|
| 1 | +/* |
| 2 | + * Licensed to the Apache Software Foundation (ASF) under one or more |
| 3 | + * contributor license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright ownership. |
| 5 | + * The ASF licenses this file to You under the Apache License, Version 2.0 |
| 6 | + * (the "License"); you may not use this file except in compliance with |
| 7 | + * the License. You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, software |
| 12 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | + * See the License for the specific language governing permissions and |
| 15 | + * limitations under the License. |
| 16 | + */ |
| 17 | + |
| 18 | +package org.apache.spark |
| 19 | + |
| 20 | +import java.io.File |
| 21 | + |
| 22 | +import com.typesafe.config.{Config, ConfigFactory, ConfigValueFactory} |
| 23 | +import org.eclipse.jetty.util.ssl.SslContextFactory |
| 24 | + |
| 25 | +/** |
| 26 | + * SSLOptions class is a common container for SSL configuration options. It offers methods to |
| 27 | + * generate specific objects to configure SSL for different communication protocols. |
| 28 | + * |
| 29 | + * SSLOptions is intended to provide the maximum common set of SSL settings, which are supported |
| 30 | + * by the protocol, which it can generate the configuration for. Since Akka doesn't support client |
| 31 | + * authentication with SSL, SSLOptions cannot support it either. |
| 32 | + * |
| 33 | + * @param enabled enables or disables SSL; if it is set to false, the rest of the |
| 34 | + * settings are disregarded |
| 35 | + * @param keyStore a path to the key-store file |
| 36 | + * @param keyStorePassword a password to access the key-store file |
| 37 | + * @param keyPassword a password to access the private key in the key-store |
| 38 | + * @param trustStore a path to the trust-store file |
| 39 | + * @param trustStorePassword a password to access the trust-store file |
| 40 | + * @param protocol SSL protocol (remember that SSLv3 was compromised) supported by Java |
| 41 | + * @param enabledAlgorithms a set of encryption algorithms to use |
| 42 | + */ |
| 43 | +private[spark] case class SSLOptions( |
| 44 | + enabled: Boolean = false, |
| 45 | + keyStore: Option[File] = None, |
| 46 | + keyStorePassword: Option[String] = None, |
| 47 | + keyPassword: Option[String] = None, |
| 48 | + trustStore: Option[File] = None, |
| 49 | + trustStorePassword: Option[String] = None, |
| 50 | + protocol: Option[String] = None, |
| 51 | + enabledAlgorithms: Set[String] = Set.empty) { |
| 52 | + |
| 53 | + /** |
| 54 | + * Creates a Jetty SSL context factory according to the SSL settings represented by this object. |
| 55 | + */ |
| 56 | + def createJettySslContextFactory(): Option[SslContextFactory] = { |
| 57 | + if (enabled) { |
| 58 | + val sslContextFactory = new SslContextFactory() |
| 59 | + |
| 60 | + keyStore.foreach(file => sslContextFactory.setKeyStorePath(file.getAbsolutePath)) |
| 61 | + trustStore.foreach(file => sslContextFactory.setTrustStore(file.getAbsolutePath)) |
| 62 | + keyStorePassword.foreach(sslContextFactory.setKeyStorePassword) |
| 63 | + trustStorePassword.foreach(sslContextFactory.setTrustStorePassword) |
| 64 | + keyPassword.foreach(sslContextFactory.setKeyManagerPassword) |
| 65 | + protocol.foreach(sslContextFactory.setProtocol) |
| 66 | + sslContextFactory.setIncludeCipherSuites(enabledAlgorithms.toSeq: _*) |
| 67 | + |
| 68 | + Some(sslContextFactory) |
| 69 | + } else { |
| 70 | + None |
| 71 | + } |
| 72 | + } |
| 73 | + |
| 74 | + /** |
| 75 | + * Creates an Akka configuration object which contains all the SSL settings represented by this |
| 76 | + * object. It can be used then to compose the ultimate Akka configuration. |
| 77 | + */ |
| 78 | + def createAkkaConfig: Option[Config] = { |
| 79 | + import scala.collection.JavaConversions._ |
| 80 | + if (enabled) { |
| 81 | + Some(ConfigFactory.empty() |
| 82 | + .withValue("akka.remote.netty.tcp.security.key-store", |
| 83 | + ConfigValueFactory.fromAnyRef(keyStore.map(_.getAbsolutePath).getOrElse(""))) |
| 84 | + .withValue("akka.remote.netty.tcp.security.key-store-password", |
| 85 | + ConfigValueFactory.fromAnyRef(keyStorePassword.getOrElse(""))) |
| 86 | + .withValue("akka.remote.netty.tcp.security.trust-store", |
| 87 | + ConfigValueFactory.fromAnyRef(trustStore.map(_.getAbsolutePath).getOrElse(""))) |
| 88 | + .withValue("akka.remote.netty.tcp.security.trust-store-password", |
| 89 | + ConfigValueFactory.fromAnyRef(trustStorePassword.getOrElse(""))) |
