Skip to content

Commit 367ce78

Browse files
jiazhaijiazhai
authored
Add Tls with keystore type config support (apache#6853)
Fixes apache#6640 ### Motivation Add Tls with keystore type config. ### Modifications Add Tls with keystore type config. ### Verifying this change - Unit test passed
1 parent 7cd28b9 commit 367ce78

File tree

92 files changed

+3631
-484
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

92 files changed

+3631
-484
lines changed

‎conf/broker.conf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -406,6 +406,62 @@ tlsCiphers=
406406
# authentication.
407407
tlsRequireTrustedClientCertOnConnect=false
408408

409+
### --- KeyStore TLS config variables --- ###
410+
# Enable TLS with KeyStore type configuration in broker.
411+
tlsEnabledWithKeyStore=false
412+
413+
# TLS Provider for KeyStore type
414+
tlsProvider=
415+
416+
# TLS KeyStore type configuration in broker: JKS, PKCS12
417+
tlsKeyStoreType=JKS
418+
419+
# TLS KeyStore path in broker
420+
tlsKeyStore=
421+
422+
# TLS KeyStore password for broker
423+
tlsKeyStorePassword=
424+
425+
# TLS TrustStore type configuration in broker: JKS, PKCS12
426+
tlsTrustStoreType=JKS
427+
428+
# TLS TrustStore path in broker
429+
tlsTrustStore=
430+
431+
# TLS TrustStore password in broker
432+
tlsTrustStorePassword=
433+
434+
# Whether internal client use KeyStore type to authenticate with Pulsar brokers
435+
brokerClientTlsEnabledWithKeyStore=false
436+
437+
# The TLS Provider used by internal client to authenticate with other Pulsar brokers
438+
brokerClientSslProvider=
439+
440+
# TLS TrustStore type configuration for internal client: JKS, PKCS12
441+
# used by the internal client to authenticate with Pulsar brokers
442+
brokerClientTlsTrustStoreType=JKS
443+
444+
# TLS TrustStore path for internal client
445+
# used by the internal client to authenticate with Pulsar brokers
446+
brokerClientTlsTrustStore=
447+
448+
# TLS TrustStore password for internal client,
449+
# used by the internal client to authenticate with Pulsar brokers
450+
brokerClientTlsTrustStorePassword=
451+
452+
# Specify the tls cipher the internal client will use to negotiate during TLS Handshake
453+
# (a comma-separated list of ciphers)
454+
# e.g. [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256].
455+
# used by the internal client to authenticate with Pulsar brokers
456+
brokerClientTlsCiphers=
457+
458+
# Specify the tls protocols the broker will use to negotiate during TLS handshake
459+
# (a comma-separated list of protocol names).
460+
# e.g. [TLSv1.2, TLSv1.1, TLSv1]
461+
# used by the internal client to authenticate with Pulsar brokers
462+
brokerClientTlsProtocols=
463+
464+
409465
### --- Authentication --- ###
410466

411467
# Enable authentication

‎conf/client.conf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,14 @@ tlsEnableHostnameVerification=false
5656
# fails, then the cert is untrusted and the connection is dropped.
5757
tlsTrustCertsFilePath=
5858

59+
# Enable TLS with KeyStore type configuration in broker.
60+
useKeyStoreTls=false;
61+
62+
# TLS KeyStore type configuration: JKS, PKCS12
63+
tlsTrustStoreType=JKS
64+
65+
# TLS TrustStore path
66+
tlsTrustStorePath=
67+
68+
# TLS TrustStore password
69+
tlsTrustStorePassword=

‎conf/standalone.conf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,102 @@ maxConsumersPerSubscription=0
225225
# Use 0 or negative number to disable the check
226226
maxNumPartitionsPerPartitionedTopic=0
227227

