Skip to content

Commit 74b882c

Browse files
andreaturliandreaturli
committed
add support for trustStore and trustStorePassword
1 parent 42bfe54 commit 74b882c

File tree

5 files changed

+166
-52
lines changed

5 files changed

+166
-52
lines changed

‎vcloud-director-nat-microservice/src/test/java/brooklyn/networking/vclouddirector/natmicroservice/NatServiceMicroserviceLiveTest.java‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
import org.testng.annotations.BeforeClass;
1616
import org.testng.annotations.Test;
1717

18+
import com.google.common.escape.Escaper;
19+
import com.google.common.net.UrlEscapers;
20+
import com.sun.jersey.api.client.ClientResponse;
21+
import com.sun.jersey.api.client.GenericType;
22+
1823
import brooklyn.config.BrooklynProperties;
1924
import brooklyn.entity.basic.Entities;
2025
import brooklyn.location.jclouds.JcloudsLocation;
@@ -25,23 +30,24 @@
2530
import brooklyn.test.entity.LocalManagementContextForTests;
2631
import brooklyn.util.exceptions.Exceptions;
2732

28-
import com.google.common.escape.Escaper;
29-
import com.google.common.net.UrlEscapers;
30-
import com.sun.jersey.api.client.ClientResponse;
31-
import com.sun.jersey.api.client.GenericType;
32-
3333
public class NatServiceMicroserviceLiveTest extends AbstractRestApiTest {
3434

3535
private static final Logger LOG = LoggerFactory.getLogger(NatServiceMicroserviceLiveTest.class);
3636

3737
private ManagementContext mgmt;
3838
private JcloudsLocation loc;
39+
40+
private String trustStore;
41+
private String trustStorePassword;
3942

4043
@BeforeClass(alwaysRun=true)
4144
@Override
4245
public void setUp() throws Exception {
4346
mgmt = new LocalManagementContextForTests(BrooklynProperties.Factory.newDefault());
4447
loc = (JcloudsLocation) mgmt.getLocationRegistry().resolve("canopy-vCHS");
48+
trustStore = (String) loc.getAllConfigBag().getStringKey("trustStore");
49+
trustStorePassword = (String) loc.getAllConfigBag().getStringKey("trustStorePassword");
50+
4551
super.setUp();
4652
}
4753

@@ -54,7 +60,7 @@ public void tearDown() throws Exception {
5460

5561
protected NatServiceDispatcher newNatServiceDispatcher() {
5662
return NatServiceDispatcher.builder()
57-
.endpoint(endpoint(loc), new TrustConfig(null, null))
63+
.endpoint(endpoint(loc), new TrustConfig(trustStore, trustStorePassword))
5864
.build();
5965
}
6066

‎vcloud-director-portforwarding/src/main/java/brooklyn/networking/vclouddirector/NatDirectClient.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ public NatDirectClient(JcloudsLocation loc) {
4747
.endpoint(endpoint)
4848
.identity(loc.getIdentity())
4949
.credential(loc.getCredential())
50+
.trustStore((String) loc.getAllConfigBag().getStringKey("trustStore"))
51+
.trustStorePassword((String) loc.getAllConfigBag().getStringKey("trustStorePassword"))
5052
.mutex(MutexRegistry.INSTANCE.getMutexFor(endpoint))
5153
.build();
5254
}

‎vcloud-director/src/main/java/brooklyn/networking/vclouddirector/CustomSSLSocketFactory.java‎

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -26,43 +26,42 @@
2626

2727
import org.apache.http.conn.ssl.SSLSocketFactory;
2828

29+
import com.google.common.base.Throwables;
30+
2931
public class CustomSSLSocketFactory {
3032

