Examples with SslContext org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext used on opensource projects

Example 41 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project cassandra by apache.

the class SSLFactoryTest method testPEMSslContextReload_HappyPath.

@Test
public void testPEMSslContextReload_HappyPath() throws IOException, InterruptedException {
    try {
        ServerEncryptionOptions options = addPEMKeystoreOptions(encryptionOptions).withInternodeEncryption(ServerEncryptionOptions.InternodeEncryption.all);
        SSLFactory.initHotReloading(options, options, true);
        SslContext oldCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        File keystoreFile = new File(options.keystore);
        SSLFactory.checkCertFilesForHotReloading(options, options);
        keystoreFile.trySetLastModified(System.currentTimeMillis() + 15000);
        SSLFactory.checkCertFilesForHotReloading(options, options);
        SslContext newCtx = SSLFactory.getOrCreateSslContext(options, true, ISslContextFactory.SocketType.CLIENT);
        Assert.assertNotSame(oldCtx, newCtx);
    } catch (Exception e) {
        throw e;
    } finally {
        DatabaseDescriptor.loadConfig();
    }
}

Example 42 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project neo4j by neo4j.

the class BoltServer method createInternalProtocolInitializer.

private ProtocolInitializer createInternalProtocolInitializer(BoltProtocolFactory boltProtocolFactory, TransportThrottleGroup throttleGroup, ByteBufAllocator bufferAllocator) {
    SslContext sslCtx = null;
    SslPolicyLoader sslPolicyLoader = dependencyResolver.resolveDependency(SslPolicyLoader.class);
    boolean requireEncryption = sslPolicyLoader.hasPolicyForSource(CLUSTER);
    if (requireEncryption) {
        try {
            sslCtx = sslPolicyLoader.getPolicy(CLUSTER).nettyServerContext();
        } catch (SSLException e) {
            throw new RuntimeException("Failed to initialize SSL encryption support, which is required to start this connector. " + "Error was: " + e.getMessage(), e);
        }
    }
    SocketAddress internalListenAddress;
    if (config.isExplicitlySet(GraphDatabaseSettings.routing_listen_address)) {
        internalListenAddress = config.get(GraphDatabaseSettings.routing_listen_address).socketAddress();
    } else {
        // otherwise use same host as external connector but with default internal port
        internalListenAddress = new InetSocketAddress(config.get(BoltConnector.listen_address).getHostname(), config.get(GraphDatabaseSettings.routing_listen_address).getPort());
    }
    Duration channelTimeout = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_timeout);
    long maxMessageSize = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_max_inbound_bytes);
    return new SocketTransport(BoltConnector.NAME, internalListenAddress, sslCtx, requireEncryption, logService.getInternalLogProvider(), throttleGroup, boltProtocolFactory, connectionTracker, channelTimeout, maxMessageSize, bufferAllocator, boltMemoryPool);
}

Example 43 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project neo4j by neo4j.

the class BoltServer method createExternalProtocolInitializer.

private ProtocolInitializer createExternalProtocolInitializer(BoltProtocolFactory boltProtocolFactory, TransportThrottleGroup throttleGroup, Log log, ByteBufAllocator bufferAllocator) {
    SslContext sslCtx;
    boolean requireEncryption;
    BoltConnector.EncryptionLevel encryptionLevel = config.get(BoltConnector.encryption_level);
    SslPolicyLoader sslPolicyLoader = dependencyResolver.resolveDependency(SslPolicyLoader.class);
    switch(encryptionLevel) {
        case REQUIRED:
            // Encrypted connections are mandatory.
            requireEncryption = true;
            sslCtx = createSslContext(sslPolicyLoader);
            break;
        case OPTIONAL:
            // Encrypted connections are optional.
            requireEncryption = false;
            sslCtx = createSslContext(sslPolicyLoader);
            break;
        case DISABLED:
            // Encryption is turned off.
            requireEncryption = false;
            sslCtx = null;
            break;
        default:
            // In the unlikely event that we happen to fall through to the default option here,
            // there is a mismatch between the BoltConnector.EncryptionLevel enum and the options
            // handled in this switch statement. In this case, we'll log a warning and default to
            // disabling encryption, since this mirrors the functionality introduced in 3.0.
            log.warn("Unhandled encryption level %s - assuming DISABLED.", encryptionLevel.name());
            requireEncryption = false;
            sslCtx = null;
            break;
    }
    SocketAddress listenAddress = config.get(BoltConnector.listen_address).socketAddress();
    Duration channelTimeout = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_timeout);
    long maxMessageSize = config.get(BoltConnectorInternalSettings.unsupported_bolt_unauth_connection_max_inbound_bytes);
    return new SocketTransport(BoltConnector.NAME, listenAddress, sslCtx, requireEncryption, logService.getInternalLogProvider(), throttleGroup, boltProtocolFactory, connectionTracker, channelTimeout, maxMessageSize, bufferAllocator, boltMemoryPool);
}

Example 44 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project neo4j by neo4j.

the class TransportSelectionHandlerTest method shouldPreventMultipleLevelsOfSslEncryption.

@Test
void shouldPreventMultipleLevelsOfSslEncryption() throws Exception {
    // Given
    ChannelHandlerContext context = channelHandlerContextMockSslAlreadyConfigured();
    AssertableLogProvider logging = new AssertableLogProvider();
    SslContext sslCtx = mock(SslContext.class);
    var memoryTracker = mock(MemoryTracker.class);
    TransportSelectionHandler handler = new TransportSelectionHandler(null, sslCtx, false, false, logging, null, null, memoryTracker);
    // encrypted
    final ByteBuf payload = Unpooled.wrappedBuffer(new byte[] { 22, 3, 1, 0, 5 });
    // When
    handler.decode(context, payload, null);
    // Then
    verify(context).close();
    assertThat(logging).forClass(TransportSelectionHandler.class).forLevel(ERROR).containsMessageWithArguments("Fatal error: multiple levels of SSL encryption detected." + " Terminating connection: %s", context.channel());
}

Example 45 with SslContext

use of org.apache.flink.shaded.netty4.io.netty.handler.ssl.SslContext in project flink by apache.

the class SSLUtils method createRestClientSSLEngineFactory.

/**
 * Creates a {@link SSLHandlerFactory} to be used by the REST Clients.
 *
 * @param config The application configuration.
 */
public static SSLHandlerFactory createRestClientSSLEngineFactory(final Configuration config) throws Exception {
    ClientAuth clientAuth = SecurityOptions.isRestSSLAuthenticationEnabled(config) ? ClientAuth.REQUIRE : ClientAuth.NONE;
    SslContext sslContext = createRestNettySSLContext(config, true, clientAuth);
    if (sslContext == null) {
        throw new IllegalConfigurationException("SSL is not enabled for REST endpoints.");
    }
    return new SSLHandlerFactory(sslContext, -1, -1);
}