228+
### --- TLS --- ###
229+
# Deprecated - Use webServicePortTls and brokerServicePortTls instead
230+
tlsEnabled=false
231+
232+
# Tls cert refresh duration in seconds (set 0 to check on every new connection)
233+
tlsCertRefreshCheckDurationSec=300
234+
235+
# Path for the TLS certificate file
236+
tlsCertificateFilePath=
237+
238+
# Path for the TLS private key file
239+
tlsKeyFilePath=
240+
241+
# Path for the trusted TLS certificate file.
242+
# This cert is used to verify that any certs presented by connecting clients
243+
# are signed by a certificate authority. If this verification
244+
# fails, then the certs are untrusted and the connections are dropped.
245+
tlsTrustCertsFilePath=
246+
247+
# Accept untrusted TLS certificate from client.
248+
# If true, a client with a cert which cannot be verified with the
249+
# 'tlsTrustCertsFilePath' cert will allowed to connect to the server,
250+
# though the cert will not be used for client authentication.
251+
tlsAllowInsecureConnection=false
252+
253+
# Specify the tls protocols the broker will use to negotiate during TLS handshake
254+
# (a comma-separated list of protocol names).
255+
# Examples:- [TLSv1.2, TLSv1.1, TLSv1]
256+
tlsProtocols=
257+
258+
# Specify the tls cipher the broker will use to negotiate during TLS Handshake
259+
# (a comma-separated list of ciphers).
260+
# Examples:- [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
261+
tlsCiphers=
262+
263+
# Trusted client certificates are required for to connect TLS
264+
# Reject the Connection if the Client Certificate is not trusted.
265+
# In effect, this requires that all connecting clients perform TLS client
266+
# authentication.
267+
tlsRequireTrustedClientCertOnConnect=false
268+
269+
### --- KeyStore TLS config variables --- ###
270+
# Enable TLS with KeyStore type configuration in broker.
271+
tlsEnabledWithKeyStore=false
272+
273+
# TLS Provider for KeyStore type
274+
tlsProvider=
275+
276+
# TLS KeyStore type configuration in broker: JKS, PKCS12
277+
tlsKeyStoreType=JKS
278+
279+
# TLS KeyStore path in broker
280+
tlsKeyStore=
281+
282+
# TLS KeyStore password for broker
283+
tlsKeyStorePassword=
284+
285+
# TLS TrustStore type configuration in broker: JKS, PKCS12
286+
tlsTrustStoreType=JKS
287+
288+
# TLS TrustStore path in broker
289+
tlsTrustStore=
290+
291+
# TLS TrustStore password for broker
292+
tlsTrustStorePassword=
293+
294+
# Whether internal client use KeyStore type to authenticate with Pulsar brokers
295+
brokerClientTlsEnabledWithKeyStore=false
296+
297+
# The TLS Provider used by internal client to authenticate with other Pulsar brokers
298+
brokerClientSslProvider=
299+
300+
# TLS TrustStore type configuration for internal client: JKS, PKCS12
301+
# used by the internal client to authenticate with Pulsar brokers
302+
brokerClientTlsTrustStoreType=JKS
303+
304+
# TLS TrustStore path for internal client
305+
# used by the internal client to authenticate with Pulsar brokers
306+
brokerClientTlsTrustStore=
307+
308+
# TLS TrustStore password for internal client,
309+
# used by the internal client to authenticate with Pulsar brokers
310+
brokerClientTlsTrustStorePassword=
311+
312+
# Specify the tls cipher the internal client will use to negotiate during TLS Handshake
313+
# (a comma-separated list of ciphers)
314+
# e.g. [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256].
315+
# used by the internal client to authenticate with Pulsar brokers
316+
brokerClientTlsCiphers=
317+
318+
# Specify the tls protocols the broker will use to negotiate during TLS handshake
319+
# (a comma-separated list of protocol names).
320+
# e.g. [TLSv1.2, TLSv1.1, TLSv1]
321+
# used by the internal client to authenticate with Pulsar brokers
322+
brokerClientTlsProtocols=
323+
228324
### --- Authentication --- ###
229325
# Role names that are treated as "proxy roles". If the broker sees a request with
230326
#role as proxyRoles - it will demand to see a valid original principal.

