-
Notifications
You must be signed in to change notification settings - Fork 25.6k
Introduce SslProfile class to simplify SSLService #132241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Pinging @elastic/es-security (Team:Security) |
@slobodanadamovic No rush on this. I'm not likely to have time to come back to it for another couple of weeks anyway. I tried to make each commit self contained, so if you want to review it commit-by-commit that should work quite well. |
Because profiles rely on looking up the configuration as a key in a map, we need equals to include `explicitlyConfigured`
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
Thanks for breaking refactoring into separate commits! Made it easier to review.
This change introduces a new `SslProfile` class. The `SslProfile` is roughly analogous to `SslConfiguration` and provides the runtime implementation support for an "ssl context" (but here called a "profile" because `SSLContext` is already a thing). This means that a number of methods that were previously called on `SSLService` are now called on a contextual `SslProfile`. For example, `SSLService.getHostnameVerifier(SslConfiguration)` is now `SslProfile.hostnameVerifier()` This has two primary benefits 1. Moving these methods out of `SSLService` provides a cleaner split. `SSLService` is now (more of) a manager for accessing profiles and configurations, and the profiles provide the runtime support for creating SSL connections. 2. It moves us a step towards having extensible SSL contexts/profiles. Because a `SslProfile` is self contained, we can inject one into a defined extension point without needing any direct reference to an `SSLService`. That is we can work towards an SPI extension point such as ``` public interface SslExtension { public Set<String> getSslProfileNames(); public void applySslProfile(String name, SslProfile profile); } ``` and that interface doesn't need to know anything more than what is contained in `SslProfile` (it knows nothing of `SSLService`).
This change introduces a new
SslProfile
class.The
SslProfile
is roughly analogous toSslConfiguration
and provides the runtime implementation support for an "ssl context" (but here called a "profile" becauseSSLContext
is already a thing).This means that a number of methods that were previously called on
SSLService
are now called on a contextualSslProfile
.For example,
SSLService.getHostnameVerifier(SslConfiguration)
is nowSslProfile.hostnameVerifier()
This has two primary benefits
SSLService
provides a cleaner split.SSLService
is now (more of) a manager for accessing profiles and configurations, and the profiles provide the runtime support for creating SSL connections.SslProfile
is self contained, we can inject one into a defined extension point without needing any direct reference to anSSLService
. That is we can work towards an SPI extension point such asSslProfile
(it knows nothing ofSSLService
).