You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ud...@apache.org on 2016/08/09 20:06:06 UTC
[3/3] incubator-geode git commit: GEODE-420: Amended method signature
in SSLConfigurationFactory.java and SocketCreatorFactory.java to be more
generic. Deprecated Cluster-ssl-* configuration and replaced it with new
ssl-* configuration properties.
GEODE-420: Amended method signature in SSLConfigurationFactory.java and SocketCreatorFactory.java to be more generic.
Deprecated Cluster-ssl-* configuration and replaced it with new ssl-* configuration properties.
Project: http://git-wip-us.apache.org/repos/asf/incubator-geode/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-geode/commit/f7424db6
Tree: http://git-wip-us.apache.org/repos/asf/incubator-geode/tree/f7424db6
Diff: http://git-wip-us.apache.org/repos/asf/incubator-geode/diff/f7424db6
Branch: refs/heads/feature/GEODE-420
Commit: f7424db6e4316bff151162cada55c800106c6ef5
Parents: b557ccf
Author: Udo Kohlmeyer <uk...@pivotal.io>
Authored: Wed Aug 10 06:04:57 2016 +1000
Committer: Udo Kohlmeyer <uk...@pivotal.io>
Committed: Wed Aug 10 06:04:57 2016 +1000
----------------------------------------------------------------------
.../controllers/RestAPIsWithSSLDUnitTest.java | 199 ++++++-------
.../internal/DistributedSystemConfigImpl.java | 8 +-
.../admin/jmx/internal/AgentConfigImpl.java | 24 +-
.../jmx/internal/MX4JServerSocketFactory.java | 4 +-
.../client/internal/ConnectionFactoryImpl.java | 5 +-
.../distributed/ConfigurationProperties.java | 90 +++++-
.../distributed/SSLEnabledComponents.java | 6 +
.../internal/AbstractDistributionConfig.java | 114 ++++----
.../internal/DistributionConfig.java | 287 ++++++++++++++++---
.../internal/DistributionConfigImpl.java | 195 +++++++++++--
.../membership/gms/fd/GMSHealthMonitor.java | 5 +-
.../internal/tcpserver/TcpServer.java | 21 +-
.../gemfire/internal/AbstractConfig.java | 39 ++-
.../gemfire/internal/admin/SSLConfig.java | 29 +-
.../cache/tier/sockets/AcceptorImpl.java | 5 +-
.../internal/net/SSLConfigurationFactory.java | 53 +++-
.../internal/net/SSLEnabledComponent.java | 2 +-
.../internal/net/SocketCreatorFactory.java | 36 +--
.../gemfire/internal/tcp/Connection.java | 3 +-
.../gemfire/internal/tcp/TCPConduit.java | 23 +-
.../management/internal/ManagementAgent.java | 2 +-
.../CacheServerSSLConnectionDUnitTest.java | 37 ++-
.../gemfire/distributed/LocatorDUnitTest.java | 2 +
.../LocatorLauncherLocalIntegrationTest.java | 5 +-
.../LocatorLauncherRemoteIntegrationTest.java | 5 +-
.../ServerLauncherLocalIntegrationTest.java | 7 +-
.../ServerLauncherRemoteIntegrationTest.java | 7 +-
.../internal/DistributionConfigJUnitTest.java | 7 +-
.../InternalDistributedSystemJUnitTest.java | 22 +-
.../internal/net/JSSESocketJUnitTest.java | 12 +-
.../net/SocketCreatorFactoryJUnitTest.java | 119 ++++----
.../gemfire/management/JMXMBeanDUnitTest.java | 17 +-
32 files changed, 903 insertions(+), 487 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-assembly/src/test/java/com/gemstone/gemfire/rest/internal/web/controllers/RestAPIsWithSSLDUnitTest.java
----------------------------------------------------------------------
diff --git a/geode-assembly/src/test/java/com/gemstone/gemfire/rest/internal/web/controllers/RestAPIsWithSSLDUnitTest.java b/geode-assembly/src/test/java/com/gemstone/gemfire/rest/internal/web/controllers/RestAPIsWithSSLDUnitTest.java
index 9b1072f..fa36979 100644
--- a/geode-assembly/src/test/java/com/gemstone/gemfire/rest/internal/web/controllers/RestAPIsWithSSLDUnitTest.java
+++ b/geode-assembly/src/test/java/com/gemstone/gemfire/rest/internal/web/controllers/RestAPIsWithSSLDUnitTest.java
@@ -26,7 +26,6 @@ import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.BindException;
-import java.net.Socket;
import java.security.KeyStore;
import java.util.Date;
import java.util.HashMap;
@@ -37,9 +36,8 @@ import javax.net.ssl.SSLContext;
import org.apache.http.HttpEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
-import org.apache.http.conn.ssl.PrivateKeyDetails;
-import org.apache.http.conn.ssl.PrivateKeyStrategy;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.conn.ssl.SSLContextBuilder;
import org.apache.http.conn.ssl.SSLContexts;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
@@ -107,7 +105,7 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
}
private File findTrustStoreJKSForPath(Properties props) {
- String propertyValue = props.getProperty(CLUSTER_SSL_TRUSTSTORE);
+ String propertyValue = props.getProperty(SSL_TRUSTSTORE);
if (StringUtils.isEmpty(propertyValue)) {
propertyValue = props.getProperty(HTTP_SERVICE_SSL_TRUSTSTORE);
}
@@ -118,7 +116,7 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
}
private File findKeyStoreJKS(Properties props) {
- String propertyValue = props.getProperty(CLUSTER_SSL_KEYSTORE);
+ String propertyValue = props.getProperty(SSL_KEYSTORE);
if (StringUtils.isEmpty(propertyValue)) {
propertyValue = props.getProperty(HTTP_SERVICE_SSL_KEYSTORE);
}
@@ -301,14 +299,13 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
}
String sslEnabledComponentsProperty = sslProperties.getProperty(SSL_ENABLED_COMPONENTS);
if (sslEnabledComponentsProperty != null && sslEnabledComponentsProperty.length() > 0) {
