Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
nrg4878 merged PR #6476: URL: https://github.com/apache/hive/pull/6476 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
sonarqubecloud[bot] commented on PR #6476: URL: https://github.com/apache/hive/pull/6476#issuecomment-4440249974 ## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) **Quality Gate passed** Issues  [4 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=ACCEPTED) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_coverage&view=list)  [1.2% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
VenuReddy2103 commented on code in PR #6476:
URL: https://github.com/apache/hive/pull/6476#discussion_r3232437774
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##
@@ -319,18 +341,23 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
public static TTransport getSSLSocket(String host, int port, int
socketTimeout, int connectionTimeout,
String trustStorePath, String trustStorePassWord, String trustStoreType,
- String trustStoreAlgorithm) throws TTransportException {
-TSSLTransportFactory.TSSLTransportParameters params =
-new TSSLTransportFactory.TSSLTransportParameters();
-String tStoreType = trustStoreType.isEmpty()? KeyStore.getDefaultType() :
trustStoreType;
-String tStoreAlgorithm = trustStoreAlgorithm.isEmpty()?
-TrustManagerFactory.getDefaultAlgorithm() : trustStoreAlgorithm;
-params.setTrustStore(trustStorePath, trustStorePassWord,
-tStoreAlgorithm, tStoreType);
-params.requireClientAuth(true);
+ String trustStoreAlgorithm, String[] includeProtocols, String[]
cipherSuites) throws TTransportException {
+TSSLTransportFactory.TSSLTransportParameters params =
getSSLTransportParameters(false,
+trustStorePath, trustStorePassWord,
+trustStoreAlgorithm.isEmpty() ?
TrustManagerFactory.getDefaultAlgorithm() : trustStoreAlgorithm,
+trustStoreType.isEmpty() ? KeyStore.getDefaultType() : trustStoreType,
+cipherSuites);
// The underlying SSLSocket object is bound to host:port with the given
SO_TIMEOUT and
// connection timeout and SSLContext created with the given params
TSocket tSSLSocket = TSSLTransportFactory.getClientSocket(host, port,
socketTimeout, params);
+if (includeProtocols.length > 0) {
+ SSLSocket sslSocket = (SSLSocket) (tSSLSocket.getSocket());
+ Set includeProtocolsLowerCase =
Arrays.stream(includeProtocols).map(String::toLowerCase)
+ .collect(Collectors.toSet());
+ String[] enabledProtocols =
Arrays.stream(sslSocket.getSupportedProtocols())
+ .filter(protocol ->
includeProtocolsLowerCase.contains(protocol.toLowerCase())).toArray(String[]::new);
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
VenuReddy2103 commented on code in PR #6476:
URL: https://github.com/apache/hive/pull/6476#discussion_r3232436015
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##
@@ -303,14 +319,20 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
}
SSLServerSocket sslServerSocket = (SSLServerSocket)
thriftServerSocket.getServerSocket();
List enabledProtocols = new ArrayList<>();
- for (String protocol : sslServerSocket.getEnabledProtocols()) {
+ for (String protocol : sslServerSocket.getSupportedProtocols()) {
if (sslVersionBlacklistLocal.contains(protocol.toLowerCase())) {
LOG.debug("Disabling SSL Protocol: " + protocol);
} else {
enabledProtocols.add(protocol);
}
}
- sslServerSocket.setEnabledProtocols(enabledProtocols.toArray(new
String[0]));
+ if (includeProtocols.length > 0) {
+Set includeProtocolsLowerCase =
Arrays.stream(includeProtocols).map(String::toLowerCase)
+.collect(Collectors.toSet());
+enabledProtocols = enabledProtocols.stream()
+.filter(protocol ->
includeProtocolsLowerCase.contains(protocol.toLowerCase())).toList();
+ }
+
sslServerSocket.setEnabledProtocols(enabledProtocols.toArray(String[]::new));
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
sonarqubecloud[bot] commented on PR #6476: URL: https://github.com/apache/hive/pull/6476#issuecomment-4437949946 ## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) **Quality Gate passed** Issues  [8 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=ACCEPTED) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_coverage&view=list)  [0.8% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
VenuReddy2103 commented on code in PR #6476:
URL: https://github.com/apache/hive/pull/6476#discussion_r3231635097
