Skip to content

deduplicate sslcontext code by creating an internal shared util #910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pjfanning wants to merge 1 commit into
base: main
Choose a base branch
from
Open

deduplicate sslcontext code by creating an internal shared util #910

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 1 addition & 14 deletions .../src/main/scala/org/apache/pekko/discovery/kubernetes/KubernetesApiServiceDiscovery.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,6 @@ package org.apache.pekko.discovery.kubernetes
import java.net.InetAddress
import java.nio.charset.StandardCharsets
import java.nio.file.{ Files, Paths }
import java.security.{ KeyStore, SecureRandom }
import javax.net.ssl.{ KeyManager, KeyManagerFactory, SSLContext, TrustManager }

import scala.collection.immutable
import scala.collection.immutable.Seq
Expand Down Expand Up @@ -233,18 +231,7 @@ class KubernetesApiServiceDiscovery(settings: Settings)(
* This uses blocking IO, and so should only be used at startup from blocking dispatcher.
*/
private def clientHttpsConnectionContext(): HttpsConnectionContext = {
val certificates = PemManagersProvider.loadCertificates(settings.apiCaPath)

val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
val keyStore = KeyStore.getInstance("PKCS12")
keyStore.load(null)
factory.init(keyStore, Array.empty)
val km: Array[KeyManager] = factory.getKeyManagers
val tm: Array[TrustManager] =
PemManagersProvider.buildTrustManagers(certificates)
val random: SecureRandom = new SecureRandom
val sslContext = SSLContext.getInstance(settings.tlsVersion)
sslContext.init(km, tm, random)
val sslContext = PemManagersProvider.createSslContext(settings.apiCaPath, settings.tlsVersion)
ConnectionContext.httpsClient(sslContext)
}

Expand Down
19 changes: 3 additions & 16 deletions ...a/org/apache/pekko/coordination/lease/kubernetes/internal/AbstractKubernetesApiImpl.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@ import pekko.stream.scaladsl.{ FileIO, Keep, Sink }
import pekko.util.ByteString

import java.nio.file.{ Files, Paths }
import java.security.{ KeyStore, SecureRandom }
import javax.net.ssl.{ KeyManager, KeyManagerFactory, SSLContext, TrustManager }
import javax.net.ssl.SSLContext
import scala.collection.immutable
import scala.concurrent.{ ExecutionContext, Future }
import scala.util.control.NonFatal
Expand All @@ -51,20 +50,8 @@ import scala.util.control.NonFatal
protected val log: LoggingAdapter = Logging(system, getClass: Class[?])
private val http: HttpExt = Http()(system)

private lazy val sslContext: SSLContext = {
val certificates = PemManagersProvider.loadCertificates(settings.apiCaPath)
val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
val keyStore = KeyStore.getInstance("PKCS12")
keyStore.load(null)
factory.init(keyStore, Array.empty)
val km: Array[KeyManager] = factory.getKeyManagers
val tm: Array[TrustManager] =
PemManagersProvider.buildTrustManagers(certificates)
val random: SecureRandom = new SecureRandom
val sslContext = SSLContext.getInstance(settings.tlsVersion)
sslContext.init(km, tm, random)
sslContext
}
private lazy val sslContext: SSLContext =
PemManagersProvider.createSslContext(settings.apiCaPath, settings.tlsVersion)

private lazy val clientSslContext: HttpsConnectionContext = ConnectionContext.httpsClient(sslContext)

Expand Down
22 changes: 20 additions & 2 deletions management-pki/src/main/scala/org/apache/pekko/pki/kubernetes/PemManagersProvider.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ package org.apache.pekko.pki.kubernetes
import java.io.File
import java.nio.charset.StandardCharsets
import java.nio.file.Files
import java.security.{ KeyStore, PrivateKey }
import java.security.{ KeyStore, PrivateKey, SecureRandom }
import java.security.cert.{ Certificate, CertificateFactory }

import scala.concurrent.blocking
Expand All @@ -27,7 +27,7 @@ import org.apache.pekko
import pekko.annotation.InternalApi
import pekko.pki.pem.{ DERPrivateKeyLoader, PEMDecoder }

import javax.net.ssl.{ TrustManager, TrustManagerFactory }
import javax.net.ssl.{ KeyManagerFactory, SSLContext, TrustManager, TrustManagerFactory }

/**
* INTERNAL API
Expand Down Expand Up @@ -68,4 +68,22 @@ private[pekko] object PemManagersProvider {
certFactory.generateCertificates(Files.newInputStream(new File(filename).toPath)).asScala
}

/**
* INTERNAL API
*
* Creates an SSLContext that trusts the given CA certificate file, with no client key material.
*/
@InternalApi def createSslContext(caCertPath: String, tlsVersion: String): SSLContext = {
val certificates = loadCertificates(caCertPath)
val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
val ks = KeyStore.getInstance("PKCS12")
ks.load(null)
factory.init(ks, Array.empty)
val km = factory.getKeyManagers
val tm = buildTrustManagers(certificates)
val sslContext = SSLContext.getInstance(tlsVersion)
sslContext.init(km, tm, new SecureRandom)
sslContext
}

}
18 changes: 1 addition & 17 deletions ...bernetes/src/main/scala/org/apache/pekko/rollingupdate/kubernetes/KubernetesApiImpl.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,12 +47,6 @@ import pekko.util.ByteString

import java.nio.file.Files
import java.nio.file.Paths
import java.security.KeyStore
import java.security.SecureRandom
import javax.net.ssl.KeyManager
import javax.net.ssl.KeyManagerFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManager

/**
* INTERNAL API
Expand Down Expand Up @@ -473,17 +467,7 @@ PUTs must contain resourceVersions. Response:
*/
private def clientHttpsConnectionContext(k8sSettings: KubernetesSettings): Option[HttpsConnectionContext] = {
if (k8sSettings.secure) {
val certificates = PemManagersProvider.loadCertificates(k8sSettings.apiCaPath)
val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
val keyStore = KeyStore.getInstance("PKCS12")
keyStore.load(null)
factory.init(keyStore, Array.empty)
val km: Array[KeyManager] = factory.getKeyManagers
val tm: Array[TrustManager] =
PemManagersProvider.buildTrustManagers(certificates)
val random: SecureRandom = new SecureRandom
val sslContext = SSLContext.getInstance("TLSv1.2")
sslContext.init(km, tm, random)
val sslContext = PemManagersProvider.createSslContext(k8sSettings.apiCaPath, "TLSv1.2")
Some(ConnectionContext.httpsClient(sslContext))
} else
None
Expand Down