Skip to content

Commit 1415b34

Browse files
sscarduziosscarduzio
committed
make ssl custom ciphers and protocols work with all versions
1 parent b0be0d3 commit 1415b34

File tree

4 files changed

+72
-21
lines changed

4 files changed

+72
-21
lines changed

‎es23x/src/main/java/tech/beshu/ror/es/SSLTransport.java

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@
2121
* Created by sscarduzio on 28/11/2016.
2222
*/
2323

24+
import cz.seznam.euphoria.shaded.guava.com.google.common.base.Joiner;
2425
import org.elasticsearch.common.inject.Inject;
25-
import org.elasticsearch.common.logging.Loggers;
2626
import org.elasticsearch.common.network.NetworkService;
2727
import org.elasticsearch.common.settings.Settings;
2828
import org.elasticsearch.common.util.BigArrays;
@@ -33,11 +33,11 @@
3333
import org.jboss.netty.handler.ssl.SslContext;
3434
import tech.beshu.ror.commons.SSLCertParser;
3535
import tech.beshu.ror.commons.settings.BasicSettings;
36-
import tech.beshu.ror.commons.settings.RawSettings;
3736
import tech.beshu.ror.commons.shims.es.LoggerShim;
3837
import tech.beshu.ror.commons.utils.TempFile;
3938

4039
import java.io.File;
40+
import java.util.List;
4141
import java.util.Optional;
4242

4343
public class SSLTransport extends NettyHttpServerTransport {
@@ -72,16 +72,30 @@ public HttpSslChannelPipelineFactory(NettyHttpServerTransport transport) {
7272
try {
7373
File chainFile = TempFile.newFile("fullchain", "pem", certChain);
7474
File privatekeyFile = TempFile.newFile("privkey", "pem", privateKey);
75-
76-
if (sslSettings.getAllowedSSLProtocols().isPresent() ||sslSettings.getAllowedSSLCiphers().isPresent()) {
77-
logger.error("ROR SSL: setting accepted protocols or ciphers not available for ES < 6.0!");
78-
// List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
79-
// sslcb.protocols(basicSettings.getAllowedSSLProtocols().get().toArray(new String[protocols.size()]));
80-
// logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
75+
List<String> ciphers = sslSettings.getAllowedSSLCiphers().orElse(null);
76+
List<String> protocols = sslSettings.getAllowedSSLProtocols().orElse(null);
77+
78+
SslContext sslContext = SslContext.newServerContext(
79+
null,
80+
null,
81+
chainFile,
82+
privatekeyFile,
83+
null,
84+
ciphers,
85+
protocols,
86+
0, 0
87+
);
88+
89+
if (ciphers != null) {
90+
logger.info("ROR SSL accepted ciphers: " + Joiner.on(",").join(ciphers));
91+
}
92+
if (protocols != null) {
93+
logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
8194
}
8295

96+
8397
// #TODO expose configuration of sslPrivKeyPem password? Letsencrypt never sets one..
84-
context = Optional.of(SslContext.newServerContext(chainFile, privatekeyFile, null));
98+
context = Optional.of(sslContext);
8599

86100
} catch (Exception e) {
87101
context = Optional.empty();

‎es51x/src/main/java/tech/beshu/ror/es/SSLTransportNetty4.java

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,11 @@
2121
* Created by sscarduzio on 28/11/2016.
2222
*/
2323

24+
import cz.seznam.euphoria.shaded.guava.com.google.common.base.Joiner;
2425
import io.netty.channel.Channel;
2526
import io.netty.channel.ChannelHandler;
2627
import io.netty.channel.ChannelHandlerContext;
28+
import io.netty.handler.ssl.ApplicationProtocolConfig;
2729
import io.netty.handler.ssl.NotSslRecordException;
2830
import io.netty.handler.ssl.SslContext;
2931
import io.netty.handler.ssl.SslContextBuilder;
@@ -36,11 +38,11 @@
3638
import org.elasticsearch.threadpool.ThreadPool;
3739
import tech.beshu.ror.commons.SSLCertParser;
3840
import tech.beshu.ror.commons.settings.BasicSettings;
39-
import tech.beshu.ror.commons.settings.RawSettings;
4041
import tech.beshu.ror.commons.shims.es.LoggerShim;
4142

4243
import java.io.ByteArrayInputStream;
4344
import java.nio.charset.StandardCharsets;
45+
import java.util.List;
4446
import java.util.Optional;
4547

4648
public class SSLTransportNetty4 extends Netty4HttpServerTransport {
@@ -76,7 +78,9 @@ protected void exceptionCaught(final ChannelHandlerContext ctx, final Throwable
7678
}
7779

7880
public ChannelHandler configureServerChannelHandler() {
79-
return new SSLHandler(this);
81+
SSLHandler handler = new SSLHandler(this);
82+
logger.info("ROR SSL accepted ciphers: " + Joiner.on(",").join(handler.context.get().cipherSuites()));
83+
return handler;
8084
}
8185

8286
private class SSLHandler extends Netty4HttpServerTransport.HttpChannelHandler {
@@ -86,13 +90,31 @@ private class SSLHandler extends Netty4HttpServerTransport.HttpChannelHandler {
8690
super(transport, SSLTransportNetty4.this.detailedErrorsEnabled, SSLTransportNetty4.this.threadPool.getThreadContext());
8791

