This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch 1197 in repository https://gitbox.apache.org/repos/asf/incubator-stormcrawler.git
commit 3acaec5e787d67a2430662d73be7700e40055fa2 Author: Richard Zowalla <[email protected]> AuthorDate: Fri Apr 26 20:16:08 2024 +0200 Fix #1197 - Allow to disable SSL/TLS verification in OpenSearchConnection #1197 --- external/opensearch/opensearch-conf.yaml | 3 +++ .../opensearch/OpenSearchConnection.java | 25 +++++++++++++++++++++- 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/external/opensearch/opensearch-conf.yaml b/external/opensearch/opensearch-conf.yaml index f37b8d5a..032ba06f 100644 --- a/external/opensearch/opensearch-conf.yaml +++ b/external/opensearch/opensearch-conf.yaml @@ -9,6 +9,9 @@ config: #opensearch.password: "PASSWORD" opensearch.concurrentRequests: 2 + # Disable TLS validation for connection to OpenSearch + # opensearch.disable.tls.validation: false + # Indexer bolt # adresses can be specified as a full URL # if not we assume that the protocol is http and the port 9200 diff --git a/external/opensearch/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java b/external/opensearch/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java index d3eb87b7..f62b0131 100644 --- a/external/opensearch/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java +++ b/external/opensearch/src/main/java/org/apache/stormcrawler/opensearch/OpenSearchConnection.java @@ -29,7 +29,10 @@ import org.apache.http.HttpHost; import org.apache.http.auth.AuthScope; import org.apache.http.auth.UsernamePasswordCredentials; import org.apache.http.client.CredentialsProvider; +import org.apache.http.conn.ssl.NoopHostnameVerifier; +import org.apache.http.conn.ssl.TrustAllStrategy; import org.apache.http.impl.client.BasicCredentialsProvider; +import org.apache.http.ssl.SSLContextBuilder; import org.apache.storm.shade.org.apache.commons.lang.StringUtils; import org.apache.stormcrawler.util.ConfUtils; import org.jetbrains.annotations.NotNull; @@ -125,10 +128,18 @@ public final class OpenSearchConnection { ConfUtils.getString( stormConf, Constants.PARAMPREFIX, dottedType, "proxy.scheme", "http"); + final boolean disableTlsValidation = + ConfUtils.getBoolean( + stormConf, + Constants.PARAMPREFIX, + dottedType, + "disable.tls.validation", + false); + final boolean needsUser = StringUtils.isNotBlank(user) && StringUtils.isNotBlank(password); final boolean needsProxy = StringUtils.isNotBlank(proxyhost) && proxyport != -1; - if (needsUser || needsProxy) { + if (needsUser || needsProxy || disableTlsValidation) { builder.setHttpClientConfigCallback( httpClientBuilder -> { if (needsUser) { @@ -142,6 +153,18 @@ public final class OpenSearchConnection { httpClientBuilder.setProxy( new HttpHost(proxyhost, proxyport, proxyscheme)); } + + if (disableTlsValidation) { + try { + final SSLContextBuilder sslContext = new SSLContextBuilder(); + sslContext.loadTrustMaterial(null, new TrustAllStrategy()); + httpClientBuilder.setSSLContext(sslContext.build()); + httpClientBuilder.setSSLHostnameVerifier( + NoopHostnameVerifier.INSTANCE); + } catch (Exception e) { + throw new RuntimeException("Failed to disable TLS validation", e); + } + } return httpClientBuilder; }); }
