Examples with EncryptionArtifactFactory org.jivesoftware.openfire.spi.EncryptionArtifactFactory used on opensource projects

Example 1 with EncryptionArtifactFactory

use of org.jivesoftware.openfire.spi.EncryptionArtifactFactory in project Openfire by igniterealtime.

the class AdminConsolePlugin method startup.

/**
     * Starts the Jetty instance.
     */
public void startup() {
    restartNeeded = false;
    // Add listener for certificate events
    certificateListener = new CertificateListener();
    CertificateManager.addListener(certificateListener);
    // the number of threads allocated to each connector/port
    int serverThreads = JiveGlobals.getXMLProperty("adminConsole.serverThreads", 2);
    adminPort = JiveGlobals.getXMLProperty("adminConsole.port", 9090);
    adminSecurePort = JiveGlobals.getXMLProperty("adminConsole.securePort", 9091);
    final QueuedThreadPool tp = new QueuedThreadPool();
    tp.setName("Jetty-QTP-AdminConsole");
    adminServer = new Server(tp);
    if (JMXManager.isEnabled()) {
        JMXManager jmx = JMXManager.getInstance();
        adminServer.addBean(jmx.getContainer());
    }
    // Create connector for http traffic if it's enabled.
    if (adminPort > 0) {
        final HttpConfiguration httpConfig = new HttpConfiguration();
        // Do not send Jetty info in HTTP headers
        httpConfig.setSendServerVersion(false);
        final ServerConnector httpConnector = new ServerConnector(adminServer, null, null, null, -1, serverThreads, new HttpConnectionFactory(httpConfig));
        // Listen on a specific network interface if it has been set.
        String bindInterface = getBindInterface();
        httpConnector.setHost(bindInterface);
        httpConnector.setPort(adminPort);
        adminServer.addConnector(httpConnector);
    }
    // Create a connector for https traffic if it's enabled.
    sslEnabled = false;
    try {
        IdentityStore identityStore = null;
        if (XMPPServer.getInstance().getCertificateStoreManager() == null) {
            Log.warn("Admin console: CertifcateStoreManager has not been initialized yet. HTTPS will be unavailable.");
        } else {
            identityStore = XMPPServer.getInstance().getCertificateStoreManager().getIdentityStore(ConnectionType.WEBADMIN);
        }
        if (identityStore != null && adminSecurePort > 0) {
            if (identityStore.getAllCertificates().isEmpty()) {
                Log.warn("Admin console: Identity store does not have any certificates. HTTPS will be unavailable.");
            } else {
                if (!identityStore.containsDomainCertificate("RSA")) {
                    Log.warn("Admin console: Using RSA certificates but they are not valid for the hosted domain");
                }
                final ConnectionManagerImpl connectionManager = ((ConnectionManagerImpl) XMPPServer.getInstance().getConnectionManager());
                final ConnectionConfiguration configuration = connectionManager.getListener(ConnectionType.WEBADMIN, true).generateConnectionConfiguration();
                final SslContextFactory sslContextFactory = new EncryptionArtifactFactory(configuration).getSslContextFactory();
                final ServerConnector httpsConnector;
                if ("npn".equals(JiveGlobals.getXMLProperty("spdy.protocol", ""))) {
                    httpsConnector = new HTTPSPDYServerConnector(adminServer, sslContextFactory);
                } else {
                    final HttpConfiguration httpsConfig = new HttpConfiguration();
                    httpsConfig.setSendServerVersion(false);
                    httpsConfig.setSecureScheme("https");
                    httpsConfig.setSecurePort(adminSecurePort);
                    httpsConfig.addCustomizer(new SecureRequestCustomizer());
                    final HttpConnectionFactory httpConnectionFactory = new HttpConnectionFactory(httpsConfig);
                    final SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(sslContextFactory, org.eclipse.jetty.http.HttpVersion.HTTP_1_1.toString());
                    httpsConnector = new ServerConnector(adminServer, null, null, null, -1, serverThreads, sslConnectionFactory, httpConnectionFactory);
                }
                final String bindInterface = getBindInterface();
                httpsConnector.setHost(bindInterface);
                httpsConnector.setPort(adminSecurePort);
                adminServer.addConnector(httpsConnector);
                sslEnabled = true;
            }
        }
    } catch (Exception e) {
        Log.error("An exception occurred while trying to make available the admin console via HTTPS.", e);
    }
    // Make sure that at least one connector was registered.
    if (adminServer.getConnectors() == null || adminServer.getConnectors().length == 0) {
        adminServer = null;
        // Log warning.
        log(LocaleUtils.getLocalizedString("admin.console.warning"));
        return;
    }
    HandlerCollection collection = new HandlerCollection();
    adminServer.setHandler(collection);
    collection.setHandlers(new Handler[] { contexts, new DefaultHandler() });
    try {
        adminServer.start();
        // Log the ports that the admin server is listening on.
        logAdminConsolePorts();
    } catch (Exception e) {
        Log.error("Could not start admin console server", e);
    }
}

