Examples with SslConnectionFactory org.eclipse.jetty.server.SslConnectionFactory used on opensource projects

Example 86 with SslConnectionFactory

use of org.eclipse.jetty.server.SslConnectionFactory in project storm by apache.

the class UIHelpers method mkSslConnector.

private static ServerConnector mkSslConnector(Server server, Integer port, String ksPath, String ksPassword, String ksType, String keyPassword, String tsPath, String tsPassword, String tsType, Boolean needClientAuth, Boolean wantClientAuth, Integer headerBufferSize, boolean enableSslReload) {
    SslContextFactory factory = new ReloadableSslContextFactory(enableSslReload);
    factory.setExcludeCipherSuites("SSL_RSA_WITH_RC4_128_MD5", "SSL_RSA_WITH_RC4_128_SHA");
    factory.setExcludeProtocols("SSLv3");
    factory.setRenegotiationAllowed(false);
    factory.setKeyStorePath(ksPath);
    factory.setKeyStoreType(ksType);
    factory.setKeyStorePassword(ksPassword);
    factory.setKeyManagerPassword(keyPassword);
    if (tsPath != null && tsPassword != null && tsType != null) {
        factory.setTrustStorePath(tsPath);
        factory.setTrustStoreType(tsType);
        factory.setTrustStorePassword(tsPassword);
    }
    if (needClientAuth != null && needClientAuth) {
        factory.setNeedClientAuth(true);
    } else if (wantClientAuth != null && wantClientAuth) {
        factory.setWantClientAuth(true);
    }
    HttpConfiguration httpsConfig = new HttpConfiguration();
    httpsConfig.addCustomizer(new SecureRequestCustomizer());
    if (null != headerBufferSize) {
        httpsConfig.setRequestHeaderSize(headerBufferSize);
    }
    ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(factory, HttpVersion.HTTP_1_1.asString()), new HttpConnectionFactory(httpsConfig));
    sslConnector.setPort(port);
    return sslConnector;
}

Example 87 with SslConnectionFactory

use of org.eclipse.jetty.server.SslConnectionFactory in project dropwizard by dropwizard.

the class Http2ConnectorFactory method build.

@Override
public Connector build(Server server, MetricRegistry metrics, String name, @Nullable ThreadPool threadPool) {
    // HTTP/2 requires that a server MUST support TLSv1.2 or higher and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher
    // See https://datatracker.ietf.org/doc/html/rfc7540#section-9.2
    setSupportedProtocols(Arrays.asList("TLSv1.3", "TLSv1.2"));
    checkSupportedCipherSuites();
    // Setup connection factories
    final HttpConfiguration httpConfig = buildHttpConfiguration();
    final HttpConnectionFactory http1 = buildHttpConnectionFactory(httpConfig);
    final HTTP2ServerConnectionFactory http2 = new HTTP2ServerConnectionFactory(httpConfig);
    http2.setMaxConcurrentStreams(maxConcurrentStreams);
    http2.setInitialStreamRecvWindow(initialStreamRecvWindow);
    final NegotiatingServerConnectionFactory alpn = new ALPNServerConnectionFactory();
    // Speak HTTP 1.1 over TLS if negotiation fails
    alpn.setDefaultProtocol("http/1.1");
    final SslContextFactory sslContextFactory = configureSslContextFactory(new SslContextFactory.Server());
    sslContextFactory.addLifeCycleListener(logSslParameters(sslContextFactory));
    server.addBean(sslContextFactory);
    server.addBean(new SslReload(sslContextFactory, this::configureSslContextFactory));
    // We should use ALPN as a negotiation protocol. Old clients that don't support it will be served
    // via HTTPS. New clients, however, that want to use HTTP/2 will use TLS with ALPN extension.
    // If negotiation succeeds, the client and server switch to HTTP/2 protocol.
    final SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(sslContextFactory, "alpn");
    return buildConnector(server, new ScheduledExecutorScheduler(), buildBufferPool(), name, threadPool, new InstrumentedConnectionFactory(sslConnectionFactory, metrics.timer(httpConnections())), alpn, http2, http1);
}

Example 88 with SslConnectionFactory

use of org.eclipse.jetty.server.SslConnectionFactory in project dropwizard by dropwizard.

the class HttpsConnectorFactory method build.

