io.vertx.core.net.JksOptions Java Examples

/**
 * Tests authentication with the cert auth backend using PEM file
 */
@Test
public void testLoginByCert_usingJKSConfig(TestContext tc) throws VaultException {
  JsonObject config = new JsonObject();
  config.put("host", process.getHost());
  config.put("port", process.getPort());
  config.put("ssl", true);
  JksOptions options = new JksOptions();
  options.setPassword("password").setPath("target/vault/config/ssl/keystore.jks");
  config.put("keyStoreOptions", options.toJson());

  JksOptions jks = new JksOptions()
    .setPassword("password")
    .setPath("target/vault/config/ssl/truststore.jks");
  config.put("trustStoreOptions", jks.toJson());

  client = new SlimVaultClient(vertx, config);

  checkWeCanLoginAndAccessRestrictedSecrets(tc);
}
 

@Test
public void clientSslClientTruststoreTest(TestContext context) {

  this.context = context;
  JksOptions jksOptions = new JksOptions().setPath("/tls/client-truststore.jks");

  MqttClientOptions clientOptions = new MqttClientOptions()
    .setSsl(true)
    .setTrustStoreOptions(jksOptions);

  MqttClient client = MqttClient.create(vertx, clientOptions);
  client.exceptionHandler(t -> context.assertTrue(false));

  Async async = context.async();
  client.connect(MQTT_SERVER_TLS_PORT, MQTT_SERVER_HOST, s -> client.disconnect(d -> async.countDown()));
  async.await();
}
 

public ClientFactory(Vertx vertx) {

        this.vertx = vertx;


        String path = System.getenv("HOME") + System.getenv("AMQ_NAME") + "/etc";

        JksOptions clientJksOptions = new JksOptions();
        clientJksOptions
            .setPath(path + "/enmasse-keystore.jks")
            .setPassword("enmasse");

        PfxOptions clientPfxOptions = new PfxOptions()
            .setPath(path + "/enmasse-truststore.jks")
            .setPassword("enmasse");

        this.protonClientOptions =  new ProtonClientOptions()
            .setSsl(true)
            .setHostnameVerificationAlgorithm("")
            .setKeyStoreOptions(clientJksOptions)
            .setPfxTrustOptions(clientPfxOptions);

    }
 

public void runSSHServiceWithShiro(Vertx vertx) throws Exception {
  ShellService service = ShellService.create(vertx,
    new ShellServiceOptions().setSSHOptions(
      new SSHTermOptions().
        setHost("localhost").
        setPort(5000).
        setKeyPairOptions(new JksOptions().
          setPath("server-keystore.jks").
          setPassword("wibble")
        ).
        setAuthOptions(
          new JsonObject()
            .put("provider", "shiro")
            .put("type", "PROPERTIES")
            .put("config", new JsonObject().
              put("properties_path", "file:/path/to/my/auth.properties"))
        )
    )
  );
  service.start();
}
 

public void runSSHServiceWithMongo(Vertx vertx) throws Exception {
  ShellService service = ShellService.create(vertx,
    new ShellServiceOptions().setSSHOptions(
      new SSHTermOptions().
        setHost("localhost").
        setPort(5000).
        setKeyPairOptions(new JksOptions().
          setPath("server-keystore.jks").
          setPassword("wibble")
        ).
        setAuthOptions(new JsonObject()
          .put("provider", "mongo")
          .put("config", new JsonObject().put("connection_string", "mongodb://localhost:27018"))
        )
    )
  );
  service.start();
}
 

public void runSSHServiceWithJDBC(Vertx vertx) throws Exception {
  ShellService service = ShellService.create(vertx,
    new ShellServiceOptions().setSSHOptions(
      new SSHTermOptions().
        setHost("localhost").
        setPort(5000).
        setKeyPairOptions(new JksOptions().
          setPath("server-keystore.jks").
          setPassword("wibble")
        ).
        setAuthOptions(new JsonObject()
          .put("provider", "jdbc")
          .put("config", new JsonObject()
            .put("url", "jdbc:hsqldb:mem:test?shutdown=true")
            .put("driver_class", "org.hsqldb.jdbcDriver"))
        )
    )
  );
  service.start();
}
 

