Skip to content

Commit 1210696

Browse files
jonny-mccoubreyjonny-mccoubrey
authored
US887031: Use secure Trust Manager when connecting to RabbitMQ via TLS (#180)
1 parent 1cfb5f7 commit 1210696

File tree

5 files changed

+155
-1
lines changed

5 files changed

+155
-1
lines changed

‎release-notes-8.1.0.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,8 @@ ${version-number}
55

66
#### New Features
77

8+
#### Bug Fixes
9+
- **I887031:** Replace use of the TrustEverythingTrustManager with a TrustManager provided by the
10+
`javax.net.ssl.TrustManagerFactory`.
11+
812
#### Known Issues

‎util-rabbitmq/src/main/java/com/hpe/caf/util/rabbitmq/RabbitUtil.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,14 @@
2424
import org.slf4j.Logger;
2525
import org.slf4j.LoggerFactory;
2626

27+
import javax.net.ssl.SSLContext;
28+
import javax.net.ssl.TrustManagerFactory;
2729
import java.io.IOException;
2830
import java.net.URI;
2931
import java.net.URISyntaxException;
3032
import java.security.KeyManagementException;
33+
import java.security.KeyStore;
34+
import java.security.KeyStoreException;
3135
import java.security.NoSuchAlgorithmException;
3236
import java.util.ArrayList;
3337
import java.util.Collections;
@@ -105,6 +109,21 @@ public static Connection createRabbitConnection(final RabbitConfiguration rc,
105109
factory.setUsername(rc.getRabbitUser());
106110
factory.setPassword(rc.getRabbitPassword());
107111

112+
if (rc.getRabbitProtocol().equalsIgnoreCase("amqps")) {
113+
try {
114+
final String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
115+
final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(tmfAlgorithm);
116+
trustManagerFactory.init((KeyStore) null);
117+
118+
final SSLContext context = SSLContext.getInstance("TLS");
119+
context.init(null, trustManagerFactory.getTrustManagers(), null);
120+
121+
factory.useSslProtocol(context);
122+
} catch (final KeyStoreException e) {
123+
throw new IllegalStateException("Trust Manager Initialization Failed", e);
124+
}
125+
}
126+
108127
final URI rabbitUrl = new URI(String.format("%s://%s:%s", rc.getRabbitProtocol(), rc.getRabbitHost(),
109128
rc.getRabbitPort()));
110129
factory.setUri(rabbitUrl);

