You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by sp...@apache.org on 2016/04/27 19:58:59 UTC
[09/24] incubator-tinkerpop git commit: Added additional SSL
configuration options for Gremlin Driver.
Added additional SSL configuration options for Gremlin Driver.
Specifically added: keyPassword, keyFile and keyCertChainFile.
Project: http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/commit/57416163
Tree: http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/tree/57416163
Diff: http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/diff/57416163
Branch: refs/heads/TINKERPOP-1179
Commit: 57416163be0470d0dcd124bebc12efe325578805
Parents: ec730eb
Author: Stephen Mallette <sp...@genoprime.com>
Authored: Tue Apr 19 13:53:35 2016 -0400
Committer: Stephen Mallette <sp...@genoprime.com>
Committed: Wed Apr 20 15:07:15 2016 -0400
----------------------------------------------------------------------
CHANGELOG.asciidoc | 1 +
.../tinkerpop/gremlin/driver/Channelizer.java | 38 +++++++++++++++-----
.../tinkerpop/gremlin/driver/Cluster.java | 33 +++++++++++++++++
.../tinkerpop/gremlin/driver/Settings.java | 15 ++++++++
4 files changed, 78 insertions(+), 9 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/blob/57416163/CHANGELOG.asciidoc
----------------------------------------------------------------------
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 9e117e1..32b534d 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -26,6 +26,7 @@ image::https://raw.githubusercontent.com/apache/incubator-tinkerpop/master/docs/
TinkerPop 3.1.3 (NOT OFFICIALLY RELEASED YET)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+* Added driver configuration settings for SSL: `keyCertChainFile`, `keyFile` and `keyPassword`.
* Fixed bug where transaction managed sessions were not properly rolling back transactions for exceptions encountered during script evaluation.
* Fixed bug in `:uninstall` command if the default `/ext` directory was not used.
http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/blob/57416163/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Channelizer.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Channelizer.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Channelizer.java
index b059c3f..c850a11 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Channelizer.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Channelizer.java
@@ -21,7 +21,9 @@ package org.apache.tinkerpop.gremlin.driver;
import io.netty.channel.Channel;
import io.netty.handler.codec.http.websocketx.CloseWebSocketFrame;
import io.netty.handler.ssl.SslContextBuilder;
+import io.netty.handler.ssl.SslProvider;
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
+import io.netty.handler.ssl.util.SelfSignedCertificate;
import org.apache.tinkerpop.gremlin.driver.exception.ConnectionException;
import org.apache.tinkerpop.gremlin.driver.handler.NioGremlinRequestEncoder;
import org.apache.tinkerpop.gremlin.driver.handler.NioGremlinResponseDecoder;
@@ -41,7 +43,9 @@ import io.netty.handler.ssl.SslContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.net.ssl.SSLException;
import java.io.File;
+import java.security.cert.CertificateException;
import java.util.Optional;
import java.util.UUID;
import java.util.concurrent.ConcurrentMap;
@@ -116,15 +120,7 @@ public interface Channelizer extends ChannelHandler {
final Optional<SslContext> sslCtx;
if (supportsSsl()) {
try {
- final SslContextBuilder builder = SslContextBuilder.forClient();
- if (cluster.connectionPoolSettings().trustCertChainFile != null)
- builder.trustManager(new File(cluster.connectionPoolSettings().trustCertChainFile));
- else {
- logger.warn("SSL configured without a trustCertChainFile and thus trusts all certificates without verification (not suitable for production)");
- builder.trustManager(InsecureTrustManagerFactory.INSTANCE);
- }
-
- sslCtx = Optional.of(builder.build());
+ sslCtx = Optional.of(createSSLContext(cluster.connectionPoolSettings()));
} catch (Exception ex) {
throw new RuntimeException(ex);
}
@@ -140,6 +136,30 @@ public interface Channelizer extends ChannelHandler {
pipeline.addLast(PIPELINE_GREMLIN_SASL_HANDLER, new Handler.GremlinSaslAuthenticationHandler(cluster.authProperties()));
pipeline.addLast(PIPELINE_GREMLIN_HANDLER, new Handler.GremlinResponseHandler(pending));
}
+
+ private SslContext createSSLContext(final Settings.ConnectionPoolSettings sslSettings) throws Exception {
+ final SslProvider provider = SslProvider.JDK;
+
+ final SslContextBuilder builder = SslContextBuilder.forClient();
+ if (cluster.connectionPoolSettings().trustCertChainFile != null)
+ builder.trustManager(new File(cluster.connectionPoolSettings().trustCertChainFile));
+ else {
+ logger.warn("SSL configured without a trustCertChainFile and thus trusts all certificates without verification (not suitable for production)");
+ builder.trustManager(InsecureTrustManagerFactory.INSTANCE);
+ }
+
+ if (null != sslSettings.keyCertChainFile && null != sslSettings.keyFile) {
+ final File keyCertChainFile = new File(sslSettings.keyCertChainFile);
+ final File keyFile = new File(sslSettings.keyFile);
+
+ // note that keyPassword may be null here if the keyFile is not password-protected.