@Test
public void testExternalAuthProviderFails(TestContext context) throws Exception {
  AtomicInteger count = new AtomicInteger();
  authProvider = (authInfo, resultHandler) -> {
    count.incrementAndGet();
    resultHandler.handle(Future.failedFuture("not authenticated"));
  };
  termHandler = term -> {
    context.fail();
  };
  startShell(new SSHTermOptions().setPort(5000).setHost("localhost").setKeyPairOptions(
    new JksOptions().setPath("src/test/resources/server-keystore.jks").setPassword("wibble")));
  Session session = createSession("paulo", "anothersecret", false);
  try {
    session.connect();
    context.fail("Was not expected to login");
  } catch (JSchException e) {
    assertEquals("Auth cancel", e.getMessage());
  }
  context.assertEquals(1, count.get());
}
 

@Test
public void testDifferentCharset(TestContext context) throws Exception {
  termHandler = term -> {
    term.write("\u20AC");
    term.close();
  };
  startShell(new SSHTermOptions().setDefaultCharset("ISO_8859_1").setPort(5000).setHost("localhost").setKeyPairOptions(
    new JksOptions().setPath("src/test/resources/server-keystore.jks").setPassword("wibble")).
    setAuthOptions(new JsonObject()
      .put("provider", "shiro")
      .put("type", "PROPERTIES")
      .put("config",
        new JsonObject().put("properties_path", "classpath:test-auth.properties"))));
  Session session = createSession("paulo", "secret", false);
  session.connect();
  Channel channel = session.openChannel("shell");
  channel.connect();
  InputStream in = channel.getInputStream();
  int b = in.read();
  context.assertEquals(63, b);
}
 

@Test
public void testKeymapFromFilesystem() throws Exception {
  URL url = TermServer.class.getResource(SSHTermOptions.DEFAULT_INPUTRC);
  File f = new File(url.toURI());
  termHandler = Term::close;
  startShell(new SSHTermOptions().setIntputrc(f.getAbsolutePath()).setPort(5000).setHost("localhost").setKeyPairOptions(
    new JksOptions().setPath("src/test/resources/server-keystore.jks").setPassword("wibble")).
    setAuthOptions(new JsonObject()
      .put("provider", "shiro")
      .put("type", "PROPERTIES")
      .put("config",
        new JsonObject().put("properties_path", "classpath:test-auth.properties"))));
  Session session = createSession("paulo", "secret", false);
  session.connect();
  Channel channel = session.openChannel("shell");
  channel.connect();
}
 

@Override
protected JsonObject getRetrieverConfiguration() {

  JsonObject config = new JsonObject();
  config.put("host", process.getHost());
  config.put("port", process.getPort());
  config.put("ssl", true);
  PemKeyCertOptions options = new PemKeyCertOptions()
    .addCertPath("target/vault/config/ssl/client-cert.pem")
    .addKeyPath("target/vault/config/ssl/client-privatekey.pem");
  config.put("pemKeyCertOptions", options.toJson());

  PemTrustOptions trust = new PemTrustOptions()
    .addCertPath("target/vault/config/ssl/cert.pem");
  config.put("pemTrustStoreOptions", trust.toJson());

  JksOptions jks = new JksOptions()
    .setPath("target/vault/config/ssl/truststore.jks");
  config.put("trustStoreOptions", jks.toJson());

  config.put("auth-backend", "cert");

  return config;
}
 

/**
 * Tests authentication with the cert auth backend using PEM file
 */
@Test
public void testLoginByCert_usingPemConfig(TestContext tc) throws VaultException {
  JsonObject config = new JsonObject();
  config.put("host", process.getHost());
  config.put("port", process.getPort());
  config.put("ssl", true);
  PemKeyCertOptions options = new PemKeyCertOptions()
    .addCertPath("target/vault/config/ssl/client-cert.pem")
    .addKeyPath("target/vault/config/ssl/client-privatekey.pem");
  config.put("pemKeyCertOptions", options.toJson());