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_ENABLED, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_KEYSTORE, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_KEYSTORE_PASSWORD, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_KEYSTORE_TYPE, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_PROTOCOLS, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_REQUIRE_AUTHENTICATION, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_TRUSTSTORE, null);
- sslPropertyConverter(sslProperties, props, CLUSTER_SSL_TRUSTSTORE_PASSWORD, null);
+ sslPropertyConverter(sslProperties, props, SSL_KEYSTORE, null);
+ sslPropertyConverter(sslProperties, props, SSL_KEYSTORE_PASSWORD, null);
+ sslPropertyConverter(sslProperties, props, SSL_KEYSTORE_TYPE, null);
+ sslPropertyConverter(sslProperties, props, SSL_PROTOCOLS, null);
+ sslPropertyConverter(sslProperties, props, SSL_REQUIRE_AUTHENTICATION, null);
+ sslPropertyConverter(sslProperties, props, SSL_TRUSTSTORE, null);
+ sslPropertyConverter(sslProperties, props, SSL_TRUSTSTORE_PASSWORD, null);
sslPropertyConverter(sslProperties, props, HTTP_SERVICE_SSL_ALIAS, null);
sslPropertyConverter(sslProperties, props, SSL_ENABLED_COMPONENTS, null);
}
@@ -398,23 +395,18 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
clientTrust.load(new FileInputStream(trustStoreJKSForPath), "password".toCharArray());
// this is needed
- SSLContext sslcontext = SSLContexts.custom()
- .loadTrustMaterial(clientTrust, new TrustSelfSignedStrategy())
- .loadKeyMaterial(clientKeys, "password".toCharArray(), new PrivateKeyStrategy() {
- @Override
- public String chooseAlias(final Map<String, PrivateKeyDetails> aliases, final Socket socket) {
- if(aliases.size() == 1)
- {
- return aliases.keySet().stream().findFirst().get();
- }
- if (!StringUtils.isEmpty(properties.getProperty(INVALID_CLIENT_ALIAS))) {
- return properties.getProperty(INVALID_CLIENT_ALIAS);
- } else {
- return properties.getProperty(HTTP_SERVICE_SSL_ALIAS);
- }
- }
- })
- .build();
+ SSLContextBuilder custom = SSLContexts.custom();
+ SSLContextBuilder sslContextBuilder = custom.loadTrustMaterial(clientTrust, new TrustSelfSignedStrategy());
+ SSLContext sslcontext = sslContextBuilder.loadKeyMaterial(clientKeys, "password".toCharArray(), (aliases, socket) -> {
+ if (aliases.size() == 1) {
+ return aliases.keySet().stream().findFirst().get();
+ }
+ if (!StringUtils.isEmpty(properties.getProperty(INVALID_CLIENT_ALIAS))) {
+ return properties.getProperty(INVALID_CLIENT_ALIAS);
+ } else {
+ return properties.getProperty(HTTP_SERVICE_SSL_ALIAS);
+ }
+ }).build();
// Host checking is disabled here , as tests might run on multiple hosts and
// host entries can not be assumed
@@ -471,11 +463,11 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
public void testSimpleSSL() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
validateConnection(restEndpoint, "SSL", props);
@@ -485,12 +477,11 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
public void testSimpleSSLWithMultiKey_KeyStore() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKey.jks"));
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKeyTrust.jks"));
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_TRUSTSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_KEYSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKey.jks"));
+ props.setProperty(SSL_TRUSTSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKeyTrust.jks"));
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
props.setProperty(HTTP_SERVICE_SSL_ALIAS, "httpservicekey");
String restEndpoint = startInfraWithSSL(props, false);
@@ -501,12 +492,11 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
public void testSimpleSSLWithMultiKey_KeyStore_WithInvalidClientKey() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKey.jks"));
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKeyTrust.jks"));
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_TRUSTSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_KEYSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKey.jks"));
+ props.setProperty(SSL_TRUSTSTORE, TestUtil.getResourcePath(getClass(), "/com/gemstone/gemfire/internal/net/multiKeyTrust.jks"));
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
props.setProperty(HTTP_SERVICE_SSL_ALIAS, "httpservicekey");
props.setProperty(INVALID_CLIENT_ALIAS, "someAlias");
@@ -517,10 +507,10 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithoutKeyStoreType() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -530,12 +520,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithSSLProtocol() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "SSL");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "SSL");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -545,12 +535,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithTLSProtocol() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "TLS");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "TLS");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -560,12 +550,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithTLSv11Protocol() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "TLSv1.1");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "TLSv1.1");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -575,12 +565,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithTLSv12Protocol() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "TLSv1.2");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "TLSv1.2");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -590,12 +580,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testWithMultipleProtocol() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "SSL,TLSv1.2");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "SSL,TLSv1.2");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
