From be18ec4985478b05bd65d253e34abfb961dfc360 Mon Sep 17 00:00:00 2001 From: Bjørn Christian Seime Date: Thu, 4 Jul 2019 11:44:38 +0200 Subject: Fix typo in class name --- .../ssl/impl/DefaultSslContextFactoryProvider.java | 4 +- jrt/src/com/yahoo/jrt/CryptoEngine.java | 4 +- .../security/tls/ConfigFileBasedTlsContext.java | 185 +++++++++++++++++++++ .../security/tls/ConfigFiledBasedTlsContext.java | 185 --------------------- .../yahoo/security/tls/TransportSecurityUtils.java | 2 +- .../tls/ConfigFileBasedTlsContextTest.java | 70 ++++++++ .../tls/ConfigFiledBasedTlsContextTest.java | 70 -------- 7 files changed, 260 insertions(+), 260 deletions(-) create mode 100644 security-utils/src/main/java/com/yahoo/security/tls/ConfigFileBasedTlsContext.java delete mode 100644 security-utils/src/main/java/com/yahoo/security/tls/ConfigFiledBasedTlsContext.java create mode 100644 security-utils/src/test/java/com/yahoo/security/tls/ConfigFileBasedTlsContextTest.java delete mode 100644 security-utils/src/test/java/com/yahoo/security/tls/ConfigFiledBasedTlsContextTest.java diff --git a/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/DefaultSslContextFactoryProvider.java b/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/DefaultSslContextFactoryProvider.java index bd814937ab9..615cd5d46ad 100644 --- a/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/DefaultSslContextFactoryProvider.java +++ b/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/DefaultSslContextFactoryProvider.java @@ -3,7 +3,7 @@ package com.yahoo.jdisc.http.ssl.impl; import com.yahoo.component.AbstractComponent; import com.yahoo.jdisc.http.ssl.SslContextFactoryProvider; -import com.yahoo.security.tls.ConfigFiledBasedTlsContext; +import com.yahoo.security.tls.ConfigFileBasedTlsContext; import com.yahoo.security.tls.TlsContext; import com.yahoo.security.tls.TransportSecurityUtils; import org.eclipse.jetty.util.ssl.SslContextFactory; @@ -17,7 +17,7 @@ public class DefaultSslContextFactoryProvider extends AbstractComponent implemen private final SslContextFactoryProvider instance = TransportSecurityUtils.getConfigFile() .map(configFile -> (SslContextFactoryProvider) new StaticTlsContextBasedProvider( - new ConfigFiledBasedTlsContext(configFile, TransportSecurityUtils.getInsecureAuthorizationMode()))) + new ConfigFileBasedTlsContext(configFile, TransportSecurityUtils.getInsecureAuthorizationMode()))) .orElseGet(ThrowingSslContextFactoryProvider::new); @Override diff --git a/jrt/src/com/yahoo/jrt/CryptoEngine.java b/jrt/src/com/yahoo/jrt/CryptoEngine.java index 16ebdf105fc..8812264a3f1 100644 --- a/jrt/src/com/yahoo/jrt/CryptoEngine.java +++ b/jrt/src/com/yahoo/jrt/CryptoEngine.java @@ -4,7 +4,7 @@ package com.yahoo.jrt; import com.yahoo.security.tls.AuthorizationMode; import com.yahoo.security.tls.MixedMode; -import com.yahoo.security.tls.ConfigFiledBasedTlsContext; +import com.yahoo.security.tls.ConfigFileBasedTlsContext; import com.yahoo.security.tls.TlsContext; import com.yahoo.security.tls.TransportSecurityUtils; @@ -24,7 +24,7 @@ public interface CryptoEngine extends AutoCloseable { return new NullCryptoEngine(); } AuthorizationMode mode = TransportSecurityUtils.getInsecureAuthorizationMode(); - TlsContext tlsContext = new ConfigFiledBasedTlsContext(TransportSecurityUtils.getConfigFile().get(), mode); + TlsContext tlsContext = new ConfigFileBasedTlsContext(TransportSecurityUtils.getConfigFile().get(), mode); TlsCryptoEngine tlsCryptoEngine = new TlsCryptoEngine(tlsContext); MixedMode mixedMode = TransportSecurityUtils.getInsecureMixedMode(); switch (mixedMode) { diff --git a/security-utils/src/main/java/com/yahoo/security/tls/ConfigFileBasedTlsContext.java