From 36d1ecc19daff6e8d562ee8110965d7387430150 Mon Sep 17 00:00:00 2001 From: Jon Marius Venstad Date: Fri, 15 Dec 2023 10:22:52 +0100 Subject: Revert "Revert "Revert "Jonmv/zk 3.9.1 clients 2""" --- .../com/yahoo/vespa/zookeeper/Configurator.java | 36 +++++++++++++++++----- .../vespa/zookeeper/DummyVespaZooKeeperServer.java | 1 - .../com/yahoo/vespa/zookeeper/Reconfigurer.java | 1 - .../vespa/zookeeper/VespaZooKeeperServer.java | 24 +++++++++++++++ .../com/yahoo/vespa/zookeeper/ZooKeeperRunner.java | 1 - .../com/yahoo/vespa/zookeeper/package-info.java | 5 +++ .../zookeeper/server/VespaZooKeeperServer.java | 24 --------------- .../yahoo/vespa/zookeeper/server/package-info.java | 5 --- .../yahoo/vespa/zookeeper/ConfiguratorTest.java | 18 +++++------ .../yahoo/vespa/zookeeper/ReconfigurerTest.java | 1 - 10 files changed, 65 insertions(+), 51 deletions(-) create mode 100644 zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/VespaZooKeeperServer.java create mode 100644 zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/package-info.java delete mode 100644 zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/VespaZooKeeperServer.java delete mode 100644 zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/package-info.java (limited to 'zookeeper-server/zookeeper-server-common/src') diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Configurator.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Configurator.java index 14288bab710..727e369885e 100644 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Configurator.java +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Configurator.java @@ -3,10 +3,10 @@ package com.yahoo.vespa.zookeeper; import com.yahoo.cloud.config.ZookeeperServerConfig; import com.yahoo.cloud.config.ZookeeperServerConfig.Server; +import com.yahoo.security.tls.ConfigFileBasedTlsContext; import com.yahoo.security.tls.MixedMode; import com.yahoo.security.tls.TlsContext; import com.yahoo.security.tls.TransportSecurityUtils; -import com.yahoo.vespa.zookeeper.tls.VespaZookeeperTlsContextUtils; import java.io.FileWriter; import java.io.IOException; @@ -47,8 +47,9 @@ public class Configurator { // Doc says that it is max size of data in a zookeeper node, but it goes for everything that // needs to be serialized, see https://issues.apache.org/jira/browse/ZOOKEEPER-1162 for details System.setProperty(ZOOKEEPER_JUTE_MAX_BUFFER, Integer.valueOf(zookeeperServerConfig.juteMaxBuffer()).toString()); - // Need to set this as a system properties instead of config, config does not work + // Need to set these as a system properties instead of config, config does not work System.setProperty("zookeeper.authProvider.x509", "com.yahoo.vespa.zookeeper.VespaMtlsAuthenticationProvider"); + System.setProperty("zookeeper.ssl.authProvider", "x509"); // Need to set this as a system property, otherwise it will be parsed for _every_ packet and an exception will be thrown (and handled) System.setProperty("zookeeper.globalOutstandingLimit", "1000"); System.setProperty("zookeeper.snapshot.compression.method", zookeeperServerConfig.snapshotMethod()); @@ -59,9 +60,13 @@ public class Configurator { } void writeConfigToDisk() { - VespaTlsConfig config = VespaZookeeperTlsContextUtils.tlsContext() - .map(ctx -> new VespaTlsConfig(ctx, TransportSecurityUtils.getInsecureMixedMode())) - .orElse(VespaTlsConfig.tlsDisabled()); + VespaTlsConfig config; + String cfgFile = zookeeperServerConfig.vespaTlsConfigFile(); + if (cfgFile.isBlank()) { + config = VespaTlsConfig.fromSystem(); + } else { + config = VespaTlsConfig.fromConfig(Paths.get(cfgFile)); + } writeConfigToDisk(config); } @@ -85,7 +90,7 @@ public class Configurator { } } - private static String transformConfigToString(ZookeeperServerConfig config, VespaTlsConfig vespaTlsConfig, Map dynamicConfig) { + private String transformConfigToString(ZookeeperServerConfig config, VespaTlsConfig vespaTlsConfig, Map dynamicConfig) { Map configEntries = new LinkedHashMap<>(); configEntries.put("tickTime", Integer.toString(config.tickTime())); configEntries.put("initLimit", Integer.toString(config.initLimit())); @@ -113,7 +118,7 @@ public class Configurator { return transformConfigToString(configEntries); } - static void addServerSpecs(Map configEntries, ZookeeperServerConfig config, Map dynamicConfig) { + void addServerSpecs(Map configEntries, ZookeeperServerConfig