@@ -606,12 +596,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
public void testSSLWithCipherSuite() throws Exception {
System.setProperty("javax.net.debug", "ssl");
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "TLSv1.2");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "TLSv1.2");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
SSLContext ssl = SSLContext.getInstance("TLSv1.2");
@@ -619,7 +609,7 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
ssl.init(null, null, new java.security.SecureRandom());
String[] cipherSuites = ssl.getSocketFactory().getSupportedCipherSuites();
- props.setProperty(CLUSTER_SSL_CIPHERS, cipherSuites[0]);
+ props.setProperty(SSL_CIPHERS, cipherSuites[0]);
String restEndpoint = startInfraWithSSL(props, false);
validateConnection(restEndpoint, "TLSv1.2", props);
@@ -628,12 +618,12 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
@Test
public void testSSLWithMultipleCipherSuite() throws Exception {
Properties props = new Properties();
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "TLSv1.2");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "TLSv1.2");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
SSLContext ssl = SSLContext.getInstance("TLSv1.2");
@@ -641,7 +631,7 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
ssl.init(null, null, new java.security.SecureRandom());
String[] cipherSuites = ssl.getSocketFactory().getSupportedCipherSuites();
- props.setProperty(CLUSTER_SSL_CIPHERS, cipherSuites[0] + "," + cipherSuites[1]);
+ props.setProperty(SSL_CIPHERS, cipherSuites[0] + "," + cipherSuites[1]);
String restEndpoint = startInfraWithSSL(props, false);
validateConnection(restEndpoint, "TLSv1.2", props);
@@ -651,18 +641,13 @@ public class RestAPIsWithSSLDUnitTest extends LocatorTestBase {
public void testMutualAuthentication() throws Exception {
Properties props = new Properties();
- props.setProperty(HTTP_SERVICE_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
-
- props.setProperty(HTTP_SERVICE_SSL_TRUSTSTORE_PASSWORD, "password");
-
- props.setProperty(CLUSTER_SSL_ENABLED, "true");
- props.setProperty(CLUSTER_SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_KEYSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
- props.setProperty(CLUSTER_SSL_TRUSTSTORE_PASSWORD, "password");
- props.setProperty(CLUSTER_SSL_KEYSTORE_TYPE, "JKS");
- props.setProperty(CLUSTER_SSL_PROTOCOLS, "SSL");
- props.setProperty(CLUSTER_SSL_REQUIRE_AUTHENTICATION, "true");
+ props.setProperty(SSL_KEYSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ props.setProperty(SSL_TRUSTSTORE, findTrustedJKSWithSingleEntry().getCanonicalPath());
+ props.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ props.setProperty(SSL_KEYSTORE_TYPE, "JKS");
+ props.setProperty(SSL_PROTOCOLS, "SSL");
+ props.setProperty(SSL_REQUIRE_AUTHENTICATION, "true");
props.setProperty(SSL_ENABLED_COMPONENTS, SSLEnabledComponents.HTTP_SERVICE);
String restEndpoint = startInfraWithSSL(props, false);
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/admin/internal/DistributedSystemConfigImpl.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/admin/internal/DistributedSystemConfigImpl.java b/geode-core/src/main/java/com/gemstone/gemfire/admin/internal/DistributedSystemConfigImpl.java
index 8f65506..37cd139 100755
--- a/geode-core/src/main/java/com/gemstone/gemfire/admin/internal/DistributedSystemConfigImpl.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/admin/internal/DistributedSystemConfigImpl.java
@@ -857,13 +857,13 @@ public class DistributedSystemConfigImpl
// SSL support...
// -------------------------------------------------------------------------
private boolean sslEnabled =
- DistributionConfig.DEFAULT_CLUSTER_SSL_ENABLED;
+ DistributionConfig.DEFAULT_SSL_ENABLED;
private String sslProtocols =
- DistributionConfig.DEFAULT_CLUSTER_SSL_PROTOCOLS;
+ DistributionConfig.DEFAULT_SSL_PROTOCOLS;
private String sslCiphers =
- DistributionConfig.DEFAULT_CLUSTER_SSL_CIPHERS;
+ DistributionConfig.DEFAULT_SSL_CIPHERS;
private boolean sslAuthenticationRequired =
- DistributionConfig.DEFAULT_CLUSTER_SSL_REQUIRE_AUTHENTICATION;
+ DistributionConfig.DEFAULT_SSL_REQUIRE_AUTHENTICATION;
private Properties sslProperties = new Properties();
public boolean isSSLEnabled() {
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/AgentConfigImpl.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/AgentConfigImpl.java b/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/AgentConfigImpl.java
index 9f6a070..6aa8944 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/AgentConfigImpl.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/AgentConfigImpl.java
@@ -239,13 +239,13 @@ public class AgentConfigImpl extends DistributedSystemConfigImpl implements Agen
props.setProperty(STATE_SAVE_FILE_NAME, String.valueOf(DEFAULT_STATE_SAVE_FILE));
- props.setProperty(CLUSTER_SSL_ENABLED, String.valueOf(DEFAULT_CLUSTER_SSL_ENABLED));
+ props.setProperty(CLUSTER_SSL_ENABLED, String.valueOf(DEFAULT_SSL_ENABLED));
