Skip to content

Commit

Permalink
Improve and make more coherent ssl/tls options
Browse files Browse the repository at this point in the history
  • Loading branch information
@vietj
vietj committed Feb 4, 2015
1 parent 7cf7564 commit a3820ab
Show file tree
Hide file tree
Showing 25 changed files with 832 additions and 704 deletions.
4 changes: 2 additions & 2 deletions src/main/asciidoc/net.adoc
View file
Expand Up @@ -365,7 +365,7 @@ The password for the keystore should also be provided:
[source,java] [source,java]
---- ----
NetServerOptions options = new NetServerOptions().setSsl(true).setKeyStoreOptions( NetServerOptions options = new NetServerOptions().setSsl(true).setKeyStoreOptions(
new JKSOptions(). new JksOptions().
setPath("/path/to/your/keystore.jks"). setPath("/path/to/your/keystore.jks").
setPassword("password-of-your-keystore") setPassword("password-of-your-keystore")
); );
Expand All @@ -377,7 +377,7 @@ Alternatively you can read the key store yourself as a buffer and provide that d
[source,java] [source,java]
---- ----
Buffer myKeyStoreAsABuffer = readKeyStore(); Buffer myKeyStoreAsABuffer = readKeyStore();
JKSOptions jksOptions = new JKSOptions(). JksOptions jksOptions = new JksOptions().
setValue(myKeyStoreAsABuffer). setValue(myKeyStoreAsABuffer).
setPassword("password-of-your-keystore"); setPassword("password-of-your-keystore");
NetServerOptions options = new NetServerOptions(). NetServerOptions options = new NetServerOptions().
Expand Down
4 changes: 2 additions & 2 deletions src/main/java/examples/NetExamples.java
View file
Expand Up @@ -187,7 +187,7 @@ public void example16(Vertx vertx) {


public void example17(Vertx vertx) { public void example17(Vertx vertx) {
NetServerOptions options = new NetServerOptions().setSsl(true).setKeyStoreOptions( NetServerOptions options = new NetServerOptions().setSsl(true).setKeyStoreOptions(
new JKSOptions(). new JksOptions().
setPath("/path/to/your/keystore.jks"). setPath("/path/to/your/keystore.jks").
setPassword("password-of-your-keystore") setPassword("password-of-your-keystore")
); );
Expand All @@ -196,7 +196,7 @@ public void example17(Vertx vertx) {


public void example18(Vertx vertx) { public void example18(Vertx vertx) {
Buffer myKeyStoreAsABuffer = readKeyStore(); Buffer myKeyStoreAsABuffer = readKeyStore();
JKSOptions jksOptions = new JKSOptions(). JksOptions jksOptions = new JksOptions().
setValue(myKeyStoreAsABuffer). setValue(myKeyStoreAsABuffer).
setPassword("password-of-your-keystore"); setPassword("password-of-your-keystore");
NetServerOptions options = new NetServerOptions(). NetServerOptions options = new NetServerOptions().
Expand Down
36 changes: 30 additions & 6 deletions src/main/java/io/vertx/core/http/HttpClientOptions.java
View file
Expand Up @@ -19,8 +19,12 @@
import io.vertx.codegen.annotations.DataObject; import io.vertx.codegen.annotations.DataObject;
import io.vertx.core.json.JsonObject; import io.vertx.core.json.JsonObject;
import io.vertx.core.net.ClientOptionsBase; import io.vertx.core.net.ClientOptionsBase;
import io.vertx.core.net.KeyStoreOptions; import io.vertx.core.net.JksOptions;
import io.vertx.core.net.TrustStoreOptions; import io.vertx.core.net.PemCaOptions;
import io.vertx.core.net.PemKeyCertOptions;
import io.vertx.core.net.PfxOptions;
import io.vertx.core.net.CaOptions;
import io.vertx.core.net.TCPSSLOptions;


/** /**
* Options describing how an {@link HttpClient} will make connections. * Options describing how an {@link HttpClient} will make connections.
Expand Down Expand Up @@ -189,17 +193,37 @@ public HttpClientOptions setSsl(boolean ssl) {
} }


@Override @Override
public HttpClientOptions setKeyStoreOptions(KeyStoreOptions keyStore) { public HttpClientOptions setKeyStoreOptions(JksOptions options) {
super.setKeyStoreOptions(keyStore); super.setKeyStoreOptions(options);
return this; return this;
} }