  PemTrustOptions trust = new PemTrustOptions()
    .addCertPath("target/vault/config/ssl/cert.pem");
  config.put("pemTrustStoreOptions", trust.toJson());

  JksOptions jks = new JksOptions()
    .setPath("target/vault/config/ssl/truststore.jks");
  config.put("trustStoreOptions", jks.toJson());

  client = new SlimVaultClient(vertx, config);

  checkWeCanLoginAndAccessRestrictedSecrets(tc);
}
 

public static NetServerOptions getNetServerOptions(EncryptionOptions eo) {
    if (eo == null) {
        return new NetServerOptions();
    }
    NetServerOptions options = new NetServerOptions().setSsl(true);
    options.setKeyStoreOptions(new JksOptions().setPath(eo.keystore).setPassword(eo.keystore_password));

    if (eo.truststore != null) {
        if (eo.require_client_auth) {
            options.setClientAuth(ClientAuth.REQUIRED);
        }
        options.setTrustStoreOptions(new JksOptions().setPath(eo.truststore).setPassword(eo.truststore_password));
    }

    if (eo.cipher_suites != null) {
        for (String cipherSuitee : eo.cipher_suites)
            options.addEnabledCipherSuite(cipherSuitee);
    }
    return options;
}
 

public void connectSsl(Vertx vertx) {

    DB2ConnectOptions options = new DB2ConnectOptions()
      .setPort(50001)
      .setHost("the-host")
      .setDatabase("the-db")
      .setUser("user")
      .setPassword("secret")
      .setSsl(true)
      .setTrustStoreOptions(new JksOptions()
          .setPath("/path/to/keystore.p12")
          .setPassword("keystoreSecret"));

    DB2Connection.connect(vertx, options, res -> {
      if (res.succeeded()) {
        // Connected with SSL
      } else {
        System.out.println("Could not connect " + res.cause());
      }
    });
  }
 

public static NetClientOptions getNetClientOptions(EncryptionOptions eo) {
    if (eo == null) {
        return new NetClientOptions();
    }
    NetClientOptions options = new NetClientOptions().setSsl(true);
    options.setKeyStoreOptions(new JksOptions().setPath(eo.keystore).setPassword(eo.keystore_password));

    if (eo.truststore != null) {
        options.setTrustStoreOptions(new JksOptions().setPath(eo.truststore).setPassword(eo.truststore_password));
    }

    if (eo.cipher_suites != null) {
        for (String cipherSuitee : eo.cipher_suites)
            options.addEnabledCipherSuite(cipherSuitee);
    }
    return options;
}
 

@Test
public void testHttp2EnabledSsl() throws ExecutionException, InterruptedException {
    Assumptions.assumeTrue(JdkSSLEngineOptions.isAlpnAvailable()); //don't run on JDK8
    Vertx vertx = Vertx.vertx();
    try {
        WebClientOptions options = new WebClientOptions()
                .setUseAlpn(true)
                .setProtocolVersion(HttpVersion.HTTP_2)
                .setSsl(true)
                .setKeyStoreOptions(
                        new JksOptions().setPath("src/test/resources/client-keystore.jks").setPassword("password"))
                .setTrustStoreOptions(
                        new JksOptions().setPath("src/test/resources/client-truststore.jks").setPassword("password"));

        WebClient client = WebClient.create(vertx, options);
        int port = sslUrl.getPort();

        runTest(client, port);

