Skip to content

Commit c8fe590

Browse files
IgorBalog-EngIgorBalog-Eng
authored
Merge pull request #226 from Engineering-Research-and-Development/feature/certification_fixes
Feature/certification fixes
2 parents 69b3444 + 46f1dfc commit c8fe590

File tree

112 files changed

+615
-181
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

112 files changed

+615
-181
lines changed

‎CHANGELOG.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,22 @@
11
# Changelog
22
All notable changes to this project will be documented in this file.
33

4+
## [1.14.3] - 2023-09-12
5+
6+
### Changed
7+
8+
- failed login is registered in logs (UserNotFoundException)
9+
- bumped spring-boot-parent to 2.5.14
10+
- hardcoded not to show stack trace in response
11+
- if DAPS certificate is not loaded, or certificate expired, connector will not start
12+
- changed how connectorId is used - now it is single property that needs to be set (application.connectorid)
13+
- if connectorId is not valid (blank) connector will not start
14+
15+
### Added
16+
17+
- added Spring StrictHttpFirewall with firewall.property file; default - disabled
18+
- new property application.connectorid
19+
420
## [1.14.2] - 2023-08-01
521

622
### Changed

‎README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,39 @@ The ECC supports three different way to exchange data:
6464
* **IDSCP2** enabled if *IDSCP2=true* and *WS_INTERNAL=false* (use https on the edge) or *IDSCP2=true* and *WS_INTERNAL=true* (use WS on the edge)
6565
* **Web Socket over HTTPS** enabled if *WS_OVER_HTTPS=true* and *IDSCP2=false*
6666

67+
## Firewall <a name="firewall"></a>
68+
69+
Execution Core Container allows setting up HttpFirewall through Spring Security. To turn it on/off, please take a look at following property:
70+
71+
```
72+
#Firewall
73+
application.firewall.isEnabled=true
74+
```
75+
76+
If firewall is enabled, it will read properties defined in `firewall.properties` file which easily can be modified by needs of setup.
77+
78+
```
79+
#Set which HTTP header names should be allowed (if want to allow all header names, keep it empty)
80+
allowedHeaderNames=
81+
#Set which values in header names should have the exact value and allowed (if want to allow any values keep it empty)
82+
allowedHeaderValues=
83+
#Set which HTTP methods should be allowed (if want to allow all header names, keep it empty)
84+
allowedMethods=GET,POST
85+
#Set if a backslash "\" or a URL encoded backslash "%5C" should be allowed in the path or not
86+
allowBackSlash=true
87+
#Set if a slash "/" that is URL encoded "%2F" should be allowed in the path or not
88+
allowUrlEncodedSlash=true
89+
#Set if double slash "//" that is URL encoded "%2F%2F" should be allowed in the path or not
90+
allowUrlEncodedDoubleSlash=true
91+
#Set if semicolon is allowed in the URL (i.e. matrix variables)
92+
allowSemicolon=true
93+
#Set if a percent "%" that is URL encoded "%25" should be allowed in the path or not
94+
allowUrlEncodedPercent=true
95+
#if a period "." that is URL encoded "%2E" should be allowed in the path or not
96+
allowUrlEncodedPeriod=true
97+
```
98+
*IMPORTANT:* If you're not an expert, the strong advice is to keep values at their default values. If you decide to change values, pay special attention to allowHeaderNames and allowHeaderValues, since those set values are exclusive and considered as only values that should be present in the header.
99+
67100
## How to Test
68101
The reachability could be verified using the following endpoints:
69102
* **http://{IP_ADDRESS}:{HTTP_PUBLIC_PORT}/about/version**

‎ci/docker/be-dataapp_resources/application-docker.properties‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ application.extractPayloadFromResponse=${EXTRACT_PAYLOAD_FROM_RESPONSE}
2626
#Use default behavior for contract agreement, should not be used in production
2727
application.contract.negotiation.demo=${CONTRACT_NEGOTIATION_DEMO}
2828

29+
#Firewall
30+
application.firewall.isEnabled=false
31+
2932
#mydata or platoon
3033
application.usageControlVersion=platoon
3134

