Răsfoiți Sursa

[desktop] Add global ssl_cacerts config option

This allows the SSL cacerts to be set in one location by default,
and allow individual apps to overload it when necessary.
Erick Tryzelaar 10 ani în urmă
părinte
comite
908e6b5

+ 2 - 1
apps/beeswax/src/beeswax/conf.py

@@ -22,6 +22,7 @@ import beeswax.hive_site
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
 
+from desktop.conf import default_ssl_cacerts
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from beeswax.settings import NICE_NAME
@@ -107,7 +108,7 @@ SSL = ConfigSection(
       key="cacerts",
       help=_t("Path to Certificate Authority certificates."),
       type=str,
-      default="/etc/hue/cacerts.pem"
+      dynamic_default=default_ssl_cacerts,
     ),
 
     KEY = Config(

+ 21 - 0
apps/beeswax/src/beeswax/tests.py

@@ -2737,3 +2737,24 @@ def hive_site_xml(is_local=False, use_sasl=False, thrift_uris='thrift://darkside
     'use_sasl': str(use_sasl).lower(),
     'hs2_impersonation': hs2_impersonation,
   }
+
+
+def test_ssl_cacerts():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, '/etc/hue/cacerts.pem'),
+      ({'present': False}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+
+      ({'data': 'global-cacerts.pem'}, {'present': False}, 'global-cacerts.pem'),
+      ({'data': 'global-cacerts.pem'}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+      ]:
+    resets = [
+      desktop_conf.SSL_CACERTS.set_for_testing(**desktop_kwargs),
+      conf.SSL.CACERTS.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.CACERTS.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.CACERTS.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 2 - 1
apps/impala/src/impala/conf.py

@@ -20,6 +20,7 @@ import sys
 import socket
 
 from django.utils.translation import ugettext_lazy as _t, ugettext as _
+from desktop.conf import default_ssl_cacerts
 from desktop.lib.conf import ConfigSection, Config, coerce_bool
 
 from impala.settings import NICE_NAME
@@ -95,7 +96,7 @@ SSL = ConfigSection(
       key="cacerts",
       help=_t("Path to Certificate Authority certificates."),
       type=str,
-      default="/etc/hue/cacerts.pem"
+      dynamic_default=default_ssl_cacerts,
     ),
 
     KEY = Config(

+ 24 - 0
apps/impala/src/impala/tests.py

@@ -21,6 +21,8 @@ import os
 import re
 import sys
 
+import desktop.conf as desktop_conf
+
 from nose.plugins.skip import SkipTest
 from nose.tools import assert_true, assert_equal, assert_false
 
@@ -38,6 +40,7 @@ from beeswax.test_base import get_query_server_config, wait_for_query_to_finish,
 from beeswax.tests import _make_query
 from hadoop.pseudo_hdfs4 import get_db_prefix, is_live_cluster
 
+from impala import conf
 from impala.conf import SERVER_HOST
 
 
@@ -228,3 +231,24 @@ def create_saved_query(app_name, owner):
     Document.objects.link(design, owner=design.owner, extra=design.type, name=design.name, description=design.desc)
 
     return design
+
+
+def test_ssl_cacerts():
+  for desktop_kwargs, conf_kwargs, expected in [
+      ({'present': False}, {'present': False}, '/etc/hue/cacerts.pem'),
+      ({'present': False}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+
+      ({'data': 'global-cacerts.pem'}, {'present': False}, 'global-cacerts.pem'),
+      ({'data': 'global-cacerts.pem'}, {'data': 'local-cacerts.pem'}, 'local-cacerts.pem'),
+      ]:
+    resets = [
+      desktop_conf.SSL_CACERTS.set_for_testing(**desktop_kwargs),
+      conf.SSL.CACERTS.set_for_testing(**conf_kwargs),
+    ]
+
+    try:
+      assert_equal(conf.SSL.CACERTS.get(), expected,
+          'desktop:%s conf:%s expected:%s got:%s' % (desktop_kwargs, conf_kwargs, expected, conf.SSL.CACERTS.get()))
+    finally:
+      for reset in resets:
+        reset()

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -82,6 +82,9 @@
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
 
+  # Path to default Certificate Authority certificates.
+  ## ssl_cacerts=/etc/hue/cacerts.pem
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -88,6 +88,9 @@
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2
 
+  # Path to default Certificate Authority certificates.
+  ## ssl_cacerts=/etc/hue/cacerts.pem
+
   # LDAP username and password of the hue user used for LDAP authentications.
   # Set it to use LDAP Authentication with HiveServer2 and Impala.
   ## ldap_username=hue

+ 11 - 0
desktop/core/src/desktop/conf.py

@@ -109,6 +109,12 @@ SSL_PASSWORD_SCRIPT = Config(
   type=coerce_password_from_script,
   default=None)
 
+SSL_CACERTS = Config(
+  key="ssl_cacerts",
+  help=_('Path to default Certificate Authority certificates.'),
+  type=str,
+  default='/etc/hue/cacerts.pem')
+
 LDAP_PASSWORD = Config(
   key="ldap_password",
   help=_("LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2/Impala."),
@@ -255,6 +261,11 @@ def default_secure_cookie():
   return is_https_enabled()
 
 
+def default_ssl_cacerts():
+  """Path to default Certificate Authority certificates"""
+  return SSL_CACERTS.get()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),