    } finally {
        vertx.close();
    }
}
 

private static BasicHttpClient createBasicHttpClient(Vertx vertx, int maxPoolSize, int connectTimeoutMs,
                                                     boolean useCompression, int maxRedirects, boolean ssl,
                                                     String jksPath, String jksPassword) {

    final HttpClientOptions options = new HttpClientOptions()
            .setMaxPoolSize(maxPoolSize)
            .setTryUseCompression(useCompression)
            .setConnectTimeout(connectTimeoutMs)
            // Vert.x's HttpClientRequest needs this value to be 2 for redirections to be followed once,
            // 3 for twice, and so on
            .setMaxRedirects(maxRedirects + 1);

    if (ssl) {
        final JksOptions jksOptions = new JksOptions()
                .setPath(jksPath)
                .setPassword(jksPassword);

        options
                .setSsl(true)
                .setKeyStoreOptions(jksOptions);
    }
    return new BasicHttpClient(vertx, vertx.createHttpClient(options));
}
 

@Provides
@Singleton
public HttpServer vertxServer(Vertx vertx, Configuration conf, Router router, VertxRequestHandler restHandler)
{
    HttpServerOptions options = new HttpServerOptions().setLogActivity(true);

    if (conf.isSslEnabled())
    {
        options.setKeyStoreOptions(new JksOptions()
                                   .setPath(conf.getKeyStorePath())
                                   .setPassword(conf.getKeystorePassword()))
               .setSsl(conf.isSslEnabled());

        if (conf.getTrustStorePath() != null && conf.getTruststorePassword() != null)
        {
            options.setTrustStoreOptions(new JksOptions()
                                         .setPath(conf.getTrustStorePath())
                                         .setPassword(conf.getTruststorePassword()));
        }
    }

    router.route().pathRegex(".*").handler(rc -> restHandler.handle(rc.request()));

    return vertx.createHttpServer(options)
                .requestHandler(router);
}
 

public void exampleWithCerts(Vertx vertx) {
  JsonObject vault_config = new JsonObject();

  // ...

  PemKeyCertOptions certs = new PemKeyCertOptions()
    .addCertPath("target/vault/config/ssl/client-cert.pem")
    .addKeyPath("target/vault/config/ssl/client-privatekey.pem");
  vault_config.put("pemKeyCertOptions", certs.toJson());

  PemTrustOptions trust = new PemTrustOptions()
    .addCertPath("target/vault/config/ssl/cert.pem");
  vault_config.put("pemTrustStoreOptions", trust.toJson());

  JksOptions jks = new JksOptions()
    .setPath("target/vault/config/ssl/truststore.jks");
  vault_config.put("trustStoreOptions", jks.toJson());

  vault_config.put("auth-backend", "cert");

  // Path to the secret to read.
  vault_config.put("path", "secret/my-secret");

  ConfigStoreOptions store = new ConfigStoreOptions()
    .setType("vault")
    .setConfig(vault_config);

  ConfigRetriever retriever = ConfigRetriever.create(vertx,
    new ConfigRetrieverOptions().addStore(store));
}
 

private static JksOptions toJksOptions(JksConfiguration configuration) {
    JksOptions jksOptions = new JksOptions();
    if (configuration.path.isPresent()) {
        jksOptions.setPath(configuration.path.get());
    }
    if (configuration.password.isPresent()) {
        jksOptions.setPassword(configuration.password.get());
    }
    return jksOptions;
}
 

@Test
public void shouldSetJksTrustOptions() {
    given(mockSsl.getTrustStoreType()).willReturn("JKS");
    given(mockSsl.getTrustStore()).willReturn("/trust/store/path");
    given(mockSsl.getTrustStorePassword()).willReturn("pass");

    customizer.apply(mockHttpServerOptions);

    ArgumentCaptor<JksOptions> captor = ArgumentCaptor.forClass(JksOptions.class);
    verify(mockHttpServerOptions).setTrustOptions(captor.capture());

    JksOptions jksOptions = captor.getValue();
    assertThat(jksOptions.getPath()).isEqualTo("/trust/store/path");
    assertThat(jksOptions.getPassword()).isEqualTo("pass");
}
 

public HttpServerOptions getServerOptions(JsonObject config) {
    if (!new File(KeyUtil.DEMO_KEYSTTORE).exists()) {
        KeyUtil.generateKey(); // only for demo, create keystore
    }
    return new HttpServerOptions().
            setKeyStoreOptions(new JksOptions().setPath(KeyUtil.DEMO_KEYSTTORE).setPassword(KeyUtil.DEMO_PWD)).
            setSsl(true);
}
 

