You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by pk...@apache.org on 2022/04/24 18:00:23 UTC
[logging-log4j2] 02/11: [LOG4J2-3439] Corrects default SSL configuration
This is an automated email from the ASF dual-hosted git repository.
pkarwasz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
commit 2d3246467b70879adfe44ce619fec350394a7ad9
Author: Piotr P. Karwasz <pi...@karwasz.org>
AuthorDate: Sun Mar 20 21:09:31 2022 +0100
[LOG4J2-3439] Corrects default SSL configuration
Replaces an invalid `SSLContext` algorithm name with Log4j's default and
adds unity tests.
Conflicts:
log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactory.java
src/site/xdoc/manual/appenders.xml
---
.../core/net/ssl/SslConfigurationFactoryTest.java | 73 ++++++++++++++++++++++
.../net/ssl/AbstractKeyStoreConfiguration.java | 4 +-
.../log4j/core/net/ssl/KeyStoreConfiguration.java | 2 +-
.../core/net/ssl/SslConfigurationDefaults.java | 7 ++-
.../core/net/ssl/SslConfigurationFactory.java | 8 ++-
src/site/asciidoc/manual/appenders.adoc | 7 ++-
6 files changed, 92 insertions(+), 9 deletions(-)
diff --git a/log4j-core-test/src/test/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactoryTest.java b/log4j-core-test/src/test/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactoryTest.java
new file mode 100644
index 0000000000..e6de0db6a2
--- /dev/null
+++ b/log4j-core-test/src/test/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactoryTest.java
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache license, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the license for the specific language governing permissions and
+ * limitations under the license.
+ */
+package org.apache.logging.log4j.core.net.ssl;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+import java.util.Properties;
+
+import org.apache.logging.log4j.core.test.net.ssl.TestConstants;
+import org.apache.logging.log4j.util.PropertiesUtil;
+import org.junit.jupiter.api.Test;
+
+public class SslConfigurationFactoryTest {
+
+ private static void addKeystoreConfiguration(Properties props) {
+ props.setProperty("log4j2.keyStoreLocation", TestConstants.KEYSTORE_FILE_RESOURCE);
+ props.setProperty("log4j2.keyStoreKeyStoreType", TestConstants.KEYSTORE_TYPE);
+ }
+
+ private static void addTruststoreConfiguration(Properties props) {
+ props.setProperty("log4j2.trustStoreLocation", TestConstants.TRUSTSTORE_FILE_RESOURCE);
+ props.setProperty("log4j2.trustStoreKeyStoreType", TestConstants.TRUSTSTORE_TYPE);
+ }
+
+ @Test
+ public void testStaticConfiguration() {
+ final Properties props = new Properties();
+ final PropertiesUtil util = new PropertiesUtil(props);
+ // No keystore and truststore -> no SslConfiguration
+ SslConfiguration sslConfiguration = SslConfigurationFactory.createSslConfiguration(util);
+ assertNull(sslConfiguration);
+ // Only keystore
+ props.clear();
+ addKeystoreConfiguration(props);
+ util.reload();
+ sslConfiguration = SslConfigurationFactory.createSslConfiguration(util);
+ assertNotNull(sslConfiguration);
+ assertNotNull(sslConfiguration.getKeyStoreConfig());
+ assertNull(sslConfiguration.getTrustStoreConfig());
+ // Only truststore
+ props.clear();
+ addTruststoreConfiguration(props);
+ util.reload();
+ sslConfiguration = SslConfigurationFactory.createSslConfiguration(util);
+ assertNotNull(sslConfiguration);
+ assertNull(sslConfiguration.getKeyStoreConfig());
+ assertNotNull(sslConfiguration.getTrustStoreConfig());
+ // Both
+ props.clear();
+ addKeystoreConfiguration(props);
+ addTruststoreConfiguration(props);
+ util.reload();
+ sslConfiguration = SslConfigurationFactory.createSslConfiguration(util);
+ assertNotNull(sslConfiguration);
+ assertNotNull(sslConfiguration.getKeyStoreConfig());
+ assertNotNull(sslConfiguration.getTrustStoreConfig());
+ }
+}
diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/AbstractKeyStoreConfiguration.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/AbstractKeyStoreConfiguration.java
index 74e5eaa577..4df86e7f8c 100644
--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/AbstractKeyStoreConfiguration.java
+++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/AbstractKeyStoreConfiguration.java
@@ -32,6 +32,8 @@ import org.apache.logging.log4j.core.util.NetUtils;
* Configuration of the KeyStore
*/
public class AbstractKeyStoreConfiguration extends StoreConfiguration<KeyStore> {
