From a7793ce43b854f971990df390b20c156ab669e23 Mon Sep 17 00:00:00 2001 From: ayushis Date: Mon, 17 Jul 2023 13:57:43 -0700 Subject: [PATCH] Parameterized class used for initializing crypto provider --- .build/parent-pom-template.xml | 2 +- .../org/apache/cassandra/config/Config.java | 2 +- .../cassandra/config/DatabaseDescriptor.java | 36 ++++++++++++++----- .../DefaultCryptoProvider.java} | 26 +++++++++----- .../ICryptoProvider.java | 2 +- .../cassandra/service/CassandraDaemon.java | 14 -------- .../apache/cassandra/utils/FBUtilities.java | 8 ----- .../config/DatabaseDescriptorRefTest.java | 3 +- 8 files changed, 49 insertions(+), 44 deletions(-) rename src/java/org/apache/cassandra/{service/AmazonCorrettoCryptoProviderImpl.java => security/DefaultCryptoProvider.java} (76%) rename src/java/org/apache/cassandra/{service => security}/ICryptoProvider.java (97%) diff --git a/.build/parent-pom-template.xml b/.build/parent-pom-template.xml index a60194567b37..56a4022bd019 100644 --- a/.build/parent-pom-template.xml +++ b/.build/parent-pom-template.xml @@ -773,7 +773,7 @@ software.amazon.cryptools AmazonCorrettoCryptoProvider - [2.0, 3.0) + 2.2.0 linux-x86_64 diff --git a/src/java/org/apache/cassandra/config/Config.java b/src/java/org/apache/cassandra/config/Config.java index 842ddb7c72cd..3acea3be27aa 100644 --- a/src/java/org/apache/cassandra/config/Config.java +++ b/src/java/org/apache/cassandra/config/Config.java @@ -79,7 +79,7 @@ public static Set splitCommaDelimited(String src) public String authenticator; public String authorizer; public String role_manager; - public String crypto_provider; + public ParameterizedClass crypto_provider; public String network_authorizer; @Replaces(oldName = "permissions_validity_in_ms", converter = Converters.MILLIS_DURATION_INT, deprecated = true) public volatile DurationSpec.IntMillisecondsBound permissions_validity = new DurationSpec.IntMillisecondsBound("2s"); diff --git a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java index b4557d0424fb..5cd6c0a25410 100644 --- a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java +++ b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java @@ -100,9 +100,8 @@ import org.apache.cassandra.locator.SeedProvider; import org.apache.cassandra.security.EncryptionContext; import org.apache.cassandra.security.SSLFactory; -import org.apache.cassandra.service.AmazonCorrettoCryptoProviderImpl; import org.apache.cassandra.service.CacheService.CacheType; -import org.apache.cassandra.service.ICryptoProvider; +import org.apache.cassandra.security.ICryptoProvider; import org.apache.cassandra.service.paxos.Paxos; import org.apache.cassandra.utils.FBUtilities; import org.apache.cassandra.utils.StorageCompatibilityMode; @@ -176,7 +175,7 @@ public class DatabaseDescriptor private static Config.DiskAccessMode indexAccessMode; - private static ICryptoProvider cryptoProvider = new AmazonCorrettoCryptoProviderImpl(); + private static ICryptoProvider cryptoProvider; private static IAuthenticator authenticator; private static IAuthorizer authorizer; private static INetworkAuthorizer networkAuthorizer; @@ -439,6 +438,8 @@ private static void applyAll() throws ConfigurationException applyTokensConfig(); + applyCryptoProvider(); + applySeedProvider(); applyEncryptionContext(); @@ -880,9 +881,6 @@ else if (conf.commitlog_segment_size.toMebibytes() >= 2048) else if (conf.commitlog_segment_size.toKibibytes() < 2 * conf.max_mutation_size.toKibibytes()) throw new ConfigurationException("commitlog_segment_size must be at least twice the size of max_mutation_size / 1024", false); - if (conf.crypto_provider != null) - cryptoProvider = FBUtilities.newCryptoProvider(conf.crypto_provider); - // native transport encryption options if (conf.client_encryption_options != null) { @@ -1223,6 +1221,25 @@ public static void applySslContext() } } + public static void applyCryptoProvider() + { + try + { + if (conf.crypto_provider == null) + conf.crypto_provider = new ParameterizedClass("org.apache.cassandra.security.DefaultCryptoProvider", null); + + Class cryptoProviderClass = Class.forName(conf.crypto_provider.class_name); + cryptoProvider = (ICryptoProvider)cryptoProviderClass.getConstructor(Map.class).newInstance(conf.crypto_provider.parameters); + + cryptoProvider.installProvider(); + } + catch(Exception e) + { + throw new ConfigurationException("Failed to initialize crypto Provider.", e); + } + + } + public static void applySeedProvider() { // load the seeds for node contact points @@ -1506,10 +1523,11 @@ private static IFailureDetector createFailureDetector(String detectorClassName) return detector; } - public static ICryptoProvider getCryptoProvider() {return cryptoProvider;} + public static