diff options
author | Bjørn Christian Seime <bjorn.christian@seime.no> | 2018-09-26 15:00:15 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-09-26 15:00:15 +0200 |
commit | fd7ad12f8ca32c2dda024383822935fac2ff7e67 (patch) | |
tree | 5648d747655f59c084db489d0a09a406dc49c277 /jrt | |
parent | 3a6ec425d48dc06cb6455fb3ae4eac9d10a7c37f (diff) | |
parent | 6a6f80b206b45fe7fcacb04bfd119dfab33ff25c (diff) |
Merge pull request #7101 from vespa-engine/bjorncs/tls
Introduce insecure mixed mode + move env var logic to separate class
Diffstat (limited to 'jrt')
-rw-r--r-- | jrt/src/com/yahoo/jrt/CryptoEngine.java | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/jrt/src/com/yahoo/jrt/CryptoEngine.java b/jrt/src/com/yahoo/jrt/CryptoEngine.java index 2ef936ec7ed..c27aba73873 100644 --- a/jrt/src/com/yahoo/jrt/CryptoEngine.java +++ b/jrt/src/com/yahoo/jrt/CryptoEngine.java @@ -2,10 +2,10 @@ package com.yahoo.jrt; -import com.yahoo.security.tls.TransportSecurityOptions; +import com.yahoo.security.tls.TransportSecurityUtils; +import com.yahoo.security.tls.TransportSecurityUtils.MixedMode; import java.nio.channels.SocketChannel; -import java.nio.file.Paths; /** @@ -16,12 +16,22 @@ import java.nio.file.Paths; **/ public interface CryptoEngine { public CryptoSocket createCryptoSocket(SocketChannel channel, boolean isServer); - static public CryptoEngine createDefault() { // TODO Move this logic to a dedicated factory class - String tlsConfigParameter = System.getenv("VESPA_TLS_CONFIG_FILE"); - if (tlsConfigParameter != null && !tlsConfigParameter.isEmpty()) { - return new TlsCryptoEngine(TransportSecurityOptions.fromJsonFile(Paths.get(tlsConfigParameter))); - } else { + static public CryptoEngine createDefault() { + if (!TransportSecurityUtils.isTransportSecurityEnabled()) { return new NullCryptoEngine(); } + TlsCryptoEngine tlsCryptoEngine = new TlsCryptoEngine(TransportSecurityUtils.getOptions().get()); + if (!TransportSecurityUtils.isInsecureMixedModeEnabled()) { + return tlsCryptoEngine; + } + MixedMode mixedMode = TransportSecurityUtils.getInsecureMixedMode().get(); + switch (mixedMode) { + case PLAINTEXT_CLIENT_MIXED_SERVER: + return new MaybeTlsCryptoEngine(tlsCryptoEngine, false); + case TLS_CLIENT_MIXED_SERVER: + return new MaybeTlsCryptoEngine(tlsCryptoEngine, true); + default: + throw new IllegalArgumentException(mixedMode.toString()); + } } } |