Examples with SecurityConfig com.couchbase.client.core.env.SecurityConfig used on opensource projects

Example 1 with SecurityConfig

use of com.couchbase.client.core.env.SecurityConfig in project spring-boot by spring-projects.

the class CouchbaseAutoConfigurationTests method enableSslNoEnabledFlag.

@Test
void enableSslNoEnabledFlag() {
    testClusterEnvironment((env) -> {
        SecurityConfig securityConfig = env.securityConfig();
        assertThat(securityConfig.tlsEnabled()).isTrue();
        assertThat(securityConfig.trustManagerFactory()).isNotNull();
    }, "spring.couchbase.env.ssl.keyStore=classpath:test.jks", "spring.couchbase.env.ssl.keyStorePassword=secret");
}

Example 2 with SecurityConfig

use of com.couchbase.client.core.env.SecurityConfig in project spring-boot by spring-projects.

the class CouchbaseAutoConfigurationTests method disableSslEvenWithKeyStore.

@Test
void disableSslEvenWithKeyStore() {
    testClusterEnvironment((env) -> {
        SecurityConfig securityConfig = env.securityConfig();
        assertThat(securityConfig.tlsEnabled()).isFalse();
        assertThat(securityConfig.trustManagerFactory()).isNull();
    }, "spring.couchbase.env.ssl.enabled=false", "spring.couchbase.env.ssl.keyStore=classpath:test.jks", "spring.couchbase.env.ssl.keyStorePassword=secret");
}

Example 3 with SecurityConfig

use of com.couchbase.client.core.env.SecurityConfig in project couchbase-jdbc-driver by couchbaselabs.

the class ConnectionManager method clusterForCoordinate.

private Cluster clusterForCoordinate(final ConnectionCoordinate coordinate) {
    synchronized (this) {
        if (environment == null) {
            // This logger config makes sure the SDK also uses java.util.Logging.
            LoggerConfig.Builder loggerConfig = LoggerConfig.builder().disableSlf4J(true).fallbackToConsole(false);
            SecurityConfig.Builder securityConfig = SecurityConfig.builder();
            if (Boolean.parseBoolean(CouchbaseDriverProperty.SSL.get(coordinate.properties()))) {
                securityConfig = securityConfig.enableTls(true);
                if ("no-verify".equals(CouchbaseDriverProperty.SSL_MODE.get(coordinate.properties()))) {
                    securityConfig = securityConfig.trustManagerFactory(InsecureTrustManagerFactory.INSTANCE);
                } else {
                    if ("verify-ca".equals(CouchbaseDriverProperty.SSL_MODE.get(coordinate.properties()))) {
                        securityConfig = securityConfig.enableHostnameVerification(false);
                    }
                    String certPath = CouchbaseDriverProperty.SSL_CERT_PATH.get(coordinate.properties());
                    if (!isNullOrEmpty(certPath)) {
                        securityConfig.trustCertificate(Paths.get(certPath));
                    }
                    String keyStorePath = CouchbaseDriverProperty.SSL_KEYSTORE_PATH.get(coordinate.properties());
                    if (!isNullOrEmpty(keyStorePath)) {
                        String keyStorePassword = CouchbaseDriverProperty.SSL_KEYSTORE_PASSWORD.get(coordinate.properties());
                        if (isNull(keyStorePassword)) {
                            throw new IllegalArgumentException("If a keystore is provided, the password also needs to be provided");
                        }
                        securityConfig.trustStore(Paths.get(keyStorePath), keyStorePassword, Optional.empty());
                    }
                }
            }
            environment = ClusterEnvironment.builder().load((PropertyLoader<CoreEnvironment.Builder>) builder -> new SystemPropertyPropertyLoader(coordinate.properties()).load(builder)).loggerConfig(loggerConfig).securityConfig(securityConfig).retryStrategy(new InterceptingRetryStrategy()).build();
        }
        long newHandleCount = openHandles.compute(coordinate, (k, v) -> {
            if (v == null) {
                return 1L;
            } else {
                return v + 1;
            }
        });
        LOGGER.fine("Incrementing Handle Count to " + newHandleCount + " for Coordinate " + coordinate);
        return clusterCache.computeIfAbsent(coordinate, s -> {
            Cluster c = Cluster.connect(coordinate.connectionString(), clusterOptions(coordinate.authenticator()).environment(environment));
            maybeWaitUntilReady(coordinate, c);
            return c;
        });
    }
}

Example 4 with SecurityConfig

use of com.couchbase.client.core.env.SecurityConfig in project couchbase-jvm-clients by couchbase.

the class BaseEndpoint method reconnect.

