You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@felix.apache.org by ja...@apache.org on 2013/11/15 14:17:41 UTC
svn commit: r1542257 - in /felix/trunk/http/sslfilter/src:
main/java/org/apache/felix/http/sslfilter/internal/
test/java/org/apache/felix/http/sslfilter/internal/
Author: jawi
Date: Fri Nov 15 13:17:40 2013
New Revision: 1542257
URL: http://svn.apache.org/r1542257
Log:
FELIX-4230 - Enhance SSL filter to forward client certificates:
- added some logging and exception handling to make sure that error
situations are traceable;
- did some monkey tests on SSL certificate forwarding, which seems to
work properly.
Added:
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java (with props)
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java (with props)
Modified:
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/HttpServiceTracker.java
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilter.java
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterActivator.java
felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterRequest.java
felix/trunk/http/sslfilter/src/test/java/org/apache/felix/http/sslfilter/internal/SslFilterRequestTest.java
Modified: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/HttpServiceTracker.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/HttpServiceTracker.java?rev=1542257&r1=1542256&r2=1542257&view=diff
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/HttpServiceTracker.java (original)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/HttpServiceTracker.java Fri Nov 15 13:17:40 2013
@@ -20,24 +20,28 @@ package org.apache.felix.http.sslfilter.
import java.util.HashMap;
import java.util.Hashtable;
+import java.util.Map;
import javax.servlet.ServletException;
import org.apache.felix.http.api.ExtHttpService;
import org.osgi.framework.BundleContext;
import org.osgi.framework.ServiceReference;
+import org.osgi.service.log.LogService;
import org.osgi.util.tracker.ServiceTracker;
+/**
+ * @author <a href="mailto:dev@felix.apache.org">Felix Project Team</a>
+ */
public class HttpServiceTracker extends ServiceTracker
{
-
- private final HashMap /* ServiceReference, SslFilter */filters;
+ private final Map<ServiceReference, SslFilter> filters;
public HttpServiceTracker(BundleContext context)
{
super(context, ExtHttpService.class.getName(), null);
- this.filters = new HashMap();
+ this.filters = new HashMap<ServiceReference, SslFilter>();
}
public Object addingService(ServiceReference reference)
@@ -49,11 +53,14 @@ public class HttpServiceTracker extends
try
{
service.registerFilter(filter, ".*", new Hashtable(), 0, null);
+
this.filters.put(reference, filter);
+
+ SystemLogger.log(LogService.LOG_DEBUG, "SSL filter registered...");
}
catch (ServletException e)
{
- // TODO: log
+ SystemLogger.log(LogService.LOG_WARNING, "Failed to register SSL filter!", e);
}
}
@@ -66,6 +73,8 @@ public class HttpServiceTracker extends
if (filter != null)
{
((ExtHttpService) service).unregisterFilter(filter);
+
+ SystemLogger.log(LogService.LOG_DEBUG, "SSL filter unregistered...");
}
super.removedService(reference, service);
Added: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java?rev=1542257&view=auto
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java (added)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java Fri Nov 15 13:17:40 2013
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.felix.http.sslfilter.internal;
+
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.ServiceReference;
+import org.osgi.service.log.LogService;
+import org.osgi.util.tracker.ServiceTracker;
+
+/**
+ * @author <a href="mailto:dev@felix.apache.org">Felix Project Team</a>
+ */
+public class LogServiceTracker extends ServiceTracker
+{
+ public LogServiceTracker(BundleContext context)
+ {
+ super(context, LogService.class.getName(), null);
+ }
+
+ @Override
+ public Object addingService(ServiceReference reference)
+ {
+ LogService result = (LogService) super.addingService(reference);
+ SystemLogger.setLogService(result);
+ return result;
+ }
+
+ @Override
+ public void removedService(ServiceReference reference, Object service)
+ {
+ SystemLogger.setLogService(null);
+ super.removedService(reference, service);
+ }
+}
Propchange: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/LogServiceTracker.java
------------------------------------------------------------------------------
svn:eol-style = native
Modified: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilter.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilter.java?rev=1542257&r1=1542256&r2=1542257&view=diff
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilter.java (original)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilter.java Fri Nov 15 13:17:40 2013
@@ -19,6 +19,8 @@
package org.apache.felix.http.sslfilter.internal;
import java.io.IOException;
+import java.security.cert.CertificateException;
+
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
@@ -27,9 +29,10 @@ import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
+import org.osgi.service.log.LogService;
+
public class SslFilter implements Filter
{
-
// request header indicating an SSL endpoint proxy
private static final String X_FORWARD_SSL_HEADER = "X-Forwarded-SSL";
@@ -41,15 +44,23 @@ public class SslFilter implements Filter
public void init(FilterConfig config)
{
+ // No explicit initialization needed...