‎worker-test/pom.xml‎

Lines changed: 89 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,28 @@
170170
<startParallel>true</startParallel>
171171
<containerNamePattern>%a-%t</containerNamePattern>
172172
<images>
173+
<image>
174+
<alias>keystore</alias>
175+
<name>${project.artifactId}-keystore:${project.version}</name>
176+
<build>
177+
<from>${dockerHubPublic}/cafapi/opensuse-jre11:3.0.0</from>
178+
<runCmds>
179+
<runCmd>mkdir /test-keystore</runCmd>
180+
<runCmd>openssl genrsa -out /test-keystore/ca_key.pem 2048</runCmd>
181+
<runCmd>openssl req -x509 -new -key /test-keystore/ca_key.pem -out /test-keystore/ca_certificate.pem -days 3650 -subj "/CN=myname/OU=myorganisational.unit/O=myorganisation/L=mycity/S=myprovince/C=GB"</runCmd>
182+
<runCmd>openssl genrsa -out /test-keystore/server_key.pem 2048</runCmd>
183+
<runCmd>openssl req -new -key /test-keystore/server_key.pem -out /test-keystore/server.csr -subj "/CN=myname/OU=myorganisational.unit/O=myorganisation/L=mycity/S=myprovince/C=GB"</runCmd>
184+
<runCmd>chmod 664 /test-keystore/server_key.pem</runCmd>
185+
<runCmd>openssl x509 -req -in /test-keystore/server.csr -CA /test-keystore/ca_certificate.pem -CAkey /test-keystore/ca_key.pem -CAcreateserial -out /test-keystore/server_certificate.pem -days 3650</runCmd>
186+
</runCmds>
187+
<volumes>
188+
<volume>/test-keystore</volume>
189+
</volumes>
190+
</build>
191+
<run>
192+
<platform>linux/amd64</platform>
193+
</run>
194+
</image>
173195
<image>
174196
<alias>webdav</alias>
175197
<name>${dockerHubPublic}/cloudesire/webdav</name>
@@ -201,7 +223,10 @@
201223
</image>
202224
<image>
203225
<alias>rabbitmq</alias>
204-
<name>${dockerHubPublic}/library/rabbitmq:3-management</name>
226+
<name>${project.artifactId}-rabbitmq:${project.version}</name>
227+
<build>
228+
<contextDir>${project.basedir}/src/test/docker</contextDir>
229+
</build>
205230
<run>
206231
<ports>
207232
<port>${rabbitmq.ctrl.port}:15672</port>
@@ -218,6 +243,11 @@
218243
<log>
219244
<enabled>true</enabled>
220245
</log>
246+
<volumes>
247+
<from>
248+
<image>keystore</image>
249+
</from>
250+
</volumes>
221251
</run>
222252
</image>
223253
<image>
@@ -276,10 +306,15 @@
276306
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
277307
</CAF_WORKER_JAVA_OPTS>
278308
<CAF_WORKER_RETRY_LIMIT>2</CAF_WORKER_RETRY_LIMIT>
309+
<CAF_RABBITMQ_PROTOCOL>amqps</CAF_RABBITMQ_PROTOCOL>
310+
<CAF_RABBITMQ_PORT>5671</CAF_RABBITMQ_PORT>
311+
<SSL_CA_CRT_DIR>/test-keystore</SSL_CA_CRT_DIR>
312+
<SSL_CA_CRT>ca_certificate.pem</SSL_CA_CRT>
279313
</env>
280314
<volumes>
281315
<from>
282316
<image>webdav</image>
317+
<image>keystore</image>
283318
</from>
284319
</volumes>
285320
<links>
@@ -312,10 +347,15 @@
312347
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
313348
</CAF_WORKER_JAVA_OPTS>
314349
<CAF_WORKER_RETRY_LIMIT>2</CAF_WORKER_RETRY_LIMIT>
350+
<CAF_RABBITMQ_PROTOCOL>amqps</CAF_RABBITMQ_PROTOCOL>
351+
<CAF_RABBITMQ_PORT>5671</CAF_RABBITMQ_PORT>
352+
<SSL_CA_CRT_DIR>/test-keystore</SSL_CA_CRT_DIR>
353+
<SSL_CA_CRT>ca_certificate.pem</SSL_CA_CRT>
315354
</env>
316355
<volumes>
317356
<from>
318357
<image>webdav</image>
358+
<image>keystore</image>
319359
</from>
320360
</volumes>
321361
<links>
@@ -348,10 +388,15 @@
348388
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
349389
</CAF_WORKER_JAVA_OPTS>
350390
<CAF_WORKER_RETRY_LIMIT>2</CAF_WORKER_RETRY_LIMIT>
391+
<CAF_RABBITMQ_PROTOCOL>amqps</CAF_RABBITMQ_PROTOCOL>
392+
<CAF_RABBITMQ_PORT>5671</CAF_RABBITMQ_PORT>
393+
<SSL_CA_CRT_DIR>/test-keystore</SSL_CA_CRT_DIR>
394+
<SSL_CA_CRT>ca_certificate.pem</SSL_CA_CRT>
351395
</env>
352396
<volumes>
353397
<from>
354398
<image>webdav</image>
399+
<image>keystore</image>
355400
</from>
356401
</volumes>
357402
<links>
@@ -369,6 +414,47 @@
369414
</wait>
370415
</run>
371416
</image>
417+
<!--Worker to test SSL certificate trust manager when connecting to RabbitMQ-->
418+
<image>
419+
<alias>worker-test-no-valid-cert</alias>
420+
<name>${targetDockerRegistryPath}/worker-test:${project.version}</name>
421+
<run>
422+
<platform>linux/amd64</platform>
423+
<ports>
424+
<port>${worker.testadminport4}:8081</port>
425+
<port>${worker.testdebugport4}:5005</port>
426+
</ports>
427+
<env>
428+
<CAF_WORKER_DATASTORE_PATH>/srv/common/webdav</CAF_WORKER_DATASTORE_PATH>
429+
<CAF_WORKER_JAVA_OPTS>
430+
-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005
431+
</CAF_WORKER_JAVA_OPTS>
432+
<CAF_WORKER_RETRY_LIMIT>2</CAF_WORKER_RETRY_LIMIT>
433+
<CAF_RABBITMQ_PROTOCOL>amqps</CAF_RABBITMQ_PROTOCOL>
434+
<CAF_RABBITMQ_PORT>5671</CAF_RABBITMQ_PORT>
435+
</env>
436+
<volumes>
437+
<from>
438+
<image>webdav</image>
439+
</from>
440+
</volumes>
441+
<links>
442+
<link>rabbitmq</link>
443+
</links>
444+
<log>
445+
<enabled>true</enabled>
446+
</log>
447+
<!--Expect healthcheck to return 500 as trying to use SSL without valid certificate-->
448+
<wait>
449+
<http>
450+
<url>http://${docker.host.address}:${worker.testadminport4}/healthcheck</url>
451+
<status>500</status>
452+
</http>
453+
<time>120000</time>
454+
<shutdown>500</shutdown>
455+
</wait>
456+
</run>
457+
</image>
372458
</images>
373459
</configuration>
374460
</plugin>
@@ -386,8 +472,10 @@
386472
<worker.debugport>5005</worker.debugport>
387473
<worker.testadminport2>8082</worker.testadminport2>
388474
<worker.testadminport3>8083</worker.testadminport3>
475+
<worker.testadminport4>8084</worker.testadminport4>
389476
<worker.testdebugport2>5006</worker.testdebugport2>
390477
<worker.testdebugport3>5007</worker.testdebugport3>
478+
<worker.testdebugport4>5008</worker.testdebugport4>
391479
</properties>
392480
</profile>
393481
</profiles>

‎worker-test/src/test/docker/Dockerfile‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#
2+
# Copyright 2015-2024 Open Text.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
ARG DOCKER_HUB_PUBLIC=dockerhub-public.svsartifactory.swinfra.net
18+
19+
FROM ${DOCKER_HUB_PUBLIC}/library/rabbitmq:3-management
20+
21+
COPY rabbitmq.conf /etc/rabbitmq

‎worker-test/src/test/docker/rabbitmq.conf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#
2+
# Copyright 2015-2024 Open Text.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
listeners.ssl.default = 5671
18+
ssl_options.cacertfile = /test-keystore/ca_certificate.pem
19+
ssl_options.certfile = /test-keystore/server_certificate.pem
20+
ssl_options.keyfile = /test-keystore/server_key.pem
21+
ssl_options.verify = verify_none
22+
ssl_options.fail_if_no_peer_cert = false

0 commit comments

Comments
 (0)