RUN python -m pip install -r /opt/db/config/requirements.txt
ADD certificates /usr/local/share/ca-certificates/
RUN update-ca-certificates
-CMD if [ -f /app/store/p12.pass ]; then export CLIENT_CERT_PASS=$(cat /app/store/p12.pass); fi \
- && if [ -f /app/store/trust.pass ]; then export TRUST_CERT_PASS=$(cat /app/store/trust.pass); fi \
- && python /opt/db/config/mongo_db_schema_creation.py \
+CMD python /opt/db/config/mongo_db_schema_creation.py \
&& java -Dspring.config.location=file:/app/application.properties -cp /app/libs/*:/app/pnf-simulator.jar org.onap.pnfsimulator.Main \
3. Edit /app/application.properties file as follow:
- ssl.clientCertificateEnabled=true (to disable/enable client authentication)
- ssl.strictHostnameVerification=true (to disable/enable hostname verification)
-- ssl.clientCertificateDir=/app/store/client.p12 (to replace keystore file)
-- ssl.clientCertificatePassword=collector (to replace password for keystore)
-- ssl.trustStoreDir=/app/store/trustStore (to replace truststore file)
-- ssl.trustStorePassword=collector (to replace password for truststore)
-4. Refresh configuration by sending simple POST request to correct actuator endpoint at: ```curl http://localhost:5000/refresh -H 'Content-type: application/json' -X POST --data '{}'```
+- ssl.clientCertificatePath=/app/store/client.p12 (to replace with keystore file)
+- ssl.clientCertificatePasswordPath=/app/store/keystore.pass (to replace with keystore password file)
+- ssl.trustStorePath=/app/store/trustStore (to replace with truststore file)
+- ssl.trustStorePasswordPath=/app/store/truststore.pass (to replace with truststore password file)
+4. Refresh configuration by sending simple POST request to correct actuator endpoint at: ```curl http://localhost:5001/refresh -H 'Content-type: application/json' -X POST --data '{}'```
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * PNF-REGISTRATION-HANDLER
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.pnfsimulator.simulator.client.utils.ssl;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import javax.net.ssl.SSLContext;
+import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
+import org.apache.http.ssl.SSLContexts;
+
+class CertAuthSslContextFactory {
+
+ private final CertificateReader certificateReader;
+
+ CertAuthSslContextFactory(CertificateReader certificateReader) {
+ this.certificateReader = certificateReader;
+ }
+
+ SSLContext createSslContext(SslAuthenticationHelper sslAuthenticationHelper)
+ throws GeneralSecurityException, IOException {
+ final String keystorePasswordPath = sslAuthenticationHelper.getClientCertificatePasswordPath();
+
+ final KeyStore keystore = certificateReader.read(sslAuthenticationHelper.getClientCertificatePath(),
+ keystorePasswordPath, "PKCS12");
+ final KeyStore truststore = certificateReader.read(sslAuthenticationHelper.getTrustStorePath(),
+ sslAuthenticationHelper.getTrustStorePasswordPath(), "JKS");
+
+ return SSLContexts.custom()
+ .loadKeyMaterial(keystore, certificateReader.readPassword(keystorePasswordPath))
+ .loadTrustMaterial(truststore, new TrustSelfSignedStrategy())
+ .build();
+ }
+
+}
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.nio.file.Files;
+import java.nio.file.Path;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
class CertificateReader {
- KeyStore read(String certificate, String password, String type) throws GeneralSecurityException, IOException {
- try (InputStream keyStoreStream = new FileInputStream(certificate)) {
+ KeyStore read(String certificatePath, String passwordPath, String type) throws GeneralSecurityException, IOException {
+ try (InputStream keyStoreStream = new FileInputStream(certificatePath)) {
KeyStore keyStore = KeyStore.getInstance(type);
- keyStore.load(keyStoreStream, PasswordConverter.convert(password));
