Skip to content

Commit 453d1f6

Browse files
nebhalenebhale
committed
Safenet Luna Security Provider
The change adds a framework for the Safenet Luna Security Provider. This framework is triggered by a service with the name 'luna' in it. It depends on that service having the HSM host, host-certificate, client, and client-certificate. In also expects users to provide a repository with the Luna Client binaries in it. [#96530962][#99962452]
1 parent 9e5b563 commit 453d1f6

38 files changed

+682
-75
lines changed

‎.idea/dictionaries/bhale.xml

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ To learn how to configure various properties of the buildpack, follow the "Confi
5757
* [DynaTrace Agent](docs/framework-dyna_trace_agent.md) ([Configuration](docs/framework-dyna_trace_agent.md#configuration))
5858
* [Java Options](docs/framework-java_opts.md) ([Configuration](docs/framework-java_opts.md#configuration))
5959
* [JRebel Agent](docs/framework-jrebel_agent.md) ([Configuration](docs/framework-jrebel_agent.md#configuration))
60+
* [Luna Security Provider](docs/framework-luna_security_provider.md) ([Configuration](docs/framework-luna_security_provider.md#configuration))
6061
* [MariaDB JDBC](docs/framework-maria_db_jdbc.md) ([Configuration](docs/framework-maria_db_jdbc.md#configuration))
6162
* [New Relic Agent](docs/framework-new_relic_agent.md) ([Configuration](docs/framework-new_relic_agent.md#configuration))
6263
* [Play Framework Auto Reconfiguration](docs/framework-play_framework_auto_reconfiguration.md) ([Configuration](docs/framework-play_framework_auto_reconfiguration.md#configuration))

‎config/components.yml

+1
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ frameworks:
3737
# - "JavaBuildpack::Framework::DynaTraceAgent"
3838
- "JavaBuildpack::Framework::JavaOpts"
3939
- "JavaBuildpack::Framework::JrebelAgent"
40+
# - "JavaBuildpack::Framework::LunaSecurityProvider"
4041
- "JavaBuildpack::Framework::MariaDbJDBC"
4142
- "JavaBuildpack::Framework::NewRelicAgent"
4243
- "JavaBuildpack::Framework::PlayFrameworkAutoReconfiguration"

‎config/luna_security_provider.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Cloud Foundry Java Buildpack
2+
# Copyright (c) 2015 the original author or authors.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# Configuration for the Dynatrace framework
17+
---
18+
version: 5.3.+
19+
repository_root: ""

‎docs/framework-luna_security_provider.md

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Luna Security Provider Framework
2+
The Luna Security Provider Framework causes an application to be automatically configured to work with a bound [Luna Security Service][]. **Note:** This framework is disabled by default.
3+
4+
<table>
5+
<tr>
6+
<td><strong>Detection Criterion</strong></td>
7+
<td>Existence of a single bound Luna Security Provider service. The existence of an Luna Security service defined by the <a href="http://docs.cloudfoundry.org/devguide/deploy-apps/environment-variable.html#VCAP-SERVICES"><code>VCAP_SERVICES</code></a> payload containing a service name, label or tag with <code>luna</code> as a substring.
8+
</td>
9+
</tr>
10+
<tr>
11+
<td><strong>Tags</strong></td>
12+
<td><tt>luna-security-provider=&lt;version&gt;</tt></td>
13+
</tr>
14+
</table>
15+
Tags are printed to standard output by the buildpack detect script
16+
17+
## User-Provided Service
18+
When binding to the Luna Security Provider using a user-provided service, it must have name or tag with `luna` in it. The credential payload can contain the following entries:
19+
20+
| Name | Description
21+
| ---- | -----------
22+
| `host` | The controller host name
23+
| `host-certificate` | A PEM encoded host certificate
24+
| `client-private-key` | A PEM encoded client private key
25+
| `client-certificate` | A PEM encoded client certificate
26+
27+
To provide more complex values such as the PEM certificates, using the interactive mode when creating a user-provided service will manage the character escaping automatically.
28+
29+
## Configuration
30+
For general information on configuring the buildpack, refer to [Configuration and Extension][].
31+
32+
The framework can be configured by modifying the [`config/luna_security_provider.yml`][] file in the buildpack. The framework uses the [`Repository` utility support][repositories] and so it supports the [version syntax][] defined there.
33+
34+
| Name | Description
35+
| ---- | -----------
36+
| `repository_root` | The URL of the Luna Security Provider repository index ([details][repositories]).
37+
| `version` | Version of the Luna Security Provider to use.
38+
39+
### Additional Resources
40+
The framework can also be configured by overlaying a set of resources on the default distribution. To do this, add files to the `resources/luna_security_provider` directory in the buildpack fork.
41+
42+
[`config/luna_security_provider.yml`]: ../config/luna_security_provider.yml
43+
[Luna Security Service]: http://www.safenet-inc.com/data-encryption/hardware-security-modules-hsms/
44+
[Configuration and Extension]: ../README.md#configuration-and-extension
45+
[repositories]: extending-repositories.md
46+
[version syntax]: extending-repositories.md#version-syntax-and-ordering

