Examples with SecureRequestCustomizer org.eclipse.jetty.server.SecureRequestCustomizer used on opensource projects

Example 61 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project lucene-solr by apache.

the class ReplicatorTestCase method newHttpServer.

/**
   * Returns a new {@link Server HTTP Server} instance. To obtain its port, use
   * {@link #serverPort(Server)}.
   */
public static synchronized Server newHttpServer(Handler handler) throws Exception {
    // if this property is true, then jetty will be configured to use SSL
    // leveraging the same system properties as java to specify
    // the keystore/truststore if they are set
    //
    // This means we will use the same truststore, keystore (and keys) for
    // the server as well as any client actions taken by this JVM in
    // talking to that server, but for the purposes of testing that should 
    // be good enough
    final boolean useSsl = Boolean.getBoolean("tests.jettySsl");
    final SslContextFactory sslcontext = new SslContextFactory(false);
    if (useSsl) {
        if (null != System.getProperty("javax.net.ssl.keyStore")) {
            sslcontext.setKeyStorePath(System.getProperty("javax.net.ssl.keyStore"));
        }
        if (null != System.getProperty("javax.net.ssl.keyStorePassword")) {
            sslcontext.setKeyStorePassword(System.getProperty("javax.net.ssl.keyStorePassword"));
        }
        if (null != System.getProperty("javax.net.ssl.trustStore")) {
            sslcontext.setKeyStorePath(System.getProperty("javax.net.ssl.trustStore"));
        }
        if (null != System.getProperty("javax.net.ssl.trustStorePassword")) {
            sslcontext.setTrustStorePassword(System.getProperty("javax.net.ssl.trustStorePassword"));
        }
        sslcontext.setNeedClientAuth(Boolean.getBoolean("tests.jettySsl.clientAuth"));
    }
    final QueuedThreadPool threadPool = new QueuedThreadPool();
    threadPool.setDaemon(true);
    threadPool.setMaxThreads(10000);
    threadPool.setIdleTimeout(5000);
    threadPool.setStopTimeout(30000);
    Server server = new Server(threadPool);
    server.setStopAtShutdown(true);
    server.manage(threadPool);
    final ServerConnector connector;
    if (useSsl) {
        HttpConfiguration configuration = new HttpConfiguration();
        configuration.setSecureScheme("https");
        configuration.addCustomizer(new SecureRequestCustomizer());
        ServerConnector c = new ServerConnector(server, new SslConnectionFactory(sslcontext, "http/1.1"), new HttpConnectionFactory(configuration));
        connector = c;
    } else {
        ServerConnector c = new ServerConnector(server, new HttpConnectionFactory());
        connector = c;
    }
    connector.setPort(0);
    connector.setHost("127.0.0.1");
    server.setConnectors(new Connector[] { connector });
    server.setSessionIdManager(new HashSessionIdManager(new Random(random().nextLong())));
    server.setHandler(handler);
    server.start();
    return server;
}

Example 62 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project lucene-solr by apache.

the class JettySolrRunner method init.

private void init(int port) {
    QueuedThreadPool qtp = new QueuedThreadPool();
    qtp.setMaxThreads(THREAD_POOL_MAX_THREADS);
    qtp.setIdleTimeout(THREAD_POOL_MAX_IDLE_TIME_MS);
    qtp.setStopTimeout((int) TimeUnit.MINUTES.toMillis(1));
    server = new Server(qtp);
    server.manage(qtp);
    server.setStopAtShutdown(config.stopAtShutdown);
    if (System.getProperty("jetty.testMode") != null) {
        // if this property is true, then jetty will be configured to use SSL
        // leveraging the same system properties as java to specify
        // the keystore/truststore if they are set unless specific config
        // is passed via the constructor.
        //
        // This means we will use the same truststore, keystore (and keys) for
        // the server as well as any client actions taken by this JVM in
        // talking to that server, but for the purposes of testing that should 
        // be good enough
        final SslContextFactory sslcontext = SSLConfig.createContextFactory(config.sslConfig);
        ServerConnector connector;
        if (sslcontext != null) {
            HttpConfiguration configuration = new HttpConfiguration();
            configuration.setSecureScheme("https");
            configuration.addCustomizer(new SecureRequestCustomizer());
            connector = new ServerConnector(server, new SslConnectionFactory(sslcontext, "http/1.1"), new HttpConnectionFactory(configuration));
        } else {
            connector = new ServerConnector(server, new HttpConnectionFactory());
        }
        connector.setReuseAddress(true);
        connector.setSoLingerTime(-1);
        connector.setPort(port);
        connector.setHost("127.0.0.1");
        connector.setIdleTimeout(THREAD_POOL_MAX_IDLE_TIME_MS);
        server.setConnectors(new Connector[] { connector });
        server.setSessionIdManager(new HashSessionIdManager(new Random()));
    } else {
        ServerConnector connector = new ServerConnector(server, new HttpConnectionFactory());
        connector.setPort(port);
        connector.setSoLingerTime(-1);
        connector.setIdleTimeout(THREAD_POOL_MAX_IDLE_TIME_MS);
        server.setConnectors(new Connector[] { connector });
    }
    // Initialize the servlets
    final ServletContextHandler root = new ServletContextHandler(server, config.context, ServletContextHandler.SESSIONS);
    server.addLifeCycleListener(new LifeCycle.Listener() {

