Skip to content

Commit e335983

Browse files
HTHouHTHou
committed
Add generic SSL TLS configuration support
1 parent d563cd0 commit e335983

38 files changed

Lines changed: 954 additions & 102 deletions

File tree

‎external-service-impl/rest/src/main/java/org/apache/iotdb/rest/RestService.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.apache.iotdb.externalservice.api.IExternalService;
2222
import org.apache.iotdb.rest.i18n.RestMessages;
2323
import org.apache.iotdb.rest.protocol.filter.ApiOriginFilter;
24+
import org.apache.iotdb.rpc.RpcSslUtils;
2425

2526
import org.eclipse.jetty.http.HttpVersion;
2627
import org.eclipse.jetty.server.HttpConfiguration;
@@ -52,6 +53,8 @@ private void startSSL(
5253
String trustStorePath,
5354
String keyStorePwd,
5455
String trustStorePwd,
56+
String sslProtocol,
57+
String sslProviderClass,
5558
int idleTime,
5659
boolean clientAuth) {
5760
server = new Server();
@@ -61,6 +64,7 @@ private void startSSL(
6164
httpsConfig.addCustomizer(new SecureRequestCustomizer());
6265

6366
SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
67+
configureSSL(sslContextFactory, sslProtocol, sslProviderClass);
6468
sslContextFactory.setKeyStorePath(keyStorePath);
6569
sslContextFactory.setKeyStorePassword(keyStorePwd);
6670
if (clientAuth) {
@@ -125,6 +129,8 @@ public void start() {
125129
config.getTrustStorePath(),
126130
config.getKeyStorePwd(),
127131
config.getTrustStorePwd(),
132+
config.getSslProtocol(),
133+
config.getSslProviderClass(),
128134
config.getIdleTimeoutInSeconds(),
129135
config.isClientAuth());
130136
} else {
@@ -142,4 +148,22 @@ public void stop() {
142148
server.destroy();
143149
}
144150
}
151+
152+
private void configureSSL(
153+
SslContextFactory.Server sslContextFactory, String sslProtocol, String sslProviderClass) {
154+
String protocol = trimToEmpty(sslProtocol);
155+
try {
156+
RpcSslUtils.ensureProvider(protocol, sslProviderClass);
157+
} catch (Exception e) {
158+
throw new IllegalArgumentException("Failed to initialize SSL provider for REST service", e);
159+
}
160+
if (!protocol.isEmpty()) {
161+
sslContextFactory.setProtocol(protocol);
162+
sslContextFactory.setIncludeProtocols(protocol);
163+
}
164+
}
165+
166+
private String trimToEmpty(String value) {
167+
return value == null ? "" : value.trim();
168+
}
145169
}

‎iotdb-client/cli/src/main/java/org/apache/iotdb/cli/AbstractCli.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,18 @@ public abstract class AbstractCli {
7777

7878
static final String TRUST_STORE_PWD_ARGS = "tpw";
7979

80+
static final String SSL_PROTOCOL_ARGS = "ssl_protocol";
81+
82+
static final String SSL_PROVIDER_CLASS_ARGS = "ssl_provider_class";
83+
8084
private static final String EXECUTE_NAME = "execute";
8185

8286
private static final String USE_SSL = "use_ssl";
8387
private static final String TRUST_STORE = "trust_store";
8488

8589
private static final String TRUST_STORE_PWD = "trust_store_pwd";
90+
private static final String SSL_PROTOCOL = "ssl_protocol";
91+
private static final String SSL_PROVIDER_CLASS = "ssl_provider_class";
8692
private static final String NULL = "null";
8793

8894
static final int CODE_OK = 0;
@@ -132,6 +138,10 @@ public abstract class AbstractCli {
132138
static String trustStore;
133139
// TODO: Make non-static
134140
static String trustStorePwd;
141+
// TODO: Make non-static
142+
static String sslProtocol;
143+
// TODO: Make non-static
144+
static String sslProviderClass;
135145

136146
static String execute;
137147
static boolean hasExecuteSQL = false;
@@ -156,6 +166,10 @@ static void init() {
156166
keywordSet.add("-" + USE_SSL_ARGS);
157167
keywordSet.add("-" + TRUST_STORE_ARGS);
158168
keywordSet.add("-" + TRUST_STORE_PWD_ARGS);
169+
keywordSet.add("-" + SSL_PROTOCOL_ARGS);
170+
keywordSet.add("--" + SSL_PROTOCOL_ARGS);
171+
keywordSet.add("-" + SSL_PROVIDER_CLASS_ARGS);
172+
keywordSet.add("--" + SSL_PROVIDER_CLASS_ARGS);
159173
keywordSet.add("-" + EXECUTE_ARGS);
160174
keywordSet.add("-" + ISO8601_ARGS);
161175
keywordSet.add("-" + RPC_COMPRESS_ARGS);
@@ -214,6 +228,24 @@ static Options createOptions() {
214228
.build();
215229
options.addOption(useSSL);
216230

