Secure cassandra support on WF BE

[sdc/sdc-workflow-designer.git] / workflow-designer-be / src / main / java / org / onap / sdc / workflow / server / config / ZusammenConfig.java

diff --git a/workflow-designer-be/src/main/java/org/onap/sdc/workflow/server/config/ZusammenConfig.java b/workflow-designer-be/src/main/java/org/onap/sdc/workflow/server/config/ZusammenConfig.java
index 23e8643..700b1b9 100644 (file)
--- a/workflow-designer-be/src/main/java/org/onap/sdc/workflow/server/config/ZusammenConfig.java
+++ b/workflow-designer-be/src/main/java/org/onap/sdc/workflow/server/config/ZusammenConfig.java
@@ -16,23 +16,44 @@
 
 package org.onap.sdc.workflow.server.config;
 
+import com.datastax.driver.core.RemoteEndpointAwareJdkSSLOptions;
+import com.datastax.driver.core.SSLOptions;
+import java.io.FileInputStream;
+import java.security.KeyStore;
+import java.security.SecureRandom;
 import javax.annotation.PostConstruct;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
+import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.cassandra.ClusterBuilderCustomizer;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
 @Configuration
 public class ZusammenConfig {
 
-    @Value("${zusammen-tenant:workflow}")
+    @Value("${spring.data.cassandra.keyspace-name}")
     private String tenant;
-    @Value("${spring.data.cassandra.contact-points:localhost}")
+    @Value("${spring.data.cassandra.contact-points}")
     private String cassandraAddress;
-    @Value("${spring.data.cassandra.username:}")
+    @Value("${spring.data.cassandra.username}")
     private String cassandraUser;
-    @Value("${spring.data.cassandra.password:}")
+    @Value("${spring.data.cassandra.password}")
     private String cassandraPassword;
-    @Value("${zusammen.cassandra.isAuthenticate:false}")
+    @Value("${zusammen.cassandra.isAuthenticate}")
     private String cassandraAuth;
+    @Value("${spring.data.cassandra.ssl}")
+    private String cassandraSSL;
+    @Value("${zusammen.cassandra.trustStorePath}")
+    private String cassandraTrustStorePath;
+    @Value("${zusammen.cassandra.trustStorePassword}")
+    private String cassandraTrustStorePassword;
+
+    private static final String[] CIPHER_SUITES = {"TLS_RSA_WITH_AES_128_CBC_SHA"};
+    private static final String KEYSTORE_TYPE = "JKS";
+    private static final String SECURE_SOCKET_PROTOCOL = "SSL";
 
     @PostConstruct
     public void init() {
@@ -40,9 +61,36 @@ public class ZusammenConfig {
         System.setProperty("cassandra.user", cassandraUser);
         System.setProperty("cassandra.password", cassandraPassword);
         System.setProperty("cassandra.authenticate", Boolean.toString(Boolean.valueOf(cassandraAuth)));
+        System.setProperty("cassandra.ssl", Boolean.toString(Boolean.valueOf(cassandraSSL)));
+        System.setProperty("cassandra.truststore", cassandraTrustStorePath);
+        System.setProperty("cassandra.truststore.password", cassandraTrustStorePassword);
     }
 
     public String getTenant() {
         return tenant;
     }
+
+    @Bean
+    @ConditionalOnProperty("spring.data.cassandra.ssl")
+    ClusterBuilderCustomizer clusterBuilderCustomizer() {
+        SSLOptions sslOptions = RemoteEndpointAwareJdkSSLOptions
+                                        .builder()
+                                        .withSSLContext(getSslContext())
+                                        .withCipherSuites(CIPHER_SUITES).build();
+        return builder -> builder.withSSL(sslOptions);
+    }
+
+    private SSLContext getSslContext() {
+        try (FileInputStream tsf = new FileInputStream(cassandraTrustStorePath)) {
+            SSLContext ctx = SSLContext.getInstance(SECURE_SOCKET_PROTOCOL);
+            KeyStore ts = KeyStore.getInstance(KEYSTORE_TYPE);
+            ts.load(tsf, cassandraTrustStorePassword.toCharArray());
+            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            tmf.init(ts);
+            ctx.init(null, tmf.getTrustManagers(), new SecureRandom());
+            return ctx;
+        } catch (Exception ex) {
+            throw new BeanCreationException(ex.getMessage(), ex);
+        }
+    }
 }
\ No newline at end of file