mirror of
https://github.com/Alfresco/alfresco-community-repo.git
synced 2025-07-24 17:32:48 +00:00
[ACS-4459] Investigate and extend/universalize current custom Solr mTLS implementation in Repository (#1735)
* ACS-4459 Add new HttpClient Factory for Mutual TLS and implement it for Transform Service * ACS-4462 Add e2e for MTLS
This commit is contained in:
Kacper Magdziarz
GitHub
@@ -0,0 +1,110 @@
|
||||
/*
|
||||
* Copyright (C) 2023 Alfresco Software Limited.
|
||||
*
|
||||
* This file is part of Alfresco
|
||||
*
|
||||
* Alfresco is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* Alfresco is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public License
|
||||
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package org.alfresco.httpclient;
|
||||
|
||||
import javax.net.ssl.KeyManager;
|
||||
import javax.net.ssl.SSLContext;
|
||||
import javax.net.ssl.TrustManager;
|
||||
|
||||
import org.alfresco.error.AlfrescoRuntimeException;
|
||||
import org.apache.http.HttpHost;
|
||||
import org.apache.http.HttpRequestInterceptor;
|
||||
import org.apache.http.client.config.RequestConfig;
|
||||
import org.apache.http.conn.HttpClientConnectionManager;
|
||||
import org.apache.http.conn.ssl.NoopHostnameVerifier;
|
||||
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
|
||||
import org.apache.http.impl.client.CloseableHttpClient;
|
||||
import org.apache.http.impl.client.HttpClientBuilder;
|
||||
import org.apache.http.impl.client.HttpClients;
|
||||
import org.apache.http.impl.client.StandardHttpRequestRetryHandler;
|
||||
|
||||
|
||||
public class HttpClient4Factory
|
||||
{
|
||||
protected static final String TLS_PROTOCOL = "TLS";
|
||||
protected static final String HTTPS_PROTOCOL = "https";
|
||||
protected static final String HTTP_TARGET_HOST = "http.target_host";
|
||||
protected static final String TLS_V_1_2 = "TLSv1.2";
|
||||
protected static final String TLS_V_1_3 = "TLSv1.3";
|
||||
|
||||
private static SSLContext createSSLContext(HttpClientConfig config)
|
||||
{
|
||||
KeyManager[] keyManagers = config.getKeyStore().createKeyManagers();
|
||||
TrustManager[] trustManagers = config.getTrustStore().createTrustManagers();
|
||||
|
||||
try
|
||||
{
|
||||
SSLContext sslcontext = SSLContext.getInstance(TLS_PROTOCOL);
|
||||
sslcontext.init(keyManagers, trustManagers, null);
|
||||
return sslcontext;
|
||||
}
|
||||
catch(Throwable e)
|
||||
{
|
||||
throw new AlfrescoRuntimeException("Unable to create SSL context", e);
|
||||
}
|
||||
}
|
||||
|
||||
public static CloseableHttpClient createHttpClient(HttpClientConfig config)
|
||||
{
|
||||
return createHttpClient(config, null);
|
||||
}
|
||||
|
||||
public static CloseableHttpClient createHttpClient(HttpClientConfig config, HttpClientConnectionManager connectionManager)
|
||||
{
|
||||
HttpClientBuilder clientBuilder = HttpClients.custom();
|
||||
|
||||
if(config.isMTLSEnabled())
|
||||
{
|
||||
clientBuilder.addInterceptorFirst((HttpRequestInterceptor) (request, context) -> {
|
||||
if (!((HttpHost) context.getAttribute(HTTP_TARGET_HOST)).getSchemeName().equals(HTTPS_PROTOCOL))
|
||||
{
|
||||
String msg = "mTLS is enabled but provided URL does not use a secured protocol";
|
||||
throw new HttpClientException(msg);
|
||||
}
|
||||
});
|
||||
|
||||
SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(
|
||||
createSSLContext(config),
|
||||
new String[] { TLS_V_1_2, TLS_V_1_3 },
|
||||
null,
|
||||
config.isHostnameVerificationDisabled() ? new NoopHostnameVerifier() : SSLConnectionSocketFactory.getDefaultHostnameVerifier());
|
||||
clientBuilder.setSSLSocketFactory(sslConnectionSocketFactory);
|
||||
}
|
||||
|
||||
if(connectionManager != null)
|
||||
{
|
||||
clientBuilder.setConnectionManager(connectionManager);
|
||||
}
|
||||
|
||||
RequestConfig requestConfig = RequestConfig.custom()
|
||||
.setConnectTimeout(config.getConnectionTimeout())
|
||||
.setSocketTimeout(config.getSocketTimeout())
|
||||
.setConnectionRequestTimeout(config.getConnectionRequestTimeout())
|
||||
.build();
|
||||
|
||||
clientBuilder.setDefaultRequestConfig(requestConfig);
|
||||
clientBuilder.setMaxConnTotal(config.getMaxTotalConnections());
|
||||
clientBuilder.setMaxConnPerRoute(config.getMaxHostConnections());
|
||||
clientBuilder.setRetryHandler(new StandardHttpRequestRetryHandler(5, false));
|
||||
|
||||
return clientBuilder.build();
|
||||
}
|
||||
|
||||
}
|
||||
202
core/src/main/java/org/alfresco/httpclient/HttpClientConfig.java
Normal file
202
core/src/main/java/org/alfresco/httpclient/HttpClientConfig.java
Normal file
@@ -0,0 +1,202 @@
|
||||
/*
|
||||
* Copyright (C) 2023 Alfresco Software Limited.
