浏览代码

HUE-2342 [impala] SSL encryption

Romain Rigaux 11 年之前
父节点
当前提交
269732e

+ 13 - 5
apps/beeswax/src/beeswax/server/hive_server2_lib.py

@@ -314,10 +314,18 @@ class HiveServerClient:
     self.impersonation_enabled = impersonation_enabled
 
     if self.query_server['server_name'] == 'impala':
-      ssl_enabled = False
+      ssl_enabled = impala_conf.SSL.ENABLED.get()
+      ca_certs = impala_conf.SSL.CACERTS.get()
+      keyfile = impala_conf.SSL.KEY.get()
+      certfile = impala_conf.SSL.CERT.get()
+      validate = impala_conf.SSL.VALIDATE.get()
       timeout = impala_conf.SERVER_CONN_TIMEOUT.get()
     else:
       ssl_enabled = beeswax_conf.SSL.ENABLED.get()
+      ca_certs = beeswax_conf.SSL.CACERTS.get()
+      keyfile = beeswax_conf.SSL.KEY.get()
+      certfile = beeswax_conf.SSL.CERT.get()
+      validate = beeswax_conf.SSL.VALIDATE.get()
       timeout = beeswax_conf.SERVER_CONN_TIMEOUT.get()
 
     if ldap_username:
@@ -338,10 +346,10 @@ class HiveServerClient:
 					                                password=password,
                                           timeout_seconds=timeout,
                                           use_ssl=ssl_enabled,
-                                          ca_certs=beeswax_conf.SSL.CACERTS.get(),
-                                          keyfile=beeswax_conf.SSL.KEY.get(),
-                                          certfile=beeswax_conf.SSL.CERT.get(),
-                                          validate=beeswax_conf.SSL.VALIDATE.get())
+                                          ca_certs=ca_certs,
+                                          keyfile=keyfile,
+                                          certfile=certfile,
+                                          validate=validate)
 
 
   def get_security(self):

+ 41 - 1
apps/impala/src/impala/conf.py

@@ -19,7 +19,7 @@ import sys
 import socket
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
-from desktop.lib.conf import Config, coerce_bool
+from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from impala.settings import NICE_NAME
 
@@ -77,6 +77,46 @@ QUERY_TIMEOUT_S = Config(
   default=600
 )
 
+SSL = ConfigSection(
+  key='ssl',
+  help=_t('SSL configuration for the server.'),
+  members=dict(
+    ENABLED = Config(
+      key="enabled",
+      help=_t("SSL communication enabled for this server."),
+      type=coerce_bool,
+      default=False
+    ),
+
+    CACERTS = Config(
+      key="cacerts",
+      help=_t("Path to Certificate Authority certificates."),
+      type=str,
+      default="/etc/hue/cacerts.pem"
+    ),
+
+    KEY = Config(
+      key="key",
+      help=_t("Path to the private key file."),
+      type=str,
+      default="/etc/hue/key.pem"
+    ),
+
+    CERT = Config(
+      key="cert",
+      help=_t("Path to the public certificate file."),
+      type=str,
+      default="/etc/hue/cert.pem"
+    ),
+
+    VALIDATE = Config(
+      key="validate",
+      help=_t("Choose whether Hue should validate certificates received from the server."),
+      type=coerce_bool,
+      default=True
+    )
+  )
+)
 
 def config_validator(user):
   # dbms is dependent on beeswax.conf (this file)

+ 50 - 34
desktop/conf.dist/hue.ini

@@ -761,6 +761,56 @@
     ## validate=true
 
 
+###########################################################################
+# Settings to configure Impala
+###########################################################################
+
+[impala]
+  # Host of the Impala Server (one of the Impalad)
+  ## server_host=localhost
+
+  # Port of the Impala Server
+  ## server_port=21050
+
+  # Kerberos principal
+  ## impala_principal=impala/hostname.foo.com
+
+  # Turn on/off impersonation mechanism when talking to Impala
+  ## impersonation_enabled=False
+
+  # Number of initial rows of a result set to ask Impala to cache in order
+  # to support re-fetching them for downloading them.
+  # Set to 0 for disabling the option and backward compatibility.
+  ## querycache_rows=50000
+
+  # Timeout in seconds for thrift calls
+  ## server_conn_timeout=120
+
+  # Hue will try to close the Impala query when the user leaves the editor page.
+  # This will free all the query resources in Impala, but also make its results inaccessible.
+  ## close_queries=true
+
+  # If QUERY_TIMEOUT_S > 0, the query will be timed out (i.e. cancelled) if Impala does not do any work
+  # (compute or send back results) for that query within QUERY_TIMEOUT_S seconds.
+  ## query_timeout_s=600
+
+  [[ssl]]
+    # SSL communication enabled for this server.
+    ## enabled=false
+
+    # Path to Certificate Authority certificates.
+    ## cacerts=/etc/hue/cacerts.pem
+
+    # Path to the private key file.
+    ## key=/etc/hue/key.pem
+
+    # Path to the public certificate file.
+    ## cert=/etc/hue/cert.pem
+
+    # Choose whether Hue should validate certificates received from the server.
+    ## validate=true
+
+
 ###########################################################################
 # Settings to configure Pig
 ###########################################################################
@@ -799,40 +849,6 @@
   ## blacklist=
 
