Examples with SecureRequestCustomizer org.eclipse.jetty.server.SecureRequestCustomizer used on opensource projects

Example 36 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project spring-boot by spring-projects.

the class SslServerCustomizer method createConnector.

private ServerConnector createConnector(Server server, SslContextFactory.Server sslContextFactory, InetSocketAddress address) {
    HttpConfiguration config = new HttpConfiguration();
    config.setSendServerVersion(false);
    config.setSecureScheme("https");
    config.setSecurePort(address.getPort());
    config.addCustomizer(new SecureRequestCustomizer());
    ServerConnector connector = createServerConnector(server, sslContextFactory, config);
    connector.setPort(address.getPort());
    connector.setHost(address.getHostString());
    return connector;
}

Example 37 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project rest.li by linkedin.

the class HttpsJettyServer method getConnectors.

@Override
protected Connector[] getConnectors(Server server) {
    SslContextFactory sslContextFactory = new SslContextFactory();
    sslContextFactory.setKeyStorePath(_keyStore);
    sslContextFactory.setKeyStorePassword(_keyStorePassword);
    sslContextFactory.setTrustStorePath(_keyStore);
    sslContextFactory.setTrustStorePassword(_keyStorePassword);
    HttpConfiguration configuration = new HttpConfiguration();
    configuration.addCustomizer(new SecureRequestCustomizer());
    ServerConnector sslConnector = new ServerConnector(server, sslContextFactory, new HttpConnectionFactory(configuration, HttpCompliance.RFC2616));
    sslConnector.setPort(_sslPort);
    Connector[] httpConnectors = super.getConnectors(server);
    Connector[] connectors = new Connector[httpConnectors.length + 1];
    int i = 0;
    for (Connector c : httpConnectors) {
        connectors[i++] = c;
    }
    connectors[i++] = sslConnector;
    return connectors;
}

Example 38 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project Openfire by igniterealtime.

the class HttpBindManager method createSSLConnector.

private Connector createSSLConnector(final Server httpBindServer) {
    final int securePort = getHttpBindSecurePort();
    try {
        final IdentityStore identityStore = XMPPServer.getInstance().getCertificateStoreManager().getIdentityStore(ConnectionType.BOSH_C2S);
        if (securePort > 0 && identityStore.getStore().aliases().hasMoreElements()) {
            if (!identityStore.containsDomainCertificate()) {
                Log.warn("HTTP binding: Using certificates but they are not valid for the hosted domain");
            }
            final ConnectionManagerImpl connectionManager = ((ConnectionManagerImpl) XMPPServer.getInstance().getConnectionManager());
            final ConnectionConfiguration configuration = connectionManager.getListener(ConnectionType.BOSH_C2S, true).generateConnectionConfiguration();
            final SslContextFactory sslContextFactory = new EncryptionArtifactFactory(configuration).getSslContextFactory();
            final HttpConfiguration httpsConfig = new HttpConfiguration();
            httpsConfig.setSecureScheme("https");
            httpsConfig.setSecurePort(securePort);
            configureProxiedConnector(httpsConfig);
            httpsConfig.addCustomizer(new SecureRequestCustomizer());
            httpsConfig.setSendServerVersion(false);
            final ServerConnector sslConnector = new ServerConnector(httpBindServer, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
            sslConnector.setHost(getBindInterface());
            sslConnector.setPort(securePort);
            return sslConnector;
        }
    } catch (Exception e) {
        Log.error("Error creating SSL connector for Http bind", e);
    }
    return null;
}

Example 39 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project qpid-broker-j by apache.

the class HttpManagement method createConnector.