b/security-utils/src/main/java/com/yahoo/security/tls/ConfigFileBasedTlsContext.java new file mode 100644 index 00000000000..3b9158cf9b1 --- /dev/null +++ b/security-utils/src/main/java/com/yahoo/security/tls/ConfigFileBasedTlsContext.java @@ -0,0 +1,185 @@ +// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.security.tls; + +import com.yahoo.security.KeyStoreBuilder; +import com.yahoo.security.KeyStoreType; +import com.yahoo.security.KeyUtils; +import com.yahoo.security.SslContextBuilder; +import com.yahoo.security.X509CertificateUtils; +import com.yahoo.security.tls.authz.PeerAuthorizerTrustManager; +import com.yahoo.security.tls.policy.AuthorizedPeers; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLParameters; +import javax.net.ssl.X509ExtendedTrustManager; +import java.io.IOException; +import java.io.UncheckedIOException; +import java.lang.ref.WeakReference; +import java.nio.file.Files; +import java.nio.file.Path; +import java.security.KeyStore; +import java.time.Duration; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import java.util.concurrent.Executors; +import java.util.concurrent.ScheduledExecutorService; +import java.util.concurrent.ThreadFactory; +import java.util.concurrent.TimeUnit; +import java.util.logging.Level; +import java.util.logging.Logger; + +/** + * A {@link TlsContext} that uses the tls configuration specified in the transport security options file. + * The credentials are regularly reloaded to support short-lived certificates. + * + * @author bjorncs + */ +public class ConfigFileBasedTlsContext implements TlsContext { + + private static final Duration UPDATE_PERIOD = Duration.ofHours(1); + + private static final Logger log = Logger.getLogger(ConfigFileBasedTlsContext.class.getName()); + + private final TlsContext tlsContext; + private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor(new ReloaderThreadFactory()); + + public ConfigFileBasedTlsContext(Path tlsOptionsConfigFile, AuthorizationMode mode) { + TransportSecurityOptions options = TransportSecurityOptions.fromJsonFile(tlsOptionsConfigFile); + MutableX509TrustManager trustManager = new MutableX509TrustManager(); + MutableX509KeyManager keyManager = new MutableX509KeyManager(); + reloadTrustManager(options, trustManager); + reloadKeyManager(options, keyManager); + this.tlsContext = createDefaultTlsContext(options, mode, trustManager, keyManager); + this.scheduler.scheduleAtFixedRate(new CryptoMaterialReloader(tlsOptionsConfigFile, scheduler, trustManager, keyManager), + UPDATE_PERIOD.getSeconds()/*initial delay*/, + UPDATE_PERIOD.getSeconds(), + TimeUnit.SECONDS); + } + + private static void reloadTrustManager(TransportSecurityOptions options, MutableX509TrustManager trustManager) { + if (options.getCaCertificatesFile().isPresent()) { + trustManager.updateTruststore(loadTruststore(options.getCaCertificatesFile().get())); + } else { + trustManager.useDefaultTruststore(); + } + } + + private static void reloadKeyManager(TransportSecurityOptions options, MutableX509KeyManager keyManager) { + if (options.getPrivateKeyFile().isPresent() && options.getCertificatesFile().isPresent()) { + keyManager.updateKeystore(loadKeystore(options.getPrivateKeyFile().get(), options.getCertificatesFile().get()), new char[0]); + } else { + keyManager.useDefaultKeystore(); + } + } + + private static KeyStore loadTruststore(Path caCertificateFile) { + try { + return KeyStoreBuilder.withType(KeyStoreType.PKCS12) + .withCertificateEntries("cert", X509CertificateUtils.certificateListFromPem(Files.readString(caCertificateFile))) + .build(); + } catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + