001/**
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements. See the NOTICE file distributed with this
004 * work for additional information regarding copyright ownership. The ASF
005 * licenses this file to you under the Apache License, Version 2.0 (the
006 * "License"); you may not use this file except in compliance with the License.
007 * You may obtain a copy of the License at
008 *
009 * http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
013 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
014 * License for the specific language governing permissions and limitations under
015 * the License.
016 */
017package org.apache.activemq.transport.https;
018
019
020/**
021 * Extend Jetty's {@link SslSocketConnector} to optionally also provide
022 * Kerberos5ized SSL sockets. The only change in behavior from superclass is
023 * that we no longer honor requests to turn off NeedAuthentication when running
024 * with Kerberos support.
025 */
026public class Krb5AndCertsSslSocketConnector {
027//
028//extends SslSocketConnector {
029//    public static final List<String> KRB5_CIPHER_SUITES = Collections.unmodifiableList(Collections.singletonList("TLS_KRB5_WITH_3DES_EDE_CBC_SHA"));
030//    static {
031//        System.setProperty("https.cipherSuites", KRB5_CIPHER_SUITES.get(0));
032//    }
033//
034//    private static final Logger LOG = LoggerFactory.getLogger(Krb5AndCertsSslSocketConnector.class);
035//
036//    private static final String REMOTE_PRINCIPAL = "remote_principal";
037//
038//    public enum MODE {
039//        KRB, CERTS, BOTH
040//    } // Support Kerberos, certificates or both?
041//
042//    private boolean useKrb;
043//    private boolean useCerts;
044//
045//    public Krb5AndCertsSslSocketConnector() {
046//        // By default, stick to cert based authentication
047//        super();
048//        useKrb = false;
049//        useCerts = true;
050//        setPasswords();
051//    }
052//    public Krb5AndCertsSslSocketConnector(SslContextFactory f, String auth) {
053//        // By default, stick to cert based authentication
054//        super(f);
055//        useKrb = false;
056//        useCerts = true;
057//        setPasswords();
058//        setMode(auth);
059//    }
060//
061//    public static boolean isKrb(String mode) {
062//        return mode == MODE.KRB.toString() || mode == MODE.BOTH.toString();
063//    }
064//
065//    public void setMode(String mode) {
066//        useKrb = mode == MODE.KRB.toString() || mode == MODE.BOTH.toString();
067//        useCerts = mode == MODE.CERTS.toString() || mode == MODE.BOTH.toString();
068//        logIfDebug("useKerb = " + useKrb + ", useCerts = " + useCerts);
069//    }
070//
071//    // If not using Certs, set passwords to random gibberish or else
072//    // Jetty will actually prompt the user for some.
073//    private void setPasswords() {
074//        if (!useCerts) {
075//            Random r = new Random();
076//            System.setProperty("jetty.ssl.password", String.valueOf(r.nextLong()));
077//            System.setProperty("jetty.ssl.keypassword", String.valueOf(r.nextLong()));
078//        }
079//    }
080//
081//    @Override
082//    public SslContextFactory getSslContextFactory() {
083//        final SslContextFactory factory = super.getSslContextFactory();
084//
085//        if (useCerts) {
086//            return factory;
087//        }
088//
089//        try {
090//            SSLContext context = factory.getProvider() == null ? SSLContext.getInstance(factory.getProtocol()) : SSLContext.getInstance(factory.getProtocol(),
091//                factory.getProvider());
092//            context.init(null, null, null);
093//            factory.setSslContext(context);
094//        } catch (NoSuchAlgorithmException e) {
095//        } catch (NoSuchProviderException e) {
096//        } catch (KeyManagementException e) {
097//        }
098//
099//        return factory;
100//    }
101//
102//    /*
103//     * (non-Javadoc)
104//     *
105//     * @see
106//     * org.mortbay.jetty.security.SslSocketConnector#newServerSocket(java.lang
107//     * .String, int, int)
108//     */
109//    @Override
110//    protected ServerSocket newServerSocket(String host, int port, int backlog) throws IOException {
111//        logIfDebug("Creating new KrbServerSocket for: " + host);
112//        SSLServerSocket ss = null;
113//
114//        if (useCerts) // Get the server socket from the SSL super impl
115//            ss = (SSLServerSocket) super.newServerSocket(host, port, backlog);
116//        else { // Create a default server socket
117//            try {
118//                ss = (SSLServerSocket) super.newServerSocket(host, port, backlog);
119//            } catch (Exception e) {
120//                LOG.warn("Could not create KRB5 Listener", e);
121//                throw new IOException("Could not create KRB5 Listener: " + e.toString());
122//            }
123//        }
124//
125//        // Add Kerberos ciphers to this socket server if needed.
126//        if (useKrb) {
127//            ss.setNeedClientAuth(true);
128//            String[] combined;
129//            if (useCerts) { // combine the cipher suites
130//                String[] certs = ss.getEnabledCipherSuites();
131//                combined = new String[certs.length + KRB5_CIPHER_SUITES.size()];
132//                System.arraycopy(certs, 0, combined, 0, certs.length);
133//                System.arraycopy(KRB5_CIPHER_SUITES.toArray(new String[0]), 0, combined, certs.length, KRB5_CIPHER_SUITES.size());
134//            } else { // Just enable Kerberos auth
135//                combined = KRB5_CIPHER_SUITES.toArray(new String[0]);
136//            }
137//
138//            ss.setEnabledCipherSuites(combined);
139//        }
140//        return ss;
141//    };
142//
143//    @Override
144//    public void customize(EndPoint endpoint, Request request) throws IOException {
145//        if (useKrb) { // Add Kerberos-specific info
146//            SSLSocket sslSocket = (SSLSocket) endpoint.getTransport();
147//            Principal remotePrincipal = sslSocket.getSession().getPeerPrincipal();
148//            logIfDebug("Remote principal = " + remotePrincipal);
149//            request.setScheme(HttpSchemes.HTTPS);
150//            request.setAttribute(REMOTE_PRINCIPAL, remotePrincipal);
151//
152//            if (!useCerts) { // Add extra info that would have been added by
153//                             // super
154//                String cipherSuite = sslSocket.getSession().getCipherSuite();
155//                Integer keySize = Integer.valueOf(ServletSSL.deduceKeyLength(cipherSuite));
156//                ;
157//
158//                request.setAttribute("javax.servlet.request.cipher_suite", cipherSuite);
159//                request.setAttribute("javax.servlet.request.key_size", keySize);
160//            }
161//        }
162//
163//        if (useCerts)
164//            super.customize(endpoint, request);
165//    }
166//
167//    private void logIfDebug(String s) {
168//        if (LOG.isDebugEnabled())
169//            LOG.debug(s);
170//    }
171}