Package org.apache.hadoop.security.ssl

Class SSLFactory

java.lang.Object

org.apache.hadoop.security.ssl.SSLFactory

All Implemented Interfaces:

org.apache.hadoop.security.authentication.client.ConnectionConfigurator

@Private
@Evolving
public class SSLFactory
extends Object
implements org.apache.hadoop.security.authentication.client.ConnectionConfigurator

Factory that creates SSLEngine and SSLSocketFactory instances using Hadoop configuration information.

This SSLFactory uses a ReloadingX509TrustManager instance, which reloads public keys if the truststore file changes.

This factory is used to configure HTTPS in Hadoop HTTP based endpoints, both client and server.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	SSLFactory.Mode

Field Summary

Fields

Modifier and Type	Field	Description
static final String	KEY_MANAGER_SSLCERTIFICATE
static final String	KEYSTORES_FACTORY_CLASS_KEY
static final String	SSL_CLIENT_CONF_DEFAULT
static final String	SSL_CLIENT_CONF_KEY
static final String	SSL_ENABLED_PROTOCOLS_DEFAULT
static final String	SSL_ENABLED_PROTOCOLS_KEY
static final String	SSL_HOSTNAME_VERIFIER_KEY
static final boolean	SSL_REQUIRE_CLIENT_CERT_DEFAULT
static final String	SSL_REQUIRE_CLIENT_CERT_KEY
static final String	SSL_SERVER_CONF_DEFAULT
static final String	SSL_SERVER_CONF_KEY
static final String	SSL_SERVER_EXCLUDE_CIPHER_LIST
static final String	SSL_SERVER_INCLUDE_CIPHER_LIST
static final String	SSL_SERVER_KEYSTORE_KEYPASSWORD
static final String	SSL_SERVER_KEYSTORE_LOCATION
static final String	SSL_SERVER_KEYSTORE_PASSWORD
static final String	SSL_SERVER_KEYSTORE_TYPE
static final String	SSL_SERVER_KEYSTORE_TYPE_DEFAULT
static final String	SSL_SERVER_NEED_CLIENT_AUTH
static final boolean	SSL_SERVER_NEED_CLIENT_AUTH_DEFAULT
static final String	SSL_SERVER_TRUSTSTORE_LOCATION
static final String	SSL_SERVER_TRUSTSTORE_PASSWORD
static final String	SSL_SERVER_TRUSTSTORE_TYPE
static final String	SSL_SERVER_TRUSTSTORE_TYPE_DEFAULT
static final String	TRUST_MANAGER_SSLCERTIFICATE

Constructor Summary

Constructors

Constructor	Description
SSLFactory(SSLFactory.Mode mode, Configuration conf)	Creates an SSLFactory.

Method Summary

Modifier and Type	Method	Description
HttpURLConnection	configure(HttpURLConnection conn)	If the given HttpURLConnection is an HttpsURLConnection configures the connection with the SSLSocketFactory and HostnameVerifier of this SSLFactory, otherwise does nothing.
SSLEngine	createSSLEngine()	Returns a configured SSLEngine.
SSLServerSocketFactory	createSSLServerSocketFactory()	Returns a configured SSLServerSocketFactory.
SSLSocketFactory	createSSLSocketFactory()	Returns a configured SSLSocketFactory.
void	destroy()	Releases any resources being used.
HostnameVerifier	getHostnameVerifier()	Returns the hostname verifier it should be used in HttpsURLConnections.
static HostnameVerifier	getHostnameVerifier(String verifier)
KeyStoresFactory	getKeystoresFactory()	Returns the SSLFactory KeyStoresFactory instance.
void	init()	Initializes the factory.
boolean	isClientCertRequired()	Returns if client certificates are required or not.
static Configuration	readSSLConfiguration(Configuration conf, SSLFactory.Mode mode)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SSL_CLIENT_CONF_KEY

public static final String SSL_CLIENT_CONF_KEY

See Also:

• Constant Field Values

SSL_CLIENT_CONF_DEFAULT

public static final String SSL_CLIENT_CONF_DEFAULT

See Also:

• Constant Field Values

SSL_SERVER_CONF_KEY

public static final String SSL_SERVER_CONF_KEY

See Also:

• Constant Field Values

SSL_SERVER_CONF_DEFAULT

public static final String SSL_SERVER_CONF_DEFAULT

See Also:

• Constant Field Values

SSL_REQUIRE_CLIENT_CERT_KEY

public static final String SSL_REQUIRE_CLIENT_CERT_KEY

See Also:

• Constant Field Values

SSL_REQUIRE_CLIENT_CERT_DEFAULT

public static final boolean SSL_REQUIRE_CLIENT_CERT_DEFAULT

See Also:

• Constant Field Values

SSL_HOSTNAME_VERIFIER_KEY

public static final String SSL_HOSTNAME_VERIFIER_KEY

See Also:

• Constant Field Values

SSL_ENABLED_PROTOCOLS_KEY

public static final String SSL_ENABLED_PROTOCOLS_KEY

See Also:

• Constant Field Values

SSL_ENABLED_PROTOCOLS_DEFAULT

public static final String SSL_ENABLED_PROTOCOLS_DEFAULT

See Also:

• Constant Field Values

SSL_SERVER_NEED_CLIENT_AUTH

public static final String SSL_SERVER_NEED_CLIENT_AUTH

See Also:

