问题描述
我有一个Redis的Azure缓存-已启用Premium和Cluster。我一直在尝试使用spring-boot-starter-data-redis
(春季启动版本:2.3.4.RELEASE
,Java版本:11
)并使用lettuce客户端连接到Redis,但是当我使用Lettuce抛出以下SSL异常时我将Redis视为Redis群集,但将其用作独立Redis服务器时连接正常。
我的pom.xml
依赖项是:
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org.junit.vintage</groupId>
<artifactId>junit-vintage-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
Java代码:
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.data.redis.RedisProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.*;
import org.springframework.data.redis.connection.lettuce.LettuceClientConfiguration;
import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
import org.springframework.data.redis.core.StringRedisTemplate;
@Configuration
class LettuceConfig {
@Bean
StringRedisTemplate getStringRedisTemplate(final RedisProperties redisProperties) {
return new StringRedisTemplate(getRedisConnectionFactory(redisProperties));
}
@Bean
RedisConnectionFactory getRedisConnectionFactory(final RedisProperties redisProperties) {
final RedisNode redisNode = RedisNode.newRedisNode()
.listeningAt(redisProperties.getHost(),redisProperties.getPort())
.build();
// Connecting as a Redis Cluster
final RedisClusterConfiguration redisClusterConfiguration = new RedisClusterConfiguration();
redisClusterConfiguration.addClusterNode(redisNode);
redisClusterConfiguration.setPassword(RedisPassword.of(redisProperties.getPassword()));
// Connecting as a Standalone Redis server
final RedisStandaloneConfiguration redisStandaloneConfiguration = new RedisStandaloneConfiguration();
redisStandaloneConfiguration.setHostName(redisProperties.getHost());
redisStandaloneConfiguration.setPort(redisProperties.getPort());
redisStandaloneConfiguration.setPassword(RedisPassword.of(redisProperties.getPassword()));
final LettuceClientConfiguration.LettuceClientConfigurationBuilder lettuceClientConfigurationBuilder =
LettuceClientConfiguration.builder()
.clientName(redisProperties.getClientName())
.commandTimeout(redisProperties.getTimeout());
if (redisProperties.isSsl()) {
lettuceClientConfigurationBuilder.useSsl();
}
final LettuceClientConfiguration lettuceClientConfiguration = lettuceClientConfigurationBuilder.build();
return new LettuceConnectionFactory(redisClusterConfiguration,lettuceClientConfiguration);
}
}
@SpringBootApplication
public class LettuceClusterApplication implements CommandLineRunner {
private final StringRedisTemplate stringRedisTemplate;
@Autowired
public LettuceClusterApplication(final StringRedisTemplate stringRedisTemplate) {
this.stringRedisTemplate = stringRedisTemplate;
}
public static void main(String[] args) {
SpringApplication.run(LettuceClusterApplication.class,args);
}
@Override
public void run(String... args) throws Exception {
System.out.println(stringRedisTemplate.hasKey("abc"));
}
}
在redisStandaloneConfiguration
中使用new LettuceConnectionFactory(...,...)
时,代码可以正常工作,但是如果我使用redisClusterConfiguration
,则代码将失败,并具有以下异常:
java.lang.IllegalStateException: Failed to execute CommandLineRunner
at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:798) ~[spring-boot-2.3.4.RELEASE.jar:2.3.4.RELEASE]
...
Caused by: org.springframework.data.redis.RedisConnectionFailureException: Redis connection failed; nested exception is io.lettuce.core.RedisConnectionException: Unable to connect to [RedisURI [host='<redacted>.redis.cache.windows.net',port=6380]]
at org.springframework.data.redis.connection.lettuce.LettuceExceptionConverter.convert(LettuceExceptionConverter.java:66) ~[spring-data-redis-2.3.4.RELEASE.jar:2.3.4.RELEASE]
...
Caused by: io.lettuce.core.RedisConnectionException: Unable to connect to [RedisURI [host='<redacted>.redis.cache.windows.net',port=6380]]
at io.lettuce.core.RedisConnectionException.create(RedisConnectionException.java:78) ~[lettuce-core-5.3.4.RELEASE.jar:5.3.4.RELEASE]
...
Caused by: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address <redacted> found
...
Caused by: java.security.cert.CertificateException: No subject alternative names matching IP address <redacted> found
at java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:165) ~[na:na]
...
我的application.properties
文件:
spring.redis.host = <redacted>.redis.cache.windows.net
spring.redis.port = 6380
spring.redis.password = <redacted>
spring.redis.ssl = true
spring.redis.clientName = ${HOSTNAME}
spring.redis.timeout = 100000
更新:在Github中发现了类似的问题:https://github.com/lettuce-io/lettuce-core/issues/246,但它说它应该与生菜版本> 4.2
和我的生菜核心版本(捆绑在{ {1}}是spring-boot-starter-data-redis
。
同样值得一提的是说明相同的文档:https://lettuce.io/core/release/reference/#ssl
从Redis Standalone连接上的3.1版和Redis群集上的4.2版开始,Lettuce支持SSL连接
也引发了GitHub问题:https://github.com/lettuce-io/lettuce-core/issues/1454
解决方法
如果您的所有节点都具有与主机名相同的 IP 地址(我认为在 Azure Redis 缓存中就是这种情况,我认为),那么这是您可以将客户端配置为将未解析的 IP 地址映射回主机名的一种方法证书中列出。
@Bean
ClientResources clientResources(RedisProperties redisProperties) throws UnknownHostException {
var clientResourcesBuilder = DefaultClientResources.builder();
var configuredHost = redisProperties.getHost();
var inetAddresses = Arrays.asList(InetAddress.getAllByName(configuredHost));
MappingSocketAddressResolver resolver = MappingSocketAddressResolver.create(
DnsResolvers.UNRESOLVED,hostAndPort -> inetAddresses.stream()
.anyMatch(i -> i.getHostAddress().equals(hostAndPort.getHostText())) ?
HostAndPort.of(configuredHost,hostAndPort.getPort()) :
hostAndPort
);
clientResourcesBuilder.socketAddressResolver(resolver);
return clientResourcesBuilder.build();
}
据我所知,这是 Github issue 上列出的解决方案中最可取的,直到 Microsoft 从头解决问题。
,与以独立模式连接不同,以集群模式连接到 Azure redis 是一个两步过程:
- 连接到
<hostname:6380>
,进行身份验证并获取集群端点详细信息 - 连接到您在集群端点详细信息中获得的
<ip address:port>
,再次进行身份验证,然后将命令发送到您的密钥所在的特定集群分片
您得到 No subject alternative names matching IP address <redacted> found
的原因是 Azure redis 在集群端点详细信息中为您提供了 IP 地址 + 端口号,然后 Lettuce 尝试根据 IP 地址验证您的 SSL 连接 - 而不是主机名,但是失败,因为它尝试针对您当前连接到 something.redis.cache.windows.net
的服务器端点验证 SSL 证书主题或 SAN <ip address>:<port>
。
在大多数客户端库中,您可以通过配置或覆盖 SSL 证书验证来根据您的特定 redis 缓存的主机名验证服务器证书来解决此问题。
例如在 .Net StackExchange.redis 中,有一个名为“sslhost”的配置设置可用于此目的。
希望 Lettuce 也有类似的。