Package org.apache.hadoop.hbase.rest

Class TestRESTServerSSL

java.lang.Object

org.apache.hadoop.hbase.rest.TestRESTServerSSL

@Tag("org.apache.hadoop.hbase.testclassification.RestTests") @Tag("org.apache.hadoop.hbase.testclassification.MediumTests")
public class TestRESTServerSSL
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
private org.apache.hadoop.conf.Configuration	conf
private static final String	KEY_STORE_PASSWORD
private static File	keyDir
private static final org.slf4j.Logger	LOG
private static final HBaseRESTTestingUtility	REST_TEST_UTIL
private static org.apache.hadoop.hbase.rest.client.Client	sslClient
private static final HBaseTestingUtil	TEST_UTIL
private static final String	TRUST_STORE_PASSWORD

Constructor Summary

Constructors

Constructor	Description
TestRESTServerSSL()

Method Summary

Modifier and Type	Method	Description
static void	afterClass()
static void	beforeClass()
void	beforeEachTest()
private static void	generateKeyStore(String keyStoreType, KeyPair keyPair, X509Certificate serverCertificate)
private static void	generateTrustStore(String trustStoreType, X509Certificate serverCertificate)
private static String	getKeystoreFilePath(String keyStoreType)
private static String	getTruststoreFilePath(String trustStoreType)
private static void	initializeAlgorithmId()
private static File	initKeystoreDir()
private void	startRESTServer(String storeType)
private void	startRESTServerWithDefaultKeystoreType()
void	tearDownAfterTest()
void	testClientAuthNeedRejectsClientWithoutCert()	With client.auth.mode=NEED, an anonymous client (no client cert) is rejected by the server.
void	testClientAuthNoneAcceptsClientWithoutCert()	With client.auth.mode=NONE (the default), a client that presents no client certificate is accepted — matching today's behavior.
void	testClientAuthWantAllowsAnonymousClient()	With client.auth.mode=WANT, an anonymous client (no client cert) is still accepted; the server requests a cert but does not require it.
void	testNonSslClientDenied()
void	testSslConnection()
void	testSslConnectionFallsBackToLegacyKeystoreKeys()	Backward-compatibility regression: existing deployments that know only about the legacy unscoped keys must continue to work exactly as before.
void	testSslConnectionUsingKeystoreFormatJCEKS()
void	testSslConnectionUsingKeystoreFormatJKS()
void	testSslConnectionUsingKeystoreFormatPKCS12()
void	testSslConnectionUsingRoleScopedServerKeys()	Server started with only the role-scoped hbase.rest.ssl.server.* keys (and legacy keys unset).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

KEY_STORE_PASSWORD

private static final String KEY_STORE_PASSWORD

See Also:

• Constant Field Values

TRUST_STORE_PASSWORD

private static final String TRUST_STORE_PASSWORD

See Also:

• Constant Field Values

TEST_UTIL

private static final HBaseTestingUtil TEST_UTIL

REST_TEST_UTIL

private static final HBaseRESTTestingUtility REST_TEST_UTIL

sslClient

private static org.apache.hadoop.hbase.rest.client.Client sslClient

keyDir

private static File keyDir

conf

private org.apache.hadoop.conf.Configuration conf

Constructor Details

TestRESTServerSSL

public TestRESTServerSSL()

Method Details

initializeAlgorithmId

private static void initializeAlgorithmId()

beforeClass

@BeforeAll
public static void beforeClass()
                        throws Exception

Throws:

Exception

afterClass

@AfterAll
public static void afterClass()
                       throws Exception

Throws:

Exception

beforeEachTest

@BeforeEach
public void beforeEachTest()

tearDownAfterTest

@AfterEach
public void tearDownAfterTest()

testSslConnection

@Test
public void testSslConnection()
                       throws Exception

Throws:

Exception

testNonSslClientDenied

@Test
public void testNonSslClientDenied()
                            throws Exception

Throws:

Exception

testSslConnectionUsingKeystoreFormatJKS

@Test
public void testSslConnectionUsingKeystoreFormatJKS()
                                             throws Exception

Throws:

Exception

testSslConnectionUsingKeystoreFormatJCEKS

@Test
public void testSslConnectionUsingKeystoreFormatJCEKS()
                                               throws Exception

Throws:

Exception

testSslConnectionUsingKeystoreFormatPKCS12

@Test
public void testSslConnectionUsingKeystoreFormatPKCS12()
                                                throws Exception

Throws:

Exception

testSslConnectionUsingRoleScopedServerKeys

@Test
public void testSslConnectionUsingRoleScopedServerKeys()
                                                throws Exception

Server started with only the role-scoped hbase.rest.ssl.server.* keys (and legacy keys unset). A successful SSL connection proves the server-scoped keys were consulted.

Throws:

Exception

testSslConnectionFallsBackToLegacyKeystoreKeys

@Test
public void testSslConnectionFallsBackToLegacyKeystoreKeys()
                                                    throws Exception

Backward-compatibility regression: existing deployments that know only about the legacy unscoped keys must continue to work exactly as before. This mirrors testSslConnection() but names the intent explicitly.

Throws:

Exception

testClientAuthNoneAcceptsClientWithoutCert

@Test
public void testClientAuthNoneAcceptsClientWithoutCert()
                                                throws Exception

With client.auth.mode=NONE (the default), a client that presents no client certificate is accepted — matching today's behavior.

Throws:

Exception

testClientAuthWantAllowsAnonymousClient

@Test
public void testClientAuthWantAllowsAnonymousClient()
                                             throws Exception

With client.auth.mode=WANT, an anonymous client (no client cert) is still accepted; the server requests a cert but does not require it.

Throws:

Exception

testClientAuthNeedRejectsClientWithoutCert

@Test
public void testClientAuthNeedRejectsClientWithoutCert()
                                                throws Exception

With client.auth.mode=NEED, an anonymous client (no client cert) is rejected by the server. The base Client configures truststore-only, so it presents no key material to the server.

Throws:

Exception

initKeystoreDir

private static File initKeystoreDir()

generateKeyStore

private static void generateKeyStore(String keyStoreType,
 KeyPair keyPair,
 X509Certificate serverCertificate)
                              throws Exception

Throws:

Exception

generateTrustStore

private static void generateTrustStore(String trustStoreType,
 X509Certificate serverCertificate)
                                throws Exception

Throws:

Exception

getKeystoreFilePath

private static String getKeystoreFilePath(String keyStoreType)

getTruststoreFilePath

private static String getTruststoreFilePath(String trustStoreType)

startRESTServerWithDefaultKeystoreType

private void startRESTServerWithDefaultKeystoreType()
                                             throws Exception

Throws:

Exception

startRESTServer

private void startRESTServer(String storeType)
                      throws Exception

Throws:

Exception