This is an automated email from the ASF dual-hosted git repository.
crazyhzm pushed a commit to branch 3.0
in repository https://gitbox.apache.org/repos/asf/dubbo.git
The following commit(s) were added to refs/heads/3.0 by this push:
new 838493c Fix netty ssl file leak (#9245)
838493c is described below
commit 838493c4c4eaa09fe7291ef6e6963bf816475219
Author: haoyann <[email protected]>
AuthorDate: Wed Nov 10 13:35:29 2021 +0800
Fix netty ssl file leak (#9245)
---
.../org/apache/dubbo/remoting/api/SslContexts.java | 50 +++++++++++++++++-----
.../dubbo/rpc/protocol/grpc/GrpcOptionsUtils.java | 48 +++++++++++++++++----
2 files changed, 80 insertions(+), 18 deletions(-)
diff --git
a/dubbo-remoting/dubbo-remoting-api/src/main/java/org/apache/dubbo/remoting/api/SslContexts.java
b/dubbo-remoting/dubbo-remoting-api/src/main/java/org/apache/dubbo/remoting/api/SslContexts.java
index adcf383..cd7320a 100644
---
a/dubbo-remoting/dubbo-remoting-api/src/main/java/org/apache/dubbo/remoting/api/SslContexts.java
+++
b/dubbo-remoting/dubbo-remoting-api/src/main/java/org/apache/dubbo/remoting/api/SslContexts.java
@@ -28,6 +28,7 @@ import org.apache.dubbo.config.SslConfig;
import org.apache.dubbo.config.context.ConfigManager;
import javax.net.ssl.SSLException;
+import java.io.IOException;
import java.io.InputStream;
import java.security.Provider;
import java.security.Security;
@@ -41,22 +42,32 @@ public class SslContexts {
SslConfig sslConfig = globalConfigManager.getSsl().orElseThrow(() ->
new IllegalStateException("Ssl enabled, but no ssl cert information
provided!"));
SslContextBuilder sslClientContextBuilder;
+ InputStream serverKeyCertChainPathStream = null;
+ InputStream serverPrivateKeyPathStream = null;
+ InputStream serverTrustCertStream = null;
try {
+ serverKeyCertChainPathStream =
sslConfig.getServerKeyCertChainPathStream();
+ serverPrivateKeyPathStream =
sslConfig.getServerPrivateKeyPathStream();
+ serverTrustCertStream =
sslConfig.getServerTrustCertCollectionPathStream();
String password = sslConfig.getServerKeyPassword();
if (password != null) {
- sslClientContextBuilder =
SslContextBuilder.forServer(sslConfig.getServerKeyCertChainPathStream(),
- sslConfig.getServerPrivateKeyPathStream(), password);
+ sslClientContextBuilder =
SslContextBuilder.forServer(serverKeyCertChainPathStream,
+ serverPrivateKeyPathStream, password);
} else {
- sslClientContextBuilder =
SslContextBuilder.forServer(sslConfig.getServerKeyCertChainPathStream(),
- sslConfig.getServerPrivateKeyPathStream());
+ sslClientContextBuilder =
SslContextBuilder.forServer(serverKeyCertChainPathStream,
+ serverPrivateKeyPathStream);
}
- if (sslConfig.getServerTrustCertCollectionPathStream() != null) {
-
sslClientContextBuilder.trustManager(sslConfig.getServerTrustCertCollectionPathStream());
+ if (serverTrustCertStream != null) {
+ sslClientContextBuilder.trustManager(serverTrustCertStream);
sslClientContextBuilder.clientAuth(ClientAuth.REQUIRE);
}
} catch (Exception e) {
throw new IllegalArgumentException("Could not find certificate
file or the certificate is invalid.", e);
+ } finally {
+ safeCloseStream(serverTrustCertStream);
+ safeCloseStream(serverKeyCertChainPathStream);
+ safeCloseStream(serverPrivateKeyPathStream);
}
try {
return
sslClientContextBuilder.sslProvider(findSslProvider()).build();
@@ -70,13 +81,17 @@ public class SslContexts {
SslConfig sslConfig = globalConfigManager.getSsl().orElseThrow(() ->