- props.setProperty(CLUSTER_SSL_PROTOCOLS, String.valueOf(DEFAULT_CLUSTER_SSL_PROTOCOLS));
+ props.setProperty(CLUSTER_SSL_PROTOCOLS, String.valueOf(DEFAULT_SSL_PROTOCOLS));
- props.setProperty(CLUSTER_SSL_CIPHERS, String.valueOf(DEFAULT_CLUSTER_SSL_CIPHERS));
+ props.setProperty(CLUSTER_SSL_CIPHERS, String.valueOf(DEFAULT_SSL_CIPHERS));
- props.setProperty(CLUSTER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(DEFAULT_CLUSTER_SSL_REQUIRE_AUTHENTICATION));
+ props.setProperty(CLUSTER_SSL_REQUIRE_AUTHENTICATION, String.valueOf(DEFAULT_SSL_REQUIRE_AUTHENTICATION));
props.setProperty(ENTITY_CONFIG_XML_FILE_NAME, String.valueOf(DEFAULT_ENTITY_CONFIG_XML_FILE));
@@ -935,10 +935,10 @@ public class AgentConfigImpl extends DistributedSystemConfigImpl implements Agen
this.httpAuthUser = validateNonEmptyString(props.getProperty(HTTP_AUTHENTICATION_USER_NAME), DEFAULT_HTTP_AUTHENTICATION_USER);
this.httpAuthPassword = validateNonEmptyString(props.getProperty(HTTP_AUTHENTICATION_PASSWORD_NAME), DEFAULT_HTTP_AUTHENTICATION_PASSWORD);
- this.sslEnabled = validateBoolean(props.getProperty(CLUSTER_SSL_ENABLED), DEFAULT_CLUSTER_SSL_ENABLED);
- this.sslProtocols = validateNonEmptyString(props.getProperty(CLUSTER_SSL_PROTOCOLS), DEFAULT_CLUSTER_SSL_PROTOCOLS);
- this.sslCiphers = validateNonEmptyString(props.getProperty(CLUSTER_SSL_CIPHERS), DEFAULT_CLUSTER_SSL_CIPHERS);
- this.sslAuthenticationRequired = validateBoolean(props.getProperty(CLUSTER_SSL_REQUIRE_AUTHENTICATION), DEFAULT_CLUSTER_SSL_REQUIRE_AUTHENTICATION);
+ this.sslEnabled = validateBoolean(props.getProperty(CLUSTER_SSL_ENABLED), DEFAULT_SSL_ENABLED);
+ this.sslProtocols = validateNonEmptyString(props.getProperty(CLUSTER_SSL_PROTOCOLS), DEFAULT_SSL_PROTOCOLS);
+ this.sslCiphers = validateNonEmptyString(props.getProperty(CLUSTER_SSL_CIPHERS), DEFAULT_SSL_CIPHERS);
+ this.sslAuthenticationRequired = validateBoolean(props.getProperty(CLUSTER_SSL_REQUIRE_AUTHENTICATION), DEFAULT_SSL_REQUIRE_AUTHENTICATION);
this.sslProperties = new Properties();
for (int i = 0; true; i++) {
String key = "ssl-property-" + i;
@@ -1675,10 +1675,10 @@ public class AgentConfigImpl extends DistributedSystemConfigImpl implements Agen
// -------------------------------------------------------------------------
// SSL support...
// -------------------------------------------------------------------------
- private boolean sslEnabled = DEFAULT_CLUSTER_SSL_ENABLED;
- private String sslProtocols = DEFAULT_CLUSTER_SSL_PROTOCOLS;
- private String sslCiphers = DEFAULT_CLUSTER_SSL_CIPHERS;
- private boolean sslAuthenticationRequired = DEFAULT_CLUSTER_SSL_REQUIRE_AUTHENTICATION;
+ private boolean sslEnabled = DEFAULT_SSL_ENABLED;
+ private String sslProtocols = DEFAULT_SSL_PROTOCOLS;
+ private String sslCiphers = DEFAULT_SSL_CIPHERS;
+ private boolean sslAuthenticationRequired = DEFAULT_SSL_REQUIRE_AUTHENTICATION;
private Properties sslProperties = new Properties();
@Override
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JServerSocketFactory.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JServerSocketFactory.java b/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JServerSocketFactory.java
index de61095..bf6ff5e 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JServerSocketFactory.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/admin/jmx/internal/MX4JServerSocketFactory.java
@@ -80,10 +80,10 @@ implements mx4j.tools.adaptor.AdaptorServerSocketFactory,
String ciphers,
Properties gfsecurityProps) {
if (protocols == null || protocols.length() == 0) {
- protocols = DistributionConfig.DEFAULT_CLUSTER_SSL_PROTOCOLS;
+ protocols = DistributionConfig.DEFAULT_SSL_PROTOCOLS;
}
if (ciphers == null || ciphers.length() == 0) {
- ciphers = DistributionConfig.DEFAULT_CLUSTER_SSL_CIPHERS;
+ ciphers = DistributionConfig.DEFAULT_SSL_CIPHERS;
}
this.socketCreator = SocketCreatorFactory.createNonDefaultInstance(
useSSL, needClientAuth, protocols, ciphers, gfsecurityProps);
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/cache/client/internal/ConnectionFactoryImpl.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/cache/client/internal/ConnectionFactoryImpl.java b/geode-core/src/main/java/com/gemstone/gemfire/cache/client/internal/ConnectionFactoryImpl.java
index 276b767..c8c6d10 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/cache/client/internal/ConnectionFactoryImpl.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/cache/client/internal/ConnectionFactoryImpl.java
@@ -25,6 +25,7 @@ import com.gemstone.gemfire.cache.wan.GatewaySender;
import com.gemstone.gemfire.distributed.internal.DistributionConfig;
import com.gemstone.gemfire.distributed.internal.InternalDistributedSystem;
import com.gemstone.gemfire.distributed.internal.ServerLocation;
+import com.gemstone.gemfire.internal.net.SSLEnabledComponent;
import com.gemstone.gemfire.internal.net.SocketCreator;
import com.gemstone.gemfire.internal.cache.tier.Acceptor;
import com.gemstone.gemfire.internal.cache.tier.sockets.CacheClientUpdater;
@@ -96,13 +97,13 @@ public class ConnectionFactoryImpl implements ConnectionFactory {
this.cancelCriterion = cancelCriterion;
this.pool = pool;
if (this.usedByGateway || (this.gatewaySender != null)) {
- this.socketCreator = SocketCreatorFactory.getGatewaySSLSocketCreator();
+ this.socketCreator = SocketCreatorFactory.getSSLSocketCreatorForComponent(SSLEnabledComponent.GATEWAY);
