You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ji...@apache.org on 2019/03/21 19:56:23 UTC
[geode] branch develop updated: GEODE-6450: can use default SSL
when invoking CMS on server (#3320)
This is an automated email from the ASF dual-hosted git repository.
jinmeiliao pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/geode.git
The following commit(s) were added to refs/heads/develop by this push:
new c97b156 GEODE-6450: can use default SSL when invoking CMS on server (#3320)
c97b156 is described below
commit c97b15641816275af09b14a1f1b12c746f5cdff7
Author: jinmeiliao <ji...@pivotal.io>
AuthorDate: Thu Mar 21 12:56:11 2019 -0700
GEODE-6450: can use default SSL when invoking CMS on server (#3320)
---
.../rest/ClusterManagementServiceOnServerTest.java | 149 +++++++++++++++++++++
.../api/GeodeClusterManagementServiceFactory.java | 6 +-
.../internal/cli/domain/MemberInformation.java | 10 +-
.../functions/GetMemberInformationFunction.java | 2 +-
.../sanctioned-geode-core-serializables.txt | 2 +-
5 files changed, 159 insertions(+), 10 deletions(-)
diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/management/internal/rest/ClusterManagementServiceOnServerTest.java b/geode-assembly/src/distributedTest/java/org/apache/geode/management/internal/rest/ClusterManagementServiceOnServerTest.java
new file mode 100644
index 0000000..95449a4
--- /dev/null
+++ b/geode-assembly/src/distributedTest/java/org/apache/geode/management/internal/rest/ClusterManagementServiceOnServerTest.java
@@ -0,0 +1,149 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.apache.geode.management.internal.rest;
+
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_ENABLED_COMPONENTS;
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_KEYSTORE;
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_KEYSTORE_PASSWORD;
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_TRUSTSTORE;
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_TRUSTSTORE_PASSWORD;
+import static org.apache.geode.distributed.ConfigurationProperties.SSL_USE_DEFAULT_CONTEXT;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.io.File;
+import java.io.Serializable;
+import java.util.Properties;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.springframework.web.client.ResourceAccessException;
+
+import org.apache.geode.cache.configuration.RegionConfig;
+import org.apache.geode.internal.security.SecurableCommunicationChannel;
+import org.apache.geode.management.api.ClusterManagementResult;
+import org.apache.geode.management.api.ClusterManagementService;
+import org.apache.geode.management.client.ClusterManagementServiceProvider;
+import org.apache.geode.test.dunit.rules.ClusterStartupRule;
+import org.apache.geode.test.dunit.rules.MemberVM;
+
+public class ClusterManagementServiceOnServerTest implements Serializable {
+
+ @Rule
+ public ClusterStartupRule cluster = new ClusterStartupRule();
+
+ private File keyFile = new File(ClusterManagementServiceOnServerTest.class.getClassLoader()
+ .getResource("ssl/trusted.keystore").getFile());;
+
+ private MemberVM locator, server;
+ private Properties sslProps;
+ private RegionConfig regionConfig;
+
+ @Before
+ public void before() throws Exception {
+ sslProps = new Properties();
+ sslProps.setProperty(SSL_KEYSTORE, keyFile.getCanonicalPath());
+ sslProps.setProperty(SSL_TRUSTSTORE, keyFile.getCanonicalPath());
+ sslProps.setProperty(SSL_KEYSTORE_PASSWORD, "password");
+ sslProps.setProperty(SSL_TRUSTSTORE_PASSWORD, "password");
+ sslProps.setProperty(SSL_ENABLED_COMPONENTS, SecurableCommunicationChannel.WEB.getConstant());
