1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
|
package org.openslx.dozmod.util;
import java.net.ProxySelector;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.concurrent.atomic.AtomicReference;
import javax.net.ssl.SSLContext;
import org.apache.hc.client5.http.classic.methods.HttpGet;
import org.apache.hc.client5.http.config.ConnectionConfig;
import org.apache.hc.client5.http.config.RequestConfig;
import org.apache.hc.client5.http.config.TlsConfig;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClientBuilder;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
import org.apache.hc.core5.http.HttpResponse;
import org.apache.hc.core5.http.ssl.TLS;
import org.apache.hc.core5.util.Timeout;
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.openslx.bwlp.thrift.iface.MasterServer;
import org.openslx.dozmod.App;
import org.openslx.dozmod.authentication.ShibbolethEcp;
import org.openslx.thrifthelper.ThriftManager;
import org.openslx.util.Util;
import com.btr.proxy.search.ProxySearch;
import com.btr.proxy.search.wpad.WpadProxySearchStrategy;
import com.btr.proxy.util.Logger.LogBackEnd;
import com.btr.proxy.util.Logger.LogLevel;
/**
* Configures the proxy
*
* @author Jonathan Bauer
*/
public class ProxyConfigurator {
/**
* Logger for this class
*/
private final static Logger LOGGER = LogManager.getLogger(ProxyConfigurator.class);
private static final AtomicReference<CloseableHttpClient> apacheClient = new AtomicReference<>();
private static final List<TLS[]> TLS_CHECKLIST;
private static final Timeout TIMEOUT_CONNECT = Timeout.ofSeconds(8);
private static final Timeout TIMEOUT_SOCKET = Timeout.ofSeconds(8);
private static final Timeout TIMEOUT_REQUEST = Timeout.ofSeconds(3);
private static SSLContext thriftCtx;
static {
List<TLS[]> res = new ArrayList<>();
res.add(null);
boolean ok = false;
try {
SSLContext.getInstance("TLSv1.3");
ok = true;
} catch (Exception e) {
}
if (ok) {
res.add(new TLS[] { TLS.V_1_3, TLS.V_1_2 });
}
res.add(new TLS[] { TLS.V_1_2 });
res.add(new TLS[] { TLS.V_1_2, TLS.V_1_1 });
TLS_CHECKLIST = Collections.unmodifiableList(res);
try {
if (ok) {
thriftCtx = SSLContext.getInstance("TLSv1.3");
} else {
thriftCtx = SSLContext.getInstance("TLSv1.2");
}
thriftCtx.init(null, null, null);
} catch (NoSuchAlgorithmException | KeyManagementException e) {
LOGGER.warn("Error creating default SSL context for thrift", e);
}
}
private static void tryAllThriftVariants() {
thriftCtx = null;
for (TLS[] tls : TLS_CHECKLIST) {
if (tls == null)
continue;
SSLContext ctx;
MasterServer.Client masterClient;
try {
ctx = SSLContext.getInstance(tls[0].id);
ctx.init(null, null, null);
masterClient = ThriftManager.getNewMasterClient(ctx,
App.getMasterServerAddress(),
App.THRIFT_SSL_PORT, 4000);
if (masterClient != null) {
masterClient.ping();
try {
masterClient.getInputProtocol().getTransport().close();
masterClient.getOutputProtocol().getTransport().close();
} catch (Throwable e) {
}
thriftCtx = ctx;
break;
}
} catch (Exception e) {
}
}
}
private static void tryAllHttpsVariants() {
apacheClient.set(null);
for (TLS[] tls : TLS_CHECKLIST) {
HttpClientBuilder builder;
try {
if (tls == null) {
builder = createDefaultBuilder();
} else {
builder = createSlxBuilder(tls);
}
CloseableHttpClient client = builder.build();
if (testHttpsMaster(client)) {
apacheClient.set(client);
break;
}
} catch (Exception e) {
}
}
}
/**
* Initialization method.
