Skip to content

[fix][misc] do not require encryption on system topics #18898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nicoloboschi merged 3 commits into from
Dec 14, 2022
Merged

[fix][misc] do not require encryption on system topics #18898

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5275b52
[fix][misc] do not require encryption on system topics
nicoloboschi Dec 13, 2022
6513872
style and fix return
nicoloboschi Dec 13, 2022
e336ff6
rm unrelated change
nicoloboschi Dec 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,7 @@
import org.apache.pulsar.common.intercept.InterceptException;
import org.apache.pulsar.common.naming.Metadata;
import org.apache.pulsar.common.naming.NamespaceName;
import org.apache.pulsar.common.naming.SystemTopicNames;
import org.apache.pulsar.common.naming.TopicName;
import org.apache.pulsar.common.policies.data.BacklogQuota;
import org.apache.pulsar.common.policies.data.BacklogQuota.BacklogQuotaType;
Expand Down Expand Up @@ -1326,7 +1327,9 @@ protected void handleProducer(final CommandProducer cmdProducer) {

backlogQuotaCheckFuture.thenRun(() -> {
// Check whether the producer will publish encrypted messages or not
if ((topic.isEncryptionRequired() || encryptionRequireOnProducer) && !isEncrypted) {
if ((topic.isEncryptionRequired() || encryptionRequireOnProducer)
&& !isEncrypted
&& !SystemTopicNames.isSystemTopic(topicName)) {
Comment thread
nicoloboschi marked this conversation as resolved.
String msg = String.format("Encryption is required in %s", topicName);
log.warn("[{}] {}", remoteAddress, msg);
if (producerFuture.completeExceptionally(new ServerMetadataException(msg))) {
Expand Down
6 changes: 6 additions & 0 deletions pulsar-broker/src/main/java/org/apache/pulsar/broker/service/persistent/SystemTopic.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,4 +76,10 @@ public boolean isCompactionEnabled() {
// even though is not explicitly set in the policies.
return !NamespaceService.isHeartbeatNamespace(TopicName.get(topic));
}

@Override
public boolean isEncryptionRequired() {
// System topics are only written by the broker that can't know the encryption context.
Comment thread
nicoloboschi marked this conversation as resolved.
return false;
}
}
14 changes: 14 additions & 0 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/admin/TopicPoliciesTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@

import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
import static org.testng.Assert.assertNotEquals;
import static org.testng.Assert.assertNotNull;
import static org.testng.Assert.assertNull;
import static org.testng.Assert.assertTrue;
Expand Down Expand Up @@ -3109,4 +3110,17 @@ public void testGetTopicPoliciesWhenDeleteTopicPolicy() throws Exception {
assertNull(topicPolicies);
}

@Test
public void testProduceChangesWithEncryptionRequired() throws Exception {
final String beforeLac = admin.topics().getInternalStats(topicPolicyEventsTopic).lastConfirmedEntry;
admin.namespaces().setEncryptionRequiredStatus(myNamespace, true);
// just an update to trigger writes on __change_events
admin.topicPolicies().setMaxConsumers(testTopic, 5);
Awaitility.await()
.untilAsserted(() -> {
final PersistentTopicInternalStats newLac = admin.topics().getInternalStats(topicPolicyEventsTopic);
assertNotEquals(newLac, beforeLac);
});
}

}
25 changes: 25 additions & 0 deletions pulsar-broker/src/test/java/org/apache/pulsar/broker/transaction/TransactionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1617,4 +1617,29 @@ public void testGetTxnState() throws Exception {
Transaction abortingTxn = transaction;
Awaitility.await().until(() -> abortingTxn.getState() == Transaction.State.ABORTING);
}


@Test
public void testEncryptionRequired() throws Exception {
final String namespace = "tnx/ns-prechecks";
final String topic = "persistent://" + namespace + "/test_transaction_topic";
admin.namespaces().createNamespace(namespace);
admin.namespaces().setEncryptionRequiredStatus(namespace, true);
admin.topics().createNonPartitionedTopic(topic);

@Cleanup
Producer<byte[]> producer = this.pulsarClient.newProducer()
.topic(topic)
.sendTimeout(5, TimeUnit.SECONDS)
.addEncryptionKey("my-app-key")
.defaultCryptoKeyReader("file:./src/test/resources/certificate/public-key.client-rsa.pem")
.create();

Transaction txn = pulsarClient.newTransaction()
.withTransactionTimeout(5, TimeUnit.SECONDS).build().get();
producer.newMessage(txn)
.value(UUID.randomUUID().toString().getBytes(StandardCharsets.UTF_8))
.send();
txn.commit();
}
}