty.util.ReferenceCountUtil;
import org.apache.cassandra.concurrent.ScheduledExecutors;
- import org.apache.cassandra.config.DatabaseDescriptor;
-import org.apache.cassandra.config.Config;
import org.apache.cassandra.config.EncryptionOptions;
import org.apache.cassandra.security.ISslContextFactory.SocketType;
diff --cc src/java/org/apache/cassandra/transport/PipelineConfigurator.java
index ff524785dc,cefba02c59..d19af211e2
--- a/src/java/org/apache/cassandra/transport/PipelineConfigurator.java
+++ b/src/java/org/apache/cassandra/transport/PipelineConfigurator.java
@@@ -64,8 -61,10 +64,10 @@@ public class PipelineConfigurato
// Not to be used in production, this causes a Netty logging handler to be added to the pipeline,
// which will throttle a system under any normal load.
- private static final boolean DEBUG = Boolean.getBoolean("cassandra.unsafe_verbose_debug_client_protocol");
+ private static final boolean DEBUG = TEST_UNSAFE_VERBOSE_DEBUG_CLIENT_PROTOCOL.getBoolean();
+ public static final String SSL_FACTORY_CONTEXT_DESCRIPTION = "client_encryption_options";
+
// Stateless handlers
private static final ConnectionLimitHandler connectionLimitHandler = new ConnectionLimitHandler();
@@@ -202,9 -201,9 +205,10 @@@
return channel -> {
SslContext sslContext = SSLFactory.getOrCreateSslContext(encryptionOptions,
encryptionOptions.require_client_auth,
- ISslContextFactory.SocketType.SERVER);
+ ISslContextFactory.SocketType.SERVER,
+ SSL_FACTORY_CONTEXT_DESCRIPTION);
- channel.pipeline().addFirst(SSL_HANDLER, sslContext.newHandler(channel.alloc()));
+ InetSocketAddress peer = encryptionOptions.require_endpoint_verification ? (InetSocketAddress) channel.remoteAddress() : null;
+ channel.pipeline().addFirst(SSL_HANDLER, newSslHandler(channel, sslContext, peer));
};
default:
throw new IllegalStateException("Unrecognized TLS encryption policy: " + this.tlsEncryptionPolicy);
diff --cc src/java/org/apache/cassandra/transport/SimpleClient.java
index 2b57d104e4,5ea0190aea..8e270a3f55
--- a/src/java/org/apache/cassandra/transport/SimpleClient.java
+++ b/src/java/org/apache/cassandra/transport/SimpleClient.java
@@@ -52,9 -52,9 +52,10 @@@ import org.apache.cassandra.security.SS
import org.apache.cassandra.transport.messages.*;
import org.apache.cassandra.utils.concurrent.UncheckedInterruptedException;
+import static org.apache.cassandra.net.SocketFactory.newSslHandler;
import static org.apache.cassandra.transport.CQLMessageHandler.envelopeSize;
import static org.apache.cassandra.transport.Flusher.MAX_FRAMED_PAYLOAD_SIZE;
+ import static org.apache.cassandra.transport.PipelineConfigurator.SSL_FACTORY_CONTEXT_DESCRIPTION;
import static org.apache.cassandra.utils.concurrent.NonBlockingRateLimiter.NO_OP_LIMITER;
import static org.apache.cassandra.utils.Clock.Global.currentTimeMillis;
@@@ -624,9 -624,8 +625,9 @@@ public class SimpleClient implements Cl
{
super.initChannel(channel);
SslContext sslContext = SSLFactory.getOrCreateSslContext(encryptionOptions, encryptionOptions.require_client_auth,
- ISslContextFactory.SocketType.CLIENT);
+ ISslContextFactory.SocketType.CLIENT, SSL_FACTORY_CONTEXT_DESCRIPTION);
- channel.pipeline().addFirst("ssl", sslContext.newHandler(channel.alloc()));
+ InetSocketAddress peer = encryptionOptions.require_endpoint_verification ? new InetSocketAddress(host, port) : null;
+ channel.pipeline().addFirst("ssl", newSslHandler(channel, sslContext, peer));
}
}
diff --cc test/unit/org/apache/cassandra/security/DefaultSslContextFactoryTest.java
index bcd13efd4d,bec9d20042..c169b9e775
--- a/test/unit/org/apache/cassandra/security/DefaultSslContextFactoryTest.java
+++ b/test/unit/org/apache/cassandra/security/DefaultSslContextFactoryTest.java
@@@ -65,15 -56,13 +65,15 @@@ public class DefaultSslContextFactoryTe
@Test
public void getSslContextOpenSSL() throws IOException
