Skip to content

Commit 03826d9

Browse files
epughepugh
authored
SOLR-17864: Solr keystore property renames (#3845)
* Solr keystore property renames solr.keyStoreReload.enabled -> solr.keystore.reload.enabled solr.jetty.sslContext.reload.scanInterval --> solr.jetty.ssl.context.reload.scan.interval.secs
1 parent a72691c commit 03826d9

File tree

9 files changed

+30
-27
lines changed

9 files changed

+30
-27
lines changed

‎solr/bin/solr‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ if [ "$SOLR_SSL_ENABLED" == "true" ]; then
213213
SOLR_JETTY_CONFIG+=("--module=https" "--lib=$DEFAULT_SERVER_DIR/solr-webapp/webapp/WEB-INF/lib/*")
214214
if [ "${SOLR_SSL_RELOAD_ENABLED:-true}" == "true" ]; then
215215
SOLR_JETTY_CONFIG+=("--module=ssl-reload")
216-
SOLR_SSL_OPTS+=" -Dsolr.keyStoreReload.enabled=true"
216+
SOLR_SSL_OPTS+=" -Dsolr.keystore.reload.enabled=true"
217217
fi
218218
SOLR_URL_SCHEME=https
219219
if [ -n "$SOLR_SSL_KEY_STORE" ]; then
@@ -245,10 +245,10 @@ if [ "$SOLR_SSL_ENABLED" == "true" ]; then
245245
fi
246246

247247
if [ -n "$SOLR_SSL_NEED_CLIENT_AUTH" ]; then
248-
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.needClientAuth=$SOLR_SSL_NEED_CLIENT_AUTH"
248+
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.need.client.auth.enabled=$SOLR_SSL_NEED_CLIENT_AUTH"
249249
fi
250250
if [ -n "$SOLR_SSL_WANT_CLIENT_AUTH" ]; then
251-
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.wantClientAuth=$SOLR_SSL_WANT_CLIENT_AUTH"
251+
SOLR_SSL_OPTS+=" -Dsolr.jetty.ssl.want.client.auth.enabled=$SOLR_SSL_WANT_CLIENT_AUTH"
252252
fi
253253

254254
if [ -n "$SOLR_SSL_CLIENT_KEY_STORE" ]; then
@@ -274,7 +274,7 @@ if [ "$SOLR_SSL_ENABLED" == "true" ]; then
274274
fi
275275

276276
if [ -n "$SOLR_SSL_CHECK_PEER_NAME" ]; then
277-
SOLR_SSL_OPTS+=" -Dsolr.ssl.checkPeerName=$SOLR_SSL_CHECK_PEER_NAME -Dsolr.jetty.ssl.sniHostCheck=$SOLR_SSL_CHECK_PEER_NAME"
277+
SOLR_SSL_OPTS+=" -Dsolr.ssl.check.peer.name.enabled=$SOLR_SSL_CHECK_PEER_NAME -Dsolr.jetty.ssl.sni.host.check.enabled=$SOLR_SSL_CHECK_PEER_NAME"
278278
fi
279279

280280
if [ -n "$SOLR_SSL_CLIENT_TRUST_STORE" ]; then

‎solr/bin/solr.cmd‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ IF "%SOLR_SSL_ENABLED%"=="true" (
103103
set SOLR_URL_SCHEME=https
104104
IF "%SOLR_SSL_RELOAD_ENABLED%"=="true" (
105105
set "SOLR_JETTY_CONFIG=!SOLR_JETTY_CONFIG! --module=ssl-reload"
106-
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.keyStoreReload.enabled=true"
106+
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.keystore.reload.enabled=true"
107107
)
108108
IF DEFINED SOLR_SSL_KEY_STORE (
109109
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.keystore=%SOLR_SSL_KEY_STORE%"
@@ -133,10 +133,10 @@ IF "%SOLR_SSL_ENABLED%"=="true" (
133133
)
134134

135135
IF DEFINED SOLR_SSL_NEED_CLIENT_AUTH (
136-
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.needClientAuth=%SOLR_SSL_NEED_CLIENT_AUTH%"
136+
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.need.client.auth.enabled=%SOLR_SSL_NEED_CLIENT_AUTH%"
137137
)
138138
IF DEFINED SOLR_SSL_WANT_CLIENT_AUTH (
139-
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.wantClientAuth=%SOLR_SSL_WANT_CLIENT_AUTH%"
139+
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.jetty.ssl.want.client.auth.enabled=%SOLR_SSL_WANT_CLIENT_AUTH%"
140140
)
141141

