Examples with X509TrustManagerResolver com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver used on opensource projects

Example 1 with X509TrustManagerResolver

use of com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver in project photon-model by vmware.

the class CertificateUtil method resolveCertificate.

public static X509TrustManagerResolver resolveCertificate(URI uri, Proxy proxy, String proxyUsername, String proxyPassword, long timeoutMillis) {
    logger.entering(logger.getName(), "resolveCertificate");
    X509TrustManagerResolver trustManagerResolver = new X509TrustManagerResolver();
    SSLContext sslContext;
    try {
        sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, new TrustManager[] { trustManagerResolver }, null);
    } catch (KeyManagementException | NoSuchAlgorithmException e) {
        logger.throwing(logger.getName(), "connect", e);
        throw new LocalizableValidationException(e, "Failed to initialize SSL context.", "security.certificate.context.init.error");
    }
    String hostAddress = uri.getHost();
    int port = uri.getPort() == -1 ? DEFAULT_SECURE_CONNECTION_PORT : uri.getPort();
    String uriScheme = uri.getScheme();
    String host = String.format("%s://%s:%d", uriScheme, hostAddress, port);
    try {
        SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
        if (proxy != null && proxy.type() == Type.HTTP && proxyUsername != null && UriUtils.HTTPS_SCHEME.equalsIgnoreCase(uriScheme)) {
            URL url = uri.toURL();
            handleCertForHttpsThroughHttpProxyWithAuth(url, proxy, proxyUsername, proxyPassword, timeoutMillis, sslSocketFactory);
        } else {
            SSLSocket sslSocket;
            if (proxy != null) {
                if (proxyUsername != null) {
                    throw new LocalizableValidationException("Proxy authentication supported " + "for HTTPS URI through HTTP Proxy only." + " URI: " + uri.toASCIIString() + ", Proxy: " + proxy.toString(), "security.certificate.proxy.authentication.not.supported.error", uri.toASCIIString(), proxy.toString());
                }
                Socket tunnel = new Socket(proxy);
                tunnel.connect(new InetSocketAddress(hostAddress, port), (int) timeoutMillis);
                sslSocket = (SSLSocket) sslSocketFactory.createSocket(tunnel, hostAddress, port, true);
            } else {
                sslSocket = (SSLSocket) sslSocketFactory.createSocket();
                if (SSL_CONNECT_USE_SNI) {
                    SNIHostName serverName = new SNIHostName(hostAddress);
                    List<SNIServerName> serverNames = new ArrayList<>(1);
                    serverNames.add(serverName);
                    SSLParameters params = sslSocket.getSSLParameters();
                    params.setServerNames(serverNames);
                    sslSocket.setSSLParameters(params);
                }
                sslSocket.connect(new InetSocketAddress(hostAddress, port), (int) timeoutMillis);
            }
            SSLSession session = sslSocket.getSession();
            session.invalidate();
        }
    } catch (IOException e) {
        try {
            if (trustManagerResolver.isCertsTrusted() || trustManagerResolver.getCertificateChain().length == 0) {
                Utils.logWarning("Exception while resolving certificate for host: [%s]. Error: %s ", host, e.getMessage());
            } else {
                logger.throwing(logger.getName(), "connect", e);
                throw new IllegalArgumentException(e.getMessage(), e);
            }
        } catch (IllegalStateException ise) {
            throw new LocalizableValidationException(e, String.format("Cannot connect to host: [%s]. Error: %s", host, e.getMessage()), "security.certificate.connection.error", host, e.getMessage());
        }
    }
    if (trustManagerResolver.getCertificateChain().length == 0) {
        LocalizableValidationException e = new LocalizableValidationException("Check ssl certificate failed for server: " + host, "security.certificate.check.error", host);
        logger.throwing(logger.getName(), "connect", e);
        throw e;
    }
    logger.exiting(logger.getName(), "resolveCertificate");
    return trustManagerResolver;
}

Example 2 with X509TrustManagerResolver

use of com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver in project photon-model by vmware.

the class ResolveCertificateUtil method assertUntrustedCert.

private void assertUntrustedCert(String uri) {
    X509TrustManagerResolver trustManagerResolver = CertificateUtil.resolveCertificate(URI.create(uri), 5000L);
    assertTrustManagerResolver(uri, trustManagerResolver);
}

Example 3 with X509TrustManagerResolver

use of com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver in project photon-model by vmware.

the class BaseVSphereAdapterTest method setUp.

