Skip to content

HDDS-15176. Ozone SCM fails to start when gRPC cipher policy list includes unsupported cipher #10192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dombizita wants to merge 1 commit into
base: master
Choose a base branch
from
Open

HDDS-15176. Ozone SCM fails to start when gRPC cipher policy list includes unsupported cipher #10192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion ...ain/java/org/apache/hadoop/ozone/container/common/transport/server/XceiverServerGrpc.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
import org.apache.ratis.thirdparty.io.netty.channel.nio.NioEventLoopGroup;
import org.apache.ratis.thirdparty.io.netty.channel.socket.nio.NioServerSocketChannel;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SslContextBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SupportedCipherSuiteFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

Expand Down Expand Up @@ -146,7 +147,9 @@ public XceiverServerGrpc(DatanodeDetails datanodeDetails,
SslContextBuilder sslContextBuilder = GrpcSslContexts.configure(
sslClientContextBuilder, secConf.getGrpcSslProvider());
sslContextBuilder.protocols(secConf.getGrpcTlsProtocols());
sslContextBuilder.ciphers(secConf.getGrpcTlsCiphers());
sslContextBuilder.ciphers(
secConf.getGrpcTlsCiphers(),
SupportedCipherSuiteFilter.INSTANCE);
nettyServerBuilder.sslContext(sslContextBuilder.build());
} catch (Exception ex) {
LOG.error("Unable to setup TLS for secure datanode GRPC endpoint.", ex);
Expand Down
5 changes: 4 additions & 1 deletion ...ervice/src/main/java/org/apache/hadoop/ozone/container/replication/ReplicationServer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@
import org.apache.ratis.thirdparty.io.grpc.netty.NettyServerBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.ClientAuth;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SslContextBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SupportedCipherSuiteFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

Expand Down Expand Up @@ -121,7 +122,9 @@ public void init() {
sslContextBuilder.clientAuth(ClientAuth.REQUIRE);
sslContextBuilder.trustManager(caClient.getTrustManager());
sslContextBuilder.protocols(secConf.getGrpcTlsProtocols());
sslContextBuilder.ciphers(secConf.getGrpcTlsCiphers());
sslContextBuilder.ciphers(
secConf.getGrpcTlsCiphers(),
SupportedCipherSuiteFilter.INSTANCE);

nettyServerBuilder.sslContext(sslContextBuilder.build());
} catch (IOException ex) {
Expand Down
25 changes: 24 additions & 1 deletion ...p-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/ssl/TestGrpcTlsConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@
import org.apache.ratis.thirdparty.io.netty.handler.ssl.ClientAuth;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SslContextBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SslProvider;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SupportedCipherSuiteFilter;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;

Expand Down Expand Up @@ -146,6 +147,26 @@ public void testDefaultConfigAcceptsConnection() throws Exception {
}
}

@Test
public void testServerIgnoresUnsupportedConfiguredCiphers() throws Exception {
Server server = null;
ManagedChannel channel = null;
try {
String[] configuredCiphers = {
"TLS_FAKE_CIPHER_SUITE",
"TLS_AES_256_GCM_SHA384"
};
server = setupServer(new String[]{"TLSv1.3"}, configuredCiphers);
server.start();
channel = setupClient(server.getPort(), new String[]{"TLSv1.3"}, new String[]{"TLS_AES_256_GCM_SHA384"});
XceiverClientProtocolServiceStub asyncStub = XceiverClientProtocolServiceGrpc.newStub(channel);
ContainerCommandResponseProto response = sendRequest(asyncStub);
assertEquals(SUCCESS, response.getResult());
} finally {
shutdown(channel, server);
}
}

private Server setupServer(String[] protocols, String[] ciphers)
throws Exception {
NettyServerBuilder nettyServerBuilder = NettyServerBuilder.forPort(0).addService(new GrpcService());
Expand All @@ -157,7 +178,9 @@ private Server setupServer(String[] protocols, String[] ciphers)
sslContextBuilder.protocols(protocols);
}
if (ciphers != null) {
sslContextBuilder.ciphers(Arrays.asList(ciphers));
sslContextBuilder.ciphers(
Arrays.asList(ciphers),
SupportedCipherSuiteFilter.INSTANCE);
}
nettyServerBuilder.sslContext(sslContextBuilder.build());
return nettyServerBuilder.build();
Expand Down
5 changes: 4 additions & 1 deletion ...s/server-scm/src/main/java/org/apache/hadoop/hdds/scm/ha/InterSCMGrpcProtocolService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
import org.apache.ratis.thirdparty.io.grpc.netty.NettyServerBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.ClientAuth;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SslContextBuilder;
import org.apache.ratis.thirdparty.io.netty.handler.ssl.SupportedCipherSuiteFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

Expand Down Expand Up @@ -75,7 +76,9 @@ public class InterSCMGrpcProtocolService {
sslServerContextBuilder, securityConfig.getGrpcSslProvider());
sslContextBuilder.clientAuth(ClientAuth.REQUIRE);
sslContextBuilder.protocols(securityConfig.getGrpcTlsProtocols());
sslContextBuilder.ciphers(securityConfig.getGrpcTlsCiphers());
sslContextBuilder.ciphers(
securityConfig.getGrpcTlsCiphers(),
SupportedCipherSuiteFilter.INSTANCE);
nettyServerBuilder.sslContext(sslContextBuilder.build());
} catch (Exception ex) {
LOG.error("Unable to setup TLS for secure " +
Expand Down
5 changes: 4 additions & 1 deletion ...-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/GrpcOzoneManagerServer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import io.netty.channel.socket.nio.NioServerSocketChannel;
import io.netty.handler.ssl.SslContextBuilder;
import io.netty.handler.ssl.SslProvider;
import io.netty.handler.ssl.SupportedCipherSuiteFilter;
import java.io.IOException;
import java.util.OptionalInt;
import java.util.concurrent.LinkedBlockingQueue;
Expand Down Expand Up @@ -165,7 +166,9 @@ public void init(OzoneManagerProtocolServerSideTranslatorPB omTranslator,
SslProvider.valueOf(omServerConfig.get(HDDS_GRPC_TLS_PROVIDER,
HDDS_GRPC_TLS_PROVIDER_DEFAULT)));
sslContextBuilder.protocols(secConf.getGrpcTlsProtocols());
sslContextBuilder.ciphers(secConf.getGrpcTlsCiphers());
sslContextBuilder.ciphers(
secConf.getGrpcTlsCiphers(),
SupportedCipherSuiteFilter.INSTANCE);
nettyServerBuilder.sslContext(sslContextBuilder.build());
} catch (Exception ex) {
LOG.error("Unable to setup TLS for secure Om S3g GRPC channel.", ex);
Expand Down