Package org.apache.hadoop.hbase.io.crypto.tls

Class HBaseTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

org.apache.hadoop.hbase.io.crypto.tls.HBaseTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

@Private
public class HBaseTrustManager
extends X509ExtendedTrustManager

A custom TrustManager that supports hostname verification We attempt to perform verification using just the IP address first and if that fails will attempt to perform a reverse DNS lookup and verify using the hostname. This file has been copied from the Apache ZooKeeper project.

See Also:

• Base revision

Field Summary

Fields

Modifier and Type	Field	Description
private final boolean	allowReverseDnsLookup
private final boolean	hostnameVerificationEnabled
private final HBaseHostnameVerifier	hostnameVerifier
private static final org.slf4j.Logger	LOG
private final X509ExtendedTrustManager	x509ExtendedTrustManager

Constructor Summary

Constructors

Constructor	Description
HBaseTrustManager(X509ExtendedTrustManager x509ExtendedTrustManager, boolean hostnameVerificationEnabled, boolean allowReverseDnsLookup)	Instantiate a new HBaseTrustManager.

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(X509Certificate[] chain, String authType)
void	checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
void	checkServerTrusted(X509Certificate[] chain, String authType)
void	checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
X509Certificate[]	getAcceptedIssuers()
private void	performHostVerification(InetAddress inetAddress, X509Certificate certificate)	Compares peer's hostname with the one stored in the provided client certificate.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

LOG

private static final org.slf4j.Logger LOG

x509ExtendedTrustManager

private final X509ExtendedTrustManager x509ExtendedTrustManager

hostnameVerificationEnabled

private final boolean hostnameVerificationEnabled

allowReverseDnsLookup

private final boolean allowReverseDnsLookup

hostnameVerifier

private final HBaseHostnameVerifier hostnameVerifier

Constructor Details

HBaseTrustManager

HBaseTrustManager(X509ExtendedTrustManager x509ExtendedTrustManager,
 boolean hostnameVerificationEnabled,
 boolean allowReverseDnsLookup)

Instantiate a new HBaseTrustManager.

Parameters:

x509ExtendedTrustManager - The trustmanager to use for checkClientTrusted/checkServerTrusted logic

hostnameVerificationEnabled - If true, this TrustManager should verify hostnames of peers when checking trust.

allowReverseDnsLookup - If true, we will fall back on reverse dns if resolving of host fails

Method Details

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

performHostVerification

private void performHostVerification(InetAddress inetAddress,
 X509Certificate certificate)
                              throws CertificateException

Compares peer's hostname with the one stored in the provided client certificate. Performs verification with the help of provided HostnameVerifier.

Parameters:

inetAddress - Peer's inet address.

certificate - Peer's certificate

Throws:

CertificateException - Thrown if the provided certificate doesn't match the peer hostname.