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/conf/MetastoreConf.java:
##
@@ -1477,6 +1477,10 @@ public enum ConfVars {
"Metastore SSL certificate truststore type."),
SSL_TRUSTMANAGERFACTORY_ALGORITHM("metastore.trustmanagerfactory.algorithm",
"hive.metastore.trustmanagerfactory.algorithm", "",
"Metastore SSL certificate truststore algorithm."),
+SSL_INCLUDE_PROTOCOLS("metastore.include.protocols",
"hive.metastore.include.protocols", "",
+"List of include SSL protocols separated by comma for Metastore"),
+SSL_INCLUDE_CIPHERSUITES("metastore.include.ciphersuites",
"hive.metastore.include.ciphersuites", "",
+"List of include cipher suite names separated by colon for Metastore"),
Review Comment:
done
##
standalone-metastore/metastore-client/src/main/java/org/apache/hadoop/hive/metastore/client/ThriftHiveMetaStoreClient.java:
##
@@ -575,9 +580,13 @@ private THttpClient createHttpClient(URI store, boolean
useSSL) throws MetaExcep
String trustStorePassword = MetastoreConf.getPassword(conf,
MetastoreConf.ConfVars.SSL_TRUSTSTORE_PASSWORD);
String trustStoreType = MetastoreConf.getVar(conf,
MetastoreConf.ConfVars.SSL_TRUSTSTORE_TYPE).trim();
String trustStoreAlgorithm = MetastoreConf.getVar(conf,
MetastoreConf.ConfVars.SSL_TRUSTMANAGERFACTORY_ALGORITHM).trim();
+String[] includeProtocols =
Iterables.toArray(Splitter.on(",").trimResults().omitEmptyStrings()
+.split(MetastoreConf.getVar(conf,
MetastoreConf.ConfVars.SSL_INCLUDE_PROTOCOLS)), String.class);
+String[] includeCipherSuites =
Iterables.toArray(Splitter.on(":").trimResults().omitEmptyStrings()
+.split(MetastoreConf.getVar(conf,
MetastoreConf.ConfVars.SSL_INCLUDE_CIPHERSUITES)), String.class);
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
VenuReddy2103 commented on code in PR #6476:
URL: https://github.com/apache/hive/pull/6476#discussion_r3231633040
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##
@@ -303,14 +319,20 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
}
SSLServerSocket sslServerSocket = (SSLServerSocket)
thriftServerSocket.getServerSocket();
List enabledProtocols = new ArrayList<>();
- for (String protocol : sslServerSocket.getEnabledProtocols()) {
+ for (String protocol : sslServerSocket.getSupportedProtocols()) {
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
-
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
sonarqubecloud[bot] commented on PR #6476: URL: https://github.com/apache/hive/pull/6476#issuecomment-4432435217 ## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) **Quality Gate passed** Issues  [4 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=ACCEPTED) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_coverage&view=list)  [0.8% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
Copilot commented on code in PR #6476:
URL: https://github.com/apache/hive/pull/6476#discussion_r3227066923
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##
@@ -303,14 +319,20 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
}
SSLServerSocket sslServerSocket = (SSLServerSocket)
thriftServerSocket.getServerSocket();
List enabledProtocols = new ArrayList<>();
- for (String protocol : sslServerSocket.getEnabledProtocols()) {
+ for (String protocol : sslServerSocket.getSupportedProtocols()) {
if (sslVersionBlacklistLocal.contains(protocol.toLowerCase())) {
LOG.debug("Disabling SSL Protocol: " + protocol);
} else {
enabledProtocols.add(protocol);
}
}
- sslServerSocket.setEnabledProtocols(enabledProtocols.toArray(new
String[0]));
+ if (includeProtocols.length > 0) {
+Set includeProtocolsLowerCase =
Arrays.stream(includeProtocols).map(String::toLowerCase)
+.collect(Collectors.toSet());
+enabledProtocols = enabledProtocols.stream()
+.filter(protocol ->
includeProtocolsLowerCase.contains(protocol.toLowerCase())).toList();
+ }
+
sslServerSocket.setEnabledProtocols(enabledProtocols.toArray(String[]::new));
Review Comment:
If includeProtocols is configured but none of the requested protocols are
present after applying the blacklist/intersection, enabledProtocols becomes
empty and sslServerSocket.setEnabledProtocols(...) will throw
IllegalArgumentException at runtime. Please validate the intersection and fail
fast with a clear error message (e.g., list requested protocols and
supported/enabled protocols) instead of letting a low-level exception occur.
