-
Notifications
You must be signed in to change notification settings - Fork 12.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
nacos grpc connection supports TLS Encryption (#9980)
support tls encryption on grpc transport on client and server side --------- Co-authored-by: githubcheng2978 <yeliang.cheng@freemud.com>
- Loading branch information
1 parent
81dda26
commit 214e0c9
Showing
59 changed files
with
3,387 additions
and
175 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
156 changes: 156 additions & 0 deletions
156
common/src/main/java/com/alibaba/nacos/common/remote/TlsConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| /* | ||
| * Copyright 1999-2020 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.remote; | ||
|
|
||
| /** | ||
| * gRPC config. | ||
| * | ||
| * @author githubcheng2978 | ||
| */ | ||
| public class TlsConfig { | ||
| /** | ||
| * ssl provider,default OPENSSL,JDK,OPENSSL_REFCNT. | ||
| */ | ||
| private String sslProvider = "OPENSSL"; | ||
|
|
||
| /** | ||
| * enable tls. | ||
| */ | ||
| private Boolean enableTls = false; | ||
|
|
||
| /** | ||
| * tls version: TLSv1.1,TLSv1.2,TLSv1.3 | ||
| * if want to support multi protocol, use comma seperated. like TLSv1.1,TLSv1.2,TLSv1.3 | ||
| */ | ||
| private String protocols; | ||
|
|
||
| /** | ||
| * cipherList, same of usage protocols. | ||
| */ | ||
| private String ciphers; | ||
|
|
||
| /** | ||
| * private key. | ||
| */ | ||
| private String certPrivateKey; | ||
|
|
||
| /** | ||
| * certificate file. | ||
| */ | ||
| private String certChainFile; | ||
|
|
||
| /** | ||
| * read certPrivateKey file when need password. | ||
| */ | ||
| private String certPrivateKeyPassword; | ||
|
|
||
| /** | ||
| * mutualAuth,if true,need provider certPrivateKey and certChainFile. | ||
| */ | ||
| private Boolean mutualAuthEnable = false; | ||
|
|
||
| /** | ||
| * ignore certificate valid. | ||
| */ | ||
| private Boolean trustAll = false; | ||
|
|
||
| /** | ||
| * collection of trust certificate file. | ||
| */ | ||
| private String trustCollectionCertFile; | ||
|
|
||
| public Boolean getEnableTls() { | ||
| return enableTls; | ||
| } | ||
|
|
||
| public void setEnableTls(Boolean enableTls) { | ||
| this.enableTls = enableTls; | ||
| } | ||
|
|
||
| public Boolean getMutualAuthEnable() { | ||
| return mutualAuthEnable; | ||
| } | ||
|
|
||
| public void setMutualAuthEnable(Boolean mutualAuthEnable) { | ||
| this.mutualAuthEnable = mutualAuthEnable; | ||
| } | ||
|
|
||
| public String getProtocols() { | ||
| return protocols; | ||
| } | ||
|
|
||
| public void setProtocols(String protocols) { | ||
| this.protocols = protocols; | ||
| } | ||
|
|
||
| public Boolean getTrustAll() { | ||
| return trustAll; | ||
| } | ||
|
|
||
| public void setTrustAll(Boolean trustAll) { | ||
| this.trustAll = trustAll; | ||
| } | ||
|
|
||
| public String getCiphers() { | ||
| return ciphers; | ||
| } | ||
|
|
||
| public void setCiphers(String ciphers) { | ||
| this.ciphers = ciphers; | ||
| } | ||
|
|
||
| public String getTrustCollectionCertFile() { | ||
| return trustCollectionCertFile; | ||
| } | ||
|
|
||
| public void setTrustCollectionCertFile(String trustCollectionCertFile) { | ||
| this.trustCollectionCertFile = trustCollectionCertFile; | ||
| } | ||
|
|
||
| public String getCertPrivateKeyPassword() { | ||
| return certPrivateKeyPassword; | ||
| } | ||
|
|
||
| public void setCertPrivateKeyPassword(String certPrivateKeyPassword) { | ||
| this.certPrivateKeyPassword = certPrivateKeyPassword; | ||
| } | ||
|
|
||
| public String getCertPrivateKey() { | ||
| return certPrivateKey; | ||
| } | ||
|
|
||
| public void setCertPrivateKey(String certPrivateKey) { | ||
| this.certPrivateKey = certPrivateKey; | ||
| } | ||
|
|
||
| public String getCertChainFile() { | ||
| return certChainFile; | ||
| } | ||
|
|
||
| public void setCertChainFile(String certChainFile) { | ||
| this.certChainFile = certChainFile; | ||
| } | ||
|
|
||
| public String getSslProvider() { | ||
| return sslProvider; | ||
| } | ||
|
|
||
| public void setSslProvider(String sslProvider) { | ||
| this.sslProvider = sslProvider; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
common/src/main/java/com/alibaba/nacos/common/remote/client/RpcClientTlsConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| /* | ||
| * Copyright 1999-2020 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.remote.client; | ||
|
|
||
| import com.alibaba.nacos.common.remote.TlsConfig; | ||
|
|
||
| import java.util.Properties; | ||
|
|
||
| /** | ||
| * gRPC config for sdk. | ||
| * | ||
| * @author githubcheng2978 | ||
| */ | ||
| public class RpcClientTlsConfig extends TlsConfig { | ||
|
|
||
| /** | ||
| * get tls config from properties. | ||
| * @param properties Properties. | ||
| * @return tls of config. | ||
| */ | ||
| public static RpcClientTlsConfig properties(Properties properties) { | ||
| RpcClientTlsConfig tlsConfig = new RpcClientTlsConfig(); | ||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_ENABLE)) { | ||
| tlsConfig.setEnableTls(Boolean.parseBoolean( | ||
| properties.getProperty(RpcConstants.RPC_CLIENT_TLS_ENABLE))); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_PROVIDER)) { | ||
| tlsConfig.setSslProvider(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_PROVIDER)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_MUTUAL_AUTH)) { | ||
| tlsConfig.setMutualAuthEnable(Boolean.parseBoolean( | ||
| properties.getProperty(RpcConstants.RPC_CLIENT_MUTUAL_AUTH))); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_PROTOCOLS)) { | ||
| tlsConfig.setProtocols(RpcConstants.RPC_CLIENT_TLS_PROTOCOLS); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_CIPHERS)) { | ||
| tlsConfig.setCiphers(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_CIPHERS)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_TRUST_COLLECTION_CHAIN_PATH)) { | ||
| tlsConfig.setTrustCollectionCertFile(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_TRUST_COLLECTION_CHAIN_PATH)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_CERT_CHAIN_PATH)) { | ||
| tlsConfig.setCertChainFile(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_CERT_CHAIN_PATH)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_CERT_KEY)) { | ||
| tlsConfig.setCertPrivateKey(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_CERT_KEY)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_TRUST_ALL)) { | ||
| tlsConfig.setTrustAll(Boolean.parseBoolean(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_TRUST_ALL))); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_TRUST_PWD)) { | ||
| tlsConfig.setCertPrivateKeyPassword(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_TRUST_PWD)); | ||
| } | ||
|
|
||
| if (properties.containsKey(RpcConstants.RPC_CLIENT_TLS_PROVIDER)) { | ||
| tlsConfig.setSslProvider(properties.getProperty(RpcConstants.RPC_CLIENT_TLS_PROVIDER)); | ||
| } | ||
| return tlsConfig; | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.