Package org.apache.cassandra.security

Class SSLFactory

java.lang.Object

org.apache.cassandra.security.SSLFactory

public final class SSLFactory
extends Object

A Factory for providing and setting up client SSLSockets. Also provides methods for creating both JSSE SSLContext instances as well as netty SslContext instances.

Netty SslContext instances are expensive to create (as well as to destroy) and consume a lof of resources (especially direct memory), but instances can be reused across connections (assuming the SSL params are the same). Hence we cache created instances in cachedSslContexts.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	SSLFactory.LoggingCipherSuiteFilter

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_HOT_RELOAD_INITIAL_DELAY_SEC	Default initial delay for hot reloading
static final int	DEFAULT_HOT_RELOAD_PERIOD_SEC	Default periodic check delay for hot reloading

Constructor Summary

Constructors

Constructor	Description
SSLFactory()

Method Summary

Modifier and Type	Method	Description
static void	checkCertFilesForHotReloading()	Performs a lightweight check whether the certificate files have been refreshed.
static void	clearSslContextCache()	This clears the cache of Netty's SslContext objects for Client and Server sockets.
static SSLContext	createSSLContext(EncryptionOptions options, boolean verifyPeerCertificate)	Create a JSSE SSLContext.
static void	forceCheckCertFiles()	Forces revalidation and loading of SSL certifcates if valid
static io.netty.handler.ssl.SslContext	getOrCreateSslContext(EncryptionOptions options, boolean verifyPeerCertificate, ISslContextFactory.SocketType socketType, String contextDescription)	get a netty SslContext instance
static void	initHotReloading(EncryptionOptions.ServerEncryptionOptions serverOpts, EncryptionOptions clientOpts, boolean force)	Determines whether to hot reload certificates and schedules a periodic task for it.
static boolean	openSslIsAvailable()
static List<String>	tlsInstanceProtocolSubstitution()	Provides the list of protocols that would have been supported if "TLS" was selected as the protocol before the change for CASSANDRA-13325 that expects explicit protocol versions.
static void	validateSslCerts(EncryptionOptions.ServerEncryptionOptions serverOpts, EncryptionOptions clientOpts)	Sanity checks all certificates to ensure we can actually load them
static void	validateSslContext(String contextDescription, EncryptionOptions options, boolean verifyPeerCertificate, boolean logProtocolAndCiphers)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_HOT_RELOAD_INITIAL_DELAY_SEC

public static final int DEFAULT_HOT_RELOAD_INITIAL_DELAY_SEC

Default initial delay for hot reloading

See Also:

• Constant Field Values

DEFAULT_HOT_RELOAD_PERIOD_SEC

public static final int DEFAULT_HOT_RELOAD_PERIOD_SEC

Default periodic check delay for hot reloading

See Also:

• Constant Field Values

Constructor Details

SSLFactory

public SSLFactory()

Method Details

openSslIsAvailable

public static boolean openSslIsAvailable()

tlsInstanceProtocolSubstitution

public static List<String> tlsInstanceProtocolSubstitution()

Provides the list of protocols that would have been supported if "TLS" was selected as the protocol before the change for CASSANDRA-13325 that expects explicit protocol versions.

Returns:

list of enabled protocol names

createSSLContext

public static SSLContext createSSLContext(EncryptionOptions options,
 boolean verifyPeerCertificate)
                                   throws IOException

Create a JSSE SSLContext.

Throws:

IOException

getOrCreateSslContext

public static io.netty.handler.ssl.SslContext getOrCreateSslContext(EncryptionOptions options,
 boolean verifyPeerCertificate,
 ISslContextFactory.SocketType socketType,
 String contextDescription)
                                                             throws IOException

get a netty SslContext instance

Throws:

IOException

checkCertFilesForHotReloading

public static void checkCertFilesForHotReloading()

Performs a lightweight check whether the certificate files have been refreshed.

Throws:

IllegalStateException - if initHotReloading(EncryptionOptions.ServerEncryptionOptions, EncryptionOptions, boolean) is not called first

forceCheckCertFiles

public static void forceCheckCertFiles()

Forces revalidation and loading of SSL certifcates if valid

clearSslContextCache

public static void clearSslContextCache()

This clears the cache of Netty's SslContext objects for Client and Server sockets. This is made publically available so that any ISslContextFactory's implementation can call this to handle any special scenario to invalidate the SslContext cache. This should be used with caution since the purpose of this cache is save costly creation of Netty's SslContext objects and this essentially results in re-creating it.

initHotReloading

public static void initHotReloading(EncryptionOptions.ServerEncryptionOptions serverOpts,
 EncryptionOptions clientOpts,
 boolean force)
                             throws IOException

Determines whether to hot reload certificates and schedules a periodic task for it.

Parameters:

serverOpts - Server encryption options (Internode)

clientOpts - Client encryption options (Native Protocol)

Throws:

IOException

validateSslContext

public static void validateSslContext(String contextDescription,
 EncryptionOptions options,
 boolean verifyPeerCertificate,
 boolean logProtocolAndCiphers)
                               throws IOException

Throws:

IOException

validateSslCerts

public static void validateSslCerts(EncryptionOptions.ServerEncryptionOptions serverOpts,
 EncryptionOptions clientOpts)
                             throws IOException

Sanity checks all certificates to ensure we can actually load them

Throws:

IOException