‎pulsar-broker-common/src/main/java/org/apache/pulsar/broker/ServiceConfiguration.java‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@ public class ServiceConfiguration implements PulsarConfiguration {
7777
@Category
7878
private static final String CATEGORY_TLS = "TLS";
7979
@Category
80+
private static final String CATEGORY_KEYSTORE_TLS = "KeyStoreTLS";
81+
@Category
8082
private static final String CATEGORY_AUTHENTICATION = "Authentication";
8183
@Category
8284
private static final String CATEGORY_AUTHORIZATION = "Authorization";
@@ -1581,6 +1583,102 @@ public class ServiceConfiguration implements PulsarConfiguration {
15811583
private String transactionMetadataStoreProviderClassName =
15821584
"org.apache.pulsar.transaction.coordinator.impl.InMemTransactionMetadataStoreProvider";
15831585

1586+
/**** --- KeyStore TLS config variables --- ****/
1587+
@FieldContext(
1588+
category = CATEGORY_KEYSTORE_TLS,
1589+
doc = "Enable TLS with KeyStore type configuration in broker"
1590+
)
1591+
private boolean tlsEnabledWithKeyStore = false;
1592+
1593+
@FieldContext(
1594+
category = CATEGORY_KEYSTORE_TLS,
1595+
doc = "TLS Provider for KeyStore type"
1596+
)
1597+
private String tlsProvider = null;
1598+
1599+
@FieldContext(
1600+
category = CATEGORY_KEYSTORE_TLS,
1601+
doc = "TLS KeyStore type configuration in broker: JKS, PKCS12"
1602+
)
1603+
private String tlsKeyStoreType = "JKS";
1604+
1605+
@FieldContext(
1606+
category = CATEGORY_KEYSTORE_TLS,
1607+
doc = "TLS KeyStore path in broker"
1608+
)
1609+
private String tlsKeyStore = null;
1610+
1611+
@FieldContext(
1612+
category = CATEGORY_KEYSTORE_TLS,
1613+
doc = "TLS KeyStore password for broker"
1614+
)
1615+
private String tlsKeyStorePassword = null;
1616+
1617+
@FieldContext(
1618+
category = CATEGORY_KEYSTORE_TLS,
1619+
doc = "TLS TrustStore type configuration in broker: JKS, PKCS12"
1620+
)
1621+
private String tlsTrustStoreType = "JKS";
1622+
1623+
@FieldContext(
1624+
category = CATEGORY_KEYSTORE_TLS,
1625+
doc = "TLS TrustStore path in broker"
1626+
)
1627+
private String tlsTrustStore = null;
1628+
1629+
@FieldContext(
1630+
category = CATEGORY_KEYSTORE_TLS,
1631+
doc = "TLS TrustStore password for broker"
1632+
)
1633+
private String tlsTrustStorePassword = null;
1634+
1635+
/**** --- KeyStore TLS config variables used for internal client/admin to auth with other broker--- ****/
1636+
@FieldContext(
1637+
category = CATEGORY_KEYSTORE_TLS,
1638+
doc = "Whether internal client use KeyStore type to authenticate with other Pulsar brokers"
1639+
)
1640+
private boolean brokerClientTlsEnabledWithKeyStore = false;
1641+
@FieldContext(
1642+
category = CATEGORY_KEYSTORE_TLS,
1643+
doc = "The TLS Provider used by internal client to authenticate with other Pulsar brokers"
1644+
)
1645+
private String brokerClientSslProvider = null;
1646+
// needed when client auth is required
1647+
@FieldContext(
1648+
category = CATEGORY_KEYSTORE_TLS,
1649+
doc = "TLS TrustStore type configuration for internal client: JKS, PKCS12 "
1650+
+ " used by the internal client to authenticate with Pulsar brokers"
1651+
)
1652+
private String brokerClientTlsTrustStoreType = "JKS";
1653+
@FieldContext(
1654+
category = CATEGORY_KEYSTORE_TLS,
1655+
doc = "TLS TrustStore path for internal client, "
1656+
+ " used by the internal client to authenticate with Pulsar brokers"
1657+
)
1658+
private String brokerClientTlsTrustStore = null;
1659+
@FieldContext(
1660+
category = CATEGORY_KEYSTORE_TLS,
1661+
doc = "TLS TrustStore password for internal client, "
1662+
+ " used by the internal client to authenticate with Pulsar brokers"
1663+
)
1664+
private String brokerClientTlsTrustStorePassword = null;
1665+
@FieldContext(
1666+
category = CATEGORY_KEYSTORE_TLS,
1667+
doc = "Specify the tls cipher the internal client will use to negotiate during TLS Handshake"
1668+
+ " (a comma-separated list of ciphers).\n\n"
1669+
+ "Examples:- [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256].\n"
1670+
+ " used by the internal client to authenticate with Pulsar brokers"
1671+
)
1672+
private Set<String> brokerClientTlsCiphers = Sets.newTreeSet();
1673+
@FieldContext(
1674+
category = CATEGORY_KEYSTORE_TLS,
1675+
doc = "Specify the tls protocols the broker will use to negotiate during TLS handshake"
1676+
+ " (a comma-separated list of protocol names).\n\n"
1677+
+ "Examples:- [TLSv1.2, TLSv1.1, TLSv1] \n"
1678+
+ " used by the internal client to authenticate with Pulsar brokers"
1679+
)
1680+
private Set<String> brokerClientTlsProtocols = Sets.newTreeSet();
1681+
15841682
/**
15851683
* @deprecated See {@link #getConfigurationStoreServers}
15861684
*/

