Examples with SecureRequestCustomizer org.eclipse.jetty.server.SecureRequestCustomizer used on opensource projects

Example 76 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project storm by apache.

the class UIHelpers method mkSslConnector.

private static ServerConnector mkSslConnector(Server server, Integer port, String ksPath, String ksPassword, String ksType, String keyPassword, String tsPath, String tsPassword, String tsType, Boolean needClientAuth, Boolean wantClientAuth, Integer headerBufferSize, boolean enableSslReload) {
    SslContextFactory factory = new ReloadableSslContextFactory(enableSslReload);
    factory.setExcludeCipherSuites("SSL_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_SHA");
    factory.setExcludeProtocols("SSLv3");
    factory.setRenegotiationAllowed(false);
    factory.setKeyStorePath(ksPath);
    factory.setKeyStoreType(ksType);
    factory.setKeyStorePassword(ksPassword);
    factory.setKeyManagerPassword(keyPassword);
    if (tsPath != null && tsPassword != null && tsType != null) {
        factory.setTrustStorePath(tsPath);
        factory.setTrustStoreType(tsType);
        factory.setTrustStorePassword(tsPassword);
    }
    if (needClientAuth != null && needClientAuth) {
        factory.setNeedClientAuth(true);
    } else if (wantClientAuth != null && wantClientAuth) {
        factory.setWantClientAuth(true);
    }
    HttpConfiguration httpsConfig = new HttpConfiguration();
    httpsConfig.addCustomizer(new SecureRequestCustomizer());
    if (null != headerBufferSize) {
        httpsConfig.setRequestHeaderSize(headerBufferSize);
    }
    ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(factory, HttpVersion.HTTP_1_1.asString()), new HttpConnectionFactory(httpsConfig));
    sslConnector.setPort(port);
    return sslConnector;
}

Example 77 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project cloudstack by apache.

the class ServerDaemon method createHttpsConnector.

private void createHttpsConnector(final HttpConfiguration httpConfig) {
    // Configure SSL
    if (httpsEnable && StringUtils.isNotEmpty(keystoreFile) && new File(keystoreFile).exists()) {
        // SSL Context
        final SslContextFactory sslContextFactory = new SslContextFactory.Server();
        // Define keystore path and passwords
        sslContextFactory.setKeyStorePath(keystoreFile);
        sslContextFactory.setKeyStorePassword(keystorePassword);
        sslContextFactory.setKeyManagerPassword(keystorePassword);
        // HTTPS config
        final HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
        httpsConfig.addCustomizer(new SecureRequestCustomizer());
        // HTTPS Connector
        final ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
        sslConnector.setPort(httpsPort);
        sslConnector.setHost(bindInterface);
        server.addConnector(sslConnector);
    }
}

Example 78 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project structr by structr.

the class HttpService method initialize.

