--- /dev/null
+.*
\ No newline at end of file
collector.keystore.file.location=etc/keystore\r
collector.keystore.passwordfile=etc/passwordfile\r
\r
+collector.cert.subject.matcher=etc/certSubjectMatcher.properties\r
+\r
## The truststore must be setup per installation when mutual tls support is configured\r
collector.truststore.file.location=etc/truststore\r
collector.truststore.passwordfile=etc/trustpasswordfile\r
</parent>\r
<groupId>org.onap.dcaegen2.collectors.ves</groupId>\r
<artifactId>VESCollector</artifactId>\r
- <version>1.4.3-SNAPSHOT</version>\r
+ <version>1.4.4-SNAPSHOT</version>\r
<name>dcaegen2-collectors-ves</name>\r
<description>VESCollector</description>\r
<properties>\r
public String exceptionConfigFileLocation() {
return properties.getString("exceptionConfig", null);
}
-
public String dMaaPConfigurationFileLocation() {
return prependWithUserDirOnRelative(properties.getString("collector.dmaapfile", "etc/DmaapConfig.json"));
}
+ public String certSubjectMatcher(){
+ return prependWithUserDirOnRelative(properties.getString("collector.cert.subject.matcher", "etc/certSubjectMatcher.properties"));
+ }
+
public String authMethod(){
return properties.getString("auth.method", AuthMethodType.NO_AUTH.value());
}
package org.onap.dcae.common.configuration;
+import org.onap.dcae.ApplicationException;
import org.onap.dcae.ApplicationSettings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.web.server.Ssl.ClientAuth;
import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
-public class CertAuth implements AuthMethod {
+@Configuration
+@Order(0)
+@EnableWebSecurity
+public class CertAuth extends WebSecurityConfigurerAdapter implements AuthMethod {
private static final Logger log = LoggerFactory.getLogger(CertAuth.class);
private final ConfigurableServletWebServerFactory container;
this.properties = properties;
}
+ @Override
+ public void configure(WebSecurity web) {
+ web.ignoring().anyRequest();
+ }
+
+ @Override
+ protected void configure(HttpSecurity http) {
+ try {
+ http.authorizeRequests()
+ .anyRequest().authenticated().and()
+ .addFilterBefore(new CustomFilter(properties), FilterSecurityInterceptor.class);
+
+ } catch (Exception ex) {
+ log.error("Cannot authorize request cause: ",ex);
+ throw new ApplicationException(ex);
+ }
+ }
+
@Override
public void configure() {
SslContextCreator sslContextCreator = new SslContextCreator(properties);
package org.onap.dcae.common.configuration;
+import org.onap.dcae.ApplicationException;
import org.onap.dcae.ApplicationSettings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.web.server.Ssl.ClientAuth;
import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
-public class CertBasicAuth implements AuthMethod{
+@Configuration
+@Order(1)
+@EnableWebSecurity
+public class CertBasicAuth extends WebSecurityConfigurerAdapter implements AuthMethod{
private static final Logger log = LoggerFactory.getLogger(CertAuth.class);
private final ConfigurableServletWebServerFactory container;
this.properties = properties;
}
+ @Override
+ public void configure(WebSecurity web) {
+ web.ignoring().anyRequest();
+ }
+
+ @Override
+ protected void configure(HttpSecurity http) {
+ try {
+ http.authorizeRequests()
+ .anyRequest().authenticated().and()
+ .addFilterBefore(new CustomFilter(properties), FilterSecurityInterceptor.class);
+
+ } catch (Exception ex) {
+ log.error("Cannot authorize request cause: ",ex);
+ throw new ApplicationException(ex);
+ }
+ }
+
@Override
public void configure() {
SslContextCreator sslContextCreator = new SslContextCreator(properties);
--- /dev/null
+/*-
+ * ============LICENSE_START=======================================================
+ * org.onap.dcaegen2.collectors.ves
