This is an automated email from the ASF dual-hosted git repository.
rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git
The following commit(s) were added to refs/heads/master by this push:
new 9c6e9cc6c Hardening: clean up TlsTransportPlugin and surface
unverified peers
9c6e9cc6c is described below
commit 9c6e9cc6c5ff1e77484909fd375b0cebbadf3654
Author: Richard Zowalla <[email protected]>
AuthorDate: Mon Apr 13 20:14:22 2026 +0200
Hardening: clean up TlsTransportPlugin and surface unverified peers
Three small cleanups in TlsTransportPlugin, none of which change
runtime behavior on the live path:
- Extract "CN=ANONYMOUS" into an ANONYMOUS_PRINCIPAL_NAME constant
so it can be grepped for when auditing authorizer rules.
- Raise the SSLPeerUnverifiedException log from debug to warn. The
branch is only reachable when client auth is disabled at the
transport layer (nimbus/supervisor.thrift.tls.client.auth.required
= false), but when it does fire it is worth seeing in production
logs.
- Remove the dead TSSLTransportParameters wiring in getServer().
The params object was built with keystore/truststore settings and
requireClientAuth(true), but never passed to
ReloadableTsslTransportFactory.getServerSocket — the real SSL
context is built inside the factory from the ThriftConnectionType
and conf. Keep the eager keystore/truststore presence checks so
misconfiguration still fails fast with a clear message, and prune
the now-unused TSSLTransportFactory and SecurityUtils imports.
C
---
.../security/auth/tls/TlsTransportPlugin.java | 24 +++++++---------------
1 file changed, 7 insertions(+), 17 deletions(-)
diff --git
a/storm-client/src/jvm/org/apache/storm/security/auth/tls/TlsTransportPlugin.java
b/storm-client/src/jvm/org/apache/storm/security/auth/tls/TlsTransportPlugin.java
index 665d9f1fc..e260c4d0f 100644
---
a/storm-client/src/jvm/org/apache/storm/security/auth/tls/TlsTransportPlugin.java
+++
b/storm-client/src/jvm/org/apache/storm/security/auth/tls/TlsTransportPlugin.java
@@ -37,18 +37,17 @@ import org.apache.storm.thrift.protocol.TBinaryProtocol;
import org.apache.storm.thrift.protocol.TProtocol;
import org.apache.storm.thrift.server.TServer;
import org.apache.storm.thrift.server.TThreadPoolServer;
-import org.apache.storm.thrift.transport.TSSLTransportFactory;
import org.apache.storm.thrift.transport.TServerSocket;
import org.apache.storm.thrift.transport.TSocket;
import org.apache.storm.thrift.transport.TTransport;
import org.apache.storm.thrift.transport.TTransportException;
import org.apache.storm.utils.ExtendedThreadPoolExecutor;
-import org.apache.storm.utils.SecurityUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class TlsTransportPlugin implements ITransportPlugin {
private static final Logger LOG =
LoggerFactory.getLogger(TlsTransportPlugin.class);
+ private static final String ANONYMOUS_PRINCIPAL_NAME = "CN=ANONYMOUS";
protected ThriftConnectionType type;
protected Map<String, Object> conf;
private int port;
@@ -71,22 +70,13 @@ public class TlsTransportPlugin implements ITransportPlugin
{
int configuredPort = type.getPort(conf);
Integer socketTimeout = type.getSocketTimeOut(conf);
- TSSLTransportFactory.TSSLTransportParameters params = new
TSSLTransportFactory.TSSLTransportParameters();
- if (type.getServerKeyStorePath(conf) != null &&
type.getServerKeyStorePassword(conf) != null) {
- params.setKeyStore(type.getServerKeyStorePath(conf),
type.getServerKeyStorePassword(conf), null,
-
SecurityUtils.inferKeyStoreTypeFromPath(type.getServerKeyStorePath(conf)));
- } else {
+ if (type.getServerKeyStorePath(conf) == null ||
type.getServerKeyStorePassword(conf) == null) {
throw new IllegalArgumentException("The server keystore is not
configured properly");
}
- if (type.isClientAuthRequired(conf)) {
- if (type.getServerTrustStorePath(conf) != null &&
type.getServerTrustStorePassword(conf) != null) {
- params.setTrustStore(type.getServerTrustStorePath(conf),
type.getServerTrustStorePassword(conf), null,
-
SecurityUtils.inferKeyStoreTypeFromPath(type.getServerTrustStorePath(conf)));
- params.requireClientAuth(true);
- } else {
- throw new IllegalArgumentException("The server truststore is
not configured properly");
- }
+ if (type.isClientAuthRequired(conf)
+ && (type.getServerTrustStorePath(conf) == null ||
type.getServerTrustStorePassword(conf) == null)) {
+ throw new IllegalArgumentException("The server truststore is not
configured properly");
}
int clientTimeout = (socketTimeout == null ? 0 : socketTimeout);
@@ -152,7 +142,7 @@ public class TlsTransportPlugin implements ITransportPlugin
{
TSocket tsocket = (TSocket) trans;
SSLSocket socket = (SSLSocket) tsocket.getSocket();
- String principalName = "CN=ANONYMOUS";
+ String principalName = ANONYMOUS_PRINCIPAL_NAME;
try {
for (X509Certificate cert:
socket.getSession().getPeerCertificateChain()) {
Principal principal = cert.getSubjectDN();
@@ -160,7 +150,7 @@ public class TlsTransportPlugin implements ITransportPlugin
{
break;
}
} catch (SSLPeerUnverifiedException e) {
- LOG.debug("Client cert is not verified. Set
principalName={}.", principalName, e);
+ LOG.warn("Client cert is not verified. Set principalName={}.",
principalName, e);
}
LOG.debug("principalName : {} ", principalName);
ReqContext reqContext = ReqContext.context();