@Override @Override
public HttpClientOptions setTrustStoreOptions(TrustStoreOptions trustStore) { public HttpClientOptions setPfxKeyCertOptions(PfxOptions options) {
super.setTrustStoreOptions(trustStore); return (HttpClientOptions) super.setPfxKeyCertOptions(options);
}

@Override
public HttpClientOptions setPemKeyCertOptions(PemKeyCertOptions options) {
return (HttpClientOptions) super.setPemKeyCertOptions(options);
}

@Override
public HttpClientOptions setTrustStoreOptions(JksOptions options) {
super.setTrustStoreOptions(options);
return this; return this;
} }


@Override
public HttpClientOptions setPfxCaOptions(PfxOptions options) {
return (HttpClientOptions) super.setPfxCaOptions(options);
}

@Override
public HttpClientOptions setPemCaOptions(PemCaOptions options) {
return (HttpClientOptions) super.setPemCaOptions(options);
}

@Override @Override
public HttpClientOptions addEnabledCipherSuite(String suite) { public HttpClientOptions addEnabledCipherSuite(String suite) {
super.addEnabledCipherSuite(suite); super.addEnabledCipherSuite(suite);
Expand Down
35 changes: 29 additions & 6 deletions src/main/java/io/vertx/core/http/HttpServerOptions.java
View file
Expand Up @@ -18,9 +18,12 @@


import io.vertx.codegen.annotations.DataObject; import io.vertx.codegen.annotations.DataObject;
import io.vertx.core.json.JsonObject; import io.vertx.core.json.JsonObject;
import io.vertx.core.net.KeyStoreOptions; import io.vertx.core.net.JksOptions;
import io.vertx.core.net.PemCaOptions;
import io.vertx.core.net.PemKeyCertOptions;
import io.vertx.core.net.NetServerOptions; import io.vertx.core.net.NetServerOptions;
import io.vertx.core.net.TrustStoreOptions; import io.vertx.core.net.PfxOptions;
import io.vertx.core.net.CaOptions;


/** /**
* Represents options used by an {@link io.vertx.core.http.HttpServer} instance * Represents options used by an {@link io.vertx.core.http.HttpServer} instance
Expand Down Expand Up @@ -145,17 +148,37 @@ public HttpServerOptions setSsl(boolean ssl) {
} }


@Override @Override
public HttpServerOptions setKeyStoreOptions(KeyStoreOptions keyStore) { public HttpServerOptions setKeyStoreOptions(JksOptions options) {
super.setKeyStoreOptions(keyStore); super.setKeyStoreOptions(options);
return this; return this;
} }


@Override @Override
public HttpServerOptions setTrustStoreOptions(TrustStoreOptions trustStore) { public HttpServerOptions setPfxKeyCertOptions(PfxOptions options) {
super.setTrustStoreOptions(trustStore); return (HttpServerOptions) super.setPfxKeyCertOptions(options);
}

@Override
public HttpServerOptions setPemKeyCertOptions(PemKeyCertOptions options) {
return (HttpServerOptions) super.setPemKeyCertOptions(options);
}

@Override
public HttpServerOptions setTrustStoreOptions(JksOptions options) {
super.setTrustStoreOptions(options);
return this; return this;
} }


@Override
public HttpServerOptions setPemCaOptions(PemCaOptions options) {
return (HttpServerOptions) super.setPemCaOptions(options);
}

@Override
public HttpServerOptions setPfxCaOptions(PfxOptions options) {
return (HttpServerOptions) super.setPfxCaOptions(options);
}

