PakhomovAlexander commented on code in PR #1737:
URL: https://github.com/apache/ignite-3/pull/1737#discussion_r1121883904
##########
docs/_docs/ssl-tls.adoc:
##########
@@ -0,0 +1,181 @@
+= SSL/TLS
+
+This page explains how to configure SSL/TLS encryption between the cluster
nodes (server and client) and the clients that connect to your cluster.
+
+== Considerations
+
+All internal connections in the cluster context, as well as cluster's user
interaction interfaces, are SSL-enabled. The communication categories are as
follows:
+
+* Between the user and the cluster (node): REST
+* Between the user and the platform clients
+* Between nodes: Network (Messaging, Scalecube)
+
+All SSL configurations activities are performed at the node level.
+
+Apache Ignite does not support direct paths to SSL certificates. Instead, it
utilizes PKCS12 and JKS keystore.
+
+== REST
+
+The standard implementation of SSL for REST involves configuring a secure
connection on a separate port. Apache Ignite supports HTTP and HTTPS, arch on
its own port.
+
+The Apache Ignite 3.x REST security configuration is as follows:
+
+[source,json]
+----
+"rest": {
+ "dualProtocol": false,
+ "httpToHttpsRedirection": false,
+ "ssl": {
+ "enabled": false,
+ "port": 10400,
+ "portRange": 100,
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+== Clients and JDBC
+
+Apache Ignite 3.x Client implementation is based on the Netty framework, which
supports configuration for security connections via `SSLContextBuilder`.
+
+=== Client-side Configuration
+
+[source,java]
+----
+SslContextBuilder sslBuilder = SslContextBuilder
+ .forClient()
+ .keyManager(getKeyManagerFactory())
+ .trustManager(getTrustManagerFactory());
+}
+----
+
+=== Server-side Configuration
+
+[source,java]
+----
+SslContextBuilder builder = SslContextBuilder.forServer(certChainInput,
keyInput)
+ .ciphers(getCiphers(), getCiphersFilter())
+ .sessionTimeout(serverSslConfig.getSessionTimeout())
+ .sslProvider(sslProvider);
+.trustManager(trustedCerts.toArray(new X509Certificate[0]))
+ .clientAuth(serverSslConfig.getClientAuth());
+----
+
+Introduce the client configuration on the Apache Ignite 3.x server side and
map it to Netty Security Context:
+
+[source,json]
+----
+"clientConnector": {
+ "ssl": {
+ "enabled": false,
+ "clientAuth": "none",
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ },
+ "trustStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+If you have enabled SSL for `clientConnector`, set the corresponding
properties in
link:https://github.com/apache/ignite-3/blob/be6c8b290894dbd6f88eaaa2a2aafc3eff300855/modules/jdbc/src/main/java/org/apache/ignite/internal/jdbc/ConnectionProperties.java[ConnectionProperties].
+
+== Platform Clients
+
+=== .NET
+
+Add the `IgniteClientConfiguration.SslStreamFactory` property of type
`ISslStreamFactory`.
+
+Provide a
link:https://github.com/apache/ignite/blob/66f43a4bee163aadb3ad731f6eb9a6dfde9faa73/modules/platforms/dotnet/Apache.Ignite.Core/Client/SslStreamFactory.cs[predefined
implementation].
+
+Use the base class library `SslStream`.
+
+Basic usage without client authorization:
+
+[source,csharp]
+----
+var cfg = new IgniteClientConfiguration { SslStreamFactory = new() }
+----
+
+=== C++
+
+This client configuration is under developement.
+
+== CLI Configuration
+
+The CLI, uses OkHTTP to communicate with Apache Ignite 3.x. To enable SSL,
create `SSLSocketFactory` and pass it to the `OkHttpClient` builder:
+
+[source,java]
+----
+X509TrustManager trustManager;
+SSLSocketFactory sslSocketFactory;
+try {
+ trustManager =
trustManagerForCertificates(trustedCertificatesInputStream());
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, new TrustManager[] { trustManager }, null);
+ sslSocketFactory = sslContext.getSocketFactory();
+}
+catch (GeneralSecurityException e) {
+ throw new RuntimeException(e);
+}
+
+client = new OkHttpClient.Builder()
+ .sslSocketFactory(sslSocketFactory, trustManager)
+ .build();
+----
+
+You can enable SSL on the CLI side using the `cli config set` command:
+
+[source,shell]
+----
+cli config set cli.trust-store.type=<type>
+cli config set cli.trust-store.path=<path>
+cli config set cli.trust-store.password=<password>
+----
+
+Store the CLI security configuration in a separate file with permission
settings that protect it from unauthorized read/write operations. This
configuration file must match profiles from the common configuration file.