private static KeyStore loadKeystore(Path privateKeyFile, Path certificatesFile) { + try { + return KeyStoreBuilder.withType(KeyStoreType.PKCS12) + .withKeyEntry( + "default", + KeyUtils.fromPemEncodedPrivateKey(Files.readString(privateKeyFile)), + X509CertificateUtils.certificateListFromPem(Files.readString(certificatesFile))) + .build(); + } catch (IOException e) { + throw new UncheckedIOException(e); + } + } + + private static DefaultTlsContext createDefaultTlsContext(TransportSecurityOptions options, + AuthorizationMode mode, + MutableX509TrustManager mutableTrustManager, + MutableX509KeyManager mutableKeyManager) { + SSLContext sslContext = new SslContextBuilder() + .withKeyManager(mutableKeyManager) + .withTrustManagerFactory( + ignoredTruststore -> options.getAuthorizedPeers() + .map(authorizedPeers -> (X509ExtendedTrustManager) new PeerAuthorizerTrustManager(authorizedPeers, mode, mutableTrustManager)) + .orElseGet(() -> new PeerAuthorizerTrustManager(new AuthorizedPeers(Set.of()), AuthorizationMode.DISABLE, mutableTrustManager))) + .build(); + List acceptedCiphers = options.getAcceptedCiphers(); + Set ciphers = acceptedCiphers.isEmpty() ? TlsContext.ALLOWED_CIPHER_SUITES : new HashSet<>(acceptedCiphers); + return new DefaultTlsContext(sslContext, ciphers, PeerAuthentication.NEED); + } + + // Wrapped methods from TlsContext + @Override public SSLContext context() { return tlsContext.context(); } + @Override public SSLParameters parameters() { return tlsContext.parameters(); } + @Override public SSLEngine createSslEngine() { return tlsContext.createSslEngine(); } + @Override public SSLEngine createSslEngine(String peerHost, int peerPort) { return tlsContext.createSslEngine(peerHost, peerPort); } + + @Override + public void close() { + try { + scheduler.shutdownNow(); + if (!scheduler.awaitTermination(10, TimeUnit.SECONDS)) { + throw new RuntimeException("Unable to shutdown executor before timeout"); + } + } catch (InterruptedException e) { + throw new RuntimeException(e); + } + } + + // Note: no reference to outer class (directly or indirectly) to ensure trust/key managers are eventually GCed once + // there are no more use of the outer class and the underlying SSLContext + private static class CryptoMaterialReloader implements Runnable { + + final Path tlsOptionsConfigFile; + final ScheduledExecutorService scheduler; + final WeakReference trustManager; + final WeakReference keyManager; + + CryptoMaterialReloader(Path tlsOptionsConfigFile, + ScheduledExecutorService scheduler, + MutableX509TrustManager trustManager, + MutableX509KeyManager keyManager) { + this.tlsOptionsConfigFile = tlsOptionsConfigFile; + this.scheduler = scheduler; + this.trustManager = new WeakReference<>(trustManager); + this.keyManager = new WeakReference<>(keyManager); + } + + @Override + public void run() { + try { + MutableX509TrustManager trustManager = this.trustManager.get(); + MutableX509KeyManager keyManager = this.keyManager.get(); + if (trustManager == null && keyManager == null) { + scheduler.shutdown(); + return; + } + TransportSecurityOptions options = TransportSecurityOptions.fromJsonFile(tlsOptionsConfigFile); + if (trustManager != null) { + reloadTrustManager(options, trustManager); + } + if (keyManager != null) { + reloadKeyManager(options, keyManager); + } + } catch (Throwable t) { + log.log(Level.SEVERE, String.format("Failed to reload crypto material (path='%s'): %s", tlsOptionsConfigFile, t.getMessage()), t); + } + } + } + + // Static class to ensure no reference to outer class is contained + private static class ReloaderThreadFactory implements ThreadFactory { + @Override + public