‎java-buildpack.iml

+1-1
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@
271271
<orderEntry type="library" scope="PROVIDED" name="addressable (v2.3.8, rbenv: 1.9.3-p551) [gem]" level="application" />
272272
<orderEntry type="library" scope="PROVIDED" name="ast (v2.0.0, rbenv: 1.9.3-p551) [gem]" level="application" />
273273
<orderEntry type="library" scope="PROVIDED" name="astrolabe (v1.3.0, rbenv: 1.9.3-p551) [gem]" level="application" />
274-
<orderEntry type="library" scope="PROVIDED" name="bundler (v1.8.2, rbenv: 1.9.3-p551) [gem]" level="application" />
274+
<orderEntry type="library" scope="PROVIDED" name="bundler (v1.10.6, rbenv: 1.9.3-p551) [gem]" level="application" />
275275
<orderEntry type="library" scope="PROVIDED" name="codeclimate-test-reporter (v0.4.7, rbenv: 1.9.3-p551) [gem]" level="application" />
276276
<orderEntry type="library" scope="PROVIDED" name="crack (v0.4.2, rbenv: 1.9.3-p551) [gem]" level="application" />
277277
<orderEntry type="library" scope="PROVIDED" name="diff-lcs (v1.2.5, rbenv: 1.9.3-p551) [gem]" level="application" />

‎lib/java_buildpack/buildpack.rb

+25-20
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
require 'java_buildpack/component/additional_libraries'
2020
require 'java_buildpack/component/application'
2121
require 'java_buildpack/component/droplet'
22+
require 'java_buildpack/component/environment_variables'
2223
require 'java_buildpack/component/immutable_java_home'
2324
require 'java_buildpack/component/java_opts'
2425
require 'java_buildpack/component/mutable_java_home'
@@ -104,24 +105,26 @@ def initialize(app_dir, application)
104105

105106
log_environment_variables
106107

107-
additional_libraries = Component::AdditionalLibraries.new app_dir
108-
mutable_java_home = Component::MutableJavaHome.new
109-
immutable_java_home = Component::ImmutableJavaHome.new mutable_java_home, app_dir
110-
java_opts = Component::JavaOpts.new app_dir
108+
mutable_java_home = Component::MutableJavaHome.new
109+
immutable_java_home = Component::ImmutableJavaHome.new mutable_java_home, app_dir
111110

112-
instantiate_components(additional_libraries, app_dir, application, immutable_java_home, java_opts,
113-
mutable_java_home)
111+
component_info = {
112+
'additional_libraries' => Component::AdditionalLibraries.new(app_dir),
113+
'application' => application,
114+
'env_vars' => Component::EnvironmentVariables.new(app_dir),
115+
'java_opts' => Component::JavaOpts.new(app_dir),
116+
'app_dir' => app_dir
117+
}
118+
119+
instantiate_components(mutable_java_home, immutable_java_home, component_info)
114120
end
115121

116-
def instantiate_components(additional_libraries, app_dir, application, immutable_java_home, java_opts,
117-
mutable_java_home)
118-
components = JavaBuildpack::Util::ConfigurationUtils.load 'components'
119-
@jres = instantiate(components['jres'], additional_libraries, application, mutable_java_home, java_opts,
120-
app_dir)
121-
@frameworks = instantiate(components['frameworks'], additional_libraries, application, immutable_java_home,
122-
java_opts, app_dir)
123-
@containers = instantiate(components['containers'], additional_libraries, application, immutable_java_home,
124-
java_opts, app_dir)
122+
def instantiate_components(mutable_java_home, immutable_java_home, component_info)
123+
components = JavaBuildpack::Util::ConfigurationUtils.load 'components'
124+
125+
@jres = instantiate(components['jres'], mutable_java_home, component_info)
126+
@frameworks = instantiate(components['frameworks'], immutable_java_home, component_info)
127+
@containers = instantiate(components['containers'], immutable_java_home, component_info)
125128
end
126129

127130
def component_detection(type, components, unique)
@@ -146,19 +149,21 @@ def detection(type, components, unique)
146149
[detected, tags]
147150
end
148151

