Skip to content

Commit a9c9066

Browse files
cdegrocCole-Greer
cdegroc
authored and
Cole-Greer
committed
[TINKERPOP-3146] Support hot reloading of SSL certificates (#3078)
Adds a file watcher that monitors certificate files for changes every minute. When changes are detected, the certificates are reloaded. Integrates the (Apache License) Hakky54/sslcontext-kickstart library (as suggested by the TinkerPop community) to enable hot-reloading of SSL certificates.
1 parent a97db03 commit a9c9066

7 files changed

Lines changed: 264 additions & 43 deletions

File tree

‎CHANGELOG.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima
103103
* Changed `gremlin-go` Client `ReadBufferSize` and `WriteBufferSize` defaults to 1048576 (1MB) to align with DriverRemoteConnection.
104104
* Fixed bug in `IndexStep` which prevented Java serialization due to non-serializable lambda usage by creating serializable function classes.
105105
* Fixed bug in `Operator` which was caused only a single method parameter to be Collection type checked instead of all parameters.
106+
* Support hot reloading of SSL certificates.
106107
107108
[[release-3-7-3]]
108109
=== TinkerPop 3.7.3 (October 23, 2024)

‎gremlin-server/pom.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,16 @@ limitations under the License.
5959
<artifactId>logback-classic</artifactId>
6060
<optional>true</optional>
6161
</dependency>
62+
<dependency>
63+
<groupId>io.github.hakky54</groupId>
64+
<artifactId>sslcontext-kickstart-for-netty</artifactId>
65+
<exclusions>
66+
<exclusion>
67+
<groupId>org.slf4j</groupId>
68+
<artifactId>slf4j-api</artifactId>
69+
</exclusion>
70+
</exclusions>
71+
</dependency>
6272
<!-- METRICS -->
6373
<dependency>
6474
<groupId>com.codahale.metrics</groupId>

‎gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/AbstractChannelizer.java‎

Lines changed: 52 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,13 @@
2121
import io.netty.channel.group.ChannelGroup;
2222
import io.netty.handler.ssl.ClientAuth;
2323
import io.netty.handler.ssl.SslContext;
24-
import io.netty.handler.ssl.SslContextBuilder;
2524
import io.netty.handler.ssl.SslProvider;
2625
import io.netty.handler.timeout.IdleStateHandler;
26+
import nl.altindag.ssl.SSLFactory;
27+
import nl.altindag.ssl.exception.GenericSecurityException;
28+
import nl.altindag.ssl.netty.util.NettySslUtils;
29+
import nl.altindag.ssl.util.SSLFactoryUtils;
30+
import org.apache.tinkerpop.gremlin.server.util.SSLStoreFilesModificationWatcher;
2731
import org.apache.tinkerpop.gremlin.util.MessageSerializer;
2832
import org.apache.tinkerpop.gremlin.util.message.RequestMessage;
2933
import org.apache.tinkerpop.gremlin.util.message.ResponseMessage;
@@ -44,19 +48,12 @@
4448
import org.slf4j.Logger;
4549
import org.slf4j.LoggerFactory;
4650

47-
import javax.net.ssl.KeyManagerFactory;
4851
import javax.net.ssl.SSLException;
49-
import javax.net.ssl.TrustManagerFactory;
50-
5152
import java.io.FileInputStream;
5253
import java.io.IOException;
5354
import java.io.InputStream;
5455
import java.lang.reflect.Constructor;
5556
import java.security.KeyStore;
56-
import java.security.KeyStoreException;
57-
import java.security.NoSuchAlgorithmException;
58-
import java.security.UnrecoverableKeyException;
59-
import java.security.cert.CertificateException;
6057
import java.util.Arrays;
6158
import java.util.Collections;
6259
import java.util.HashMap;
@@ -65,6 +62,7 @@
6562
import java.util.Optional;
6663
import java.util.concurrent.ExecutorService;
6764
import java.util.concurrent.ScheduledExecutorService;
65+
import java.util.concurrent.TimeUnit;
6866
import java.util.stream.Stream;
6967

