From 418fb672abdee99f00776b6047ed616ba1aeb28a Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Sun, 11 Feb 2018 11:20:48 +0900 Subject: [PATCH] Use SecurityUtility (part 2) --- .../pulsar/client/impl/ConnectionPool.java | 30 ++++++----------- .../service/ServiceChannelInitializer.java | 27 ++++------------ .../proxy/server/DirectProxyHandler.java | 32 ++++++------------- 3 files changed, 25 insertions(+), 64 deletions(-) diff --git a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ConnectionPool.java b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ConnectionPool.java index f598abe70a5a2..c36fcd979739b 100644 --- a/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ConnectionPool.java +++ b/pulsar-client/src/main/java/org/apache/pulsar/client/impl/ConnectionPool.java @@ -19,7 +19,6 @@ package org.apache.pulsar.client.impl; import java.io.Closeable; -import java.io.File; import java.io.IOException; import java.net.InetAddress; import java.net.InetSocketAddress; @@ -35,6 +34,7 @@ import org.apache.pulsar.client.api.ClientConfiguration; import org.apache.pulsar.client.api.PulsarClientException; import org.apache.pulsar.common.api.ByteBufPair; +import org.apache.pulsar.common.util.SecurityUtility; import org.apache.pulsar.common.util.netty.EventLoopUtil; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -52,8 +52,6 @@ import io.netty.channel.socket.SocketChannel; import io.netty.handler.codec.LengthFieldBasedFrameDecoder; import io.netty.handler.ssl.SslContext; -import io.netty.handler.ssl.SslContextBuilder; -import io.netty.handler.ssl.util.InsecureTrustManagerFactory; import io.netty.resolver.dns.DnsNameResolver; import io.netty.resolver.dns.DnsNameResolverBuilder; import io.netty.util.concurrent.Future; @@ -85,27 +83,17 @@ public ConnectionPool(ClientConfiguration conf, EventLoopGroup eventLoopGroup) { bootstrap.handler(new ChannelInitializer() { public void initChannel(SocketChannel ch) throws Exception { if (conf.isUseTls()) { - SslContextBuilder builder = SslContextBuilder.forClient(); - if (conf.isTlsAllowInsecureConnection()) { - builder.trustManager(InsecureTrustManagerFactory.INSTANCE); - } else { - if (conf.getTlsTrustCertsFilePath().isEmpty()) { - // Use system default - builder.trustManager((File) null); - } else { - File trustCertCollection = new File(conf.getTlsTrustCertsFilePath()); - builder.trustManager(trustCertCollection); - } - } - + SslContext sslCtx; // Set client certificate if available AuthenticationDataProvider authData = conf.getAuthentication().getAuthData(); if (authData.hasDataForTls()) { - builder.keyManager(authData.getTlsPrivateKey(), - (X509Certificate[]) authData.getTlsCertificates()); + sslCtx = SecurityUtility.createNettySslContextForClient(conf.isTlsAllowInsecureConnection(), + conf.getTlsTrustCertsFilePath(), (X509Certificate[]) authData.getTlsCertificates(), + authData.getTlsPrivateKey()); + } else { + sslCtx = SecurityUtility.createNettySslContextForClient(conf.isTlsAllowInsecureConnection(), + conf.getTlsTrustCertsFilePath()); } - - SslContext sslCtx = builder.build(); ch.pipeline().addLast(TLS_HANDLER, sslCtx.newHandler(ch.alloc())); } @@ -195,7 +183,7 @@ private CompletableFuture createConnection(InetSocketAddress logicalA } cnx.setRemoteHostName(physicalAddress.getHostName()); - + cnx.connectionFuture().thenRun(() -> { if (log.isDebugEnabled()) { log.debug("[{}] Connection handshake completed", cnx.channel()); diff --git a/pulsar-discovery-service/src/main/java/org/apache/pulsar/discovery/service/ServiceChannelInitializer.java b/pulsar-discovery-service/src/main/java/org/apache/pulsar/discovery/service/ServiceChannelInitializer.java index d1863182cf3e1..91bb6b232e3b3 100644 --- a/pulsar-discovery-service/src/main/java/org/apache/pulsar/discovery/service/ServiceChannelInitializer.java +++ b/pulsar-discovery-service/src/main/java/org/apache/pulsar/discovery/service/ServiceChannelInitializer.java @@ -18,18 +18,14 @@ */ package org.apache.pulsar.discovery.service; -import java.io.File; - import org.apache.pulsar.common.api.PulsarDecoder; +import org.apache.pulsar.common.util.SecurityUtility; import org.apache.pulsar.discovery.service.server.ServiceConfig; import io.netty.channel.ChannelInitializer; import io.netty.channel.socket.SocketChannel; import io.netty.handler.codec.LengthFieldBasedFrameDecoder; -import io.netty.handler.ssl.ClientAuth; import io.netty.handler.ssl.SslContext; -import io.netty.handler.ssl.SslContextBuilder; -import io.netty.handler.ssl.util.InsecureTrustManagerFactory; /** * Initialize service channel handlers. @@ -42,7 +38,8 @@ public class ServiceChannelInitializer extends ChannelInitializer private DiscoveryService discoveryService; private boolean enableTLS; - public