@Override
public boolean initialize(final StructrServices services) throws ClassNotFoundException, IllegalAccessException, InstantiationException {
    final LicenseManager licenseManager = services.getLicenseManager();
    final boolean isTest = Services.isTesting();
    String sourceJarName = getClass().getProtectionDomain().getCodeSource().getLocation().toString();
    if (!isTest && StringUtils.stripEnd(sourceJarName, System.getProperty("file.separator")).endsWith("classes")) {
        String jarFile = System.getProperty("jarFile");
        if (StringUtils.isEmpty(jarFile)) {
            throw new IllegalArgumentException(getClass().getName() + " was started in an environment where the classloader cannot determine the JAR file containing the main class.\n" + "Please specify the path to the JAR file in the parameter -DjarFile.\n" + "Example: -DjarFile=${project.build.directory}/${project.artifactId}-${project.version}.jar");
        }
        sourceJarName = jarFile;
    }
    // load configuration from properties file
    maxIdleTime = Services.parseInt(System.getProperty("maxIdleTime"), 30000);
    requestHeaderSize = Services.parseInt(System.getProperty("requestHeaderSize"), 8192);
    if (Settings.Async.getValue()) {
        logger.info("Running in asynchronous mode");
    }
    // other properties
    final String keyStorePath = Settings.KeystorePath.getValue();
    final String keyStorePassword = Settings.KeystorePassword.getValue();
    final String contextPath = System.getProperty("contextPath", "/");
    final boolean enableHttps = Settings.HttpsEnabled.getValue();
    final boolean enableGzipCompression = Settings.GzipCompression.getValue();
    final boolean logRequests = Settings.RequestLogging.getValue();
    final String logPrefix = Settings.LogPrefix.getValue();
    final String host = Settings.ApplicationHost.getValue();
    final int httpsPort = Settings.HttpsPort.getValue();
    boolean enableRewriteFilter = true;
    // get current base path
    String basePath = System.getProperty("home", Settings.getBasePath());
    if (StringUtils.isEmpty(basePath)) {
        // use cwd and, if that fails, /tmp as a fallback
        basePath = System.getProperty("user.dir", "/tmp");
    }
    // create base directory if it does not exist
    final File baseDir = new File(basePath);
    if (!baseDir.exists()) {
        baseDir.mkdirs();
    }
    server = new Server(Settings.HttpPort.getValue());
    final ContextHandlerCollection contexts = new ContextHandlerCollection();
    contexts.addHandler(new DefaultHandler());
    final ServletContextHandler servletContext = new ServletContextHandler(server, contextPath, true, true);
    if (enableGzipCompression) {
        gzipHandler = new GzipHandler();
        gzipHandler.setIncludedMimeTypes("text/html", "text/plain", "text/css", "text/javascript", "application/json");
        gzipHandler.setInflateBufferSize(32768);
        gzipHandler.setMinGzipSize(256);
        gzipHandler.setCompressionLevel(9);
        gzipHandler.setIncludedMethods("GET", "POST", "PUT", "HEAD", "DELETE");
        gzipHandler.addIncludedPaths("/*");
        gzipHandler.setDispatcherTypes(EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.ASYNC));
    }
    servletContext.setGzipHandler(gzipHandler);
    final List<Connector> connectors = new LinkedList<>();
    // create resource collection from base path & source JAR
    try {
        servletContext.setBaseResource(new ResourceCollection(Resource.newResource(basePath), JarResource.newJarResource(Resource.newResource(sourceJarName))));
    } catch (Throwable t) {
        logger.warn("Base resource {} not usable: {}", new Object[] { basePath, t.getMessage() });
    }
    // this is needed for the filters to work on the root context "/"
    servletContext.addServlet("org.eclipse.jetty.servlet.DefaultServlet", "/");
    servletContext.setInitParameter("org.eclipse.jetty.servlet.Default.dirAllowed", "false");
    if (Settings.ConfigServletEnabled.getValue()) {
        // configuration wizard entry point
        servletContext.addServlet("org.structr.rest.servlet.ConfigServlet", "/structr/config/*");
    }
    // CMIS setup
    if (Settings.CmisEnabled.getValue() && (licenseManager == null || licenseManager.isModuleLicensed("cmis"))) {
        try {
            servletContext.addEventListener(new CmisRepositoryContextListener());
            final ServletHolder cmisAtomHolder = servletContext.addServlet(CmisAtomPubServlet.class.getName(), "/structr/cmis/atom/*");
            cmisAtomHolder.setInitParameter("callContextHandler", BasicAuthCallContextHandler.class.getName());
            cmisAtomHolder.setInitParameter("cmisVersion", "1.1");
            final ServletHolder cmisBrowserHolder = servletContext.addServlet(CmisBrowserBindingServlet.class.getName(), "/structr/cmis/browser/*");
            cmisBrowserHolder.setInitParameter("callContextHandler", BasicAuthCallContextHandler.class.getName());
            cmisBrowserHolder.setInitParameter("cmisVersion", "1.1");
        } catch (Throwable t) {
            logger.warn("Cannot initialize CMIS servlet", t);
        }
    }
    sessionCache = new DefaultSessionCache(servletContext.getSessionHandler());
    if (licenseManager != null) {
        final String hardwareId = licenseManager.getHardwareFingerprint();
        DefaultSessionIdManager idManager = new DefaultSessionIdManager(server);
        idManager.setWorkerName(hardwareId);
        sessionCache.getSessionHandler().setSessionIdManager(idManager);
    }
    final StructrSessionDataStore sessionDataStore = new StructrSessionDataStore();
    // sessionDataStore.setSavePeriodSec(60);
    sessionCache.setSessionDataStore(sessionDataStore);
    // sessionCache.setSaveOnCreate(true);
    sessionCache.setSaveOnInactiveEviction(false);
    sessionCache.setRemoveUnloadableSessions(true);