+ keyStore.load(keyStoreStream, readPassword(passwordPath));
return keyStore;
}
}
+
+ char[] readPassword(String passwordPath) throws IOException {
+ final String password = Files.readString(Path.of(passwordPath));
+ return PasswordConverter.convert(password);
+ }
+
}
package org.onap.pnfsimulator.simulator.client.utils.ssl;
-import org.apache.http.client.HttpClient;
-
import java.io.IOException;
import java.security.GeneralSecurityException;
+import org.apache.http.client.HttpClient;
public class HttpClientFactoryFacade {
}
private static final CertificateReader CERTIFICATE_READER = new CertificateReader();
- private static final SSLContextFactory SSL_CONTEXT_FACTORY = new SSLContextFactory(CERTIFICATE_READER);
+ private static final CertAuthSslContextFactory CERT_AUTH_SSL_CONTEXT_FACTORY = new CertAuthSslContextFactory(CERTIFICATE_READER);
+ private static final SSLContextFactory SSL_CONTEXT_FACTORY = new SSLContextFactory(CERT_AUTH_SSL_CONTEXT_FACTORY);
private static final HttpClientFactory HTTP_CLIENT_FACTORY = new HttpClientFactory(SSL_CONTEXT_FACTORY);
public static HttpClient create(String url, SslAuthenticationHelper sslAuthenticationHelper) throws GeneralSecurityException, IOException {
*/
package org.onap.pnfsimulator.simulator.client.utils.ssl;
-import org.apache.http.conn.ssl.TrustAllStrategy;
-import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
-import org.apache.http.conn.ssl.TrustStrategy;
-import org.apache.http.ssl.SSLContextBuilder;
-import org.apache.http.ssl.SSLContexts;
-
-import javax.net.ssl.SSLContext;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
+import javax.net.ssl.SSLContext;
+import org.apache.http.conn.ssl.TrustAllStrategy;
+import org.apache.http.conn.ssl.TrustStrategy;
+import org.apache.http.ssl.SSLContextBuilder;
class SSLContextFactory {
private static final TrustStrategy TRUST_STRATEGY_ALWAYS = new TrustAllStrategy();
- private final CertificateReader certificateReader;
+ private final CertAuthSslContextFactory certAuthSslContextFactory;
- SSLContextFactory(CertificateReader certificateReader) {
- this.certificateReader = certificateReader;
+ SSLContextFactory(CertAuthSslContextFactory certAuthSslContextFactory) {
+ this.certAuthSslContextFactory = certAuthSslContextFactory;
}
SSLContext create(SslAuthenticationHelper sslAuthenticationHelper) throws GeneralSecurityException, IOException {
- return SSLContexts.custom()
- .loadKeyMaterial(certificateReader.read(sslAuthenticationHelper.getClientCertificateDir(), sslAuthenticationHelper.getClientCertificatePassword(), "PKCS12"), PasswordConverter.convert(sslAuthenticationHelper.getClientCertificatePassword()))
- .loadTrustMaterial(certificateReader.read(sslAuthenticationHelper.getTrustStoreDir(), sslAuthenticationHelper.getTrustStorePassword(), "JKS"), new TrustSelfSignedStrategy())
- .build();
+ return certAuthSslContextFactory.createSslContext(sslAuthenticationHelper);
}
SSLContext createTrustAlways() throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
private boolean clientCertificateEnabled;
private boolean strictHostnameVerification;
- private String clientCertificateDir;
- private String clientCertificatePassword;
- private String trustStoreDir;
- private String trustStorePassword;
+ private String clientCertificatePath;
+ private String clientCertificatePasswordPath;
+ private String trustStorePath;
+ private String trustStorePasswordPath;
}
ssl.clientCertificateEnabled=true
ssl.strictHostnameVerification=${STRICT_HOSTNAME_VERIFICATION:false}
-ssl.clientCertificateDir=/app/store/cert.p12
-ssl.clientCertificatePassword=${CLIENT_CERT_PASS:collector}
-ssl.trustStoreDir=/app/store/trust.jks
-ssl.trustStorePassword=${TRUST_CERT_PASS:collector}
+ssl.clientCertificatePath=/app/store/cert.p12
+ssl.clientCertificatePasswordPath=/app/store/p12.pass
+ssl.trustStorePath=/app/store/trust.jks
