{"action":"created","issue":{"url":"https://api.github.com/repos/apache/incubator-heron/issues/2850","repository_url":"https://api.github.com/repos/apache/incubator-heron","labels_url":"https://api.github.com/repos/apache/incubator-heron/issues/2850/labels{/name}","comments_url":"https://api.github.com/repos/apache/incubator-heron/issues/2850/comments","events_url":"https://api.github.com/repos/apache/incubator-heron/issues/2850/events","html_url":"https://github.com/apache/incubator-heron/pull/2850","id":311704832,"number":2850,"title":"Add SSL support for stream manager connections","user":{"login":"ajorgensen","id":509779,"avatar_url":"https://avatars3.githubusercontent.com/u/509779?v=4","gravatar_id":"","url":"https://api.github.com/users/ajorgensen","html_url":"https://github.com/ajorgensen","followers_url":"https://api.github.com/users/ajorgensen/followers","following_url":"https://api.github.com/users/ajorgensen/following{/other_user}","gists_url":"https://api.github.com/users/ajorgensen/gists{/gist_id}","starred_url":"https://api.github.com/users/ajorgensen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajorgensen/subscriptions","organizations_url":"https://api.github.com/users/ajorgensen/orgs","repos_url":"https://api.github.com/users/ajorgensen/repos","events_url":"https://api.github.com/users/ajorgensen/events{/privacy}","received_events_url":"https://api.github.com/users/ajorgensen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-04-05T17:39:20Z","updated_at":"2018-04-06T12:09:21Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/apache/incubator-heron/pulls/2850","html_url":"https://github.com/apache/incubator-heron/pull/2850","diff_url":"https://github.com/apache/incubator-heron/pull/2850.diff","patch_url":"https://github.com/apache/incubator-heron/pull/2850.patch"},"body":"This commit adds ssl support for connection between stream managers. The\r\nmain purpose of this change is to protect data that is in-transit\r\nthrough a heron topology from packet sniffing as such it is only\r\nimplemented between each stream manager. Communication to the tmaster,\r\nmetrics manager, or instance will not be encrypted.\r\n\r\nThis basic implementation adds the ability to optionally pass an ssl certificate\r\nand private key to the libevent connection option. This change does not\r\nintroduce any keystores and relies on proper permissions and keys to\r\nexist on the system or in the sandbox at the time of the deploy.\r\n\r\nThe introduction of openssl is specifically left as a dynamic link\r\ninstead of a static link. The reason for this is if there is a\r\nvulnerability discovered in an openssl library it will but much easier\r\nfor the topology owner to simply upgrade the system version of openssl\r\nto pick up the fix. If openssl was statically linked into heron it would\r\nrequire re-releasing older heron versions statically linked to the\r\nlatest openssl version and all topology owners to redownload the release\r\nwhich would make rolling out the fix much harder.\r\n\r\nCloses https://github.com/apache/incubator-heron/issues/2773\r\n\r\n# Open Question\r\nSince bazel/cpp are not my specialty. I do have a few open questions that will likely need to be addressed before this is merged.\r\n\r\n1. What happens in environments where openssl is not installed? Can we have a flag that optionally removes the ssl feature if necessary?\r\n2. I need to write up documentation for this but I think would like to have it bake in a production environment for a bit to make sure there are no issues. I can write up a document but mark it as beta if we want.\r\n"},"comment":{"url":"https://api.github.com/repos/apache/incubator-heron/issues/comments/379234202","html_url":"https://github.com/apache/incubator-heron/pull/2850#issuecomment-379234202","issue_url":"https://api.github.com/repos/apache/incubator-heron/issues/2850","id":379234202,"user":{"login":"ajorgensen","id":509779,"avatar_url":"https://avatars3.githubusercontent.com/u/509779?v=4","gravatar_id":"","url":"https://api.github.com/users/ajorgensen","html_url":"https://github.com/ajorgensen","followers_url":"https://api.github.com/users/ajorgensen/followers","following_url":"https://api.github.com/users/ajorgensen/following{/other_user}","gists_url":"https://api.github.com/users/ajorgensen/gists{/gist_id}","starred_url":"https://api.github.com/users/ajorgensen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajorgensen/subscriptions","organizations_url":"https://api.github.com/users/ajorgensen/orgs","repos_url":"https://api.github.com/users/ajorgensen/repos","events_url":"https://api.github.com/users/ajorgensen/events{/privacy}","received_events_url":"https://api.github.com/users/ajorgensen/received_events","type":"User","site_admin":false},"created_at":"2018-04-06T12:09:21Z","updated_at":"2018-04-06T12:09:21Z","author_association":"CONTRIBUTOR","body":"@kramasamy yes the intention is for everything to function as is and *only* in the case that a certificate and private key path are provided will an ssl connection be established.\r\n\r\nAnyone running a production environment should always have their openssl version up to date to make sure it has the latest patches, bug fixes, etc. As long as the version running on the production machine is ABI compatible with 1.1.0 then this should work as intended. I believe openssl tries to be as backwards compatible as possible (https://abi-laboratory.pro/tracker/timeline/openssl/). 1.1.0 was released in 2016 which was the largest breaking change they've made and until then its been close to 100%. I think anyone running a version older than 1.1.0 will have bigger problems then not being able to run heron with ssl but assuming the methods that we're using are still in that version it *should* just work. "}}
{"actor":{"display_login":"ajorgensen"}}