        @Override
        public void lifeCycleStopping(LifeCycle arg0) {
        }

        @Override
        public void lifeCycleStopped(LifeCycle arg0) {
        }

        @Override
        public void lifeCycleStarting(LifeCycle arg0) {
            synchronized (JettySolrRunner.this) {
                waitOnSolr = true;
                JettySolrRunner.this.notify();
            }
        }

        @Override
        public void lifeCycleStarted(LifeCycle arg0) {
            lastPort = getFirstConnectorPort();
            nodeProperties.setProperty("hostPort", Integer.toString(lastPort));
            nodeProperties.setProperty("hostContext", config.context);
            root.getServletContext().setAttribute(SolrDispatchFilter.PROPERTIES_ATTRIBUTE, nodeProperties);
            root.getServletContext().setAttribute(SolrDispatchFilter.SOLRHOME_ATTRIBUTE, solrHome);
            logger.info("Jetty properties: {}", nodeProperties);
            debugFilter = root.addFilter(DebugFilter.class, "*", EnumSet.of(DispatcherType.REQUEST));
            extraFilters = new LinkedList<>();
            for (Class<? extends Filter> filterClass : config.extraFilters.keySet()) {
                extraFilters.add(root.addFilter(filterClass, config.extraFilters.get(filterClass), EnumSet.of(DispatcherType.REQUEST)));
            }
            for (ServletHolder servletHolder : config.extraServlets.keySet()) {
                String pathSpec = config.extraServlets.get(servletHolder);
                root.addServlet(servletHolder, pathSpec);
            }
            dispatchFilter = root.getServletHandler().newFilterHolder(BaseHolder.Source.EMBEDDED);
            dispatchFilter.setHeldClass(SolrDispatchFilter.class);
            dispatchFilter.setInitParameter("excludePatterns", excludePatterns);
            root.addFilter(dispatchFilter, "*", EnumSet.of(DispatcherType.REQUEST));
        }

        @Override
        public void lifeCycleFailure(LifeCycle arg0, Throwable arg1) {
            System.clearProperty("hostPort");
        }
    });
    // for some reason, there must be a servlet for this to get applied
    root.addServlet(Servlet404.class, "/*");
    GzipHandler gzipHandler = new GzipHandler();
    gzipHandler.setHandler(root);
    gzipHandler.setMinGzipSize(0);
    gzipHandler.setCheckGzExists(false);
    gzipHandler.setCompressionLevel(-1);
    gzipHandler.setExcludedAgentPatterns(".*MSIE.6\\.0.*");
    gzipHandler.setIncludedMethods("GET");
    server.setHandler(gzipHandler);
}

Example 63 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project nifi by apache.

the class HandleHttpRequest method initializeServer.

