Examples with Tls org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.netconf.callhome.server.rev201015.netconf.callhome.server.allowed.devices.device.transport.Tls used on opensource projects

Example 6 with Tls

use of org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.netconf.callhome.server.rev201015.netconf.callhome.server.allowed.devices.device.transport.Tls in project bgpcep by opendaylight.

the class AbstractPCEPSessionNegotiator method handleMessageStartTlsWait.

private boolean handleMessageStartTlsWait(final Message msg) {
    if (msg instanceof Starttls) {
        final SslContextFactory sslFactory = new SslContextFactory(this.tlsConfiguration);
        final SSLContext sslContext = sslFactory.getServerContext();
        if (sslContext == null) {
            this.sendErrorMessage(PCEPErrors.NOT_POSSIBLE_WITHOUT_TLS);
            negotiationFailed(new IllegalStateException("Failed to establish a TLS connection."));
            this.state = State.FINISHED;
            return true;
        }
        final SSLEngine engine = sslContext.createSSLEngine();
        engine.setNeedClientAuth(true);
        engine.setUseClientMode(false);
        this.channel.pipeline().addFirst(new SslHandler(engine));
        LOG.info("PCEPS TLS connection with peer: {} established succesfully.", this.channel);
        startNegotiationWithOpen();
        return true;
    } else if (!(msg instanceof Pcerr)) {
        this.sendErrorMessage(PCEPErrors.NON_STARTTLS_MSG_RCVD);
        negotiationFailed(new IllegalStateException("Unexpected message recieved."));
        this.state = State.FINISHED;
        return true;
    }
    return false;
}

Example 7 with Tls

use of org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.netconf.callhome.server.rev201015.netconf.callhome.server.allowed.devices.device.transport.Tls in project openflowplugin by opendaylight.

the class OFFrameDecoder method exceptionCaught.

@Override
public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
    if (cause instanceof io.netty.handler.ssl.NotSslRecordException) {
        LOG.warn("Not an TLS record exception - please verify TLS configuration.");
    } else {
        LOG.warn("Unexpected exception from downstream.", cause);
    }
    LOG.warn("Closing connection.");
    ctx.close();
    if (tlsPresent) {
        String errorCause = getSslErrorCause(cause);
        LOG.trace("SSL Error info {}", errorCause);
        this.connectionFacade.consume(new SslConnectionErrorBuilder().setInfo(errorCause).build());
    }
}

Example 8 with Tls

use of org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.netconf.callhome.server.rev201015.netconf.callhome.server.allowed.devices.device.transport.Tls in project netconf by opendaylight.

the class NetconfConnectDeviceCommand method execute.

@Override
public Object execute() {
    if (!NetconfCommandUtils.isIpValid(deviceIp) || !NetconfCommandUtils.isPortValid(devicePort)) {
        return "Invalid IP:" + deviceIp + " or Port:" + devicePort + "Please enter a valid entry to proceed.";
    }
    final boolean isTcpOnly = connectionType.equals("true");
    final boolean isSchemaless = schemaless.equals("true");
    final NetconfNodeBuilder netconfNodeBuilder = new NetconfNodeBuilder();
    netconfNodeBuilder.setHost(new Host(new IpAddress(new Ipv4Address(deviceIp)))).setPort(new PortNumber(Uint16.valueOf(Integer.decode(devicePort)))).setTcpOnly(isTcpOnly).setSchemaless(isSchemaless);
    if (isTcpOnly || protocol.equalsIgnoreCase("ssh")) {
        if (Strings.isNullOrEmpty(username) || Strings.isNullOrEmpty(password)) {
            return "Empty Username:" + username + " or Password:" + password + ". In TCP or SSH mode, you must provide valid username and password.";
        }
        final Credentials credentials = new LoginPasswordBuilder().setPassword(password).setUsername(username).build();
        netconfNodeBuilder.setCredentials(credentials);
        if (!isTcpOnly) {
            netconfNodeBuilder.setProtocol(new ProtocolBuilder().setName(Name.SSH).build());
        }
    } else if (protocol.equalsIgnoreCase("tls")) {
        TlsCase tlsCase = null;
        if (!Strings.isNullOrEmpty(excludedTlsVersions)) {
            tlsCase = new TlsCaseBuilder().setTls(new TlsBuilder().setExcludedVersions(Arrays.asList(excludedTlsVersions.split(","))).build()).build();
        }
        netconfNodeBuilder.setProtocol(new ProtocolBuilder().setName(Name.TLS).setSpecification(tlsCase).build());
    } else {
        return "Invalid protocol: " + protocol + ". Only SSH and TLS are supported.";
    }
    service.connectDevice(netconfNodeBuilder.build(), deviceId);
    final String message = "Netconf connector added succesfully";
    return message;
}

Example 9 with Tls

use of org.opendaylight.yang.gen.v1.urn.opendaylight.params.xml.ns.yang.netconf.callhome.server.rev201015.netconf.callhome.server.allowed.devices.device.transport.Tls in project netconf by opendaylight.

the class NetconfKeystoreAdapter method getJavaKeyStore.

/**
 * Using private keys and trusted certificates to create a new JDK <code>KeyStore</code> which
 * will be used by TLS clients to create <code>SSLEngine</code>. The private keys are essential
 * to create JDK <code>KeyStore</code> while the trusted certificates are optional.
 *
 * @param allowedKeys Set of keys to include during KeyStore generation, empty set will creatr
 *                   a KeyStore with all possible keys.
 * @return A JDK KeyStore object
 * @throws GeneralSecurityException If any security exception occurred
 * @throws IOException If there is an I/O problem with the keystore data
 */
public KeyStore getJavaKeyStore(final Set<String> allowedKeys) throws GeneralSecurityException, IOException {
    requireNonNull(allowedKeys);
    final KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(null, null);
    synchronized (privateKeys) {
        if (privateKeys.isEmpty()) {
            throw new KeyStoreException("No keystore private key found");
        }
        for (Map.Entry<String, PrivateKey> entry : privateKeys.entrySet()) {
            if (!allowedKeys.isEmpty() && !allowedKeys.contains(entry.getKey())) {
                continue;
            }
            final java.security.PrivateKey key = getJavaPrivateKey(entry.getValue().getData());
            final List<X509Certificate> certificateChain = getCertificateChain(entry.getValue().getCertificateChain().toArray(new String[0]));
            if (certificateChain.isEmpty()) {
                throw new CertificateException("No certificate chain associated with private key found");
            }
            keyStore.setKeyEntry(entry.getKey(), key, "".toCharArray(), certificateChain.stream().toArray(Certificate[]::new));
        }
    }
    synchronized (trustedCertificates) {
        for (Map.Entry<String, TrustedCertificate> entry : trustedCertificates.entrySet()) {
            final List<X509Certificate> x509Certificates = getCertificateChain(new String[] { entry.getValue().getCertificate() });
            keyStore.setCertificateEntry(entry.getKey(), x509Certificates.get(0));
        }
    }
    return keyStore;
}