@Before
public void setUp() throws Throwable {
    this.host = VerificationHost.create(Integer.getInteger(TestProperties.HOST_PREFERRED_PORT, 0));
    String bindingAddress = System.getProperty(TestProperties.HOST_BINDING_ADDRESS);
    if (!StringUtils.isEmpty(bindingAddress)) {
        this.host.setBindAddress(bindingAddress);
    }
    this.host.start();
    this.host.waitForServiceAvailable(ExampleService.FACTORY_LINK);
    // TODO: VSYM-992 - improve test/fix arbitrary timeout
    // must be at least 15min as default timeout to get an IP is 10min
    this.host.setTimeoutSeconds(15 * 60);
    try {
        PhotonModelAdaptersRegistryAdapters.startServices(this.host);
        PhotonModelServices.startServices(this.host);
        PhotonModelMetricServices.startServices(this.host);
        PhotonModelTaskServices.startServices(this.host);
        PhotonModelSecurityServices.startServices(this.host);
        this.host.waitForServiceAvailable(PhotonModelServices.LINKS);
        this.host.waitForServiceAvailable(PhotonModelTaskServices.LINKS);
        this.host.waitForServiceAvailable(PhotonModelSecurityServices.LINKS);
        startAdditionalServices();
        ServerX509TrustManager.create(this.host);
    } catch (Throwable e) {
        this.host.log("Error starting up services for the test %s", e.getMessage());
        throw new Exception(e);
    }
    if (this.vcUrl == null) {
        this.vcUrl = "http://not-configured";
    } else {
        X509TrustManagerResolver resolver = CertificateUtil.resolveCertificate(URI.create(this.vcUrl), 20000);
        if (!resolver.isCertsTrusted()) {
            SslTrustCertificateState certState = new SslTrustCertificateState();
            certState.certificate = CertificateUtil.toPEMformat(resolver.getCertificate());
            SslTrustCertificateState.populateCertificateProperties(certState, resolver.getCertificate());
            Operation op = Operation.createPost(this.host, SslTrustCertificateService.FACTORY_LINK).setReferer(this.host.getReferer()).setBody(certState);
            this.host.waitForResponse(op);
        }
    }
    if (this.dataStoreId != null) {
        this.dataStoreId = this.dataStoreId.substring(this.dataStoreId.lastIndexOf("/") + 1, this.dataStoreId.length());
    }
    doSetup();
}

Example 4 with X509TrustManagerResolver

use of com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver in project photon-model by vmware.

the class ResolveCertificateUtil method resolveSelfSignedBehindHttpProxy.

@Test
public void resolveSelfSignedBehindHttpProxy() {
    String uri = "https://self-signed.badssl.com/";
    X509TrustManagerResolver resolver = CertificateUtil.resolveCertificate(URI.create(uri), new Proxy(Type.HTTP, new InetSocketAddress("proxy.vmware.com", 3128)), null, null, 5000L);
    assertTrustManagerResolver(uri, resolver);
}

Example 5 with X509TrustManagerResolver

use of com.vmware.photon.controller.model.security.ssl.X509TrustManagerResolver in project photon-model by vmware.

the class ResolveCertificateUtil method resolveSelfSignedBehindSocksProxy_neg.

@Test(expected = LocalizableValidationException.class)
public void resolveSelfSignedBehindSocksProxy_neg() {
    String uri = "https://self-signed.badssl.com/";
    X509TrustManagerResolver resolver = CertificateUtil.resolveCertificate(URI.create(uri), new Proxy(Type.SOCKS, new InetSocketAddress("proxy.vmware.com", 3128)), "user", "pass", 5000L);
    assertTrustManagerResolver(uri, resolver);
}