+ static final char[] DEFAULT_PASSWORD = "changeit".toCharArray();
+
private final KeyStore keyStore;
private final String keyStoreType;
@@ -54,7 +56,7 @@ public class AbstractKeyStoreConfiguration extends StoreConfiguration<KeyStore>
final KeyStore ks = KeyStore.getInstance(this.keyStoreType);
final char[] password = this.getPassword();
try {
- ks.load(fin, password);
+ ks.load(fin, password != null ? password : DEFAULT_PASSWORD);
} finally {
if (password != null) {
Arrays.fill(password, '\0');
diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/KeyStoreConfiguration.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/KeyStoreConfiguration.java
index 6459ac013a..4547f0a395 100644
--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/KeyStoreConfiguration.java
+++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/KeyStoreConfiguration.java
@@ -128,7 +128,7 @@ public class KeyStoreConfiguration extends AbstractKeyStoreConfiguration {
final KeyManagerFactory kmFactory = KeyManagerFactory.getInstance(this.keyManagerFactoryAlgorithm);
final char[] password = this.getPassword();
try {
- kmFactory.init(this.getKeyStore(), password);
+ kmFactory.init(this.getKeyStore(), password != null ? password : DEFAULT_PASSWORD);
} finally {
if (password != null) {
Arrays.fill(password, '\0');
diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationDefaults.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationDefaults.java
index 3c95eeb1e4..daa052e05a 100644
--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationDefaults.java
+++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationDefaults.java
@@ -16,12 +16,15 @@
*/
package org.apache.logging.log4j.core.net.ssl;
+import java.security.KeyStore;
+
/**
*
*/
public class SslConfigurationDefaults {
- public static final String KEYSTORE_TYPE = "JKS";
- public static final String PROTOCOL = "SSL";
+ public static final String KEYSTORE_TYPE = KeyStore.getDefaultType();
+ // "TLS" uses all protocols available except those excluded in "jdk.tls.disabledAlgorithms"
+ public static final String PROTOCOL = "TLS";
}
diff --git a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactory.java b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactory.java
index ad393d6dbd..7c1bf3b583 100644
--- a/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactory.java
+++ b/log4j-core/src/main/java/org/apache/logging/log4j/core/net/ssl/SslConfigurationFactory.java
@@ -46,6 +46,10 @@ public class SslConfigurationFactory {
private static final Supplier<SslConfiguration> SSL_CONFIGURATION = LazyValue.from(() -> {
final PropertiesUtil props = PropertiesUtil.getProperties();
+ return createSslConfiguration(props);
+ });
+
+ static final SslConfiguration createSslConfiguration(final PropertiesUtil props) {
KeyStoreConfiguration keyStoreConfiguration = null;
TrustStoreConfiguration trustStoreConfiguration = null;
String location = props.getStringProperty(trustStorelocation);
@@ -82,11 +86,11 @@ public class SslConfigurationFactory {
}
if (trustStoreConfiguration != null || keyStoreConfiguration != null) {
final boolean isVerifyHostName = props.getBooleanProperty(verifyHostName, false);
- return SslConfiguration.createSSLConfiguration("https", keyStoreConfiguration,
+ return SslConfiguration.createSSLConfiguration(null, keyStoreConfiguration,
trustStoreConfiguration, isVerifyHostName);
}
return null;
- });
+ }
public static SslConfiguration getSslConfiguration() {
return SSL_CONFIGURATION.get();
diff --git a/src/site/asciidoc/manual/appenders.adoc b/src/site/asciidoc/manual/appenders.adoc
index 00087c29d8..b6dd769458 100644
--- a/src/site/asciidoc/manual/appenders.adoc
+++ b/src/site/asciidoc/manual/appenders.adoc
@@ -4266,9 +4266,10 @@ documents the parameters available for SSL configuration.
[cols=",,",options="header",]
|=======================================================================
|Parameter Name |Type |Description
-|protocol |String |`SSL` if omitted. See also
-http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SSLContext[Standard
-names].
+|protocol |String |The SSL protocol to use, `TLS` if omitted. A single value
+may enable multiple protocoles, see the
+https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#sslcontext-algorithms[JVM
+documentation] for details.
|KeyStore |KeyStore |Contains your private keys and certificates, and
determines which authentication credentials to send to the remote host.