ICryptoProvider getCryptoProvider() { return cryptoProvider; } - public void setCryptoProvider(ICryptoProvider cryptoProvider) { - DatabaseDescriptor.cryptoProvider = cryptoProvider; + public void setCryptoProvider(ICryptoProvider cryptoProvider) + { + cryptoProvider = cryptoProvider; } public static IAuthenticator getAuthenticator() { diff --git a/src/java/org/apache/cassandra/service/AmazonCorrettoCryptoProviderImpl.java b/src/java/org/apache/cassandra/security/DefaultCryptoProvider.java similarity index 76% rename from src/java/org/apache/cassandra/service/AmazonCorrettoCryptoProviderImpl.java rename to src/java/org/apache/cassandra/security/DefaultCryptoProvider.java index afcb911b1980..dd85f1342ca4 100644 --- a/src/java/org/apache/cassandra/service/AmazonCorrettoCryptoProviderImpl.java +++ b/src/java/org/apache/cassandra/security/DefaultCryptoProvider.java @@ -16,8 +16,9 @@ * limitations under the License. */ -package org.apache.cassandra.service; +package org.apache.cassandra.security; +import java.util.Map; import javax.crypto.Cipher; import org.slf4j.Logger; @@ -26,15 +27,18 @@ import org.apache.cassandra.exceptions.StartupException; import com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider; -public class AmazonCorrettoCryptoProviderImpl implements ICryptoProvider +public class DefaultCryptoProvider implements ICryptoProvider { - private static final Logger logger = LoggerFactory.getLogger(AmazonCorrettoCryptoProviderImpl.class); + private static final Logger logger = LoggerFactory.getLogger(DefaultCryptoProvider.class); + + public DefaultCryptoProvider(Map args) {} @Override public void installProvider() throws StartupException { try { AmazonCorrettoCryptoProvider.install(); + AmazonCorrettoCryptoProvider.INSTANCE.assertHealthy(); } catch(Exception e) { @@ -45,13 +49,19 @@ public void installProvider() throws StartupException @Override public void checkProvider() throws Exception { - try { - if (Cipher.getInstance("AES/GCM/NoPadding").getProvider().getName().equals(AmazonCorrettoCryptoProvider.PROVIDER_NAME)) { + try + { + if (Cipher.getInstance("AES/GCM/NoPadding").getProvider().getName().equals(AmazonCorrettoCryptoProvider.PROVIDER_NAME)) + { AmazonCorrettoCryptoProvider.INSTANCE.assertHealthy(); - } else { - logger.warn("ACCP is not the highest priority provider"); } - } catch (Exception e) { + else + { + logger.warn("{} is not the highest priority provider", AmazonCorrettoCryptoProvider.class.getName()); + } + } + catch (Exception e) + { logger.warn("Corretto Crypto Provider Error", e); } } diff --git a/src/java/org/apache/cassandra/service/ICryptoProvider.java b/src/java/org/apache/cassandra/security/ICryptoProvider.java similarity index 97% rename from src/java/org/apache/cassandra/service/ICryptoProvider.java rename to src/java/org/apache/cassandra/security/ICryptoProvider.java index 9ece0f6d562f..5a0e9b4cbf00 100644 --- a/src/java/org/apache/cassandra/service/ICryptoProvider.java +++ b/src/java/org/apache/cassandra/security/ICryptoProvider.java @@ -16,7 +16,7 @@ * limitations under the License. */ -package org.apache.cassandra.service; +package org.apache.cassandra.security; import org.apache.cassandra.exceptions.StartupException; diff --git a/src/java/org/apache/cassandra/service/CassandraDaemon.java b/src/java/org/apache/cassandra/service/CassandraDaemon.java index 275b86f927b9..61320f823b53 100644 --- a/src/java/org/apache/cassandra/service/CassandraDaemon.java +++ b/src/java/org/apache/cassandra/service/CassandraDaemon.java @@ -259,8 +259,6 @@ protected void setup() CommitLog.instance.start(); - installCryptoProvider(); - runStartupChecks(); try @@ -490,18 +488,6 @@ protected void setup() completeSetup(); } - public void installCryptoProvider() - { - try - { - DatabaseDescriptor.getCryptoProvider().installProvider(); - } - catch (StartupException e) - { - exitOrFail(e.returnCode, e.getMessage(), e.getCause()); - } - } - public void runStartupChecks() { try diff --git a/src/java/org/apache/cassandra/utils/FBUtilities.java b/src/java/org/apache/cassandra/utils/FBUtilities.java index 5e4cd0399722..6b2ddb0f8658 100644 --- a/src/java/org/apache/cassandra/utils/FBUtilities.java +++ b/src/java/org/apache/cassandra/utils/FBUtilities.java @@ -88,7 +88,6 @@ import org.apache.cassandra.io.util.FileUtils; import org.apache.cassandra.locator.InetAddressAndPort; import org.apache.cassandra.security.ISslContextFactory; -import org.apache.cassandra.service.ICryptoProvider; import org.apache.cassandra.utils.concurrent.FutureCombiner; import org.apache.cassandra.utils.concurrent.UncheckedInterruptedException; import org.objectweb.asm.Opcodes; @@ -637,13 +636,6 @@ static IPartitioner newPartitioner(String partitionerClassName, Optional