7068
/**
@@ -148,8 +146,34 @@ public void init(final ServerGremlinExecutor serverGremlinExecutor) {
148146
configureSerializers();
149147

150148
// configure ssl if present
151-
sslContext = settings.optionalSsl().isPresent() && settings.ssl.enabled ?
152-
Optional.ofNullable(createSSLContext(settings)) : Optional.empty();
149+
if (settings.optionalSsl().isPresent() && settings.ssl.enabled) {
150+
if (settings.ssl.getSslContext().isPresent()) {
151+
logger.info("Using the SslContext override");
152+
this.sslContext = settings.ssl.getSslContext();
153+
} else {
154+
final SSLFactory sslFactory = createSSLFactoryBuilder(settings).withSwappableTrustMaterial().withSwappableIdentityMaterial().build();
155+
this.sslContext = Optional.of(createSSLContext(sslFactory));
156+
157+
if (settings.ssl.refreshInterval > 0) {
158+
// At the scheduled refreshInterval, check whether the keyStore or trustStore has been modified. If they were,
159+
// reload the SSLFactory which will reload the underlying KeyManager/TrustManager that Netty SSLHandler uses.
160+
scheduledExecutorService.scheduleAtFixedRate(
161+
new SSLStoreFilesModificationWatcher(settings.ssl.keyStore, settings.ssl.trustStore, () -> {
162+
SSLFactory newSslFactory = createSSLFactoryBuilder(settings).build();
163+
try {
164+
SSLFactoryUtils.reload(sslFactory, newSslFactory);
165+
} catch (RuntimeException e) {
166+
logger.error("Failed to reload SSLFactory", e);
167+
}
168+
}),
169+
settings.ssl.refreshInterval, settings.ssl.refreshInterval, TimeUnit.MILLISECONDS
170+
);
171+
}
172+
}
173+
} else {
174+
this.sslContext = Optional.empty();
175+
}
176+
153177
if (sslContext.isPresent()) logger.info("SSL enabled");
154178

155179
authenticator = createAuthenticator(settings.authentication);
@@ -307,74 +331,59 @@ private void configureSerializers() {
307331
}
308332
}
309333

310-
private SslContext createSSLContext(final Settings settings) {
334+
private SSLFactory.Builder createSSLFactoryBuilder(final Settings settings) {
311335
final Settings.SslSettings sslSettings = settings.ssl;
312336

313-
if (sslSettings.getSslContext().isPresent()) {
314-
logger.info("Using the SslContext override");
315-
return sslSettings.getSslContext().get();
316-
}
317-
318-
final SslProvider provider = SslProvider.JDK;
319-
320-
final SslContextBuilder builder;
321-
322-
// Build JSSE SSLContext
337+
final SSLFactory.Builder builder = SSLFactory.builder();
323338
try {
324-
final KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
325-
326-
// Load private key and signed cert
327339
if (null != sslSettings.keyStore) {
328340
final String keyStoreType = null == sslSettings.keyStoreType ? KeyStore.getDefaultType() : sslSettings.keyStoreType;
329-
final KeyStore keystore = KeyStore.getInstance(keyStoreType);
330341
final char[] password = null == sslSettings.keyStorePassword ? null : sslSettings.keyStorePassword.toCharArray();
331342
try (final InputStream in = new FileInputStream(sslSettings.keyStore)) {
332-
keystore.load(in, password);
343+
builder.withIdentityMaterial(in, password, keyStoreType);
333344
}
334-
kmf.init(keystore, password);
335345
} else {
336346
throw new IllegalStateException("keyStore must be configured when SSL is enabled.");
337347
}
338348