if (sender!= null && !sender.getGatewayTransportFilters().isEmpty()) {
this.socketCreator.initializeTransportFilterClientSocketFactory(sender);
}
} else {
//If configured use SSL properties for cache-server
- this.socketCreator = SocketCreatorFactory.getServerSSLSocketCreator();
+ this.socketCreator = SocketCreatorFactory.getSSLSocketCreatorForComponent(SSLEnabledComponent.SERVER);
}
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
index ddec998..2b024d4 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/ConfigurationProperties.java
@@ -187,6 +187,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: "any" </p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_CIPHERS}
*/
String CLUSTER_SSL_CIPHERS = "cluster-ssl-ciphers";
/**
@@ -197,6 +198,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: "false"</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 see {@link #SSL_ENABLED_COMPONENTS}
*/
String CLUSTER_SSL_ENABLED = "cluster-ssl-enabled";
/**
@@ -206,6 +208,7 @@ public interface ConfigurationProperties {
* certificate and private key.</p>
* <U>Default</U>: ""</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_KEYSTORE}
*/
String CLUSTER_SSL_KEYSTORE = "cluster-ssl-keystore";
/**
@@ -216,6 +219,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: ""</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_KEYSTORE_PASSWORD}
*/
String CLUSTER_SSL_KEYSTORE_PASSWORD = "cluster-ssl-keystore-password";
/**
@@ -226,6 +230,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: ""</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_KEYSTORE_TYPE}
*/
String CLUSTER_SSL_KEYSTORE_TYPE = "cluster-ssl-keystore-type";
/**
@@ -236,6 +241,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: "any"</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_PROTOCOLS}
*/
String CLUSTER_SSL_PROTOCOLS = "cluster-ssl-protocols";
/**
@@ -246,6 +252,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: "true"</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_REQUIRE_AUTHENTICATION}
*/
String CLUSTER_SSL_REQUIRE_AUTHENTICATION = "cluster-ssl-require-authentication";
/**
@@ -256,6 +263,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: ""</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_TRUSTSTORE}
*/
String CLUSTER_SSL_TRUSTSTORE = "cluster-ssl-truststore";
/**
@@ -266,6 +274,7 @@ public interface ConfigurationProperties {
* </p>
* <U>Default</U>: ""</p>
* <U>Since</U>: GemFire 8.0
+ * @deprecated Since Geode 1.0 use {@link #SSL_TRUSTSTORE_PASSWORD}
*/
String CLUSTER_SSL_TRUSTSTORE_PASSWORD = "cluster-ssl-truststore-password";
/**
@@ -1657,8 +1666,87 @@ public interface ConfigurationProperties {
* <a name="ssl-enabled-components"/a></p>
* <U>Description</U>: This setting is a comma delimited fields which works in conjunction with the {@link #CLUSTER_SSL_PREFIX} properties.
* This property will determine which components will use SSL for their communications.</p>
- * <U>Options</U>: "all","server","cluster","gateway","http","jmx" -- As described {@link SSLEnabledComponents}
+ * <U>Options</U>: "all","server","cluster","gateway","http","jmx","none" -- As described {@link SSLEnabledComponents}
* <U>Since</U>: Geode 1.0
*/
String SSL_ENABLED_COMPONENTS = "ssl-enabled-components";
+ /**
+ * The static String definition of the <i>"ssl-ciphers"</i> property
+ * <a name="ssl-ciphers"/a></p>
+ * <U>Description</U>: A space separated list of the SSL cipher suites to
+ * enable. Those listed must be supported by the available providers.
+ * </p>
+ * <U>Default</U>: "any" </p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_CIPHERS = "ssl-ciphers";
+ /**
+ * The static String definition of the <i>"ssl-keystore"</i> property
+ * <a name="ssl-keystore"/a></p>
+ * <U>Description</U>Location of the Java keystore file containing
+ * certificate and private key.</p>
+ * <U>Default</U>: ""</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_KEYSTORE = "ssl-keystore";
+ /**
+ * The static String definition of the <i>"ssl-keystore-password"</i> property
+ * <a name="ssl-keystore-password"/a></p>
+ * <U>Description</U>Password to access the private key from the keystore
+ * file specified by javax.net.ssl.keyStore.
+ * </p>
+ * <U>Default</U>: ""</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_KEYSTORE_PASSWORD = "ssl-keystore-password";
+ /**
+ * The static String definition of the <i>"ssl-keystore-type"</i> property
+ * <a name="ssl-keystore-type"/a></p>
+ * <U>Description</U>For Java keystore file format, this property has the
+ * value jks (or JKS).
+ * </p>
+ * <U>Default</U>: ""</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_KEYSTORE_TYPE = "ssl-keystore-type";
+ /**
+ * The static String definition of the <i>"cluster-ssl-protocols"</i> property
+ * <a name="ssl-protocols"/a></p>
+ * <U>Description</U>: A space separated list of the SSL protocols to
+ * enable. Those listed must be supported by the available providers.
+ * </p>
+ * <U>Default</U>: "any"</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_PROTOCOLS = "ssl-protocols";
+ /**
+ * The static String definition of the <i>"ssl-require-authentication"</i> property
+ * <a name="ssl-require-authentication"/a></p>
+ * <U>Description</U>: If false, allow ciphers that do not require the
+ * client side of the connection to be authenticated.
