Browse Source

HUE-67. beeswax_server email notification should ignore SSL warnings

bc Wong 15 years ago
parent
commit
3410cee030

+ 30 - 6
apps/beeswax/java/src/com/cloudera/beeswax/BeeswaxServiceImpl.java

@@ -21,21 +21,26 @@ import java.io.IOException;
 import java.io.OutputStream;
 import java.io.PrintStream;
 import java.io.UnsupportedEncodingException;
-import java.net.URL;
 import java.net.HttpURLConnection;
+import java.net.URL;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ExecutorService;
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 import java.util.Properties;
 import java.util.UUID;
 import java.util.Vector;
-import java.util.Map.Entry;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
 
 import org.apache.hadoop.fs.Path;
 import org.apache.hadoop.hive.conf.HiveConf;
@@ -537,7 +542,26 @@ public class BeeswaxServiceImpl implements BeeswaxService.Iface {
     this.executor = Executors.newCachedThreadPool(new NamingThreadFactory("Beeswax-%d"));
     this.runningQueries = new ConcurrentHashMap<String, RunningQueryState>();
 
-    String protocol = dtHttps ? "https" : "http";
+    String protocol;
+    if (dtHttps) {
+      protocol = "https";
+      try {
+        // Disable SSL verification. HUE cert may be signed by untrusted CA.
+        SSLContext sslcontext = SSLContext.getInstance("SSL");
+        sslcontext.init(null,
+                        new DummyX509TrustManager[] { new DummyX509TrustManager() },
+                        new SecureRandom());
+        HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory());
+      } catch (NoSuchAlgorithmException ex) {
+        LOG.warn("Failed to disable SSL certificate check " + ex);
+      } catch (KeyManagementException ex) {
+        LOG.warn("Failed to disable SSL certificate check " + ex);
+      }
+      DummyHostnameVerifier dummy = new DummyHostnameVerifier();
+      HttpsURLConnection.setDefaultHostnameVerifier(dummy);
+    } else {
+      protocol = "http";
+    }
     this.notifyUrl = protocol + "://" + dtHost + ":" + dtPort + NOTIFY_URL_BASE;
 
     // A daemon thread that periodically evict stale RunningQueryState objects

+ 29 - 0
apps/beeswax/java/src/com/cloudera/beeswax/DummyHostnameVerifier.java

@@ -0,0 +1,29 @@
+// Licensed to Cloudera, Inc. under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  Cloudera, Inc. licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.cloudera.beeswax;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLSession;
+
+/**
+ * A hostname verifier that always return true.
+ */
+public class DummyHostnameVerifier implements HostnameVerifier {
+  public boolean verify(String hostname, SSLSession session) {
+    return true;
+  }
+}

+ 40 - 0
apps/beeswax/java/src/com/cloudera/beeswax/DummyX509TrustManager.java

@@ -0,0 +1,40 @@
+// Licensed to Cloudera, Inc. under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  Cloudera, Inc. licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.cloudera.beeswax;
+
+import java.security.cert.X509Certificate;
+import javax.net.ssl.X509TrustManager;
+
+/**
+ * A trust manager that trusts everybody.
+ */
+public class DummyX509TrustManager implements X509TrustManager {
+
+  private X509Certificate[] _acceptedIssuers = new X509Certificate[] { };
+
+  public void checkClientTrusted(X509Certificate[] chain, String authType) {
+    // no-op
+  }
+
+  public void checkServerTrusted(X509Certificate[] chain, String authType) {
+    // no-op
+  }
+
+  public X509Certificate[] getAcceptedIssuers() {
+    return _acceptedIssuers;
+  }
+}