dtreskunov / easyssl Goto Github PK

4.0 4.0 1.0 348 KB

EasySSL is a small library to help create Spring Boot microservices that talk to each other over HTTPS with mutual authentication

License: Apache License 2.0

Java 95.12% Ruby 4.88%

easyssl's People

Contributors

Stargazers

Watchers

Forkers

quantum-fusion

easyssl's Issues

Support reading certs/keys from literal strings

This is a prerequisite for pulling secrets out of config files.

client auth is set to WANT

https://github.com/dtreskunov/easyssl/blob/master/src/main/java/com/github/dtreskunov/easyssl/spring/EasySslBeans.java#L208

This sets the client auth to WANT which according to http://docs.spring.io/spring-boot/docs/current/api/org/springframework/boot/context/embedded/Ssl.ClientAuth.html#WANT means that a client certificate is requested but not required. This should be NEED or a configurable value.

Jetty versions 9.4.15 or later cause server to reject client certificate

Test com.github.dtreskunov.easyssl.IntegrationTestUsingRealServer.happyCase fails with a socket write error [1].

Wireshark trace is attached: easyssl-testHappy-jetty-9.4.15-conn-reset.pcapng.zip. Server responds with a Certificate Unknown frame before closing the connection.

After downgrading Jetty to 9.4.14 (commit a1545c4), the error goes away: easyssl-testHappy-jetty-9.4.14-ok.pcapng.zip

[1]:

org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://localhost:18904/whoami": Software caused connection abort: socket write error; nested exception is java.net.SocketException: Software caused connection abort: socket write error
	at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:675)
	at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:622)
	at org.springframework.web.client.RestTemplate.getForEntity(RestTemplate.java:321)
	at com.github.dtreskunov.easyssl.IntegrationTestUsingRealServer.happyCase(IntegrationTestUsingRealServer.java:68)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:75)
	at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:86)
	at org.junit.rules.ExpectedException$ExpectedExceptionStatement.evaluate(ExpectedException.java:239)
	at org.junit.rules.RunRules.evaluate(RunRules.java:20)
	at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:84)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:252)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:94)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
	at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:70)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:191)
	at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:86)
	at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:678)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192)
Caused by: java.net.SocketException: Software caused connection abort: socket write error
	at java.net.SocketOutputStream.socketWrite0(Native Method)
	at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:111)
	at java.net.SocketOutputStream.write(SocketOutputStream.java:155)
	at sun.security.ssl.OutputRecord.writeBuffer(OutputRecord.java:431)
	at sun.security.ssl.OutputRecord.write(OutputRecord.java:417)
	at sun.security.ssl.SSLSocketImpl.writeRecordInternal(SSLSocketImpl.java:886)
	at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:857)
	at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:727)
	at sun.security.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:1150)
	at sun.security.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:1266)
	at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:1178)
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:348)
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
	at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
	at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
	at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:374)
	at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
	at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
	at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
	at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
	at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
	at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
	at org.springframework.http.client.HttpComponentsClientHttpRequest.executeInternal(HttpComponentsClientHttpRequest.java:89)
	at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)
	at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:53)
	at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:661)
	... 35 more

Some exceptions allow bypass of certificate validation

https://github.com/dtreskunov/easyssl/blob/master/src/main/java/com/github/dtreskunov/easyssl/ClientCertificateCheckingFilter.java#L50

Why would we want to continue along as if this was an authenticated request if we get an exception other than CertificateException? The default should be to return 403 unless we can validate the certificate.

Deadlocking in CRLTrustManager

Tomcat had spawned 200 threads. They're all busy because they're all waiting to enter the synchronized maybeLoadCRL method. The thread holding the lock is blocked on checking the lastModified() of the UrlResource represending the CRL (certificate revocation list) file. There is no timeout on the URLConnection.

A thread waiting for the lock:

Daemon Thread [https-jsse-nio-9443-exec-211] (Suspended)	
	owns: NioEndpoint$NioSocketWrapper  (id=12430)	
	waiting for: CRLTrustManager  (id=12431)	
->>	CRLTrustManager.maybeLoadCRL() line: 78	
	CRLTrustManager.check(X509Certificate[]) line: 105	
	CRLTrustManager.checkClientTrusted(X509Certificate[], String) line: 87	
	ClientCertificateCheckingFilter.checkClientCertificate(ServletRequest) line: 49	
	ClientCertificateCheckingFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 59	
...etc...

The thread holding the lock:

Daemon Thread [https-jsse-nio-9443-exec-13] (Suspended)	
	owns: Object  (id=12441)	
	owns: Object  (id=12442)	
	owns: DelegateHttpsURLConnection  (id=12443)	
	owns: CRLTrustManager  (id=12431)	
	owns: NioEndpoint$NioSocketWrapper  (id=12444)	
	SocketInputStream.socketRead(FileDescriptor, byte[], int, int, int) line: 116	
	SocketInputStream.read(byte[], int, int, int) line: 171	
	SocketInputStream.read(byte[], int, int) line: 141	
	InputRecord.readFully(InputStream, byte[], int, int) line: 465	
	InputRecord.readV3Record(InputStream, OutputStream) line: 593	
	InputRecord.read(InputStream, OutputStream) line: 532	
	SSLSocketImpl.readRecord(InputRecord, boolean) line: 983	
	SSLSocketImpl.performInitialHandshake() line: 1385	
	SSLSocketImpl.startHandshake(boolean) line: 1413	
	SSLSocketImpl.startHandshake() line: 1397	
	HttpsClient.afterConnect() line: 559	
	DelegateHttpsURLConnection(AbstractDelegateHttpsURLConnection).connect() line: 185	
	DelegateHttpsURLConnection(HttpURLConnection).getInputStream0() line: 1546	
	DelegateHttpsURLConnection(HttpURLConnection).getInputStream() line: 1474	
	DelegateHttpsURLConnection(HttpURLConnection).getHeaderField(String) line: 2982	
	DelegateHttpsURLConnection(HttpURLConnection).getHeaderFieldDate(String, long) line: 552	
	DelegateHttpsURLConnection(URLConnection).getLastModified() line: 559	
	HttpsURLConnectionImpl.getLastModified() line: 422	
	UrlResource(AbstractFileResolvingResource).lastModified() line: 175	
	CRLTrustManager.shouldLoadCRL() line: 71	
->>	CRLTrustManager.maybeLoadCRL() line: 78
	CRLTrustManager.check(X509Certificate[]) line: 105	
	CRLTrustManager.checkClientTrusted(X509Certificate[], String) line: 87	
	ClientCertificateCheckingFilter.checkClientCertificate(ServletRequest) line: 49	
	ClientCertificateCheckingFilter.doFilter(ServletRequest, ServletResponse, FilterChain) line: 59	
...etc...

Using hardcoded password for keystore

https://github.com/dtreskunov/easyssl/blob/master/src/main/java/com/github/dtreskunov/easyssl/spring/EasySslBeans.java#L76

I understand that the keystore is ephemeral. That means you don't need to actually know the password other than when it is running. So it could create a random password string at startup and use that for the keystore password.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.