+
+ regionConfig = new RegionConfig();
+ regionConfig.setName("test");
+ }
+
+ @Test
+ public void serverHasNoSslPropertyAndDoNotUseDefaultSSL() throws Exception {
+ locator = cluster.startLocatorVM(0, l -> l.withHttpService().withProperties(sslProps));
+ int locatorPort = locator.getPort();
+ server = cluster.startServerVM(1, s -> s.withConnectionToLocator(locatorPort));
+
+ server.invoke(() -> {
+ assertThatThrownBy(() -> ClusterManagementServiceProvider.getService())
+ .isInstanceOf(IllegalStateException.class);
+ });
+ }
+
+ @Test
+ public void serverHasNoSslPropertyAndDoUseIncorrectDefaultSSL() throws Exception {
+ locator = cluster.startLocatorVM(0, l -> l.withHttpService().withProperties(sslProps));
+ int locatorPort = locator.getPort();
+ Properties serverProps = new Properties();
+ serverProps.setProperty(SSL_USE_DEFAULT_CONTEXT, "true");
+ server = cluster.startServerVM(1,
+ s -> s.withConnectionToLocator(locatorPort).withProperties(serverProps));
+
+ server.invoke(() -> {
+ ClusterManagementService service = ClusterManagementServiceProvider.getService();
+ assertThat(service).isNotNull();
+ assertThatThrownBy(() -> service.create(regionConfig))
+ .isInstanceOf(ResourceAccessException.class);
+ });
+
+ // the default ssl context is static and will probably pollute future tests
+ server.getVM().bounce();
+ }
+
+ @Test
+ public void serverHasNoSslPropertyAndDoUseCorrectDefaultSSL() throws Exception {
+ locator = cluster.startLocatorVM(0, l -> l.withHttpService().withProperties(sslProps));
+ int locatorPort = locator.getPort();
+ Properties serverProps = new Properties();
+ serverProps.setProperty(SSL_USE_DEFAULT_CONTEXT, "true");
+ server = cluster.startServerVM(1,
+ s -> s.withConnectionToLocator(locatorPort).withProperties(serverProps));
+
+ server.invoke(() -> {
+ System.setProperty("javax.net.ssl.keyStore", keyFile.getCanonicalPath());
+ System.setProperty("javax.net.ssl.keyStorePassword", "password");
+ System.setProperty("javax.net.ssl.keyStoreType", "JKS");
+ System.setProperty("javax.net.ssl.trustStore", keyFile.getCanonicalPath());
+ System.setProperty("javax.net.ssl.trustStorePassword", "password");
+ System.setProperty("javax.net.ssl.trustStoreType", "JKS");
+
+ ClusterManagementService service = ClusterManagementServiceProvider.getService();
+ assertThat(service).isNotNull();
+ ClusterManagementResult clusterManagementResult = service.create(regionConfig);
+ assertThat(clusterManagementResult.isSuccessful()).isTrue();
+ });
+
+ // the default ssl context is static and will probably pollute future tests
+ server.getVM().bounce();
+ }
+
+ @Test
+ public void useDefaultSSLPropertyTakesPrecedence() throws Exception {
+ locator = cluster.startLocatorVM(0, l -> l.withHttpService().withProperties(sslProps));
+ int locatorPort = locator.getPort();
+ Properties serverProps = new Properties(sslProps);
+ serverProps.setProperty(SSL_USE_DEFAULT_CONTEXT, "true");
+ server = cluster.startServerVM(1,
+ s -> s.withConnectionToLocator(locatorPort).withProperties(serverProps));
+
+ server.invoke(() -> {
+ // default SSL context not set here, and ssl config inside sslProps is ignored because
+ // use_default_ssl_context is true
+ ClusterManagementService service = ClusterManagementServiceProvider.getService();
+ assertThat(service).isNotNull();
+ assertThatThrownBy(() -> service.create(regionConfig))
+ .isInstanceOf(ResourceAccessException.class);
+ });
+
+ // the default ssl context is static and will probably pollute future tests
+ server.getVM().bounce();
+ }
+}