}
- public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
- ServletException
+ public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException
{
HttpServletRequest httpReq = (HttpServletRequest) req;
if (X_FORWARD_SSL_VALUE.equalsIgnoreCase(httpReq.getHeader(X_FORWARD_SSL_HEADER)))
{
- httpReq = new SslFilterRequest(httpReq, httpReq.getHeader(X_FORWARD_SSL_CERTIFICATE_HEADER));
+ try
+ {
+ // In case this fails, we fall back to the original HTTP request, which is better than nothing...
+ httpReq = new SslFilterRequest(httpReq, httpReq.getHeader(X_FORWARD_SSL_CERTIFICATE_HEADER));
+ }
+ catch (CertificateException e)
+ {
+ SystemLogger.log(LogService.LOG_WARNING, "Failed to create SSL filter request! Problem parsing client certificates?! Client certificate will *not* be forwarded...", e);
+ }
}
// forward the request making sure any certificate is removed
@@ -69,6 +80,6 @@ public class SslFilter implements Filter
public void destroy()
{
+ // No explicit destroy needed...
}
-
}
Modified: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterActivator.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterActivator.java?rev=1542257&r1=1542256&r2=1542257&view=diff
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterActivator.java (original)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterActivator.java Fri Nov 15 13:17:40 2013
@@ -23,22 +23,29 @@ import org.osgi.framework.BundleContext;
public class SslFilterActivator implements BundleActivator
{
-
- private HttpServiceTracker tracker;
+ private HttpServiceTracker httpTracker;
+ private LogServiceTracker logTracker;
public void start(BundleContext context)
{
- this.tracker = new HttpServiceTracker(context);
- this.tracker.open();
+ this.logTracker = new LogServiceTracker(context);
+ this.logTracker.open();
+
+ this.httpTracker = new HttpServiceTracker(context);
+ this.httpTracker.open();
}
public void stop(BundleContext context)
{
- if (this.tracker != null)
+ if (this.httpTracker != null)
{
- this.tracker.close();
- this.tracker = null;
+ this.httpTracker.close();
+ this.httpTracker = null;
+ }
+ if (this.logTracker != null)
+ {
+ this.logTracker.close();
+ this.logTracker = null;
}
}
-
}
Modified: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterRequest.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterRequest.java?rev=1542257&r1=1542256&r2=1542257&view=diff
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterRequest.java (original)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SslFilterRequest.java Fri Nov 15 13:17:40 2013
@@ -32,7 +32,6 @@ import javax.servlet.http.HttpServletReq
class SslFilterRequest extends HttpServletRequestWrapper
{
-
// The HTTPS scheme name
private static final String HTTPS_SCHEME = "https";
@@ -56,41 +55,38 @@ class SslFilterRequest extends HttpServl
* The first certificate in the chain is the one set by the client, the next
* is the one used to authenticate the first, and so on.
