Uploaded image for project: 'HBase'
  1. HBase
  2. HBASE-26666

Add native TLS encryption support to RPC server/client

    XMLWordPrintableJSON

Details

    • Hide
      Full support for TLS/SSL encryption in Netty RPC client and server. The implementation is based on Netty's built-in SSL handler and capable of using JDK or OpenSSL implementation whichever is available on the classpath. The feature also supports side-by-side plaintext and encrypted communication which enables upgrading existing clusters with zero downtime.
      Show
      Full support for TLS/SSL encryption in Netty RPC client and server. The implementation is based on Netty's built-in SSL handler and capable of using JDK or OpenSSL implementation whichever is available on the classpath. The feature also supports side-by-side plaintext and encrypted communication which enables upgrading existing clusters with zero downtime.

    Description

      Today, HBase must complete the SASL handshake (saslClient.complete()) prior to turning on any RPC encryption (hbase.rpc.protection=privacy, sasl.QOP=auth-conf).

      This is a problem because we have to transmit the bearer token to the server before we can complete the sasl handshake. This would mean that we would insecurely transmit the bearer token (which is equivalent to any other password) which is a bad smell.

      Ideally, if we can solve this problem for the oauth bearer mechanism, we could also apply it to our delegation token interface for digest-md5 (which, I believe, suffers the same problem).

      The plan is to port Server/Client TLS implementation from the ZooKeeper project. It's a Netty based solution which looks like the best fit for NettyRpc client/server. 

      Attachments

        Issue Links

          incorporates

          New Feature - A new feature of the product, which has yet to be developed. ZOOKEEPER-2120 SSL feature on Netty

          • Major - Major loss of function.
          • Resolved
          is blocked by

          Bug - A problem which impairs or prevents the functions of the product. HBASE-27271 BufferCallBeforeInitHandler should ignore the flush request

          • Major - Major loss of function.
          • Resolved
          is required by

          New Feature - A new feature of the product, which has yet to be developed. HBASE-26553 OAuth Bearer authentication mech plugin for SASL

          • Major - Major loss of function.
          • In Progress

          Task - A task that needs to be done. HBASE-27226 Document native TLS support in Netty RPC

          • Major - Major loss of function.
          • Resolved
          relates to

          New Feature - A new feature of the product, which has yet to be developed. HBASE-27347 Port FileWatcher from ZK to autodetect keystore/truststore changes in TLS connections

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HBASE-27278 Improve TestTlsIPC to reuse existing IPC test code

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HBASE-27279 Make SslHandler work with SaslWrapHandler/SaslUnwrapHandler

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HBASE-27342 Use Hadoop Credentials API to retrieve passwords of TLS key/trust stores

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HBASE-27346 Autodetect key/truststore file type from file extension

          • Major - Major loss of function.
          • Resolved
          links to

          Web Link GitHub Pull Request #4125

          Web Link GitHub Pull Request #4666

          Activity

            People

              andor Andor Molnar
              elserj Josh Elser
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: