diff --git a/jetty-documentation/src/main/asciidoc/administration/jmx/using-jmx.adoc b/jetty-documentation/src/main/asciidoc/administration/jmx/using-jmx.adoc index 4113599a59c..b14cb261df3 100644 --- a/jetty-documentation/src/main/asciidoc/administration/jmx/using-jmx.adoc +++ b/jetty-documentation/src/main/asciidoc/administration/jmx/using-jmx.adoc @@ -17,93 +17,93 @@ [[using-jmx]] === Using JMX with Jetty -Jetty JMX integration uses the platform MBean server implementation that Java VM provides. -The integration is based on the `ObjectMBean` implementation of `DynamicMBean`. -This implementation allows you to wrap an arbitrary POJO in an MBean and annotate it appropriately to expose it via JMX. -See xref:jetty-jmx-annotations[]. +Jetty's architecture is based on POJO components (see xref:basic-architecture[]). +These components are organized in a tree and each component may have a lifecycle +that spans the `Server` lifetime, or a web application lifetime, or even shorter +lifetimes such as that of a TCP connection. -The `MBeanContainer` implementation of the `Container.Listener` interface coordinates creation of MBeans. -The Jetty Server and it's components use a link:{JDURL}/org/eclipse/jetty/util/component/Container.html[Container] to maintain a containment tree of components and to support notification of changes to that tree. -The `MBeanContainer` class listens for Container events and creates and destroys MBeans as required to wrap all Jetty components. +Every time a component is added or removed from the component tree, an event is +emitted, and link:{JDURL}/org/eclipse/jetty/util/component/Container.html[`Container.Listener`] +implementations can listen to those events and perform additional actions. -You can access the MBeans that Jetty publishes both through built-in Java VM connector via JConsole or JMC, or by registering a remote JMX connector and using a remote JMX agent to monitor Jetty. +One such `Container.Listener` is `MBeanContainer` that uses `ObjectMBean` to +create an MBean from an arbitrary POJO, and register/unregister the MBean to/from +the platform `MBeanServer`. + +Jetty components are annotated with <> +and provide specific JMX details so that `ObjectMBean` can build a more +precise representation of the JMX metadata associated with the component POJO. + +Therefore, when a component is added to the component tree, `MBeanContainer` is +notified, it creates the MBean from the component POJO and registers it to +the `MBeanServer`. +Similarly, when a component is removed from the tree, `MBeanContainer` is +notified, and unregisters the MBean from the `MBeanServer`. + +The Jetty MBeans can be accessed via any JMX console such as Java Mission Control +(JMC), VisualVM, JConsole or others. [[configuring-jmx]] ==== Configuring JMX -This guide describes how to initialize and configure the Jetty JMX integration. +This guide describes the various ways to initialize and configure the Jetty JMX integration. +Configuring the Jetty JMX integration only registers the Jetty MBeans into the platform +`MBeanServer`, and therefore the MBeans can only be accessed locally (from the same machine), +not from remote machines. -To monitor an application using JMX, perform the following steps: - -* Configure the application to instantiate an MBean container. -* Instrument objects to be MBeans. -* Provide access for JMX agents to MBeans. - -[[accessing-jetty-mbeans]] -===== Using JConsole to Access Jetty MBeans - -The simplest way to access the MBeans that Jetty publishes is to use the http://java.sun.com/developer/technicalArticles/J2SE/jconsole.html[JConsole utility] the Java Virtual Machine supplies. -See xref:jetty-jconsole[] for instructions on how to configure JVM for use with JConsole or JMC. - -To access Jetty MBeans via JConsole or JMC, you must: - -* Enable the registration of Jetty MBeans into the platform MBeanServer. -* Enable a `JMXConnectorServer` so that JConsole/JMC can connect and visualize the MBeans. - -[[registering-jetty-mbeans]] -===== Registering Jetty MBeans - -Configuring Jetty JMX integration differs for standalone and embedded Jetty. +This means that this configuration is enough for development, where you have easy access +(with graphical user interface) to the machine where Jetty runs, but it is typically not +enough when the machine Jetty where runs is remote, or only accessible via SSH or otherwise +without graphical user interface support. +In these cases, you have to enable <>. [[jmx-standalone-jetty]] -====== Standalone Jetty +===== Standalone Jetty Server JMX is not enabled by default in the Jetty distribution. -To enable JMX in the Jetty distribution, run the following, where `{$jetty.home}` is the directory where you have the Jetty distribution located (see link:#startup-base-and-home[the documentation for Jetty base vs. home examples]): +To enable JMX in the Jetty distribution run the following, where `{$jetty.home}` +is the directory where you have the Jetty distribution installed, and +`${jetty.base}` is the directory where you have your Jetty configuration +(see link:#startup-base-and-home[the documentation for Jetty base vs. home examples]): [source, screen, subs="{sub-order}"] -.... +---- +$ cd ${jetty.base} $ java -jar {$jetty.home}/start.jar --add-to-start=jmx -.... +---- -Running the above command will append the available configurable elements of the JMX module to the `{$jetty.base}/start.ini` file. -If you are managing separate ini files for your modules in the distribution, use `--add-to-start.d=jmx` instead. - -If you wish to add remote access for JMX, you will also need to enable the JMX-Remote module: - -[source, screen, subs="{sub-order}"] -.... -$ java -jar {$jetty.home}/start.jar --add-to-start=jmx-remote -.... +Running the above command will append the available configurable elements of the `jmx` module +to the `{$jetty.base}/start.ini` file, or create the `${jetty.base}/start.d/jmx.ini` file. [[jmx-embedded-jetty]] -====== Embedded Jetty +===== Embedded Jetty Server -When running Jetty embedded into an application, create and configure an MBeanContainer instance as follows: +When running Jetty embedded into an application, create and configure an `MBeanContainer` +instance as follows: [source, java] ---- - Server server = new Server(); -// Setup JMX -MBeanContainer mbContainer=new MBeanContainer(ManagementFactory.getPlatformMBeanServer()); -server.addEventListener(mbContainer); -server.addBean(mbContainer); +// Setup JMX. +MBeanContainer mbeanContainer = new MBeanContainer(ManagementFactory.getPlatformMBeanServer()); +server.addBean(mbeanContainer); -// Add loggers MBean to server (will be picked up by MBeanContainer above) +// Export the loggers as MBeans. server.addBean(Log.getLog()); - ---- -Notice that Jetty creates the `MBeanContainer` immediately after creating the Server, and immediately after registering it as an `EventListener` of the Server object (which is also a Container object). +Because logging is initialized prior to the `MBeanContainer` (even before the `Server` itself), +it is necessary to register the logger manually via `server.addBean()` so that the loggers may +show up in the JMX tree as MBeans. -Because logging is initialized prior to the `MBeanContainer` (even before the Server itself), it is necessary to register the logger manually via `server.addBean()` so that the loggers may show up in the JMX tree. - -[[jmx-using-jetty-maven-plugin]] +[[jmx-jetty-maven-plugin]] ===== Using the Jetty Maven Plugin with JMX -If you are using the link:#jetty-maven-plugin[Jetty Maven plugin] you should copy the `/etc/jetty-jmx.xml` file into your webapp project somewhere, such as `/src/etc,` then add a `` element to the plugin ``: +If you are using the link:#jetty-maven-plugin[Jetty Maven plugin] you should copy the +`${jetty.home}/etc/jetty-jmx.xml` file into your webapp project somewhere, such as +`src/main/config/etc/`, then add a +`` element to the `` element of the Jetty Maven Plugin: [source, xml, subs="{sub-order}"] ---- @@ -113,21 +113,153 @@ If you are using the link:#jetty-maven-plugin[Jetty Maven plugin] you should cop {VERSION} 10 - src/etc/jetty-jmx.xml + src/main/config/etc/jetty-jmx.xml ---- +[[accessing-jetty-mbeans]] +==== Using JConsole or Java Mission Control to Access Jetty MBeans -[[enabling-jmxconnectorserver-for-remote-access]] -==== Enabling JMXConnectorServer for Remote Access +The simplest way to access the MBeans that Jetty publishes is to use +<>. -There are two ways of enabling remote connectivity so that JConsole or JMC can connect to visualize MBeans. +Both these tools can connect to local or remote JVMs to display the MBeans. + +For local access, you just need to start JConsole or JMC and then choose +from their user interface the local JVM you want to connect to. + +For remote access, you need first to enable <> +in Jetty. + +[[jmx-remote-access]] +==== Enabling JMX Remote Access + +There are two ways of enabling remote connectivity so that JConsole or JMC can connect +to the remote JVM to visualize MBeans. * Use the `com.sun.management.jmxremote` system property on the command line. Unfortunately, this solution does not work well with firewalls and is not flexible. -* Use Jetty's `ConnectorServer` class. -To enable use of this class, uncomment the correspondent portion in `/etc/jetty-jmx.xml,` like this: +* Use Jetty's `jmx-remote` module or - equivalently - the `ConnectorServer` class. + +`ConnectorServer` will use by default RMI to allow connection from remote clients, +and it is a wrapper around the standard JDK class `JMXConnectorServer`, which is +the class that provides remote access to JMX clients. + +Connecting to the remote JVM is a two step process: + +* First, the client will connect to the RMI _registry_ to download the RMI stub for +the `JMXConnectorServer`; this RMI stub contains the IP address and port to connect +to the RMI server, i.e. the