3133
private CustomSSLSocketFactory() {
3234
}
3335

34-
public static SSLSocketFactory getInstance()
35-
throws NoSuchAlgorithmException, KeyStoreException,
36-
CertificateException, KeyManagementException, IOException {
37-
38-
TrustManagerFactory trustManagerFactory = TrustManagerFactory
39-
.getInstance(TrustManagerFactory.getDefaultAlgorithm());
40-
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
41-
try{
42-
String trustStore = System.getProperty("javax.net.ssl.trustStore");
43-
String trustStorePassword = System.getProperty("javax.net.ssl.trustStorePassword");
44-
if(trustStore == null || trustStorePassword == null){
45-
throw new IOException("javax.net.ssl.trustStore/javax.net.ssl.trustStorePassword property - not set");
46-
}
36+
public static SSLSocketFactory getInstance(String trustStore, String trustStorePassword) {
37+
try {
38+
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
4739
FileInputStream keystoreStream = new FileInputStream(trustStore);
48-
try{
49-
keystore = KeyStore.getInstance(KeyStore.getDefaultType());
40+
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
41+
try {
5042
keystore.load(keystoreStream, trustStorePassword.toCharArray());
51-
} finally{
43+
} finally {
5244
keystoreStream.close();
5345
}
54-
} catch(FileNotFoundException e){
55-
e.printStackTrace();
46+
trustManagerFactory.init(keystore);
47+
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
48+
SSLContext sslContext = SSLContext.getInstance("TLS");
49+
sslContext.init(null, trustManagers, null);
50+
SSLContext.setDefault(sslContext);
51+
return new SSLSocketFactory(sslContext, SSLSocketFactory.STRICT_HOSTNAME_VERIFIER);
52+
} catch (CertificateException e) {
53+
throw Throwables.propagate(e);
54+
} catch (NoSuchAlgorithmException e) {
55+
throw Throwables.propagate(e);
56+
} catch (KeyStoreException e) {
57+
throw Throwables.propagate(e);
58+
} catch (KeyManagementException e) {
59+
throw Throwables.propagate(e);
60+
} catch (FileNotFoundException e) {
61+
throw Throwables.propagate(e);
5662
} catch (IOException e) {
57-
e.printStackTrace();
63+
throw Throwables.propagate(e);
5864
}
59-
trustManagerFactory.init(keystore);
60-
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
61-
SSLContext sslContext = SSLContext.getInstance("TLS");
62-
sslContext.init(null, trustManagers, null);
63-
SSLContext.setDefault(sslContext);
64-
65-
return new SSLSocketFactory(sslContext,
66-
SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
6765
}
66+
6867
}

‎vcloud-director/src/main/java/brooklyn/networking/vclouddirector/NatService.java‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,6 @@
1515
import org.slf4j.Logger;
1616
import org.slf4j.LoggerFactory;
1717

18-
import brooklyn.util.exceptions.Exceptions;
19-
import brooklyn.util.guava.Maybe;
20-
import brooklyn.util.net.Protocol;
21-
import brooklyn.util.text.Strings;
22-
import brooklyn.util.time.Duration;
23-
import brooklyn.util.time.Time;
24-
2518
import com.google.common.annotations.Beta;
2619
import com.google.common.base.Objects;
2720
import com.google.common.base.Predicates;
@@ -51,6 +44,12 @@
5144
import com.vmware.vcloud.sdk.constants.Version;
5245
import com.vmware.vcloud.sdk.constants.query.QueryReferenceType;
5346

47+
import brooklyn.util.exceptions.Exceptions;
48+
import brooklyn.util.guava.Maybe;
49+
import brooklyn.util.net.Protocol;
50+
import brooklyn.util.time.Duration;
51+
import brooklyn.util.time.Time;
52+
5453
/**
5554
* For adding/removing NAT rules to vcloud-director.
5655
*
@@ -477,7 +476,6 @@ protected VcloudClient newVcloudClient() {
477476
return newVcloudClient(baseUrl, identity, credential, trustStore, trustStorePassword, logLevel);
478477
}
479478

