Apache
/
activemq-artemis
mirror of https://github.com/apache/activemq-artemis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ARTEMIS-4561 expose store type on web component tls binding config

This commit is contained in:
Gary Tully 2024-01-10 12:19:20 +00:00 committed by Justin Bertram
parent ebd634ae54
commit 5269b1a89d
7 changed files with 64 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
artemis-core-client/src/main/java/org/apache/activemq/artemis/core/remoting/impl/ssl/SSLSupport.java
View File

@ -353,7 +353,7 @@ public class SSLSupport {
return ks;
}
private static void checkPemProviderLoaded(String keystoreType) {
public static void checkPemProviderLoaded(String keystoreType) {
if (keystoreType != null && keystoreType.startsWith("PEM")) {
if (Security.getProvider("PEM") == null) {
Security.insertProviderAt(new PemKeyStoreProvider(), Integer.parseInt(System.getProperty("artemis.pemProvider.insertAt", "0")));

22
artemis-dto/src/main/java/org/apache/activemq/artemis/dto/BindingDTO.java
View File

@ -48,9 +48,15 @@ public class BindingDTO {
@XmlAttribute
public String keyStorePath;
@XmlAttribute
public String keyStoreType;
@XmlAttribute
public String trustStorePath;
@XmlAttribute
public String trustStoreType;
@XmlAttribute
private String includedTLSProtocols;
@ -171,6 +177,14 @@ public class BindingDTO {
this.keyStorePath = keyStorePath;
}
public String getKeyStoreType() {
return keyStoreType;
}
public void setKeyStoreType(String keyStoreType) {
this.keyStoreType = keyStoreType;
}
public String getTrustStorePath() {
return trustStorePath;
}
@ -179,6 +193,14 @@ public class BindingDTO {
this.trustStorePath = trustStorePath;
}
public String getTrustStoreType() {
return trustStoreType;
}
public void setTrustStoreType(String trustStoreType) {
this.trustStoreType = trustStoreType;
}
public List<AppDTO> getApps() {
return apps;
}

4
artemis-web/pom.xml
View File

@ -98,7 +98,6 @@
<groupId>org.apache.activemq</groupId>
<artifactId>artemis-core-client</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.activemq</groupId>
@ -187,6 +186,9 @@
<directory>../tests/security-resources</directory>
<includes>
<include>server-keystore.p12</include>
<include>server-cert.pem</include>
<include>server-key.pem</include>
<include>server-pem-props-config.txt</include>
</includes>
</resource>
</resources>

10
artemis-web/src/main/java/org/apache/activemq/artemis/component/WebServerComponent.java
View File

@ -57,6 +57,8 @@ import org.eclipse.jetty.webapp.WebAppContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import static org.apache.activemq.artemis.core.remoting.impl.ssl.SSLSupport.checkPemProviderLoaded;
public class WebServerComponent implements ExternalComponent, WebServerComponentMarker {
private static final Logger logger = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
@ -227,6 +229,10 @@ public class WebServerComponent implements ExternalComponent, WebServerComponent
if ("https".equals(scheme)) {
SslContextFactory.Server sslFactory = new SslContextFactory.Server();
sslFactory.setKeyStorePath(binding.keyStorePath == null ? artemisInstance + "/etc/keystore.jks" : binding.keyStorePath);
if (binding.keyStoreType != null) {
sslFactory.setKeyStoreType(binding.keyStoreType);
checkPemProviderLoaded(binding.keyStoreType);
}
sslFactory.setKeyStorePassword(binding.getKeyStorePassword() == null ? "password" : binding.getKeyStorePassword());
if (binding.getIncludedTLSProtocols() != null) {
@ -246,6 +252,10 @@ public class WebServerComponent implements ExternalComponent, WebServerComponent
if (binding.clientAuth) {
sslFactory.setTrustStorePath(binding.trustStorePath);
sslFactory.setTrustStorePassword(binding.getTrustStorePassword());
if (binding.trustStoreType != null) {
sslFactory.setTrustStoreType(binding.trustStoreType);
checkPemProviderLoaded(binding.trustStoreType);
}
}
}

24
artemis-web/src/test/java/org/apache/activemq/cli/test/WebServerComponentTest.java
View File