Thread newThread(Runnable r) { + Thread thread = new Thread(r, "tls-context-reloader"); + thread.setDaemon(true); + return thread; + } + } + +} diff --git a/security-utils/src/main/java/com/yahoo/security/tls/ConfigFiledBasedTlsContext.java b/security-utils/src/main/java/com/yahoo/security/tls/ConfigFiledBasedTlsContext.java deleted file mode 100644 index 4b986e1a8d5..00000000000 --- a/security-utils/src/main/java/com/yahoo/security/tls/ConfigFiledBasedTlsContext.java +++ /dev/null @@ -1,185 +0,0 @@ -// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -package com.yahoo.security.tls; - -import com.yahoo.security.KeyStoreBuilder; -import com.yahoo.security.KeyStoreType; -import com.yahoo.security.KeyUtils; -import com.yahoo.security.SslContextBuilder; -import com.yahoo.security.X509CertificateUtils; -import com.yahoo.security.tls.authz.PeerAuthorizerTrustManager; -import com.yahoo.security.tls.policy.AuthorizedPeers; - -import javax.net.ssl.SSLContext; -import javax.net.ssl.SSLEngine; -import javax.net.ssl.SSLParameters; -import javax.net.ssl.X509ExtendedTrustManager; -import java.io.IOException; -import java.io.UncheckedIOException; -import java.lang.ref.WeakReference; -import java.nio.file.Files; -import java.nio.file.Path; -import java.security.KeyStore; -import java.time.Duration; -import java.util.HashSet; -import java.util.List; -import java.util.Set; -import java.util.concurrent.Executors; -import java.util.concurrent.ScheduledExecutorService; -import java.util.concurrent.ThreadFactory; -import java.util.concurrent.TimeUnit; -import java.util.logging.Level; -import java.util.logging.Logger; - -/** - * A {@link TlsContext} that uses the tls configuration specified in the transport security options file. - * The credentials are regularly reloaded to support short-lived certificates. - * - * @author bjorncs - */ -public class ConfigFiledBasedTlsContext implements TlsContext { - - private static final Duration UPDATE_PERIOD = Duration.ofHours(1); - - private static final Logger log = Logger.getLogger(ConfigFiledBasedTlsContext.class.getName()); - - private final TlsContext tlsContext; - private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor(new ReloaderThreadFactory()); - - public ConfigFiledBasedTlsContext(Path tlsOptionsConfigFile, AuthorizationMode mode) { - TransportSecurityOptions options = TransportSecurityOptions.fromJsonFile(tlsOptionsConfigFile); - MutableX509TrustManager trustManager = new MutableX509TrustManager(); - MutableX509KeyManager keyManager = new MutableX509KeyManager(); - reloadTrustManager(options, trustManager); - reloadKeyManager(options, keyManager); - this.tlsContext = createDefaultTlsContext(options, mode, trustManager, keyManager); - this.scheduler.scheduleAtFixedRate(new CryptoMaterialReloader(tlsOptionsConfigFile, scheduler, trustManager, keyManager), - UPDATE_PERIOD.getSeconds()/*initial delay*/, - UPDATE_PERIOD.getSeconds(), - TimeUnit.SECONDS); - } - - private static void reloadTrustManager(TransportSecurityOptions options, MutableX509TrustManager trustManager) { - if (options.getCaCertificatesFile().isPresent()) { - trustManager.updateTruststore(loadTruststore(options.getCaCertificatesFile().get())); - } else { - trustManager.useDefaultTruststore(); - } - } - - private static void reloadKeyManager(TransportSecurityOptions options, MutableX509KeyManager keyManager) { - if (options.getPrivateKeyFile().isPresent() && options.getCertificatesFile().isPresent()) { - keyManager.updateKeystore(loadKeystore(options.getPrivateKeyFile().get(), options.getCertificatesFile().get()), new char[0]); - } else { - keyManager.useDefaultKeystore(); - } - } - - private