{
- EncryptionOptions options = new EncryptionOptions().withTrustStore("test/conf/cassandra_ssl_test.truststore")
- .withTrustStorePassword("cassandra")
- .withKeyStore("test/conf/cassandra_ssl_test.keystore")
- .withKeyStorePassword("cassandra")
- .withRequireClientAuth(false)
- .withCipherSuites("TLS_RSA_WITH_AES_128_CBC_SHA");
+ EncryptionOptions.ServerEncryptionOptions options = new EncryptionOptions.ServerEncryptionOptions().withTrustStore("test/conf/cassandra_ssl_test.truststore")
+ .withTrustStorePassword("cassandra")
+ .withKeyStore("test/conf/cassandra_ssl_test.keystore")
+ .withKeyStorePassword("cassandra")
+ .withOutboundKeystore("test/conf/cassandra_ssl_test_outbound.keystore")
+ .withOutboundKeystorePassword("cassandra")
+ .withRequireClientAuth(false)
+ .withCipherSuites("TLS_RSA_WITH_AES_128_CBC_SHA");
- SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
+ SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test");
Assert.assertNotNull(sslContext);
if (OpenSsl.isAvailable())
Assert.assertTrue(sslContext instanceof OpenSslContext);
diff --cc test/unit/org/apache/cassandra/security/PEMBasedSslContextFactoryTest.java
index ee9c6104c8,f44e34492e..a1fb37c1b9
--- a/test/unit/org/apache/cassandra/security/PEMBasedSslContextFactoryTest.java
+++ b/test/unit/org/apache/cassandra/security/PEMBasedSslContextFactoryTest.java
@@@ -218,28 -216,7 +218,28 @@@ public class PEMBasedSslContextFactoryT
.withRequireClientAuth(false)
.withCipherSuites("TLS_RSA_WITH_AES_128_CBC_SHA")
.withSslContextFactory(sslContextFactory);
- SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.SERVER);
++ SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.SERVER, "test");
+ Assert.assertNotNull(sslContext);
+ if (OpenSsl.isAvailable())
+ Assert.assertTrue(sslContext instanceof OpenSslContext);
+ else
+ Assert.assertTrue(sslContext instanceof SslContext);
+ }
+
+ @Test
+ public void getSslContextOpenSSLOutboundKeystore() throws IOException
+ {
+ ParameterizedClass sslContextFactory = new ParameterizedClass(PEMBasedSslContextFactory.class.getSimpleName()
+ , new HashMap<>());
+ EncryptionOptions.ServerEncryptionOptions options = new EncryptionOptions.ServerEncryptionOptions().withTrustStore("test/conf/cassandra_ssl_test.truststore.pem")
+ .withKeyStore("test/conf/cassandra_ssl_test.keystore.pem")
+ .withKeyStorePassword("cassandra")
+ .withOutboundKeystore("test/conf/cassandra_ssl_test.keystore.pem")
+ .withOutboundKeystorePassword("cassandra")
+ .withRequireClientAuth(false)
+ .withCipherSuites("TLS_RSA_WITH_AES_128_CBC_SHA")
+ .withSslContextFactory(sslContextFactory);
- SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
+ SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test");
Assert.assertNotNull(sslContext);
if (OpenSsl.isAvailable())
Assert.assertTrue(sslContext instanceof OpenSslContext);
diff --cc test/unit/org/apache/cassandra/security/SSLFactoryTest.java
index ff3bab9d26,91e4062be4..b6e0b8e4b5
--- a/test/unit/org/apache/cassandra/security/SSLFactoryTest.java
+++ b/test/unit/org/apache/cassandra/security/SSLFactoryTest.java
@@@ -18,15 -18,11 +18,16 @@@
*/
package org.apache.cassandra.security;
-import org.apache.cassandra.io.util.File;
import java.io.FileInputStream;
+ import java.io.FileOutputStream;
import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.util.HashMap;
import java.util.Map;
@@@ -219,20 -177,26 +230,26 @@@ public class SSLFactoryTes
try
{
ServerEncryptionOptions options = addKeystoreOptions(encryptionOptions);
+ // emulate InboundSockets and share the cert but with different options, no extra hot reloading init
+ ServerEncryptionOptions legacyOptions = options.withOptional(false).withInternodeEncryption(ServerEncryptionOptions.InternodeEncryption.all);
- SSLFactory.initHotReloading(options, options, true);
