Examples with SslContext org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext used on opensource projects

Example 61 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project neo4j by neo4j.

the class BoltServer method createExternalProtocolInitializer.

private ProtocolInitializer createExternalProtocolInitializer(BoltProtocolFactory boltProtocolFactory, TransportThrottleGroup throttleGroup, Log log, ByteBufAllocator bufferAllocator) {
    SslContext sslCtx;
    boolean requireEncryption;
    BoltConnector.EncryptionLevel encryptionLevel = config.get(BoltConnector.encryption_level);
    SslPolicyLoader sslPolicyLoader = dependencyResolver.resolveDependency(SslPolicyLoader.class);
    switch(encryptionLevel) {
        case REQUIRED:
            // Encrypted connections are mandatory.
            requireEncryption = true;
            sslCtx = createSslContext(sslPolicyLoader);
            break;
        case OPTIONAL:
            // Encrypted connections are optional.
            requireEncryption = false;
            sslCtx = createSslContext(sslPolicyLoader);
            break;
        case DISABLED:
            // Encryption is turned off.
            requireEncryption = false;
            sslCtx = null;
            break;
        default:
            // In the unlikely event that we happen to fall through to the default option here,
            // there is a mismatch between the BoltConnector.EncryptionLevel enum and the options
            // handled in this switch statement. In this case, we'll log a warning and default to
            // disabling encryption, since this mirrors the functionality introduced in 3.0.
            log.warn("Unhandled encryption level %s - assuming DISABLED.", encryptionLevel.name());
            requireEncryption = false;
            sslCtx = null;
            break;
    }
    SocketAddress listenAddress = config.get(BoltConnector.listen_address).socketAddress();
    Duration channelTimeout = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_timeout);
    long maxMessageSize = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_max_inbound_bytes);
    return new SocketTransport(BoltConnector.NAME, listenAddress, sslCtx, requireEncryption, logService.getInternalLogProvider(), throttleGroup, boltProtocolFactory, connectionTracker, channelTimeout, maxMessageSize, bufferAllocator, boltMemoryPool);
}

Example 62 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project neo4j by neo4j.

the class TransportSelectionHandlerTest method shouldPreventMultipleLevelsOfSslEncryption.

@Test
void shouldPreventMultipleLevelsOfSslEncryption() throws Exception {
    // Given
    ChannelHandlerContext context = channelHandlerContextMockSslAlreadyConfigured();
    AssertableLogProvider logging = new AssertableLogProvider();
    SslContext sslCtx = mock(SslContext.class);
    var memoryTracker = mock(MemoryTracker.class);
    TransportSelectionHandler handler = new TransportSelectionHandler(null, sslCtx, false, false, logging, null, null, memoryTracker);
    // encrypted
    final ByteBuf payload = Unpooled.wrappedBuffer(new byte[] { 22, 3, 1, 0, 5 });
    // When
    handler.decode(context, payload, null);
    // Then
    verify(context).close();
    assertThat(logging).forClass(TransportSelectionHandler.class).forLevel(ERROR).containsMessageWithArguments("Fatal error: multiple levels of SSL encryption detected." + " Terminating connection: %s", context.channel());
}

Example 63 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project flink by apache.

the class SSLUtils method createRestClientSSLEngineFactory.

/**
 * Creates a {@link SSLHandlerFactory} to be used by the REST Clients.
 *
 * @param config The application configuration.
 */
public static SSLHandlerFactory createRestClientSSLEngineFactory(final Configuration config) throws Exception {
    ClientAuth clientAuth = SecurityOptions.isRestSSLAuthenticationEnabled(config) ? ClientAuth.REQUIRE : ClientAuth.NONE;
    SslContext sslContext = createRestNettySSLContext(config, true, clientAuth);
    if (sslContext == null) {
        throw new IllegalConfigurationException("SSL is not enabled for REST endpoints.");
    }
    return new SSLHandlerFactory(sslContext, -1, -1);
}

Example 64 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project flink by apache.

the class SSLUtils method createInternalNettySSLContext.

/**
 * Creates the SSL Context for internal SSL, if internal SSL is configured. For internal SSL,
 * the client and server side configuration are identical, because of mutual authentication.
 */
@Nullable
private static SslContext createInternalNettySSLContext(Configuration config, boolean clientMode, SslProvider provider) throws Exception {
    checkNotNull(config, "config");
    if (!SecurityOptions.isInternalSSLEnabled(config)) {
        return null;
    }
    String[] sslProtocols = getEnabledProtocols(config);
    List<String> ciphers = Arrays.asList(getEnabledCipherSuites(config));
    int sessionCacheSize = config.getInteger(SecurityOptions.SSL_INTERNAL_SESSION_CACHE_SIZE);
    int sessionTimeoutMs = config.getInteger(SecurityOptions.SSL_INTERNAL_SESSION_TIMEOUT);
    KeyManagerFactory kmf = getKeyManagerFactory(config, true, provider);
    TrustManagerFactory tmf = getTrustManagerFactory(config, true);
    ClientAuth clientAuth = ClientAuth.REQUIRE;
    final SslContextBuilder sslContextBuilder;
    if (clientMode) {
        sslContextBuilder = SslContextBuilder.forClient().keyManager(kmf);
    } else {
        sslContextBuilder = SslContextBuilder.forServer(kmf);
    }
    return sslContextBuilder.sslProvider(provider).protocols(sslProtocols).ciphers(ciphers).trustManager(tmf).clientAuth(clientAuth).sessionCacheSize(sessionCacheSize).sessionTimeout(sessionTimeoutMs / 1000).build();
}

Example 65 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project pinpoint by naver.

the class PinpointNettyServerBuilder method useTransportSecurity.

@Override
public PinpointNettyServerBuilder useTransportSecurity(File certChain, File privateKey) {
    checkState(!freezeProtocolNegotiatorFactory, "Cannot change security when using ServerCredentials");
    SslContext sslContext;
    try {
        sslContext = GrpcSslContexts.forServer(certChain, privateKey).build();
    } catch (SSLException e) {
        // This should likely be some other, easier to catch exception.
        throw new RuntimeException(e);
    }
    protocolNegotiatorFactory = ProtocolNegotiators.serverTlsFactory(sslContext);
    return this;
}