You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by bs...@apache.org on 2020/05/26 19:02:21 UTC
[geode] 01/01: Revert "GEODE-8144: endpoint identification in
servers is not working (#5131)"
This is an automated email from the ASF dual-hosted git repository.
bschuchardt pushed a commit to branch feature/revert-geode-8144
in repository https://gitbox.apache.org/repos/asf/geode.git
commit 6f2ec27e7e6c4e30e6341f2a300415ba2d4d3ade
Author: Bruce Schuchardt <bs...@pivotal.io>
AuthorDate: Tue May 26 11:58:49 2020 -0700
Revert "GEODE-8144: endpoint identification in servers is not working (#5131)"
This reverts commit b22df8cf0f11b73237dd88dc1de9217f5f7cc8c3.
The change to InternalLocator to use a canonical hostname caused a
gfsh-windows test to fail. I'm reverting this commit while I look into
the problem.
---
.../client/sni/DualServerSNIAcceptanceTest.java | 3 +-
.../org/apache/geode/client/sni/docker-compose.yml | 1 -
.../client/sni/geode-config/gemfire.properties | 1 -
.../client/sni/geode-config/gfsecurity.properties | 2 +-
.../sni/geode-config/locator-maeve-keystore.jks | Bin 3525 -> 2048 bytes
.../geode-config/server-clementine-keystore.jks | Bin 3537 -> 2059 bytes
.../sni/geode-config/server-dolores-keystore.jks | Bin 3528 -> 2050 bytes
.../geode/client/sni/geode-config/truststore.jks | Bin 1126 -> 8095 bytes
.../geode/client/sni/scripts/geode-starter-2.gfsh | 8 ++---
.../geode/client/sni/scripts/geode-starter.gfsh | 6 ++--
.../RestrictUseOfInetAddressJUnitTest.java | 1 -
.../distributed/internal/InternalLocator.java | 2 +-
.../apache/geode/internal/net/SocketCreator.java | 33 ++++-----------------
13 files changed, 16 insertions(+), 41 deletions(-)
diff --git a/geode-assembly/src/acceptanceTest/java/org/apache/geode/client/sni/DualServerSNIAcceptanceTest.java b/geode-assembly/src/acceptanceTest/java/org/apache/geode/client/sni/DualServerSNIAcceptanceTest.java
index 7b08be2..640d92a 100644
--- a/geode-assembly/src/acceptanceTest/java/org/apache/geode/client/sni/DualServerSNIAcceptanceTest.java
+++ b/geode-assembly/src/acceptanceTest/java/org/apache/geode/client/sni/DualServerSNIAcceptanceTest.java
@@ -26,6 +26,7 @@ import static org.apache.geode.test.util.ResourceUtils.createTempFileFromResourc
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import java.io.IOException;
import java.net.URL;
import java.util.Properties;
@@ -73,7 +74,7 @@ public class DualServerSNIAcceptanceTest {
private ClientCache cache;
@BeforeClass
- public static void beforeClass() throws Exception {
+ public static void beforeClass() throws IOException, InterruptedException {
docker.get().exec(options("-T"), "geode",
arguments("gfsh", "run", "--file=/geode/scripts/geode-starter-2.gfsh"));
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/docker-compose.yml b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/docker-compose.yml
index dd52102..8caa12f 100644
--- a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/docker-compose.yml
+++ b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/docker-compose.yml
@@ -19,7 +19,6 @@ services:
geode:
container_name: 'geode'
image: 'geode:develop'
- hostname: geode
expose:
- '10334'
- '40404'
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gemfire.properties b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gemfire.properties
index 9ae3497..1f13fb0 100644
--- a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gemfire.properties
+++ b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gemfire.properties
@@ -17,4 +17,3 @@
statistic-sampling-enabled=true
statistic-archive-file=statArchive.gfs
-
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gfsecurity.properties b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gfsecurity.properties
index 135f3e3..813d260 100644
--- a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gfsecurity.properties
+++ b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/gfsecurity.properties
@@ -23,5 +23,5 @@ ssl-truststore-password=geode
ssl-require-authentication=false
ssl-web-require-authentication=false
ssl-enabled-components=all
-ssl-endpoint-identification-enabled=true
+ssl-endpoint-identification-enabled=false
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/locator-maeve-keystore.jks b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/locator-maeve-keystore.jks
index 95caaec..a29cf0f 100644
Binary files a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/locator-maeve-keystore.jks and b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/locator-maeve-keystore.jks differ
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-clementine-keystore.jks b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-clementine-keystore.jks
index 6716704..380de6c 100644
Binary files a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-clementine-keystore.jks and b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-clementine-keystore.jks differ
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-dolores-keystore.jks b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-dolores-keystore.jks
index f00aeac..cb2c4c5 100644
Binary files a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-dolores-keystore.jks and b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/server-dolores-keystore.jks differ
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/truststore.jks b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/truststore.jks
index a7563df..ffcdaf3 100644
Binary files a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/truststore.jks and b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/geode-config/truststore.jks differ
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter-2.gfsh b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter-2.gfsh