142142
IF DEFINED SOLR_SSL_CLIENT_KEY_STORE (
@@ -174,7 +174,7 @@ IF "%SOLR_SSL_ENABLED%"=="true" (
174174
)
175175
)
176176
IF DEFINED SOLR_SSL_CHECK_PEER_NAME (
177-
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.ssl.checkPeerName=%SOLR_SSL_CHECK_PEER_NAME% -Dsolr.jetty.ssl.sniHostCheck=%SOLR_SSL_CHECK_PEER_NAME%"
177+
set "SOLR_SSL_OPTS=!SOLR_SSL_OPTS! -Dsolr.ssl.check.peer.name.enabled=%SOLR_SSL_CHECK_PEER_NAME% -Dsolr.jetty.ssl.sni.host.check.enabled=%SOLR_SSL_CHECK_PEER_NAME%"
178178
)
179179
) ELSE (
180180
set SOLR_SSL_OPTS=

‎solr/packaging/test/test_ssl.bats‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ teardown() {
118118

119119
# Restart the server enabling the SNI hostcheck
120120
export SOLR_SSL_CHECK_PEER_NAME=false
121-
export SOLR_OPTS="${SOLR_OPTS} -Dsolr.jetty.ssl.sniHostCheck=true"
121+
export SOLR_OPTS="${SOLR_OPTS} -Dsolr.jetty.ssl.sni.host.check.enabled=true"
122122
solr restart
123123
# This should fail the SNI Hostname check
124124
run ! solr api --verbose --solr-url "https://localhost:${SOLR_PORT}/solr/admin/collections?action=CLUSTERSTATUS"
@@ -526,14 +526,14 @@ teardown() {
526526
# server1 will run on $SOLR_PORT and will use server1.keystore
527527
export SOLR_SSL_KEY_STORE=$ssl_dir/server1.keystore.p12
528528
export SOLR_SSL_TRUST_STORE=$ssl_dir/server1.keystore.p12
529-
solr start --jvm-opts "-Dsolr.jetty.sslContext.reload.scanInterval=1 -DsocketTimeout=5000"
529+
solr start --jvm-opts "-Dsolr.jetty.ssl.context.reload.scan.interval.secs=1 -DsocketTimeout=5000"
530530
solr assert --started https://localhost:${SOLR_PORT} --timeout 5000
531531

532532
# server2 will run on $SOLR2_PORT and will use server2.keystore. Initially, this is the same as server1.keystore
533533
export SOLR_SSL_KEY_STORE=$ssl_dir/server2.keystore.p12
534534
export SOLR_SSL_TRUST_STORE=$ssl_dir/server2.keystore.p12
535535

536-
solr start -z localhost:${ZK_PORT} -p ${SOLR2_PORT} --jvm-opts "-Dsolr.jetty.sslContext.reload.scanInterval=1 -DsocketTimeout=5000"
536+
solr start -z localhost:${ZK_PORT} -p ${SOLR2_PORT} --jvm-opts "-Dsolr.jetty.ssl.context.reload.scan.interval.secs=1 -DsocketTimeout=5000"
537537
solr assert --started https://localhost:${SOLR2_PORT} --timeout 5000
538538

539539
# "test" collection is two shards, meaning there must be communication between shards for queries (handled by http shard handler factory)

‎solr/server/etc/jetty-ssl-context-reload.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<Arg>
77
<New id="keyStoreScanner" class="org.eclipse.jetty.util.ssl.KeyStoreScanner">
88
<Arg><Ref refid="sslContextFactory"/></Arg>
9-
<Set name="scanInterval"><Property name="solr.jetty.sslContext.reload.scanInterval" default="30"/></Set>
9+
<Set name="scanInterval"><Property name="solr.jetty.ssl.context.reload.scan.interval.secs" default="30"/></Set>
1010
</New>
1111
</Arg>
1212
</Call>

