HIVE-29603: Support SSL cipher suites inclusion for HS2 HTTP mode and Web UI (apache#6466)

Author: tanishq-chugh

common/src/java/org/apache/hadoop/hive/conf/HiveConf.java

@@ -3858,6 +3858,8 @@ public static enum ConfVars {
         "SSL certificate keystore password for HiveServer2 WebUI."),
     HIVE_SERVER2_WEBUI_SSL_KEYSTORE_TYPE("hive.server2.webui.keystore.type", "",
         "SSL certificate keystore type for HiveServer2 WebUI."),
+    HIVE_SERVER2_WEBUI_SSL_INCLUDE_CIPHERSUITES("hive.server2.webui.include.ciphersuites", "",
+        "SSL a list of include cipher suite names separated by colon for HiveServer2 WebUI."),
     HIVE_SERVER2_WEBUI_SSL_EXCLUDE_CIPHERSUITES("hive.server2.webui.exclude.ciphersuites", "",
         "SSL a list of exclude cipher suite names or regular expressions separated by comma"
         + " for HiveServer2 WebUI."),
@@ -4375,6 +4377,8 @@ public static enum ConfVars {
         "SSL certificate keystore type."),
     HIVE_SERVER2_SSL_KEYMANAGERFACTORY_ALGORITHM("hive.server2.keymanagerfactory.algorithm", "",
         "SSL certificate keystore algorithm."),
+    HIVE_SERVER2_SSL_HTTP_INCLUDE_CIPHERSUITES("hive.server2.http.include.ciphersuites", "",
+        "SSL a list of include cipher suite names separated by colon for HiveServer2 http server."),
     HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES("hive.server2.http.exclude.ciphersuites", "",
         "SSL a list of exclude cipher suite names or regular expressions separated by comma "
         + "for HiveServer2 http server."),

common/src/java/org/apache/hive/http/HttpServer.java

@@ -163,6 +163,7 @@ public static class Builder {
     private String keyStorePath;
     private String keyStoreType;
     private String keyManagerFactoryAlgorithm;
+    private String includeCiphersuites;
     private String excludeCiphersuites;
     private String spnegoPrincipal;
     private String spnegoKeytab;
@@ -246,6 +247,11 @@ public Builder setKeyManagerFactoryAlgorithm(String keyManagerFactoryAlgorithm)
       return this;
     }
 
+    public Builder setIncludeCiphersuites(String includeCiphersuites) {
+      this.includeCiphersuites = includeCiphersuites;
+      return this;
+    }
+
     public Builder setExcludeCiphersuites(String excludeCiphersuites) {
       this.excludeCiphersuites = excludeCiphersuites;
       return this;
@@ -668,12 +674,18 @@ ServerConnector createAndAddChannelConnector(int queueSize, Builder b) {
       sslContextFactory.setKeyManagerFactoryAlgorithm(
           b.keyManagerFactoryAlgorithm == null || b.keyManagerFactoryAlgorithm.isEmpty()?
           KeyManagerFactory.getDefaultAlgorithm() : b.keyManagerFactoryAlgorithm);
+      if (b.includeCiphersuites != null && !b.includeCiphersuites.trim().isEmpty()) {
+        Set<String> includeCS = Sets.newHashSet(
+            Splitter.on(":").trimResults().omitEmptyStrings().split(b.includeCiphersuites));
+        if (!includeCS.isEmpty()) {
+          sslContextFactory.setIncludeCipherSuites(includeCS.toArray(new String[0]));
+        }
+      }
       if (b.excludeCiphersuites != null && !b.excludeCiphersuites.trim().isEmpty()) {
         Set<String> excludeCS = Sets.newHashSet(
-            Splitter.on(",").trimResults().omitEmptyStrings().split(b.excludeCiphersuites.trim()));
-        int eSize = excludeCS.size();
-        if (eSize > 0) {
-          sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new String[eSize]));
+            Splitter.on(",").trimResults().omitEmptyStrings().split(b.excludeCiphersuites));
+        if (!excludeCS.isEmpty()) {
+          sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new String[0]));
         }
       }
       Set<String> excludedSSLProtocols = Sets.newHashSet(

service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java

@@ -173,13 +173,21 @@ public void onClosed(Connection connection) {
         sslContextFactory.setKeyStorePassword(keyStorePassword);
         sslContextFactory.setKeyStoreType(keyStoreType);
         sslContextFactory.setKeyManagerFactoryAlgorithm(keyStoreAlgorithm);
-        String excludeCiphersuites = hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES).trim();
-        if (!excludeCiphersuites.trim().isEmpty()) {
+        String includeCiphersuites = hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_INCLUDE_CIPHERSUITES);
+        if (includeCiphersuites != null && !includeCiphersuites.trim().isEmpty()) {
+          Set<String> includeCS = Sets.newHashSet(
+              Splitter.on(":").trimResults().omitEmptyStrings().split(includeCiphersuites));
+          if (!includeCS.isEmpty()) {
+            sslContextFactory.setIncludeCipherSuites(includeCS.toArray(new String[0]));
+          }
+        }
+
+        String excludeCiphersuites = hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES);
+        if (excludeCiphersuites != null && !excludeCiphersuites.trim().isEmpty()) {
           Set<String> excludeCS = Sets.newHashSet(
-                  Splitter.on(",").trimResults().omitEmptyStrings().split(excludeCiphersuites.trim()));
-          int eSize = excludeCS.size();
-          if (eSize > 0) {
-            sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new String[eSize]));
+              Splitter.on(",").trimResults().omitEmptyStrings().split(excludeCiphersuites));
+          if (!excludeCS.isEmpty()) {
+            sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new String[0]));
           }
         }
         connector = new ServerConnector(server, sslContextFactory, http);

service/src/java/org/apache/hive/service/server/HiveServer2.java

@@ -489,6 +489,7 @@ private static HttpServer.Builder createHttpServerBuilder(String webHost, int po
       builder.setKeyStoreType(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_KEYSTORE_TYPE));
       builder.setKeyManagerFactoryAlgorithm(
           hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_KEYMANAGERFACTORY_ALGORITHM));
+      builder.setIncludeCiphersuites(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_INCLUDE_CIPHERSUITES));
       builder.setExcludeCiphersuites(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_EXCLUDE_CIPHERSUITES));
       builder.setUseSSL(true);
     }