480-
// FIXME Don't set sysprop as could affect all other activities of the JVM!
481479
protected VcloudClient newVcloudClient(String endpoint, String identity, String credential, String trustStore, String trustStorePassword, Level logLevel) {
482480
try {
483481
if (logLevel != null) {
@@ -494,6 +492,15 @@ protected VcloudClient newVcloudClient(String endpoint, String identity, String
494492
vcloudClient = new VcloudClient(endpoint, version);
495493
LOG.debug("VCloudClient - trying login to {} using {}", endpoint, version);
496494
vcloudClient.login(identity, credential);
495+
496+
// Performing Certificate Validation
497+
if (trustStore != null && trustStorePassword != null) {
498+
vcloudClient.registerScheme("https", 443, CustomSSLSocketFactory.getInstance(trustStore, trustStorePassword));
499+
} else {
500+
LOG.warn("Ignoring the Certificate Validation using FakeSSLSocketFactory");
501+
vcloudClient.registerScheme("https", 443, FakeSSLSocketFactory.getInstance());
502+
}
503+
497504
versionFound = true;
498505
LOG.info("VCloudClient - Logged into {} using version {}", endpoint, version);
499506
break;
@@ -504,17 +511,6 @@ protected VcloudClient newVcloudClient(String endpoint, String identity, String
504511
if (!versionFound) {
505512
throw new IllegalStateException("Cannot login to " + endpoint + " using any of " + VCLOUD_VERSIONS);
506513
}
507-
508-
// Performing Certificate Validation
509-
if (Strings.isNonBlank(trustStore)) {
510-
System.setProperty("javax.net.ssl.trustStore", trustStore);
511-
System.setProperty("javax.net.ssl.trustStorePassword", trustStorePassword);
512-
vcloudClient.registerScheme("https", 443, CustomSSLSocketFactory.getInstance());
513-
514-
} else {
515-
LOG.warn("Ignoring the Certificate Validation using FakeSSLSocketFactory");
516-
vcloudClient.registerScheme("https", 443, FakeSSLSocketFactory.getInstance());
517-
}
518514
return vcloudClient;
519515
} catch (Exception e) {
520516
throw Exceptions.propagate(e);

