aratno commented on code in PR #1907:
URL:
https://github.com/apache/cassandra-java-driver/pull/1907#discussion_r1476658241
##########
core/src/main/resources/reference.conf:
##########
@@ -790,6 +790,13 @@ datastax-java-driver {
// truststore-password = password123
// keystore-path = /path/to/client.keystore
// keystore-password = password123
+
+ # The duration between attempts to reload the keystore from the contents
of the file specified
+ # by `keystore-path`. This is mainly relevant in environments where
certificates have short
+ # lifetimes and applications are restarted infrequently, since an expired
client certificate
+ # will prevent new connections from being established until the
application is restarted. If
+ # not set, defaults to not reload the keystore.
+ // keystore-reload-interval = 30 minutes
Review Comment:
We talked about this and a few other things on Slack - decided to keep the
commented-out config as a way to disable reloading by default. It's possible we
enable it by default in the future, when mTLS is more popular, but that's for
another day.
##########
core/src/main/java/com/datastax/oss/driver/internal/core/ssl/ReloadingKeyManagerFactory.java:
##########
@@ -0,0 +1,253 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.datastax.oss.driver.internal.core.ssl;
+
+import
com.datastax.oss.driver.shaded.guava.common.annotations.VisibleForTesting;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.Socket;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.Provider;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.KeyManagerFactorySpi;
+import javax.net.ssl.ManagerFactoryParameters;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.X509ExtendedKeyManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ReloadingKeyManagerFactory extends KeyManagerFactory implements
AutoCloseable {
+ private static final Logger logger =
LoggerFactory.getLogger(ReloadingKeyManagerFactory.class);
+ private static final String KEYSTORE_TYPE = "JKS";
+ private Path keystorePath;
+ private String keystorePassword;
+ private ScheduledExecutorService executor;
+ private final Spi spi;
+
+ // We're using a single thread executor so this shouldn't need to be
volatile, since all updates
+ // to lastDigest should come from the same thread
+ private volatile byte[] lastDigest;
+
+ /**
+ * Create a new {@link ReloadingKeyManagerFactory} with the given keystore
file and password,
+ * reloading from the file's content at the given interval. This function
will do an initial
+ * reload before returning, to confirm that the file exists and is readable.
+ *
+ * @param keystorePath the keystore file to reload
+ * @param keystorePassword the keystore password
+ * @param reloadInterval the duration between reload attempts. Set to {@link
+ * java.time.Duration#ZERO} to disable scheduled reloading.
+ * @return
+ */
+ public static ReloadingKeyManagerFactory create(
+ Path keystorePath, String keystorePassword, Duration reloadInterval)
+ throws UnrecoverableKeyException, KeyStoreException,
NoSuchAlgorithmException,
+ CertificateException, IOException {
+ KeyManagerFactory kmf =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+
+ KeyStore ks;
+ try (InputStream ksf = Files.newInputStream(keystorePath)) {
+ ks = KeyStore.getInstance(KEYSTORE_TYPE);
+ ks.load(ksf, keystorePassword.toCharArray());
+ }
+ kmf.init(ks, keystorePassword.toCharArray());
+
+ ReloadingKeyManagerFactory reloadingKeyManagerFactory = new
ReloadingKeyManagerFactory(kmf);
+ reloadingKeyManagerFactory.start(keystorePath, keystorePassword,
reloadInterval);
+ return reloadingKeyManagerFactory;
+ }
+
+ @VisibleForTesting
+ protected ReloadingKeyManagerFactory(KeyManagerFactory initial) {
+ this(
+ new Spi((X509ExtendedKeyManager) initial.getKeyManagers()[0]),
+ initial.getProvider(),
+ initial.getAlgorithm());
+ }
+
+ private ReloadingKeyManagerFactory(Spi spi, Provider provider, String
algorithm) {
+ super(spi, provider, algorithm);
+ this.spi = spi;
+ }
+
+ private void start(Path keystorePath, String keystorePassword, Duration
reloadInterval) {
+ this.keystorePath = keystorePath;
+ this.keystorePassword = keystorePassword;
+
+ // Ensure that reload is called once synchronously, to make sure the file
exists etc.
+ reload();
+
+ if (!reloadInterval.isZero()) {
+ this.executor =
+ Executors.newScheduledThreadPool(
+ 1,
+ runnable -> {
+ Thread t =
Executors.defaultThreadFactory().newThread(runnable);
+ t.setName(String.format("%s-%%d",
this.getClass().getSimpleName()));
+ t.setDaemon(true);
+ return t;
+ });
+ this.executor.scheduleWithFixedDelay(
+ this::reload,
+ reloadInterval.toMillis(),
+ reloadInterval.toMillis(),
+ TimeUnit.MILLISECONDS);
+ }
+ }
+
+ @VisibleForTesting
+ void reload() {
+ try {
+ reload0();
+ } catch (Exception e) {
+ String msg =
+ "Failed to reload KeyStore. If this continues to happen, your client
may use stale identity"
+ + "certificates and fail to re-establish connections to
Cassandra hosts.";
Review Comment:
Thanks for noticing this!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
