Java Mode类代码示例

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
public void configure(TransportLayer transportLayer, PrincipalBuilder principalBuilder, Map<String, ?> configs) throws KafkaException {
    try {
        this.transportLayer = transportLayer;
        this.configs = configs;

        // 初始化saslstate字段为SEND_HANDSHAKE_REQUEST
        setSaslState(handshakeRequestEnable ? SaslState.SEND_HANDSHAKE_REQUEST : SaslState.INITIAL);

        // determine client principal from subject for Kerberos to use as authorization id for the SaslClient.
        // For other mechanisms, the authenticated principal (username for PLAIN and SCRAM) is used as
        // authorization id. Hence the principal is not specified for creating the SaslClient.
        if (mechanism.equals(SaslConfigs.GSSAPI_MECHANISM))
            this.clientPrincipalName = firstPrincipal(subject);
        else
            this.clientPrincipalName = null;
        // 用于收集认证信息I的SaslClientCallbackHandler
        callbackHandler = new SaslClientCallbackHandler();
        callbackHandler.configure(configs, Mode.CLIENT, subject, mechanism);

        // 创建saslclient对象
        saslClient = createSaslClient();
    } catch (Exception e) {
        throw new KafkaException("Failed to configure SaslClientAuthenticator", e);
    }
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
private void createSaslServer(String mechanism) throws IOException {
    this.saslMechanism = mechanism;
    if (!ScramMechanism.isScram(mechanism))
        callbackHandler = new SaslServerCallbackHandler(jaasContext, kerberosNamer);
    else
        callbackHandler = new ScramServerCallbackHandler(credentialCache.cache(mechanism, ScramCredential.class));
    callbackHandler.configure(configs, Mode.SERVER, subject, saslMechanism);
    if (mechanism.equals(SaslConfigs.GSSAPI_MECHANISM)) {
        saslServer = createSaslKerberosServer(callbackHandler, configs, subject);
    } else {
        try {
            saslServer = Subject.doAs(subject, new PrivilegedExceptionAction<SaslServer>() {
                public SaslServer run() throws SaslException {
                    // 调用createSaslServer
                    return Sasl.createSaslServer(saslMechanism, "kafka", host, configs, callbackHandler);
                }
            });
        } catch (PrivilegedActionException e) {
            throw new SaslException("Kafka Server failed to create a SaslServer to interact with a client during session authentication", e.getCause());
        }
    }
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
public SSLEngine createSslEngine(String peerHost, int peerPort) {
    SSLEngine sslEngine = sslContext.createSSLEngine(peerHost, peerPort);
    if (cipherSuites != null) sslEngine.setEnabledCipherSuites(cipherSuites);
    if (enabledProtocols != null) sslEngine.setEnabledProtocols(enabledProtocols);

    // SSLParameters#setEndpointIdentificationAlgorithm enables endpoint validation
    // only in client mode. Hence, validation is enabled only for clients.
    if (mode == Mode.SERVER) {
        sslEngine.setUseClientMode(false);
        if (needClientAuth)
            sslEngine.setNeedClientAuth(needClientAuth);
        else
            sslEngine.setWantClientAuth(wantClientAuth);
    } else {
        sslEngine.setUseClientMode(true);
        SSLParameters sslParams = sslEngine.getSSLParameters();
        sslParams.setEndpointIdentificationAlgorithm(endpointIdentification);
        sslEngine.setSSLParameters(sslParams);
    }
    return sslEngine;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
private static Map<String, Object> createSslConfig(Mode mode, File keyStoreFile, Password password, Password keyPassword,
                                                   File trustStoreFile, Password trustStorePassword) {
    Map<String, Object> sslConfigs = new HashMap<>();
    sslConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.2"); // protocol to create SSLContext

    if (mode == Mode.SERVER || (mode == Mode.CLIENT && keyStoreFile != null)) {
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, keyStoreFile.getPath());
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "JKS");
        sslConfigs.put(SslConfigs.SSL_KEYMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, password);
        sslConfigs.put(SslConfigs.SSL_KEY_PASSWORD_CONFIG, keyPassword);
    }

    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, trustStoreFile.getPath());
    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, trustStorePassword);
    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "JKS");
    sslConfigs.put(SslConfigs.SSL_TRUSTMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());

    List<String> enabledProtocols  = new ArrayList<>();
    enabledProtocols.add("TLSv1.2");
    sslConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, enabledProtocols);

    return sslConfigs;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
private static Map<String, Object> createSslConfig(Mode mode, File keyStoreFile, Password password, Password keyPassword,
                                                   File trustStoreFile, Password trustStorePassword) {
  Map<String, Object> sslConfigs = new HashMap<>();
  sslConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.2"); // protocol to create SSLContext

  if (mode == Mode.SERVER || (mode == Mode.CLIENT && keyStoreFile != null)) {
    sslConfigs.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, keyStoreFile.getPath());
    sslConfigs.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "JKS");
    sslConfigs.put(SslConfigs.SSL_KEYMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());
    sslConfigs.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, password);
    sslConfigs.put(SslConfigs.SSL_KEY_PASSWORD_CONFIG, keyPassword);
  }

  sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, trustStoreFile.getPath());
  sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, trustStorePassword);
  sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "JKS");
  sslConfigs.put(SslConfigs.SSL_TRUSTMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());