+
+== Network
+
+The node network is based on the Netty framework. The configuration is the
same as described for the Apache Ignite Client part except for the part that
addresses the Apache Ignite 3.x configuration:
+
+[source,json]
+----
+"network": {
+ "ssl": {
+ "enabled": false,
+ "clientAuth": "none",
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ },
+ "trustStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+== SSL Client Authentication (mTLS Support)
+
+Optionally, the connections you utilize can support the client authentication
feature. Configure it separately for each connection on the server side.
+
+Two-way authentication requires that both server and client have certificates
they reciprocally trust. The client generates a private key, stores it in its
keystore, and gets it signed by an entity the server's truststore trusts.
+
+To support client authentication, a connection must include the `clientAuth`
property, which can have of the following values:
Review Comment:
`clientAuth` is not enough for that. The user also needs to define both
`trustStore` and `keyStore` configurations (as well as the server)
##########
docs/_docs/ssl-tls.adoc:
##########
@@ -0,0 +1,181 @@
+= SSL/TLS
+
+This page explains how to configure SSL/TLS encryption between the cluster
nodes (server and client) and the clients that connect to your cluster.
+
+== Considerations
+
+All internal connections in the cluster context, as well as cluster's user
interaction interfaces, are SSL-enabled. The communication categories are as
follows:
+
+* Between the user and the cluster (node): REST
+* Between the user and the platform clients
+* Between nodes: Network (Messaging, Scalecube)
+
+All SSL configurations activities are performed at the node level.
+
+Apache Ignite does not support direct paths to SSL certificates. Instead, it
utilizes PKCS12 and JKS keystore.
+
+== REST
+
+The standard implementation of SSL for REST involves configuring a secure
connection on a separate port. Apache Ignite supports HTTP and HTTPS, arch on
its own port.
+
+The Apache Ignite 3.x REST security configuration is as follows:
+
+[source,json]
+----
+"rest": {
+ "dualProtocol": false,
+ "httpToHttpsRedirection": false,
+ "ssl": {
+ "enabled": false,
+ "port": 10400,
+ "portRange": 100,
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+== Clients and JDBC
Review Comment:
There is no example of the tcp client and jdbc configuration. Do you plan to
extend the PR or do it in another one? You can check
ItSslTest#ClusterWithSsl#clientCanConnectWithSsl and
ItSslTest#ClusterWithSsl#jdbcCanConnectWithSsl for an example.
##########
docs/_docs/thin-client-comparison.csv:
##########
@@ -0,0 +1,11 @@
+Feature,Java,.NET,C++
+Record Binary View,{yes},{yes},{yes}
+Key-Value Binary View,{yes},{yes},No
+Record View,{yes},{yes},No
+Key-Value View,{yes},{yes},No
+SQL API,{yes},{yes},{yes}
+Partition Awareness,{yes},{yes},No
+Transactions,{yes},{yes},{yes}
+Compute API,{yes},{yes},No
+Retry Policy,{yes},{yes},No
+Heartbeats,{yes},{yes},No
Review Comment:
could you please add an extra end of line here?
##########
docs/_docs/ssl-tls.adoc:
##########
@@ -0,0 +1,181 @@
+= SSL/TLS
+
+This page explains how to configure SSL/TLS encryption between the cluster
nodes (server and client) and the clients that connect to your cluster.
+
+== Considerations
+
+All internal connections in the cluster context, as well as cluster's user
interaction interfaces, are SSL-enabled. The communication categories are as
follows:
+
+* Between the user and the cluster (node): REST
+* Between the user and the platform clients
+* Between nodes: Network (Messaging, Scalecube)
+
+All SSL configurations activities are performed at the node level.
+
+Apache Ignite does not support direct paths to SSL certificates. Instead, it
utilizes PKCS12 and JKS keystore.
+
+== REST
+
+The standard implementation of SSL for REST involves configuring a secure
connection on a separate port. Apache Ignite supports HTTP and HTTPS, arch on
its own port.