339-
builder = SslContextBuilder.forServer(kmf);
340-
341349
// Load custom truststore for client auth certs
342350
if (null != sslSettings.trustStore) {
343351
final String trustStoreType = null != sslSettings.trustStoreType ? sslSettings.trustStoreType
344-
: sslSettings.keyStoreType != null ? sslSettings.keyStoreType : KeyStore.getDefaultType();
345-
346-
final KeyStore truststore = KeyStore.getInstance(trustStoreType);
352+
: sslSettings.keyStoreType != null ? sslSettings.keyStoreType : KeyStore.getDefaultType();
347353
final char[] password = null == sslSettings.trustStorePassword ? null : sslSettings.trustStorePassword.toCharArray();
348354
try (final InputStream in = new FileInputStream(sslSettings.trustStore)) {
349-
truststore.load(in, password);
355+
builder.withTrustMaterial(in, password, trustStoreType);
350356
}
351-
final TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
352-
tmf.init(truststore);
353-
builder.trustManager(tmf);
354357
}
355-
356-
} catch (UnrecoverableKeyException | NoSuchAlgorithmException | KeyStoreException | CertificateException | IOException e) {
358+
} catch (GenericSecurityException | IOException e) {
357359
logger.error(e.getMessage());
358360
throw new RuntimeException("There was an error enabling SSL.", e);
359361
}
360362

361363
if (null != sslSettings.sslCipherSuites && !sslSettings.sslCipherSuites.isEmpty()) {
362-
builder.ciphers(sslSettings.sslCipherSuites);
364+
builder.withCiphers(sslSettings.sslCipherSuites.toArray(new String[] {}));
363365
}
364366

365367
if (null != sslSettings.sslEnabledProtocols && !sslSettings.sslEnabledProtocols.isEmpty()) {
366-
builder.protocols(sslSettings.sslEnabledProtocols.toArray(new String[] {}));
368+
builder.withProtocols(sslSettings.sslEnabledProtocols.toArray(new String[] {}));
367369
}
368-
370+
369371
if (null != sslSettings.needClientAuth && ClientAuth.OPTIONAL == sslSettings.needClientAuth) {
370372
logger.warn("needClientAuth = OPTIONAL is not a secure configuration. Setting to REQUIRE.");
371373
sslSettings.needClientAuth = ClientAuth.REQUIRE;
372374
}
373375

374-
builder.clientAuth(sslSettings.needClientAuth).sslProvider(provider);
376+
if (sslSettings.needClientAuth == ClientAuth.REQUIRE) {
377+
builder.withNeedClientAuthentication(true);
378+
}
379+
380+
return builder;
381+
}
375382

383+
private static SslContext createSSLContext(final SSLFactory sslFactory) {
376384
try {
377-
return builder.build();
385+
final SslProvider provider = SslProvider.JDK;
386+
return NettySslUtils.forServer(sslFactory).sslProvider(provider).build();
378387
} catch (SSLException ssle) {
379388
logger.error(ssle.getMessage());
380389
throw new RuntimeException("There was an error enabling SSL.", ssle);

‎gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/Settings.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,12 @@ public static class SslSettings {
581581
*/
582582
public ClientAuth needClientAuth = ClientAuth.NONE;
583583

584+
/**
585+
* The interval, in milliseconds, at which the trustStore and keyStore files are checked for updates.
586+
* The default interval is 60 seconds.
587+
*/
588+
public long refreshInterval = 60000L;
589+
584590
private SslContext sslContext;
585591