remote `JMXConnectorServer`. +* Second, the client uses the RMI stub to connect to the RMI _server_ (i.e. the +remote `JMXConnectorServer`) typically on an address and port that may be different +from the RMI registry address and port. + +The configuration for the RMI registry and the RMI server is specified by a `JMXServiceURL`. +The string format of an RMI `JMXServiceURL` is: + +[source, screen, subs="{sub-order}"] +---- +service:jmx:rmi://:/jndi/rmi://:/jmxrmi +---- + +Default values are: + +[source, screen, subs="{sub-order}"] +---- +rmi_server_host = localhost +rmi_server_port = 1099 +rmi_registry_host = localhost +rmi_registry_port = 1099 +---- + +With the default configuration, only clients that are local to the server machine can connect +to the RMI registry and RMI server - this is done for security reasons. +With this configuration it would still be possible to access the MBeans from remote using +a <>. + +By specifying an appropriate `JMXServiceURL`, you can fine tune the network interfaces the +RMI registry and the RMI server bind to, and the ports that the RMI registry and the RMI server +listen to. +The RMI server and RMI registry hosts and ports can be the same (as in the default configuration) +because RMI is able to multiplex traffic arriving to a port to multiple RMI objects. + +If you need to allow JMX remote access through a firewall, you must open both the RMI registry +and the RMI server ports. + +Examples: + +[source, screen, subs="{sub-order}"] +---- +service:jmx:rmi:///jndi/rmi:///jmxrmi + rmi_server_host = any address + rmi_server_port = randomly chosen + rmi_registry_host = any address + rmi_registry_port = 1099 + +service:jmx:rmi://localhost:1100/jndi/rmi://localhost:1099/jmxrmi + rmi_server_host = loopback address + rmi_server_port = 1100 + rmi_registry_host = loopback address + rmi_registry_port = 1099 +---- + +[NOTE] +==== +When `ConnectorServer` is started, its RMI stub is exported to the RMI registry. +The RMI stub contains the IP address and port to connect to the RMI object, but +the IP address is typically the machine host name, not the host specified in the +`JMXServiceURL`. + +To control the IP address stored in the RMI stub you need to set the system +property `java.rmi.server.hostname` with the desired value. +This is especially important when binding the RMI server host to the loopback +address for security reasons. See also +<>. +==== + +===== Enabling JMX Remote Access in Standalone Jetty Server + +Similarly to <>, you +enable the `jmx-remote` module: + +[source, screen, subs="{sub-order}"] +---- +$ cd ${jetty.base} +$ java -jar {$jetty.home}/start.jar --add-to-start=jmx-remote +---- + +===== Enabling JMX Remote Access in Embedded Jetty + +When running Jetty embedded into an application, create and configure a `ConnectorServer`: + +[source, java, subs="{sub-order}"] +---- +Server server = new Server(); + +// Setup JMX +MBeanContainer mbeanContainer = new MBeanContainer(ManagementFactory.getPlatformMBeanServer()); +server.addBean(mbeanContainer); + +// Setup ConnectorServer +JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1999, "/jndi/rmi:///jmxrmi"); +ConnectorServer jmxServer = new ConnectorServer(jmxURL, "org.eclipse.jetty.jmx:name=rmiconnectorserver"); +server.addBean(jmxServer); +---- + +The `JMXServiceURL` above specifies that the RMI server binds to the wildcard address +on port 1999, while the RMI registry binds to the wildcard address on port 1099 (the +default RMI registry port). + +[[jmx-remote-access-authorization]] +===== JMX Remote Access Authorization + +The standard `JMXConnectorServer` provides several options to authorize access. +For a complete guide to controlling authentication and authorization in JMX, see +https://blogs.oracle.com/lmalventosa/entry/jmx_authentication_authorization[Authentication and Authorization in JMX RMI connectors]. + +To authorize access to the `JMXConnectorServer` you can use this configuration, +where the `jmx.password` and `jmx.access` files have the format specified in the blog entry above: [source, xml, subs="{sub-order}"] ---- @@ -136,50 +268,22 @@ To enable use of this class, uncomment the correspondent portion in `/etc/jetty- rmi - - /jndi/rmi://:/jmxrmi - - - org.eclipse.jetty.jmx:name=rmiconnectorserver - - - ----- - -This configuration snippet starts an `RMIRegistry` and a `JMXConnectorServer` both on port 1099 (by default), so that firewalls should open just that one port to allow connections from JConsole or JMC. - -[[securing-remote-access]] -==== Securing Remote Access - -`JMXConnectorServer` several options to restrict access. -For a complete guide to controlling authentication and authorization in JMX, see https://blogs.oracle.com/lmalventosa/entry/jmx_authentication_authorization[Authentication and Authorization in JMX RMI connectors] in Luis-Miguel Alventosa's blog. - -To restrict access to the `JMXConnectorServer`, you can use this configuration, where the `jmx.password` and `jmx.access` files have the format specified in the blog entry above: - -[source, xml, subs="{sub-order}"] ----- - - - - - rmi - - - /jndi/rmi://:/jmxrmi + 1099 + /jndi/rmi:///jmxrmi - jmx.remote.x.password.file + jmx.remote.x.access.file - /resources/jmx.password + /resources/jmx.access - jmx.remote.x.access.file + jmx.remote.x.password.file - /resources/jmx.access + /resources/jmx.password @@ -187,17 +291,141 @@ To restrict access to the `JMXConnectorServer`, you can use this configuration, org.eclipse.jetty.jmx:name=rmiconnectorserver - - ---- -[[custom-monitor-applcation]] -==== Custom Monitor Application +Similarly, in code: -Using the JMX API, you can also write a custom application to monitor your Jetty server. -To allow this application to connect to your Jetty server, you need to uncomment the last section of the `/etc/jetty-jmx.xml` configuration file and optionally modify the endpoint name. -Doing so creates a JMX HTTP connector and registers a JMX URL that outputs to the `Stderr` log. +[source, java, subs="{sub-order}"] +---- +JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1099, "/jndi/rmi:///jmxrmi"); +Map env = new HashMap<>(); +env.put("jmx.remote.x.access.file", "resources/jmx.access"); +env.put("jmx.remote.x.password.file", "resources/jmx.password"); +ConnectorServer jmxServer = new ConnectorServer(jmxURL, env, "org.eclipse.jetty.jmx:name=rmiconnectorserver"); +jmxServer.start(); +---- -You should provide the URL that appears in the log to your monitor application in order to create an `MBeanServerConnection.` -You can use the same URL to connect to your Jetty instance from a remote machine using JConsole or JMC. -See the link:{GITBROWSEURL}/jetty-jmx/src/main/config/etc/jetty-jmx.xml[configuration file] for more details. +Calling `ConnectorServer.start()` may be explicit as in the examples above, +or can be skipped when adding the `ConnectorServer` as a bean to the `Server`, +so that starting the `Server` will also start the `ConnectorServer`. + +===== Securing JMX Remote Access with TLS + +The JMX communication via RMI happens by default in clear-text. + +It is possible to configure the `ConnectorServer` with a `SslContextFactory` so +that the JMX communication via RMI is encrypted: + +[source, xml, subs="{sub-order}"] +---- + + + + rmi + + 1099 + /jndi/rmi:///jmxrmi + + + + org.eclipse.jetty.jmx:name=rmiconnectorserver + + +---- + +Similarly, in code: + +[source, java, subs="{sub-order}"] +---- +SslContextFactory sslContextFactory = new SslContextFactory(); +sslContextFactory.setKeyStorePath(); +sslContextFactory.setKeyStorePassword("secret"); + +JMXServiceURL jmxURL = new JMXServiceURL("rmi", null, 1099, "/jndi/rmi:///jmxrmi"); +ConnectorServer jmxServer = new ConnectorServer(jmxURL, null, "org.eclipse.jetty.jmx:name=rmiconnectorserver", sslContextFactory); +---- + +It is possible to use the same `SslContextFactory` used to configure the +Jetty `ServerConnector` that supports TLS for the HTTP protocol. +This is used in the XML example above: the `SslContextFactory` configured +for the TLS `ServerConnector` is registered with an id of `sslContextFactory` +which is referenced in the XML via the `Ref` element. + +The keystore must contain a valid certificate signed by a Certification Authority. + +The RMI mechanic is the usual one: the RMI client (typically a monitoring console) +will connect first to the RMI registry (using TLS), download the RMI server stub +that contains the address and port of the RMI server to connect to, then connect +to the RMI server (using TLS). + +This also mean that if the RMI registry and the RMI server are on different hosts, +the RMI client must have available the cryptographic material to validate both +hosts. + +Having certificates signed by a Certification Authority simplifies by a lot the +configuration needed to get the JMX communication over TLS working properly. + +If that is not the case (for example the certificate is self-signed), then you +need to specify the required system properties that allow RMI (especially when +acting as an RMI client) to retrieve the cryptographic material necessary to +establish the TLS connection. + +For example, trying to connect using the JDK standard `JMXConnector` with both +the RMI server and the RMI registry to `domain.com`: + +[source, java, subs="{sub-order}"] +---- +// System properties necessary for an RMI client to trust a self-signed certificate. +System.setProperty("javax.net.ssl.trustStore", "/path/to/trustStore"); +System.setProperty("javax.net.ssl.trustStorePassword", "secret"); + +JMXServiceURL jmxURL = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://domain.com:1100/jmxrmi") +Map clientEnv = new HashMap<>(); +// Required to connect to the RMI registry via TLS. +clientEnv.put(ConnectorServer.RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE, new SslRMIClientSocketFactory()); +try (JMXConnector client = JMXConnectorFactory.connect(jmxURL, clientEnv)) +{ + Set names = client.getMBeanServerConnection().queryNames(null, null); +} +---- + +Similarly, to launch JMC: + +[source, java, subs="{sub-order}"] +---- +$ jmc -vmargs -Djavax.net.ssl.trustStore=/path/to/trustStore -Djavax.net.ssl.trustStorePassword=secret +---- + +Note that these system properties are required when launching the `ConnectorServer` too, +on the server, because it acts as an RMI client with respect to the RMI registry. + +[[jmx-remote-access-ssh-tunnel]] +===== JMX Remote Access with Port Forwarding via SSH Tunnel + +You can access JMX MBeans on a remote machine when the RMI ports are not open, +for example because of firewall policies, but you have SSH access to the machine +using local port forwarding via a SSH tunnel. + +In this case you want to configure the `ConnectorServer` with a `JMXServiceURL` +that binds the RMI server and the RMI registry to the loopback interface only: +`service:jmx:rmi://localhost:1099/jndi/rmi://localhost:1099/jmxrmi`. + +Then you setup the local port forwarding with the SSH tunnel: + +[source, screen, subs="{sub-order}"] +---- +$ ssh -L 1099:localhost:1099 @ +---- + +Now you can use JConsole or JMC to connect to `localhost:1099` on your local +computer. The traffic will be forwarded to `machine_host` and when there, +SSH will forward the traffic to `localhost:1099`, which is exactly where +the `ConnectorServer` listens. + +When you configure `ConnectorServer` in this way, you must set the system +property `-Djava.rmi.server.hostname=localhost`, on the server. + +This is required because when the RMI server is exported, its address and +port are stored in the RMI stub. You want the address in the RMI stub to be +`localhost` so that when the RMI stub is downloaded to the remote client, +the RMI communication will go through the SSH tunnel. diff --git a/jetty-jmx/src/main/config/etc/jetty-jmx-remote.xml b/jetty-jmx/src/main/config/etc/jetty-jmx-remote.xml index bd6cbc6e7b8..1003ad7e261 100644 --- a/jetty-jmx/src/main/config/etc/jetty-jmx-remote.xml +++ b/jetty-jmx/src/main/config/etc/jetty-jmx-remote.xml @@ -13,14 +13,14 @@ --> - @@ -28,9 +28,9 @@ rmi - - - /jndi/rmi://:/jmxrmi + + + /jndi/rmi://:/jmxrmi org.eclipse.jetty.jmx:name=rmiconnectorserver diff --git a/jetty-jmx/src/main/config/etc/jetty-jmx.xml b/jetty-jmx/src/main/config/etc/jetty-jmx.xml index e07ea744355..ac906d8172f 100644 --- a/jetty-jmx/src/main/config/etc/jetty-jmx.xml +++ b/jetty-jmx/src/main/config/etc/jetty-jmx.xml @@ -4,13 +4,13 @@ - + - + @@ -25,7 +25,7 @@ - + diff --git a/jetty-jmx/src/main/config/modules/jmx-remote.mod b/jetty-jmx/src/main/config/modules/jmx-remote.mod index 7a10a018144..438f3368ef9 100644 --- a/jetty-jmx/src/main/config/modules/jmx-remote.mod +++ b/jetty-jmx/src/main/config/modules/jmx-remote.mod @@ -8,8 +8,14 @@ jmx etc/jetty-jmx-remote.xml [ini-template] -## The host/address to bind RMI to -# jetty.jmxremote.rmihost=localhost +## The host/address to bind the RMI server to. +# jetty.jmxremote.rmiserverhost=localhost -## The port RMI listens to -# jetty.jmxremote.rmiport=1099 +## The port the RMI server listens to (0 means a random port is chosen). +# jetty.jmxremote.rmiserverport=1099 + +## The host/address to bind the RMI registry to. +# jetty.jmxremote.rmiregistryhost=localhost + +## The port the RMI registry listens to. +# jetty.jmxremote.rmiregistryport=1099 diff --git a/jetty-jmx/src/main/java/org/eclipse/jetty/jmx/ConnectorServer.java b/jetty-jmx/src/main/java/org/eclipse/jetty/jmx/ConnectorServer.java index 42ae03001d4..1901bd57252 100644 --- a/jetty-jmx/src/main/java/org/eclipse/jetty/jmx/ConnectorServer.java +++ b/jetty-jmx/src/main/java/org/eclipse/jetty/jmx/ConnectorServer.java @@ -23,12 +23,16 @@ import java.lang.management.ManagementFactory; import java.net.InetAddress; import java.net.InetSocketAddress; import java.net.ServerSocket; +import java.net.UnknownHostException; import java.rmi.registry.LocateRegistry; import java.rmi.registry.Registry; +import java.rmi.server.RMIClientSocketFactory; import java.rmi.server.RMIServerSocketFactory; import java.rmi.server.UnicastRemoteObject; import java.util.HashMap; import java.util.Map; +import java.util.Objects; +import java.util.function.IntConsumer; import javax.management.MBeanServer; import javax.management.ObjectName; @@ -36,26 +40,35 @@ import javax.management.remote.JMXConnectorServer; import javax.management.remote.JMXConnectorServerFactory; import javax.management.remote.JMXServiceURL; import javax.management.remote.rmi.RMIConnectorServer; +import javax.rmi.ssl.SslRMIClientSocketFactory; import org.eclipse.jetty.util.HostPort; import org.eclipse.jetty.util.component.AbstractLifeCycle; import org.eclipse.jetty.util.log.Log; import org.eclipse.jetty.util.log.Logger; +import org.eclipse.jetty.util.ssl.SslContextFactory; import org.eclipse.jetty.util.thread.ShutdownThread; /** - * AbstractLifeCycle wrapper for JMXConnectorServer + *

LifeCycle wrapper for JMXConnectorServer.

+ *

This class provides the following facilities:

+ *
    + *
  • participates in the {@code Server} lifecycle
    • + *
  • starts the RMI registry if not there already
    • + *
  • allows to bind the RMI registry and the RMI server to the loopback interface
    • + *
  • makes it easy to use TLS for the JMX communication
    • + *
*/ public class ConnectorServer extends AbstractLifeCycle { + public static final String RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE = "com.sun.jndi.rmi.factory.socket"; private static final Logger LOG = Log.getLogger(ConnectorServer.class); private JMXServiceURL _jmxURL; private final Map _environment; private final String _objectName; - private String _registryHost; + private final SslContextFactory _sslContextFactory; private int _registryPort; - private String _rmiHost; private int _rmiPort; private JMXConnectorServer _connectorServer; private Registry _registry; @@ -82,10 +95,16 @@ public class ConnectorServer extends AbstractLifeCycle * @param name object name string to be assigned to ConnectorServer bean */ public ConnectorServer(JMXServiceURL svcUrl, Map environment, String name) + { + this(svcUrl, environment, name, null); + } + + public ConnectorServer(JMXServiceURL svcUrl, Map environment, String name, SslContextFactory sslContextFactory) { this._jmxURL = svcUrl; this._environment = environment == null ? new HashMap<>() : new HashMap<>(environment); this._objectName = name; + this._sslContextFactory = sslContextFactory; } public JMXServiceURL getAddress() @@ -100,20 +119,29 @@ public class ConnectorServer extends AbstractLifeCycle if (rmi) { if (!_environment.containsKey(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE)) - _environment.put(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE, new JMXRMIServerSocketFactory(false)); + _environment.put(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE, new JMXRMIServerSocketFactory(_jmxURL.getHost(), port -> _rmiPort = port)); + if (_sslContextFactory != null) + { + SslRMIClientSocketFactory csf = new SslRMIClientSocketFactory(); + if (!_environment.containsKey(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE)) + _environment.put(RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE, csf); + if (!_environment.containsKey(RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE)) + _environment.put(RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE, csf); + } } String urlPath = _jmxURL.getURLPath(); String jndiRMI = "/jndi/rmi://"; - boolean registry = urlPath.startsWith(jndiRMI); - if (registry) + if (urlPath.startsWith(jndiRMI)) { int startIndex = jndiRMI.length(); int endIndex = urlPath.indexOf('/', startIndex); HostPort hostPort = new HostPort(urlPath.substring(startIndex, endIndex)); - _registryHost = hostPort.getHost(); - startRegistry(hostPort); - urlPath = jndiRMI + _registryHost + ":" + _registryPort + urlPath.substring(endIndex); + String registryHost = startRegistry(hostPort); + // If the RMI registry was already started, use the existing port. + if (_registryPort == 0) + _registryPort = hostPort.getPort(); + urlPath = jndiRMI + registryHost + ":" + _registryPort + urlPath.substring(endIndex); // Rebuild JMXServiceURL to use it for the creation of the JMXConnectorServer. _jmxURL = new JMXServiceURL(_jmxURL.getProtocol(), _jmxURL.getHost(), _jmxURL.getPort(), urlPath); } @@ -122,14 +150,15 @@ public class ConnectorServer extends AbstractLifeCycle _connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(_jmxURL, _environment, mbeanServer); mbeanServer.registerMBean(_connectorServer, new ObjectName(_objectName)); _connectorServer.start(); + String rmiHost = normalizeHost(_jmxURL.getHost()); + // If _rmiPort is still zero, it's using the same port as the RMI registry. + if (_rmiPort == 0) + _rmiPort = _registryPort; + _jmxURL = new JMXServiceURL(_jmxURL.getProtocol(), rmiHost, _rmiPort, urlPath); + ShutdownThread.register(0, this); - _jmxURL = new JMXServiceURL(_jmxURL.getProtocol(), - _rmiHost != null ? _rmiHost : _jmxURL.getHost(), - _rmiPort > 0 ? _rmiPort : _jmxURL.getPort(), - urlPath); - - LOG.info("JMX Remote URL: {}", _jmxURL); + LOG.info("JMX URL: {}", _jmxURL); } @Override @@ -142,7 +171,7 @@ public class ConnectorServer extends AbstractLifeCycle stopRegistry(); } - private void startRegistry(HostPort hostPort) throws Exception + private String startRegistry(HostPort hostPort) throws Exception { String host = hostPort.getHost(); int port = hostPort.getPort(1099); @@ -151,14 +180,23 @@ public class