1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
package com.yahoo.jdisc.http.ssl.impl;
import com.yahoo.config.InnerNode;
import com.yahoo.jdisc.http.ConnectorConfig;
import com.yahoo.jdisc.http.ssl.SslContextFactoryProvider;
import com.yahoo.jdisc.http.ssl.pem.PemSslKeyStore;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import java.io.IOException;
import java.io.UncheckedIOException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.KeyStore;
import java.util.Arrays;
import java.util.List;
import java.util.function.BiConsumer;
import java.util.function.Function;
import java.util.logging.Logger;
/**
* A implementation of {@link SslContextFactoryProvider} to be injected into non-ssl connectors or connectors using legacy ssl config
*
* @author bjorncs
*/
// TODO Vespa 7: Remove legacy ssl config
public class LegacySslContextFactoryProvider implements SslContextFactoryProvider {
private static final Logger log = Logger.getLogger(LegacySslContextFactoryProvider.class.getName());
private final ConnectorConfig connectorConfig;
@SuppressWarnings("deprecation")
private final com.yahoo.jdisc.http.SecretStore secretStore;
public LegacySslContextFactoryProvider(ConnectorConfig connectorConfig,
@SuppressWarnings("deprecation") com.yahoo.jdisc.http.SecretStore secretStore) {
validateConfig(connectorConfig.ssl());
this.connectorConfig = connectorConfig;
this.secretStore = secretStore;
}
@Override
public SslContextFactory getInstance(String containerId, int port) {
ConnectorConfig.Ssl sslConfig = connectorConfig.ssl();
if (!sslConfig.enabled()) throw new IllegalStateException();
SslContextFactory factory = new JDiscSslContextFactory();
switch (sslConfig.clientAuth()) {
case NEED_AUTH:
factory.setNeedClientAuth(true);
break;
case WANT_AUTH:
factory.setWantClientAuth(true);
break;
}
// NOTE: All ciphers matching ^TLS_RSA_.*$ are disabled by default in Jetty 9.4.12+ (https://github.com/eclipse/jetty.project/issues/2807)
// JDisc will allow these ciphers by default to support older clients (e.g. Java 8u60 and curl 7.29.0)
// Removing the exclusion will allow for the TLS_RSA variants that are not covered by other exclusions
String[] excludedCiphersWithoutTlsRsaExclusion = Arrays.stream(factory.getExcludeCipherSuites())
.filter(cipher -> !cipher.equals("^TLS_RSA_.*$"))
.toArray(String[]::new);
factory.setExcludeCipherSuites(excludedCiphersWithoutTlsRsaExclusion);
switch (sslConfig.keyStoreType()) {
case JKS:
factory.setKeyStorePath(sslConfig.keyStorePath());
factory.setKeyStoreType("JKS");
factory.setKeyStorePassword(secretStore.getSecret(sslConfig.keyDbKey()));
break;
case PEM:
factory.setKeyStorePath(sslConfig.keyStorePath());
factory.setKeyStore(createPemKeyStore(sslConfig.pemKeyStore()));
break;
}
if (!sslConfig.trustStorePath().isEmpty()) {
factory.setTrustStorePath(sslConfig.trustStorePath());
factory.setTrustStoreType(sslConfig.trustStoreType().toString());
if (sslConfig.useTrustStorePassword()) {
factory.setTrustStorePassword(secretStore.getSecret(sslConfig.keyDbKey()));
}
}
if (!sslConfig.prng().isEmpty()) {
factory.setSecureRandomAlgorithm(sslConfig.prng());
}
setStringArrayParameter(
factory, sslConfig.excludeProtocol(), ConnectorConfig.Ssl.ExcludeProtocol::name, SslContextFactory::setExcludeProtocols);
setStringArrayParameter(
factory, sslConfig.includeProtocol(), ConnectorConfig.Ssl.IncludeProtocol::name, SslContextFactory::setIncludeProtocols);
setStringArrayParameter(
factory, sslConfig.excludeCipherSuite(), ConnectorConfig.Ssl.ExcludeCipherSuite::name, SslContextFactory::setExcludeCipherSuites);
setStringArrayParameter(
factory, sslConfig.includeCipherSuite(), ConnectorConfig.Ssl.IncludeCipherSuite::name, SslContextFactory::setIncludeCipherSuites);
factory.setKeyManagerFactoryAlgorithm(sslConfig.sslKeyManagerFactoryAlgorithm());
factory.setProtocol(sslConfig.protocol());
return factory;
}
private static void validateConfig(ConnectorConfig.Ssl config) {
if (!config.enabled()) return;
switch (config.keyStoreType()) {
case JKS:
validateJksConfig(config);
break;
case PEM:
validatePemConfig(config);
break;
}
if (!config.trustStorePath().isEmpty() && config.useTrustStorePassword() && config.keyDbKey().isEmpty()) {
throw new IllegalArgumentException("Missing password for JKS truststore");
}
}
private static void validateJksConfig(ConnectorConfig.Ssl ssl) {
if (!ssl.pemKeyStore().keyPath().isEmpty() || ! ssl.pemKeyStore().certificatePath().isEmpty()) {
throw new IllegalArgumentException("pemKeyStore attributes can not be set when keyStoreType is JKS.");
}
if (ssl.keyDbKey().isEmpty()) {
throw new IllegalArgumentException("Missing password for JKS keystore");
}
}
private static void validatePemConfig(ConnectorConfig.Ssl ssl) {
if (! ssl.keyStorePath().isEmpty()) {
throw new IllegalArgumentException("keyStorePath can not be set when keyStoreType is PEM");
}
if (!ssl.keyDbKey().isEmpty()) {
log.warning("Encrypted PEM key stores are not supported. Password is only applied to truststore");
}
if (ssl.pemKeyStore().certificatePath().isEmpty()) {
throw new IllegalArgumentException("Missing certificate path.");
}
if (ssl.pemKeyStore().keyPath().isEmpty()) {
throw new IllegalArgumentException("Missing key path.");
}
}
private static KeyStore createPemKeyStore(ConnectorConfig.Ssl.PemKeyStore pemKeyStore) {
try {
Path certificatePath = Paths.get(pemKeyStore.certificatePath());
Path keyPath = Paths.get(pemKeyStore.keyPath());
return new PemSslKeyStore(certificatePath, keyPath).loadJavaKeyStore();
} catch (IOException e) {
throw new UncheckedIOException(e);
} catch (Exception e) {
throw new RuntimeException("Failed setting up key store for " + pemKeyStore.keyPath() + ", " + pemKeyStore.certificatePath(), e);
}
}
private static <T extends InnerNode> void setStringArrayParameter(SslContextFactory sslContextFactory,
List<T> configValues,
Function<T, String> nameProperty,
BiConsumer<SslContextFactory, String[]> setter) {
if (!configValues.isEmpty()) {
String[] nameArray = configValues.stream().map(nameProperty).toArray(String[]::new);
setter.accept(sslContextFactory, nameArray);
}
}
}
|