| 90 | + .withValue("akka.remote.netty.tcp.security.key-password", |
| 91 | + ConfigValueFactory.fromAnyRef(keyPassword.getOrElse(""))) |
| 92 | + .withValue("akka.remote.netty.tcp.security.random-number-generator", |
| 93 | + ConfigValueFactory.fromAnyRef("")) |
| 94 | + .withValue("akka.remote.netty.tcp.security.protocol", |
| 95 | + ConfigValueFactory.fromAnyRef(protocol.getOrElse(""))) |
| 96 | + .withValue("akka.remote.netty.tcp.security.enabled-algorithms", |
| 97 | + ConfigValueFactory.fromIterable(enabledAlgorithms.toSeq)) |
| 98 | + .withValue("akka.remote.netty.tcp.enable-ssl", |
| 99 | + ConfigValueFactory.fromAnyRef(true))) |
| 100 | + } else { |
| 101 | + None |
| 102 | + } |
| 103 | + } |
| 104 | + |
| 105 | + /** Returns a string representation of this SSLOptions with all the passwords masked. */ |
| 106 | + override def toString: String = s"SSLOptions{enabled=$enabled, " + |
| 107 | + s"keyStore=$keyStore, keyStorePassword=${keyStorePassword.map(_ => "xxx")}, " + |
| 108 | + s"trustStore=$trustStore, trustStorePassword=${trustStorePassword.map(_ => "xxx")}, " + |
| 109 | + s"protocol=$protocol, enabledAlgorithms=$enabledAlgorithms}" |
| 110 | + |
| 111 | +} |
| 112 | + |
| 113 | +private[spark] object SSLOptions extends Logging { |
| 114 | + |
| 115 | + /** Resolves SSLOptions settings from a given Spark configuration object at a given namespace. |
| 116 | + * |
| 117 | + * The following settings are allowed: |
| 118 | + * $ - `[ns].enabled` - `true` or `false`, to enable or disable SSL respectively |
| 119 | + * $ - `[ns].keyStore` - a path to the key-store file; can be relative to the current directory |
| 120 | + * $ - `[ns].keyStorePassword` - a password to the key-store file |
| 121 | + * $ - `[ns].keyPassword` - a password to the private key |
| 122 | + * $ - `[ns].trustStore` - a path to the trust-store file; can be relative to the current |
| 123 | + * directory |
| 124 | + * $ - `[ns].trustStorePassword` - a password to the trust-store file |
| 125 | + * $ - `[ns].protocol` - a protocol name supported by a particular Java version |
| 126 | + * $ - `[ns].enabledAlgorithms` - a comma separated list of ciphers |
| 127 | + * |
| 128 | + * For a list of protocols and ciphers supported by particular Java versions, you may go to |
| 129 | + * [[https://blogs.oracle.com/java-platform-group/entry/diagnosing_tls_ssl_and_https Oracle |
| 130 | + * blog page]]. |
| 131 | + * |
| 132 | + * You can optionally specify the default configuration. If you do, for each setting which is |
| 133 | + * missing in SparkConf, the corresponding setting is used from the default configuration. |
| 134 | + * |
| 135 | + * @param conf Spark configuration object where the settings are collected from |
| 136 | + * @param ns the namespace name |
| 137 | + * @param defaults the default configuration |
| 138 | + * @return [[org.apache.spark.SSLOptions]] object |
| 139 | + */ |
| 140 | + def parse(conf: SparkConf, ns: String, defaults: Option[SSLOptions] = None): SSLOptions = { |
| 141 | + val enabled = conf.getBoolean(s"$ns.enabled", defaultValue = defaults.exists(_.enabled)) |
| 142 | + |
| 143 | + val keyStore = conf.getOption(s"$ns.keyStore").map(new File(_)) |
| 144 | + .orElse(defaults.flatMap(_.keyStore)) |
| 145 | + |
| 146 | + val keyStorePassword = conf.getOption(s"$ns.keyStorePassword") |
| 147 | + .orElse(defaults.flatMap(_.keyStorePassword)) |
| 148 | + |
| 149 | + val keyPassword = conf.getOption(s"$ns.keyPassword") |
| 150 | + .orElse(defaults.flatMap(_.keyPassword)) |
| 151 | + |
| 152 | + val trustStore = conf.getOption(s"$ns.trustStore").map(new File(_)) |
| 153 | + .orElse(defaults.flatMap(_.trustStore)) |
| 154 | + |
| 155 | + val trustStorePassword = conf.getOption(s"$ns.trustStorePassword") |
| 156 | + .orElse(defaults.flatMap(_.trustStorePassword)) |
| 157 | + |
| 158 | + val protocol = conf.getOption(s"$ns.protocol") |
| 159 | + .orElse(defaults.flatMap(_.protocol)) |
| 160 | + |
| 161 | + val enabledAlgorithms = conf.getOption(s"$ns.enabledAlgorithms") |
| 162 | + .map(_.split(",").map(_.trim).filter(_.nonEmpty).toSet) |
| 163 | + .orElse(defaults.map(_.enabledAlgorithms)) |
| 164 | + .getOrElse(Set.empty) |
| 165 | + |
| 166 | + new SSLOptions( |
| 167 | + enabled, |
| 168 | + keyStore, |
| 169 | + keyStorePassword, |
| 170 | + keyPassword, |
| 171 | + trustStore, |
| 172 | + trustStorePassword, |
| 173 | + protocol, |
| 174 | + enabledAlgorithms) |
| 175 | + } |
| 176 | + |
| 177 | +} |
| 178 | + |
0 commit comments