Example 2 with EncryptionArtifactFactory

use of org.jivesoftware.openfire.spi.EncryptionArtifactFactory in project Openfire by igniterealtime.

the class HttpBindManager method createSSLConnector.

private void createSSLConnector(int securePort) {
    httpsConnector = null;
    try {
        final IdentityStore identityStore = XMPPServer.getInstance().getCertificateStoreManager().getIdentityStore(ConnectionType.BOSH_C2S);
        if (securePort > 0 && identityStore.getStore().aliases().hasMoreElements()) {
            if (!identityStore.containsDomainCertificate("RSA")) {
                Log.warn("HTTP binding: Using RSA certificates but they are not valid for " + "the hosted domain");
            }
            final ConnectionManagerImpl connectionManager = ((ConnectionManagerImpl) XMPPServer.getInstance().getConnectionManager());
            final ConnectionConfiguration configuration = connectionManager.getListener(ConnectionType.BOSH_C2S, true).generateConnectionConfiguration();
            final SslContextFactory sslContextFactory = new EncryptionArtifactFactory(configuration).getSslContextFactory();
            final HttpConfiguration httpsConfig = new HttpConfiguration();
            httpsConfig.setSecureScheme("https");
            httpsConfig.setSecurePort(securePort);
            configureProxiedConnector(httpsConfig);
            httpsConfig.addCustomizer(new SecureRequestCustomizer());
            final ServerConnector sslConnector;
            if ("npn".equals(JiveGlobals.getXMLProperty("spdy.protocol", ""))) {
                sslConnector = new HTTPSPDYServerConnector(httpBindServer, sslContextFactory);
            } else {
                sslConnector = new ServerConnector(httpBindServer, new SslConnectionFactory(sslContextFactory, "http/1.1"), new HttpConnectionFactory(httpsConfig));
            }
            sslConnector.setHost(getBindInterface());
            sslConnector.setPort(securePort);
            httpsConnector = sslConnector;
        }
    } catch (Exception e) {
        Log.error("Error creating SSL connector for Http bind", e);
    }
}

Example 3 with EncryptionArtifactFactory

use of org.jivesoftware.openfire.spi.EncryptionArtifactFactory in project Openfire by igniterealtime.

the class NIOConnection method startTLS.

public void startTLS(boolean clientMode) throws Exception {
    final EncryptionArtifactFactory factory = new EncryptionArtifactFactory(configuration);
    final SslFilter filter;
    if (clientMode) {
        filter = factory.createClientModeSslFilter();
    } else {
        filter = factory.createServerModeSslFilter();
    }
    ioSession.getFilterChain().addBefore(EXECUTOR_FILTER_NAME, TLS_FILTER_NAME, filter);
    ioSession.setAttribute(SslFilter.DISABLE_ENCRYPTION_ONCE, Boolean.TRUE);
    if (!clientMode) {
        // Indicate the client that the server is ready to negotiate TLS
        deliverRawText("<proceed xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\"/>");
    }
}