+ * </p>
+ * <U>Default</U>: "true"</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_REQUIRE_AUTHENTICATION = "ssl-require-authentication";
+ /**
+ * The static String definition of the <i>"ssl-truststore"</i> property
+ * <a name="ssl-truststore"/a></p>
+ * <U>Description</U>Location of the Java keystore file containing the
+ * collection of CA certificates trusted by distributed member (trust store).
+ * </p>
+ * <U>Default</U>: ""</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_TRUSTSTORE = "ssl-truststore";
+ /**
+ * The static String definition of the <i>"ssl-truststore-password"</i> property
+ * <a name="ssl-truststore-password"/a></p>
+ * <U>Description</U>Password to unlock the keystore file (store password)
+ * specified by javax.net.ssl.trustStore.
+ * </p>
+ * <U>Default</U>: ""</p>
+ * <U>Since</U>: Geode 1.0
+ */
+ String SSL_TRUSTSTORE_PASSWORD = "ssl-truststore-password";
}
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
index 51cc99a..c4310bd 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/SSLEnabledComponents.java
@@ -23,6 +23,12 @@ package com.gemstone.gemfire.distributed;
public interface SSLEnabledComponents {
/**
+ * This determines that none of the components will use the SSL for their communications.
+ * <U>Since</U>: Geode 1.0
+ */
+ String NONE = "none";
+
+ /**
* This determines that all components will use the SSL for their communications.
* <U>Since</U>: Geode 1.0
*/
http://git-wip-us.apache.org/repos/asf/incubator-geode/blob/f7424db6/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
----------------------------------------------------------------------
diff --git a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
index 458b1ad..33b0124 100644
--- a/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
+++ b/geode-core/src/main/java/com/gemstone/gemfire/distributed/internal/AbstractDistributionConfig.java
@@ -35,13 +35,13 @@ import org.apache.commons.lang.StringUtils;
import com.gemstone.gemfire.InternalGemFireException;
import com.gemstone.gemfire.InvalidValueException;
import com.gemstone.gemfire.UnmodifiableException;
-import com.gemstone.gemfire.distributed.SSLEnabledComponents;
import com.gemstone.gemfire.internal.AbstractConfig;
import com.gemstone.gemfire.internal.ConfigSource;
-import com.gemstone.gemfire.internal.net.SocketCreator;
import com.gemstone.gemfire.internal.admin.remote.DistributionLocatorId;
import com.gemstone.gemfire.internal.i18n.LocalizedStrings;
import com.gemstone.gemfire.internal.logging.LogWriterImpl;
+import com.gemstone.gemfire.internal.net.SSLEnabledComponent;
+import com.gemstone.gemfire.internal.net.SocketCreator;
import com.gemstone.gemfire.memcached.GemFireMemcachedServer;
/**
@@ -148,8 +148,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
@ConfigAttributeChecker(name = BIND_ADDRESS)
protected String checkBindAddress(String value) {
- if (value != null && value.length() > 0 &&
- !SocketCreator.isLocalHost(value)) {
+ if (value != null && value.length() > 0 && !SocketCreator.isLocalHost(value)) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_BIND_ADDRESS_0_INVALID_MUST_BE_IN_1.toLocalizedString(new Object[] {
value, SocketCreator.getMyAddresses()
}));
@@ -159,8 +158,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
@ConfigAttributeChecker(name = SERVER_BIND_ADDRESS)
protected String checkServerBindAddress(String value) {
- if (value != null && value.length() > 0 &&
- !SocketCreator.isLocalHost(value)) {
+ if (value != null && value.length() > 0 && !SocketCreator.isLocalHost(value)) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_BIND_ADDRESS_0_INVALID_MUST_BE_IN_1.toLocalizedString(new Object[] {
value, SocketCreator.getMyAddresses()
}));
@@ -180,8 +178,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
@ConfigAttributeChecker(name = HTTP_SERVICE_BIND_ADDRESS)
protected String checkHttpServiceBindAddress(String value) {
- if (value != null && value.length() > 0 &&
- !SocketCreator.isLocalHost(value)) {
+ if (value != null && value.length() > 0 && !SocketCreator.isLocalHost(value)) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_BIND_ADDRESS_0_INVALID_MUST_BE_IN_1.toLocalizedString(new Object[] {
value, SocketCreator.getMyAddresses()
}));
@@ -305,11 +302,11 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
int portVal = 0;
try {
portVal = Integer.parseInt(port);
- if(0 == portVal){
+ if (0 == portVal) {
return "";
- }
- else if (portVal < 1 || portVal > 65535) {
- throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_INVALID_LOCATOR_0_THE_PORT_1_WAS_NOT_GREATER_THAN_ZERO_AND_LESS_THAN_65536.toLocalizedString(new Object[] {value, Integer.valueOf(portVal)}));
+ } else if (portVal < 1 || portVal > 65535) {
+ throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_INVALID_LOCATOR_0_THE_PORT_1_WAS_NOT_GREATER_THAN_ZERO_AND_LESS_THAN_65536