static KeyStore loadTruststore(Path caCertificateFile) { - try { - return KeyStoreBuilder.withType(KeyStoreType.PKCS12) - .withCertificateEntries("cert", X509CertificateUtils.certificateListFromPem(Files.readString(caCertificateFile))) - .build(); - } catch (IOException e) { - throw new UncheckedIOException(e); - } - } - - private static KeyStore loadKeystore(Path privateKeyFile, Path certificatesFile) { - try { - return KeyStoreBuilder.withType(KeyStoreType.PKCS12) - .withKeyEntry( - "default", - KeyUtils.fromPemEncodedPrivateKey(Files.readString(privateKeyFile)), - X509CertificateUtils.certificateListFromPem(Files.readString(certificatesFile))) - .build(); - } catch (IOException e) { - throw new UncheckedIOException(e); - } - } - - private static DefaultTlsContext createDefaultTlsContext(TransportSecurityOptions options, - AuthorizationMode mode, - MutableX509TrustManager mutableTrustManager, - MutableX509KeyManager mutableKeyManager) { - SSLContext sslContext = new SslContextBuilder() - .withKeyManager(mutableKeyManager) - .withTrustManagerFactory( - ignoredTruststore -> options.getAuthorizedPeers() - .map(authorizedPeers -> (X509ExtendedTrustManager) new PeerAuthorizerTrustManager(authorizedPeers, mode, mutableTrustManager)) - .orElseGet(() -> new PeerAuthorizerTrustManager(new AuthorizedPeers(Set.of()), AuthorizationMode.DISABLE, mutableTrustManager))) - .build(); - List acceptedCiphers = options.getAcceptedCiphers(); - Set ciphers = acceptedCiphers.isEmpty() ? TlsContext.ALLOWED_CIPHER_SUITES : new HashSet<>(acceptedCiphers); - return new DefaultTlsContext(sslContext, ciphers, PeerAuthentication.NEED); - } - - // Wrapped methods from TlsContext - @Override public SSLContext context() { return tlsContext.context(); } - @Override public SSLParameters parameters() { return tlsContext.parameters(); } - @Override public SSLEngine createSslEngine() { return tlsContext.createSslEngine(); } - @Override public SSLEngine createSslEngine(String peerHost, int peerPort) { return tlsContext.createSslEngine(peerHost, peerPort); } - - @Override - public void close() { - try { - scheduler.shutdownNow(); - if (!scheduler.awaitTermination(10, TimeUnit.SECONDS)) { - throw new RuntimeException("Unable to shutdown executor before timeout"); - } - } catch (InterruptedException e) { - throw new RuntimeException(e); - } - } - - // Note: no reference to outer class (directly or indirectly) to ensure trust/key managers are eventually GCed once - // there are no more use of the outer class and the underlying SSLContext - private static class CryptoMaterialReloader implements Runnable { - - final Path tlsOptionsConfigFile; - final ScheduledExecutorService scheduler; - final WeakReference trustManager; - final WeakReference keyManager; - - CryptoMaterialReloader(Path tlsOptionsConfigFile, - ScheduledExecutorService scheduler, - MutableX509TrustManager trustManager, - MutableX509KeyManager keyManager) { - this.tlsOptionsConfigFile = tlsOptionsConfigFile; - this.scheduler = scheduler; - this.trustManager = new WeakReference<>(trustManager); - this.keyManager = new WeakReference<>(keyManager); - } - - @Override - public void run() { - try { - MutableX509TrustManager trustManager = this.trustManager.get(); - MutableX509KeyManager keyManager = this.keyManager.get(); - if (trustManager == null && keyManager == null) { - scheduler.shutdown(); - return; - } - TransportSecurityOptions options = TransportSecurityOptions.fromJsonFile(tlsOptionsConfigFile); - if (trustManager != null) { - reloadTrustManager(options, trustManager); - } - if (keyManager != null) { - reloadKeyManager(options, keyManager); - } - } catch (Throwable