+ builder.keyManager(keyCertChainFile, keyFile, sslSettings.keyPassword);
+ }
+
+ builder.sslProvider(provider);
+
+ return builder.build();
+ }
}
/**
http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/blob/57416163/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Cluster.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Cluster.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Cluster.java
index 02181e2..7ae898b 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Cluster.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Cluster.java
@@ -144,6 +144,9 @@ public final class Cluster {
.port(settings.port)
.enableSsl(settings.connectionPool.enableSsl)
.trustCertificateChainFile(settings.connectionPool.trustCertChainFile)
+ .keyCertChainFile(settings.connectionPool.keyCertChainFile)
+ .keyFile(settings.connectionPool.keyFile)
+ .keyPassword(settings.connectionPool.keyPassword)
.nioPoolSize(settings.nioPoolSize)
.workerPoolSize(settings.workerPoolSize)
.reconnectInterval(settings.connectionPool.reconnectInterval)
@@ -286,6 +289,9 @@ public final class Cluster {
private String channelizer = Channelizer.WebSocketChannelizer.class.getName();
private boolean enableSsl = false;
private String trustCertChainFile = null;
+ private String keyCertChainFile = null;
+ private String keyFile = null;
+ private String keyPassword = null;
private LoadBalancingStrategy loadBalancingStrategy = new LoadBalancingStrategy.RoundRobin();
private AuthProperties authProps = new AuthProperties();
@@ -363,6 +369,30 @@ public final class Cluster {
}
/**
+ * The X.509 certificate chain file in PEM format.
+ */
+ public Builder keyCertChainFile(final String keyCertChainFile) {
+ this.keyCertChainFile = keyCertChainFile;
+ return this;
+ }
+
+ /**
+ * The PKCS#8 private key file in PEM format.
+ */
+ public Builder keyFile(final String keyFile) {
+ this.keyFile = keyFile;
+ return this;
+ }
+
+ /**
+ * The password of the {@link #keyFile}, or {@code null} if it's not password-protected.
+ */
+ public Builder keyPassword(final String keyPassword) {
+ this.keyPassword = keyPassword;
+ return this;
+ }
+
+ /**
* The minimum number of in-flight requests that can occur on a {@link Connection} before it is considered
* for closing on return to the {@link ConnectionPool}.
*/
@@ -587,6 +617,9 @@ public final class Cluster {
connectionPoolSettings.resultIterationBatchSize = this.resultIterationBatchSize;
connectionPoolSettings.enableSsl = this.enableSsl;
connectionPoolSettings.trustCertChainFile = this.trustCertChainFile;
+ connectionPoolSettings.keyCertChainFile = this.keyCertChainFile;
+ connectionPoolSettings.keyFile = this.keyFile;
+ connectionPoolSettings.keyPassword = this.keyPassword;
connectionPoolSettings.channelizer = this.channelizer;
return new Cluster(getContactPoints(), serializer, this.nioPoolSize, this.workerPoolSize,
connectionPoolSettings, loadBalancingStrategy, authProps);
http://git-wip-us.apache.org/repos/asf/incubator-tinkerpop/blob/57416163/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
----------------------------------------------------------------------
diff --git a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
index 4daa223..373b9c7 100644
--- a/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
+++ b/gremlin-driver/src/main/java/org/apache/tinkerpop/gremlin/driver/Settings.java
@@ -119,6 +119,21 @@ final class Settings {
public String trustCertChainFile = null;
/**
+ * The X.509 certificate chain file in PEM format.
+ */
+ public String keyCertChainFile = null;
+
+ /**
+ * The PKCS#8 private key file in PEM format.
+ */
+ public String keyFile = null;
+
+ /**
+ * The password of the {@link #keyFile}, or {@code null} if it's not password-protected.
+ */
+ public String keyPassword = null;
+
+ /**
* The minimum size of a connection pool for a {@link Host}. By default this is set to 2.
*/
public int minSize = ConnectionPool.MIN_POOL_SIZE;