@Override @Override
public HttpServerOptions addEnabledCipherSuite(String suite) { public HttpServerOptions addEnabledCipherSuite(String suite) {
super.addEnabledCipherSuite(suite); super.addEnabledCipherSuite(suite);
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/io/vertx/core/http/impl/HttpClientImpl.java
View file
Expand Up @@ -91,7 +91,7 @@ public class HttpClientImpl implements HttpClient {
public HttpClientImpl(VertxInternal vertx, HttpClientOptions options) { public HttpClientImpl(VertxInternal vertx, HttpClientOptions options) {
this.vertx = vertx; this.vertx = vertx;
this.options = new HttpClientOptions(options); this.options = new HttpClientOptions(options);
this.sslHelper = new SSLHelper(options, KeyStoreHelper.create(vertx, options.getKeyStoreOptions()), KeyStoreHelper.create(vertx, options.getTrustStoreOptions())); this.sslHelper = new SSLHelper(options, KeyStoreHelper.create(vertx, options.getKeyCertOptions()), KeyStoreHelper.create(vertx, options.getCaOptions()));
this.creatingContext = vertx.getContext(); this.creatingContext = vertx.getContext();
closeHook = completionHandler -> { closeHook = completionHandler -> {
HttpClientImpl.this.close(); HttpClientImpl.this.close();
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/io/vertx/core/http/impl/HttpServerImpl.java
View file
Expand Up @@ -131,7 +131,7 @@ public HttpServerImpl(VertxInternal vertx, HttpServerOptions options) {
} }
creatingContext.addCloseHook(this); creatingContext.addCloseHook(this);
} }
this.sslHelper = new SSLHelper(options, KeyStoreHelper.create(vertx, options.getKeyStoreOptions()), KeyStoreHelper.create(vertx, options.getTrustStoreOptions())); this.sslHelper = new SSLHelper(options, KeyStoreHelper.create(vertx, options.getKeyCertOptions()), KeyStoreHelper.create(vertx, options.getCaOptions()));
this.subProtocols = options.getWebsocketSubProtocols(); this.subProtocols = options.getWebsocketSubProtocols();
this.metrics = vertx.metricsSPI().createMetrics(this, options); this.metrics = vertx.metricsSPI().createMetrics(this, options);
} }
Expand Down
129 changes: 4 additions & 125 deletions src/main/java/io/vertx/core/net/CaOptions.java
View file
Expand Up @@ -13,142 +13,21 @@
* *
* You may elect to redistribute this code under either of these licenses. * You may elect to redistribute this code under either of these licenses.
*/ */

package io.vertx.core.net; package io.vertx.core.net;


import io.vertx.codegen.annotations.DataObject; import io.vertx.codegen.annotations.DataObject;
import io.vertx.core.buffer.Buffer;
import io.vertx.core.impl.Arguments;
import io.vertx.core.json.JsonArray;
import io.vertx.core.json.JsonObject;

import java.util.ArrayList;
import java.util.Base64;
import java.util.List;
import java.util.Objects;


/** /**
* Certificate Authority trust store options configuring certificates based on * Certification authority configuration options.
* <i>Privacy-enhanced Electronic Email</i> (PEM) files. The store is configured with a list of
* validating certificates.
* <p>
* Validating certificates must contain X.509 certificates wrapped in a PEM block:<p>
*
* <pre>
* -----BEGIN CERTIFICATE-----
* MIIDezCCAmOgAwIBAgIEVmLkwTANBgkqhkiG9w0BAQsFADBuMRAwDgYDVQQGEwdV
* ...
* z5+DuODBJUQst141Jmgq8bS543IU/5apcKQeGNxEyQ==
* -----END CERTIFICATE-----
* </pre>
*
* The certificates can either be loaded by Vert.x from the filesystem:
* <p>
* <pre>
* HttpServerOptions options = new HttpServerOptions();
* options.setTrustStore(new CaOptions().addCertPath("/cert.pem"));
* </pre>
*
* Or directly provided as a buffer:
* <p>
*
* <pre>
* Buffer cert = vertx.fileSystem().readFileSync("/cert.pem");
* HttpServerOptions options = new HttpServerOptions();
* options.setTrustStore(new CaOptions().addCertValue(cert));
* </pre>
* *
* @author <a href="mailto:julien@julienviet.com">Julien Viet</a> * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
* @author <a href="http://tfox.org">Tim Fox</a>
*/ */
@DataObject @DataObject
public class CaOptions implements TrustStoreOptions, Cloneable { public interface CaOptions {

private ArrayList<String> certPaths;
private ArrayList<Buffer> certValues;

/**
* Default constructor
*/
public CaOptions() {
super();
this.certPaths = new ArrayList<>();
this.certValues = new ArrayList<>();
}

/**
* Copy constructor
*
* @param other the options to copy
*/
public CaOptions(CaOptions other) {
super();
this.certPaths = new ArrayList<>(other.getCertPaths());
this.certValues = new ArrayList<>(other.getCertValues());
}


/** /**
* Create options from JSON * @return a copy of these options
*
* @param json the JSON
*/ */
public CaOptions(JsonObject json) { CaOptions clone();
super();
this.certPaths = new ArrayList<>();
this.certValues = new ArrayList<>();
for (Object certPath : json.getJsonArray("certPaths", new JsonArray())) {
certPaths.add((String) certPath);
}
for (Object certValue : json.getJsonArray("certValues", new JsonArray())) {
certValues.add(Buffer.buffer(Base64.getDecoder().decode((String) certValue)));
}
}