+ssl.trustStorePasswordPath=/app/store/trust.pass
\ No newline at end of file
--- /dev/null
+/*
+ * ============LICENSE_START=======================================================
+ * PNF-REGISTRATION-HANDLER
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.pnfsimulator.simulator.client.utils.ssl;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.nio.file.NoSuchFileException;
+import java.security.GeneralSecurityException;
+import javax.net.ssl.SSLContext;
+import org.hamcrest.CoreMatchers;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+
+public class CertAuthSslContextFactoryTest {
+
+ private static final String CERTIFICATES_DIRECTORY = "src/test/resources/certificates/";
+
+ private static final String KEYSTORE_FILENAME = "client.p12";
+ private static final String VALID_KEYSTORE_PASSWORD_FILENAME = "client.pass";
+ private static final String INVALID_KEYSTORE_PASSWORD_FILENAME = "client_invalid.pass";
+
+ private static final String TRUSTSTORE_FILENAME = "truststore";
+ private static final String VALID_TRUSTSTORE_PASSWORD_FILENAME = "truststore.pass";
+ private static final String INVALID_TRUSTSTORE_PASSWORD_FILENAME = "truststore_invalid.pass";
+
+ private static final String NON_EXISTING_PASSWORD_FILENAME = "non_existing.pass";
+ private static final String PASSWORD_INCORRECT = "password was incorrect";
+
+ private CertAuthSslContextFactory certAuthSslContextFactory;
+
+ @Before
+ public void setup() {
+ this.certAuthSslContextFactory = new CertAuthSslContextFactory(new CertificateReader());
+ }
+
+ @Test
+ public void shouldCreateSslContextSuccessfully_whenValidPasswordsUsed()
+ throws GeneralSecurityException, IOException {
+ // Given
+ final SslAuthenticationHelper sslAuthenticationHelper = mockSslAuthenticationHelperWithFiles(
+ VALID_KEYSTORE_PASSWORD_FILENAME, VALID_TRUSTSTORE_PASSWORD_FILENAME);
+
+ // When
+ final SSLContext sslContext = certAuthSslContextFactory.createSslContext(sslAuthenticationHelper);
+
+ // Then
+ assertNotNull(sslContext);
+ }
+
+ @Test
+ public void shouldThrowIOException_whenInvalidKeystorePasswordUsed() {
+ // Given
+ final SslAuthenticationHelper sslAuthenticationHelper = mockSslAuthenticationHelperWithFiles(
+ INVALID_KEYSTORE_PASSWORD_FILENAME, VALID_TRUSTSTORE_PASSWORD_FILENAME);
+
+ // When
+ final IOException exception = assertThrows(IOException.class,
+ () -> certAuthSslContextFactory.createSslContext(sslAuthenticationHelper));
+
+ // Then
+ assertThat(exception.getMessage(), CoreMatchers.containsString(PASSWORD_INCORRECT));
+ }
+
+ @Test
+ public void shouldThrowIOException_whenInvalidTruststorePasswordUsed() {
+ // Given
+ final SslAuthenticationHelper sslAuthenticationHelper = mockSslAuthenticationHelperWithFiles(
+ VALID_KEYSTORE_PASSWORD_FILENAME, INVALID_TRUSTSTORE_PASSWORD_FILENAME);
+
+ // When
+ final IOException exception = assertThrows(IOException.class,
+ () -> certAuthSslContextFactory.createSslContext(sslAuthenticationHelper));
+
+ // Then
+ assertThat(exception.getMessage(), CoreMatchers.containsString(PASSWORD_INCORRECT));
+ }
+
+ @Test
+ public void shouldThrowNoSuchFileException_whenInvalidKeystoreFilePath() {
+ final SslAuthenticationHelper sslAuthenticationHelper = mockSslAuthenticationHelperWithFiles(
+ NON_EXISTING_PASSWORD_FILENAME, INVALID_TRUSTSTORE_PASSWORD_FILENAME);
+
+ // When, Then
+ assertThrows(NoSuchFileException.class,
+ () -> certAuthSslContextFactory.createSslContext(sslAuthenticationHelper));
+ }
+
+ @Test
+ public void shouldThrowNoSuchFileException_whenInvalidTruststoreFilePath() {
+ // Given
+ final SslAuthenticationHelper sslAuthenticationHelper = mockSslAuthenticationHelperWithFiles(
+ VALID_KEYSTORE_PASSWORD_FILENAME, NON_EXISTING_PASSWORD_FILENAME);
+
+ // When, Then
+ assertThrows(NoSuchFileException.class,
