Explorar o código

[desktop] Add support SSL certificate passwords

Erick Tryzelaar %!s(int64=10) %!d(string=hai) anos
pai
achega
c852455

+ 6 - 0
desktop/conf.dist/hue.ini

@@ -65,6 +65,12 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # SSL certificate password
+  ## ssl_password=
+
+  # Execute this script to produce the SSL password. This will be used when `ssl_password` is not set.
+  ## ssl_password_script=
+
   # List of allowed and disallowed ciphers in cipher list format.
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2

+ 6 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -71,6 +71,12 @@
   # Filename of SSL RSA Private Key
   ## ssl_private_key=
 
+  # SSL certificate password
+  ## ssl_password=
+
+  # Execute this script to produce the SSL password. This will be used when `ssl_password` is not set.
+  ## ssl_password_script=
+
   # List of allowed and disallowed ciphers in cipher list format.
   # See http://www.openssl.org/docs/apps/ciphers.html for more information on cipher list format.
   ## ssl_cipher_list=DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2

+ 19 - 0
desktop/core/src/desktop/conf.py

@@ -94,6 +94,17 @@ SSL_CIPHER_LIST = Config(
   help=_("List of allowed and disallowed ciphers"),
   default="DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2")
 
+SSL_PASSWORD = Config(
+  key="ssl_password",
+  help=_("SSL password of the the certificate"),
+  default=None)
+
+SSL_PASSWORD_SCRIPT = Config(
+  key="ssl_password_script",
+  help=_("Execute this script to produce the SSL password. This will be used when `ssl_password` is not set."),
+  type=coerce_password_from_script,
+  default=None)
+
 LDAP_PASSWORD = Config(
   key="ldap_password",
   help=_("LDAP password of the hue user used for LDAP authentications. For example for LDAP Authentication with HiveServer2/Impala."),
@@ -949,6 +960,14 @@ def get_redaction_policy():
   return LOG_REDACTION_FILE.get()
 
 
+def get_ssl_password():
+  password = SSL_PASSWORD.get()
+  if password is None:
+    password = SSL_PASSWORD_SCRIPT.get()
+
+  return password
+
+
 def get_database_password():
   password = DATABASE.PASSWORD.get()
   if password is None:

+ 5 - 0
desktop/core/src/desktop/lib/wsgiserver.py

@@ -1509,6 +1509,7 @@ class CherryPyWSGIServer(object):
     ssl_certificate = None
     ssl_private_key = None
     ssl_cipher_list = "DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2"
+    ssl_password_cb = None
     
     def __init__(self, bind_addr, wsgi_app, numthreads=10, server_name=None,
                  max=-1, request_queue_size=5, timeout=10, shutdown_timeout=5):
@@ -1664,6 +1665,10 @@ class CherryPyWSGIServer(object):
             
             # See http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/442473
             ctx = SSL.Context(SSL.SSLv23_METHOD)
+
+            if self.ssl_password_cb is not None:
+              ctx.set_passwd_cb(self.ssl_password_cb)
+
             ctx.set_cipher_list(self.ssl_cipher_list)
             ctx.use_privatekey_file(self.ssl_private_key)
             ctx.use_certificate_file(self.ssl_certificate)

+ 5 - 0
desktop/core/src/desktop/management/commands/runcherrypyserver.py

@@ -83,6 +83,11 @@ def start_server(options):
         server.ssl_certificate = options['ssl_certificate']
         server.ssl_private_key = options['ssl_private_key']
         server.ssl_cipher_list = options['ssl_cipher_list']
+
+        ssl_password = conf.get_ssl_password()
+        if ssl_password:
+            server.ssl_password_cb = lambda *unused: ssl_password
+
     try:
         server.bind_server()
         drop_privileges_if_necessary(options)