Skip to content

Commit

Permalink
in case of SchemaRegistryBrowserController setup an exception (f.e. C…
Browse files Browse the repository at this point in the history 
…onnectException) the setup method could not load a getWindow witch leads to a NPE which masks the real cause - added flag for suppress cert path validation for schema-registry
  • Loading branch information
Bernhard Haring committed Nov 3, 2022
1 parent b7c54e1 commit e18a8b3
Show file tree
Hide file tree
Showing 4 changed files with 57 additions and 19 deletions.
6 changes: 3 additions & 3 deletions src/main/java/at/esque/kafka/SchemaRegistryBrowserController.java
View file
Expand Up @@ -47,7 +47,7 @@ public class SchemaRegistryBrowserController {
public void setup(ClusterConfig selectedConfig, ConfigHandler configHandler) {
schemaRegistryRestService = new RestService(selectedConfig.getSchemaRegistry());

if (selectedConfig.isSchemaRegistryUseSsl()) {
if (selectedConfig.isSchemaRegistryUseSsl() || selectedConfig.isSchemaRegistrySuppressCertPathValidation()) {
SSLSocketFactory sslSocketFactory = SslSocketFactoryCreator.buildSSlSocketFactory(selectedConfig, configHandler);
schemaRegistryRestService.setSslSocketFactory(sslSocketFactory);
}
Expand Down Expand Up @@ -84,14 +84,14 @@ public void setup(ClusterConfig selectedConfig, ConfigHandler configHandler) {
versionComboBox.getSelectionModel().select(versionComboBox.getItems().size() - 1);
}
} catch (Exception e) {
ErrorAlert.show(e, getWindow());
ErrorAlert.show(e);
}
});

subjectListView.setItems(FXCollections.observableArrayList(schemaRegistryRestService.getAllSubjects()));

} catch (Exception e) {
ErrorAlert.show(e, getWindow());
ErrorAlert.show(e);
}
}

Expand Down
14 changes: 14 additions & 0 deletions src/main/java/at/esque/kafka/cluster/ClusterConfig.java
View file
Expand Up @@ -16,6 +16,7 @@ public class ClusterConfig {
private StringProperty schemaRegistryBasicAuthUserInfo = new SimpleStringProperty();
private BooleanProperty schemaRegistryUseSsl = new SimpleBooleanProperty();
private BooleanProperty sslEnabled = new SimpleBooleanProperty();
private BooleanProperty certPathValidationSuppressed = new SimpleBooleanProperty();
private StringProperty keyStoreLocation = new SimpleStringProperty();
private StringProperty keyStorePassword = new SimpleStringProperty();
private StringProperty trustStoreLocation = new SimpleStringProperty();
Expand Down Expand Up @@ -43,6 +44,7 @@ public void update(ClusterConfig existingConfig) {
this.setSchemaRegistry(existingConfig.getSchemaRegistry());
this.setSchemaRegistryBasicAuthUserInfo(existingConfig.getSchemaRegistryBasicAuthUserInfo());
this.setSchemaRegistryUseSsl(existingConfig.isSchemaRegistryUseSsl());
this.setSchemaRegistrySuppressCertPathValidation(existingConfig.isSchemaRegistrySuppressCertPathValidation());
this.setSslEnabled(existingConfig.isSslEnabled());
this.setKeyStoreLocation(existingConfig.getKeyStoreLocation());
this.setKeyStorePassword(existingConfig.getKeyStorePassword());
Expand Down Expand Up @@ -111,6 +113,18 @@ public void setSslEnabled(boolean sslEnabled) {
this.sslEnabled.set(sslEnabled);
}

@JsonProperty("certPathValidationSuppressed")
public boolean isSchemaRegistrySuppressCertPathValidation() {
return certPathValidationSuppressed.get();
}
public BooleanProperty suppressCertPathValidation() {
return certPathValidationSuppressed;
}

public void setSchemaRegistrySuppressCertPathValidation(boolean suppressCertPathValidation) {
this.certPathValidationSuppressed.set(suppressCertPathValidation);
}