+ .toLocalizedString(new Object[] { value, Integer.valueOf(portVal) }));
}
} catch (NumberFormatException ex) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_INVALID_LOCATOR_0.toLocalizedString(value));
@@ -386,9 +383,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
*/
@ConfigAttributeChecker(name = CLIENT_CONFLATION_PROP_NAME)
protected String checkClientConflation(String value) {
- if (!(value.equals(CLIENT_CONFLATION_PROP_VALUE_DEFAULT) ||
- value.equals(CLIENT_CONFLATION_PROP_VALUE_ON) ||
- value.equals(CLIENT_CONFLATION_PROP_VALUE_OFF))) {
+ if (!(value.equals(CLIENT_CONFLATION_PROP_VALUE_DEFAULT) || value.equals(CLIENT_CONFLATION_PROP_VALUE_ON) || value.equals(CLIENT_CONFLATION_PROP_VALUE_OFF))) {
throw new IllegalArgumentException("Could not set \"" + CONFLATE_EVENTS + "\" to \"" + value + "\" because its value is not recognized");
}
return value;
@@ -450,8 +445,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
@ConfigAttributeChecker(name = MEMCACHED_BIND_ADDRESS)
protected String checkMemcachedBindAddress(String value) {
- if (value != null && value.length() > 0 &&
- !SocketCreator.isLocalHost(value)) {
+ if (value != null && value.length() > 0 && !SocketCreator.isLocalHost(value)) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_MEMCACHED_BIND_ADDRESS_0_INVALID_MUST_BE_IN_1.toLocalizedString(new Object[] {
value, SocketCreator.getMyAddresses()
}));
@@ -461,8 +455,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
@ConfigAttributeChecker(name = REDIS_BIND_ADDRESS)
protected String checkRedisBindAddress(String value) {
- if (value != null && value.length() > 0 &&
- !SocketCreator.isLocalHost(value)) {
+ if (value != null && value.length() > 0 && !SocketCreator.isLocalHost(value)) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_REDIS_BIND_ADDRESS_0_INVALID_MUST_BE_IN_1.toLocalizedString(new Object[] {
value, SocketCreator.getMyAddresses()
}));
@@ -475,33 +468,33 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
* This would mean one is mixing the "old" with the "new"
*/
@ConfigAttributeChecker(name = SSL_ENABLED_COMPONENTS)
- protected String[] checkLegacySSLWhenSSLEnabledComponentsSet(String[] value) {
- if (value != null && value.length > 0) {
- for (String component : value) {
- switch (component) {
- case SSLEnabledComponents.ALL:
- case SSLEnabledComponents.CLUSTER:
- case SSLEnabledComponents.SERVER:
- case SSLEnabledComponents.GATEWAY:
- case SSLEnabledComponents.JMX:
- case SSLEnabledComponents.HTTP_SERVICE:
- case SSLEnabledComponents.LOCATOR:
- continue;
- default:
- throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_0_INVALID_TRY_1.toLocalizedString(new Object[] {
- value, StringUtils.join(new String[] {
- SSLEnabledComponents.ALL,
- SSLEnabledComponents.CLUSTER,
- SSLEnabledComponents.SERVER,
- SSLEnabledComponents.GATEWAY,
- SSLEnabledComponents.JMX,
- SSLEnabledComponents.HTTP_SERVICE,
- SSLEnabledComponents.LOCATOR
- }, ",")
- }));
- }
+ protected SSLEnabledComponent[] checkLegacySSLWhenSSLEnabledComponentsSet(SSLEnabledComponent[] value) {
+ for (SSLEnabledComponent component : value) {
+ switch (component) {
+ case ALL:
+ case CLUSTER:
+ case SERVER:
+ case GATEWAY:
+ case JMX:
+ case HTTP_SERVICE:
+ case LOCATOR:
+ continue;
+ default:
+ throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_0_INVALID_TRY_1.toLocalizedString(new Object[] {
+ value, StringUtils.join(new String[] {
+ SSLEnabledComponent.ALL.getConstant(),
+ SSLEnabledComponent.CLUSTER.getConstant(),
+ SSLEnabledComponent.SERVER.getConstant(),
+ SSLEnabledComponent.GATEWAY.getConstant(),
+ SSLEnabledComponent.JMX.getConstant(),
+ SSLEnabledComponent.HTTP_SERVICE.getConstant(),
+ SSLEnabledComponent.LOCATOR.getConstant()
+ }, ",")
+ }));
}
- if (getJmxManagerSSLEnabled() || getHttpServiceSSLEnabled() || getServerSSLEnabled() || getGatewaySSLEnabled()) {
+ }
+ for (SSLEnabledComponent component : value) {
+ if (getClusterSSLEnabled() || getJmxManagerSSLEnabled() || getHttpServiceSSLEnabled() || getServerSSLEnabled() || getGatewaySSLEnabled()) {
throw new IllegalArgumentException(LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_COMPONENTS_SET_INVALID_DEPRECATED_SSL_SET.toLocalizedString());
}
}
@@ -557,9 +550,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
if (setter == null) {
// if we cann't find the defined setter, but the attributeName starts with these special characters
// since we already set it in the respecitive properties above, we need to set the source then return
- if (attName.startsWith(SECURITY_PREFIX) ||
- attName.startsWith(SSL_SYSTEM_PROPS_NAME) ||
- attName.startsWith(SYS_PROP_NAME)) {
+ if (attName.startsWith(SECURITY_PREFIX) || attName.startsWith(SSL_SYSTEM_PROPS_NAME) || attName.startsWith(SYS_PROP_NAME)) {
getAttSourceMap().put(attName, source);