index d640a77..38600aa 100644
--- a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter-2.gfsh
+++ b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter-2.gfsh
@@ -15,9 +15,9 @@
# limitations under the License.
#
-start locator --name=locator-maeve --connect=false --redirect-output --hostname-for-clients=locator-maeve --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/locator-maeve-keystore.jks
-start server --name=server-dolores --group=group-dolores --hostname-for-clients=server-dolores --locators=geode[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-dolores-keystore.jks
-start server --name=server-clementine --group=group-clementine --hostname-for-clients=server-clementine --server-port=40405 --locators=geode[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-clementine-keystore.jks
-connect --locator=geode[10334] --use-ssl=true --security-properties-file=/geode/config/gfsecurity.properties
+start locator --name=locator-maeve --hostname-for-clients=locator-maeve --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/locator-maeve-keystore.jks
+start server --name=server-dolores --group=group-dolores --hostname-for-clients=server-dolores --locators=localhost[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-dolores-keystore.jks
+start server --name=server-clementine --group=group-clementine --hostname-for-clients=server-clementine --server-port=40405 --locators=localhost[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-clementine-keystore.jks
+connect --locator=localhost[10334] --use-ssl=true --security-properties-file=/geode/config/gfsecurity.properties
create region --name=region-dolores --group=group-dolores --type=REPLICATE
create region --name=region-clementine --group=group-clementine --type=REPLICATE
diff --git a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter.gfsh b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter.gfsh
index bd89a37..9ceecad 100644
--- a/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter.gfsh
+++ b/geode-assembly/src/acceptanceTest/resources/org/apache/geode/client/sni/scripts/geode-starter.gfsh
@@ -15,8 +15,8 @@
# limitations under the License.
#
-start locator --name=locator-maeve --connect=false --hostname-for-clients=locator-maeve --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/locator-maeve-keystore.jks
-start server --name=server-dolores --max-heap=256m --hostname-for-clients=server-dolores --locators=geode[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-dolores-keystore.jks
-connect --locator=geode[10334] --use-ssl=true --security-properties-file=/geode/config/gfsecurity.properties
+start locator --name=locator-maeve --hostname-for-clients=locator-maeve --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/locator-maeve-keystore.jks
+start server --name=server-dolores --max-heap=256m --hostname-for-clients=server-dolores --locators=localhost[10334] --properties-file=/geode/config/gemfire.properties --security-properties-file=/geode/config/gfsecurity.properties --J=-Dgemfire.ssl-keystore=/geode/config/server-dolores-keystore.jks
+connect --locator=localhost[10334] --use-ssl=true --security-properties-file=/geode/config/gfsecurity.properties
create region --name=jellyfish --type=REPLICATE
diff --git a/geode-core/src/integrationTest/java/org/apache/geode/codeAnalysis/RestrictUseOfInetAddressJUnitTest.java b/geode-core/src/integrationTest/java/org/apache/geode/codeAnalysis/RestrictUseOfInetAddressJUnitTest.java
index 2e31cbb..f79d0d2 100644
--- a/geode-core/src/integrationTest/java/org/apache/geode/codeAnalysis/RestrictUseOfInetAddressJUnitTest.java
+++ b/geode-core/src/integrationTest/java/org/apache/geode/codeAnalysis/RestrictUseOfInetAddressJUnitTest.java
@@ -203,7 +203,6 @@ public class RestrictUseOfInetAddressJUnitTest {
// server-side locator parsing
"org/apache/geode/internal/admin/remote/DistributionLocatorId",
// sanctioned comms class used by every communications component
- "org/apache/geode/internal/net/SocketCreator",
"org/apache/geode/internal/net/SCAdvancedSocketCreator",
// new management API