  List<String> enabledProtocols = new ArrayList<>();
  enabledProtocols.add("TLSv1.2");
  sslConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, enabledProtocols);

  return sslConfigs;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
public void configure(TransportLayer transportLayer, PrincipalBuilder principalBuilder, Map<String, ?> configs) throws KafkaException {
    try {
        this.transportLayer = transportLayer;
        this.configs = configs;

        setSaslState(handshakeRequestEnable ? SaslState.SEND_HANDSHAKE_REQUEST : SaslState.INITIAL);

        // determine client principal from subject.
        if (!subject.getPrincipals().isEmpty()) {
            Principal clientPrincipal = subject.getPrincipals().iterator().next();
            this.clientPrincipalName = clientPrincipal.getName();
        } else {
            clientPrincipalName = null;
        }
        callbackHandler = new SaslClientCallbackHandler();
        callbackHandler.configure(configs, Mode.CLIENT, subject, mechanism);

        saslClient = createSaslClient();
    } catch (Exception e) {
        throw new KafkaException("Failed to configure SaslClientAuthenticator", e);
    }
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
private void createSaslServer(String mechanism) throws IOException {
    this.saslMechanism = mechanism;
    callbackHandler = new SaslServerCallbackHandler(Configuration.getConfiguration(), kerberosNamer);
    callbackHandler.configure(configs, Mode.SERVER, subject, saslMechanism);
    if (mechanism.equals(SaslConfigs.GSSAPI_MECHANISM)) {
        if (subject.getPrincipals().isEmpty())
            throw new IllegalArgumentException("subject must have at least one principal");
        saslServer = createSaslKerberosServer(callbackHandler, configs);
    } else {
        try {
            saslServer = Subject.doAs(subject, new PrivilegedExceptionAction<SaslServer>() {
                public SaslServer run() throws SaslException {
                    return Sasl.createSaslServer(saslMechanism, "kafka", host, configs, callbackHandler);
                }
            });
        } catch (PrivilegedActionException e) {
            throw new SaslException("Kafka Server failed to create a SaslServer to interact with a client during session authentication", e.getCause());
        }
    }
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
public SSLEngine createSslEngine(String peerHost, int peerPort) {
    SSLEngine sslEngine = sslContext.createSSLEngine(peerHost, peerPort);
    if (cipherSuites != null) sslEngine.setEnabledCipherSuites(cipherSuites);
    if (enabledProtocols != null) sslEngine.setEnabledProtocols(enabledProtocols);

    if (mode == Mode.SERVER) {
        sslEngine.setUseClientMode(false);
        if (needClientAuth)
            sslEngine.setNeedClientAuth(needClientAuth);
        else
            sslEngine.setWantClientAuth(wantClientAuth);
    } else {
        sslEngine.setUseClientMode(true);
        SSLParameters sslParams = sslEngine.getSSLParameters();
        sslParams.setEndpointIdentificationAlgorithm(endpointIdentification);
        sslEngine.setSSLParameters(sslParams);
    }
    return sslEngine;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
private static Map<String, Object> createSslConfig(Mode mode, File keyStoreFile, Password password, Password keyPassword,
                                                  File trustStoreFile, Password trustStorePassword) {
    Map<String, Object> sslConfigs = new HashMap<>();
    sslConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.2"); // protocol to create SSLContext

    if (mode == Mode.SERVER || (mode == Mode.CLIENT && keyStoreFile != null)) {
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG, keyStoreFile.getPath());
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, "JKS");
        sslConfigs.put(SslConfigs.SSL_KEYMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());
        sslConfigs.put(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG, password);
        sslConfigs.put(SslConfigs.SSL_KEY_PASSWORD_CONFIG, keyPassword);
    }

    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG, trustStoreFile.getPath());
    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG, trustStorePassword);
    sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, "JKS");
    sslConfigs.put(SslConfigs.SSL_TRUSTMANAGER_ALGORITHM_CONFIG, TrustManagerFactory.getDefaultAlgorithm());