|
||||
*
|
||||
* This file is part of Alfresco
|
||||
*
|
||||
* Alfresco is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* Alfresco is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public License
|
||||
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package org.alfresco.httpclient;
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Optional;
|
||||
import java.util.Properties;
|
||||
import java.util.stream.Collectors;
|
||||
|
||||
import org.alfresco.encryption.AlfrescoKeyStore;
|
||||
import org.alfresco.encryption.AlfrescoKeyStoreImpl;
|
||||
import org.alfresco.encryption.KeyResourceLoader;
|
||||
import org.alfresco.encryption.ssl.SSLEncryptionParameters;
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
|
||||
public class HttpClientConfig
|
||||
{
|
||||
private static final String HTTPCLIENT_CONFIG = "httpclient.config.";
|
||||
|
||||
protected static final Log LOGGER = LogFactory.getLog(HttpClientConfig.class);
|
||||
|
||||
private Properties properties;
|
||||
private String serviceName;
|
||||
|
||||
private SSLEncryptionParameters sslEncryptionParameters;
|
||||
private KeyResourceLoader keyResourceLoader;
|
||||
|
||||
private AlfrescoKeyStore keyStore;
|
||||
private AlfrescoKeyStore trustStore;
|
||||
|
||||
private Map<String, String> config;
|
||||
|
||||
public void setProperties(Properties properties)
|
||||
{
|
||||
this.properties = properties;
|
||||
}
|
||||
|
||||
public void setServiceName(String serviceName)
|
||||
{
|
||||
this.serviceName = serviceName;
|
||||
}
|
||||
|
||||
public void setSslEncryptionParameters(SSLEncryptionParameters sslEncryptionParameters)
|
||||
{
|
||||
this.sslEncryptionParameters = sslEncryptionParameters;
|
||||
}
|
||||
|
||||
public void setKeyResourceLoader(KeyResourceLoader keyResourceLoader)
|
||||
{
|
||||
this.keyResourceLoader = keyResourceLoader;
|
||||
}
|
||||
|
||||
public AlfrescoKeyStore getKeyStore()
|
||||
{
|
||||
return keyStore;
|
||||
}
|
||||
|
||||
public AlfrescoKeyStore getTrustStore()
|
||||
{
|
||||
return trustStore;
|
||||
}
|
||||
|
||||
public void init()
|
||||
{
|
||||
this.keyStore = new AlfrescoKeyStoreImpl(sslEncryptionParameters.getKeyStoreParameters(), keyResourceLoader);
|
||||
this.trustStore = new AlfrescoKeyStoreImpl(sslEncryptionParameters.getTrustStoreParameters(), keyResourceLoader);
|
||||
|
||||
config = retrieveConfig(serviceName);
|
||||
checkUnsupportedProperties(config);
|
||||
}
|
||||
|
||||
/**
|
||||
* Method used for retrieving HttpClient config from Global Properties
|
||||
* @param serviceName name of used service
|
||||
* @return map of properties
|
||||
*/
|
||||
private Map<String, String> retrieveConfig(String serviceName)
|
||||
{
|
||||
return properties.keySet().stream()
|
||||
.filter(key -> key instanceof String)
|
||||
.map(Object::toString)
|
||||
.filter(key -> key.startsWith(HTTPCLIENT_CONFIG + serviceName))
|
||||
.collect(Collectors.toMap(
|
||||
key -> key.replace(HTTPCLIENT_CONFIG + serviceName + ".", ""),
|
||||
key -> properties.getProperty(key, null)));
|
||||
}
|
||||
|
||||
private void checkUnsupportedProperties(Map<String, String> config)
|
||||
{
|
||||
config.keySet().stream()
|
||||
.filter(propertyName -> !HttpClientPropertiesEnum.isPropertyNameSupported(propertyName))
|
||||
.forEach(propertyName -> LOGGER.warn(String.format("For service [%s], an unsupported property [%s] is set", serviceName, propertyName)));
|
||||
}
|
||||
|
||||
private Integer getIntegerProperty(HttpClientPropertiesEnum property)
|
||||
{
|
||||