"org/apache/geode/management/internal/JmxManagerLocatorResponse",
diff --git a/geode-core/src/main/java/org/apache/geode/distributed/internal/InternalLocator.java b/geode-core/src/main/java/org/apache/geode/distributed/internal/InternalLocator.java
index 52dad50..288e5d9 100644
--- a/geode-core/src/main/java/org/apache/geode/distributed/internal/InternalLocator.java
+++ b/geode-core/src/main/java/org/apache/geode/distributed/internal/InternalLocator.java
@@ -701,7 +701,7 @@ public class InternalLocator extends Locator implements ConnectListener, LogConf
if (bindAddress != null) {
sb.append(bindAddress.getHostAddress());
} else {
- sb.append(LocalHostUtil.getLocalHost().getCanonicalHostName());
+ sb.append(LocalHostUtil.getLocalHost().getHostAddress());
}
sb.append('[').append(getPort()).append(']');
String thisLocator = sb.toString();
diff --git a/geode-core/src/main/java/org/apache/geode/internal/net/SocketCreator.java b/geode-core/src/main/java/org/apache/geode/internal/net/SocketCreator.java
index 2dedc20..8fb2136 100755
--- a/geode-core/src/main/java/org/apache/geode/internal/net/SocketCreator.java
+++ b/geode-core/src/main/java/org/apache/geode/internal/net/SocketCreator.java
@@ -62,7 +62,6 @@ import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509ExtendedKeyManager;
import org.apache.commons.lang3.StringUtils;
-import org.apache.commons.validator.routines.InetAddressValidator;
import org.apache.logging.log4j.Logger;
import org.apache.geode.GemFireConfigException;
@@ -545,13 +544,7 @@ public class SocketCreator extends TcpSocketCreatorImpl {
* Returns an SSLEngine that can be used to perform TLS handshakes and communication
*/
public SSLEngine createSSLEngine(String hostName, int port) {
- SSLEngine engine = getSslContext().createSSLEngine(hostName, port);
- SSLParameters parameters = engine.getSSLParameters();
- // set server-names so that endpoint identification algorithms can find what's expected
- if (setServerNames(parameters, new HostAndPort(hostName, port))) {
- engine.setSSLParameters(parameters);
- }
- return engine;
+ return getSslContext().createSSLEngine(hostName, port);
}
/**
@@ -716,7 +709,7 @@ public class SocketCreator extends TcpSocketCreatorImpl {
/**
- * When a socket is connected to a server socket, it should be passed to this method for SSL
+ * When a socket is accepted from a server socket, it should be passed to this method for SSL
* configuration.
*/
void configureClientSSLSocket(Socket socket, HostAndPort addr, int timeout) throws IOException {
@@ -777,10 +770,7 @@ public class SocketCreator extends TcpSocketCreatorImpl {
}
}
- /**
- * returns true if the SSLParameters are altered, false if not
- */
- private boolean setServerNames(SSLParameters modifiedParams, HostAndPort addr) {
+ private void setServerNames(SSLParameters modifiedParams, HostAndPort addr) {
List<SNIServerName> oldNames = modifiedParams.getServerNames();
oldNames = oldNames == null ? Collections.emptyList() : oldNames;
final List<SNIServerName> serverNames = new ArrayList<>(oldNames);
@@ -789,24 +779,11 @@ public class SocketCreator extends TcpSocketCreatorImpl {
.mapToInt(SNIServerName::getType)
.anyMatch(type -> type == StandardConstants.SNI_HOST_NAME)) {
// we already have a SNI hostname set. Do nothing.
- return false;
+ return;
}
- String hostName = addr.getHostName();
- if (this.sslConfig.doEndpointIdentification()
- && InetAddressValidator.getInstance().isValid(hostName)) {
- // endpoint validation typically uses a hostname in the sniServer parameter that the handshake
- // will compare against the subject alternative addresses in the server's certificate. Here
- // we attempt to get a hostname instead of the proffered numeric address
- try {
- hostName = InetAddress.getByName(hostName).getCanonicalHostName();
- } catch (UnknownHostException e) {
- // ignore - we'll see what happens with endpoint validation using a numeric address...
- }
- }
- serverNames.add(new SNIHostName(hostName));
+ serverNames.add(new SNIHostName(addr.getHostName()));
modifiedParams.setServerNames(serverNames);
- return true;
}
/**