diff --git a/geode-core/src/main/java/org/apache/geode/management/internal/api/GeodeClusterManagementServiceFactory.java b/geode-core/src/main/java/org/apache/geode/management/internal/api/GeodeClusterManagementServiceFactory.java
index 69fa458..73a20ec 100644
--- a/geode-core/src/main/java/org/apache/geode/management/internal/api/GeodeClusterManagementServiceFactory.java
+++ b/geode-core/src/main/java/org/apache/geode/management/internal/api/GeodeClusterManagementServiceFactory.java
@@ -90,12 +90,12 @@ public class GeodeClusterManagementServiceFactory
SSLContext sslContext = null;
HostnameVerifier hostnameVerifier = null;
- if (memberInformation.isSsl()) {
+ if (memberInformation.isWebSSL()) {
SSLConfig sslConfig = SSLConfigurationFactory.getSSLConfigForComponent(
((GemFireCacheImpl) cache).getSystem().getConfig(), SecurableCommunicationChannel.WEB);
- if (sslConfig.getTruststore() == null) {
+ if (!sslConfig.useDefaultSSLContext() && sslConfig.getTruststore() == null) {
throw new IllegalStateException(
- "The server needs to have truststore specified in order to use cluster management service.");
+ "The server needs to have ssl-truststore or ssl-use-default-context specified in order to use cluster management service.");
}
sslContext = SSLUtil.createAndConfigureSSLContext(sslConfig, false);
diff --git a/geode-core/src/main/java/org/apache/geode/management/internal/cli/domain/MemberInformation.java b/geode-core/src/main/java/org/apache/geode/management/internal/cli/domain/MemberInformation.java
index 0d7b9ce..42dc2bf 100644
--- a/geode-core/src/main/java/org/apache/geode/management/internal/cli/domain/MemberInformation.java
+++ b/geode-core/src/main/java/org/apache/geode/management/internal/cli/domain/MemberInformation.java
@@ -50,7 +50,7 @@ public class MemberInformation implements Serializable {
private double cpuUsage;
private Set<String> hostedRegions;
private String offHeapMemorySize;
- private boolean ssl;
+ private boolean webSSL;
public String getName() {
return name;
@@ -241,11 +241,11 @@ public class MemberInformation implements Serializable {
this.offHeapMemorySize = v;
}
- public boolean isSsl() {
- return ssl;
+ public boolean isWebSSL() {
+ return webSSL;
}
- public void setSsl(boolean ssl) {
- this.ssl = ssl;
+ public void setWebSSL(boolean webSSL) {
+ this.webSSL = webSSL;
}
}
diff --git a/geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/GetMemberInformationFunction.java b/geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/GetMemberInformationFunction.java
index 0a248a4..bf42b4d 100644
--- a/geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/GetMemberInformationFunction.java
+++ b/geode-core/src/main/java/org/apache/geode/management/internal/cli/functions/GetMemberInformationFunction.java
@@ -92,7 +92,7 @@ public class GetMemberInformationFunction implements InternalFunction {
SSLConfig sslConfig = SSLConfigurationFactory.getSSLConfigForComponent(config,
SecurableCommunicationChannel.WEB);
- memberInfo.setSsl(sslConfig.isEnabled());
+ memberInfo.setWebSSL(sslConfig.isEnabled());
memberInfo.setGroups(config.getGroups());
memberInfo.setLogFilePath(config.getLogFile().getCanonicalPath());
memberInfo.setStatArchiveFilePath(config.getStatisticArchiveFile().getCanonicalPath());
diff --git a/geode-core/src/main/resources/org/apache/geode/internal/sanctioned-geode-core-serializables.txt b/geode-core/src/main/resources/org/apache/geode/internal/sanctioned-geode-core-serializables.txt
index 2c94686..a8a2682 100644
--- a/geode-core/src/main/resources/org/apache/geode/internal/sanctioned-geode-core-serializables.txt