‎vcloud-director/src/test/java/brooklyn/networking/vclouddirector/SecureNatServiceLiveTest.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
package brooklyn.networking.vclouddirector;
2+
3+
import static org.testng.Assert.assertNotNull;
4+
5+
import java.net.URI;
6+
import java.net.URISyntaxException;
7+
import java.util.List;
8+
import java.util.concurrent.Executors;
9+
10+
import org.testng.annotations.AfterMethod;
11+
import org.testng.annotations.BeforeMethod;
12+
import org.testng.annotations.Test;
13+
14+
import com.google.common.util.concurrent.ListeningExecutorService;
15+
import com.google.common.util.concurrent.MoreExecutors;
16+
import com.vmware.vcloud.api.rest.schema.NatRuleType;
17+
18+
import brooklyn.entity.BrooklynAppLiveTestSupport;
19+
import brooklyn.location.jclouds.JcloudsLocation;
20+
import brooklyn.util.exceptions.Exceptions;
21+
22+
/**
23+
* Tests assume that brooklyn.properties have been configured with location specs for vCHS and TAI.
24+
* For example:
25+
*
26+
* <pre>
27+
* brooklyn.location.named.canopy-vCHS=jclouds:vcloud-director:https://p5v1-vcd.vchs.vmware.com/api
28+
* brooklyn.location.named.canopy-vCHS.identity=jo.blogs@cloudsoftcorp.com@M123456789-1234
29+
* brooklyn.location.named.canopy-vCHS.credential=pa55w0rd
30+
* brooklyn.location.named.canopy-vCHS.advancednetworking.vcloud.network.id=041e176a-befc-4b28-89e2-3c5343ff4d12
31+
* brooklyn.location.named.canopy-vCHS.advancednetworking.vcloud.network.publicip=23.92.230.21
32+
* brooklyn.location.named.canopy-vCHS.trustStore=/Library/Java/JavaVirtualMachines/jdk1.7.0_71.jdk/Contents/Home/jre/lib/security/cacerts
33+
* brooklyn.location.named.canopy-vCHS.trustStorePassword=changeit
34+
*
35+
* brooklyn.location.named.canopy-TAI=jclouds:vcloud-director:https://svdc.it-solutions.atos.net/api
36+
* brooklyn.location.named.canopy-TAI.identity=jo.blogs@myvorg_01
37+
* brooklyn.location.named.canopy-TAI.credential=pa55w0rd
38+
* brooklyn.location.named.canopy-TAI.trustStore=/Library/Java/JavaVirtualMachines/jdk1.7.0_71.jdk/Contents/Home/jre/lib/security/cacerts
39+
* brooklyn.location.named.canopy-TAI.trustStorePassword=changeit
40+
* </pre>
41+
*/
42+
public class SecureNatServiceLiveTest extends BrooklynAppLiveTestSupport {
43+
44+
//
45+
private static final String LOCATION_SPEC = "canopy-vCHS";
46+
47+
private static final String LOCATION_TAI_SPEC = "canopy-TAI";
48+
49+
protected JcloudsLocation loc;
50+
51+
protected ListeningExecutorService executor;
52+
53+
@BeforeMethod(alwaysRun=true)
54+
@Override
55+
public void setUp() throws Exception {
56+
super.setUp();
57+
loc = (JcloudsLocation) mgmt.getLocationRegistry().resolve(LOCATION_SPEC);
58+
59+
executor = MoreExecutors.listeningDecorator(Executors.newCachedThreadPool());
60+
}
61+
62+
@AfterMethod(alwaysRun=true)
63+
@Override
64+
public void tearDown() throws Exception {
65+
try {
66+
super.tearDown();
67+
} finally {
68+
executor.shutdownNow();
69+
}
70+
}
71+
72+
// TAI (as at 2014-12-16) is running vcloud-director version 5.1
73+
@Test(groups="Live")
74+
public void testGetNatRulesAtTai() throws Exception {
75+
loc = (JcloudsLocation) mgmt.getLocationRegistry().resolve(LOCATION_TAI_SPEC);
76+
NatService service = newServiceBuilder(loc).build();
77+
List<NatRuleType> rules = service.getNatRules(service.getEdgeGateway());
78+
assertNotNull(rules);
79+
}
80+
81+
// Simple test that just checks no errors (e.g. can authenticate etc)
82+
@Test(groups="Live")
83+
public void testGetNatRules() throws Exception {
84+
NatService service = newServiceBuilder(loc).build();
85+
List<NatRuleType> rules = service.getNatRules(service.getEdgeGateway());
86+
assertNotNull(rules);
87+
}
88+
89+
private NatService.Builder newServiceBuilder(JcloudsLocation loc) {
90+
String endpoint = loc.getEndpoint();
91+
92+
// jclouds endpoint has suffix "/api"; but VMware SDK wants it without "api"
93+
String convertedUri;
94+
try {
95+
URI uri = URI.create(endpoint);
96+
convertedUri = new URI(uri.getScheme(), uri.getUserInfo(), uri.getHost(), uri.getPort(), null, null, null).toString();
97+
} catch (URISyntaxException e) {
98+
throw Exceptions.propagate(e);
99+
}
100+
101+
String trustStore = (String) loc.getAllConfigBag().getStringKey("trustStore");
102+
String trustStorePassword = (String) loc.getAllConfigBag().getStringKey("trustStorePassword");
103+
104+
return NatService.builder()
105+
.identity(loc.getIdentity())
106+
.credential(loc.getCredential())
107+
.endpoint(convertedUri)
108+
.trustStore(trustStore)
109+
.trustStorePassword(trustStorePassword);
110+
}
111+
}

0 commit comments

Comments
 (0)