Skip to content

Commit ace8145

Browse files
steveloughransteveloughran
committed
Print JVM security properties in storediag and sysinfo
1 parent 6dddb40 commit ace8145

7 files changed

Lines changed: 94 additions & 9 deletions

File tree

‎src/main/java/org/apache/hadoop/fs/store/StoreEntryPoint.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@
7575
import static org.apache.hadoop.fs.store.StoreExitCodes.E_USAGE;
7676
import static org.apache.hadoop.fs.store.StoreUtils.split;
7777
import static org.apache.hadoop.fs.store.diag.OptionSets.CLOUD_CONNECTOR_LOGS;
78+
import static org.apache.hadoop.fs.store.diag.OptionSets.JAVAX_NET_DEBUG;
79+
import static org.apache.hadoop.fs.store.diag.OptionSets.NET_DEBUG_SSL_HANDSHAKE;
7880
import static org.apache.hadoop.fs.store.diag.S3ADiagnosticsInfo.DIRECTORY_MARKER_RETENTION;
7981
import static org.apache.hadoop.fs.store.diag.S3ADiagnosticsInfo.FS_S3A_CONNECTION_MAXIMUM;
8082
import static org.apache.hadoop.fs.store.diag.S3ADiagnosticsInfo.FS_S3A_THREADS_MAX;
@@ -403,6 +405,7 @@ protected void maybeEnableDebugLogging() {
403405
if (hasOption(DEBUG)) {
404406
println("Enabling debug logging");
405407
enableJvmLogging();
408+
enableSSLLogging();
406409
enableCloudConnectorLogging(getLogOverrides(), LogControl.LogLevel.DEBUG);
407410
}
408411
}
@@ -440,6 +443,11 @@ protected void enableJvmLogging() {
440443
log.setLevel(ALL);
441444
}
442445

446+
protected void enableSSLLogging() {
447+
// javax.net.debug=ssl:handshake
448+
System.setProperty(JAVAX_NET_DEBUG, NET_DEBUG_SSL_HANDSHAKE);
449+
}
450+
443451
/**
444452
* Enable cloud connector logging.
445453
* @param level desired level

‎src/main/java/org/apache/hadoop/fs/store/commands/TLSInfo.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import static java.util.Arrays.asList;
4343
import static org.apache.hadoop.fs.store.CommonParameters.STANDARD_OPTS;
4444
import static org.apache.hadoop.fs.store.diag.OptionSets.STANDARD_ENV_VARS;
45+
import static org.apache.hadoop.fs.store.diag.OptionSets.STANDARD_SECURITY_PROPS;
4546
import static org.apache.hadoop.fs.store.diag.OptionSets.TLS_ENV_VARS;
4647
import static org.apache.hadoop.fs.store.diag.OptionSets.TLS_SYSPROPS;
4748

@@ -57,7 +58,7 @@ public class TLSInfo extends DiagnosticsEntryPoint {
5758
+ STANDARD_OPTS;
5859

5960
public TLSInfo() {
60-
createCommandFormat(1,1);
61+
createCommandFormat(0,1);
6162
}
6263

6364
@Override
@@ -70,6 +71,7 @@ public int run(String[] args) throws Exception {
7071
System::getProperty);
7172

7273
printEnvVars(TLS_ENV_VARS);
74+
printSecurityProperties(STANDARD_SECURITY_PROPS);
7375

7476
println();
7577
tlsInfo(this);
@@ -177,7 +179,7 @@ public static int certInfo(
177179
printout.heading(heading);
178180
for (X509Certificate cert : x509Certificates) {
179181
final X500Principal principal = cert.getSubjectX500Principal();
180-
if (!match.isEmpty() && !principal.getName().toLowerCase(Locale.ROOT).contains(match)) {
182+
if (!verbose && !match.isEmpty() && !principal.getName().toLowerCase(Locale.ROOT).contains(match)) {
181183
continue;
182184
}
183185
counter++;

