Package org.apache.cassandra.config

Class EncryptionOptions

java.lang.Object
org.apache.cassandra.config.EncryptionOptions
Direct Known Subclasses:
EncryptionOptions.ServerEncryptionOptions
public class EncryptionOptions extends Object
This holds various options used for enabling SSL/TLS encryption. Examples of such options are: supported cipher-suites, ssl protocol with version, accepted protocols, end-point verification, require client-auth/cert etc.

  • Field Details

    • ssl_context_factory

      public final ParameterizedClass ssl_context_factory

    • keystore

      public final String keystore

    • keystore_password

      @Nullable public final String keystore_password

    • truststore

      public final String truststore

    • truststore_password

      @Nullable public final String truststore_password

    • cipher_suites

      public final List<String> cipher_suites

    • protocol

      protected String protocol

    • accepted_protocols

      protected List<String> accepted_protocols

    • algorithm

      public final String algorithm

    • store_type

      public final String store_type

    • require_client_auth

      public final boolean require_client_auth

    • require_endpoint_verification

      public final boolean require_endpoint_verification

    • enabled

      protected Boolean enabled

    • optional

      protected Boolean optional

    • isEnabled

      protected Boolean isEnabled

    • isOptional

      protected Boolean isOptional

    • sslContextFactoryInstance

      public transient ISslContextFactory sslContextFactoryInstance

  • Constructor Details

  • Method Details

    • applyConfig

      public EncryptionOptions applyConfig()

    • fillSslContextParams

      protected void fillSslContextParams(Map<String,Object> sslContextFactoryParameters)

    • putSslContextFactoryParameter

      protected static void putSslContextFactoryParameter(Map<String,Object> existingParameters, EncryptionOptions.ConfigKey configKey, Object value)

    • getEnabled

      public Boolean getEnabled()
      Indicates if the channel should be encrypted. Client and Server uses different logic to determine this
      Returns:
      if the channel should be encrypted

    • setEnabled

      public void setEnabled(Boolean enabled)
      Sets if encryption should be enabled for this channel. Note that this should only be called by the configuration parser or tests. It is public only for that purpose, mutating enabled state is probably a bad idea.
      Parameters:
      enabled - value to set

    • getOptional

      public Boolean getOptional()
      Indicates if the channel may be encrypted (but is not required to be). Explicitly providing a value in the configuration take precedent. If no optional value is set and !isEnabled(), then optional connections are allowed if a keystore exists. Without it, it would be impossible to establish the connections. Return type is Boolean even though it can never be null so that snakeyaml can find it
      Returns:
      if the channel may be encrypted

    • setOptional

      public void setOptional(Boolean optional)
      Sets if encryption should be optional for this channel. Note that this should only be called by the configuration parser or tests. It is public only for that purpose, mutating enabled state is probably a bad idea.
      Parameters:
      optional - value to set

    • setProtocol

      public void setProtocol(String protocol)
      Sets accepted TLS protocol for this channel. Note that this should only be called by the configuration parser or tests. It is public only for that purpose, mutating protocol state is probably a bad idea.
      Parameters:
      protocol - value to set

    • getProtocol

      public String getProtocol()

    • setAcceptedProtocols

      public void setAcceptedProtocols(List<String> accepted_protocols)
      Sets accepted TLS protocols for this channel. Note that this should only be called by the configuration parser or tests. It is public only for that purpose, mutating protocol state is probably a bad idea. The function casing is required for snakeyaml to find this setter for the protected field.
      Parameters:
      accepted_protocols - value to set

    • getAcceptedProtocols

      public List<String> getAcceptedProtocols()

    • acceptedProtocolsArray

      public String[] acceptedProtocolsArray()

    • cipherSuitesArray

      public String[] cipherSuitesArray()

    • tlsEncryptionPolicy

      public EncryptionOptions.TlsEncryptionPolicy tlsEncryptionPolicy()

    • withSslContextFactory

      public EncryptionOptions withSslContextFactory(ParameterizedClass sslContextFactoryClass)

    • withKeyStore

      public EncryptionOptions withKeyStore(String keystore)

    • withKeyStorePassword

      public EncryptionOptions withKeyStorePassword(String keystore_password)

    • withTrustStore

      public EncryptionOptions withTrustStore(String truststore)

    • withTrustStorePassword

      public EncryptionOptions withTrustStorePassword(String truststore_password)

    • withCipherSuites

      public EncryptionOptions withCipherSuites(List<String> cipher_suites)

    • withCipherSuites

      public EncryptionOptions withCipherSuites(String... cipher_suites)

    • withProtocol

      public EncryptionOptions withProtocol(String protocol)

    • withAcceptedProtocols

      public EncryptionOptions withAcceptedProtocols(List<String> accepted_protocols)

    • withAlgorithm

      public EncryptionOptions withAlgorithm(String algorithm)

    • withStoreType

      public EncryptionOptions withStoreType(String store_type)

    • withRequireClientAuth

      public EncryptionOptions withRequireClientAuth(boolean require_client_auth)

    • withRequireEndpointVerification

      public EncryptionOptions withRequireEndpointVerification(boolean require_endpoint_verification)

    • withEnabled

      public EncryptionOptions withEnabled(boolean enabled)

    • withOptional

      public EncryptionOptions withOptional(Boolean optional)

    • equals

      public boolean equals(Object o)
      The method is being mainly used to cache SslContexts therefore, we only consider fields that would make a difference when the TrustStore or KeyStore files are updated
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      The method is being mainly used to cache SslContexts therefore, we only consider fields that would make a difference when the TrustStore or KeyStore files are updated
      Overrides:
      hashCode in class Object