ConnectorServer extends AbstractLifeCycle { // Check if a local registry is already running. LocateRegistry.getRegistry(host, port).list(); - return; + return normalizeHost(host); } catch (Throwable ex) { LOG.ignore(ex); } - _registry = LocateRegistry.createRegistry(port, null, new JMXRMIServerSocketFactory(true)); + RMIClientSocketFactory csf = _sslContextFactory == null ? null : new SslRMIClientSocketFactory(); + RMIServerSocketFactory ssf = new JMXRMIServerSocketFactory(host, p -> _registryPort = p); + _registry = LocateRegistry.createRegistry(port, csf, ssf); + + return normalizeHost(host); + } + + private String normalizeHost(String host) throws UnknownHostException + { + return host == null || host.isEmpty() ? InetAddress.getLocalHost().getHostName() : host; } private void stopRegistry() @@ -180,54 +218,56 @@ public class ConnectorServer extends AbstractLifeCycle } } - private class JMXRMIServerSocketFactory implements RMIServerSocketFactory { - private boolean registry; + private final String _host; + private final IntConsumer _portConsumer; - private JMXRMIServerSocketFactory(boolean registry) + private JMXRMIServerSocketFactory(String host, IntConsumer portConsumer) { - this.registry = registry; + this._host = host; + this._portConsumer = portConsumer; } @Override public ServerSocket createServerSocket(int port) throws IOException { - if (registry) + InetAddress address = _host == null || _host.isEmpty() ? null : InetAddress.getByName(_host); + ServerSocket server = createServerSocket(address, port); + _portConsumer.accept(server.getLocalPort()); + return server; + } + + private ServerSocket createServerSocket(InetAddress address, int port) throws IOException + { + // A null address binds to the wildcard address. + if (_sslContextFactory == null) { - InetAddress address; - if (_registryHost == null || _registryHost.isEmpty()) - { - _registryHost = InetAddress.getLocalHost().getHostName(); - address = null; - } - else - { - address = InetAddress.getByName(_registryHost); - } ServerSocket server = new ServerSocket(); server.bind(new InetSocketAddress(address, port)); - _registryPort = server.getLocalPort(); return server; } else { - InetAddress address; - _rmiHost = _jmxURL.getHost(); - if (_rmiHost == null || _rmiHost.isEmpty()) - { - _rmiHost = InetAddress.getLocalHost().getHostName(); - address = null; - } - else - { - address = InetAddress.getByName(_rmiHost); - } - ServerSocket server = new ServerSocket(); - server.bind(new InetSocketAddress(address, port)); - _rmiPort = server.getLocalPort(); - return server; + return _sslContextFactory.newSslServerSocket(address == null ? null : address.getHostName(), port, 0); } } + + @Override + public int hashCode() + { + return _host != null ? _host.hashCode() : 0; + } + + @Override + public boolean equals(Object obj) + { + if (this == obj) + return true; + if (obj == null || getClass() != obj.getClass()) + return false; + JMXRMIServerSocketFactory that = (JMXRMIServerSocketFactory)obj; + return Objects.equals(_host, that._host); + } } } diff --git a/jetty-jmx/src/test/java/org/eclipse/jetty/jmx/ConnectorServerTest.java b/jetty-jmx/src/test/java/org/eclipse/jetty/jmx/ConnectorServerTest.java index f7b6d20dce7..9bee1f6eb91 100644 --- a/jetty-jmx/src/test/java/org/eclipse/jetty/jmx/ConnectorServerTest.java +++ b/jetty-jmx/src/test/java/org/eclipse/jetty/jmx/ConnectorServerTest.java @@ -22,9 +22,16 @@ import java.net.ConnectException; import java.net.InetAddress; import java.net.ServerSocket; import java.net.Socket; +import java.util.HashMap; +import java.util.Map; +import javax.management.remote.JMXConnector; +import javax.management.remote.JMXConnectorFactory; import javax.management.remote.JMXServiceURL; +import javax.rmi.ssl.SslRMIClientSocketFactory; +import org.eclipse.jetty.toolchain.test.MavenTestingUtils; +import org.eclipse.jetty.util.ssl.SslContextFactory; import org.junit.After; import org.junit.Assert; import org.junit.Ignore; @@ -71,12 +78,23 @@ public class ConnectorServerTest connectorServer = new ConnectorServer(new JMXServiceURL("service:jmx:rmi:///jndi/rmi:///jmxrmi"), objectName); connectorServer.start(); - InetAddress localHost = InetAddress.getLocalHost(); - if (!localHost.isLoopbackAddress()) - { - // Verify that I can connect to the RMIRegistry using a non-loopback address. - new Socket(localHost, 1099).close(); - } + // Verify that I can connect to the RMI registry using a non-loopback address. + new Socket(InetAddress.getLocalHost(), 1099).close(); + // Verify that I