‎ci/docker/be-dataapp_resources/firewall.properties‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#Set which HTTP header names should be allowed (if want to allow all header names, keep it empty)
2+
allowedHeaderNames=
3+
#Set which values in header names should have the exact value and allowed (if want to allow any values keep it empty)
4+
allowedHeaderValues=
5+
#Set which HTTP methods should be allowed (if want to allow all header names, keep it empty)
6+
allowedMethods=GET,POST
7+
#Set if a backslash "\" or a URL encoded backslash "%5C" should be allowed in the path or not
8+
allowBackSlash=true
9+
#Set if a slash "/" that is URL encoded "%2F" should be allowed in the path or not
10+
allowUrlEncodedSlash=true
11+
#Set if double slash "//" that is URL encoded "%2F%2F" should be allowed in the path or not
12+
allowUrlEncodedDoubleSlash=true
13+
#Set if semicolon is allowed in the URL (i.e. matrix variables)
14+
allowSemicolon=true
15+
#Set if a percent "%" that is URL encoded "%25" should be allowed in the path or not
16+
allowUrlEncodedPercent=true
17+
#if a period "." that is URL encoded "%2E" should be allowed in the path or not
18+
allowUrlEncodedPeriod=true

‎ci/docker/docker-compose-uc.yml‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ services:
1717
- DATA_APP_HEALTH_ENDPOINT=${PROVIDER_DATA_APP_HEALTH_ENDPOINT}
1818
- MULTIPART_EDGE=${PROVIDER_MULTIPART_EDGE} #Data APP endpoint multipart/mixed content type
1919
- MULTIPART_ECC=${MULTIPART_ECC}
20+
- CONNECTOR_ID=${PROVIDER_ISSUER_CONNECTOR_URI}
2021
- IDSCP2=${IDSCP2}
2122
- WS_EDGE=${PROVIDER_WS_EDGE}
2223
- WS_ECC=${WS_ECC}
@@ -49,12 +50,19 @@ services:
4950
networks:
5051
- provider
5152
environment:
53+
- ECC_PORT=8449
54+
- ECC_SELF_DESCRIPTION_URL=${PROVIDER_ECC_SELF_DESCRIPTION_URL}
55+
- KEYSTORE_NAME=${KEYSTORE_NAME}
56+
- KEY_PASSWORD=${KEY_PASSWORD}
57+
- KEYSTORE_PASSWORD=${KEYSTORE_PASSWORD}
58+
- ALIAS=${ALIAS}
5259
- TZ=Europe/Rome
5360
expose:
5461
- "8180"
5562
volumes:
5663
- ./uc-dataapp_resources_provider:/etc
5764
- uc_provider_data:/data
65+
- ./ecc_cert:/cert
5866

5967
be-dataapp-provider:
6068
image: rdlabengpa/ids_be_data_app:develop
@@ -69,14 +77,14 @@ services:
6977
- ALIAS=${ALIAS}
7078
- ECC_HOSTNAME=ecc-provider
7179
- ECC_PORT=8889
72-
- ECC_WSS_PORT=${ECC_PROVIDER_WSS_PORT}
7380
- TZ=Europe/Rome
7481
- ISSUER_CONNECTOR_URI=${PROVIDER_ISSUER_CONNECTOR_URI}
7582
- EXTRACT_PAYLOAD_FROM_RESPONSE=${EXTRACT_PAYLOAD_FROM_RESPONSE}
7683
- CONTRACT_NEGOTIATION_DEMO=${CONTRACT_NEGOTIATION_DEMO}
7784
ports:
7885
- "8183:8183"
79-
- "9000:9000"
86+
expose:
87+
- "9000"
8088
volumes:
8189
- ./be-dataapp_resources:/config
8290
- ./be-dataapp_data_receiver:/home/nobody/data
@@ -99,6 +107,7 @@ services:
99107
- DATA_APP_HEALTH_ENDPOINT=${CONSUMER_DATA_APP_HEALTH_ENDPOINT}
100108
- MULTIPART_EDGE=${CONSUMER_MULTIPART_EDGE} #Data APP endpoint multipart/mixed content type
101109
- MULTIPART_ECC=${MULTIPART_ECC}
110+
- CONNECTOR_ID=${CONSUMER_ISSUER_CONNECTOR_URI}
102111
- IDSCP2=${IDSCP2}
103112
- WS_EDGE=${CONSUMER_WS_EDGE}
104113
- WS_ECC=${WS_ECC}
@@ -131,12 +140,19 @@ services:
131140
networks:
132141
- consumer
133142
environment:
143+
- ECC_PORT=8449
144+
- ECC_SELF_DESCRIPTION_URL=${CONSUMER_ECC_SELF_DESCRIPTION_URL}
145+
- KEYSTORE_NAME=${KEYSTORE_NAME}
146+
- KEY_PASSWORD=${KEY_PASSWORD}
147+
- KEYSTORE_PASSWORD=${KEYSTORE_PASSWORD}
148+
- ALIAS=${ALIAS}
134149
- TZ=Europe/Rome
135150
expose:
136151
- "8280"
137152
volumes:
138153
- ./uc-dataapp_resources_consumer:/etc
139154
- uc_consumer_data:/data
155+
- ./ecc_cert:/cert
140156