    servletContext.getSessionHandler().setSessionCache(sessionCache);
    if (enableRewriteFilter) {
        final FilterHolder rewriteFilter = new FilterHolder(UrlRewriteFilter.class);
        rewriteFilter.setInitParameter("confPath", "urlrewrite.xml");
        servletContext.addFilter(rewriteFilter, "/*", EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.ASYNC));
    }
    contexts.addHandler(servletContext);
    // enable request logging
    if (logRequests) {
        final String etcPath = basePath + "/etc";
        final File etcDir = new File(etcPath);
        if (!etcDir.exists()) {
            etcDir.mkdir();
        }
        final String logbackConfFilePath = basePath + "/etc/logback-access.xml";
        final File logbackConfFile = new File(logbackConfFilePath);
        if (!logbackConfFile.exists()) {
            // synthesize a logback accees log config file
            List<String> config = new LinkedList<>();
            config.add("<configuration>");
            config.add("  <appender name=\"FILE\" class=\"ch.qos.logback.core.rolling.RollingFileAppender\">");
            config.add("    <rollingPolicy class=\"ch.qos.logback.core.rolling.TimeBasedRollingPolicy\">");
            config.add("      <fileNamePattern>logs/" + logPrefix + "-%d{yyyy_MM_dd}.request.log.zip</fileNamePattern>");
            config.add("    </rollingPolicy>");
            config.add("    <encoder>");
            config.add("      <charset>UTF-8</charset>");
            config.add("      <pattern>%h %l %u %t \"%r\" %s %b %n%fullRequest%n%n%fullResponse</pattern>");
            config.add("    </encoder>");
            config.add("  </appender>");
            config.add("  <appender-ref ref=\"FILE\" />");
            config.add("</configuration>");
            try {
                logbackConfFile.createNewFile();
                FileUtils.writeLines(logbackConfFile, "UTF-8", config);
            } catch (IOException ioex) {
                logger.warn("Unable to write logback configuration.", ioex);
            }
        }
        final FilterHolder loggingFilter = new FilterHolder(TeeFilter.class);
        servletContext.addFilter(loggingFilter, "/*", EnumSet.of(DispatcherType.REQUEST, Settings.Async.getValue() ? DispatcherType.ASYNC : DispatcherType.FORWARD));
        loggingFilter.setInitParameter("includes", "");
        final RequestLogHandler requestLogHandler = new RequestLogHandler();
        final String logPath = basePath + "/logs";
        final File logDir = new File(logPath);
        // Create logs directory if not existing
        if (!logDir.exists()) {
            logDir.mkdir();
        }
        final RequestLogImpl requestLog = new RequestLogImpl();
        requestLog.setName("REQUESTLOG");
        requestLog.start();
        requestLogHandler.setRequestLog(requestLog);
        final HandlerCollection handlers = new HandlerCollection();
        handlers.setHandlers(new Handler[] { contexts, requestLogHandler });
        server.setHandler(handlers);
    } else {
        server.setHandler(contexts);
    }
    final List<ContextHandler> resourceHandler = collectResourceHandlers();
    for (ContextHandler contextHandler : resourceHandler) {
        contexts.addHandler(contextHandler);
    }
    final Map<String, ServletHolder> servlets = collectServlets(licenseManager);
    // add servlet elements
    int position = 1;
    for (Map.Entry<String, ServletHolder> servlet : servlets.entrySet()) {
        final ServletHolder servletHolder = servlet.getValue();
        final String path = servlet.getKey();
        servletHolder.setInitOrder(position++);
        logger.info("Adding servlet {} for {}", new Object[] { servletHolder, path });
        servletContext.addServlet(servletHolder, path);
    }
    contexts.addHandler(servletContext);
    if (StringUtils.isNotBlank(host) && Settings.HttpPort.getValue() > -1) {
        httpConfig = new HttpConfiguration();
        httpConfig.setSecureScheme("https");
        httpConfig.setSecurePort(httpsPort);
        // httpConfig.setOutputBufferSize(8192);
        httpConfig.setRequestHeaderSize(requestHeaderSize);
        final ServerConnector httpConnector = new ServerConnector(server, new HttpConnectionFactory(httpConfig));
        httpConnector.setHost(host);
        httpConnector.setPort(Settings.HttpPort.getValue());
        connectors.add(httpConnector);
    } else {
        logger.warn("Unable to configure HTTP server port, please make sure that {} and {} are set correctly in structr.conf.", Settings.ApplicationHost.getKey(), Settings.HttpPort.getKey());
    }
    if (enableHttps) {
        if (httpsPort > -1 && keyStorePath != null && !keyStorePath.isEmpty() && keyStorePassword != null) {
            httpsConfig = new HttpConfiguration(httpConfig);
            httpsConfig.addCustomizer(new SecureRequestCustomizer());
            final SslContextFactory sslContextFactory = new SslContextFactory();
            sslContextFactory.setKeyStorePath(keyStorePath);
            sslContextFactory.setKeyStorePassword(keyStorePassword);
            final ServerConnector https = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
            https.setPort(httpsPort);
            https.setIdleTimeout(500000);
            https.setHost(host);
            https.setPort(httpsPort);
            connectors.add(https);
        } else {
            logger.warn("Unable to configure SSL, please make sure that {}, {} and {} are set correctly in structr.conf.", new Object[] { Settings.HttpsPort.getKey(), Settings.KeystorePath.getKey(), Settings.KeystorePassword.getKey() });
        }
    }
    if (!connectors.isEmpty()) {
        server.setConnectors(connectors.toArray(new Connector[0]));
    } else {
        logger.error("No connectors configured, aborting.");
        System.exit(0);
    }
    server.setStopTimeout(1000);
    server.setStopAtShutdown(true);
    return true;
}

