mirror of
https://github.com/google/nomulus.git
synced 2025-04-30 20:17:51 +02:00
7e42ee48a4
Dagger updated to 2.13, along with all its dependencies. Also allows us to have multiple config files for different environment (prod, sandbox, alpha, local, etc) and specify which one to use on the command line with a --env flag. Therefore the same binary can be used in all environments. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=176551289
105 lines
4.3 KiB
Java
105 lines
4.3 KiB
Java
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package google.registry.proxy.handler;
|
|
|
|
import google.registry.util.FormattingLogger;
|
|
import io.netty.channel.Channel;
|
|
import io.netty.channel.ChannelHandler.Sharable;
|
|
import io.netty.channel.ChannelInitializer;
|
|
import io.netty.channel.embedded.EmbeddedChannel;
|
|
import io.netty.handler.ssl.ClientAuth;
|
|
import io.netty.handler.ssl.SslContextBuilder;
|
|
import io.netty.handler.ssl.SslHandler;
|
|
import io.netty.handler.ssl.SslProvider;
|
|
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
|
|
import io.netty.util.AttributeKey;
|
|
import io.netty.util.concurrent.Future;
|
|
import io.netty.util.concurrent.Promise;
|
|
import java.security.PrivateKey;
|
|
import java.security.cert.X509Certificate;
|
|
import javax.inject.Inject;
|
|
import javax.inject.Named;
|
|
import javax.inject.Singleton;
|
|
|
|
/**
|
|
* Adds a server side SSL handler to the channel pipeline.
|
|
*
|
|
* <p>This <b>should</b> be the first handler provided for any handler provider list, if it is
|
|
* provided. Unless you wish to first process the PROXY header with {@link ProxyProtocolHandler},
|
|
* which should come before this handler. The type parameter {@code C} is needed so that unit tests
|
|
* can construct this handler that works with {@link EmbeddedChannel};
|
|
*
|
|
* <p>The ssl handler added requires client authentication, but it uses an {@link
|
|
* InsecureTrustManagerFactory}, which accepts any ssl certificate presented by the client, as long
|
|
* as the client uses the corresponding private key to establish SSL handshake. The client
|
|
* certificate hash will be passed along to GAE as an HTTP header for verification (not handled by
|
|
* this handler).
|
|
*/
|
|
@Singleton
|
|
@Sharable
|
|
public class SslServerInitializer<C extends Channel> extends ChannelInitializer<C> {
|
|
|
|
/**
|
|
* Attribute key to the client certificate promise whose value is set when SSL handshake completes
|
|
* successfully.
|
|
*/
|
|
public static final AttributeKey<Promise<X509Certificate>> CLIENT_CERTIFICATE_PROMISE_KEY =
|
|
AttributeKey.valueOf("CLIENT_CERTIFICATE_PROMISE_KEY");
|
|
|
|
private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
|
|
private final SslProvider sslProvider;
|
|
private final PrivateKey privateKey;
|
|
private final X509Certificate[] certificates;
|
|
|
|
@Inject
|
|
SslServerInitializer(
|
|
SslProvider sslProvider,
|
|
PrivateKey privateKey,
|
|
@Named("eppServerCertificates") X509Certificate... certificates) {
|
|
logger.finefmt("Server SSL Provider: %s", sslProvider);
|
|
this.sslProvider = sslProvider;
|
|
this.privateKey = privateKey;
|
|
this.certificates = certificates;
|
|
}
|
|
|
|
@Override
|
|
protected void initChannel(C channel) throws Exception {
|
|
SslHandler sslHandler =
|
|
SslContextBuilder.forServer(privateKey, certificates)
|
|
.sslProvider(sslProvider)
|
|
.trustManager(InsecureTrustManagerFactory.INSTANCE)
|
|
.clientAuth(ClientAuth.REQUIRE)
|
|
.build()
|
|
.newHandler(channel.alloc());
|
|
Promise<X509Certificate> clientCertificatePromise = channel.eventLoop().newPromise();
|
|
Future<Channel> unusedFuture =
|
|
sslHandler
|
|
.handshakeFuture()
|
|
.addListener(
|
|
future -> {
|
|
if (future.isSuccess()) {
|
|
Promise<X509Certificate> unusedPromise =
|
|
clientCertificatePromise.setSuccess(
|
|
(X509Certificate)
|
|
sslHandler.engine().getSession().getPeerCertificates()[0]);
|
|
} else {
|
|
Promise<X509Certificate> unusedPromise =
|
|
clientCertificatePromise.setFailure(future.cause());
|
|
}
|
|
});
|
|
channel.attr(CLIENT_CERTIFICATE_PROMISE_KEY).set(clientCertificatePromise);
|
|
channel.pipeline().addLast(sslHandler);
|
|
}
|
|
}
|