forked from alibaba/nacos
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[ISSUE alibaba#11456]Support TLS GRPC communication between clusters.
- Loading branch information
Showing
52 changed files
with
1,971 additions
and
778 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
51 changes: 51 additions & 0 deletions
51
common/src/main/java/com/alibaba/nacos/common/remote/CommunicationType.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| /* | ||
| * Copyright 1999-2023 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.remote; | ||
|
|
||
| /** | ||
| * Enum representing different types of communication. | ||
| * | ||
| * <p>CommunicationType includes:</p> | ||
| * <ul> | ||
| * <li>SDK: Communication between SDK and servers.</li> | ||
| * <li>CLUSTER: Communication between servers in a cluster.</li> | ||
| * </ul> | ||
| * | ||
| * @author stone-98 | ||
| * @date 2023/12/23 | ||
| */ | ||
| public enum CommunicationType { | ||
| /** | ||
| * Communication between SDK and servers. | ||
| */ | ||
| SDK("sdk"), | ||
| /** | ||
| * Communication between servers in a cluster. | ||
| */ | ||
| CLUSTER("cluster"); | ||
|
|
||
| private final String type; | ||
|
|
||
| CommunicationType(String type) { | ||
| this.type = type; | ||
| } | ||
|
|
||
| public String getType() { | ||
| return type; | ||
| } | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
105 changes: 105 additions & 0 deletions
105
common/src/main/java/com/alibaba/nacos/common/remote/client/RpcClusterClientTlsConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| /* | ||
| * Copyright 1999-2023 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.remote.client; | ||
|
|
||
| import com.alibaba.nacos.common.remote.TlsConfig; | ||
| import com.alibaba.nacos.common.utils.StringUtils; | ||
|
|
||
| /** | ||
| * RPC Cluster Client TLS Configuration for Nacos. | ||
| * <p> | ||
| * This class extends the {@link TlsConfig} class and provides a convenient way to create a configuration instance | ||
| * specifically for the RPC (Remote Procedure Call) cluster client in Nacos. | ||
| * </p> | ||
| * <p> | ||
| * To configure RPC cluster client TLS settings, you can use the following system properties: | ||
| * </p> | ||
| * <ul> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.enable}: Enable or disable TLS. Default is {@code false}.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.Provider}: Specify the SSL provider.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.mutualAuth}: Enable or disable mutual authentication. Default is {@code false}.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.protocols}: Specify the TLS protocols.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.ciphers}: Specify the TLS ciphers.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.certChainFile}: Specify the path to the certificate chain file.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.certPrivateKey}: Specify the path to the certificate private key file.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.certPrivateKeyPassword}: Specify the password for the certificate private key.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.trustCollectionCertFile}: Specify the path to the trust collection chain file.</li> | ||
| * <li>{@code nacos.remote.cluster.client.rpc.tls.trustAll}: Enable or disable trusting all certificates. Default is {@code false}.</li> | ||
| * </ul> | ||
| * | ||
| * @author stone-98 | ||
| * @date 2023/12/20 | ||
| */ | ||
| public class RpcClusterClientTlsConfig extends TlsConfig { | ||
|
|
||
| /** | ||
| * Creates a new instance of {@link RpcClusterClientTlsConfig} by loading TLS configuration from system properties. | ||
| * | ||
| * @return A new instance of {@link RpcClusterClientTlsConfig} with loaded TLS configuration. | ||
| */ | ||
| public static RpcClusterClientTlsConfig createConfig() { | ||
| RpcClusterClientTlsConfig tlsConfig = new RpcClusterClientTlsConfig(); | ||
| tlsConfig.setEnableTls(Boolean.getBoolean(RpcConstants.RPC_CLUSTER_CLIENT_TLS_ENABLE)); | ||
| if (!Boolean.getBoolean(RpcConstants.RPC_CLUSTER_CLIENT_TLS_ENABLE)) { | ||
| return tlsConfig; | ||
| } | ||
|
|
||
| String sslProvider = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_PROVIDER); | ||
| if (StringUtils.isNotBlank(sslProvider)) { | ||
| tlsConfig.setSslProvider(sslProvider); | ||
| } | ||
|
|
||
| boolean mutualAuth = Boolean.getBoolean(RpcConstants.RPC_CLUSTER_CLIENT_MUTUAL_AUTH); | ||
| tlsConfig.setMutualAuthEnable(mutualAuth); | ||
|
|
||
| String protocols = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_PROTOCOLS); | ||
| if (StringUtils.isNotBlank(protocols)) { | ||
| tlsConfig.setProtocols(protocols); | ||
| } | ||
|
|
||
| String ciphers = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_CIPHERS); | ||
| if (StringUtils.isNotBlank(ciphers)) { | ||
| tlsConfig.setCiphers(ciphers); | ||
| } | ||
|
|
||
| String certChain = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_CERT_CHAIN_PATH); | ||
| if (StringUtils.isNotBlank(ciphers)) { | ||
| tlsConfig.setCertChainFile(certChain); | ||
| } | ||
|
|
||
| String certPrivateKey = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_CERT_KEY); | ||
| if (StringUtils.isNotBlank(certPrivateKey)) { | ||
| tlsConfig.setCertPrivateKey(certPrivateKey); | ||
| } | ||
|
|
||
| String certPrivateKeyPassword = System.getProperty(RpcConstants.RPC_CLUSTER_CLIENT_TLS_TRUST_PWD); | ||
| if (StringUtils.isNotBlank(certPrivateKeyPassword)) { | ||
| tlsConfig.setCertPrivateKeyPassword(certPrivateKeyPassword); | ||
| } | ||
|
|
||
| String trustCollectionCertFile = System.getProperty( | ||
| RpcConstants.RPC_CLUSTER_CLIENT_TLS_TRUST_COLLECTION_CHAIN_PATH); | ||
| if (StringUtils.isNotBlank(trustCollectionCertFile)) { | ||
| tlsConfig.setTrustCollectionCertFile(trustCollectionCertFile); | ||
| } | ||
|
|
||
| boolean trustAll = Boolean.getBoolean(RpcConstants.RPC_CLUSTER_CLIENT_TLS_TRUST_ALL); | ||
| tlsConfig.setTrustAll(trustAll); | ||
|
|
||
| return tlsConfig; | ||
| } | ||
| } |
Oops, something went wrong.