package org.openslx.dozmod.util;
import java.net.ProxySelector;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import java.util.concurrent.atomic.AtomicReference;
import javax.net.ssl.SSLContext;
import org.apache.hc.client5.http.classic.methods.HttpGet;
import org.apache.hc.client5.http.config.ConnectionConfig;
import org.apache.hc.client5.http.config.RequestConfig;
import org.apache.hc.client5.http.config.TlsConfig;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse;
import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
import org.apache.hc.core5.http.ssl.TLS;
import org.apache.hc.core5.util.Timeout;
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.openslx.bwlp.thrift.iface.MasterServer;
import org.openslx.dozmod.App;
import org.openslx.dozmod.authentication.ShibbolethEcp;
import org.openslx.thrifthelper.ThriftManager;
import org.openslx.util.Util;
import com.btr.proxy.search.ProxySearch;
import com.btr.proxy.search.wpad.WpadProxySearchStrategy;
import com.btr.proxy.util.Logger.LogBackEnd;
import com.btr.proxy.util.Logger.LogLevel;
/**
* Configures the proxy
*
* @author Jonathan Bauer
*/
public class ProxyConfigurator {
/**
* Logger for this class
*/
private final static Logger LOGGER = LogManager.getLogger(ProxyConfigurator.class);
private static final AtomicReference<CloseableHttpClient> apacheClient = new AtomicReference<>();
private static final List<TLS[]> TLS_CHECKLIST;
private static final Timeout TIMEOUT_CONNECT = Timeout.ofSeconds(8);
private static final Timeout TIMEOUT_SOCKET = Timeout.ofSeconds(8);
private static final Timeout TIMEOUT_REQUEST = Timeout.ofSeconds(3);
private static SSLContext thriftCtx;
static {
List<TLS[]> res = new ArrayList<>();
res.add(null);
boolean ok = false;
try {
SSLContext.getInstance("TLSv1.3");
ok = true;
} catch (Exception e) {
}
if (ok) {
res.add(new TLS[] { TLS.V_1_3, TLS.V_1_2 });
}
res.add(new TLS[] { TLS.V_1_2 });
res.add(new TLS[] { TLS.V_1_2, TLS.V_1_1 });
TLS_CHECKLIST = Collections.unmodifiableList(res);
try {
if (ok) {
thriftCtx = SSLContext.getInstance("TLSv1.3");
} else {
thriftCtx = SSLContext.getInstance("TLSv1.2");
}
thriftCtx.init(null, null, null);
} catch (NoSuchAlgorithmException | KeyManagementException e) {
LOGGER.warn("Error creating default SSL context for thrift", e);
}
}
private static void tryAllThriftVariants() {
thriftCtx = null;
for (TLS[] tls : TLS_CHECKLIST) {
if (tls == null)
continue;
SSLContext ctx;
MasterServer.Client masterClient;
try {
ctx = SSLContext.getInstance(tls[0].id);
ctx.init(null, null, null);
masterClient = ThriftManager.getNewMasterClient(ctx,
App.getMasterServerAddress(),
App.THRIFT_SSL_PORT, 4000);
if (masterClient != null) {
masterClient.ping();
try {
masterClient.getInputProtocol().getTransport().close();
masterClient.getOutputProtocol().getTransport().close();
} catch (Throwable e) {
}
thriftCtx = ctx;
break;
}
} catch (Exception e) {
}
}
}
private static void tryAllHttpsVariants() {
apacheClient.set(null);
for (TLS[] tls : TLS_CHECKLIST) {
HttpClientBuilder builder;
try {
if (tls == null) {
builder = createDefaultBuilder();
} else {
builder = createSlxBuilder(tls);
}
CloseableHttpClient client = builder.build();
if (testHttpsMaster(client)) {
apacheClient.set(client);
break;
}
} catch (Exception e) {
}
}
}
/**
* Initialization method.