@Test
public void shouldSetJksKeyCert() {
    given(mockSsl.getKeyStoreType()).willReturn("JKS");
    given(mockSsl.getKeyStore()).willReturn("/key/store/path");
    given(mockSsl.getKeyStorePassword()).willReturn("pass");

    customizer.apply(mockHttpServerOptions);

    ArgumentCaptor<JksOptions> captor = ArgumentCaptor.forClass(JksOptions.class);
    verify(mockHttpServerOptions).setKeyCertOptions(captor.capture());

    JksOptions jksOptions = captor.getValue();
    assertThat(jksOptions.getPath()).isEqualTo("/key/store/path");
    assertThat(jksOptions.getPassword()).isEqualTo("pass");
}
 

/**
 * get the key store filename to be used when opening SMTP connections
 *
 * @return the keyStore
 * @deprecated use {@link #getTrustStoreOptions}
 */
@Deprecated
public String getKeyStore() {
  // Get the trust store options and if there are any get the path
  String keyStore = null;
  JksOptions options = getTrustStoreOptions();
  if (options != null) {
    keyStore = options.getPath();
  }
  return keyStore;
}
 

/**
 * get the key store password to be used when opening SMTP connections
 *
 * @return the keyStorePassword
 * @deprecated use {@link #getTrustStoreOptions}
 */
@Deprecated
public String getKeyStorePassword() {
  // Get the trust store options and if there are any get the password
  String keyStorePassword = null;
  JksOptions options = getTrustStoreOptions();
  if (options != null) {
    keyStorePassword = options.getPassword();
  }
  return keyStorePassword;
}
 

protected void startShell() throws Exception {
  startShell(new SSHTermOptions().setPort(5000).setHost("localhost").setKeyPairOptions(
    new JksOptions().setPath("src/test/resources/server-keystore.jks").setPassword("wibble")).
    setAuthOptions(new JsonObject()
      .put("provider", "shiro")
      .put("type", "PROPERTIES")
      .put("config",
        new JsonObject().put("properties_path", "classpath:test-auth.properties"))));
}
 

@Test
public void testNoAuthenticationConfigured() throws Exception {
  try {
    startShell(new SSHTermOptions().setPort(5000).setHost("localhost").setKeyPairOptions(
      new JksOptions().setPath("src/test/resources/server-keystore.jks").setPassword("wibble"))
    );
    fail();
  } catch (ExecutionException e) {
    assertTrue(e.getCause() instanceof VertxException);
    assertEquals("No authenticator", e.getCause().getMessage());
  }
}
 

public static void main(String[] args) {
    // TODO start a vertx instance
    // deploy verticles / one per resource in this case

    Json.mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);

    Vertx vertx = Vertx.vertx();

    HttpClientOptions clientOptions = new HttpClientOptions()
            .setSsl(true)
            .setTrustStoreOptions(new JksOptions()
                    .setPath(System.getProperty("javax.net.ssl.trustStore"))
                    .setPassword(System.getProperty("javax.net.ssl.trustStorePassword")));
    HttpClient httpClient = vertx.createHttpClient(clientOptions);

    Router router = Router.router(vertx);
    AuthHandler auth = new BearerAuthHandler(new FacebookOauthTokenVerifier(httpClient));
    router.route("/*").handler(auth);

    HelloResource helloResource = new HelloResource(httpClient);
    router.get("/hello").produces("text/plain").handler(helloResource::hello);

    CarRepository carRepository = new InMemoryCarRepository();
    CarsResource carsResource = new CarsResource(carRepository);
    router.route("/cars*").handler(BodyHandler.create());
    router.get("/cars").produces("application/json").handler(carsResource::all);
    router.post("/cars").consumes("application/json").handler(carsResource::create);