8892
new SSLCertParser(basicSettings, logger, (certChain, privateKey) -> {
93+
8994
try {
9095
// #TODO expose configuration of sslPrivKeyPem password? Letsencrypt never sets one..
91-
context = Optional.of(SslContextBuilder.forServer(
96+
SslContextBuilder sslcb = SslContextBuilder.forServer(
9297
new ByteArrayInputStream(certChain.getBytes(StandardCharsets.UTF_8)),
9398
new ByteArrayInputStream(privateKey.getBytes(StandardCharsets.UTF_8)),
9499
null
95-
).build());
100+
);
101+
102+
if (basicSettings.getAllowedSSLCiphers().isPresent()) {
103+
sslcb.ciphers(basicSettings.getAllowedSSLCiphers().get());
104+
}
105+
106+
if (basicSettings.getAllowedSSLProtocols().isPresent()) {
107+
List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
108+
sslcb.applicationProtocolConfig(new ApplicationProtocolConfig(
109+
ApplicationProtocolConfig.Protocol.NPN_AND_ALPN,
110+
ApplicationProtocolConfig.SelectorFailureBehavior.CHOOSE_MY_LAST_PROTOCOL,
111+
ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
112+
protocols
113+
));
114+
logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
115+
}
116+
117+
context = Optional.of(sslcb.build());
96118
} catch (Exception e) {
97119
context = Optional.empty();
98120
logger.error("Failed to load SSL CertChain & private key from Keystore!");

‎es52x/src/main/java/tech/beshu/ror/es/SSLTransportNetty4.java

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import io.netty.channel.Channel;
2626
import io.netty.channel.ChannelHandler;
2727
import io.netty.channel.ChannelHandlerContext;
28+
import io.netty.handler.ssl.ApplicationProtocolConfig;
2829
import io.netty.handler.ssl.NotSslRecordException;
2930
import io.netty.handler.ssl.SslContext;
3031
import io.netty.handler.ssl.SslContextBuilder;
@@ -42,6 +43,7 @@
4243

4344
import java.io.ByteArrayInputStream;
4445
import java.nio.charset.StandardCharsets;
46+
import java.util.List;
4547
import java.util.Optional;
4648

4749
public class SSLTransportNetty4 extends Netty4HttpServerTransport {
@@ -102,10 +104,15 @@ private class SSLHandler extends Netty4HttpServerTransport.HttpChannelHandler {
102104
}
103105

104106
if (basicSettings.getAllowedSSLProtocols().isPresent()) {
105-
logger.error("ROR SSL: setting accepted protocols not available for ES < 6.0!");
106-
// List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
107-
// sslcb.protocols(basicSettings.getAllowedSSLProtocols().get().toArray(new String[protocols.size()]));
108-
// logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
107+
List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
108+
sslcb.applicationProtocolConfig(new ApplicationProtocolConfig(
109+
ApplicationProtocolConfig.Protocol.NPN_AND_ALPN,
110+
ApplicationProtocolConfig.SelectorFailureBehavior.CHOOSE_MY_LAST_PROTOCOL,
111+
ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
112+
protocols
113+
));
114+
115+
logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
109116
}
110117

111118
context = Optional.of(sslcb.build());

‎es53x/src/main/java/tech/beshu/ror/es/SSLTransportNetty4.java

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import io.netty.channel.Channel;
2626
import io.netty.channel.ChannelHandler;
2727
import io.netty.channel.ChannelHandlerContext;
28+
import io.netty.handler.ssl.ApplicationProtocolConfig;
2829
import io.netty.handler.ssl.NotSslRecordException;
2930
import io.netty.handler.ssl.SslContext;
3031
import io.netty.handler.ssl.SslContextBuilder;
@@ -42,6 +43,7 @@
4243

4344
import java.io.ByteArrayInputStream;
4445
import java.nio.charset.StandardCharsets;
46+
import java.util.List;
4547
import java.util.Optional;
4648

4749
public class SSLTransportNetty4 extends Netty4HttpServerTransport {
@@ -102,11 +104,17 @@ private class SSLHandler extends Netty4HttpServerTransport.HttpChannelHandler {
102104
}
103105

104106
if (basicSettings.getAllowedSSLProtocols().isPresent()) {
105-
logger.error("ROR SSL: setting accepted protocols not available for ES < 6.0!");
106-
// List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
107-
// sslcb.protocols(basicSettings.getAllowedSSLProtocols().get().toArray(new String[protocols.size()]));
108-
// logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
107+
List<String> protocols = basicSettings.getAllowedSSLProtocols().get();
108+
sslcb.applicationProtocolConfig(new ApplicationProtocolConfig(
109+
ApplicationProtocolConfig.Protocol.NPN_AND_ALPN,
110+
ApplicationProtocolConfig.SelectorFailureBehavior.CHOOSE_MY_LAST_PROTOCOL,
111+
ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
112+
protocols
113+
));
114+
115+
logger.info("ROR SSL accepted protocols: " + Joiner.on(",").join(protocols));
109116
}
117+
110118
SslContext sslContext = sslcb.build();
111119
context = Optional.of(sslContext);
112120

0 commit comments

Comments
 (0)