@ -107,6 +107,9 @@ public class WebServerComponentTest extends Assert {
static final String SECURE_URL = System.getProperty("url", "https://localhost:8448/WebServerComponentTest.txt");
static final String KEY_STORE_PATH = WebServerComponentTest.class.getClassLoader().getResource("server-keystore.p12").getFile();
static final String PEM_KEY_STORE_PATH = WebServerComponentTest.class.getClassLoader().getResource("server-pem-props-config.txt").getFile();
static final String KEY_STORE_PASSWORD = "securepass";
private List<ActiveMQComponent> testedComponents;
@ -260,7 +263,6 @@ public class WebServerComponentTest extends Assert {
private WebServerComponent startSimpleSecureServer(Boolean sniHostCheck, Boolean sniRequired) throws Exception {
BindingDTO bindingDTO = new BindingDTO();
bindingDTO.setUri("https://localhost:0");
bindingDTO.setKeyStorePath(KEY_STORE_PATH);
bindingDTO.setKeyStorePassword(KEY_STORE_PASSWORD);
if (sniHostCheck != null) {
@ -269,6 +271,11 @@ public class WebServerComponentTest extends Assert {
if (sniRequired != null) {
bindingDTO.setSniRequired(sniRequired);
}
return startSimpleSecureServer(bindingDTO);
}
private WebServerComponent startSimpleSecureServer(BindingDTO bindingDTO) throws Exception {
bindingDTO.setUri("https://localhost:0");
if (System.getProperty("java.vendor").contains("IBM")) {
//By default on IBM Java 8 JVM, org.eclipse.jetty.util.ssl.SslContextFactory doesn't include TLSv1.2
// while it excludes all TLSv1 and TLSv1.1 cipher suites.
@ -338,6 +345,21 @@ public class WebServerComponentTest extends Assert {
Assert.assertFalse(webServerComponent.isStarted());
}
@Test
public void testStoreTypeConfigAndProviderRegistration() throws Exception {
BindingDTO bindingDTO = new BindingDTO();
bindingDTO.setKeyStorePath(PEM_KEY_STORE_PATH);
bindingDTO.setKeyStoreType("PEMCFG");
WebServerComponent webServerComponent = startSimpleSecureServer(bindingDTO);
try {
int port = webServerComponent.getPort(0);
Assert.assertEquals(200, testSimpleSecureServer("localhost", port, null, null));
} finally {
webServerComponent.stop(true);
}
}
@Test
public void testSimpleSecureServerWithSniHostCheckEnabled() throws Exception {

2
pom.xml
View File

@ -35,13 +35,13 @@
<module>artemis-dto</module>
<module>artemis-cdi-client</module>
<module>artemis-boot</module>
<module>artemis-web</module>
<module>artemis-cli</module>
<module>artemis-commons</module>
<module>artemis-selector</module>
<module>artemis-core-client</module>
<module>artemis-core-client-all</module>
<module>artemis-core-client-osgi</module>
<module>artemis-web</module>
<module>artemis-server</module>
<module>artemis-junit</module>
<module>artemis-jms-client</module>

4
tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/web/WebServerDTOConfigTest.java
View File

@ -92,6 +92,8 @@ public class WebServerDTOConfigTest {
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".passwordCodec", "test-passwordCodec");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".keyStorePath", "test-keyStorePath");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".trustStorePath", "test-trustStorePath");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".keyStoreType", "test-keyStoreType");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".trustStoreType", "test-trustStoreType");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".includedTLSProtocols", "test-includedTLSProtocols,0");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".excludedTLSProtocols", "test-excludedTLSProtocols,1");
properties.put(ActiveMQDefaultConfiguration.getDefaultSystemWebPropertyPrefix() + "bindings." + bindingName + ".includedCipherSuites", "test-includedCipherSuites,2");
@ -111,6 +113,8 @@ public class WebServerDTOConfigTest {
Assert.assertEquals("test-passwordCodec", testBinding.getPasswordCodec());
Assert.assertEquals("test-keyStorePath", testBinding.getKeyStorePath());
Assert.assertEquals("test-trustStorePath", testBinding.getTrustStorePath());
Assert.assertEquals("test-keyStoreType", testBinding.getKeyStoreType());
Assert.assertEquals("test-trustStoreType", testBinding.getTrustStoreType());
Assert.assertEquals("test-includedTLSProtocols,0", String.join(",", testBinding.getIncludedTLSProtocols()));
Assert.assertEquals("test-excludedTLSProtocols,1", String.join(",", testBinding.getExcludedTLSProtocols()));
Assert.assertEquals("test-includedCipherSuites,2", String.join(",", testBinding.getIncludedCipherSuites()));