new IllegalStateException("Ssl enabled, but no ssl cert information
provided!"));
SslContextBuilder builder = SslContextBuilder.forClient();
+ InputStream clientTrustCertCollectionPath = null;
+ InputStream clientCertChainFilePath = null;
+ InputStream clientPrivateKeyFilePath = null;
try {
- if (sslConfig.getClientTrustCertCollectionPathStream() != null) {
-
builder.trustManager(sslConfig.getClientTrustCertCollectionPathStream());
+ clientTrustCertCollectionPath =
sslConfig.getClientTrustCertCollectionPathStream();
+ if (clientTrustCertCollectionPath != null) {
+ builder.trustManager(clientTrustCertCollectionPath);
}
- InputStream clientCertChainFilePath =
sslConfig.getClientKeyCertChainPathStream();
- InputStream clientPrivateKeyFilePath =
sslConfig.getClientPrivateKeyPathStream();
+ clientCertChainFilePath =
sslConfig.getClientKeyCertChainPathStream();
+ clientPrivateKeyFilePath =
sslConfig.getClientPrivateKeyPathStream();
if (clientCertChainFilePath != null && clientPrivateKeyFilePath !=
null) {
String password = sslConfig.getClientKeyPassword();
if (password != null) {
@@ -87,6 +102,10 @@ public class SslContexts {
}
} catch (Exception e) {
throw new IllegalArgumentException("Could not find certificate
file or find invalid certificate.", e);
+ } finally {
+ safeCloseStream(clientTrustCertCollectionPath);
+ safeCloseStream(clientCertChainFilePath);
+ safeCloseStream(clientPrivateKeyFilePath);
}
try {
return builder.sslProvider(findSslProvider()).build();
@@ -116,4 +135,15 @@ public class SslContexts {
return (jdkProviders != null && jdkProviders.length > 0);
}
+ private static void safeCloseStream(InputStream stream) {
+ if (stream == null) {
+ return;
+ }
+ try {
+ stream.close();
+ } catch (IOException e) {
+ logger.warn("Failed to close a stream.", e);
+ }
+ }
+
}
diff --git
a/dubbo-rpc/dubbo-rpc-grpc/src/main/java/org/apache/dubbo/rpc/protocol/grpc/GrpcOptionsUtils.java
b/dubbo-rpc/dubbo-rpc-grpc/src/main/java/org/apache/dubbo/rpc/protocol/grpc/GrpcOptionsUtils.java
index 95efe7f..c6a8b15 100644
---
a/dubbo-rpc/dubbo-rpc-grpc/src/main/java/org/apache/dubbo/rpc/protocol/grpc/GrpcOptionsUtils.java
+++
b/dubbo-rpc/dubbo-rpc-grpc/src/main/java/org/apache/dubbo/rpc/protocol/grpc/GrpcOptionsUtils.java
@@ -27,6 +27,8 @@ import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslContextBuilder;
import org.apache.dubbo.common.URL;
import org.apache.dubbo.common.extension.ExtensionLoader;
+import org.apache.dubbo.common.logger.Logger;
+import org.apache.dubbo.common.logger.LoggerFactory;
import org.apache.dubbo.common.threadpool.ThreadPool;
import org.apache.dubbo.common.utils.CollectionUtils;
import org.apache.dubbo.config.SslConfig;
@@ -37,6 +39,7 @@ import
org.apache.dubbo.rpc.protocol.grpc.interceptors.ServerInterceptor;
import org.apache.dubbo.rpc.protocol.grpc.interceptors.ServerTransportFilter;
import javax.net.ssl.SSLException;
+import java.io.IOException;
import java.io.InputStream;
import java.util.ArrayList;
import java.util.List;
@@ -61,6 +64,8 @@ import static
org.apache.dubbo.rpc.protocol.grpc.GrpcConstants.TRANSPORT_FILTERS
*/
public class GrpcOptionsUtils {
+ private static final Logger logger =
LoggerFactory.getLogger(GrpcOptionsUtils.class);
+
static ServerBuilder buildServerBuilder(URL url, NettyServerBuilder
builder) {
int maxInboundMessageSize = url.getParameter(MAX_INBOUND_MESSAGE_SIZE,
0);
@@ -155,23 +160,32 @@ public class GrpcOptionsUtils {