/**
* @return the certificate paths used to locate certificates
*/
public List<String> getCertPaths() {
return certPaths;
}

/**
* Add a certificate path
*
* @param certPath the path to add
* @return a reference to this, so the API can be used fluently
* @throws NullPointerException
*/
public CaOptions addCertPath(String certPath) throws NullPointerException {
Objects.requireNonNull(certPath, "No null certificate accepted");
Arguments.require(!certPath.isEmpty(), "No empty certificate path accepted");
certPaths.add(certPath);
return this;
}

/**
*
* @return the certificate values
*/
public List<Buffer> getCertValues() {
return certValues;
}

/**
* Add a certificate value
*
* @param certValue the value to add
* @return a reference to this, so the API can be used fluently
* @throws NullPointerException
*/
public CaOptions addCertValue(Buffer certValue) throws NullPointerException {
Objects.requireNonNull(certValue, "No null certificate accepted");
certValues.add(certValue);
return this;
}

@Override
public CaOptions clone() {
return new CaOptions(this);
}


} }
19 changes: 9 additions & 10 deletions ...in/java/io/vertx/core/net/JKSOptions.java → ...in/java/io/vertx/core/net/JksOptions.java
View file
Expand Up @@ -19,7 +19,6 @@
import io.vertx.codegen.annotations.DataObject; import io.vertx.codegen.annotations.DataObject;
import io.vertx.core.buffer.Buffer; import io.vertx.core.buffer.Buffer;
import io.vertx.core.json.JsonObject; import io.vertx.core.json.JsonObject;
import io.vertx.core.net.JKSOptions;


/** /**
* Key or trust store options configuring private key and/or certificates based on Java Keystore files. * Key or trust store options configuring private key and/or certificates based on Java Keystore files.
Expand All @@ -46,7 +45,7 @@
* @author <a href="http://tfox.org">Tim Fox</a> * @author <a href="http://tfox.org">Tim Fox</a>
*/ */
@DataObject @DataObject
public class JKSOptions implements KeyStoreOptions, TrustStoreOptions, Cloneable { public class JksOptions implements KeyCertOptions, CaOptions, Cloneable {


private String password; private String password;
private String path; private String path;
Expand All @@ -55,7 +54,7 @@ public class JKSOptions implements KeyStoreOptions, TrustStoreOptions, Cloneable
/** /**
* Default constructor * Default constructor
*/ */
public JKSOptions() { public JksOptions() {
super(); super();
} }


Expand All @@ -64,7 +63,7 @@ public JKSOptions() {
* *
* @param other the options to copy * @param other the options to copy
*/ */
public JKSOptions(JKSOptions other) { public JksOptions(JksOptions other) {
super(); super();
this.password = other.getPassword(); this.password = other.getPassword();
this.path = other.getPath(); this.path = other.getPath();
Expand All @@ -76,7 +75,7 @@ public JKSOptions(JKSOptions other) {
* *
* @param json the JSON * @param json the JSON
*/ */
public JKSOptions(JsonObject json) { public JksOptions(JsonObject json) {
super(); super();
this.password = json.getString("password"); this.password = json.getString("password");
this.path = json.getString("path"); this.path = json.getString("path");
Expand All @@ -97,7 +96,7 @@ public String getPassword() {
* @param password the password * @param password the password
* @return a reference to this, so the API can be used fluently * @return a reference to this, so the API can be used fluently
*/ */
public JKSOptions setPassword(String password) { public JksOptions setPassword(String password) {
this.password = password; this.password = password;
return this; return this;
} }
Expand All @@ -117,7 +116,7 @@ public String getPath() {
* @param path the path * @param path the path
* @return a reference to this, so the API can be used fluently * @return a reference to this, so the API can be used fluently
*/ */
public JKSOptions setPath(String path) { public JksOptions setPath(String path) {
this.path = path; this.path = path;
return this; return this;
} }
Expand All @@ -137,13 +136,13 @@ public Buffer getValue() {
* @param value the key store as a buffer * @param value the key store as a buffer
* @return a reference to this, so the API can be used fluently * @return a reference to this, so the API can be used fluently
*/ */
public JKSOptions setValue(Buffer value) { public JksOptions setValue(Buffer value) {
this.value = value; this.value = value;
return this; return this;
} }


@Override @Override
public JKSOptions clone() { public JksOptions clone() {
return new JKSOptions(this); return new JksOptions(this);
} }
} }

0 comments on commit a3820ab

Please sign in to comment.