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/utils/SecurityUtils.java:
##
@@ -319,18 +341,23 @@ public static TServerSocket getServerSSLSocket(String
hiveHost, int portNum, Str
public static TTransport getSSLSocket(String host, int port, int
socketTimeout, int connectionTimeout,
String trustStorePath, String trustStorePassWord, String trustStoreType,
- String trustStoreAlgorithm) throws TTransportException {
-TSSLTransportFactory.TSSLTransportParameters params =
-new TSSLTransportFactory.TSSLTransportParameters();
-String tStoreType = trustStoreType.isEmpty()? KeyStore.getDefaultType() :
trustStoreType;
-String tStoreAlgorithm = trustStoreAlgorithm.isEmpty()?
-TrustManagerFactory.getDefaultAlgorithm() : trustStoreAlgorithm;
-params.setTrustStore(trustStorePath, trustStorePassWord,
-tStoreAlgorithm, tStoreType);
-params.requireClientAuth(true);
+ String trustStoreAlgorithm, String[] includeProtocols, String[]
cipherSuites) throws TTransportException {
+TSSLTransportFactory.TSSLTransportParameters params =
getSSLTransportParameters(false,
+trustStorePath, trustStorePassWord,
+trustStoreAlgorithm.isEmpty() ?
TrustManagerFactory.getDefaultAlgorithm() : trustStoreAlgorithm,
+trustStoreType.isEmpty() ? KeyStore.getDefaultType() : trustStoreType,
+cipherSuites);
// The underlying SSLSocket object is bound to host:port with the given
SO_TIMEOUT and
// connection timeout and SSLContext created with the given params
TSocket tSSLSocket = TSSLTransportFactory.getClientSocket(host, port,
socketTimeout, params);
+if (includeProtocols.length > 0) {
+ SSLSocket sslSocket = (SSLSocket) (tSSLSocket.getSocket());
+ Set includeProtocolsLowerCase =
Arrays.stream(includeProtocols).map(String::toLowerCase)
+ .collect(Collectors.toSet());
+ String[] enabledProtocols =
Arrays.stream(sslSocket.getSupportedProtocols())
+ .filter(protocol ->
includeProtocolsLowerCase.contains(protocol.toLowerCase())).toArray(String[]::new);
Review Comment:
On the client side, when includeProtocols is set but none of the configured
protocols are supported, enabledProtocols becomes an empty array and
sslSocket.setEnabledProtocols(enabledProtocols) will throw
IllegalArgumentException. Add a check for an empty intersection and throw a
more actionable exception (or fall back to defaults) so misconfiguration is
easier to diagnose.
##
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/conf/MetastoreConf.java:
##
@@ -1477,6 +1477,10 @@ public enum ConfVars {
"Metastore SSL certificate truststore type."),
SSL_TRUSTMANAGERFACTORY_ALGORITHM("metastore.trustmanagerfactory.algorithm",
"hive.metastore.trustmanagerfactory.algorithm", "",
"Metastore SSL certificate truststore algorithm."),
+SSL_INCLUDE_PROTOCOLS("metastore.include.protocols",
"hive.metastore.include.protocols", "",
+"List of include SSL protocols separa
Re: [PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
sonarqubecloud[bot] commented on PR #6476: URL: https://github.com/apache/hive/pull/6476#issuecomment-4429802590 ## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) **Quality Gate passed** Issues  [9 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=6476&issueStatuses=ACCEPTED) Measures  [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=6476&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_coverage&view=list)  [0.8% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=6476&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=6476) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
[PR] HIVE-29606: Support SSL include protocols and cipher suites for Hive Metastore [hive]
VenuReddy2103 opened a new pull request, #6476: URL: https://github.com/apache/hive/pull/6476 ### What changes were proposed in this pull request? Added `hive.metastore.include.protocols` and `hive.metastore.include.ciphersuites` properties to HMS configuration. ### Why are the changes needed? Allows administrators to enforce modern cryptographic standards (e.g., forcing TLS 1.2+ or specific high-strength ciphers). ### Does this PR introduce _any_ user-facing change? Yes. User can now enforce to use strong secure versions like TLSv1.2 or TLSv1.3 with `hive.metastore.include.protocols` and can configure stronger ciphers like AES-128-GCM with `hive.metastore.include.ciphersuites` properties for communication to HMS. ### How was this patch tested? Manual testing -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] - To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