 
-###########################################################################
-# Settings to configure Impala
-###########################################################################
-
-[impala]
-  # Host of the Impala Server (one of the Impalad)
-  ## server_host=localhost
-
-  # Port of the Impala Server
-  ## server_port=21050
-
-  # Kerberos principal
-  ## impala_principal=impala/hostname.foo.com
-
-  # Turn on/off impersonation mechanism when talking to Impala
-  ## impersonation_enabled=False
-
-  # Number of initial rows of a result set to ask Impala to cache in order
-  # to support re-fetching them for downloading them.
-  # Set to 0 for disabling the option and backward compatibility.
-  ## querycache_rows=50000
-
-  # Timeout in seconds for thrift calls
-  ## server_conn_timeout=120
-
-  # Hue will try to close the Impala query when the user leaves the editor page.
-  # This will free all the query resources in Impala, but also make its results inaccessible.
-  ## close_queries=true
-
-  # If QUERY_TIMEOUT_S > 0, the query will be timed out (i.e. cancelled) if Impala does not do any work
-  # (compute or send back results) for that query within QUERY_TIMEOUT_S seconds.
-  ## query_timeout_s=600
-
-
 ###########################################################################
 # Settings to configure HBase Browser
 ###########################################################################

+ 50 - 34
desktop/conf/pseudo-distributed.ini.tmpl

@@ -768,6 +768,56 @@
     ## validate=true
 
 
+###########################################################################
+# Settings to configure Impala
+###########################################################################
+
+[impala]
+  # Host of the Impala Server (one of the Impalad)
+  ## server_host=localhost
+
+  # Port of the Impala Server
+  ## server_port=21050
+
+  # Kerberos principal
+  ## impala_principal=impala/hostname.foo.com
+
+  # Turn on/off impersonation mechanism when talking to Impala
+  ## impersonation_enabled=False
+
+  # Number of initial rows of a result set to ask Impala to cache in order
+  # to support re-fetching them for downloading them.
+  # Set to 0 for disabling the option and backward compatibility.
+  ## querycache_rows=50000
+
+  # Timeout in seconds for thrift calls
+  ## server_conn_timeout=120
+
+  # Hue will try to close the Impala query when the user leaves the editor page.
+  # This will free all the query resources in Impala, but also make its results inaccessible.
+  ## close_queries=true
+
+  # If QUERY_TIMEOUT_S > 0, the query will be timed out (i.e. cancelled) if Impala does not do any work
+  # (compute or send back results) for that query within QUERY_TIMEOUT_S seconds.
+  ## query_timeout_s=600
+
+  [[ssl]]
+    # SSL communication enabled for this server.
+    ## enabled=false
+
+    # Path to Certificate Authority certificates.
+    ## cacerts=/etc/hue/cacerts.pem
+
+    # Path to the private key file.
+    ## key=/etc/hue/key.pem
+
+    # Path to the public certificate file.
+    ## cert=/etc/hue/cert.pem
+
+    # Choose whether Hue should validate certificates received from the server.
+    ## validate=true
+
+
 ###########################################################################
 # Settings to configure Pig
 ###########################################################################
@@ -806,40 +856,6 @@
   ## blacklist=
 
 
-###########################################################################
-# Settings to configure Impala
-###########################################################################
-
-[impala]
-  # Host of the Impala Server (one of the Impalad)
-  ## server_host=localhost
-
-  # Port of the Impala Server
-  ## server_port=21050
-
-  # Kerberos principal
-  ## impala_principal=impala/hostname.foo.com
-
-  # Turn on/off impersonation mechanism when talking to Impala
-  ## impersonation_enabled=False
-
-  # Number of initial rows of a result set to ask Impala to cache in order
-  # to support re-fetching them for downloading them.
-  # Set to 0 for disabling the option and backward compatibility.
-  ## querycache_rows=50000
-
-  # Timeout in seconds for thrift calls
-  ## server_conn_timeout=120
-
-  # Hue will try to close the Impala query when the user leaves the editor page.
-  # This will free all the query resources in Impala, but also make its results inaccessible.
-  ## close_queries=true
-
-  # If QUERY_TIMEOUT_S > 0, the query will be timed out (i.e. cancelled) if Impala does not do any work
-  # (compute or send back results) for that query within QUERY_TIMEOUT_S seconds.
-  ## query_timeout_s=600
-
-
 ###########################################################################
 # Settings to configure HBase Browser
 ###########################################################################