return;
}
@@ -572,7 +563,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
}
- checkAttribute(attName,attValue);
+ checkAttribute(attName, attValue);
try {
setter.invoke(this, attValue);
} catch (Exception e) {
@@ -769,9 +760,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
m.put(SERVER_BIND_ADDRESS, LocalizedStrings.AbstractDistributionConfig_SERVER_BIND_ADDRESS_NAME_0.toLocalizedString(DEFAULT_BIND_ADDRESS));
- m.put(NAME, "A name that uniquely identifies a member in its distributed system." +
- " Multiple members in the same distributed system can not have the same name." +
- " Defaults to \"\".");
+ m.put(NAME, "A name that uniquely identifies a member in its distributed system." + " Multiple members in the same distributed system can not have the same name." + " Defaults to \"\".");
m.put(STATISTIC_ARCHIVE_FILE, LocalizedStrings.AbstractDistributionConfig_STATISTIC_ARCHIVE_FILE_NAME_0.toLocalizedString(DEFAULT_STATISTIC_ARCHIVE_FILE));
@@ -783,13 +772,13 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
m.put(CLUSTER_SSL_ALIAS, LocalizedStrings.AbstractDistributionConfig_CLUSTER_SSL_ALIAS_0.toLocalizedString(Boolean.valueOf(DEFAULT_CLUSTER_SSL_ALIAS)));
- m.put(CLUSTER_SSL_ENABLED, LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_NAME_0.toLocalizedString(Boolean.valueOf(DEFAULT_CLUSTER_SSL_ENABLED)));
+ m.put(CLUSTER_SSL_ENABLED, LocalizedStrings.AbstractDistributionConfig_SSL_ENABLED_NAME_0.toLocalizedString(Boolean.valueOf(DEFAULT_SSL_ENABLED)));
- m.put(CLUSTER_SSL_PROTOCOLS, LocalizedStrings.AbstractDistributionConfig_SSL_PROTOCOLS_NAME_0.toLocalizedString(DEFAULT_CLUSTER_SSL_PROTOCOLS));
+ m.put(CLUSTER_SSL_PROTOCOLS, LocalizedStrings.AbstractDistributionConfig_SSL_PROTOCOLS_NAME_0.toLocalizedString(DEFAULT_SSL_PROTOCOLS));
- m.put(CLUSTER_SSL_CIPHERS, LocalizedStrings.AbstractDistributionConfig_SSL_CIPHERS_NAME_0.toLocalizedString(DEFAULT_CLUSTER_SSL_CIPHERS));
+ m.put(CLUSTER_SSL_CIPHERS, LocalizedStrings.AbstractDistributionConfig_SSL_CIPHERS_NAME_0.toLocalizedString(DEFAULT_SSL_CIPHERS));
- m.put(CLUSTER_SSL_REQUIRE_AUTHENTICATION, LocalizedStrings.AbstractDistributionConfig_SSL_REQUIRE_AUTHENTICATION_NAME.toLocalizedString(Boolean.valueOf(DEFAULT_CLUSTER_SSL_REQUIRE_AUTHENTICATION)));
+ m.put(CLUSTER_SSL_REQUIRE_AUTHENTICATION, LocalizedStrings.AbstractDistributionConfig_SSL_REQUIRE_AUTHENTICATION_NAME.toLocalizedString(Boolean.valueOf(DEFAULT_SSL_REQUIRE_AUTHENTICATION)));
m.put(CLUSTER_SSL_KEYSTORE, "Location of the Java keystore file containing an distributed member's own certificate and private key.");
@@ -862,9 +851,7 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
m.put(REMOTE_LOCATORS, LocalizedStrings.AbstractDistributionConfig_REMOTE_DISTRIBUTED_SYSTEMS_NAME_0.toLocalizedString(DEFAULT_REMOTE_LOCATORS));
- m.put(DISTRIBUTED_SYSTEM_ID, "An id that uniquely idenitifies this distributed system. " +
- "Required when using portable data exchange objects and the WAN." +
- "Must be the same on each member in this distributed system if set.");
+ m.put(DISTRIBUTED_SYSTEM_ID, "An id that uniquely idenitifies this distributed system. " + "Required when using portable data exchange objects and the WAN." + "Must be the same on each member in this distributed system if set.");
m.put(ENFORCE_UNIQUE_HOST, "Whether to require partitioned regions to put " + "redundant copies of data on different physical machines");
m.put(REDUNDANCY_ZONE, "The zone that this member is in. When this is set, " + "partitioned regions will not put two copies of the same data in the same zone.");
@@ -966,6 +953,15 @@ public abstract class AbstractDistributionConfig extends AbstractConfig implemen
m.put(SSL_ENABLED_COMPONENTS, "A comma delimited list of components that require SSL communications");
+ m.put(SSL_CIPHERS, "List of available SSL cipher suites that are to be enabled. Defaults to \"" + DEFAULT_SSL_CIPHERS + "\" meaning your provider''s defaults.");
+ m.put(SSL_PROTOCOLS, "List of available SSL protocols that are to be enabled. Defaults to \"" + DEFAULT_SSL_PROTOCOLS + "\" meaning defaults of your provider.");
+ m.put(SSL_REQUIRE_AUTHENTICATION, "If set to false, ciphers and protocols that permit anonymous clients are allowed. Defaults to \"" + DEFAULT_SSL_REQUIRE_AUTHENTICATION + "\".");
+ m.put(SSL_KEYSTORE, "Location of the Java keystore file containing the certificate and private key.");
+ m.put(SSL_KEYSTORE_TYPE, "For Java keystore file format, this property has the value jks (or JKS).");
+ m.put(SSL_KEYSTORE_PASSWORD, "Password to access the private key from the keystore.");
+ m.put(SSL_TRUSTSTORE, "Location of the Java keystore file containing the collection of trusted certificates.");
+ m.put(SSL_TRUSTSTORE_PASSWORD, "Password to unlock the truststore.");
+
dcAttDescriptions = Collections.unmodifiableMap(m);
}