Package org.apache.cassandra.security

Class AbstractSslContextFactory

java.lang.Object
org.apache.cassandra.security.AbstractSslContextFactory
All Implemented Interfaces:
ISslContextFactory
Direct Known Subclasses:
DisableSslContextFactory, FileBasedSslContextFactory
public abstract class AbstractSslContextFactory extends Object implements ISslContextFactory
Abstract class implementing ISslContextFacotry to provide most of the functionality that any implementation might need. This does not assume any file-based credentials for keys/certs hence provide a good base for any implementation that only need to customize the loading of keys/certs in a custom way.

CAUTION: While this is extremely useful abstraction, please be careful if you need to modify this class given possible custom implementations out there!

See Also:

  • Field Details

    • TLS_PROTOCOL_SUBSTITUTION

      protected static final List<String> TLS_PROTOCOL_SUBSTITUTION

    • openSslIsAvailable

      protected boolean openSslIsAvailable

    • parameters

      protected final Map<String,Object> parameters

    • cipher_suites

      protected final List<String> cipher_suites

    • protocol

      protected final String protocol

    • accepted_protocols

      protected final List<String> accepted_protocols

    • algorithm

      protected final String algorithm

    • store_type

      protected final String store_type

    • require_client_auth

      protected final boolean require_client_auth

    • require_endpoint_verification

      protected final boolean require_endpoint_verification

    • enabled

      protected Boolean enabled

    • optional

      protected Boolean optional

  • Constructor Details

    • AbstractSslContextFactory

      protected AbstractSslContextFactory()

    • AbstractSslContextFactory

      protected AbstractSslContextFactory(Map<String,Object> parameters)

  • Method Details

    • deriveIfOpenSslAvailable

      protected void deriveIfOpenSslAvailable()
      Dervies if OpenSSL is available. It allows in-jvm dtests to disable tcnative openssl support by setting CassandraRelevantProperties.DISABLE_TCACTIVE_OPENSSL system property as true. Otherwise, it creates a circular reference that prevents the instance class loader from being garbage collected.

    • getString

      protected String getString(String key, String defaultValue)

    • getString

      protected String getString(String key)

    • getStringList

      protected List<String> getStringList(String key)

    • getBoolean

      protected Boolean getBoolean(String key, boolean defaultValue)

    • getBoolean

      protected Boolean getBoolean(String key)

    • createJSSESslContext

      public SSLContext createJSSESslContext(boolean verifyPeerCertificate) throws SSLException
      Description copied from interface: ISslContextFactory
      Creates JSSE SSLContext.
      Specified by:
      createJSSESslContext in interface ISslContextFactory
      Parameters:
      verifyPeerCertificate - true if SSL peer's certificate needs to be verified; false otherwise
      Returns:
      JSSE's SSLContext
      Throws:
      SSLException - in case the Ssl Context creation fails for some reason

    • createNettySslContext

      public io.netty.handler.ssl.SslContext createNettySslContext(boolean verifyPeerCertificate, ISslContextFactory.SocketType socketType, io.netty.handler.ssl.CipherSuiteFilter cipherFilter) throws SSLException
      Description copied from interface: ISslContextFactory
      Creates Netty's SslContext object.
      Specified by:
      createNettySslContext in interface ISslContextFactory
      Parameters:
      verifyPeerCertificate - true if SSL peer's certificate needs to be verified; false otherwise
      socketType - ISslContextFactory.SocketType for Netty's Inbound or Outbound channels
      cipherFilter - to allow Netty's cipher suite filtering, e.g. SslContextBuilder.ciphers(Iterable, CipherSuiteFilter)
      Returns:
      Netty's SslContext
      Throws:
      SSLException - in case the Ssl Context creation fails for some reason

    • getAcceptedProtocols

      public List<String> getAcceptedProtocols()
      Combine the pre-4.0 protocol field with the accepted_protocols list, substituting a list of explicit protocols for the previous catchall default of "TLS"
      Specified by:
      getAcceptedProtocols in interface ISslContextFactory
      Returns:
      array of protocol names suitable for passing to SslContextBuilder.protocols, or null if the default

    • getCipherSuites

      public List<String> getCipherSuites()
      Description copied from interface: ISslContextFactory
      Returns the list of cipher suites supported by the implementation.
      Specified by:
      getCipherSuites in interface ISslContextFactory
      Returns:
      List of supported cipher suites

    • getSslProvider

      protected io.netty.handler.ssl.SslProvider getSslProvider()
      Returns SslProvider to be used to build Netty's SslContext.
      Returns:
      appropriate SslProvider

    • buildKeyManagerFactory

      protected abstract KeyManagerFactory buildKeyManagerFactory() throws SSLException
      Throws:
      SSLException

    • buildTrustManagerFactory

      protected abstract TrustManagerFactory buildTrustManagerFactory() throws SSLException
      Throws:
      SSLException

    • buildOutboundKeyManagerFactory

      protected abstract KeyManagerFactory buildOutboundKeyManagerFactory() throws SSLException
      Create a KeyManagerFactory for outbound connections. It provides a seperate keystore for internode mTLS outbound connections.
      Returns:
      KeyManagerFactory
      Throws:
      SSLException