141157
be-dataapp-consumer:
142158
image: rdlabengpa/ids_be_data_app:develop
@@ -151,14 +167,14 @@ services:
151167
- ALIAS=${ALIAS}
152168
- ECC_HOSTNAME=ecc-consumer
153169
- ECC_PORT=8887
154-
- ECC_WSS_PORT=${ECC_CONSUMER_WSS_PORT}
155170
- TZ=Europe/Rome
156171
- ISSUER_CONNECTOR_URI=${CONSUMER_ISSUER_CONNECTOR_URI}
157172
- EXTRACT_PAYLOAD_FROM_RESPONSE=${EXTRACT_PAYLOAD_FROM_RESPONSE}
158173
- CONTRACT_NEGOTIATION_DEMO=${CONTRACT_NEGOTIATION_DEMO}
159174
ports:
160175
- "8185:8183"
161-
- "9001:9000"
176+
expose:
177+
- "9000"
162178
volumes:
163179
- ./be-dataapp_resources:/config
164180
- be-dataapp_data_sender:/home/nobody/data

‎ci/docker/docker-compose.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ services:
1717
- DATA_APP_HEALTH_ENDPOINT=${PROVIDER_DATA_APP_HEALTH_ENDPOINT}
1818
- MULTIPART_EDGE=${PROVIDER_MULTIPART_EDGE} #Data APP endpoint multipart/mixed content type
1919
- MULTIPART_ECC=${MULTIPART_ECC}
20+
- CONNECTOR_ID=${PROVIDER_ISSUER_CONNECTOR_URI}
2021
- IDSCP2=${IDSCP2}
2122
- WS_EDGE=${PROVIDER_WS_EDGE}
2223
- WS_ECC=${WS_ECC}
@@ -63,7 +64,8 @@ services:
6364
- CONTRACT_NEGOTIATION_DEMO=${CONTRACT_NEGOTIATION_DEMO}
6465
ports:
6566
- "8183:8183"
66-
- "9000:9000"
67+
expose:
68+
- "9000"
6769
volumes:
6870
- ./be-dataapp_resources:/config
6971
- ./be-dataapp_data_receiver:/home/nobody/data
@@ -86,6 +88,7 @@ services:
8688
- DATA_APP_HEALTH_ENDPOINT=${CONSUMER_DATA_APP_HEALTH_ENDPOINT}
8789
- MULTIPART_EDGE=${CONSUMER_MULTIPART_EDGE} #Data APP endpoint multipart/mixed content type
8890
- MULTIPART_ECC=${MULTIPART_ECC}
91+
- CONNECTOR_ID=${CONSUMER_ISSUER_CONNECTOR_URI}
8992
- IDSCP2=${IDSCP2}
9093
- WS_EDGE=${CONSUMER_WS_EDGE}
9194
- WS_ECC=${WS_ECC}
@@ -132,7 +135,8 @@ services:
132135
- CONTRACT_NEGOTIATION_DEMO=${CONTRACT_NEGOTIATION_DEMO}
133136
ports:
134137
- "8185:8183"
135-
- "9001:9000"
138+
expose:
139+
- "9000"
136140
volumes:
137141
- ./be-dataapp_resources:/config
138142
- be-dataapp_data_sender:/home/nobody/data

‎ci/docker/ecc_resources_consumer/application-docker.properties‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ application.encodeDecodePayload=false
8383
application.selfdescription.registrateOnStartup=false
8484
application.selfdescription.brokerURL=${BROKER_URL}
8585

86+
#Firewall
87+
application.firewall.isEnabled=true
88+
8689
### Clearng-House
8790
application.clearinghouse.isEnabledClearingHouse=false
8891
application.clearinghouse.username=
@@ -92,10 +95,8 @@ application.clearinghouse.baseUrl=${CLEARING_HOUSE}
9295
application.clearinghouse.logEndpoint=/messages/log/
9396
application.clearinghouse.processEndpoint=/process/
9497

95-
#Connector URIs
96-
application.uriSchema=http
97-
application.uriAuthority=//w3id.org/engrd
98-
application.uriConnector=/connector/
98+
#Connector ID
99+
application.connectorid=${CONNECTOR_ID}
99100

100101
#IDSCP2 enabled
101102
application.idscp2.isEnabled=${IDSCP2}
@@ -182,7 +183,7 @@ application.selfdescription.description=Data Consumer Connector description
182183
application.selfdescription.title=Data Consumer Connector title
183184
application.selfdescription.curator=http://consumer.curatorURI.com
184185
application.selfdescription.maintainer=http://consumer.maintainerURI.com
185-
application.selfdescription.filelocation=/
186+
application.selfdescription.filelocation=/home/nobody/data/sd
186187
application.selfdescription.inboundModelVersion=4.0.0,4.1.0,4.1.2,4.2.0,4.2.1,4.2.2,4.2.3,4.2.4,4.2.5,4.2.6,4.2.7
187188

