Examples with SslContext org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext used on opensource projects

Example 36 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class PipelineConfigurator method encryptionConfig.

protected EncryptionConfig encryptionConfig() {
    final EncryptionOptions encryptionOptions = DatabaseDescriptor.getNativeProtocolEncryptionOptions();
    switch(tlsEncryptionPolicy) {
        case UNENCRYPTED:
            // if encryption is not enabled, no further steps are required after the initial setup
            return channel -> {
            };
        case OPTIONAL:
            // If optional, install a handler which detects whether or not the client is sending
            // encrypted bytes. If so, on receipt of the next bytes, replace that handler with
            // an SSL Handler, otherwise just remove it and proceed with an unencrypted channel.
            logger.debug("Enabling optionally encrypted CQL connections between client and server");
            return channel -> {
                SslContext sslContext = SSLFactory.getOrCreateSslContext(encryptionOptions, encryptionOptions.require_client_auth, ISslContextFactory.SocketType.SERVER);
                channel.pipeline().addFirst(SSL_HANDLER, new ByteToMessageDecoder() {

                    @Override
                    protected void decode(ChannelHandlerContext channelHandlerContext, ByteBuf byteBuf, List<Object> list) throws Exception {
                        if (byteBuf.readableBytes() < 5) {
                            // once more bytes a ready.
                            return;
                        }
                        if (SslHandler.isEncrypted(byteBuf)) {
                            // Connection uses SSL/TLS, replace the detection handler with a SslHandler and so use
                            // encryption.
                            SslHandler sslHandler = sslContext.newHandler(channel.alloc());
                            channelHandlerContext.pipeline().replace(SSL_HANDLER, SSL_HANDLER, sslHandler);
                        } else {
                            // Connection use no TLS/SSL encryption, just remove the detection handler and continue without
                            // SslHandler in the pipeline.
                            channelHandlerContext.pipeline().remove(SSL_HANDLER);
                        }
                    }
                });
            };
        case ENCRYPTED:
            logger.debug("Enabling encrypted CQL connections between client and server");
            return channel -> {
                SslContext sslContext = SSLFactory.getOrCreateSslContext(encryptionOptions, encryptionOptions.require_client_auth, ISslContextFactory.SocketType.SERVER);
                channel.pipeline().addFirst(SSL_HANDLER, sslContext.newHandler(channel.alloc()));
            };
        default:
            throw new IllegalStateException("Unrecognized TLS encryption policy: " + this.tlsEncryptionPolicy);
    }
}

Example 37 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class SSLFactoryTest method getSslContext_ParamChanges.

@Test
public void getSslContext_ParamChanges() throws IOException {
    EncryptionOptions options = addKeystoreOptions(encryptionOptions).withEnabled(true).withCipherSuites("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256");
    SslContext ctx1 = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.SERVER);
    Assert.assertTrue(ctx1.isServer());
    Assert.assertEquals(ctx1.cipherSuites(), options.cipher_suites);
    options = options.withCipherSuites("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
    SslContext ctx2 = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
    Assert.assertTrue(ctx2.isClient());
    Assert.assertEquals(ctx2.cipherSuites(), options.cipher_suites);
}

Example 38 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class SSLFactoryTest method testSslContextReload_HappyPath.

@Test
public void testSslContextReload_HappyPath() throws IOException, InterruptedException {
    try {
        ServerEncryptionOptions options = addKeystoreOptions(encryptionOptions).withInternodeEncryption(ServerEncryptionOptions.InternodeEncryption.all);
        SSLFactory.initHotReloading(options, options, true);
        SslContext oldCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        File keystoreFile = new File(options.keystore);
        SSLFactory.checkCertFilesForHotReloading(options, options);
        keystoreFile.trySetLastModified(System.currentTimeMillis() + 15000);
        SSLFactory.checkCertFilesForHotReloading(options, options);
        SslContext newCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        Assert.assertNotSame(oldCtx, newCtx);
    } catch (Exception e) {
        throw e;
    } finally {
        DatabaseDescriptor.loadConfig();
    }
}

Example 39 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class SSLFactoryTest method testSslFactoryHotReload_CorruptOrNonExistentFile_DoesNotClearExistingSslContext.

@Test
public void testSslFactoryHotReload_CorruptOrNonExistentFile_DoesNotClearExistingSslContext() throws IOException {
    try {
        ServerEncryptionOptions options = addKeystoreOptions(encryptionOptions);
        File testKeystoreFile = new File(options.keystore + ".test");
        FileUtils.copyFile(new File(options.keystore).toJavaIOFile(), testKeystoreFile.toJavaIOFile());
        options = options.withKeyStore(testKeystoreFile.path());
        SSLFactory.initHotReloading(options, options, true);
        SslContext oldCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        SSLFactory.checkCertFilesForHotReloading(options, options);
        testKeystoreFile.trySetLastModified(System.currentTimeMillis() + 15000);
        FileUtils.forceDelete(testKeystoreFile.toJavaIOFile());
        SSLFactory.checkCertFilesForHotReloading(options, options);
        SslContext newCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        Assert.assertSame(oldCtx, newCtx);
    } catch (Exception e) {
        throw e;
    } finally {
        DatabaseDescriptor.loadConfig();
        FileUtils.deleteQuietly(new File(encryptionOptions.keystore + ".test").toJavaIOFile());
    }
}

Example 40 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class PEMBasedSslContextFactoryTest method getSslContextOpenSSL.

@Test
public void getSslContextOpenSSL() throws IOException {
    ParameterizedClass sslContextFactory = new ParameterizedClass(PEMBasedSslContextFactory.class.getSimpleName(), new HashMap<>());
    EncryptionOptions options = new EncryptionOptions().withTrustStore("test/conf/cassandra_ssl_test.truststore.pem").withKeyStore("test/conf/cassandra_ssl_test.keystore.pem").withKeyStorePassword("cassandra").withRequireClientAuth(false).withCipherSuites("TLS_RSA_WITH_AES_128_CBC_SHA").withSslContextFactory(sslContextFactory);
    SslContext sslContext = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
    Assert.assertNotNull(sslContext);
    if (OpenSsl.isAvailable())
        Assert.assertTrue(sslContext instanceof OpenSslContext);
    else
        Assert.assertTrue(sslContext instanceof SslContext);
}