‎src/main/java/org/apache/hadoop/fs/store/diag/DiagnosticsEntryPoint.java‎

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,14 @@
2828
import java.security.CodeSource;
2929
import java.security.NoSuchAlgorithmException;
3030
import java.util.Arrays;
31+
import java.util.Collection;
3132
import java.util.HashMap;
3233
import java.util.List;
3334
import java.util.Map;
3435
import java.util.Properties;
3536
import java.util.Set;
3637
import java.util.TreeSet;
38+
import java.util.stream.Collectors;
3739

3840
import com.google.common.base.Function;
3941

@@ -176,21 +178,50 @@ public final void printSystemProperties(Object[][] vars) {
176178
System::getProperty);
177179
}
178180

181+
/**
182+
* Print security properties (no obfuscation).
183+
* @param properties properties.
184+
*/
185+
public final void printSecurityProperties(final String[] properties) {
186+
187+
final List<Object[]> list = Arrays.stream(properties).sorted()
188+
.map(k -> new Object[]{k, false})
189+
.collect(Collectors.toList());
190+
191+
lookupAndPrint("JVM Security Properties", list, java.security.Security::getProperty);
192+
}
193+
179194
/**
180195
* Resolve and print values.
181196
* This is an array of (name, obfuscate) entries.
182197
* @param vars variables/properties.
183198
* @param section section name
184199
* @param lookup lookup function
185200
*/
186-
public final void lookupAndPrintSanitizedValues(Object[][] vars,
201+
public final void lookupAndPrintSanitizedValues(
202+
Object[][] vars,
187203
String section,
188204
Function<String, String> lookup) {
189-
int index = 0;
190205

191-
if (vars.length > 0) {
206+
lookupAndPrint(section, Arrays.asList(vars), lookup);
207+
}
208+
209+
/**
210+
* Resolve and print values.
211+
* Takes a collection off (name, obfuscate) tuples..
212+
* @param entries variables/properties.
213+
* @param section section name
214+
* @param lookup lookup function
215+
*/
216+
private void lookupAndPrint(
217+
final String section,
218+
final Collection<Object[]> entries,
219+
final Function<String, String> lookup) {
220+
221+
int index = 0;
222+
if (!entries.isEmpty()) {
192223
heading(section);
193-
for (final Object[] option : vars) {
224+
for (final Object[] option : entries) {
194225
String var = (String) option[0];
195226
if (var == null || var.isEmpty()) {
196227
continue;

‎src/main/java/org/apache/hadoop/fs/store/diag/OptionSets.java‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,20 @@ public class OptionSets {
156156
{"", false},
157157
};
158158

159+
/**
160+
* Standard security properties.
161+
*/
162+
public static final String[] STANDARD_SECURITY_PROPS = {
163+
"jdk.certpath.disabledAlgorithms",
164+
"jdk.tls.disabledAlgorithm",
165+
"jdk.tls.keyLimits",
166+
"networkaddress.cache.ttl",
167+
"ssl.KeyManagerFactory",
168+
"ssl.KeyManagerFactory.algorithm",
169+
"ssl.TrustManagerFactory",
170+
"",
171+
};
172+
159173

160174
/** {@value}. */
161175
public static final String CLASSPATH = "java.class.path";
@@ -184,6 +198,7 @@ public class OptionSets {
184198
{"http.nonProxyHosts", false},
185199
{"java.net.preferIPv4Stack", false},
186200
{"java.net.preferIPv6Addresses", false},
201+
{"jsse.enableSNIExtension", false},
187202
{"networkaddress.cache.ttl", false},
188203
{"networkaddress.cache.negative.ttl", false},
189204
{"socksProxyHost", false},
@@ -194,27 +209,37 @@ public class OptionSets {
194209
{"sun.net.inetaddr.negative.ttl", false},
195210
};
196211