t) { - log.log(Level.SEVERE, String.format("Failed to reload crypto material (path='%s'): %s", tlsOptionsConfigFile, t.getMessage()), t); - } - } - } - - // Static class to ensure no reference to outer class is contained - private static class ReloaderThreadFactory implements ThreadFactory { - @Override - public Thread newThread(Runnable r) { - Thread thread = new Thread(r, "tls-context-reloader"); - thread.setDaemon(true); - return thread; - } - } - -} diff --git a/security-utils/src/main/java/com/yahoo/security/tls/TransportSecurityUtils.java b/security-utils/src/main/java/com/yahoo/security/tls/TransportSecurityUtils.java index 514a538f0f9..f28cad2a071 100644 --- a/security-utils/src/main/java/com/yahoo/security/tls/TransportSecurityUtils.java +++ b/security-utils/src/main/java/com/yahoo/security/tls/TransportSecurityUtils.java @@ -66,7 +66,7 @@ public class TransportSecurityUtils { public static Optional createTlsContext() { return getConfigFile() - .map(configFile -> new ConfigFiledBasedTlsContext(configFile, getInsecureAuthorizationMode())); + .map(configFile -> new ConfigFileBasedTlsContext(configFile, getInsecureAuthorizationMode())); } private static Optional getEnvironmentVariable(Map environmentVariables, String variableName) { diff --git a/security-utils/src/test/java/com/yahoo/security/tls/ConfigFileBasedTlsContextTest.java b/security-utils/src/test/java/com/yahoo/security/tls/ConfigFileBasedTlsContextTest.java new file mode 100644 index 00000000000..4e6f0a141b0 --- /dev/null +++ b/security-utils/src/test/java/com/yahoo/security/tls/ConfigFileBasedTlsContextTest.java @@ -0,0 +1,70 @@ +// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. +package com.yahoo.security.tls; + +import com.yahoo.security.KeyUtils; +import com.yahoo.security.X509CertificateBuilder; +import com.yahoo.security.X509CertificateUtils; +import org.junit.Rule; +import org.junit.Test; +import org.junit.rules.TemporaryFolder; + +import javax.net.ssl.SSLEngine; +import javax.security.auth.x500.X500Principal; +import java.io.IOException; +import java.math.BigInteger; +import java.nio.file.Files; +import java.nio.file.Path; +import java.security.KeyPair; +import java.security.cert.X509Certificate; + +import static com.yahoo.security.KeyAlgorithm.EC; +import static com.yahoo.security.SignatureAlgorithm.SHA256_WITH_ECDSA; +import static java.time.Instant.EPOCH; +import static java.time.temporal.ChronoUnit.DAYS; +import static org.assertj.core.api.Assertions.assertThat; + +/** + * @author bjorncs + */ +public class ConfigFileBasedTlsContextTest { + + @Rule + public TemporaryFolder tempDirectory = new TemporaryFolder(); + + @Test + public void can_create_sslcontext_from_credentials() throws IOException, InterruptedException { + KeyPair keyPair = KeyUtils.generateKeypair(EC); + Path privateKeyFile = tempDirectory.newFile().toPath(); + Files.writeString(privateKeyFile, KeyUtils.toPem(keyPair.getPrivate())); + + X509Certificate certificate = X509CertificateBuilder + .fromKeypair(keyPair, new X500Principal("CN=dummy"), EPOCH, EPOCH.plus(1, DAYS), SHA256_WITH_ECDSA, BigInteger.ONE) + .build(); + Path certificateChainFile = tempDirectory.newFile().toPath(); + String certificatePem = X509CertificateUtils.toPem(certificate); + Files.writeString(certificateChainFile, certificatePem); + + Path caCertificatesFile = tempDirectory.newFile().toPath(); + Files.writeString(caCertificatesFile, certificatePem); + + TransportSecurityOptions options = new TransportSecurityOptions.Builder() + .withCertificates(certificateChainFile, privateKeyFile) + .withCaCertificates(caCertificatesFile) + .build(); + + Path optionsFile = tempDirectory.newFile().toPath(); + options.toJsonFile(optionsFile); + + try (TlsContext tlsContext = new ConfigFileBasedTlsContext(optionsFile, AuthorizationMode.ENFORCE)) { + SSLEngine sslEngine = tlsContext.createSslEngine(); + assertThat(sslEngine).isNotNull(); + String[] enabledCiphers = sslEngine.getEnabledCipherSuites(); + assertThat(enabledCiphers).isNotEmpty(); + assertThat(enabledCiphers).isSubsetOf(TlsContext.ALLOWED_CIPHER_SUITES.toArray(new String[0])); + + String[] enabledProtocols = sslEngine.getEnabledProtocols(); + assertThat(enabledProtocols).contains("TLSv1.2"); + } + } + +} \ No newline at end of file diff --git a/security-utils/src/test/java/com/yahoo/security/tls/ConfigFiledBasedTlsContextTest.java b/security-utils/src/test/java/com/yahoo/security/tls/ConfigFiledBasedTlsContextTest.java deleted file mode 100644 index 5b0fcfc9d65..00000000000 --- a/security-utils/src/test/java/com/yahoo/security/tls/ConfigFiledBasedTlsContextTest.java +++ /dev/null @@ -1,70 +0,0 @@ -// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root. -package com.yahoo.security.tls; - -import com.yahoo.security.KeyUtils; -import com.yahoo.security.X509CertificateBuilder; -import com.yahoo.security.X509CertificateUtils; -import org.junit.Rule; -import org.junit.Test; -import org.junit.rules.TemporaryFolder; - -import javax.net.ssl.SSLEngine; -import javax.security.auth.x500.X500Principal; -import java.io.IOException; -import java.math.BigInteger; -import java.nio.file.Files; -import java.nio.file.Path; -import java.security.KeyPair; -import java.security.cert.X509Certificate; - -import static com.yahoo.security.KeyAlgorithm.EC; -import static com.yahoo.security.SignatureAlgorithm.SHA256_WITH_ECDSA; -import static java.time.Instant.EPOCH; -import static java.time.temporal.ChronoUnit.DAYS; -import static org.assertj.core.api.Assertions.assertThat; - -/** - * @author bjorncs - */ -public class ConfigFiledBasedTlsContextTest { - - @Rule - public TemporaryFolder tempDirectory = new TemporaryFolder(); - - @Test - public void can_create_sslcontext_from_credentials() throws IOException, InterruptedException { - KeyPair keyPair = KeyUtils.generateKeypair(EC); - Path privateKeyFile = tempDirectory.newFile().toPath(); - Files.writeString(privateKeyFile, KeyUtils.toPem(keyPair.getPrivate())); - - X509Certificate certificate = X509CertificateBuilder - .fromKeypair(keyPair, new X500Principal("CN=dummy"), EPOCH, EPOCH.plus(1, DAYS), SHA256_WITH_ECDSA, BigInteger.ONE) - .build(); - Path certificateChainFile = tempDirectory.newFile().toPath(); - String certificatePem = X509CertificateUtils.toPem(certificate); - Files.writeString(certificateChainFile, certificatePem); - - Path caCertificatesFile = tempDirectory.newFile().toPath(); - Files.writeString(caCertificatesFile, certificatePem); - - TransportSecurityOptions options = new TransportSecurityOptions.Builder() - .withCertificates(certificateChainFile, privateKeyFile) - .withCaCertificates(caCertificatesFile) - .build(); - - Path optionsFile = tempDirectory.newFile().toPath(); - options.toJsonFile(optionsFile); - - try (TlsContext tlsContext = new ConfigFiledBasedTlsContext(optionsFile, AuthorizationMode.ENFORCE)) { - SSLEngine sslEngine = tlsContext.createSslEngine(); - assertThat(sslEngine).isNotNull(); - String[] enabledCiphers = sslEngine.getEnabledCipherSuites(); - assertThat(enabledCiphers).isNotEmpty(); - assertThat(enabledCiphers).isSubsetOf(TlsContext.ALLOWED_CIPHER_SUITES.toArray(new String[0])); - - String[] enabledProtocols = sslEngine.getEnabledProtocols(); - assertThat(enabledProtocols).contains("TLSv1.2"); - } - } - -} \ No newline at end of file -- cgit v1.2.3