Examples with DFLT_KEY_ALGORITHM org.apache.ignite.ssl.SslContextFactory.DFLT_KEY_ALGORITHM used on opensource projects

Example 1 with DFLT_KEY_ALGORITHM

use of org.apache.ignite.ssl.SslContextFactory.DFLT_KEY_ALGORITHM in project ignite by apache.

the class SecurityTest method testEncryption.

/**
 * Test SSL/TLS encryption.
 */
@Test
public void testEncryption() throws Exception {
    // Server-side security configuration
    IgniteConfiguration srvCfg = Config.getServerConfiguration();
    SslContextFactory sslCfg = new SslContextFactory();
    Function<String, String> rsrcPath = rsrc -> Paths.get(IGNITE_HOME == null ? "." : IGNITE_HOME, "modules", "core", "src", "test", "resources", rsrc).toString();
    sslCfg.setKeyStoreFilePath(rsrcPath.apply("/server.jks"));
    sslCfg.setKeyStorePassword("123456".toCharArray());
    sslCfg.setTrustStoreFilePath(rsrcPath.apply("/trust.jks"));
    sslCfg.setTrustStorePassword("123456".toCharArray());
    srvCfg.setClientConnectorConfiguration(new ClientConnectorConfiguration().setSslEnabled(true).setSslClientAuth(true));
    srvCfg.setSslContextFactory(sslCfg);
    // Client-side security configuration
    ClientConfiguration clientCfg = new ClientConfiguration().setAddresses(Config.SERVER);
    try (Ignite ignored = Ignition.start(srvCfg)) {
        boolean failed;
        try (IgniteClient client = Ignition.startClient(clientCfg)) {
            client.<Integer, String>cache(Config.DEFAULT_CACHE_NAME).put(1, "1");
            failed = false;
        } catch (Exception ex) {
            failed = true;
        }
        assertTrue("Client connection without SSL must fail", failed);
        // Not using user-supplied SSL Context Factory:
        try (IgniteClient client = Ignition.startClient(clientCfg.setSslMode(SslMode.REQUIRED).setSslClientCertificateKeyStorePath(rsrcPath.apply("/client.jks")).setSslClientCertificateKeyStoreType(DFLT_STORE_TYPE).setSslClientCertificateKeyStorePassword("123456").setSslTrustCertificateKeyStorePath(rsrcPath.apply("/trust.jks")).setSslTrustCertificateKeyStoreType(DFLT_STORE_TYPE).setSslTrustCertificateKeyStorePassword("123456").setSslKeyAlgorithm(DFLT_KEY_ALGORITHM).setSslTrustAll(false).setSslProtocol(SslProtocol.TLS))) {
            client.<Integer, String>cache(Config.DEFAULT_CACHE_NAME).put(1, "1");
        }
        // Using user-supplied SSL Context Factory
        try (IgniteClient client = Ignition.startClient(clientCfg.setSslMode(SslMode.REQUIRED).setSslContextFactory(sslCfg))) {
            client.<Integer, String>cache(Config.DEFAULT_CACHE_NAME).put(1, "1");
        }
    }
}

Example 2 with DFLT_KEY_ALGORITHM

use of org.apache.ignite.ssl.SslContextFactory.DFLT_KEY_ALGORITHM in project ignite by apache.

the class ClientSslUtils method getSslContext.

/**
 * Gets SSL context for the given client configuration.
 *
 * @param cfg Configuration.
 * @return {@link SSLContext} when SSL is enabled in the configuration; null otherwise.
 */
public static SSLContext getSslContext(ClientConfiguration cfg) {
    if (cfg.getSslMode() == SslMode.DISABLED)
        return null;
    Factory<SSLContext> sslCtxFactory = cfg.getSslContextFactory();
    if (sslCtxFactory != null) {
        try {
            return sslCtxFactory.create();
        } catch (Exception e) {
            throw new ClientError("SSL Context Factory failed", e);
        }
    }
    BiFunction<String, String, String> or = (val, dflt) -> val == null || val.isEmpty() ? dflt : val;
    String keyStore = or.apply(cfg.getSslClientCertificateKeyStorePath(), System.getProperty("javax.net.ssl.keyStore"));
    String keyStoreType = or.apply(cfg.getSslClientCertificateKeyStoreType(), or.apply(System.getProperty("javax.net.ssl.keyStoreType"), DFLT_STORE_TYPE));
    String keyStorePwd = or.apply(cfg.getSslClientCertificateKeyStorePassword(), System.getProperty("javax.net.ssl.keyStorePassword"));
    String trustStore = or.apply(cfg.getSslTrustCertificateKeyStorePath(), System.getProperty("javax.net.ssl.trustStore"));
    String trustStoreType = or.apply(cfg.getSslTrustCertificateKeyStoreType(), or.apply(System.getProperty("javax.net.ssl.trustStoreType"), DFLT_STORE_TYPE));
    String trustStorePwd = or.apply(cfg.getSslTrustCertificateKeyStorePassword(), System.getProperty("javax.net.ssl.trustStorePassword"));
    String algorithm = or.apply(cfg.getSslKeyAlgorithm(), DFLT_KEY_ALGORITHM);
    String proto = toString(cfg.getSslProtocol());
    if (Stream.of(keyStore, keyStorePwd, keyStoreType, trustStore, trustStorePwd, trustStoreType).allMatch(s -> s == null || s.isEmpty())) {
        try {
            return SSLContext.getDefault();
        } catch (NoSuchAlgorithmException e) {
            throw new ClientError("Default SSL context cryptographic algorithm is not available", e);
        }
    }
    KeyManager[] keyManagers = getKeyManagers(algorithm, keyStore, keyStoreType, keyStorePwd);
    TrustManager[] trustManagers = cfg.isSslTrustAll() ? new TrustManager[] { ignoreErrorsTrustMgr } : getTrustManagers(algorithm, trustStore, trustStoreType, trustStorePwd);
    try {
        SSLContext sslCtx = SSLContext.getInstance(proto);
        sslCtx.init(keyManagers, trustManagers, null);
        return sslCtx;
    } catch (NoSuchAlgorithmException e) {
        throw new ClientError("SSL context cryptographic algorithm is not available", e);
    } catch (KeyManagementException e) {
        throw new ClientError("Failed to create SSL Context", e);
    }
}