Package org.apache.hadoop.hbase.io.crypto.tls

Class TLSStore

java.lang.Object

org.apache.hadoop.hbase.io.crypto.tls.TLSStore

@Private
public final class TLSStore
extends Object

One keystore or truststore, resolved from configuration with every attribute drawn from a single key prefix.

Each TLS surface exposes two prefixes for the same store: a role-scoped one added for single-EKU certificate support (e.g. hbase.rpc.tls.server.) and the historical unscoped one (e.g. hbase.rpc.tls.). Resolving attribute by attribute would let a store's location come from one prefix while its password or type came from the other, which opens either the wrong file or the right file with the wrong credentials. resolve(org.apache.hadoop.conf.Configuration, java.lang.String, java.lang.String, org.apache.hadoop.hbase.io.crypto.tls.TLSStore.Keys) therefore picks the prefix once, from the location, and reads the rest of the store from that same prefix.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	TLSStore.Keys	The key postfixes making up one store, by surface.

Field Summary

Fields

Modifier and Type	Field	Description
private final char[]	keyPassword
private final String	location
private static final org.slf4j.Logger	LOG
private static final Set<String>	LOGGED_STORES	Stores already checked for unused legacy keys, so the scan and the warning happen once.
private final char[]	password
private final String	type

Constructor Summary

Constructors

Modifier	Constructor	Description
private	TLSStore(String location, char[] password, char[] keyPassword, String type)

Method Summary

Modifier and Type	Method	Description
String	getKeyPassword()	Falls back to the store password when no separate key password is configured.
char[]	getKeyPasswordChars()
String	getLocation()
String	getPassword()
char[]	getPasswordChars()	For the netty paths, whose key/trust manager factories take char[].
String	getType()
private static void	logOnce(org.apache.hadoop.conf.Configuration config, String rolePrefix, String legacyPrefix, TLSStore.Keys keys)
static TLSStore	resolve(org.apache.hadoop.conf.Configuration config, String rolePrefix, String legacyPrefix, TLSStore.Keys keys)	Reads one store from config.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

LOGGED_STORES

private static final Set<String> LOGGED_STORES

Stores already checked for unused legacy keys, so the scan and the warning happen once.

location

private final String location

password

private final char[] password

keyPassword

private final char[] keyPassword

type

private final String type

Constructor Details

TLSStore

private TLSStore(String location,
 char[] password,
 char[] keyPassword,
 String type)

Method Details

resolve

public static TLSStore resolve(org.apache.hadoop.conf.Configuration config,
 String rolePrefix,
 String legacyPrefix,
 TLSStore.Keys keys)
                        throws IOException

Reads one store from config. The prefix supplying the location supplies every other attribute too, so the two prefixes are never combined within a single store.

Only the location is mandatory under a prefix: a store may have no password at all, and the type is auto-detected from the file extension when absent (see KeyStoreFileType.fromPropertyValueOrFileName(java.lang.String, java.lang.String)). Keeping the legacy keys in place while migrating is valid -- the ones left unused are logged once so they can be cleaned up.

Parameters:

config - the configuration to read from

rolePrefix - role-scoped prefix, e.g. hbase.rpc.tls.server.

legacyPrefix - historical unscoped prefix, e.g. hbase.rpc.tls.

keys - which store to read, and under which postfixes

Throws:

IllegalArgumentException - if rolePrefix supplies any attribute but not the location, since the location would then be taken from legacyPrefix

IOException

logOnce

private static void logOnce(org.apache.hadoop.conf.Configuration config,
 String rolePrefix,
 String legacyPrefix,
 TLSStore.Keys keys)

getLocation

public String getLocation()

getPassword

public String getPassword()

getKeyPassword

public String getKeyPassword()

Falls back to the store password when no separate key password is configured.

getPasswordChars

public char[] getPasswordChars()

For the netty paths, whose key/trust manager factories take char[].

getKeyPasswordChars

public char[] getKeyPasswordChars()

See Also:

• getKeyPassword()

getType

public String getType()