212+
public static final String JAVAX_NET_DEBUG = "javax.net.debug";
213+
214+
public static final String JDK_TLS_CLIENT_PROTOCOLS = "jdk.tls.client.protocols";
215+
197216
/**
198217
* TLS System properties.
218+
* See https://www.java.com/en/configure_crypto.html
199219
*/
200220
public static final Object[][] TLS_SYSPROPS = {
201221
{"java.version", false},
202222
{"java.library.path", false},
203223
{"com.sun.net.ssl.checkRevocation", false},
204224
{"https.protocols", false},
225+
{JAVAX_NET_DEBUG, false},
205226
{"javax.net.ssl.keyStore", false},
206227
{"javax.net.ssl.keyStorePassword", true},
207228
{"javax.net.ssl.trustStore", false},
208229
{"javax.net.ssl.trustStorePassword", true},
209230
{"jdk.certpath.disabledAlgorithms", false},
210231
{"jdk.tls.client.cipherSuites", false},
211-
{"jdk.tls.client.protocols", false},
232+
{JDK_TLS_CLIENT_PROTOCOLS, false},
212233
{"jdk.tls.disabledAlgorithms", false},
213234
{"jdk.tls.legacyAlgorithms", false},
214235
{"jsse.enableSNIExtension", false},
215236
{"", false},
216237
};
217238

239+
public static final String NET_DEBUG_SSL_HANDSHAKE = "ssl:handshake";
240+
241+
public static final String NET_DEBUG_ALL = "all";
242+
218243
public static final String MOZILLA_PUBLIC_SUFFIX_LIST =
219244
"mozilla/public-suffix-list.txt";
220245

‎src/main/java/org/apache/hadoop/fs/store/diag/S3ADiagnosticsInfo.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,11 @@ public class S3ADiagnosticsInfo extends StoreDiagnosticsInfo {
305305
public static final String FS_S3A_DOWNGRADE_SYNCABLE_EXCEPTIONS =
306306
"fs.s3a.downgrade.syncable.exceptions";
307307

308-
private static final Object[][] options = {
308+
/**
309+
* Each option is a triple of
310+
* (key, secure, obfuscate)
311+
*/
312+
private static final Object[][] S3A_OPTIONS = {
309313
/* Core auth */
310314
{ACCESS_KEY, true, true},
311315
{SECRET_KEY, true, true},
@@ -803,7 +807,7 @@ public String getHomepage() {
803807

804808
@Override
805809
public Object[][] getFilesystemOptions() {
806-
return options;
810+
return S3A_OPTIONS;
807811
}
808812

809813
@Override

‎src/main/java/org/apache/hadoop/fs/store/diag/StoreDiag.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,9 @@ public int run(String[] args, PrintStream stream) throws Exception {
201201
// only print selected ones
202202
printSystemProperties(storeInfo.getSelectedSystemProperties());
203203
}
204+
205+
printSecurityProperties(storeInfo.getSecurityProperties());
206+
204207
if (hasOption(ENVARS)) {
205208
dumpEnvVars();
206209
}

‎src/main/java/org/apache/hadoop/fs/store/diag/StoreDiagnosticsInfo.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@
4747
import static org.apache.hadoop.fs.store.StoreEntryPoint.DEFAULT_HIDE_ALL_SENSITIVE_CHARS;
4848
import static org.apache.hadoop.fs.store.StoreEntryPoint.getOrigins;
4949
import static org.apache.hadoop.fs.store.StoreUtils.sanitize;
50+
import static org.apache.hadoop.fs.store.diag.OptionSets.STANDARD_SECURITY_PROPS;
5051
import static org.apache.hadoop.fs.store.diag.OptionSets.STANDARD_SYSPROPS;
5152
import static org.apache.hadoop.fs.store.diag.StoreDiag.sortKeys;
5253

@@ -56,6 +57,9 @@
5657
*/
5758
public class StoreDiagnosticsInfo {
5859

60+
/**
61+
* Empty set for {@link #getFilesystemOptions()}.
62+
*/
5963
protected static final Object[][] EMPTY_OPTIONS = {};
6064

6165
protected static final String[] EMPTY_CLASSNAMES = {};
@@ -215,6 +219,14 @@ public Object[][] getSelectedSystemProperties() {
215219
return STANDARD_SYSPROPS;
216220
}
217221

222+
/**
223+
* Get security properties to log.
224+
* @return an array of security properties.
225+
*/
226+
public String[] getSecurityProperties() {
227+
return STANDARD_SECURITY_PROPS;
228+
}
229+
218230
/**
219231
* should HTTPS/TLS binding info be printed?
220232
* default is true.

0 commit comments

Comments
 (0)