231+
Option sslProtocol =
232+
Option.builder(SSL_PROTOCOL_ARGS)
233+
.longOpt(SSL_PROTOCOL)
234+
.argName(SSL_PROTOCOL)
235+
.hasArg()
236+
.desc("SSL protocol. (optional)")
237+
.build();
238+
options.addOption(sslProtocol);
239+
240+
Option sslProviderClass =
241+
Option.builder(SSL_PROVIDER_CLASS_ARGS)
242+
.longOpt(SSL_PROVIDER_CLASS)
243+
.argName(SSL_PROVIDER_CLASS)
244+
.hasArg()
245+
.desc("JSSE provider class for SSL. (optional)")
246+
.build();
247+
options.addOption(sslProviderClass);
248+
217249
Option execute =
218250
Option.builder(EXECUTE_ARGS)
219251
.argName(EXECUTE_NAME)

‎iotdb-client/cli/src/main/java/org/apache/iotdb/cli/Cli.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,12 @@ private static void constructProperties() {
111111
info.setProperty("use_ssl", useSsl);
112112
info.setProperty("trust_store", trustStore);
113113
info.setProperty("trust_store_pwd", trustStorePwd);
114+
if (sslProtocol != null) {
115+
info.setProperty(Config.SSL_PROTOCOL, sslProtocol);
116+
}
117+
if (sslProviderClass != null) {
118+
info.setProperty(Config.SSL_PROVIDER_CLASS, sslProviderClass);
119+
}
114120
}
115121
info.setProperty("user", username);
116122
info.setProperty("password", password);
@@ -159,6 +165,8 @@ private static boolean parseCommandLine(
159165
private static void serve(CliContext ctx) {
160166
try {
161167
useSsl = commandLine.getOptionValue(USE_SSL_ARGS);
168+
sslProtocol = commandLine.getOptionValue(SSL_PROTOCOL_ARGS);
169+
sslProviderClass = commandLine.getOptionValue(SSL_PROVIDER_CLASS_ARGS);
162170
if (Boolean.parseBoolean(useSsl)) {
163171
trustStore = ctx.getLineReader().readLine("please input your trust_store:", '\0');
164172
trustStorePwd = ctx.getLineReader().readLine("please input your trust_store_pwd:", '\0');

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/Constants.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,14 @@ public class Constants {
6868
public static final String TRUST_STORE_PWD_NAME = "trust_store_password";
6969
public static final String TRUST_STORE_PWD_DESC = "Trust store password. (optional)";
7070

71+
public static final String SSL_PROTOCOL_ARGS = "ssl_protocol";
72+
public static final String SSL_PROTOCOL_NAME = "ssl_protocol";
73+
public static final String SSL_PROTOCOL_DESC = "SSL protocol. (optional)";
74+
75+
public static final String SSL_PROVIDER_CLASS_ARGS = "ssl_provider_class";
76+
public static final String SSL_PROVIDER_CLASS_NAME = "ssl_provider_class";
77+
public static final String SSL_PROVIDER_CLASS_DESC = "JSSE provider class for SSL. (optional)";
78+
7179
public static final String FILE_TYPE_ARGS = "ft";
7280
public static final String FILE_TYPE_NAME = "file_type";
7381
public static final String FILE_TYPE_ARGS_NAME = "format";

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/common/OptionsUtil.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,26 @@ public static Options createCommonOptions(Options options) {
133133
.build();
134134
options.addOption(opTrustStorePwd);
135135

136+
Option opSslProtocol =
137+
Option.builder(SSL_PROTOCOL_ARGS)
138+
.longOpt(SSL_PROTOCOL_NAME)
139+
.optionalArg(true)
140+
.argName(SSL_PROTOCOL_NAME)
141+
.hasArg()
142+
.desc(SSL_PROTOCOL_DESC)
143+
.build();
144+
options.addOption(opSslProtocol);
145+
146+
Option opSslProviderClass =
147+
Option.builder(SSL_PROVIDER_CLASS_ARGS)
148+
.longOpt(SSL_PROVIDER_CLASS_NAME)
149+
.optionalArg(true)
150+
.argName(SSL_PROVIDER_CLASS_NAME)
151+
.hasArg()
152+
.desc(SSL_PROVIDER_CLASS_DESC)
153+
.build();
154+
options.addOption(opSslProviderClass);
155+
136156
return options;
137157
}
138158

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/AbstractDataTool.java‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@
3434
import org.apache.iotdb.rpc.IoTDBConnectionException;
3535
import org.apache.iotdb.rpc.StatementExecutionException;
3636
import org.apache.iotdb.session.Session;
37+
import org.apache.iotdb.session.TableSessionBuilder;
38+
import org.apache.iotdb.session.pool.SessionPool;
39+
import org.apache.iotdb.session.pool.TableSessionPoolBuilder;
3740
import org.apache.iotdb.tool.common.Constants;
3841
import org.apache.iotdb.tool.common.ImportTsFileOperation;
3942

@@ -94,6 +97,8 @@ public abstract class AbstractDataTool {
9497
protected static Boolean useSsl;
9598
protected static String trustStore;
9699
protected static String trustStorePwd;
100+
protected static String sslProtocol;
101+
protected static String sslProviderClass;
97102
protected static Boolean aligned;
98103
protected static String database;
99104
protected static String startTime;
@@ -134,6 +139,50 @@ public abstract class AbstractDataTool {
134139

135140
protected AbstractDataTool() {}
136141

142+
protected static Session.Builder configureSsl(Session.Builder builder) {
143+
builder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
144+
if (sslProtocol != null) {
145+
builder.sslProtocol(sslProtocol);
146+
}
147+
if (sslProviderClass != null) {
148+
builder.sslProviderClass(sslProviderClass);
149+
}
150+
return builder;
151+
}
152+
153+
protected static SessionPool.Builder configureSsl(SessionPool.Builder builder) {
154+
builder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
155+
if (sslProtocol != null) {
156+
builder.sslProtocol(sslProtocol);
157+
}
158+
if (sslProviderClass != null) {
159+
builder.sslProviderClass(sslProviderClass);
160+
}
161+
return builder;
162+
}
163+
164+
protected static TableSessionBuilder configureSsl(TableSessionBuilder builder) {
165+
builder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
166+
if (sslProtocol != null) {
167+
builder.sslProtocol(sslProtocol);
168+
}
169+
if (sslProviderClass != null) {
170+
builder.sslProviderClass(sslProviderClass);
171+
}
172+
return builder;
173+
}
174+
175+
protected static TableSessionPoolBuilder configureSsl(TableSessionPoolBuilder builder) {
176+
builder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
177+
if (sslProtocol != null) {
178+
builder.sslProtocol(sslProtocol);
179+
}
180+
if (sslProviderClass != null) {
181+
builder.sslProviderClass(sslProviderClass);
182+
}
183+
return builder;
184+
}
185+
137186
protected static String checkRequiredArg(
138187
String arg, String name, CommandLine commandLine, String defaultValue)
139188
throws ArgsErrorException {
@@ -170,6 +219,8 @@ protected static void parseBasicParams(CommandLine commandLine)
170219
String useSslStr = commandLine.getOptionValue(Constants.USE_SSL_ARGS);
171220
useSsl = Boolean.parseBoolean(useSslStr);
172221
if (useSsl) {
222+
sslProtocol = commandLine.getOptionValue(Constants.SSL_PROTOCOL_ARGS);
223+
sslProviderClass = commandLine.getOptionValue(Constants.SSL_PROVIDER_CLASS_ARGS);
173224
String givenTS = commandLine.getOptionValue(Constants.TRUST_STORE_ARGS);
174225
if (givenTS != null) {
175226
trustStore = givenTS;

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ExportDataTable.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,7 @@ public void init() throws IoTDBConnectionException, StatementExecutionException
7171
.database(database)
7272
.thriftMaxFrameSize(rpcMaxFrameSize);
7373
if (useSsl) {
74-
tableSessionBuilder =
75-
tableSessionBuilder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
74+
tableSessionBuilder = configureSsl(tableSessionBuilder);
7675
}
7776
tableSession = tableSessionBuilder.build();
7877
SessionDataSet sessionDataSet = tableSession.executeQueryStatement("show databases", timeout);

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ExportDataTree.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,8 +80,7 @@ public void init() throws IoTDBConnectionException, StatementExecutionException,
8080
.enableRedirection(SessionConfig.DEFAULT_REDIRECTION_MODE)
8181
.version(SessionConfig.DEFAULT_VERSION);
8282
if (useSsl) {
83-
sessionBuilder =
84-
sessionBuilder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
83+
sessionBuilder = configureSsl(sessionBuilder);
8584
}
8685
session = sessionBuilder.build();
8786
session.open(false);

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ImportDataTable.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,7 @@ public void init() throws InterruptedException {
8888
.enableAutoFetch(false)
8989
.database(database);
9090
if (useSsl) {
91-
tableSessionPoolBuilder =
92-
tableSessionPoolBuilder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
91+
tableSessionPoolBuilder = configureSsl(tableSessionPoolBuilder);
9392
}
9493
sessionPool = tableSessionPoolBuilder.build();
9594
final File file = new File(targetPath);

‎iotdb-client/cli/src/main/java/org/apache/iotdb/tool/data/ImportDataTree.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,7 @@ public void init()
7272
.enableRedirection(false)
7373
.enableAutoFetch(false);
7474
if (useSsl) {
75-
sessionPoolBuilder =
76-
sessionPoolBuilder.useSSL(true).trustStore(trustStore).trustStorePwd(trustStorePwd);
75+
sessionPoolBuilder = configureSsl(sessionPoolBuilder);
7776
}
7877
sessionPool = sessionPoolBuilder.build();
7978
sessionPool.setEnableQueryRedirection(false);

0 commit comments

Comments
 (0)