*/
public static void init() {
tryAllThriftVariants();
// Only try HTTPS if thrift succeeded
if (thriftCtx != null) {
tryAllHttpsVariants();
}
// To be discussed: Let's bail out if the master server is reachable via thrift and https
if (apacheClient.get() != null) {
LOGGER.info("Not setting up proxy because master server seems reachable.");
return;
}
// first setup the logger of proxy-vole
com.btr.proxy.util.Logger.setBackend(new LogBackEnd() {
public void log(Class<?> clazz, LogLevel loglevel, String msg, Object... params) {
Level priority;
switch (loglevel) {
case ERROR:
priority = Level.ERROR;
break;
case WARNING:
priority = Level.WARN;
break;
case INFO:
priority = Level.INFO;
break;
default:
priority = Level.DEBUG;
}
LogManager.getLogger(clazz).log(priority, MessageFormat.format(msg, params));
}
public boolean isLogginEnabled(LogLevel logLevel) {
return true;
}
});
LOGGER.info("Master server not directly reachable; trying to determine proxy");
// try to find local proxy settings
ProxySearch proxySearch = ProxySearch.getDefaultProxySearch();
ProxySelector myProxySelector = proxySearch.getProxySelector();
if (myProxySelector == null) {
// didn't work, try WPAD detection
LOGGER.error("No suitable proxy settings found, trying WPAD...");
WpadProxySearchStrategy ss = new WpadProxySearchStrategy();
myProxySelector = ss.getProxySelector();
}
// final check to see if WPAD actually worked
if (myProxySelector == null) {
LOGGER.error("Could not find a suitable proxy!");
return;
}
// Seems to have worked
ProxySelector.setDefault(myProxySelector);
tryAllThriftVariants();
tryAllHttpsVariants();
if (thriftCtx == null || apacheClient.get() == null) {
LOGGER.warn("Could not establish Thrift/HTTPS connection after auto-configuring Proxy config");
return;
}
LOGGER.info("Proxy initialised.");
Util.sleep(10);
}
/**
* Get the HttpClient to be used with apache
* httpclient.
*
* @return client
*/
public static CloseableHttpClient getClient() {
CloseableHttpClient inst = apacheClient.get();
if (inst != null)
return inst;
inst = createDefaultBuilder().build();
apacheClient.compareAndSet(null, inst);
return inst;
}
private static HttpClientBuilder createDefaultBuilder() {
return HttpClientBuilder.create()
.setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
.setDefaultConnectionConfig(ConnectionConfig.custom()
.setConnectTimeout(ProxyConfigurator.TIMEOUT_CONNECT)
.setSocketTimeout(ProxyConfigurator.TIMEOUT_SOCKET)
.build())
.setMaxConnPerRoute(4)
.build());
}
private static HttpClientBuilder createSlxBuilder(TLS[] tlsVersions) {
return HttpClientBuilder.create()
.setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
.setSSLSocketFactory(SSLConnectionSocketFactoryBuilder.create()
.setTlsVersions(tlsVersions)
.build())
.setDefaultTlsConfig(TlsConfig.custom()
.setSupportedProtocols(tlsVersions)
.build())
.setDefaultConnectionConfig(ConnectionConfig.custom()
.setConnectTimeout(ProxyConfigurator.TIMEOUT_CONNECT)
.setSocketTimeout(ProxyConfigurator.TIMEOUT_SOCKET)
.build())
.setMaxConnPerRoute(4)
.build());
}
private static boolean testHttpsMaster(CloseableHttpClient client) {
final RequestConfig requestConfig = RequestConfig.custom()
.setConnectionRequestTimeout(ProxyConfigurator.TIMEOUT_REQUEST)
.build();
HttpGet httpGet = new HttpGet(ShibbolethEcp.BWLP_SP.toString());
httpGet.setConfig(requestConfig);
httpGet.setHeader("Accept", "text/html, application/vnd.paos+xml");
httpGet.setHeader("PAOS",
"ver=\"urn:liberty:paos:2003-08\";\"urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp\"");
try {
HttpResponse response = client.execute(httpGet);
LOGGER.debug("Master server replies with " + response.getCode());
int rc = response.getCode();
return rc >= 200 && rc < 300;
} catch (Exception e) {
LOGGER.debug("Cannot reach master server via HTTPS", e);
return false;
}
}
public static SSLContext getThriftSslContext() {
return thriftCtx;
}
}
|
