Parcourir la source

[desktop] Add global ssl_cacerts config option

This allows the SSL cacerts to be set in one location by default,
and allow individual apps to overload it when necessary.
Erick Tryzelaar il y a 10 ans
Parent
commit
908e6b5

+ 2 - 1
apps/beeswax/src/beeswax/conf.py

@@ -22,6 +22,7 @@ import beeswax.hive_site
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
 
+from desktop.conf import default_ssl_cacerts
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from beeswax.settings import NICE_NAME
@@ -107,7 +108,7 @@ SSL = ConfigSection(
       key="cacerts",
       help=_t("Path to Certificate Authority certificates."),
       type=str,
-      default="/etc/hue/cacerts.pem"
+      dynamic_default=default_ssl_cacerts,
     ),
 
     KEY = Config(

+ 21 - 0
apps/beeswax/src/beeswax/tests.py

@@ -2737,3 +2737,24 @@ def hive_site_xml(is_local=False, use_sasl=False, thrift_uris='thrift://darkside
     'use_sasl': str(use_sasl).lower(),
     'hs2_impersonation': hs2_impersonation,
   }
+
+
+def test_ssl_cacerts():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, '/etc/hue/cacerts.pem'),
+      ({'present': False}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+
+      ({'data': 'global-cacerts.pem'}, {'present': False}, 'global-cacerts.pem'),
+      ({'data': 'global-cacerts.pem'}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+      ]:
+    resets = [
+      desktop_conf.SSL_CACERTS.set_for_testing(**desktop_kwargs),
+      conf.SSL.CACERTS.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.CACERTS.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.CACERTS.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 2 - 1
apps/impala/src/impala/conf.py

@@ -20,6 +20,7 @@ import sys
 import socket
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
+from desktop.conf import default_ssl_cacerts
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from impala.settings import NICE_NAME
@@ -95,7 +96,7 @@ SSL = ConfigSection(
       key="cacerts",
       help=_t("Path to Certificate Authority certificates."),
       type=str,
-      default="/etc/hue/cacerts.pem"
+      dynamic_default=default_ssl_cacerts,
     ),
 
     KEY = Config(

+ 24 - 0
apps/impala/src/impala/tests.py

@@ -21,6 +21,8 @@ import os
 import re
 import sys
 
+import desktop.conf as desktop_conf
+
 from nose.plugins.skip import SkipTest
 from nose.tools import assert_true, assert_equal, assert_false
 
@@ -38,6 +40,7 @@ from beeswax.test_base import get_query_server_config, wait_for_query_to_finish,
 from beeswax.tests import _make_query
 from hadoop.pseudo_hdfs4 import get_db_prefix, is_live_cluster
 
+from impala import conf
 from impala.conf import SERVER_HOST
 
 
@@ -228,3 +231,24 @@ def create_saved_query(app_name, owner):
     Document.objects.link(design, owner=design.owner, extra=design.type, name=design.name, description=design.desc)
 
     return design
+
+
+def test_ssl_cacerts():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, '/etc/hue/cacerts.pem'),
+      ({'present': False}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+
+      ({'data': 'global-cacerts.pem'}, {'present': False}, 'global-cacerts.pem'),
+      ({'data': 'global-cacerts.pem'}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+      ]:
+    resets = [
+      desktop_conf.SSL_CACERTS.set_for_testing(**desktop_kwargs),
+      conf.SSL.CACERTS.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.CACERTS.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.CACERTS.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -82,6 +82,9 @@
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
 
+  # Path to default Certificate Authority certificates.
+  ## ssl_cacerts=/etc/hue/cacerts.pem
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -88,6 +88,9 @@
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
 
+  # Path to default Certificate Authority certificates.
+  ## ssl_cacerts=/etc/hue/cacerts.pem
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 11 - 0
desktop/core/src/desktop/conf.py

@@ -109,6 +109,12 @@ SSL_PASSWORD_SCRIPT = Config(
   type=coerce_password_from_script,
   default=None)
 
+SSL_CACERTS = Config(
+  key="ssl_cacerts",
+  help=_('Path to default Certificate Authority certificates.'),
+  type=str,
+  default='/etc/hue/cacerts.pem')
+
 LDAP_PASSWORD = Config(
   key="ldap_password",
   help=_("LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2/Impala."),
@@ -255,6 +261,11 @@ def default_secure_cookie():
   return is_https_enabled()
 
 
+def default_ssl_cacerts():
+  """Path to default Certificate Authority certificates"""
+  return SSL_CACERTS.get()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),