private synchronized void initializeServer(final ProcessContext context) throws Exception {
    if (initialized.get()) {
        return;
    }
    this.containerQueue = new LinkedBlockingQueue<>(context.getProperty(CONTAINER_QUEUE_SIZE).asInteger());
    final String host = context.getProperty(HOSTNAME).getValue();
    final int port = context.getProperty(PORT).asInteger();
    final SSLContextService sslService = context.getProperty(SSL_CONTEXT).asControllerService(SSLContextService.class);
    final HttpContextMap httpContextMap = context.getProperty(HTTP_CONTEXT_MAP).asControllerService(HttpContextMap.class);
    final long requestTimeout = httpContextMap.getRequestTimeout(TimeUnit.MILLISECONDS);
    final String clientAuthValue = context.getProperty(CLIENT_AUTH).getValue();
    final boolean need;
    final boolean want;
    if (CLIENT_NEED.equals(clientAuthValue)) {
        need = true;
        want = false;
    } else if (CLIENT_WANT.equals(clientAuthValue)) {
        need = false;
        want = true;
    } else {
        need = false;
        want = false;
    }
    final SslContextFactory sslFactory = (sslService == null) ? null : createSslFactory(sslService, need, want);
    final Server server = new Server(port);
    // create the http configuration
    final HttpConfiguration httpConfiguration = new HttpConfiguration();
    if (sslFactory == null) {
        // create the connector
        final ServerConnector http = new ServerConnector(server, new HttpConnectionFactory(httpConfiguration));
        // set host and port
        if (StringUtils.isNotBlank(host)) {
            http.setHost(host);
        }
        http.setPort(port);
        // add this connector
        server.setConnectors(new Connector[] { http });
    } else {
        // add some secure config
        final HttpConfiguration httpsConfiguration = new HttpConfiguration(httpConfiguration);
        httpsConfiguration.setSecureScheme("https");
        httpsConfiguration.setSecurePort(port);
        httpsConfiguration.addCustomizer(new SecureRequestCustomizer());
        // build the connector
        final ServerConnector https = new ServerConnector(server, new SslConnectionFactory(sslFactory, "http/1.1"), new HttpConnectionFactory(httpsConfiguration));
        // set host and port
        if (StringUtils.isNotBlank(host)) {
            https.setHost(host);
        }
        https.setPort(port);
        // add this connector
        server.setConnectors(new Connector[] { https });
    }
    final Set<String> allowedMethods = new HashSet<>();
    if (context.getProperty(ALLOW_GET).asBoolean()) {
        allowedMethods.add("GET");
    }
    if (context.getProperty(ALLOW_POST).asBoolean()) {
        allowedMethods.add("POST");
    }
    if (context.getProperty(ALLOW_PUT).asBoolean()) {
        allowedMethods.add("PUT");
    }
    if (context.getProperty(ALLOW_DELETE).asBoolean()) {
        allowedMethods.add("DELETE");
    }
    if (context.getProperty(ALLOW_HEAD).asBoolean()) {
        allowedMethods.add("HEAD");
    }
    if (context.getProperty(ALLOW_OPTIONS).asBoolean()) {
        allowedMethods.add("OPTIONS");
    }
    final String additionalMethods = context.getProperty(ADDITIONAL_METHODS).getValue();
    if (additionalMethods != null) {
        for (final String additionalMethod : additionalMethods.split(",")) {
            final String trimmed = additionalMethod.trim();
            if (!trimmed.isEmpty()) {
                allowedMethods.add(trimmed.toUpperCase());
            }
        }
    }
    final String pathRegex = context.getProperty(PATH_REGEX).getValue();
    final Pattern pathPattern = (pathRegex == null) ? null : Pattern.compile(pathRegex);
    server.setHandler(new AbstractHandler() {

        @Override
        public void handle(final String target, final Request baseRequest, final HttpServletRequest request, final HttpServletResponse response) throws IOException, ServletException {
            final String requestUri = request.getRequestURI();
            if (!allowedMethods.contains(request.getMethod().toUpperCase())) {
                getLogger().info("Sending back METHOD_NOT_ALLOWED response to {}; method was {}; request URI was {}", new Object[] { request.getRemoteAddr(), request.getMethod(), requestUri });
                response.sendError(Status.METHOD_NOT_ALLOWED.getStatusCode());
                return;
            }
            if (pathPattern != null) {
                final URI uri;
                try {
                    uri = new URI(requestUri);
                } catch (final URISyntaxException e) {
                    throw new ServletException(e);
                }
                if (!pathPattern.matcher(uri.getPath()).matches()) {
                    response.sendError(Status.NOT_FOUND.getStatusCode());
                    getLogger().info("Sending back NOT_FOUND response to {}; request was {} {}", new Object[] { request.getRemoteAddr(), request.getMethod(), requestUri });
                    return;
                }
            }
            // If destination queues full, send back a 503: Service Unavailable.
            if (context.getAvailableRelationships().isEmpty()) {
                response.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
                return;
            }
            // Right now, that information, though, is only in the ProcessSession, not the ProcessContext,
            // so it is not known to us. Should see if it can be added to the ProcessContext.
            final AsyncContext async = baseRequest.startAsync();
            async.setTimeout(requestTimeout);
            final boolean added = containerQueue.offer(new HttpRequestContainer(request, response, async));
            if (added) {
                getLogger().debug("Added Http Request to queue for {} {} from {}", new Object[] { request.getMethod(), requestUri, request.getRemoteAddr() });
            } else {
                getLogger().info("Sending back a SERVICE_UNAVAILABLE response to {}; request was {} {}", new Object[] { request.getRemoteAddr(), request.getMethod(), request.getRemoteAddr() });
                response.sendError(Status.SERVICE_UNAVAILABLE.getStatusCode());
                response.flushBuffer();
                async.complete();
            }
        }
    });
    this.server = server;
    server.start();
    getLogger().info("Server started and listening on port " + getPort());
    initialized.set(true);
}