Example 79 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project rest.li by linkedin.

the class HttpsH2JettyServer method getConnectors.

@Override
protected Connector[] getConnectors(Server server) {
    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStorePath(_keyStore);
    sslContextFactory.setKeyStorePassword(_keyStorePassword);
    sslContextFactory.setTrustStorePath(_keyStore);
    sslContextFactory.setTrustStorePassword(_keyStorePassword);
    sslContextFactory.setCipherComparator(HTTP2Cipher.COMPARATOR);
    sslContextFactory.setUseCipherSuitesOrder(true);
    HttpConfiguration https_config = new HttpConfiguration();
    https_config.setSecureScheme(HttpScheme.HTTPS.asString());
    https_config.setSecurePort(_sslPort);
    // HTTPS Configuration
    HttpConfiguration http2_config = new HttpConfiguration(https_config);
    http2_config.addCustomizer(new SecureRequestCustomizer());
    // HTTP/2 Connection Factory
    HTTP2ServerConnectionFactory h2 = new HTTP2ServerConnectionFactory(http2_config) {

        /**
         * Required to override since we are using legacy versions in testing which would not be otherwise accepted
         */
        @Override
        public boolean isAcceptable(String protocol, String tlsProtocol, String tlsCipher) {
            return true;
        }
    };
    NegotiatingServerConnectionFactory.checkProtocolNegotiationAvailable();
    ALPNServerConnectionFactory alpn = new ALPNServerConnectionFactory();
    alpn.setDefaultProtocol("h2");
    // SSL Connection Factory
    SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, alpn.getProtocol());
    // Connector supporting HTTP/2, http1.1 and negotiation protocols
    ServerConnector h2Connector = new ServerConnector(server, ssl, alpn, h2, new HttpConnectionFactory(https_config, HttpCompliance.RFC2616));
    h2Connector.setPort(_sslPort);
    server.addConnector(h2Connector);
    HttpConfiguration configuration = new HttpConfiguration();
    ServerConnector h2cConnector = new ServerConnector(server, new HttpConnectionFactory(configuration, HttpCompliance.RFC2616), new HTTP2CServerConnectionFactory(configuration));
    h2cConnector.setPort(_port);
    return new ServerConnector[] { h2Connector, h2cConnector };
}

Example 80 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project zeppelin by apache.

the class ZeppelinServer method initServerConnector.

private static void initServerConnector(Server server, int port, int sslPort) {
    ServerConnector connector;
    HttpConfiguration httpConfig = new HttpConfiguration();
    httpConfig.addCustomizer(new ForwardedRequestCustomizer());
    httpConfig.setSendServerVersion(conf.sendJettyName());
    httpConfig.setRequestHeaderSize(conf.getJettyRequestHeaderSize());
    if (conf.useSsl()) {
        LOG.debug("Enabling SSL for Zeppelin Server on port {}", sslPort);
        httpConfig.setSecureScheme(HttpScheme.HTTPS.asString());
        httpConfig.setSecurePort(sslPort);
        HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
        httpsConfig.addCustomizer(new SecureRequestCustomizer());
        SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(getSslContextFactory(conf), HttpVersion.HTTP_1_1.asString());
        HttpConnectionFactory httpsConnectionFactory = new HttpConnectionFactory(httpsConfig);
        connector = new ServerConnector(server, sslConnectionFactory, httpsConnectionFactory);
        connector.setPort(sslPort);
        connector.addBean(new JettySslHandshakeMetrics(Metrics.globalRegistry, Tags.empty()));
    } else {
        HttpConnectionFactory httpConnectionFactory = new HttpConnectionFactory(httpConfig);
        connector = new ServerConnector(server, httpConnectionFactory);
        connector.setPort(port);
    }
    // Set some timeout options to make debugging easier.
    int timeout = 1000 * 30;
    connector.setIdleTimeout(timeout);
    connector.setHost(conf.getServerAddress());
    connector.addBean(new JettyConnectionMetrics(Metrics.globalRegistry, Tags.empty()));
    server.addConnector(connector);
}