+++ b/geode-core/src/main/resources/org/apache/geode/internal/sanctioned-geode-core-serializables.txt
@@ -524,7 +524,7 @@ org/apache/geode/management/internal/cli/domain/FixedPartitionAttributesInfo,tru
org/apache/geode/management/internal/cli/domain/IndexDetails,true,-2198907141534201288,fromClause:java/lang/String,indexName:java/lang/String,indexStatisticsDetails:org/apache/geode/management/internal/cli/domain/IndexDetails$IndexStatisticsDetails,indexType:org/apache/geode/cache/query/IndexType,indexedExpression:java/lang/String,isValid:boolean,memberId:java/lang/String,memberName:java/lang/String,projectionAttributes:java/lang/String,regionName:java/lang/String,regionPath:java/lang/String
org/apache/geode/management/internal/cli/domain/IndexDetails$IndexStatisticsDetails,false,numberOfKeys:java/lang/Long,numberOfUpdates:java/lang/Long,numberOfValues:java/lang/Long,totalUpdateTime:java/lang/Long,totalUses:java/lang/Long
org/apache/geode/management/internal/cli/domain/MemberConfigurationInfo,false,cacheAttributes:java/util/Map,cacheServerAttributes:java/util/List,gfePropsRuntime:java/util/Map,gfePropsSetFromFile:java/util/Map,gfePropsSetUsingApi:java/util/Map,gfePropsSetWithDefaults:java/util/Map,jvmInputArguments:java/util/List,pdxAttributes:java/util/Map,systemProperties:java/util/Properties
-org/apache/geode/management/internal/cli/domain/MemberInformation,true,1,cacheServerList:java/util/List,cacheXmlFilePath:java/lang/String,clientCount:int,cpuUsage:double,groups:java/lang/String,heapUsage:java/lang/String,host:java/lang/String,hostedRegions:java/util/Set,httpServiceBindAddress:java/lang/String,httpServicePort:int,id:java/lang/String,initHeapSize:java/lang/String,isServer:boolean,locatorPort:int,locators:java/lang/String,logFilePath:java/lang/String,maxHeapSize:java/lang/S [...]
+org/apache/geode/management/internal/cli/domain/MemberInformation,true,1,cacheServerList:java/util/List,cacheXmlFilePath:java/lang/String,clientCount:int,cpuUsage:double,groups:java/lang/String,heapUsage:java/lang/String,host:java/lang/String,hostedRegions:java/util/Set,httpServiceBindAddress:java/lang/String,httpServicePort:int,id:java/lang/String,initHeapSize:java/lang/String,isServer:boolean,locatorPort:int,locators:java/lang/String,logFilePath:java/lang/String,maxHeapSize:java/lang/S [...]
org/apache/geode/management/internal/cli/domain/PartitionAttributesInfo,true,1,colocatedWith:java/lang/String,fpaInfoList:java/util/List,localMaxMemory:int,nonDefaultAttributes:java/util/Map,partitionResolverName:java/lang/String,recoveryDelay:long,redundantCopies:int,startupRecoveryDelay:long,totalNumBuckets:int
org/apache/geode/management/internal/cli/domain/RegionAttributesInfo,true,336184564012988487,asyncEventQueueIDs:java/util/Set,cacheListenerClassNames:java/util/List,cacheLoaderClassName:java/lang/String,cacheWriterClassName:java/lang/String,cloningEnabled:boolean,compressorClassName:java/lang/String,concurrencyChecksEnabled:boolean,concurrencyLevel:int,customExpiryIdleTimeoutClass:java/lang/String,customExpiryTTLClass:java/lang/String,dataPolicy:org/apache/geode/cache/DataPolicy,diskStor [...]
org/apache/geode/management/internal/cli/domain/RegionDescription,true,6461449275798378332,cndEvictionAttributes:java/util/Map,cndPartitionAttributes:java/util/Map,cndRegionAttributes:java/util/Map,dataPolicy:org/apache/geode/cache/DataPolicy,isAccessor:boolean,isLocal:boolean,isPartition:boolean,isPersistent:boolean,isReplicate:boolean,name:java/lang/String,regionDescPerMemberMap:java/util/Map,scope:org/apache/geode/cache/Scope