This is an automated email from the ASF dual-hosted git repository.
ayushtkn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hive.git
The following commit(s) were added to refs/heads/master by this push:
new 55a514515b4 HIVE-29603: Support SSL cipher suites inclusion for HS2
HTTP mode and Web UI (#6466)
55a514515b4 is described below
commit 55a514515b41bd00e82560ac34200b458993794a
Author: Tanishq Chugh <[email protected]>
AuthorDate: Fri May 8 19:54:06 2026 +0530
HIVE-29603: Support SSL cipher suites inclusion for HS2 HTTP mode and Web
UI (#6466)
---
.../java/org/apache/hadoop/hive/conf/HiveConf.java | 4 ++++
common/src/java/org/apache/hive/http/HttpServer.java | 20 ++++++++++++++++----
.../service/cli/thrift/ThriftHttpCLIService.java | 20 ++++++++++++++------
.../org/apache/hive/service/server/HiveServer2.java | 1 +
4 files changed, 35 insertions(+), 10 deletions(-)
diff --git a/common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
b/common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
index 9db102852f8..31b5e32c2dd 100644
--- a/common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
+++ b/common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
@@ -3858,6 +3858,8 @@ public static enum ConfVars {
"SSL certificate keystore password for HiveServer2 WebUI."),
HIVE_SERVER2_WEBUI_SSL_KEYSTORE_TYPE("hive.server2.webui.keystore.type",
"",
"SSL certificate keystore type for HiveServer2 WebUI."),
+
HIVE_SERVER2_WEBUI_SSL_INCLUDE_CIPHERSUITES("hive.server2.webui.include.ciphersuites",
"",
+ "SSL a list of include cipher suite names separated by colon for
HiveServer2 WebUI."),
HIVE_SERVER2_WEBUI_SSL_EXCLUDE_CIPHERSUITES("hive.server2.webui.exclude.ciphersuites",
"",
"SSL a list of exclude cipher suite names or regular expressions
separated by comma"
+ " for HiveServer2 WebUI."),
@@ -4375,6 +4377,8 @@ public static enum ConfVars {
"SSL certificate keystore type."),
HIVE_SERVER2_SSL_KEYMANAGERFACTORY_ALGORITHM("hive.server2.keymanagerfactory.algorithm",
"",
"SSL certificate keystore algorithm."),
+
HIVE_SERVER2_SSL_HTTP_INCLUDE_CIPHERSUITES("hive.server2.http.include.ciphersuites",
"",
+ "SSL a list of include cipher suite names separated by colon for
HiveServer2 http server."),
HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES("hive.server2.http.exclude.ciphersuites",
"",
"SSL a list of exclude cipher suite names or regular expressions
separated by comma "
+ "for HiveServer2 http server."),
diff --git a/common/src/java/org/apache/hive/http/HttpServer.java
b/common/src/java/org/apache/hive/http/HttpServer.java
index cb1ef743e3d..dd9e66f92b6 100644
--- a/common/src/java/org/apache/hive/http/HttpServer.java
+++ b/common/src/java/org/apache/hive/http/HttpServer.java
@@ -163,6 +163,7 @@ public static class Builder {
private String keyStorePath;
private String keyStoreType;
private String keyManagerFactoryAlgorithm;
+ private String includeCiphersuites;
private String excludeCiphersuites;
private String spnegoPrincipal;
private String spnegoKeytab;
@@ -246,6 +247,11 @@ public Builder setKeyManagerFactoryAlgorithm(String
keyManagerFactoryAlgorithm)
return this;
}
+ public Builder setIncludeCiphersuites(String includeCiphersuites) {
+ this.includeCiphersuites = includeCiphersuites;
+ return this;
+ }
+
public Builder setExcludeCiphersuites(String excludeCiphersuites) {
this.excludeCiphersuites = excludeCiphersuites;
return this;
@@ -668,12 +674,18 @@ ServerConnector createAndAddChannelConnector(int
queueSize, Builder b) {
sslContextFactory.setKeyManagerFactoryAlgorithm(
b.keyManagerFactoryAlgorithm == null ||
b.keyManagerFactoryAlgorithm.isEmpty()?