*/
- private static final String ATTR_SSL_CERTIFICATE = "javax.servlet.request.X509Certificate";
+ protected static final String ATTR_SSL_CERTIFICATE = "javax.servlet.request.X509Certificate";
private String requestURL;
- SslFilterRequest(final HttpServletRequest request, final String clientCertHeader)
+ @SuppressWarnings("unchecked")
+ SslFilterRequest(HttpServletRequest request, String clientCertHeader) throws CertificateException
{
super(request);
if (clientCertHeader != null && clientCertHeader.length() > 0)
{
-
final String clientCert = HEADER_TO_CERT.matcher(clientCertHeader).replaceAll("\n");
try
{
- InputStream instream = new ByteArrayInputStream(clientCert.getBytes(UTF_8));
CertificateFactory fac = CertificateFactory.getInstance("X.509");
- @SuppressWarnings("unchecked")
+
+ InputStream instream = new ByteArrayInputStream(clientCert.getBytes(UTF_8));
+
Collection<X509Certificate> certs = (Collection<X509Certificate>) fac.generateCertificates(instream);
request.setAttribute(ATTR_SSL_CERTIFICATE, certs.toArray(new X509Certificate[certs.size()]));
}
- catch (CertificateException e)
- {
- // TODO Auto-generated catch block
- e.printStackTrace();
- }
catch (UnsupportedEncodingException e)
{
- // TODO Auto-generated catch block
- e.printStackTrace();
+ // Any JRE should support UTF-8...
+ throw new InternalError("UTF-8 not supported?!");
}
}
}
- void done() {
+ void done()
+ {
getRequest().removeAttribute(ATTR_SSL_CERTIFICATE);
}
@@ -121,8 +117,4 @@ class SslFilterRequest extends HttpServl
return new StringBuffer(this.requestURL);
}
-
- private final void provideCertificate(final HttpServletRequest request) throws UnsupportedEncodingException
- {
- }
}
Added: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java?rev=1542257&view=auto
==============================================================================
--- felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java (added)
+++ felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java Fri Nov 15 13:17:40 2013
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.felix.http.sslfilter.internal;
+
+import org.osgi.framework.ServiceReference;
+import org.osgi.service.log.LogService;
+
+/**
+ * @author <a href="mailto:dev@felix.apache.org">Felix Project Team</a>
+ */
+final class SystemLogger
+{
+ private static volatile LogService log;
+
+ private SystemLogger()
+ {
+ // Nop
+ }
+
+ static void setLogService(LogService _log)
+ {
+ log = _log;
+ }
+
+ static LogService getLogService()
+ {
+ return log;
+ }
+
+ public static void log(int level, String message)
+ {
+ LogService service = getLogService();
+ if (service != null)
+ {
+ service.log(level, message);
+ }
+ }
+
+ public static void log(int level, String message, Throwable exception)
+ {
+ LogService service = getLogService();
+ if (service != null)
+ {
+ service.log(level, message, exception);
+ }
+ }
+
+ public static void log(ServiceReference sr, int level, String message)
+ {
+ LogService service = getLogService();
+ if (service != null)
+ {
+ service.log(sr, level, message);
+ }
+ }
+
+ public static void log(ServiceReference sr, int level, String message, Throwable exception)
+ {
+ LogService service = getLogService();
+ if (service != null)
+ {
+ service.log(sr, level, message, exception);
+ }
+ }
+}
Propchange: felix/trunk/http/sslfilter/src/main/java/org/apache/felix/http/sslfilter/internal/SystemLogger.java
------------------------------------------------------------------------------
svn:eol-style = native
Modified: felix/trunk/http/sslfilter/src/test/java/org/apache/felix/http/sslfilter/internal/SslFilterRequestTest.java
URL: http://svn.apache.org/viewvc/felix/trunk/http/sslfilter/src/test/java/org/apache/felix/http/sslfilter/internal/SslFilterRequestTest.java?rev=1542257&r1=1542256&r2=1542257&view=diff
