-
Notifications
You must be signed in to change notification settings - Fork 214
/
HttpsEnsuringDirective.java
executable file
·160 lines (135 loc) · 6.69 KB
/
HttpsEnsuringDirective.java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
/*
* Copyright (c) 2017 Contributors to the Eclipse Foundation
*
* See the NOTICE file(s) distributed with this work for additional
* information regarding copyright ownership.
*
* This program and the accompanying materials are made available under the
* terms of the Eclipse Public License 2.0 which is available at
* http://www.eclipse.org/legal/epl-2.0
*
* SPDX-License-Identifier: EPL-2.0
*/
package org.eclipse.ditto.gateway.service.endpoints.directives;
import static org.apache.pekko.http.javadsl.server.Directives.complete;
import static org.apache.pekko.http.javadsl.server.Directives.extractActorSystem;
import static org.apache.pekko.http.javadsl.server.Directives.extractRequestContext;
import static org.apache.pekko.http.javadsl.server.Directives.redirect;
import static org.eclipse.ditto.base.model.common.ConditionChecker.checkNotNull;
import java.util.List;
import java.util.Optional;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.function.Supplier;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.annotation.Nullable;
import org.eclipse.ditto.gateway.service.util.config.endpoints.HttpConfig;
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLoggerFactory;
import org.eclipse.ditto.internal.utils.pekko.logging.ThreadSafeDittoLogger;
import org.slf4j.Logger;
import org.apache.pekko.http.javadsl.model.HttpHeader;
import org.apache.pekko.http.javadsl.model.HttpRequest;
import org.apache.pekko.http.javadsl.model.StatusCodes;
import org.apache.pekko.http.javadsl.model.Uri;
import org.apache.pekko.http.javadsl.server.RequestContext;
import org.apache.pekko.http.javadsl.server.Route;
/**
* Custom Pekko Http directive ensuring that proxied requests only come via HTTPs.
*/
public final class HttpsEnsuringDirective {
private static final String HTTPS_PROTO = "https";
private static final String HTTPS_TEXT =
"Connection via plain HTTP not supported, please connect via HTTPS instead";
private static final AtomicBoolean FORCE_HTTPS_DISABLED_ALREADY_LOGGED = new AtomicBoolean(false);
private static final ThreadSafeDittoLogger LOGGER =
DittoLoggerFactory.getThreadSafeLogger(HttpsEnsuringDirective.class);
private final HttpConfig httpConfig;
private HttpsEnsuringDirective(final HttpConfig httpConfig) {
this.httpConfig = checkNotNull(httpConfig, "HTTP config");
}
/**
* Returns an instance of {@code HttpsEnsuringDirective}.
*
* @param httpConfig the configuration settings of the Gateway service's HTTP behaviour.
* @return the instance.
* @throws NullPointerException if {@code httpConfig} is {@code null}.
*/
public static HttpsEnsuringDirective getInstance(final HttpConfig httpConfig) {
return new HttpsEnsuringDirective(httpConfig);
}
/**
* Ensures that proxied requests only come via HTTPs rejects all others - with one exception: Depending on the
* configuration regarding HTTP enforcement, the requests are redirected to HTTPS instead of being rejected.
* <p>
* NOTE: The HTTPS check can be completely disabled by configuration.
* </p>
*
* @param correlationId the correlationId (used for logging).
* @param inner the inner route to be wrapped with the HTTPs check.
* @return the new route wrapping {@code inner} with the HTTPs check.
*/
public Route ensureHttps(@Nullable final CharSequence correlationId, final Supplier<Route> inner) {
final ThreadSafeDittoLogger logger;
if (null != correlationId) {
logger = LOGGER.withCorrelationId(correlationId);
} else {
logger = LOGGER;
}
return extractActorSystem(actorSystem -> extractRequestContext(
requestContext -> {
if (!httpConfig.isForceHttps()) {
if (FORCE_HTTPS_DISABLED_ALREADY_LOGGED.compareAndSet(false, true)) {
logger.warn("No HTTPS is enforced!");
}
return inner.get();
}
// check whether the request came from HTTPS (before Proxy which terminated SSL and called us via
// HTTP)
final Uri requestUri = requestContext.getRequest().getUri();
final String forwardedProtoHeaderOrNull =
getForwardedProtoHeaderOrNull(requestUri, requestContext, logger);
if (!HTTPS_PROTO.equalsIgnoreCase(forwardedProtoHeaderOrNull)) {
return handleNonHttpsRequest(requestUri, logger);
}
return inner.get();
}));
}
private String getForwardedProtoHeaderOrNull(final Uri requestUri, final RequestContext requestContext,
final Logger logger) {
final String result = getHeader(requestContext.getRequest(), httpConfig.getProtocolHeaders())
.orElseGet(requestUri::getScheme);
logger.debug("Read protocol <{}> from headers <{}> or from URI <{}>.", result, requestUri,
httpConfig.getProtocolHeaders());
return result;
}
private Route handleNonHttpsRequest(final Uri requestUri, final Logger logger) {
if (httpConfig.isRedirectToHttps() && !isBlocked(requestUri.getPathString())) {
return redirectToHttps(requestUri, logger);
}
return disallowRequest(requestUri, logger);
}
private boolean isBlocked(final CharSequence requestUriPath) {
final Pattern redirectToHttpsBlocklistPattern = httpConfig.getRedirectToHttpsBlocklistPattern();
final Matcher matcher = redirectToHttpsBlocklistPattern.matcher(requestUriPath);
return matcher.matches();
}
private static Route redirectToHttps(final Uri originalUri, final Logger logger) {
final Uri httpsUri = originalUri.scheme(HTTPS_PROTO);
logger.debug("Redirecting URI <{}> to <{}>.", originalUri, httpsUri);
return redirect(httpsUri, StatusCodes.MOVED_PERMANENTLY);
}
private static Route disallowRequest(final Uri requestUri, final Logger logger) {
logger.info("REST request on URI <{}> did not originate via HTTPS, sending back <{}>.", requestUri,
StatusCodes.NOT_FOUND);
return complete(StatusCodes.NOT_FOUND, HTTPS_TEXT);
}
private static Optional<String> getHeader(final HttpRequest request, final List<String> protocolHeaderNames) {
for (final var headerName : protocolHeaderNames) {
final var header = request.getHeader(headerName);
if (header.isPresent()) {
return header.map(HttpHeader::value);
}
}
return Optional.empty();
}
}