KeyManagerFactory.getDefaultAlgorithm() :
b.keyManagerFactoryAlgorithm);
+ if (b.includeCiphersuites != null &&
!b.includeCiphersuites.trim().isEmpty()) {
+ Set<String> includeCS = Sets.newHashSet(
+
Splitter.on(":").trimResults().omitEmptyStrings().split(b.includeCiphersuites));
+ if (!includeCS.isEmpty()) {
+ sslContextFactory.setIncludeCipherSuites(includeCS.toArray(new
String[0]));
+ }
+ }
if (b.excludeCiphersuites != null &&
!b.excludeCiphersuites.trim().isEmpty()) {
Set<String> excludeCS = Sets.newHashSet(
-
Splitter.on(",").trimResults().omitEmptyStrings().split(b.excludeCiphersuites.trim()));
- int eSize = excludeCS.size();
- if (eSize > 0) {
- sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new
String[eSize]));
+
Splitter.on(",").trimResults().omitEmptyStrings().split(b.excludeCiphersuites));
+ if (!excludeCS.isEmpty()) {
+ sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new
String[0]));
}
}
Set<String> excludedSSLProtocols = Sets.newHashSet(
diff --git
a/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
b/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
index 795b8622e1b..d8e01cd9690 100644
---
a/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
+++
b/service/src/java/org/apache/hive/service/cli/thrift/ThriftHttpCLIService.java
@@ -173,13 +173,21 @@ public void onClosed(Connection connection) {
sslContextFactory.setKeyStorePassword(keyStorePassword);
sslContextFactory.setKeyStoreType(keyStoreType);
sslContextFactory.setKeyManagerFactoryAlgorithm(keyStoreAlgorithm);
- String excludeCiphersuites =
hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES).trim();
- if (!excludeCiphersuites.trim().isEmpty()) {
+ String includeCiphersuites =
hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_INCLUDE_CIPHERSUITES);
+ if (includeCiphersuites != null &&
!includeCiphersuites.trim().isEmpty()) {
+ Set<String> includeCS = Sets.newHashSet(
+
Splitter.on(":").trimResults().omitEmptyStrings().split(includeCiphersuites));
+ if (!includeCS.isEmpty()) {
+ sslContextFactory.setIncludeCipherSuites(includeCS.toArray(new
String[0]));
+ }
+ }
+
+ String excludeCiphersuites =
hiveConf.getVar(ConfVars.HIVE_SERVER2_SSL_HTTP_EXCLUDE_CIPHERSUITES);
+ if (excludeCiphersuites != null &&
!excludeCiphersuites.trim().isEmpty()) {
Set<String> excludeCS = Sets.newHashSet(
-
Splitter.on(",").trimResults().omitEmptyStrings().split(excludeCiphersuites.trim()));
- int eSize = excludeCS.size();
- if (eSize > 0) {
- sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new
String[eSize]));
+
Splitter.on(",").trimResults().omitEmptyStrings().split(excludeCiphersuites));
+ if (!excludeCS.isEmpty()) {
+ sslContextFactory.setExcludeCipherSuites(excludeCS.toArray(new
String[0]));
}
}
connector = new ServerConnector(server, sslContextFactory, http);
diff --git a/service/src/java/org/apache/hive/service/server/HiveServer2.java
b/service/src/java/org/apache/hive/service/server/HiveServer2.java
index ced00eeb100..5f7f071d765 100644
--- a/service/src/java/org/apache/hive/service/server/HiveServer2.java
+++ b/service/src/java/org/apache/hive/service/server/HiveServer2.java
@@ -489,6 +489,7 @@ private static HttpServer.Builder
createHttpServerBuilder(String webHost, int po
builder.setKeyStoreType(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_KEYSTORE_TYPE));
builder.setKeyManagerFactoryAlgorithm(
hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_KEYMANAGERFACTORY_ALGORITHM));
+
builder.setIncludeCiphersuites(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_INCLUDE_CIPHERSUITES));
builder.setExcludeCiphersuites(hiveConf.getVar(ConfVars.HIVE_SERVER2_WEBUI_SSL_EXCLUDE_CIPHERSUITES));
builder.setUseSSL(true);
}