SslConfig sslConfig = globalConfigManager.getSsl().orElseThrow(() ->
new IllegalStateException("Ssl enabled, but no ssl cert information
provided!"));
SslContextBuilder sslClientContextBuilder = null;
+ InputStream serverKeyCertChainPathStream = null;
+ InputStream serverPrivateKeyPathStream = null;
+ InputStream trustCertCollectionFilePath = null;
try {
+ serverKeyCertChainPathStream =
sslConfig.getServerKeyCertChainPathStream();
+ serverPrivateKeyPathStream =
sslConfig.getServerPrivateKeyPathStream();
String password = sslConfig.getServerKeyPassword();
if (password != null) {
- sslClientContextBuilder =
GrpcSslContexts.forServer(sslConfig.getServerKeyCertChainPathStream(),
- sslConfig.getServerPrivateKeyPathStream(), password);
+ sslClientContextBuilder =
GrpcSslContexts.forServer(serverKeyCertChainPathStream,
+ serverPrivateKeyPathStream, password);
} else {
- sslClientContextBuilder =
GrpcSslContexts.forServer(sslConfig.getServerKeyCertChainPathStream(),
- sslConfig.getServerPrivateKeyPathStream());
+ sslClientContextBuilder =
GrpcSslContexts.forServer(serverKeyCertChainPathStream,
+ serverPrivateKeyPathStream);
}
- InputStream trustCertCollectionFilePath =
sslConfig.getServerTrustCertCollectionPathStream();
+ trustCertCollectionFilePath =
sslConfig.getServerTrustCertCollectionPathStream();
if (trustCertCollectionFilePath != null) {
sslClientContextBuilder.trustManager(trustCertCollectionFilePath);
sslClientContextBuilder.clientAuth(ClientAuth.REQUIRE);
}
} catch (Exception e) {
throw new IllegalArgumentException("Could not find certificate
file or the certificate is invalid.", e);
+ } finally {
+ safeCloseStream(trustCertCollectionFilePath);
+ safeCloseStream(serverKeyCertChainPathStream);
+ safeCloseStream(serverPrivateKeyPathStream);
}
try {
return sslClientContextBuilder.build();
@@ -186,13 +200,16 @@ public class GrpcOptionsUtils {
SslContextBuilder builder = GrpcSslContexts.forClient();
+ InputStream trustCertCollectionFilePath = null;
+ InputStream clientCertChainFilePath = null;
+ InputStream clientPrivateKeyFilePath = null;
try {
- InputStream trustCertCollectionFilePath =
sslConfig.getClientTrustCertCollectionPathStream();
+ trustCertCollectionFilePath =
sslConfig.getClientTrustCertCollectionPathStream();
if (trustCertCollectionFilePath != null) {
builder.trustManager(trustCertCollectionFilePath);
}
- InputStream clientCertChainFilePath =
sslConfig.getClientKeyCertChainPathStream();
- InputStream clientPrivateKeyFilePath =
sslConfig.getClientPrivateKeyPathStream();
+ clientCertChainFilePath =
sslConfig.getClientKeyCertChainPathStream();
+ clientPrivateKeyFilePath =
sslConfig.getClientPrivateKeyPathStream();
if (clientCertChainFilePath != null && clientPrivateKeyFilePath !=
null) {
String password = sslConfig.getClientKeyPassword();
if (password != null) {
@@ -203,6 +220,10 @@ public class GrpcOptionsUtils {
}
} catch (Exception e) {
throw new IllegalArgumentException("Could not find certificate
file or find invalid certificate.", e);
+ } finally {
+ safeCloseStream(trustCertCollectionFilePath);
+ safeCloseStream(clientCertChainFilePath);
+ safeCloseStream(clientPrivateKeyFilePath);
}
try {
return builder.build();
@@ -220,4 +241,15 @@ public class GrpcOptionsUtils {
}
return Optional.empty();
}
+
+ private static void safeCloseStream(InputStream stream) {
+ if (stream == null) {
+ return;
+ }
+ try {
+ stream.close();
+ } catch (IOException e) {
+ logger.warn("Failed to close a stream.", e);
+ }
+ }
}