    List<String> enabledProtocols  = new ArrayList<>();
    enabledProtocols.add("TLSv1.2");
    sslConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, enabledProtocols);

    return sslConfigs;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
@Test
public void testSslFactoryConfiguration() throws Exception {
    File trustStoreFile = File.createTempFile("truststore", ".jks");
    Map<String, Object> serverSslConfig = TestSslUtils.createSslConfig(false, true, Mode.SERVER, trustStoreFile, "server");
    SslFactory sslFactory = new SslFactory(Mode.SERVER);
    sslFactory.configure(serverSslConfig);
    //host and port are hints
    SSLEngine engine = sslFactory.createSslEngine("localhost", 0);
    assertNotNull(engine);
    String[] expectedProtocols = {"TLSv1.2"};
    assertArrayEquals(expectedProtocols, engine.getEnabledProtocols());
    assertEquals(false, engine.getUseClientMode());
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
@Test
public void testSslFactoryWithoutPasswordConfiguration() throws Exception {
    File trustStoreFile = File.createTempFile("truststore", ".jks");
    Map<String, Object> serverSslConfig = TestSslUtils.createSslConfig(false, true, Mode.SERVER, trustStoreFile, "server");
    // unset the password
    serverSslConfig.remove(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG);
    SslFactory sslFactory = new SslFactory(Mode.SERVER);
    try {
        sslFactory.configure(serverSslConfig);
    } catch (Exception e) {
        fail("An exception was thrown when configuring the truststore without a password: " + e);
    }
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
@Test
public void testClientMode() throws Exception {
    File trustStoreFile = File.createTempFile("truststore", ".jks");
    Map<String, Object> clientSslConfig = TestSslUtils.createSslConfig(false, true, Mode.CLIENT, trustStoreFile, "client");
    SslFactory sslFactory = new SslFactory(Mode.CLIENT);
    sslFactory.configure(clientSslConfig);
    //host and port are hints
    SSLEngine engine = sslFactory.createSslEngine("localhost", 0);
    assertTrue(engine.getUseClientMode());
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
/**
 * @param configs client/server configs
 * @return configured ChannelBuilder based on the configs.
 */
public static ChannelBuilder createChannelBuilder(Map<String, ?> configs) {
    SecurityProtocol securityProtocol = SecurityProtocol.forName((String) configs.get(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG));
    if (!SecurityProtocol.nonTestingValues().contains(securityProtocol))
        throw new ConfigException("Invalid SecurityProtocol " + securityProtocol);
    String clientSaslMechanism = (String) configs.get(SaslConfigs.SASL_MECHANISM);
    return ChannelBuilders.create(securityProtocol, Mode.CLIENT, LoginType.CLIENT, configs, clientSaslMechanism, true);
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
public Map<Object, Object> buildConfig() {
  applyDefaults();
  validate();

  Map<Object, Object> props = new HashMap<>();

  StringJoiner csvJoiner = new StringJoiner(",");
  if (plaintextPort >= 0) {
    csvJoiner.add(SecurityProtocol.PLAINTEXT.name + "://localhost:" + plaintextPort);
  }
  if (sslPort >= 0) {
    csvJoiner.add(SecurityProtocol.SSL.name + "://localhost:" + sslPort);
  }
  props.put("broker.id", Integer.toString(nodeId));
  props.put("listeners", csvJoiner.toString());
  props.put("log.dir", logDirectory.getAbsolutePath());
  props.put("zookeeper.connect", zkConnect);
  props.put("replica.socket.timeout.ms", Long.toString(socketTimeout));
  props.put("controller.socket.timeout.ms", Long.toString(socketTimeout));
  props.put("controlled.shutdown.enable", Boolean.toString(enableControlledShutdown));
  props.put("delete.topic.enable", Boolean.toString(enableDeleteTopic));
  props.put("controlled.shutdown.retry.backoff.ms", Long.toString(controlledShutdownRetryBackoff));
  props.put("log.cleaner.dedupe.buffer.size", Long.toString(logCleanerDedupBufferSize));
  props.put("log.cleaner.enable", Boolean.toString(enableLogCleaner));
  if (rack != null) {
    props.put("broker.rack", rack);
  }
  if (trustStore != null || sslPort > 0) {
    try {
      props.putAll(TestSslUtils.createSslConfig(false, true, Mode.SERVER, trustStore, "server" + nodeId));
      //switch interbroker to ssl
      props.put("security.inter.broker.protocol", "SSL");
    } catch (Exception e) {
      throw new IllegalStateException(e);
    }
  }

  return props;
}
 

import org.apache.kafka.common.network.Mode; //导入依赖的package包/类
protected void setSecurityConfigs(Properties clientProps, String certAlias) {
  SecurityProtocol protocol = securityProtocol();
  if (protocol == SecurityProtocol.SSL) {
    File trustStoreFile = trustStoreFile();
    if (trustStoreFile == null) {
      throw new AssertionError("ssl set but no trust store provided");
    }
    clientProps.setProperty(CommonClientConfigs.SECURITY_PROTOCOL_CONFIG, protocol.name);
    try {
      clientProps.putAll(TestSslUtils.createSslConfig(true, true, Mode.CLIENT, trustStoreFile, certAlias));
    } catch (Exception e) {
      throw new IllegalStateException(e);
    }
  }
}