bookkeeper icon indicating copy to clipboard operation
bookkeeper copied to clipboard

Support SNI routing in bookkeeper

Open sijie opened this issue 5 years ago • 8 comments

Descriptions of the changes in this PR:

Motivation

Netty supports sending SNI header on TLS handshake (https://github.com/netty/netty/issues/3801#issuecomment-104274440).

This PR uses that Netty feature to send SNI header while connecting to proxy software. So we can add proxy servers (e.g. Envoy, Nginx) in front of bookies.

Changes

  • Add two configurations: bookieServiceUri and bookieConnectionMode. So the bookkeeper client can configure how it should connect to bookies.
  • Send SNI header on TLS handshake

sijie avatar Oct 08 '20 06:10 sijie

This is a draft to introduce sending SNI header in bookkeeper client. However, I think we need one more chance to make it work. Because in bookkeeper protocol, we use STARTTLS for promoting an insecure connection to TLS secured connection. That means we send requests before STARTTLS.

sijie avatar Oct 08 '20 06:10 sijie

Now that we have advanced service discovery (BP-38) and the new BookieId abstraction (BP-41, not yet landed completely) the Bookie could publish a pure-TLS endpoint on discovery metadata (BookieServiceInfo) and then the client could use directly that information

eolivelli avatar Oct 08 '20 07:10 eolivelli

@eolivelli Are you working on publishing a pure-TLS endpoint on discovery metadata?

sijie avatar Oct 08 '20 13:10 sijie

@sijie I am not working on TLS, the mechanism of BP-41 is quite generic, so we will be free to support new protocols for the Bookie seamlessly in the future, once the BP-41 is finished (missing a couple of patches currently, but I feel it will be ready for BK 4.12.0)

eolivelli avatar Oct 08 '20 13:10 eolivelli

@eolivelli okay will look into publishing a pure-TLS endpoint

sijie avatar Oct 08 '20 14:10 sijie

@sijie PTAL here for the discovery mechanisms (BP-38) https://github.com/apache/bookkeeper/pull/2214/files

here (BP-41 part 1 - already landed to master branch) the client is now able to leverage BP-38 https://github.com/apache/bookkeeper/pull/2404

eolivelli avatar Oct 08 '20 14:10 eolivelli

BP-41 has basically landed to master, so this work can move forward

eolivelli avatar Oct 27 '20 14:10 eolivelli

please update TLS tests with test for SNI

dlg99 avatar Feb 11 '21 20:02 dlg99