+ * ================================================================================
+ * Copyright (C) 2019 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.dcae.common.configuration;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import org.onap.dcae.ApplicationSettings;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.filter.GenericFilterBean;
+
+@Configuration
+public class CustomFilter extends GenericFilterBean {
+
+ private static final String CERTIFICATE_X_509 = "javax.servlet.request.X509Certificate";
+ private static final String MESSAGE = "SubjectDN didn't match with any regexp from %s file like %s";
+ private ApplicationSettings properties;
+
+ public CustomFilter(ApplicationSettings properties) {
+ this.properties = properties;
+ }
+
+ @Override
+ public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
+ FilterChain filterChain) throws IOException, ServletException {
+
+ X509Certificate[] cert = (X509Certificate[]) servletRequest.getAttribute(CERTIFICATE_X_509);
+
+ if (cert != null) {
+ if (getLines().anyMatch(element -> Pattern.compile(element).matcher(getSubjectDN(cert)).find())) {
+ filterChain.doFilter(servletRequest, servletResponse);
+ } else {
+ setResponse((HttpServletResponse) servletResponse);
+ }
+ } else {
+ filterChain.doFilter(servletRequest, servletResponse);
+ }
+ }
+
+ private void setResponse(HttpServletResponse servletResponse) throws IOException {
+ HttpServletResponse response = servletResponse;
+ response.sendError(HttpServletResponse.SC_FORBIDDEN,
+ String.format(MESSAGE, properties.certSubjectMatcher(), getLines().collect(Collectors.joining(" "))));
+ }
+
+ private Stream<String> getLines() throws IOException {
+ return Files.lines(Paths.get(properties.certSubjectMatcher()));
+ }
+
+ private String getSubjectDN(X509Certificate[] certs) {
+ return Arrays.stream(certs).map(e -> e.getSubjectDN().getName())
+ .map(x -> x.split(",")).flatMap(Arrays::stream)
+ .collect(Collectors.joining(","));
+ }
+}
return true;
}
}
-
if (isBasicAuth()) {
String authorizationHeader = request.getHeader("Authorization");
if (authorizationHeader == null || !isAuthorized(authorizationHeader)) {
when(settings.authMethod()).thenReturn(AuthMethodType.CERT_ONLY.value());
when(settings.truststoreFileLocation()).thenReturn(TRUSTSTORE.toString());
when(settings.truststorePasswordFileLocation()).thenReturn(TRUSTSTORE_PASSWORD_FILE.toString());
+ when(settings.certSubjectMatcher()).thenReturn(CERT_SUBJECT_MATCHER.toString());
}
}
@Configuration
@ExtendWith(SpringExtension.class)
public class TLSTestBase {
- protected static final String KEYSTORE_ALIAS = "localhost";
protected static final Path RESOURCES = Paths.get("src", "test", "resources");
protected static final Path KEYSTORE = Paths.get(RESOURCES.toString(), "keystore");
protected static final Path KEYSTORE_PASSWORD_FILE = Paths.get(RESOURCES.toString(), "passwordfile");
protected static final Path TRUSTSTORE = Paths.get(RESOURCES.toString(), "truststore");
protected static final Path TRUSTSTORE_PASSWORD_FILE = Paths.get(RESOURCES.toString(), "trustpasswordfile");
+ protected static final Path CERT_SUBJECT_MATCHER = Paths.get(RESOURCES.toString(), "certSubjectMatcher");
protected static abstract class ConfigurationBase {
protected final ApplicationSettings settings = Mockito.mock(ApplicationSettings.class);
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
protected abstract class TestClassBase {
+
@MockBean
@Qualifier("inputQueue")
protected LinkedBlockingQueue<JSONObject> queue;
--- /dev/null
+.*
\ No newline at end of file
major=1
minor=4
-patch=3
+patch=4
base_version=${major}.${minor}.${patch}
release_version=${base_version}
snapshot_version=${base_version}-SNAPSHOT
Code Review / dcaegen2 / collectors / ves.git / commitdiff