forked from apache/kafka
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
KAFKA-8890: Make SSL context/engine configuration extensible (KIP-519) (
- Loading branch information
1 parent
833dc77
commit 9ba49b8
Showing
11 changed files
with
493 additions
and
191 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
88 changes: 88 additions & 0 deletions
88
clients/src/main/java/org/apache/kafka/common/security/auth/SslEngineFactory.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one or more | ||
| * contributor license agreements. See the NOTICE file distributed with | ||
| * this work for additional information regarding copyright ownership. | ||
| * The ASF licenses this file to You under the Apache License, Version 2.0 | ||
| * (the "License"); you may not use this file except in compliance with | ||
| * the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package org.apache.kafka.common.security.auth; | ||
|
|
||
| import org.apache.kafka.common.Configurable; | ||
|
|
||
| import javax.net.ssl.SSLEngine; | ||
| import java.io.Closeable; | ||
| import java.security.KeyStore; | ||
| import java.util.Map; | ||
| import java.util.Set; | ||
|
|
||
| /** | ||
| * Plugin interface for allowing creation of SSLEngine object in a custom way. | ||
| * Example: You want to use custom way to load your key material and trust material needed for SSLContext. | ||
| * However, keep in mind that this is complementary to the existing Java Security Provider's mechanism and not a competing | ||
| * solution. | ||
| */ | ||
| public interface SslEngineFactory extends Configurable, Closeable { | ||
|
|
||
| /** | ||
| * Create a new SSLEngine object to be used by the client. | ||
| * | ||
| * @param peerHost The peer host to use. This is used in client mode if endpoint validation is enabled. | ||
| * @param peerPort The peer port to use. This is a hint and not used for validation. | ||
| * @param endpointIdentification Endpoint identification algorithm for client mode. | ||
| * @return The new SSLEngine. | ||
| */ | ||
| SSLEngine createClientSslEngine(String peerHost, int peerPort, String endpointIdentification); | ||
|
|
||
| /** | ||
| * Create a new SSLEngine object to be used by the server. | ||
| * | ||
| * @param peerHost The peer host to use. This is a hint and not used for validation. | ||
| * @param peerPort The peer port to use. This is a hint and not used for validation. | ||
| * @return The new SSLEngine. | ||
| */ | ||
| SSLEngine createServerSslEngine(String peerHost, int peerPort); | ||
|
|
||
| /** | ||
| * Returns true if SSLEngine needs to be rebuilt. This method will be called when reconfiguration is triggered on | ||
| * {@link org.apache.kafka.common.security.ssl.SslFactory}. Based on the <i>nextConfigs</i>, this method will | ||
| * decide whether underlying SSLEngine object needs to be rebuilt. If this method returns true, the | ||
| * {@link org.apache.kafka.common.security.ssl.SslFactory} will re-create instance of this object and run other | ||
| * checks before deciding to use the new object for the <i>new incoming connection</i> requests.The existing connections | ||
| * are not impacted by this and will not see any changes done as part of reconfiguration. | ||
| * | ||
| * <pre> | ||
| * Example: If the implementation depends on the file based key material it can check if the file is updated | ||
| * compared to the previous/last-loaded timestamp and return true. | ||
| * </pre> | ||
| * | ||
| * @param nextConfigs The configuration we want to use. | ||
| * @return True only if the underlying SSLEngine object should be rebuilt. | ||
| */ | ||
| boolean shouldBeRebuilt(Map<String, Object> nextConfigs); | ||
|
|
||
| /** | ||
| * Returns the names of configs that may be reconfigured. | ||
| */ | ||
| Set<String> reconfigurableConfigs(); | ||
|
|
||
| /** | ||
| * Returns keystore. | ||
| * @return | ||
| */ | ||
| KeyStore keystore(); | ||
|
|
||
| /** | ||
| * Returns truststore. | ||
| * @return | ||
| */ | ||
| KeyStore truststore(); | ||
| } |
Oops, something went wrong.