‎solr/server/etc/jetty-ssl.xml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
<Set name="KeyStorePassword"><Ref refid="keyStorePassword"/></Set>
2020
<Set name="TrustStorePath"><Property name="solr.jetty.truststore" default="./etc/solr-ssl.keystore.jks"/></Set>
2121
<Set name="TrustStorePassword"><Ref refid="trustStorePassword"/></Set>
22-
<Set name="NeedClientAuth"><Property name="solr.jetty.ssl.needClientAuth" default="false"/></Set>
23-
<Set name="WantClientAuth"><Property name="solr.jetty.ssl.wantClientAuth" default="false"/></Set>
22+
<Set name="NeedClientAuth"><Property name="solr.jetty.ssl.need.client.auth.enabled" default="false"/></Set>
23+
<Set name="WantClientAuth"><Property name="solr.jetty.ssl.want.client.auth.enabled" default="false"/></Set>
2424
<Set name="KeyStoreType"><Property name="solr.jetty.keystore.type" default="PKCS12"/></Set>
2525
<Set name="TrustStoreType"><Property name="solr.jetty.truststore.type" default="PKCS12"/></Set>
2626
<Set name="EndpointIdentificationAlgorithm"><Property name="solr.jetty.ssl.verifyClientHostName"/></Set>
@@ -42,10 +42,10 @@
4242
<Call name="addCustomizer">
4343
<Arg>
4444
<New class="org.eclipse.jetty.server.SecureRequestCustomizer">
45-
<Arg name="sniRequired" type="boolean"><Property name="solr.jetty.ssl.sniRequired" default="false"/></Arg>
46-
<Arg name="sniHostCheck" type="boolean"><Property name="solr.jetty.ssl.sniHostCheck" default="true"/></Arg>
47-
<Arg name="stsMaxAgeSeconds" type="int"><Property name="solr.jetty.ssl.stsMaxAgeSeconds" default="-1"/></Arg>
48-
<Arg name="stsIncludeSubdomains" type="boolean"><Property name="solr.jetty.ssl.stsIncludeSubdomains" default="false"/></Arg>
45+
<Arg name="sniRequired" type="boolean"><Property name="solr.jetty.ssl.sni.required.enabled" default="false"/></Arg>
46+
<Arg name="sniHostCheck" type="boolean"><Property name="solr.jetty.ssl.sni.host.check.enabled" default="true"/></Arg>
47+
<Arg name="stsMaxAgeSeconds" type="int"><Property name="solr.jetty.ssl.sts.max.age.secs" default="-1"/></Arg>
48+
<Arg name="stsIncludeSubdomains" type="boolean"><Property name="solr.jetty.ssl.sts.include.subdomains.enabled" default="false"/></Arg>
4949
</New>
5050
</Arg>
5151
</Call>

‎solr/solr-ref-guide/modules/deployment-guide/pages/enabling-ssl.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ NOTE: If you have defined `ZK_HOST` in `solr.in.sh`/`solr.in.cmd` (see xref:zook
194194
Start each Solr node with the Solr control script as shown in the examples below.
195195
Customize the values for the parameters shown as necessary and add any used in your system.
196196

197-
If you created the SSL key without all DNS names or IP addresses on which Solr nodes run, you can tell Solr to skip hostname verification for inter-node communications by setting the `-Dsolr.ssl.checkPeerName=false` system property.
197+
If you created the SSL key without all DNS names or IP addresses on which Solr nodes run, you can tell Solr to skip hostname verification for inter-node communications by setting the `-Dsolr.ssl.check.peer.name.enabled=false` system property.
198198

199199
[tabs#cloud]
200200
======
@@ -249,7 +249,7 @@ C:\> bin\solr.cmd -p 8984
249249
Solr can automatically reload KeyStore/TrustStore when certificates are updated without restarting. This is enabled by default
250250
when using SSL, but can be disabled by setting the environment variable `SOLR_SSL_RELOAD_ENABLED` to `false`. By
251251
default, Solr will check for updates in the KeyStore every 30 seconds, but this interval can be updated by passing the
252-
system property `solr.jetty.sslContext.reload.scanInterval` with the new interval in seconds on startup.
252+
system property `solr.jetty.ssl.context.reload.scan.interval.secs` with the new interval in seconds on startup.
253253
Note that the truststore file is not actively monitored, so if you need to apply changes to the truststore, you need
254254
to update it and after that touch the keystore to trigger a reload.
255255