‎pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/AuthenticationDataHttps.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ public AuthenticationDataHttps(HttpServletRequest request) {
3434
/*
3535
* TLS
3636
*/
37-
3837
@Override
3938
public boolean hasDataFromTls() {
4039
return (certificates != null);

‎pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authentication/OneStageAuthenticationState.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public OneStageAuthenticationState(AuthData authData,
4242
SSLSession sslSession,
4343
AuthenticationProvider provider) throws AuthenticationException {
4444
this.authenticationDataSource = new AuthenticationDataCommand(
45-
new String(authData.getBytes(), UTF_8), remoteAddress, sslSession);;
45+
new String(authData.getBytes(), UTF_8), remoteAddress, sslSession);
4646
this.authRole = provider.authenticate(authenticationDataSource);
4747
}
4848

‎pulsar-broker/src/main/java/org/apache/pulsar/PulsarStandalone.java‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
import org.apache.pulsar.broker.ServiceConfiguration;
3434
import org.apache.pulsar.broker.ServiceConfigurationUtils;
3535
import org.apache.pulsar.client.admin.PulsarAdmin;
36+
import org.apache.pulsar.client.admin.PulsarAdminBuilder;
3637
import org.apache.pulsar.client.admin.PulsarAdminException;
3738
import org.apache.pulsar.common.naming.TopicName;
3839
import org.apache.pulsar.common.policies.data.ClusterData;
@@ -332,11 +333,29 @@ public void start() throws Exception {
332333
createSampleNameSpace(clusterData, cluster);
333334
} else {
334335
URL webServiceUrlTls = new URL(
335-
String.format("http://%s:%d", config.getAdvertisedAddress(), config.getWebServicePortTls().get()));
336+
String.format("https://%s:%d", config.getAdvertisedAddress(), config.getWebServicePortTls().get()));
336337
String brokerServiceUrlTls = String.format("pulsar+ssl://%s:%d", config.getAdvertisedAddress(),
337338
config.getBrokerServicePortTls().get());
338-
admin = PulsarAdmin.builder().serviceHttpUrl(webServiceUrlTls.toString()).authentication(
339-
config.getBrokerClientAuthenticationPlugin(), config.getBrokerClientAuthenticationParameters()).build();
339+
PulsarAdminBuilder builder = PulsarAdmin.builder()
340+
.serviceHttpUrl(webServiceUrlTls.toString())
341+
.authentication(
342+
config.getBrokerClientAuthenticationPlugin(),
343+
config.getBrokerClientAuthenticationParameters());
344+
345+
// set trust store if needed.
346+
if (config.isBrokerClientTlsEnabled()) {
347+
if (config.isBrokerClientTlsEnabledWithKeyStore()) {
348+
builder.useKeyStoreTls(true)
349+
.tlsTrustStoreType(config.getBrokerClientTlsTrustStoreType())
350+
.tlsTrustStorePath(config.getBrokerClientTlsTrustStore())
351+
.tlsTrustStorePassword(config.getBrokerClientTlsTrustStorePassword());
352+
} else {
353+
builder.tlsTrustCertsFilePath(config.getBrokerClientTrustCertsFilePath());
354+
}
355+
builder.allowTlsInsecureConnection(config.isTlsAllowInsecureConnection());
356+
}
357+
358+
admin = builder.build();
340359
ClusterData clusterData = new ClusterData(null, webServiceUrlTls.toString(), null, brokerServiceUrlTls);
341360
createSampleNameSpace(clusterData, cluster);
342361
}

0 commit comments

Comments
 (0)