config, Map dynamicConfig) { int myIndex = ensureThisServerIsRepresented(config.myid(), config.server()); // If dynamic config refers to servers that are not in the current config, we must ignore it. @@ -205,7 +210,7 @@ public class Configurator { .toList(); } - static Path makeAbsolutePath(String filename) { + Path makeAbsolutePath(String filename) { Path path = Paths.get(filename); return path.isAbsolute() ? path : Paths.get(getDefaults().underVespaHome(filename)); } @@ -215,6 +220,8 @@ public class Configurator { default void appendSharedTlsConfig(Map configEntries, VespaTlsConfig vespaTlsConfig) { vespaTlsConfig.context().ifPresent(ctx -> { + VespaSslContextProvider.set(ctx); + configEntries.put(configFieldPrefix() + ".context.supplier.class", VespaSslContextProvider.class.getName()); String enabledCiphers = Arrays.stream(ctx.parameters().getCipherSuites()).sorted().collect(Collectors.joining(",")); configEntries.put(configFieldPrefix() + ".ciphersuites", enabledCiphers); String enabledProtocols = Arrays.stream(ctx.parameters().getProtocols()).sorted().collect(Collectors.joining(",")); @@ -269,6 +276,19 @@ public class Configurator { this.mixedMode = mixedMode; } + static VespaTlsConfig fromSystem() { + return new VespaTlsConfig( + TransportSecurityUtils.getSystemTlsContext().orElse(null), + TransportSecurityUtils.getInsecureMixedMode()); + } + + static VespaTlsConfig fromConfig(Path file) { + return new VespaTlsConfig( + new ConfigFileBasedTlsContext(file, TransportSecurityUtils.getInsecureAuthorizationMode()), + TransportSecurityUtils.getInsecureMixedMode()); + } + + static VespaTlsConfig tlsDisabled() { return new VespaTlsConfig(null, MixedMode.defaultValue()); } boolean tlsEnabled() { return context != null; } diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/DummyVespaZooKeeperServer.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/DummyVespaZooKeeperServer.java index f99d4cb6881..cc3d5117241 100644 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/DummyVespaZooKeeperServer.java +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/DummyVespaZooKeeperServer.java @@ -3,7 +3,6 @@ package com.yahoo.vespa.zookeeper; import com.yahoo.component.annotation.Inject; import com.yahoo.component.AbstractComponent; -import com.yahoo.vespa.zookeeper.server.VespaZooKeeperServer; import java.nio.file.Path; diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Reconfigurer.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Reconfigurer.java index 201bb7af272..f2886be93d7 100644 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Reconfigurer.java +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/Reconfigurer.java @@ -5,7 +5,6 @@ import com.yahoo.cloud.config.ZookeeperServerConfig; import com.yahoo.component.AbstractComponent; import com.yahoo.component.annotation.Inject; import com.yahoo.protect.Process; -import com.yahoo.vespa.zookeeper.server.VespaZooKeeperServer; import com.yahoo.yolean.Exceptions; import java.time.Duration; diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/VespaZooKeeperServer.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/VespaZooKeeperServer.java new file mode 100644 index 00000000000..ef6083ae5f7 --- /dev/null +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/VespaZooKeeperServer.java @@ -0,0 +1,24 @@ +// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.vespa.zookeeper; + +import java.nio.file.Path; + +/** + * Interface for a component that starts/stops a ZooKeeper server. Implementations should make sure + * that the server is up and accepts connection (typically by returning from constructor only after + * writing a node to ZooKeeper successfully). + * + * @author hmusum + */ +public interface VespaZooKeeperServer { + + /** Shut down the server. Blocks until shutdown has completed */ + void shutdown(); + + /** Start the server with the given config file */ + void start(Path configFilePath); + + /** Whether this server support dynamic reconfiguration */ + boolean reconfigurable(); + +} diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/ZooKeeperRunner.