    CarResource carResource = new CarResource(carRepository);
    router.get("/cars/:id").produces("application/json").handler(carResource::byId);

    HttpServerOptions serverOptions = new HttpServerOptions()
            .setSsl(true)
            .setKeyStoreOptions(new JksOptions()
                    .setPath(System.getProperty("javax.net.ssl.keyStorePath"))
                    .setPassword(System.getProperty("javax.net.ssl.keyStorePassword")))
            .setPort(8090);
    HttpServer server = vertx.createHttpServer(serverOptions);
    server.requestHandler(router::accept).listen();
}
 

public static HttpClientOptions parseTlsOptions(TLSOptions tlsOptions, URI apiEndpoint) {
    HttpClientOptions clientOptions = new HttpClientOptions();

    if (apiEndpoint.getScheme().equals("http")) { //$NON-NLS-1$
        return clientOptions.setSsl(false);
    } else {
        clientOptions.setSsl(true);
    }

    clientOptions.setTrustAll(tlsOptions.isTrustSelfSigned() || tlsOptions.isDevMode())
        .setVerifyHost(!(tlsOptions.isAllowAnyHost() || tlsOptions.isDevMode()));

    if (tlsOptions.getTrustStore() != null) {
        clientOptions.setTrustStoreOptions(
            new JksOptions().setPath(tlsOptions.getTrustStore()).setPassword(tlsOptions.getTrustStorePassword())
        );
    }

    if (tlsOptions.getKeyStore() != null) {
        clientOptions.setKeyStoreOptions(
            new JksOptions().setPath(tlsOptions.getKeyStore()).setPassword(tlsOptions.getKeyStorePassword())
        );
    }

    if (tlsOptions.getAllowedCiphers() != null) {
        String[] ciphers = arrayDifference(tlsOptions.getAllowedCiphers(), tlsOptions.getDisallowedCiphers(), getDefaultCipherSuites());
        for (String cipher : ciphers) {
            clientOptions.addEnabledCipherSuite(cipher);
        }
    }

    if (tlsOptions.getAllowedProtocols() != null) {
        log.info("Can't set allowed protocols on Vert.x gateway"); //$NON-NLS-1$
    }

    return clientOptions;
}
 

@Override
public void start(Future<Void> startFuture) {
    super.start(startFuture);

    HttpApiFactory.init(engine.getApiRequestPathParser());

    InheritingHttpServerOptions httpsServerOptions = new InheritingHttpServerOptions();
    httpsServerOptions
        .setSsl(true)
        .setKeyStoreOptions(
                new JksOptions()
                    .setPath(apimanConfig.getKeyStore())
                    .setPassword(apimanConfig.getKeyStorePassword())
                )
        .setTrustStoreOptions(
                new JksOptions()
                    .setPath(apimanConfig.getTrustStore())
                    .setPassword(apimanConfig.getTrustStorePassword())
                );
    addAllowedSslTlsProtocols(httpsServerOptions);

    if (JdkSSLEngineOptions.isAlpnAvailable()) {
        httpsServerOptions.setUseAlpn(true);
    }

    // Load any provided configuration into the HttpServerOptions.
    JsonObject httpServerOptionsJson = apimanConfig.getVerticleConfig(verticleType().name())
            .getJsonObject("httpServerOptions", new JsonObject()); //$NON-NLS-1$
    InheritingHttpServerOptionsConverter.fromJson(httpServerOptionsJson, httpsServerOptions);

    vertx.createHttpServer(httpsServerOptions)
        .requestHandler(this::requestHandler)
        .listen(apimanConfig.getPort(VERTICLE_TYPE),
                apimanConfig.getHostname());
}
 

private JksOptions getJksOptions(String key, String defaultResource) {
    JsonObject config = config()
            .getJsonObject(key, new JsonObject());
    JksOptions jksOptions = new JksOptions()
            .setPassword(config.getString("password", "secret"))
            .setValue(getResource(config.getString("resourceName", defaultResource)));
    return jksOptions;
}