You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@asterixdb.apache.org by AsterixDB Code Review <do...@asterix-gerrit.ics.uci.edu> on 2024/10/10 01:25:05 UTC
Change in asterixdb[trinity]: [NO ISSUE][HYR][NET] Extend SSL engine API to indicate client use
From Michael Blow <mb...@apache.org>:
Michael Blow has uploaded this change for review. ( https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/18950 )
Change subject: [NO ISSUE][HYR][NET] Extend SSL engine API to indicate client use
......................................................................
[NO ISSUE][HYR][NET] Extend SSL engine API to indicate client use
Ext-ref: MB-52099
Change-Id: Id46266849ded6d0ea632293e829aed78396e0ea1
---
M hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
M asterixdb/asterix-metadata/src/main/java/org/apache/asterix/metadata/RMIServerFactory.java
M hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/sockets/SslSocketChannelFactory.java
M hyracks-fullstack/hyracks/hyracks-api/src/main/java/org/apache/hyracks/api/network/INetworkSecurityManager.java
4 files changed, 19 insertions(+), 8 deletions(-)
git pull ssh://asterix-gerrit.ics.uci.edu:29418/asterixdb refs/changes/50/18950/1
diff --git a/asterixdb/asterix-metadata/src/main/java/org/apache/asterix/metadata/RMIServerFactory.java b/asterixdb/asterix-metadata/src/main/java/org/apache/asterix/metadata/RMIServerFactory.java
index 6a0edc0..845324a1 100644
--- a/asterixdb/asterix-metadata/src/main/java/org/apache/asterix/metadata/RMIServerFactory.java
+++ b/asterixdb/asterix-metadata/src/main/java/org/apache/asterix/metadata/RMIServerFactory.java
@@ -46,7 +46,7 @@
public ServerSocket createServerSocket(int port) throws IOException {
ServerSocketFactory socketFactory;
if (securityManager.getConfiguration().isSslEnabled()) {
- socketFactory = securityManager.newSSLContext().getServerSocketFactory();
+ socketFactory = securityManager.newSSLContext(false).getServerSocketFactory();
} else {
socketFactory = ServerSocketFactory.getDefault();
}
diff --git a/hyracks-fullstack/hyracks/hyracks-api/src/main/java/org/apache/hyracks/api/network/INetworkSecurityManager.java b/hyracks-fullstack/hyracks/hyracks-api/src/main/java/org/apache/hyracks/api/network/INetworkSecurityManager.java
index eb52436..8462f91 100644
--- a/hyracks-fullstack/hyracks/hyracks-api/src/main/java/org/apache/hyracks/api/network/INetworkSecurityManager.java
+++ b/hyracks-fullstack/hyracks/hyracks-api/src/main/java/org/apache/hyracks/api/network/INetworkSecurityManager.java
@@ -28,14 +28,14 @@
*
* @return a new ssl context
*/
- SSLContext newSSLContext();
+ SSLContext newSSLContext(boolean clientMode);
/**
* Creates a new ssl engine based on the current configuration of this {@link INetworkSecurityManager}
*
* @return a new ssl engine
*/
- SSLEngine newSSLEngine();
+ SSLEngine newSSLEngine(boolean clientMode);
/**
* Sets the configuration to be used for this {@link INetworkSecurityManager}
diff --git a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
index db524ca..ea7257a 100644
--- a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
+++ b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/security/NetworkSecurityManager.java
@@ -45,14 +45,14 @@
}
@Override
- public SSLContext newSSLContext() {
+ public SSLContext newSSLContext(boolean clientMode) {
return newSSLContext(config);
}
@Override
- public SSLEngine newSSLEngine() {
+ public SSLEngine newSSLEngine(boolean clientMode) {
try {
- SSLContext ctx = newSSLContext();
+ SSLContext ctx = newSSLContext(clientMode);
return ctx.createSSLEngine();
} catch (Exception ex) {
throw new IllegalStateException("Failed to create SSLEngine", ex);
diff --git a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/sockets/SslSocketChannelFactory.java b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/sockets/SslSocketChannelFactory.java
index 2a2fb62..0fb40a2 100644
--- a/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/sockets/SslSocketChannelFactory.java
+++ b/hyracks-fullstack/hyracks/hyracks-ipc/src/main/java/org/apache/hyracks/ipc/sockets/SslSocketChannelFactory.java
@@ -36,14 +36,15 @@
@Override
public ISocketChannel createServerChannel(SocketChannel socketChannel) {
- final SSLEngine sslEngine = networkSecurityManager.newSSLEngine();
+ final SSLEngine sslEngine = networkSecurityManager.newSSLEngine(false);
sslEngine.setUseClientMode(false);
+ sslEngine.setNeedClientAuth(false);
return new SslSocketChannel(socketChannel, sslEngine);
}
@Override
public ISocketChannel createClientChannel(SocketChannel socketChannel) {
- final SSLEngine sslEngine = networkSecurityManager.newSSLEngine();
+ final SSLEngine sslEngine = networkSecurityManager.newSSLEngine(true);
sslEngine.setUseClientMode(true);
return new SslSocketChannel(socketChannel, sslEngine);
}
--
To view, visit https://asterix-gerrit.ics.uci.edu/c/asterixdb/+/18950
To unsubscribe, or for help writing mail filters, visit https://asterix-gerrit.ics.uci.edu/settings
Gerrit-Project: asterixdb
Gerrit-Branch: trinity
Gerrit-Change-Id: Id46266849ded6d0ea632293e829aed78396e0ea1
Gerrit-Change-Number: 18950
Gerrit-PatchSet: 1
Gerrit-Owner: Michael Blow <mb...@apache.org>
Gerrit-MessageType: newchange