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/ZooKeeperRunner.java index 9c18dde3380..eaae3c74d11 100644 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/ZooKeeperRunner.java +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/ZooKeeperRunner.java @@ -4,7 +4,6 @@ package com.yahoo.vespa.zookeeper; import com.yahoo.cloud.config.ZookeeperServerConfig; import com.yahoo.concurrent.DaemonThreadFactory; import com.yahoo.protect.Process; -import com.yahoo.vespa.zookeeper.server.VespaZooKeeperServer; import com.yahoo.yolean.Exceptions; import java.nio.file.Files; diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/package-info.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/package-info.java new file mode 100644 index 00000000000..f43f095d66d --- /dev/null +++ b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/package-info.java @@ -0,0 +1,5 @@ +// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +@ExportPackage +package com.yahoo.vespa.zookeeper; + +import com.yahoo.osgi.annotation.ExportPackage; diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/VespaZooKeeperServer.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/VespaZooKeeperServer.java deleted file mode 100644 index 0eddf5175d4..00000000000 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/VespaZooKeeperServer.java +++ /dev/null @@ -1,24 +0,0 @@ -// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -package com.yahoo.vespa.zookeeper.server; - -import java.nio.file.Path; - -/** - * Interface for a component that starts/stops a ZooKeeper server. Implementations should make sure - * that the server is up and accepts connection (typically by returning from constructor only after - * writing a node to ZooKeeper successfully). - * - * @author hmusum - */ -public interface VespaZooKeeperServer { - - /** Shut down the server. Blocks until shutdown has completed */ - void shutdown(); - - /** Start the server with the given config file */ - void start(Path configFilePath); - - /** Whether this server support dynamic reconfiguration */ - boolean reconfigurable(); - -} diff --git a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/package-info.java b/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/package-info.java deleted file mode 100644 index fd6967ffbe4..00000000000 --- a/zookeeper-server/zookeeper-server-common/src/main/java/com/yahoo/vespa/zookeeper/server/package-info.java +++ /dev/null @@ -1,5 +0,0 @@ -// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -@ExportPackage -package com.yahoo.vespa.zookeeper.server; - -import com.yahoo.osgi.annotation.ExportPackage; diff --git a/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ConfiguratorTest.java b/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ConfiguratorTest.java index 2a4c8065346..3cf1d07be65 100644 --- a/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ConfiguratorTest.java +++ b/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ConfiguratorTest.java @@ -224,19 +224,17 @@ public class ConfiguratorTest { } private String tlsQuorumConfig() { - return """ - ssl.quorum.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - ssl.quorum.enabledProtocols=TLSv1.2,TLSv1.3 - ssl.quorum.clientAuth=NEED - """; + return "ssl.quorum.context.supplier.class=com.yahoo.vespa.zookeeper.VespaSslContextProvider\n" + + "ssl.quorum.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n" + + "ssl.quorum.enabledProtocols=TLSv1.2,TLSv1.3\n" + + "ssl.quorum.clientAuth=NEED\n"; } private String tlsClientServerConfig() { - return """ - ssl.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - ssl.enabledProtocols=TLSv1.2,TLSv1.3 - ssl.clientAuth=NEED - """; + return "ssl.context.supplier.class=com.yahoo.vespa.zookeeper.VespaSslContextProvider\n" + + "ssl.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n" + + "ssl.enabledProtocols=TLSv1.2,TLSv1.3\n" + + "ssl.clientAuth=NEED\n"; } private void validateConfigFileMultipleHosts(File cfgFile, boolean hosted) { diff --git a/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ReconfigurerTest.java b/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ReconfigurerTest.java index ebf1194fdfe..b21f907ec5d 100644 --- a/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ReconfigurerTest.java +++ b/zookeeper-server/zookeeper-server-common/src/test/java/com/yahoo/vespa/zookeeper/ReconfigurerTest.java @@ -3,7 +3,6 @@ package com.yahoo.vespa.zookeeper; import com.yahoo.cloud.config.ZookeeperServerConfig; import com.yahoo.net.HostName; -import com.yahoo.vespa.zookeeper.server.VespaZooKeeperServer; import org.junit.After; import org.junit.Before; import org.junit.Rule; -- cgit v1.2.3