*/
public static void init() {
tryAllThriftVariants();
// Only try HTTPS if thrift succeeded
if (thriftCtx != null) {
tryAllHttpsVariants();
}
// To be discussed: Let's bail out if the master server is reachable via thrift and https
if (apacheClient.get() != null) {
LOGGER.info("Not setting up proxy because master server seems reachable.");
return;
}
// first setup the logger of proxy-vole
com.btr.proxy.util.Logger.setBackend(new LogBackEnd() {
public void log(Class<?> clazz, LogLevel loglevel, String msg, Object... params) {
Level priority;
switch (loglevel) {
case ERROR:
priority = Level.ERROR;
break;
case WARNING:
priority = Level.WARN;
break;
case INFO:
priority = Level.INFO;
break;
default:
priority = Level.DEBUG;
}
LogManager.getLogger(clazz).log(priority, MessageFormat.format(msg, params));
}
public boolean isLogginEnabled(LogLevel logLevel) {
return true;
}
});
LOGGER.info("Master server not directly reachable; trying to determine proxy");
// try to find local proxy settings
ProxySearch proxySearch = ProxySearch.getDefaultProxySearch();
ProxySelector myProxySelector = proxySearch.getProxySelector();
if (myProxySelector == null) {
// didn't work, try WPAD detection
LOGGER.error("No suitable proxy settings found, trying WPAD...");
WpadProxySearchStrategy ss = new WpadProxySearchStrategy();
myProxySelector = ss.getProxySelector();
}
// final check to see if WPAD actually worked
if (myProxySelector == null) {
LOGGER.error("Could not find a suitable proxy!");
return;
}
// Seems to have worked
ProxySelector.setDefault(myProxySelector);
tryAllThriftVariants();
tryAllHttpsVariants();
if (thriftCtx == null || apacheClient.get() == null) {
LOGGER.warn("Could not establish Thrift/HTTPS connection after auto-configuring Proxy config");
return;
}
LOGGER.info("Proxy initialised.");
Util.sleep(10);
}
/**
* Get the HttpClient to be used with apache
* httpclient.
*
* @return client
*/
public static CloseableHttpClient getClient() {
CloseableHttpClient inst = apacheClient.get();
if (inst != null)
return inst;
inst = createDefaultBuilder().build();
apacheClient.compareAndSet(null, inst);
return inst;
}
private static HttpClientBuilder createDefaultBuilder() {
return HttpClientBuilder.create()
.setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
.setDefaultConnectionConfig(ConnectionConfig.custom()
.setConnectTimeout(ProxyConfigurator.TIMEOUT_CONNECT)
.setSocketTimeout(ProxyConfigurator.TIMEOUT_SOCKET)
.build())
.setMaxConnPerRoute(4)
.build());
}
private static HttpClientBuilder createSlxBuilder(TLS[] tlsVersions) {
return HttpClientBuilder.create()
.setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
.setSSLSocketFactory(SSLConnectionSocketFactoryBuilder.create()
.setTlsVersions(tlsVersions)
.build())
.setDefaultTlsConfig(TlsConfig.custom()
.setSupportedProtocols(tlsVersions)
.build())
.setDefaultConnectionConfig(ConnectionConfig.custom()
.setConnectTimeout(ProxyConfigurator.TIMEOUT_CONNECT)
.setSocketTimeout(ProxyConfigurator.TIMEOUT_SOCKET)
.build())
.setMaxConnPerRoute(4)
.build());
}
private static boolean testHttpsMaster(CloseableHttpClient client) {
final RequestConfig requestConfig = RequestConfig.custom()
.setConnectionRequestTimeout(ProxyConfigurator.TIMEOUT_REQUEST)
.build();
HttpGet httpGet = new HttpGet(ShibbolethEcp.BWLP_SP.toString());
httpGet.setConfig(requestConfig);
httpGet.setHeader("Accept", "text/html, application/vnd.paos+xml");
httpGet.setHeader("PAOS",
"ver=\"urn:liberty:paos:2003-08\";\"urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp\"");
try (CloseableHttpResponse response = client.execute(httpGet)) {
LOGGER.debug("Master server replies with " + response.getCode());
int rc = response.getCode();
return rc >= 200 && rc < 300;
} catch (Exception e) {
LOGGER.debug("Cannot reach master server via HTTPS", e);
return false;
}
}
public static SSLContext getThriftSslContext() {
return thriftCtx;
}
}