‎solr/solrj/src/java/org/apache/solr/client/solrj/impl/Http2SolrClient.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@
5555
import org.apache.solr.common.params.SolrParams;
5656
import org.apache.solr.common.params.UpdateParams;
5757
import org.apache.solr.common.util.ContentStream;
58+
import org.apache.solr.common.util.EnvUtils;
5859
import org.apache.solr.common.util.ExecutorUtil;
5960
import org.apache.solr.common.util.NamedList;
6061
import org.apache.solr.common.util.ObjectReleaseTracker;
@@ -238,8 +239,10 @@ private HttpClient createHttpClient(Builder builder) {
238239
: sslConfig.createClientContextFactory();
239240

240241
Long keyStoreReloadIntervalSecs = builder.keyStoreReloadIntervalSecs;
241-
if (keyStoreReloadIntervalSecs == null && Boolean.getBoolean("solr.keyStoreReload.enabled")) {
242-
keyStoreReloadIntervalSecs = Long.getLong("solr.jetty.sslContext.reload.scanInterval", 30);
242+
if (keyStoreReloadIntervalSecs == null
243+
&& EnvUtils.getPropertyAsBool("solr.keystore.reload.enabled", false)) {
244+
keyStoreReloadIntervalSecs =
245+
EnvUtils.getPropertyAsLong("solr.jetty.ssl.context.reload.scan.interval.secs", 30l);
243246
}
244247
if (sslContextFactory != null
245248
&& sslContextFactory.getKeyStoreResource() != null

‎solr/solrj/src/java/org/apache/solr/client/solrj/impl/SolrHttpConstants.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public interface SolrHttpConstants {
5252
* System property consulted to determine if HTTP based SolrClients will require hostname
5353
* validation of SSL Certificates. The default behavior is to enforce peer name validation.
5454
*/
55-
String SYS_PROP_CHECK_PEER_NAME = "solr.ssl.checkPeerName";
55+
String SYS_PROP_CHECK_PEER_NAME = "solr.ssl.check.peer.name.enabled";
5656

5757
/** Basic auth username */
5858
String PROP_BASIC_AUTH_USER = "httpBasicAuthUser";

‎solr/solrj/src/test/org/apache/solr/client/solrj/impl/Http2SolrClientTest.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -440,25 +440,25 @@ public void testGetDefaultSslContextFactory() {
440440
System.clearProperty("javax.net.ssl.keyStoreType");
441441
System.clearProperty("javax.net.ssl.trustStoreType");
442442

443-
System.setProperty("solr.ssl.checkPeerName", "true");
443+
System.setProperty("solr.ssl.check.peer.name.enabled", "true");
444444
System.setProperty("javax.net.ssl.keyStoreType", "foo");
445445
System.setProperty("javax.net.ssl.trustStoreType", "bar");
446446
SslContextFactory.Client sslContextFactory2 = Http2SolrClient.getDefaultSslContextFactory();
447447
assertEquals("HTTPS", sslContextFactory2.getEndpointIdentificationAlgorithm());
448448
assertEquals("foo", sslContextFactory2.getKeyStoreType());
449449
assertEquals("bar", sslContextFactory2.getTrustStoreType());
450-
System.clearProperty("solr.ssl.checkPeerName");
450+
System.clearProperty("solr.ssl.check.peer.name.enabled");
451451
System.clearProperty("javax.net.ssl.keyStoreType");
452452
System.clearProperty("javax.net.ssl.trustStoreType");
453453

454-
System.setProperty("solr.ssl.checkPeerName", "false");
454+
System.setProperty("solr.ssl.check.peer.name.enabled", "false");
455455
System.setProperty("javax.net.ssl.keyStoreType", "foo");
456456
System.setProperty("javax.net.ssl.trustStoreType", "bar");
457457
SslContextFactory.Client sslContextFactory3 = Http2SolrClient.getDefaultSslContextFactory();
458458
assertNull(sslContextFactory3.getEndpointIdentificationAlgorithm());
459459
assertEquals("foo", sslContextFactory3.getKeyStoreType());
460460
assertEquals("bar", sslContextFactory3.getTrustStoreType());
461-
System.clearProperty("solr.ssl.checkPeerName");
461+
System.clearProperty("solr.ssl.check.peer.name.enabled");
462462
System.clearProperty("javax.net.ssl.keyStoreType");
463463
System.clearProperty("javax.net.ssl.trustStoreType");
464464
}

0 commit comments

Comments
 (0)