Example 64 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project nifi by apache.

the class ListenHTTP method createHttpServerFromService.

private void createHttpServerFromService(final ProcessContext context) throws Exception {
    final String basePath = context.getProperty(BASE_PATH).evaluateAttributeExpressions().getValue();
    final SSLContextService sslContextService = context.getProperty(SSL_CONTEXT_SERVICE).asControllerService(SSLContextService.class);
    final Double maxBytesPerSecond = context.getProperty(MAX_DATA_RATE).asDataSize(DataUnit.B);
    final StreamThrottler streamThrottler = (maxBytesPerSecond == null) ? null : new LeakyBucketStreamThrottler(maxBytesPerSecond.intValue());
    final int returnCode = context.getProperty(RETURN_CODE).asInteger();
    throttlerRef.set(streamThrottler);
    final boolean needClientAuth = sslContextService != null && sslContextService.getTrustStoreFile() != null;
    final SslContextFactory contextFactory = new SslContextFactory();
    contextFactory.setNeedClientAuth(needClientAuth);
    if (needClientAuth) {
        contextFactory.setTrustStorePath(sslContextService.getTrustStoreFile());
        contextFactory.setTrustStoreType(sslContextService.getTrustStoreType());
        contextFactory.setTrustStorePassword(sslContextService.getTrustStorePassword());
    }
    final String keystorePath = sslContextService == null ? null : sslContextService.getKeyStoreFile();
    if (keystorePath != null) {
        final String keystorePassword = sslContextService.getKeyStorePassword();
        final String keyStoreType = sslContextService.getKeyStoreType();
        contextFactory.setKeyStorePath(keystorePath);
        contextFactory.setKeyManagerPassword(keystorePassword);
        contextFactory.setKeyStorePassword(keystorePassword);
        contextFactory.setKeyStoreType(keyStoreType);
    }
    if (sslContextService != null) {
        contextFactory.setProtocol(sslContextService.getSslAlgorithm());
    }
    // thread pool for the jetty instance
    final QueuedThreadPool threadPool = new QueuedThreadPool();
    threadPool.setName(String.format("%s (%s) Web Server", getClass().getSimpleName(), getIdentifier()));
    // create the server instance
    final Server server = new Server(threadPool);
    // get the configured port
    final int port = context.getProperty(PORT).evaluateAttributeExpressions().asInteger();
    final ServerConnector connector;
    final HttpConfiguration httpConfiguration = new HttpConfiguration();
    if (keystorePath == null) {
        // create the connector
        connector = new ServerConnector(server, new HttpConnectionFactory(httpConfiguration));
    } else {
        // configure the ssl connector
        httpConfiguration.setSecureScheme("https");
        httpConfiguration.setSecurePort(port);
        httpConfiguration.addCustomizer(new SecureRequestCustomizer());
        // build the connector
        connector = new ServerConnector(server, new SslConnectionFactory(contextFactory, "http/1.1"), new HttpConnectionFactory(httpConfiguration));
    }
    // configure the port
    connector.setPort(port);
    // add the connector to the server
    server.setConnectors(new Connector[] { connector });
    final ServletContextHandler contextHandler = new ServletContextHandler(server, "/", true, (keystorePath != null));
    for (final Class<? extends Servlet> cls : getServerClasses()) {
        final Path path = cls.getAnnotation(Path.class);
        // also, servlets other than ListenHttpServlet must have a path starting with /
        if (basePath.isEmpty() && !path.value().isEmpty()) {
            // Note: this is to handle the condition of an empty uri, otherwise pathSpec would start with //
            contextHandler.addServlet(cls, path.value());
        } else {
            contextHandler.addServlet(cls, "/" + basePath + path.value());
        }
    }
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_PROCESSOR, this);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_LOGGER, getLogger());
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_SESSION_FACTORY_HOLDER, sessionFactoryReference);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_PROCESS_CONTEXT_HOLDER, context);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_FLOWFILE_MAP, flowFileMap);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_AUTHORITY_PATTERN, Pattern.compile(context.getProperty(AUTHORIZED_DN_PATTERN).getValue()));
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_STREAM_THROTTLER, streamThrottler);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_BASE_PATH, basePath);
    contextHandler.setAttribute(CONTEXT_ATTRIBUTE_RETURN_CODE, returnCode);
    if (context.getProperty(HEADERS_AS_ATTRIBUTES_REGEX).isSet()) {
        contextHandler.setAttribute(CONTEXT_ATTRIBUTE_HEADER_PATTERN, Pattern.compile(context.getProperty(HEADERS_AS_ATTRIBUTES_REGEX).getValue()));
    }
    try {
        server.start();
    } catch (Exception e) {
        shutdownHttpServer(server);
        throw e;
    }
    this.server = server;
}

Example 65 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project nifi by apache.

the class TestHttpClient method setup.