+ () -> certAuthSslContextFactory.createSslContext(sslAuthenticationHelper));
+ }
+
+ private SslAuthenticationHelper mockSslAuthenticationHelperWithFiles(String keystorePasswordFilename,
+ String truststorePasswordFilename) {
+ final SslAuthenticationHelper sslAuthenticationHelper = Mockito.mock(SslAuthenticationHelper.class);
+
+ when(sslAuthenticationHelper.getClientCertificatePath())
+ .thenReturn(getPath(KEYSTORE_FILENAME));
+ when(sslAuthenticationHelper.getClientCertificatePasswordPath())
+ .thenReturn(getPath(keystorePasswordFilename));
+ when(sslAuthenticationHelper.getTrustStorePath())
+ .thenReturn(getPath(TRUSTSTORE_FILENAME));
+ when(sslAuthenticationHelper.getTrustStorePasswordPath())
+ .thenReturn(getPath(truststorePasswordFilename));
+
+ return sslAuthenticationHelper;
+ }
+
+ private String getPath(String fileName) {
+ return CERTIFICATES_DIRECTORY + fileName;
+ }
+}
\ No newline at end of file
package org.onap.pnfsimulator.simulator.client.utils.ssl;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.io.IOException;
-import java.security.GeneralSecurityException;
-
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
class SSLContextFactoryTest {
private CertificateReader certificateReaderMock;
+ private CertAuthSslContextFactory certAuthSslContextFactory;
private SSLContextFactory sslContextFactory;
@BeforeEach
void setup() {
certificateReaderMock = mock(CertificateReader.class);
- sslContextFactory = new SSLContextFactory(certificateReaderMock);
+ certAuthSslContextFactory = new CertAuthSslContextFactory(certificateReaderMock);
+ sslContextFactory = new SSLContextFactory(certAuthSslContextFactory);
}
@Test
--- /dev/null
+collector
\ No newline at end of file
--- /dev/null
+invalidpassword
\ No newline at end of file
--- /dev/null
+collector
\ No newline at end of file
--- /dev/null
+invalidpassword
\ No newline at end of file
--- /dev/null
+collector
\ No newline at end of file
--- /dev/null
+collector
\ No newline at end of file
- "5000:5000"
command: bash -c "
while [[ $$(ls -1 /app/store | wc -l) != '10' ]]; do echo 'Waiting for certs...'; sleep 3; done
- && export CLIENT_CERT_PASS=$$(cat /app/store/p12.pass)
- && export TRUST_CERT_PASS=$$(cat /app/store/trust.pass)
&& java -Dspring.config.location=file:/app/application.properties -cp /app/libs/*:/app/pnf-simulator.jar org.onap.pnfsimulator.Main
"
volumes:
--clean-pnfsim:
docker-compose -f docker-compose-pnfsim.yml down
- rm -rf ./resources/certservice-client/client-volume-for-pnfsim/cert.p12 || true
rm -rf ./resources/certservice-client/client-volume-for-pnfsim/trust.jks || true
+ rm -rf ./resources/certservice-client/client-volume-for-pnfsim/cert.p12 || true
+ rm -rf ./resources/certservice-client/client-volume-for-pnfsim/p12.pass || true
+ rm -rf ./resources/certservice-client/client-volume-for-pnfsim/trust.pass || true
--clean-env:
docker-compose -f docker-compose-ves-dmaap.yml down
- public
command: bash -c "
while [[ $$(ls -1 /app/store | wc -l) != '4' ]]; do echo 'Waiting for certs...'; sleep 3; done
- && cp /app/store/truststore.jks /app/store/trust.jks
- && cp /app/store/keystore.jks /app/store/cert.p12
- && export CLIENT_CERT_PASS=$$(cat /app/store/keystore.pass)
- && export TRUST_CERT_PASS=$$(cat /app/store/truststore.pass)
+ && cp /app/store/truststore.p12 /app/store/trust.jks
+ && cp /app/store/keystore.p12 /app/store/cert.p12
+ && cp /app/store/keystore.pass /app/store/p12.pass
+ && cp /app/store/truststore.pass /app/store/trust.pass
&& java -Dspring.config.location=file:/app/application.properties -cp /app/libs/*:/app/pnf-simulator.jar org.onap.pnfsimulator.Main
"
volumes:
REQUEST_TIMEOUT=10000
OUTPUT_PATH=/var/certs
CA_NAME=RA
-OUTPUT_TYPE=JKS
+OUTPUT_TYPE=P12
#Csr config envs
COMMON_NAME=onap.org
ORGANIZATION=Linux-Foundation
Code Review / integration / simulators / pnf-simulator.git / commitdiff