• Constant Field Values

SSL_SERVER_NEED_CLIENT_AUTH_DEFAULT

public static final boolean SSL_SERVER_NEED_CLIENT_AUTH_DEFAULT

See Also:

• Constant Field Values

SSL_SERVER_KEYSTORE_LOCATION

public static final String SSL_SERVER_KEYSTORE_LOCATION

See Also:

• Constant Field Values

SSL_SERVER_KEYSTORE_PASSWORD

public static final String SSL_SERVER_KEYSTORE_PASSWORD

See Also:

• Constant Field Values

SSL_SERVER_KEYSTORE_TYPE

public static final String SSL_SERVER_KEYSTORE_TYPE

See Also:

• Constant Field Values

SSL_SERVER_KEYSTORE_TYPE_DEFAULT

public static final String SSL_SERVER_KEYSTORE_TYPE_DEFAULT

See Also:

• Constant Field Values

SSL_SERVER_KEYSTORE_KEYPASSWORD

public static final String SSL_SERVER_KEYSTORE_KEYPASSWORD

See Also:

• Constant Field Values

SSL_SERVER_TRUSTSTORE_LOCATION

public static final String SSL_SERVER_TRUSTSTORE_LOCATION

See Also:

• Constant Field Values

SSL_SERVER_TRUSTSTORE_PASSWORD

public static final String SSL_SERVER_TRUSTSTORE_PASSWORD

See Also:

• Constant Field Values

SSL_SERVER_TRUSTSTORE_TYPE

public static final String SSL_SERVER_TRUSTSTORE_TYPE

See Also:

• Constant Field Values

SSL_SERVER_TRUSTSTORE_TYPE_DEFAULT

public static final String SSL_SERVER_TRUSTSTORE_TYPE_DEFAULT

See Also:

• Constant Field Values

SSL_SERVER_EXCLUDE_CIPHER_LIST

public static final String SSL_SERVER_EXCLUDE_CIPHER_LIST

See Also:

• Constant Field Values

SSL_SERVER_INCLUDE_CIPHER_LIST

public static final String SSL_SERVER_INCLUDE_CIPHER_LIST

See Also:

• Constant Field Values

KEY_MANAGER_SSLCERTIFICATE

public static final String KEY_MANAGER_SSLCERTIFICATE

TRUST_MANAGER_SSLCERTIFICATE

public static final String TRUST_MANAGER_SSLCERTIFICATE

KEYSTORES_FACTORY_CLASS_KEY

public static final String KEYSTORES_FACTORY_CLASS_KEY

See Also:

• Constant Field Values

Constructor Details

SSLFactory

public SSLFactory(SSLFactory.Mode mode,
 Configuration conf)

Creates an SSLFactory.

Parameters:

mode - SSLFactory mode, client or server.

conf - Hadoop configuration from where the SSLFactory configuration will be read.

Method Details

readSSLConfiguration

public static Configuration readSSLConfiguration(Configuration conf,
 SSLFactory.Mode mode)

init

public void init()
          throws GeneralSecurityException,
IOException

Initializes the factory.

Throws:

GeneralSecurityException - thrown if an SSL initialization error happened.

IOException - thrown if an IO error happened while reading the SSL configuration.

getHostnameVerifier

public static HostnameVerifier getHostnameVerifier(String verifier)
                                            throws GeneralSecurityException,
IOException

Throws:

GeneralSecurityException

IOException

destroy

public void destroy()

Releases any resources being used.

getKeystoresFactory

public KeyStoresFactory getKeystoresFactory()

Returns the SSLFactory KeyStoresFactory instance.

Returns:

the SSLFactory KeyStoresFactory instance.

createSSLEngine

public SSLEngine createSSLEngine()
                          throws GeneralSecurityException,
IOException

Returns a configured SSLEngine.

Returns:

the configured SSLEngine.

Throws:

GeneralSecurityException - thrown if the SSL engine could not be initialized.

IOException - thrown if and IO error occurred while loading the server keystore.

createSSLServerSocketFactory

public SSLServerSocketFactory createSSLServerSocketFactory()
                                                    throws GeneralSecurityException,
IOException

Returns a configured SSLServerSocketFactory.

Returns:

the configured SSLSocketFactory.

Throws:

GeneralSecurityException - thrown if the SSLSocketFactory could not be initialized.

IOException - thrown if and IO error occurred while loading the server keystore.

createSSLSocketFactory

public SSLSocketFactory createSSLSocketFactory()
                                        throws GeneralSecurityException,
IOException

Returns a configured SSLSocketFactory.

Returns:

the configured SSLSocketFactory.

Throws:

GeneralSecurityException - thrown if the SSLSocketFactory could not be initialized.

IOException - thrown if and IO error occurred while loading the server keystore.

getHostnameVerifier

public HostnameVerifier getHostnameVerifier()

Returns the hostname verifier it should be used in HttpsURLConnections.

Returns:

the hostname verifier.

isClientCertRequired

public boolean isClientCertRequired()

Returns if client certificates are required or not.

Returns:

if client certificates are required or not.

configure

public HttpURLConnection configure(HttpURLConnection conn)
                            throws IOException

If the given HttpURLConnection is an HttpsURLConnection configures the connection with the SSLSocketFactory and HostnameVerifier of this SSLFactory, otherwise does nothing.

Specified by:

configure in interface org.apache.hadoop.security.authentication.client.ConnectionConfigurator

Parameters:

conn - the HttpURLConnection instance to configure.

Returns:

the configured HttpURLConnection instance.

Throws:

IOException - if an IO error occurred.