Skip to content

Commit 8150746

Browse files
zhouxinyuzhouxinyu
committed
Add an interface DecryptionStrategy for SslHelper
1 parent 67cd561 commit 8150746

File tree

3 files changed

+34
-10
lines changed

3 files changed

+34
-10
lines changed

‎remoting/src/main/java/org/apache/rocketmq/remoting/netty/NettyRemotingClient.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import io.netty.handler.timeout.IdleStateEvent;
3535
import io.netty.handler.timeout.IdleStateHandler;
3636
import io.netty.util.concurrent.DefaultEventExecutorGroup;
37+
import java.io.IOException;
3738
import java.net.SocketAddress;
3839
import java.security.cert.CertificateException;
3940
import java.util.Collections;
@@ -52,7 +53,6 @@
5253
import java.util.concurrent.atomic.AtomicReference;
5354
import java.util.concurrent.locks.Lock;
5455
import java.util.concurrent.locks.ReentrantLock;
55-
import javax.net.ssl.SSLException;
5656
import org.apache.rocketmq.remoting.ChannelEventListener;
5757
import org.apache.rocketmq.remoting.InvokeCallback;
5858
import org.apache.rocketmq.remoting.RPCHook;
@@ -133,7 +133,7 @@ public Thread newThread(Runnable r) {
133133
try {
134134
sslContext = SslHelper.buildSslContext(true);
135135
log.info("SSL enabled for client");
136-
} catch (SSLException e) {
136+
} catch (IOException e) {
137137
log.error("Failed to create SSLContext", e);
138138
} catch (CertificateException e) {
139139
log.error("Failed to create SSLContext", e);

‎remoting/src/main/java/org/apache/rocketmq/remoting/netty/NettyRemotingServer.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
import io.netty.handler.timeout.IdleStateEvent;
3838
import io.netty.handler.timeout.IdleStateHandler;
3939
import io.netty.util.concurrent.DefaultEventExecutorGroup;
40+
import java.io.IOException;
4041
import java.net.InetSocketAddress;
4142
import java.security.cert.CertificateException;
4243
import java.util.NoSuchElementException;
@@ -46,7 +47,6 @@
4647
import java.util.concurrent.Executors;
4748
import java.util.concurrent.ThreadFactory;
4849
import java.util.concurrent.atomic.AtomicInteger;
49-
import javax.net.ssl.SSLException;
5050
import org.apache.rocketmq.remoting.ChannelEventListener;
5151
import org.apache.rocketmq.remoting.InvokeCallback;
5252
import org.apache.rocketmq.remoting.RPCHook;
@@ -148,7 +148,7 @@ public Thread newThread(Runnable r) {
148148
log.info("SSLContext created for server");
149149
} catch (CertificateException e) {
150150
log.error("Failed to create SSLContext for server", e);
151-
} catch (SSLException e) {
151+
} catch (IOException e) {
152152
log.error("Failed to create SSLContext for server", e);
153153
}
154154
}

‎remoting/src/main/java/org/apache/rocketmq/remoting/netty/SslHelper.java

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,40 @@
3131
import java.io.InputStream;
3232
import java.security.cert.CertificateException;
3333
import java.util.Properties;
34-
import javax.net.ssl.SSLException;
3534
import org.apache.rocketmq.remoting.common.RemotingHelper;
3635
import org.slf4j.Logger;
3736
import org.slf4j.LoggerFactory;
3837

3938
public class SslHelper {
4039

40+
public interface DecryptionStrategy {
41+
/**
42+
* Decrypt the target encrpted private key file.
43+
*
44+
* @param privateKeyEncryptPath A pathname string
45+
* @param forClient tells whether it's a client-side key file
46+
* @return An input stream for a decrypted key file
47+
* @throws IOException if an I/O error has occurred
48+
*/
49+
InputStream decryptPrivateKey(String privateKeyEncryptPath, boolean forClient) throws IOException;
50+
}
51+
4152
private static final Logger LOGGER = LoggerFactory.getLogger(RemotingHelper.ROCKETMQ_REMOTING);
4253

43-
public static SslContext buildSslContext(boolean forClient) throws SSLException, CertificateException {
54+
private static DecryptionStrategy decryptionStrategy = new DecryptionStrategy() {
55+
@Override
56+
public InputStream decryptPrivateKey(final String privateKeyEncryptPath,
57+
final boolean forClient) throws IOException {
58+
return new FileInputStream(privateKeyEncryptPath);
59+
}
60+
};
61+
62+
63+
public static void registerDecryptionStrategy(final DecryptionStrategy decryptionStrategy) {
64+
SslHelper.decryptionStrategy = decryptionStrategy;
65+
}
66+
67+
public static SslContext buildSslContext(boolean forClient) throws IOException, CertificateException {
4468

4569
File configFile = new File(NettySystemConfig.sslConfigFile);
4670
boolean testMode = !(configFile.exists() && configFile.isFile() && configFile.canRead());
@@ -92,8 +116,8 @@ public static SslContext buildSslContext(boolean forClient) throws SSLException,
92116
}
93117

94118
return sslContextBuilder.keyManager(
95-
properties.containsKey("client.keyCertChainFile") ? new File(properties.getProperty("client.keyCertChainFile")) : null,
96-
properties.containsKey("client.keyFile") ? new File(properties.getProperty("client.keyFile")) : null,
119+
properties.containsKey("client.keyCertChainFile") ? new FileInputStream(properties.getProperty("client.keyCertChainFile")) : null,
120+
properties.containsKey("client.keyFile") ? decryptionStrategy.decryptPrivateKey(properties.getProperty("client.keyFile"), true) : null,
97121
properties.containsKey("client.password") ? properties.getProperty("client.password") : null)
98122
.build();
99123
}
@@ -108,8 +132,8 @@ public static SslContext buildSslContext(boolean forClient) throws SSLException,
108132
.build();
109133
} else {
110134
return SslContextBuilder.forServer(
111-
properties.containsKey("server.keyCertChainFile") ? new File(properties.getProperty("server.keyCertChainFile")) : null,
112-
properties.containsKey("server.keyFile") ? new File(properties.getProperty("server.keyFile")) : null,
135+
properties.containsKey("server.keyCertChainFile") ? new FileInputStream(properties.getProperty("server.keyCertChainFile")) : null,
136+
properties.containsKey("server.keyFile") ? decryptionStrategy.decryptPrivateKey(properties.getProperty("server.keyFile"), false) : null,
113137
properties.containsKey("server.password") ? properties.getProperty("server.password") : null)
114138
.sslProvider(provider)
115139
.trustManager(new File(properties.getProperty("server.trustManager")))

0 commit comments

Comments
 (0)