@BeforeClass
public static void setup() throws Exception {
    // Create embedded Jetty server
    // Use less threads to mitigate Gateway Timeout (504) with proxy test
    // Minimum thread pool size = (acceptors=2 + selectors=8 + request=1), defaults to max=200
    final QueuedThreadPool threadPool = new QueuedThreadPool(50);
    server = new Server(threadPool);
    final ContextHandlerCollection handlerCollection = new ContextHandlerCollection();
    final ServletContextHandler contextHandler = new ServletContextHandler();
    contextHandler.setContextPath("/nifi-api");
    final ServletContextHandler wrongPathContextHandler = new ServletContextHandler();
    wrongPathContextHandler.setContextPath("/wrong/nifi-api");
    handlerCollection.setHandlers(new Handler[] { contextHandler, wrongPathContextHandler });
    server.setHandler(handlerCollection);
    final ServletHandler servletHandler = new ServletHandler();
    contextHandler.insertHandler(servletHandler);
    final ServletHandler wrongPathServletHandler = new ServletHandler();
    wrongPathContextHandler.insertHandler(wrongPathServletHandler);
    final SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStorePath("src/test/resources/certs/localhost-ks.jks");
    sslContextFactory.setKeyStorePassword("localtest");
    sslContextFactory.setKeyStoreType("JKS");
    httpConnector = new ServerConnector(server);
    final HttpConfiguration https = new HttpConfiguration();
    https.addCustomizer(new SecureRequestCustomizer());
    sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(https));
    server.setConnectors(new Connector[] { httpConnector, sslConnector });
    wrongPathServletHandler.addServletWithMapping(WrongSiteInfoServlet.class, "/site-to-site");
    servletHandler.addServletWithMapping(SiteInfoServlet.class, "/site-to-site");
    servletHandler.addServletWithMapping(PeersServlet.class, "/site-to-site/peers");
    servletHandler.addServletWithMapping(PortTransactionsAccessDeniedServlet.class, "/data-transfer/input-ports/input-access-denied-id/transactions");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/input-ports/input-running-id/transactions");
    servletHandler.addServletWithMapping(InputPortTransactionServlet.class, "/data-transfer/input-ports/input-running-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesServlet.class, "/data-transfer/input-ports/input-running-id/transactions/transaction-id/flow-files");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/input-ports/input-timeout-id/transactions");
    servletHandler.addServletWithMapping(InputPortTransactionServlet.class, "/data-transfer/input-ports/input-timeout-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesTimeoutServlet.class, "/data-transfer/input-ports/input-timeout-id/transactions/transaction-id/flow-files");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/input-ports/input-timeout-data-ex-id/transactions");
    servletHandler.addServletWithMapping(InputPortTransactionServlet.class, "/data-transfer/input-ports/input-timeout-data-ex-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesTimeoutAfterDataExchangeServlet.class, "/data-transfer/input-ports/input-timeout-data-ex-id/transactions/transaction-id/flow-files");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/output-ports/output-running-id/transactions");
    servletHandler.addServletWithMapping(OutputPortTransactionServlet.class, "/data-transfer/output-ports/output-running-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesServlet.class, "/data-transfer/output-ports/output-running-id/transactions/transaction-id/flow-files");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/output-ports/output-timeout-id/transactions");
    servletHandler.addServletWithMapping(OutputPortTransactionServlet.class, "/data-transfer/output-ports/output-timeout-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesTimeoutServlet.class, "/data-transfer/output-ports/output-timeout-id/transactions/transaction-id/flow-files");
    servletHandler.addServletWithMapping(PortTransactionsServlet.class, "/data-transfer/output-ports/output-timeout-data-ex-id/transactions");
    servletHandler.addServletWithMapping(OutputPortTransactionServlet.class, "/data-transfer/output-ports/output-timeout-data-ex-id/transactions/transaction-id");
    servletHandler.addServletWithMapping(FlowFilesTimeoutAfterDataExchangeServlet.class, "/data-transfer/output-ports/output-timeout-data-ex-id/transactions/transaction-id/flow-files");
    server.start();
    logger.info("Starting server on port {} for HTTP, and {} for HTTPS", httpConnector.getLocalPort(), sslConnector.getLocalPort());
    startProxyServer();
    startProxyServerWithAuth();
}