@Override
public Connector build(Server server, MetricRegistry metrics, String name, @Nullable ThreadPool threadPool) {
    final HttpConfiguration httpConfig = buildHttpConfiguration();
    final HttpConnectionFactory httpConnectionFactory = buildHttpConnectionFactory(httpConfig);
    final SslContextFactory sslContextFactory = configureSslContextFactory(new SslContextFactory.Server());
    sslContextFactory.addLifeCycleListener(logSslParameters(sslContextFactory));
    server.addBean(sslContextFactory);
    server.addBean(new SslReload(sslContextFactory, this::configureSslContextFactory));
    final SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.toString());
    final Scheduler scheduler = new ScheduledExecutorScheduler();
    final ByteBufferPool bufferPool = buildBufferPool();
    return buildConnector(server, scheduler, bufferPool, name, threadPool, new InstrumentedConnectionFactory(sslConnectionFactory, metrics.timer(httpConnections())), httpConnectionFactory);
}

Example 89 with SslConnectionFactory

use of org.eclipse.jetty.server.SslConnectionFactory in project cloudstack by apache.

the class ServerDaemon method createHttpsConnector.

private void createHttpsConnector(final HttpConfiguration httpConfig) {
    // Configure SSL
    if (httpsEnable && StringUtils.isNotEmpty(keystoreFile) && new File(keystoreFile).exists()) {
        // SSL Context
        final SslContextFactory sslContextFactory = new SslContextFactory.Server();
        // Define keystore path and passwords
        sslContextFactory.setKeyStorePath(keystoreFile);
        sslContextFactory.setKeyStorePassword(keystorePassword);
        sslContextFactory.setKeyManagerPassword(keystorePassword);
        // HTTPS config
        final HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
        httpsConfig.addCustomizer(new SecureRequestCustomizer());
        // HTTPS Connector
        final ServerConnector sslConnector = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
        sslConnector.setPort(httpsPort);
        sslConnector.setHost(bindInterface);
        server.addConnector(sslConnector);
    }
}

Example 90 with SslConnectionFactory

use of org.eclipse.jetty.server.SslConnectionFactory in project structr by structr.

the class HttpService method initialize.