private ServerConnector createConnector(final HttpPort<?> port, final Server server) {
    port.setPortManager(this);
    if (port.getState() != State.ACTIVE) {
        // TODO - RG - probably does nothing
        port.startAsync();
    }
    HttpConnectionFactory httpConnectionFactory = new HttpConnectionFactory();
    httpConnectionFactory.getHttpConfiguration().setSendServerVersion(false);
    httpConnectionFactory.getHttpConfiguration().setSendXPoweredBy(false);
    HttpConfiguration.Customizer requestAttributeCustomizer = (connector, httpConfiguration, request) -> HttpManagementUtil.getPortAttributeAction(port).performAction(request);
    httpConnectionFactory.getHttpConfiguration().addCustomizer(requestAttributeCustomizer);
    httpConnectionFactory.getHttpConfiguration().addCustomizer(new SecureRequestCustomizer());
    ConnectionFactory[] connectionFactories;
    Collection<Transport> transports = port.getTransports();
    SslContextFactory sslContextFactory = null;
    if (!transports.contains(Transport.SSL)) {
        connectionFactories = new ConnectionFactory[] { httpConnectionFactory };
    } else if (transports.contains(Transport.SSL)) {
        sslContextFactory = createSslContextFactory(port);
        ConnectionFactory sslConnectionFactory = new SslConnectionFactory(sslContextFactory, httpConnectionFactory.getProtocol());
        if (port.getTransports().contains(Transport.TCP)) {
            sslConnectionFactory = new OptionalSslConnectionFactory((SslConnectionFactory) sslConnectionFactory, HttpVersion.HTTP_1_1.asString());
        }
        connectionFactories = new ConnectionFactory[] { sslConnectionFactory, httpConnectionFactory };
    } else {
        throw new IllegalArgumentException("Unexpected transport on port " + port.getName() + ":" + transports);
    }
    ServerConnector connector = new ServerConnector(server, new QBBTrackingThreadPool(port.getThreadPoolMaximum(), port.getThreadPoolMinimum()), null, null, port.getDesiredNumberOfAcceptors(), port.getDesiredNumberOfSelectors(), connectionFactories) {

        @Override
        public void open() throws IOException {
            try {
                super.open();
            } catch (BindException e) {
                _sslContextFactoryMap.remove(port);
                InetSocketAddress addr = getHost() == null ? new InetSocketAddress(getPort()) : new InetSocketAddress(getHost(), getPort());
                throw new PortBindFailureException(addr);
            }
        }
    };
    connector.setAcceptQueueSize(port.getAcceptBacklogSize());
    String bindingAddress = port.getBindingAddress();
    if (bindingAddress != null && !bindingAddress.trim().equals("") && !bindingAddress.trim().equals("*")) {
        connector.setHost(bindingAddress.trim());
    }
    connector.setPort(port.getPort());
    if (transports.contains(Transport.SSL)) {
        connector.addBean(new SslHandshakeListener() {

            @Override
            public void handshakeFailed(final Event event, final Throwable failure) {
                SSLEngine sslEngine = event.getSSLEngine();
                if (LOGGER.isDebugEnabled()) {
                    LOGGER.info("TLS handshake failed: host='{}', port={}", sslEngine.getPeerHost(), sslEngine.getPeerPort(), failure);
                } else {
                    LOGGER.info("TLS handshake failed: host='{}', port={}: {}", sslEngine.getPeerHost(), sslEngine.getPeerPort(), String.valueOf(failure));
                }
            }
        });
    }
    int acceptors = connector.getAcceptors();
    int selectors = connector.getSelectorManager().getSelectorCount();
    if (LOGGER.isDebugEnabled()) {
        LOGGER.debug("Created connector for http port {} with maxThreads={}, minThreads={}, acceptors={}, selectors={}, acceptBacklog={}", port.getName(), port.getThreadPoolMaximum(), port.getThreadPoolMinimum(), acceptors, selectors, port.getAcceptBacklogSize());
    }
    int requiredNumberOfConnections = acceptors + 2 * selectors + 1;
    if (port.getThreadPoolMaximum() < requiredNumberOfConnections) {
        throw new IllegalConfigurationException(String.format("Insufficient number of threads is configured on http port '%s': max=%d < needed(acceptors=%d + selectors=2*%d + request=1)", port.getName(), port.getThreadPoolMaximum(), acceptors, selectors));
    }
    if (sslContextFactory != null) {
        _sslContextFactoryMap.put(port, sslContextFactory);
    }
    return connector;
}