==============================================================================
--- felix/trunk/http/sslfilter/src/test/java/org/apache/felix/http/sslfilter/internal/SslFilterRequestTest.java (original)
+++ felix/trunk/http/sslfilter/src/test/java/org/apache/felix/http/sslfilter/internal/SslFilterRequestTest.java Fri Nov 15 13:17:40 2013
@@ -18,66 +18,67 @@
*/
package org.apache.felix.http.sslfilter.internal;
+import static junit.framework.Assert.assertEquals;
+import static junit.framework.Assert.assertFalse;
+import static junit.framework.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
import javax.servlet.http.HttpServletRequest;
-import junit.framework.TestCase;
-
import org.junit.Test;
import org.mockito.Mockito;
public class SslFilterRequestTest
{
-
@Test
- public void test_isSecure()
+ public void test_isSecure() throws Exception
{
- HttpServletRequest req = Mockito.mock(HttpServletRequest.class);
+ HttpServletRequest req = mock(HttpServletRequest.class);
SslFilterRequest sreq = new SslFilterRequest(req, null);
when(req.isSecure()).thenReturn(false);
- TestCase.assertFalse(req.isSecure());
- TestCase.assertTrue(sreq.isSecure());
- TestCase.assertFalse(req.isSecure());
+ assertFalse(req.isSecure());
+ assertTrue(sreq.isSecure());
+ assertFalse(req.isSecure());
when(req.isSecure()).thenReturn(true);
- TestCase.assertTrue(req.isSecure());
- TestCase.assertTrue(sreq.isSecure());
- TestCase.assertTrue(req.isSecure());
+ assertTrue(req.isSecure());
+ assertTrue(sreq.isSecure());
+ assertTrue(req.isSecure());
}
@Test
- public void test_getScheme()
+ public void test_getScheme() throws Exception
{
HttpServletRequest req = Mockito.mock(HttpServletRequest.class);
SslFilterRequest sreq = new SslFilterRequest(req, null);
when(req.getScheme()).thenReturn("http");
- TestCase.assertEquals("http", req.getScheme());
- TestCase.assertEquals("https", sreq.getScheme());
- TestCase.assertEquals("http", req.getScheme());
+ assertEquals("http", req.getScheme());
+ assertEquals("https", sreq.getScheme());
+ assertEquals("http", req.getScheme());
when(req.getScheme()).thenReturn("https");
- TestCase.assertEquals("https", req.getScheme());
- TestCase.assertEquals("https", sreq.getScheme());
- TestCase.assertEquals("https", req.getScheme());
+ assertEquals("https", req.getScheme());
+ assertEquals("https", sreq.getScheme());
+ assertEquals("https", req.getScheme());
}
@Test
- public void test_getRequestURL()
+ public void test_getRequestURL() throws Exception
{
HttpServletRequest req = Mockito.mock(HttpServletRequest.class);
SslFilterRequest sreq = new SslFilterRequest(req, null);
when(req.getRequestURL()).thenReturn(new StringBuffer("http://some/page"));
- TestCase.assertEquals("http://some/page", req.getRequestURL().toString());
- TestCase.assertEquals("https://some/page", sreq.getRequestURL().toString());
- TestCase.assertEquals("http://some/page", req.getRequestURL().toString());
+ assertEquals("http://some/page", req.getRequestURL().toString());
+ assertEquals("https://some/page", sreq.getRequestURL().toString());
+ assertEquals("http://some/page", req.getRequestURL().toString());
when(req.getRequestURL()).thenReturn(new StringBuffer("https://some/page"));
- TestCase.assertEquals("https://some/page", req.getRequestURL().toString());
- TestCase.assertEquals("https://some/page", sreq.getRequestURL().toString());
- TestCase.assertEquals("https://some/page", req.getRequestURL().toString());
+ assertEquals("https://some/page", req.getRequestURL().toString());
+ assertEquals("https://some/page", sreq.getRequestURL().toString());
+ assertEquals("https://some/page", req.getRequestURL().toString());
}
}