@JsonProperty("keyStoreLocation")
public String getKeyStoreLocation() {
return keyStoreLocation.get();
Expand Down
49 changes: 34 additions & 15 deletions src/main/java/at/esque/kafka/cluster/SslSocketFactoryCreator.java
View file
Expand Up @@ -3,10 +3,7 @@
import at.esque.kafka.handlers.ConfigHandler;
import org.apache.kafka.common.config.SslConfigs;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.*;
import java.io.FileInputStream;
import java.io.IOException;
import java.security.KeyManagementException;
Expand All @@ -15,34 +12,56 @@
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Map;

public class SslSocketFactoryCreator {

private SslSocketFactoryCreator() {
}

private static final TrustManager[] UNQUESTIONING_TRUST_MANAGER = new TrustManager[]{
new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
return null;
}
public void checkClientTrusted(X509Certificate[] certs, String authType) {
}
public void checkServerTrusted(X509Certificate[] certs, String authType) {
}
}
};

public static SSLSocketFactory buildSSlSocketFactory(ClusterConfig clusterConfig, ConfigHandler configHandler) {
try {
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
Map<String, String> sslProperties = configHandler.getSslProperties(clusterConfig);
ks.load(new FileInputStream(sslProperties.get(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG)), sslProperties.get(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG).toCharArray());

KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
ts.load(new FileInputStream(sslProperties.get(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG)), sslProperties.get(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG).toCharArray());
SSLContext sc = SSLContext.getInstance("TLSv1.2");

KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(ks, sslProperties.get(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG).toCharArray());
if (clusterConfig.isSchemaRegistrySuppressCertPathValidation()) {
sc.init(null, UNQUESTIONING_TRUST_MANAGER, null);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ts);
}
if (clusterConfig.isSchemaRegistryUseSsl()) {
ks.load(new FileInputStream(sslProperties.get(SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG)), sslProperties.get(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG).toCharArray());

SSLContext sc = SSLContext.getInstance("TLSv1.2");
sc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
ts.load(new FileInputStream(sslProperties.get(SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG)), sslProperties.get(SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG).toCharArray());

return sc.getSocketFactory();
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(ks, sslProperties.get(SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG).toCharArray());

} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException | KeyManagementException e) {
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ts);


sc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
}

return sc.getSocketFactory();
} catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException |
UnrecoverableKeyException | KeyManagementException e) {
at.esque.kafka.alerts.ErrorAlert.show(e);
return null;
}
Expand Down
7 changes: 6 additions & 1 deletion src/main/java/at/esque/kafka/dialogs/ClusterConfigDialog.java
View file
Expand Up @@ -33,6 +33,7 @@ public class ClusterConfigDialog {
public static final String LABEL_KAFKA_CONNECT_BASIC_AUTH_USER = "Kafka Connect Basic Auth User";
public static final String LABEL_KAFKA_CONNECT_BASIC_AUTH_PASSWORD = "Kafka Connect Basic Auth Password";
public static final String LABEL_USE_SSL_CONFIGURATION = "use SSL Configuration";
public static final String LABEL_SUPPRESS_CERT_PATH_VALIDATION = "suppress Cert Path Validation";
public static final String LABEL_SUPPRESS_SSL_ENDPOINT_IDENTIFICATION = "no SSL Endpoint Identification";

private ClusterConfigDialog(){}
Expand Down Expand Up @@ -80,7 +81,11 @@ public static Optional<ClusterConfig> show(ClusterConfig existingConfig) {
Field.ofBooleanType(copy.isSchemaRegistryUseSsl())
.label(LABEL_USE_SSL_CONFIGURATION)
.tooltip(LABEL_USE_SSL_CONFIGURATION)
.bind(copy.schemaRegistryUseSslProperty())
.bind(copy.schemaRegistryUseSslProperty()),
Field.ofBooleanType(copy.isSchemaRegistrySuppressCertPathValidation())
.label(LABEL_SUPPRESS_CERT_PATH_VALIDATION)
.tooltip(LABEL_SUPPRESS_CERT_PATH_VALIDATION)
.bind(copy.suppressCertPathValidation())
),
Group.of(
Field.ofStringType(copy.getkafkaConnectUrl()==null?"":copy.getkafkaConnectUrl())
Expand Down

0 comments on commit e18a8b3

Please sign in to comment.