Example 40 with SecureRequestCustomizer

use of org.eclipse.jetty.server.SecureRequestCustomizer in project scheduling by ow2-proactive.

the class JettyStarter method configureHttps.

private Connector[] configureHttps(int httpPort, int httpsPort, boolean redirectHttpToHttps, Server server, HttpConfiguration httpConfiguration) {
    Connector[] connectors;
    SslContextFactory sslContextFactory = new SslContextFactory();
    if (WebProperties.WEB_HTTPS_PROTOCOLS_INCLUDED.isSet()) {
        sslContextFactory.setIncludeProtocols(WebProperties.WEB_HTTPS_PROTOCOLS_INCLUDED.getValueAsList(",").toArray(new String[0]));
    }
    if (WebProperties.WEB_HTTPS_PROTOCOLS_EXCLUDED.isSet()) {
        sslContextFactory.setExcludeProtocols(WebProperties.WEB_HTTPS_PROTOCOLS_EXCLUDED.getValueAsList(",").toArray(new String[0]));
    }
    if (WebProperties.WEB_HTTPS_CYPHERS_INCLUDED_ADD.isSet()) {
        List<String> includedCyphers = Arrays.asList(sslContextFactory.getIncludeCipherSuites());
        includedCyphers.addAll(WebProperties.WEB_HTTPS_CYPHERS_INCLUDED_ADD.getValueAsList(","));
        sslContextFactory.setIncludeCipherSuites(includedCyphers.toArray(new String[0]));
    }
    if (WebProperties.WEB_HTTPS_CYPHERS_EXCLUDED_ADD.isSet()) {
        sslContextFactory.addExcludeCipherSuites(WebProperties.WEB_HTTPS_CYPHERS_EXCLUDED_ADD.getValueAsList(",").toArray(new String[0]));
    }
    if (WebProperties.WEB_HTTPS_RENEGOTIATION_ALLOWED.isSet()) {
        sslContextFactory.setRenegotiationAllowed(WebProperties.WEB_HTTPS_RENEGOTIATION_ALLOWED.getValueAsBoolean());
    }
    if (WebProperties.WEB_HTTPS_SECURE_RANDOM_ALGORITHM.isSet()) {
        sslContextFactory.setSecureRandomAlgorithm(WebProperties.WEB_HTTPS_SECURE_RANDOM_ALGORITHM.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_KEY_FACTORY_ALGORITHM.isSet()) {
        sslContextFactory.setSslKeyManagerFactoryAlgorithm(WebProperties.WEB_HTTPS_KEY_FACTORY_ALGORITHM.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_TRUST_FACTORY_ALGORITHM.isSet()) {
        sslContextFactory.setTrustManagerFactoryAlgorithm(WebProperties.WEB_HTTPS_TRUST_FACTORY_ALGORITHM.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_MAX_CERT_PATH.isSet()) {
        sslContextFactory.setMaxCertPathLength(WebProperties.WEB_HTTPS_MAX_CERT_PATH.getValueAsInt());
    }
    if (WebProperties.WEB_HTTPS_CERT_ALIAS.isSet()) {
        sslContextFactory.setCertAlias(WebProperties.WEB_HTTPS_CERT_ALIAS.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_ENABLE_CRLDP.isSet()) {
        sslContextFactory.setEnableCRLDP(WebProperties.WEB_HTTPS_ENABLE_CRLDP.getValueAsBoolean());
    }
    if (WebProperties.WEB_HTTPS_CRL_PATH.isSet()) {
        sslContextFactory.setCrlPath(WebProperties.WEB_HTTPS_CRL_PATH.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_ENABLE_OCSP.isSet()) {
        sslContextFactory.setEnableOCSP(WebProperties.WEB_HTTPS_ENABLE_OCSP.getValueAsBoolean());
    }