- SslContext oldCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
- File keystoreFile = new File(options.keystore);
+ File testKeystoreFile = new File(options.keystore + ".test");
+ FileUtils.copyFile(new File(options.keystore).toJavaIOFile(), testKeystoreFile.toJavaIOFile());
+ options = options.withKeyStore(testKeystoreFile.path());
- SSLFactory.checkCertFilesForHotReloading(options, options);
- keystoreFile.trySetLastModified(System.currentTimeMillis() + 5000);
+ SSLFactory.initHotReloading(options, options, true); // deliberately not initializing with legacyOptions to match InboundSockets.addBindings
- ServerEncryptionOptions modOptions = new ServerEncryptionOptions(options)
- .withKeyStorePassword("bad password");
- SSLFactory.checkCertFilesForHotReloading(modOptions, modOptions);
- SslContext newCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
+ SslContext oldCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test");
- SslContext oldLegacyCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test legacy");
++ SslContext oldLegacyCtx = SSLFactory.getOrCreateSslContext(legacyOptions, true, ISslContextFactory.SocketType.CLIENT, "test legacy");
+
+ changeKeystorePassword(options.keystore, options.keystore_password, "bad password");
+
+ SSLFactory.checkCertFilesForHotReloading();
+ SslContext newCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test");
- SslContext newLegacyCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT, "test legacy");
++ SslContext newLegacyCtx = SSLFactory.getOrCreateSslContext(legacyOptions, true, ISslContextFactory.SocketType.CLIENT, "test legacy");
Assert.assertSame(oldCtx, newCtx);
+ Assert.assertSame(oldLegacyCtx, newLegacyCtx);
}
finally
{
@@@ -356,35 -321,25 +373,57 @@@
Assert.assertNotEquals(cacheKey1, cacheKey2);
}
+ public static class TestFileBasedSSLContextFactory extends FileBasedSslContextFactory {
+ public TestFileBasedSSLContextFactory(Map<String, Object> parameters)
+ {
+ super(parameters);
+ }
+ }
+
+ private static Certificate getCertificates(final String filename, final String password) throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException
+ {
+ FileInputStream is = new FileInputStream(filename);
+ KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
+ char[] passwd = password.toCharArray();
+ keystore.load(is, passwd);
+ return keystore.getCertificate("cassandra_ssl_test");
+ }
+
+ private static Certificate getCertificateLoadedInSslContext(final OpenSslSessionContext session)
+ throws ClassNotFoundException, InvocationTargetException, IllegalAccessException, NoSuchMethodException, NoSuchFieldException
+ {
+ Field providerField = OpenSslSessionContext.class.getDeclaredField("provider");
+ providerField.setAccessible(true);
+
+ Class<?> keyMaterialProvider = Class.forName("io.netty.handler.ssl.OpenSslKeyMaterialProvider");
+ Object provider = keyMaterialProvider.cast(providerField.get(session));
+
+ Method keyManager = provider.getClass().getDeclaredMethod("keyManager");
+ keyManager.setAccessible(true);
+ X509KeyManager keyManager1 = (X509KeyManager) keyManager.invoke(provider);
+ final Certificate[] certificates = keyManager1.getCertificateChain("cassandra_ssl_test");
+ return certificates[0];
+ }
++
+ void changeKeystorePassword(String filename, String currentPassword, String newPassword)
+ {
+ try
+ {
+ KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
+ char[] loadPasswd = currentPassword.toCharArray();
+ char[] storePasswd = newPassword.toCharArray();
+ try (FileInputStream is = new FileInputStream(filename))
+ {
+ keystore.load(is, loadPasswd);
+ }
+ try (FileOutputStream os = new FileOutputStream(filename))
+ {
+ keystore.store(os, storePasswd);
+ }
+ }
+ catch (Throwable tr)
+ {
+ throw new RuntimeException(tr);
+ }
+ }
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org