188189
#For logging the response over WSS set to DEBUG, else leave empty

‎ci/docker/ecc_resources_consumer/firewall.properties‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#Set which HTTP header names should be allowed (if want to allow all header names, keep it empty)
2+
allowedHeaderNames=
3+
#Set which values in header names should have the exact value and allowed (if want to allow any values keep it empty)
4+
allowedHeaderValues=
5+
#Set which HTTP methods should be allowed (if want to allow all header names, keep it empty)
6+
allowedMethods=GET,POST
7+
#Set if a backslash "\" or a URL encoded backslash "%5C" should be allowed in the path or not
8+
allowBackSlash=true
9+
#Set if a slash "/" that is URL encoded "%2F" should be allowed in the path or not
10+
allowUrlEncodedSlash=true
11+
#Set if double slash "//" that is URL encoded "%2F%2F" should be allowed in the path or not
12+
allowUrlEncodedDoubleSlash=true
13+
#Set if semicolon is allowed in the URL (i.e. matrix variables)
14+
allowSemicolon=true
15+
#Set if a percent "%" that is URL encoded "%25" should be allowed in the path or not
16+
allowUrlEncodedPercent=true
17+
#if a period "." that is URL encoded "%2E" should be allowed in the path or not
18+
allowUrlEncodedPeriod=true

‎ci/docker/ecc_resources_provider/application-docker.properties‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,9 @@ application.encodeDecodePayload=false
8383
application.selfdescription.registrateOnStartup=false
8484
application.selfdescription.brokerURL=${BROKER_URL}
8585

86+
#Firewall
87+
application.firewall.isEnabled=true
88+
8689
### Clearng-House
8790
application.clearinghouse.isEnabledClearingHouse=false
8891
application.clearinghouse.username=
@@ -92,10 +95,8 @@ application.clearinghouse.baseUrl=${CLEARING_HOUSE}
9295
application.clearinghouse.logEndpoint=/messages/log/
9396
application.clearinghouse.processEndpoint=/process/
9497

95-
#Connector URIs
96-
application.uriSchema=http
97-
application.uriAuthority=//w3id.org/engrd
98-
application.uriConnector=/connector/
98+
#Connector ID
99+
application.connectorid=${CONNECTOR_ID}
99100

100101
#IDSCP2 enabled
101102
application.idscp2.isEnabled=${IDSCP2}
@@ -185,7 +186,7 @@ application.selfdescription.description=Data Provider Connector description
185186
application.selfdescription.title=Data Provider Connector title
186187
application.selfdescription.curator=http://provider.curatorURI.com
187188
application.selfdescription.maintainer=http://provider.maintainerURI.com
188-
application.selfdescription.filelocation=/
189+
application.selfdescription.filelocation=/home/nobody/data/sd
189190
application.selfdescription.inboundModelVersion=4.0.0,4.1.0,4.1.2,4.2.0,4.2.1,4.2.2,4.2.3,4.2.4,4.2.5,4.2.6,4.2.7
190191

191192
#For logging the response over WSS set to DEBUG, else leave empty

‎ci/docker/ecc_resources_provider/firewall.properties‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#Set which HTTP header names should be allowed (if want to allow all header names, keep it empty)
2+
allowedHeaderNames=
3+
#Set which values in header names should have the exact value and allowed (if want to allow any values keep it empty)
4+
allowedHeaderValues=
5+
#Set which HTTP methods should be allowed (if want to allow all header names, keep it empty)
6+
allowedMethods=GET,POST
7+
#Set if a backslash "\" or a URL encoded backslash "%5C" should be allowed in the path or not
8+
allowBackSlash=true
9+
#Set if a slash "/" that is URL encoded "%2F" should be allowed in the path or not
10+
allowUrlEncodedSlash=true
11+
#Set if double slash "//" that is URL encoded "%2F%2F" should be allowed in the path or not
12+
allowUrlEncodedDoubleSlash=true
13+
#Set if semicolon is allowed in the URL (i.e. matrix variables)
14+
allowSemicolon=true
15+
#Set if a percent "%" that is URL encoded "%25" should be allowed in the path or not
16+
allowUrlEncodedPercent=true
17+
#if a period "." that is URL encoded "%2E" should be allowed in the path or not
18+
allowUrlEncodedPeriod=true

0 commit comments

Comments
 (0)