ServiceChannelInitializer(DiscoveryService discoveryService, ServiceConfig serviceConfig, boolean enableTLS) { + public ServiceChannelInitializer(DiscoveryService discoveryService, ServiceConfig serviceConfig, + boolean enableTLS) { super(); this.serviceConfig = serviceConfig; this.discoveryService = discoveryService; @@ -52,21 +49,9 @@ public ServiceChannelInitializer(DiscoveryService discoveryService, ServiceConfi @Override protected void initChannel(SocketChannel ch) throws Exception { if (enableTLS) { - File tlsCert = new File(serviceConfig.getTlsCertificateFilePath()); - File tlsKey = new File(serviceConfig.getTlsKeyFilePath()); - SslContextBuilder builder = SslContextBuilder.forServer(tlsCert, tlsKey); - if (serviceConfig.isTlsAllowInsecureConnection()) { - builder.trustManager(InsecureTrustManagerFactory.INSTANCE); - } else { - if (serviceConfig.getTlsTrustCertsFilePath().isEmpty()) { - // Use system default - builder.trustManager((File) null); - } else { - File trustCertCollection = new File(serviceConfig.getTlsTrustCertsFilePath()); - builder.trustManager(trustCertCollection); - } - } - SslContext sslCtx = builder.clientAuth(ClientAuth.OPTIONAL).build(); + SslContext sslCtx = SecurityUtility.createNettySslContextForServer( + serviceConfig.isTlsAllowInsecureConnection(), serviceConfig.getTlsTrustCertsFilePath(), + serviceConfig.getTlsCertificateFilePath(), serviceConfig.getTlsKeyFilePath()); ch.pipeline().addLast(TLS_HANDLER, sslCtx.newHandler(ch.alloc())); } ch.pipeline().addLast("frameDecoder", new LengthFieldBasedFrameDecoder(PulsarDecoder.MaxFrameSize, 0, 4, 0, 4)); diff --git a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java index 9fc2ff57dea94..56d24cfb9f1ac 100644 --- a/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java +++ b/pulsar-proxy/src/main/java/org/apache/pulsar/proxy/server/DirectProxyHandler.java @@ -19,7 +19,6 @@ package org.apache.pulsar.proxy.server; -import java.io.File; import java.net.URI; import java.net.URISyntaxException; import java.security.cert.X509Certificate; @@ -29,6 +28,7 @@ import org.apache.pulsar.common.api.Commands; import org.apache.pulsar.common.api.PulsarDecoder; import org.apache.pulsar.common.api.proto.PulsarApi.CommandConnected; +import org.apache.pulsar.common.util.SecurityUtility; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -41,10 +41,8 @@ import io.netty.channel.ChannelInitializer; import io.netty.channel.ChannelOption; import io.netty.channel.socket.SocketChannel; -import io.netty.handler.ssl.SslContext; -import io.netty.handler.ssl.SslContextBuilder; -import io.netty.handler.ssl.util.InsecureTrustManagerFactory; import io.netty.handler.codec.LengthFieldBasedFrameDecoder; +import io.netty.handler.ssl.SslContext; import io.netty.util.concurrent.Future; import io.netty.util.concurrent.FutureListener; @@ -68,7 +66,7 @@ public DirectProxyHandler(ProxyService service, ProxyConnection proxyConnection, this.clientAuthMethod = proxyConnection.clientAuthMethod; ProxyConfiguration config = service.getConfiguration(); this.forwardAuthData = service.getConfiguration().forwardAuthorizationCredentials(); - + // Start the connection attempt. Bootstrap b = new Bootstrap(); // Tie the backend connection on the same thread to avoid context switches when passing data between the 2 @@ -79,27 +77,17 @@ public DirectProxyHandler(ProxyService service, ProxyConnection proxyConnection, @Override protected void initChannel(SocketChannel ch) throws Exception { if (config.isTlsEnabledWithBroker()) { - SslContextBuilder builder = SslContextBuilder.forClient(); - if (config.isTlsAllowInsecureConnection()) { - builder.trustManager(InsecureTrustManagerFactory.INSTANCE); - } else { - if (config.getTlsTrustCertsFilePath().isEmpty()) { - // Use system default - builder.trustManager((File) null); - } else { - File trustCertCollection = new File(config.getTlsTrustCertsFilePath()); - builder.trustManager(trustCertCollection); - } - } - + SslContext sslCtx; // Set client certificate if available AuthenticationDataProvider authData = authentication.getAuthData(); if (authData.hasDataForTls()) { - builder.keyManager(authData.getTlsPrivateKey(), - (X509Certificate[]) authData.getTlsCertificates()); + sslCtx = SecurityUtility.createNettySslContextForClient(config.isTlsAllowInsecureConnection(), + config.getTlsTrustCertsFilePath(), (X509Certificate[]) authData.getTlsCertificates(), + authData.getTlsPrivateKey()); + } else { + sslCtx = SecurityUtility.createNettySslContextForClient(config.isTlsAllowInsecureConnection(), + config.getTlsTrustCertsFilePath()); } - - SslContext sslCtx = builder.build(); ch.pipeline().addLast(TLS_HANDLER, sslCtx.newHandler(ch.alloc())); } ch.pipeline().addLast("frameDecoder",