586592
/**

‎gremlin-server/src/main/java/org/apache/tinkerpop/gremlin/server/util/SSLStoreFilesModificationWatcher.java‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
package org.apache.tinkerpop.gremlin.server.util;
20+
21+
import org.slf4j.Logger;
22+
import org.slf4j.LoggerFactory;
23+
24+
import java.io.IOException;
25+
import java.io.UncheckedIOException;
26+
import java.nio.file.Files;
27+
import java.nio.file.Path;
28+
import java.nio.file.Paths;
29+
import java.nio.file.attribute.BasicFileAttributes;
30+
import java.time.ZoneOffset;
31+
import java.time.ZonedDateTime;
32+
33+
/**
34+
* FileWatcher monitoring changes to SSL keyStore/trustStore files.
35+
* If a keyStore/trustStore file is set to null, it will be ignored.
36+
* If a keyStore/trustStore file is deleted, it will be considered not modified.
37+
*/
38+
public class SSLStoreFilesModificationWatcher implements Runnable {
39+
40+
private static final Logger logger = LoggerFactory.getLogger(SSLStoreFilesModificationWatcher.class);
41+
42+
private final Path keyStore;
43+
private final Path trustStore;
44+
private final Runnable onModificationRunnable;
45+
46+
private ZonedDateTime lastModifiedTimeKeyStore = null;
47+
private ZonedDateTime lastModifiedTimeTrustStore = null;
48+
49+
/**
50+
* Create a FileWatcher on keyStore/trustStore
51+
*
52+
* @param keyStore path to the keyStore file or null to ignore
53+
* @param trustStore path to the trustStore file or null to ignore
54+
* @param onModificationRunnable function to run when a modification to the keyStore or trustStore is detected
55+
*/
56+
public SSLStoreFilesModificationWatcher(final String keyStore, final String trustStore, final Runnable onModificationRunnable) {
57+
// keyStore/trustStore can be null when not specified in gremlin-server Settings
58+
this.keyStore = keyStore != null ? Paths.get(keyStore) : null;
59+
this.trustStore = trustStore != null ? Paths.get(trustStore) : null;
60+
this.onModificationRunnable = onModificationRunnable;
61+
62+
// Initialize lastModifiedTime
63+
try {
64+
if (this.keyStore != null) {
65+
lastModifiedTimeKeyStore = getLastModifiedTime(this.keyStore);
66+
}
67+
if (this.trustStore != null) {
68+
lastModifiedTimeTrustStore = getLastModifiedTime(this.trustStore);
69+
}
70+
} catch (IOException e) {
71+
throw new UncheckedIOException(e);
72+
}
73+
logger.info("Started listening to modifications to the KeyStore and TrustStore files");
74+
}
75+
76+
@Override
77+
public void run() {
78+
try {
79+
boolean keyStoreUpdated = false;
80+
boolean trustStoreUpdated = false;
81+
ZonedDateTime keyStoreModificationDateTime = null;
82+
ZonedDateTime trustStoreModificationDateTime = null;
83+
84+
// Check if the keyStore file still exists and compare its last_modified_time
85+
if (keyStore != null && Files.exists(keyStore)) {
86+
keyStoreModificationDateTime = getLastModifiedTime(keyStore);
87+
keyStoreUpdated = lastModifiedTimeKeyStore.isBefore(keyStoreModificationDateTime);
88+
if (keyStoreUpdated) {
89+
logger.info("KeyStore file has been modified.");
90+
}
91+
}
92+
93+
// Check if the trustStore file still exists and compare its last_modified_time
94+
if (trustStore != null && Files.exists(trustStore)) {
95+
trustStoreModificationDateTime = getLastModifiedTime(trustStore);
96+
trustStoreUpdated = lastModifiedTimeTrustStore.isBefore(trustStoreModificationDateTime);
97+
if (trustStoreUpdated) {
98+
logger.info("TrustStore file has been modified.");
99+
}
100+
}
101+
102+
// If one of the files was updated, execute
103+
if (keyStoreUpdated || trustStoreUpdated) {
104+
onModificationRunnable.run();
105+
106+
if (keyStoreUpdated) {
107+
lastModifiedTimeKeyStore = keyStoreModificationDateTime;
108+
logger.info("Updated KeyStore configuration");
109+
}
110+
if (trustStoreUpdated) {
111+
lastModifiedTimeTrustStore = trustStoreModificationDateTime;
112+
logger.info("Updated TrustStore configuration");
113+
}
114+
}
115+
} catch (IOException e) {
116+
throw new UncheckedIOException(e);
117+
}
118+
}
119+
120+
private static ZonedDateTime getLastModifiedTime(final Path filepath) throws IOException {
121+
BasicFileAttributes attributes = Files.readAttributes(filepath, BasicFileAttributes.class);
122+
return ZonedDateTime.ofInstant(attributes.lastModifiedTime().toInstant(), ZoneOffset.UTC);
123+
}
124+
}

0 commit comments

Comments
 (0)