can connect to the RMI registry using the loopback address. + new Socket(InetAddress.getLoopbackAddress(), 1099).close(); + } + + @Test + public void testNoRegistryHostNonDefaultRegistryPort() throws Exception + { + int registryPort = 1299; + connectorServer = new ConnectorServer(new JMXServiceURL("service:jmx:rmi:///jndi/rmi://:" + registryPort + "/jmxrmi"), objectName); + connectorServer.start(); + + // Verify that I can connect to the RMI registry using a non-loopback address. + new Socket(InetAddress.getLocalHost(), registryPort).close(); + // Verify that I can connect to the RMI registry using the loopback address. + new Socket(InetAddress.getLoopbackAddress(), registryPort).close(); } @Test @@ -85,12 +103,10 @@ public class ConnectorServerTest connectorServer = new ConnectorServer(new JMXServiceURL("service:jmx:rmi:///jndi/rmi:///jmxrmi"), objectName); connectorServer.start(); - InetAddress localHost = InetAddress.getLocalHost(); - if (!localHost.isLoopbackAddress()) - { - // Verify that I can connect to the RMI server using a non-loopback address. - new Socket(localHost, connectorServer.getAddress().getPort()).close(); - } + // Verify that I can connect to the RMI server using a non-loopback address. + new Socket(InetAddress.getLocalHost(), connectorServer.getAddress().getPort()).close(); + // Verify that I can connect to the RMI server using the loopback address. + new Socket(InetAddress.getLoopbackAddress(), connectorServer.getAddress().getPort()).close(); } @Test @@ -160,4 +176,59 @@ public class ConnectorServerTest InetAddress loopback = InetAddress.getLoopbackAddress(); new Socket(loopback, port).close(); } + + @Test + public void testRMIServerAndRMIRegistryOnSameHostAndSamePort() throws Exception + { + // RMI can multiplex connections on the same address and port for different + // RMI objects, in this case the RMI registry and the RMI server. In this + // case, the RMIServerSocketFactory will be invoked only once. + // The case with different address and same port is already covered by TCP, + // that can listen to 192.168.0.1:1099 and 127.0.0.1:1099 without problems. + + String host = "localhost"; + int port = 1399; + connectorServer = new ConnectorServer(new JMXServiceURL("rmi", host, port, "/jndi/rmi://" + host + ":" + port + "/jmxrmi"), objectName); + connectorServer.start(); + + JMXServiceURL address = connectorServer.getAddress(); + Assert.assertEquals(port, address.getPort()); + } + + @Test + public void testJMXOverTLS() throws Exception + { + SslContextFactory sslContextFactory = new SslContextFactory(); + String keyStorePath = MavenTestingUtils.getTestResourcePath("keystore.jks").toString(); + String keyStorePassword = "storepwd"; + sslContextFactory.setKeyStorePath(keyStorePath); + sslContextFactory.setKeyStorePassword(keyStorePassword); + sslContextFactory.start(); + + // The RMIClientSocketFactory is stored within the RMI stub. + // When using TLS, the stub is deserialized in a possibly different + // JVM that does not have access to the server keystore, and there + // is no way to provide TLS configuration during the deserialization + // of the stub. Therefore the client must provide system properties + // to specify the TLS configuration. For this test it needs the + // trustStore because the server certificate is self-signed. + // The server needs to contact the RMI registry and therefore also + // needs these system properties. + System.setProperty("javax.net.ssl.trustStore", keyStorePath); + System.setProperty("javax.net.ssl.trustStorePassword", keyStorePassword); + + connectorServer = new ConnectorServer(new JMXServiceURL("rmi", null, 1100, "/jndi/rmi://localhost:1100/jmxrmi"), null, objectName, sslContextFactory); + connectorServer.start(); + + // The client needs to talk TLS to the RMI registry to download + // the RMI server stub, and this is independent from JMX. + // The RMI server stub then contains the SslRMIClientSocketFactory + // needed to talk to the RMI server. + Map clientEnv = new HashMap<>(); + clientEnv.put(ConnectorServer.RMI_REGISTRY_CLIENT_SOCKET_FACTORY_ATTRIBUTE, new SslRMIClientSocketFactory()); + try (JMXConnector client = JMXConnectorFactory.connect(connectorServer.getAddress(), clientEnv)) + { + client.getMBeanServerConnection().queryNames(null, null); + } + } } diff --git a/jetty-jmx/src/test/resources/keystore.jks b/jetty-jmx/src/test/resources/keystore.jks new file mode 100644 index 00000000000..428ba54776e Binary files /dev/null and b/jetty-jmx/src/test/resources/keystore.jks differ