149-
def instantiate(components, additional_libraries, application, java_home, java_opts, root)
152+
def instantiate(components, java_home, component_info)
150153
components.map do |component|
151154
@logger.debug { "Instantiating #{component}" }
152155

153156
require_component(component)
154157

155158
component_id = component.split('::').last.snake_case
156-
context = {
157-
application: application,
159+
160+
context = {
161+
application: component_info['application'],
158162
configuration: Util::ConfigurationUtils.load(component_id),
159-
droplet: Component::Droplet.new(additional_libraries, component_id, java_home, java_opts, root)
163+
droplet: Component::Droplet.new(component_info['additional_libraries'], component_id,
164+
component_info['env_vars'], java_home,
165+
component_info['java_opts'], component_info['app_dir'])
160166
}
161-
162167
component.constantize.new(context)
163168
end
164169
end

‎lib/java_buildpack/component/droplet.rb

+13-6
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ class Droplet
3838
# @return [String] the id of component using this droplet
3939
attr_reader :component_id
4040

41+
# @!attribute [r] environment_variables
42+
# @return [EnvironmentVariables] the shared +EnvironmentVariables+ instance for all components
43+
attr_reader :environment_variables
44+
4145
# @!attribute [r] java_home
4246
# @return [ImmutableJavaHome, MutableJavaHome] the shared +JavaHome+ instance for all components. If the
4347
# component using this instance is a jre, then this will be an
@@ -63,18 +67,21 @@ class Droplet
6367
# @param [AdditionalLibraries] additional_libraries the shared +AdditionalLibraries+ instance for all
6468
# components
6569
# @param [String] component_id the id of the component that will use this +Droplet+
70+
# @param [EnvironmentVariables] env_vars the shared +EnvironmentVariables+ instance for all
71+
# components
6672
# @param [ImmutableJavaHome, MutableJavaHome] java_home the shared +JavaHome+ instance for all components. If the
6773
# component using this instance is a jre, then this should
6874
# be an instance of +MutableJavaHome+. Otherwise it should
6975
# be an instance of +ImmutableJavaHome+.
7076
# @param [JavaOpts] java_opts the shared +JavaOpts+ instance for all components
7177
# @param [Pathname] root the root of the droplet
72-
def initialize(additional_libraries, component_id, java_home, java_opts, root)
73-
@additional_libraries = additional_libraries
74-
@component_id = component_id
75-
@java_home = java_home
76-
@java_opts = java_opts
77-
@logger = JavaBuildpack::Logging::LoggerFactory.instance.get_logger Droplet
78+
def initialize(additional_libraries, component_id, env_vars, java_home, java_opts, root)
79+
@additional_libraries = additional_libraries
80+
@component_id = component_id
81+
@environment_variables = env_vars
82+
@java_home = java_home
83+
@java_opts = java_opts
84+
@logger = JavaBuildpack::Logging::LoggerFactory.instance.get_logger Droplet
7885

7986
buildpack_root = root + '.java-buildpack'
8087
sandbox_root = buildpack_root + component_id

‎lib/java_buildpack/component/environment_variables.rb

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Encoding: utf-8
2+
# Cloud Foundry Java Buildpack
3+
# Copyright 2013-2015 the original author or authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
require 'java_buildpack/component'
18+
require 'java_buildpack/util/qualify_path'
19+
20+
module JavaBuildpack
21+
module Component
22+
23+
# An abstraction encapsulating the Environment Variables of an application.
24+
#
25+
# A new instance of this type should be created once for the application.
26+
class EnvironmentVariables < Array
27+
include JavaBuildpack::Util
28+
29+
# Creates an instance of the Environment Variables abstraction.
30+
#
31+
# @param [Pathname] droplet_root the root directory of the droplet
32+
def initialize(droplet_root)
33+
@droplet_root = droplet_root
34+
end
35+
36+
# Adds an environment variable. Prepends +$PWD+ to any variable values that are
37+
# paths (relative to the droplet root) to ensure that the path is always accurate.
38+
#
39+
# @param [String] key the variable name
40+
# @param [String] value the variable value
41+
# @return [EnvironmentVariables] +self+ for chaining
42+
def add_environment_variable(key, value)
43+
self << "#{key}=#{qualify_value(value)}"
44+
end
45+
46+
# Returns the contents as an environment variable formatted as +<key>=<value>+
47+
#
48+
# @return [String] the contents as an environment variable
49+
def as_env_vars
50+
join(' ')
51+
end
52+
53+
private
54+
55+
def qualify_value(value)
56+
value.respond_to?(:relative_path_from) ? qualify_path(value) : value
57+
end
58+
59+
end
60+
61+
end
62+
end