@Override
public boolean initialize(final StructrServices services) throws ClassNotFoundException, IllegalAccessException, InstantiationException {
    final LicenseManager licenseManager = services.getLicenseManager();
    final boolean isTest = Services.isTesting();
    String sourceJarName = getClass().getProtectionDomain().getCodeSource().getLocation().toString();
    if (!isTest && StringUtils.stripEnd(sourceJarName, System.getProperty("file.separator")).endsWith("classes")) {
        String jarFile = System.getProperty("jarFile");
        if (StringUtils.isEmpty(jarFile)) {
            throw new IllegalArgumentException(getClass().getName() + " was started in an environment where the classloader cannot determine the JAR file containing the main class.\n" + "Please specify the path to the JAR file in the parameter -DjarFile.\n" + "Example: -DjarFile=${project.build.directory}/${project.artifactId}-${project.version}.jar");
        }
        sourceJarName = jarFile;
    }
    // load configuration from properties file
    maxIdleTime = Services.parseInt(System.getProperty("maxIdleTime"), 30000);
    requestHeaderSize = Services.parseInt(System.getProperty("requestHeaderSize"), 8192);
    if (Settings.Async.getValue()) {
        logger.info("Running in asynchronous mode");
    }
    // other properties
    final String keyStorePath = Settings.KeystorePath.getValue();
    final String keyStorePassword = Settings.KeystorePassword.getValue();
    final String contextPath = System.getProperty("contextPath", "/");
    final boolean enableHttps = Settings.HttpsEnabled.getValue();
    final boolean enableGzipCompression = Settings.GzipCompression.getValue();
    final boolean logRequests = Settings.RequestLogging.getValue();
    final String logPrefix = Settings.LogPrefix.getValue();
    final String host = Settings.ApplicationHost.getValue();
    final int httpsPort = Settings.HttpsPort.getValue();
    boolean enableRewriteFilter = true;
    // get current base path
    String basePath = System.getProperty("home", Settings.getBasePath());
    if (StringUtils.isEmpty(basePath)) {
        // use cwd and, if that fails, /tmp as a fallback
        basePath = System.getProperty("user.dir", "/tmp");
    }
    // create base directory if it does not exist
    final File baseDir = new File(basePath);
    if (!baseDir.exists()) {
        baseDir.mkdirs();
    }
    server = new Server(Settings.HttpPort.getValue());
    final ContextHandlerCollection contexts = new ContextHandlerCollection();
    contexts.addHandler(new DefaultHandler());
    final ServletContextHandler servletContext = new ServletContextHandler(server, contextPath, true, true);
    if (enableGzipCompression) {
        gzipHandler = new GzipHandler();
        gzipHandler.setIncludedMimeTypes("text/html", "text/plain", "text/css", "text/javascript", "application/json");
        gzipHandler.setInflateBufferSize(32768);
        gzipHandler.setMinGzipSize(256);
        gzipHandler.setCompressionLevel(9);
        gzipHandler.setIncludedMethods("GET", "POST", "PUT", "HEAD", "DELETE");
        gzipHandler.addIncludedPaths("/*");
        gzipHandler.setDispatcherTypes(EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.ASYNC));
    }
    servletContext.setGzipHandler(gzipHandler);
    final List<Connector> connectors = new LinkedList<>();
    // create resource collection from base path & source JAR
    try {
        servletContext.setBaseResource(new ResourceCollection(Resource.newResource(basePath), JarResource.newJarResource(Resource.newResource(sourceJarName))));
    } catch (Throwable t) {
        logger.warn("Base resource {} not usable: {}", new Object[] { basePath, t.getMessage() });
    }
    // this is needed for the filters to work on the root context "/"
    servletContext.addServlet("org.eclipse.jetty.servlet.DefaultServlet", "/");
    servletContext.setInitParameter("org.eclipse.jetty.servlet.Default.dirAllowed", "false");
    if (Settings.ConfigServletEnabled.getValue()) {
        // configuration wizard entry point
        servletContext.addServlet("org.structr.rest.servlet.ConfigServlet", "/structr/config/*");
    }
    // CMIS setup
    if (Settings.CmisEnabled.getValue() && (licenseManager == null || licenseManager.isModuleLicensed("cmis"))) {
        try {
            servletContext.addEventListener(new CmisRepositoryContextListener());
            final ServletHolder cmisAtomHolder = servletContext.addServlet(CmisAtomPubServlet.class.getName(), "/structr/cmis/atom/*");
            cmisAtomHolder.setInitParameter("callContextHandler", BasicAuthCallContextHandler.class.getName());
            cmisAtomHolder.setInitParameter("cmisVersion", "1.1");
            final ServletHolder cmisBrowserHolder = servletContext.addServlet(CmisBrowserBindingServlet.class.getName(), "/structr/cmis/browser/*");
            cmisBrowserHolder.setInitParameter("callContextHandler", BasicAuthCallContextHandler.class.getName());
            cmisBrowserHolder.setInitParameter("cmisVersion", "1.1");
        } catch (Throwable t) {
            logger.warn("Cannot initialize CMIS servlet", t);
        }
    }
    sessionCache = new DefaultSessionCache(servletContext.getSessionHandler());
    if (licenseManager != null) {
        final String hardwareId = licenseManager.getHardwareFingerprint();
        DefaultSessionIdManager idManager = new DefaultSessionIdManager(server);
        idManager.setWorkerName(hardwareId);
        sessionCache.getSessionHandler().setSessionIdManager(idManager);
    }
    final StructrSessionDataStore sessionDataStore = new StructrSessionDataStore();
    // sessionDataStore.setSavePeriodSec(60);
    sessionCache.setSessionDataStore(sessionDataStore);
    // sessionCache.setSaveOnCreate(true);
    sessionCache.setSaveOnInactiveEviction(false);
    sessionCache.setRemoveUnloadableSessions(true);