/**
 * This method performs the actual connecting logic.
 *
 * <p>It is called reconnect since it works both in the case where an initial attempt is made
 * but also when the underlying channel is closed or the previous connect attempt was
 * unsuccessful.</p>
 */
private void reconnect() {
    if (disconnect.get()) {
        return;
    }
    state.transition(EndpointState.CONNECTING);
    final EndpointContext endpointContext = this.endpointContext.get();
    final AtomicLong attemptStart = new AtomicLong();
    Mono.defer((Supplier<Mono<Channel>>) () -> {
        CoreEnvironment env = endpointContext.environment();
        long connectTimeoutMs = env.timeoutConfig().connectTimeout().toMillis();
        if (eventLoopGroup.isShutdown()) {
            throw new IllegalStateException("Event Loop is already shut down, not pursuing connect attempt!");
        }
        final Bootstrap channelBootstrap = new Bootstrap().remoteAddress(remoteAddress()).group(eventLoopGroup).channel(channelFrom(eventLoopGroup)).option(ChannelOption.CONNECT_TIMEOUT_MILLIS, (int) connectTimeoutMs).handler(new ChannelInitializer<Channel>() {

            @Override
            protected void initChannel(final Channel ch) {
                ChannelPipeline pipeline = ch.pipeline();
                SecurityConfig config = env.securityConfig();
                if (config.tlsEnabled()) {
                    try {
                        pipeline.addFirst(SslHandlerFactory.get(ch.alloc(), config, endpointContext));
                    } catch (Exception e) {
                        throw new SecurityException("Could not instantiate SSL Handler", e);
                    }
                }
                if (env.ioConfig().servicesToCapture().contains(serviceType)) {
                    pipeline.addLast(new TrafficCaptureHandler(endpointContext));
                }
                pipelineInitializer().init(BaseEndpoint.this, pipeline);
                pipeline.addLast(new PipelineErrorHandler(BaseEndpoint.this));
            }
        });
        if (env.ioConfig().tcpKeepAlivesEnabled() && !(eventLoopGroup instanceof DefaultEventLoopGroup)) {
            channelBootstrap.option(ChannelOption.SO_KEEPALIVE, true);
            if (eventLoopGroup instanceof EpollEventLoopGroup) {
                channelBootstrap.option(EpollChannelOption.TCP_KEEPIDLE, (int) TimeUnit.MILLISECONDS.toSeconds(env.ioConfig().tcpKeepAliveTime().toMillis()));
            }
        }
        state.transition(EndpointState.CONNECTING);
        attemptStart.set(System.nanoTime());
        return channelFutureIntoMono(channelBootstrap.connect());
    }).timeout(endpointContext.environment().timeoutConfig().connectTimeout()).onErrorResume(throwable -> {
        state.transition(EndpointState.DISCONNECTED);
        if (disconnect.get()) {
            endpointContext.environment().eventBus().publish(new EndpointConnectionAbortedEvent(Duration.ofNanos(System.nanoTime() - attemptStart.get()), endpointContext, ConnectTimings.toMap(channel)));
            return Mono.empty();
        } else {
            return Mono.error(throwable);
        }
    }).retryWhen(Retry.any().exponentialBackoff(Duration.ofMillis(32), Duration.ofMillis(4096)).retryMax(Long.MAX_VALUE).doOnRetry(retryContext -> {
        Throwable ex = retryContext.exception();
        // We drop the severity for the BucketNotFoundException because it shows up when
        // bootstrapping against MDS clusters and nodes with no kv service enabled on it
        // that is bucket aware. If a bucket really does not exist we'll get an auth
        // exception instead.
        Event.Severity severity = ex instanceof BucketNotFoundException ? Event.Severity.DEBUG : Event.Severity.WARN;
        Duration duration = ex instanceof TimeoutException ? endpointContext.environment().timeoutConfig().connectTimeout() : Duration.ofNanos(System.nanoTime() - attemptStart.get());
        ex = annotateConnectException(ex);
        endpointContext.environment().eventBus().publish(new EndpointConnectionFailedEvent(severity, duration, endpointContext, retryContext.iteration(), trimNettyFromStackTrace(ex)));
    }).toReactorRetry()).subscribe(channel -> {
        long now = System.nanoTime();
        if (disconnect.get()) {
            this.channel = null;
            endpointContext.environment().eventBus().publish(new EndpointConnectionIgnoredEvent(Duration.ofNanos(now - attemptStart.get()), endpointContext, ConnectTimings.toMap(channel)));
            closeChannel(channel);
        } else {
            this.channel = channel;
            Optional<HostAndPort> localSocket = Optional.empty();
            if (channel.localAddress() instanceof InetSocketAddress) {
                // it will always be an inet socket address, but to safeguard for testing mocks...
                InetSocketAddress so = (InetSocketAddress) channel.localAddress();
                localSocket = Optional.of(new HostAndPort(so.getHostString(), so.getPort()));
            }
            EndpointContext newContext = new EndpointContext(endpointContext, endpointContext.remoteSocket(), endpointContext.circuitBreaker(), endpointContext.serviceType(), localSocket, endpointContext.bucket(), Optional.ofNullable(channel.attr(ChannelAttributes.CHANNEL_ID_KEY).get()));
            this.endpointContext.get().environment().eventBus().publish(new EndpointConnectedEvent(Duration.ofNanos(now - attemptStart.get()), newContext, ConnectTimings.toMap(channel)));
            this.endpointContext.set(newContext);
            this.circuitBreaker.reset();
            lastConnectedAt = now;
            state.transition(EndpointState.CONNECTED);
        }
    }, error -> endpointContext.environment().eventBus().publish(new UnexpectedEndpointConnectionFailedEvent(Duration.ofNanos(System.nanoTime() - attemptStart.get()), endpointContext, error)));
}