    if (WebProperties.WEB_HTTPS_OCSP_RESPONDER_URL.isSet()) {
        sslContextFactory.setOcspResponderURL(WebProperties.WEB_HTTPS_OCSP_RESPONDER_URL.getValueAsString());
    }
    if (WebProperties.WEB_HTTPS_SESSION_CACHING.isSet()) {
        sslContextFactory.setSessionCachingEnabled(WebProperties.WEB_HTTPS_SESSION_CACHING.getValueAsBoolean());
    }
    if (WebProperties.WEB_HTTPS_SESSION_CACHE_SIZE.isSet()) {
        sslContextFactory.setSslSessionCacheSize(WebProperties.WEB_HTTPS_SESSION_CACHE_SIZE.getValueAsInt());
    }
    if (WebProperties.WEB_HTTPS_SESSION_TIMEOUT.isSet()) {
        sslContextFactory.setSslSessionTimeout(WebProperties.WEB_HTTPS_SESSION_TIMEOUT.getValueAsInt());
    }
    String httpsKeystore = WebProperties.WEB_HTTPS_KEYSTORE.getValueAsStringOrNull();
    String httpsKeystorePassword = WebProperties.WEB_HTTPS_KEYSTORE_PASSWORD.getValueAsStringOrNull();
    checkPropertyNotNull(WebProperties.WEB_HTTPS_KEYSTORE.getKey(), httpsKeystore);
    checkPropertyNotNull(WebProperties.WEB_HTTPS_KEYSTORE_PASSWORD.getKey(), httpsKeystorePassword);
    sslContextFactory.setKeyStorePath(absolutePathOrRelativeToSchedulerHome(httpsKeystore));
    sslContextFactory.setKeyStorePassword(httpsKeystorePassword);
    if (WebProperties.WEB_HTTPS_TRUSTSTORE.isSet() && WebProperties.WEB_HTTPS_TRUSTSTORE_PASSWORD.isSet()) {
        String httpsTrustStore = WebProperties.WEB_HTTPS_TRUSTSTORE.getValueAsString();
        String httpsTrustStorePassword = WebProperties.WEB_HTTPS_TRUSTSTORE_PASSWORD.getValueAsString();
        sslContextFactory.setTrustStorePath(httpsTrustStore);
        sslContextFactory.setTrustStorePassword(httpsTrustStorePassword);
    }
    HttpConfiguration secureHttpConfiguration = new HttpConfiguration(httpConfiguration);
    secureHttpConfiguration.addCustomizer(new SecureRequestCustomizer());
    secureHttpConfiguration.setSecurePort(httpsPort);
    secureHttpConfiguration.setSecureScheme("https");
    secureHttpConfiguration.setSendDateHeader(false);
    secureHttpConfiguration.setSendServerVersion(false);
    // Connector to listen for HTTPS requests
    ServerConnector httpsConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.toString()), new HttpConnectionFactory(secureHttpConfiguration));
    httpsConnector.setName(HTTPS_CONNECTOR_NAME);
    httpsConnector.setPort(httpsPort);
    httpsConnector.setIdleTimeout(WebProperties.WEB_IDLE_TIMEOUT.getValueAsLong());
    if (redirectHttpToHttps) {
        // The next two settings allow !403 errors to be redirected to HTTPS
        httpConfiguration.setSecureScheme("https");
        httpConfiguration.setSecurePort(httpsPort);
        // Connector to listen for HTTP requests that are redirected to HTTPS
        ServerConnector httpConnector = createHttpConnector(server, httpConfiguration, httpPort);
        connectors = new Connector[] { httpConnector, httpsConnector };
    } else {
        connectors = new Connector[] { httpsConnector };
    }
    return connectors;
}