    servletContext.getSessionHandler().setSessionCache(sessionCache);
    if (enableRewriteFilter) {
        final FilterHolder rewriteFilter = new FilterHolder(UrlRewriteFilter.class);
        rewriteFilter.setInitParameter("confPath", "urlrewrite.xml");
        servletContext.addFilter(rewriteFilter, "/*", EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.ASYNC));
    }
    contexts.addHandler(servletContext);
    // enable request logging
    if (logRequests) {
        final String etcPath = basePath + "/etc";
        final File etcDir = new File(etcPath);
        if (!etcDir.exists()) {
            etcDir.mkdir();
        }
        final String logbackConfFilePath = basePath + "/etc/logback-access.xml";
        final File logbackConfFile = new File(logbackConfFilePath);
        if (!logbackConfFile.exists()) {
            // synthesize a logback accees log config file
            List<String> config = new LinkedList<>();
            config.add("<configuration>");
            config.add("  <appender name=\"FILE\" class=\"ch.qos.logback.core.rolling.RollingFileAppender\">");
            config.add("    <rollingPolicy class=\"ch.qos.logback.core.rolling.TimeBasedRollingPolicy\">");
            config.add("      <fileNamePattern>logs/" + logPrefix + "-%d{yyyy_MM_dd}.request.log.zip</fileNamePattern>");
            config.add("    </rollingPolicy>");
            config.add("    <encoder>");
            config.add("      <charset>UTF-8</charset>");
            config.add("      <pattern>%h %l %u %t \"%r\" %s %b %n%fullRequest%n%n%fullResponse</pattern>");
            config.add("    </encoder>");
            config.add("  </appender>");
            config.add("  <appender-ref ref=\"FILE\" />");
            config.add("</configuration>");
            try {
                logbackConfFile.createNewFile();
                FileUtils.writeLines(logbackConfFile, "UTF-8", config);
            } catch (IOException ioex) {
                logger.warn("Unable to write logback configuration.", ioex);
            }
        }
        final FilterHolder loggingFilter = new FilterHolder(TeeFilter.class);
        servletContext.addFilter(loggingFilter, "/*", EnumSet.of(DispatcherType.REQUEST, Settings.Async.getValue() ? DispatcherType.ASYNC : DispatcherType.FORWARD));
        loggingFilter.setInitParameter("includes", "");
        final RequestLogHandler requestLogHandler = new RequestLogHandler();
        final String logPath = basePath + "/logs";
        final File logDir = new File(logPath);
        // Create logs directory if not existing
        if (!logDir.exists()) {
            logDir.mkdir();
        }
        final RequestLogImpl requestLog = new RequestLogImpl();
        requestLog.setName("REQUESTLOG");
        requestLog.start();
        requestLogHandler.setRequestLog(requestLog);
        final HandlerCollection handlers = new HandlerCollection();
        handlers.setHandlers(new Handler[] { contexts, requestLogHandler });
        server.setHandler(handlers);
    } else {
        server.setHandler(contexts);
    }
    final List<ContextHandler> resourceHandler = collectResourceHandlers();
    for (ContextHandler contextHandler : resourceHandler) {
        contexts.addHandler(contextHandler);
    }
    final Map<String, ServletHolder> servlets = collectServlets(licenseManager);
    // add servlet elements
    int position = 1;
    for (Map.Entry<String, ServletHolder> servlet : servlets.entrySet()) {
        final ServletHolder servletHolder = servlet.getValue();
        final String path = servlet.getKey();
        servletHolder.setInitOrder(position++);
        logger.info("Adding servlet {} for {}", new Object[] { servletHolder, path });
        servletContext.addServlet(servletHolder, path);
    }
    contexts.addHandler(servletContext);
    if (StringUtils.isNotBlank(host) && Settings.HttpPort.getValue() > -1) {
        httpConfig = new HttpConfiguration();
        httpConfig.setSecureScheme("https");
        httpConfig.setSecurePort(httpsPort);
        // httpConfig.setOutputBufferSize(8192);
        httpConfig.setRequestHeaderSize(requestHeaderSize);
        final ServerConnector httpConnector = new ServerConnector(server, new HttpConnectionFactory(httpConfig));
        httpConnector.setHost(host);
        httpConnector.setPort(Settings.HttpPort.getValue());
        connectors.add(httpConnector);
    } else {
        logger.warn("Unable to configure HTTP server port, please make sure that {} and {} are set correctly in structr.conf.", Settings.ApplicationHost.getKey(), Settings.HttpPort.getKey());
    }
    if (enableHttps) {
        if (httpsPort > -1 && keyStorePath != null && !keyStorePath.isEmpty() && keyStorePassword != null) {
            httpsConfig = new HttpConfiguration(httpConfig);
            httpsConfig.addCustomizer(new SecureRequestCustomizer());
            final SslContextFactory sslContextFactory = new SslContextFactory();
            sslContextFactory.setKeyStorePath(keyStorePath);
            sslContextFactory.setKeyStorePassword(keyStorePassword);
            final ServerConnector https = new ServerConnector(server, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
            https.setPort(httpsPort);
            https.setIdleTimeout(500000);
            https.setHost(host);
            https.setPort(httpsPort);
            connectors.add(https);
        } else {
            logger.warn("Unable to configure SSL, please make sure that {}, {} and {} are set correctly in structr.conf.", new Object[] { Settings.HttpsPort.getKey(), Settings.KeystorePath.getKey(), Settings.KeystorePassword.getKey() });
        }
    }
    if (!connectors.isEmpty()) {
        server.setConnectors(connectors.toArray(new Connector[0]));
    } else {
        logger.error("No connectors configured, aborting.");
        System.exit(0);
    }
    server.setStopTimeout(1000);
    server.setStopAtShutdown(true);
    return true;
}