‎lib/java_buildpack/component/java_opts.rb

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def add_javaagent(path)
4646
# ensure that the path is always accurate.
4747
#
4848
# @param [Pathname] path the path to the +agentpath+ shared library
49-
# @param [Properties] properties to append to the agentpath entry
49+
# @param [Properties] props to append to the agentpath entry
5050
# @return [JavaOpts] +self+ for chaining
5151
def add_agentpath_with_props(path, props)
5252
add_preformatted_options "-agentpath:#{qualify_path path}=" + props.map { |k, v| "#{k}=#{v}" }.join(',')

‎lib/java_buildpack/container/dist_zip_like.rb

+1
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ def compile
4141
# (see JavaBuildpack::Component::BaseComponent#release)
4242
def release
4343
[
44+
@droplet.environment_variables.as_env_vars,
4445
@droplet.java_home.as_env_var,
4546
@droplet.java_opts.as_env_var,
4647
qualify_path(start_script(root), @droplet.root)

‎lib/java_buildpack/container/groovy.rb

+1
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ def release
5353
add_libs
5454

5555
[
56+
@droplet.environment_variables.as_env_vars,
5657
@droplet.java_home.as_env_var,
5758
@droplet.java_opts.as_env_var,
5859
qualify_path(@droplet.sandbox + 'bin/groovy', @droplet.root),

‎lib/java_buildpack/container/java_main.rb

+6-5
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ def compile
4242
def release
4343
@droplet.additional_libraries.insert 0, @application.root
4444
manifest_class_path.each { |path| @droplet.additional_libraries << path }
45+
@droplet.environment_variables.add_environment_variable 'SERVER_PORT', '$PORT' if boot_launcher?
4546

4647
release_text
4748
end
@@ -56,7 +57,7 @@ def release
5657

5758
def release_text
5859
[
59-
port,
60+
@droplet.environment_variables.as_env_vars,
6061
"#{qualify_path @droplet.java_home.root, @droplet.root}/bin/java",
6162
@droplet.additional_libraries.as_classpath,
6263
@droplet.java_opts.join(' '),
@@ -69,6 +70,10 @@ def arguments
6970
@configuration[ARGUMENTS_PROPERTY]
7071
end
7172

73+
def boot_launcher?
74+
main_class =~ /^org\.springframework\.boot\.loader\.(?:[JW]ar|Properties)Launcher$/
75+
end
76+
7277
def main_class
7378
JavaBuildpack::Util::JavaMainUtils.main_class(@application, @configuration)
7479
end
@@ -78,10 +83,6 @@ def manifest_class_path
7883
values.nil? ? [] : values.split(' ').map { |value| @droplet.root + value }
7984
end
8085

81-
def port
82-
main_class =~ /^org\.springframework\.boot\.loader\.(?:[JW]ar|Properties)Launcher$/ ? 'SERVER_PORT=$PORT' : nil
83-
end
84-
8586
end
8687

8788
end

‎lib/java_buildpack/container/spring_boot.rb

+2-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ def initialize(context)
3535

3636
# (see JavaBuildpack::Container::DistZipLike#release)
3737
def release
38-
"SERVER_PORT=$PORT #{super}"
38+
@droplet.environment_variables.add_environment_variable 'SERVER_PORT', '$PORT'
39+
super
3940
end
4041

4142
protected

‎lib/java_buildpack/container/spring_boot_cli.rb

+3-1
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,12 @@ def compile
4545

4646
# (see JavaBuildpack::Component::BaseComponent#release)
4747
def release
48+
@droplet.environment_variables.add_environment_variable 'SERVER_PORT', '$PORT'
49+
4850
[
51+
@droplet.environment_variables.as_env_vars,
4952
@droplet.java_home.as_env_var,
5053
@droplet.java_opts.as_env_var,
51-
'SERVER_PORT=$PORT',
5254
qualify_path(@droplet.sandbox + 'bin/spring', @droplet.root),
5355
'run',
5456
@droplet.additional_libraries.as_classpath,

‎lib/java_buildpack/container/tomcat.rb

+1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ def command
3838
@droplet.java_opts.add_system_property 'http.port', '$PORT'
3939

4040
[
41+
@droplet.environment_variables.as_env_vars,
4142
@droplet.java_home.as_env_var,
4243
@droplet.java_opts.as_env_var,
4344
"$PWD/#{(@droplet.sandbox + 'bin/catalina.sh').relative_path_from(@droplet.root)}",

0 commit comments

Comments
 (0)