return Integer.parseInt(extractValueFromConfig(property).orElse("0"));
|
||||
}
|
||||
|
||||
private Boolean getBooleanProperty(HttpClientPropertiesEnum property)
|
||||
{
|
||||
return Boolean.parseBoolean(extractValueFromConfig(property).orElse("false"));
|
||||
}
|
||||
|
||||
private Optional<String> extractValueFromConfig(HttpClientPropertiesEnum property)
|
||||
{
|
||||
Optional<String> optionalProperty = Optional.ofNullable(config.get(property.name));
|
||||
if(property.isRequired && optionalProperty.isEmpty())
|
||||
{
|
||||
String msg = String.format("Required property: '%s' is empty.", property.name);
|
||||
throw new HttpClientException(msg);
|
||||
}
|
||||
return optionalProperty;
|
||||
}
|
||||
|
||||
public Integer getConnectionTimeout()
|
||||
{
|
||||
return getIntegerProperty(HttpClientPropertiesEnum.CONNECTION_REQUEST_TIMEOUT);
|
||||
}
|
||||
|
||||
public Integer getSocketTimeout()
|
||||
{
|
||||
return getIntegerProperty(HttpClientPropertiesEnum.SOCKET_TIMEOUT);
|
||||
}
|
||||
|
||||
public Integer getConnectionRequestTimeout()
|
||||
{
|
||||
return getIntegerProperty(HttpClientPropertiesEnum.CONNECTION_REQUEST_TIMEOUT);
|
||||
}
|
||||
|
||||
public Integer getMaxTotalConnections()
|
||||
{
|
||||
return getIntegerProperty(HttpClientPropertiesEnum.MAX_TOTAL_CONNECTIONS);
|
||||
}
|
||||
|
||||
public Integer getMaxHostConnections()
|
||||
{
|
||||
return getIntegerProperty(HttpClientPropertiesEnum.MAX_HOST_CONNECTIONS);
|
||||
}
|
||||
|
||||
public Boolean isMTLSEnabled()
|
||||
{
|
||||
return getBooleanProperty(HttpClientPropertiesEnum.MTLS_ENABLED);
|
||||
}
|
||||
|
||||
public boolean isHostnameVerificationDisabled()
|
||||
{
|
||||
return getBooleanProperty(HttpClientPropertiesEnum.HOSTNAME_VERIFICATION_DISABLED);
|
||||
}
|
||||
|
||||
private enum HttpClientPropertiesEnum
|
||||
{
|
||||
CONNECTION_TIMEOUT("connectionTimeout", true),
|
||||
SOCKET_TIMEOUT("socketTimeout", true),
|
||||
CONNECTION_REQUEST_TIMEOUT("connectionRequestTimeout", true),
|
||||
MAX_TOTAL_CONNECTIONS("maxTotalConnections", true),
|
||||
MAX_HOST_CONNECTIONS("maxHostConnections", true),
|
||||
HOSTNAME_VERIFICATION_DISABLED("hostnameVerificationDisabled", false),
|
||||
MTLS_ENABLED("mTLSEnabled", true);
|
||||
|
||||
private final String name;
|
||||
private final Boolean isRequired;
|
||||
|
||||
HttpClientPropertiesEnum(String propertyName, Boolean isRequired)
|
||||
{
|
||||
this.name = propertyName;
|
||||
this.isRequired = isRequired;
|
||||
}
|
||||
|
||||
private static final List<String> supportedProperties = new ArrayList<>();
|
||||
|
||||
static {
|
||||
for (HttpClientPropertiesEnum property : HttpClientPropertiesEnum.values()) {
|
||||
supportedProperties.add(property.name);
|
||||
}
|
||||
}
|
||||
|
||||
public static boolean isPropertyNameSupported(String propertyName) {
|
||||
return supportedProperties.contains(propertyName);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
/*
|
||||
* Copyright (C) 2023 Alfresco Software Limited.
|
||||
*
|
||||
* This file is part of Alfresco
|
||||
*
|
||||
* Alfresco is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* Alfresco is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public License
|
||||
* along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
package org.alfresco.httpclient;
|
||||
|
||||
import org.alfresco.error.AlfrescoRuntimeException;
|
||||
|
||||
public class HttpClientException extends AlfrescoRuntimeException
|
||||
{
|
||||
public HttpClientException(String msgId)
|
||||
{
|
||||
super(msgId);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user