+
+The Apache Ignite 3.x REST security configuration is as follows:
+
+[source,json]
+----
+"rest": {
+ "dualProtocol": false,
+ "httpToHttpsRedirection": false,
+ "ssl": {
+ "enabled": false,
+ "port": 10400,
+ "portRange": 100,
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+== Clients and JDBC
+
+Apache Ignite 3.x Client implementation is based on the Netty framework, which
supports configuration for security connections via `SSLContextBuilder`.
+
+=== Client-side Configuration
+
+[source,java]
+----
+SslContextBuilder sslBuilder = SslContextBuilder
+ .forClient()
+ .keyManager(getKeyManagerFactory())
+ .trustManager(getTrustManagerFactory());
+}
+----
+
+=== Server-side Configuration
+
+[source,java]
+----
+SslContextBuilder builder = SslContextBuilder.forServer(certChainInput,
keyInput)
+ .ciphers(getCiphers(), getCiphersFilter())
+ .sessionTimeout(serverSslConfig.getSessionTimeout())
+ .sslProvider(sslProvider);
+.trustManager(trustedCerts.toArray(new X509Certificate[0]))
+ .clientAuth(serverSslConfig.getClientAuth());
+----
+
+Introduce the client configuration on the Apache Ignite 3.x server side and
map it to Netty Security Context:
+
+[source,json]
+----
+"clientConnector": {
+ "ssl": {
+ "enabled": false,
+ "clientAuth": "none",
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ },
+ "trustStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+If you have enabled SSL for `clientConnector`, set the corresponding
properties in
link:https://github.com/apache/ignite-3/blob/be6c8b290894dbd6f88eaaa2a2aafc3eff300855/modules/jdbc/src/main/java/org/apache/ignite/internal/jdbc/ConnectionProperties.java[ConnectionProperties].
+
+== Platform Clients
+
+=== .NET
+
+Add the `IgniteClientConfiguration.SslStreamFactory` property of type
`ISslStreamFactory`.
+
+Provide a
link:https://github.com/apache/ignite/blob/66f43a4bee163aadb3ad731f6eb9a6dfde9faa73/modules/platforms/dotnet/Apache.Ignite.Core/Client/SslStreamFactory.cs[predefined
implementation].
+
+Use the base class library `SslStream`.
+
+Basic usage without client authorization:
+
+[source,csharp]
+----
+var cfg = new IgniteClientConfiguration { SslStreamFactory = new() }
+----
+
+=== C++
+
+This client configuration is under developement.
+
+== CLI Configuration
+
+The CLI, uses OkHTTP to communicate with Apache Ignite 3.x. To enable SSL,
create `SSLSocketFactory` and pass it to the `OkHttpClient` builder:
+
+[source,java]
+----
+X509TrustManager trustManager;
+SSLSocketFactory sslSocketFactory;
+try {
+ trustManager =
trustManagerForCertificates(trustedCertificatesInputStream());
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, new TrustManager[] { trustManager }, null);
+ sslSocketFactory = sslContext.getSocketFactory();
+}
+catch (GeneralSecurityException e) {
+ throw new RuntimeException(e);
+}
+
+client = new OkHttpClient.Builder()
+ .sslSocketFactory(sslSocketFactory, trustManager)
+ .build();
+----
+
+You can enable SSL on the CLI side using the `cli config set` command:
+
+[source,shell]
+----
+cli config set cli.trust-store.type=<type>
+cli config set cli.trust-store.path=<path>
+cli config set cli.trust-store.password=<password>
+----
+
+Store the CLI security configuration in a separate file with permission
settings that protect it from unauthorized read/write operations. This
configuration file must match profiles from the common configuration file.
+
+== Network
+
+The node network is based on the Netty framework. The configuration is the
same as described for the Apache Ignite Client part except for the part that
addresses the Apache Ignite 3.x configuration:
+
+[source,json]
+----
+"network": {
+ "ssl": {
+ "enabled": false,
+ "clientAuth": "none",
+ "keyStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ },
+ "trustStore": {
+ "type": "PKCS12",
+ "path": "must not be empty",
+ "password": "may be empty"
+ }
+ }
+}
+----
+
+== SSL Client Authentication (mTLS Support)
+
+Optionally, the connections you utilize can support the client authentication
feature. Configure it separately for each connection on the server side.
+
+Two-way authentication requires that both server and client have certificates
they reciprocally trust. The client generates a private key, stores it in its
keystore, and gets it signed by an entity the server's truststore trusts.
+
+To support client authentication, a connection must include the `clientAuth`
property, which can have of the following values:
Review Comment:
ItSslTest#ClusterWithSslAndClientAuth might be useful.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
