[ISSUE#3315]Nacos client support https #3654
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| /* | ||
| * Copyright 1999-2018 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.tls; | ||
|
|
||
| import com.alibaba.nacos.common.utils.IpUtils; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import javax.net.ssl.HostnameVerifier; | ||
| import javax.net.ssl.SSLSession; | ||
| import java.util.concurrent.ConcurrentHashMap; | ||
|
|
||
| /** | ||
| * A HostnameVerifier verify ipv4 and localhost. | ||
| * | ||
| * @author wangwei | ||
| */ | ||
|
|
||
| public final class SelfHostnameVerifier implements HostnameVerifier { | ||
|
|
||
| private static final Logger LOGGER = LoggerFactory.getLogger(SelfHostnameVerifier.class); | ||
|
|
||
| private final HostnameVerifier hv; | ||
|
|
||
| private static ConcurrentHashMap<String, Boolean> hosts = new ConcurrentHashMap<String, Boolean>(); | ||
|
|
||
| private static final String[] LOCALHOST_HOSTNAME = new String[] {"localhost", "127.0.0.1"}; | ||
|
|
||
| public SelfHostnameVerifier(HostnameVerifier hv) { | ||
| this.hv = hv; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean verify(String hostname, SSLSession session) { | ||
| if (LOCALHOST_HOSTNAME[0].equalsIgnoreCase(hostname) || LOCALHOST_HOSTNAME[1].equals(hostname)) { | ||
| return true; | ||
| } | ||
| if (isIpv4(hostname)) { | ||
| return true; | ||
| } | ||
| return hv.verify(hostname, session); | ||
| } | ||
|
|
||
| private static boolean isIpv4(String host) { | ||
| if (host == null || host.isEmpty()) { | ||
| LOGGER.warn("host is empty, isIPv4 = false"); | ||
| return false; | ||
| } | ||
| Boolean cacheHostVerify = hosts.get(host); | ||
| if (cacheHostVerify != null) { | ||
| return cacheHostVerify; | ||
| } | ||
| boolean isIp = IpUtils.isIpv4(host); | ||
| hosts.putIfAbsent(host, isIp); | ||
| return isIp; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,112 @@ | ||
| /* | ||
| * Copyright 1999-2018 Alibaba Group Holding Ltd. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package com.alibaba.nacos.common.tls; | ||
|
|
||
| import com.alibaba.nacos.common.utils.IoUtils; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import javax.net.ssl.SSLException; | ||
| import javax.net.ssl.TrustManager; | ||
| import javax.net.ssl.TrustManagerFactory; | ||
| import javax.net.ssl.X509TrustManager; | ||
| import java.io.FileInputStream; | ||
| import java.io.InputStream; | ||
| import java.security.KeyStore; | ||
| import java.security.cert.Certificate; | ||
| import java.security.cert.CertificateException; | ||
| import java.security.cert.CertificateFactory; | ||
| import java.security.cert.X509Certificate; | ||
| import java.util.Collection; | ||
|
|
||
| /** | ||
| * A TrustManager tool returns the specified TrustManager. | ||
| * | ||
| * @author wangwei | ||
| */ | ||
| public final class SelfTrustManager { | ||
|
|
||
| private static final Logger LOGGER = LoggerFactory.getLogger(SelfTrustManager.class); | ||
|
|
||
| @SuppressWarnings("checkstyle:WhitespaceAround") | ||
|
There was a problem hiding this comment. Why SuppressWarnings checkstyle:WhitespaceAround? There was a problem hiding this comment. 第60行那两个}}报的这个checkstyle错误，但是 格式化工具就自动格式化成这样 There was a problem hiding this comment. 感觉可能是checkstyle的bug 官方文档说不会把双括弧认为是非法的。 或者是我们这种写法不属于双括弧初始化器。 |
||
| static TrustManager[] trustAll = new TrustManager[] {new X509TrustManager() { | ||
|
|
||
| @Override | ||
| public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException { | ||
| } | ||
|
|
||
| @Override | ||
| public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException { | ||
| } | ||
|
|
||
| @Override | ||
| public X509Certificate[] getAcceptedIssuers() { | ||
| return null; | ||
| } | ||
| }}; | ||
|
|
||
| /** | ||
| * Returns the result of calling {@link #buildSecureTrustManager} if {@code needAuth} is enable and {@code | ||
| * trustCertPath} exists. Returns the {@link trustAll} otherwise. | ||
| * | ||
| * @param needAuth whether need client auth | ||
| * @param trustCertPath trust certificate path | ||
| * @return Array of {@link TrustManager } | ||
| */ | ||
| public static TrustManager[] trustManager(boolean needAuth, String trustCertPath) { | ||
| if (needAuth) { | ||
| try { | ||
| return trustCertPath == null ? null : buildSecureTrustManager(trustCertPath); | ||
| } catch (SSLException e) { | ||
| LOGGER.warn("degrade trust manager as build failed, " + "will trust all certs."); | ||
| return trustAll; | ||
| } | ||
| } else { | ||
| return trustAll; | ||
| } | ||
| } | ||
|
|
||
| private static TrustManager[] buildSecureTrustManager(String trustCertPath) throws SSLException { | ||
| TrustManagerFactory selfTmf; | ||
| InputStream in = null; | ||
|
|
||
| try { | ||
| String algorithm = TrustManagerFactory.getDefaultAlgorithm(); | ||
| selfTmf = TrustManagerFactory.getInstance(algorithm); | ||
|
|
||
| KeyStore trustKeyStore = KeyStore.getInstance("JKS"); | ||
| trustKeyStore.load(null, null); | ||
|
|
||
| in = new FileInputStream(trustCertPath); | ||
| CertificateFactory cf = CertificateFactory.getInstance("X.509"); | ||
|
|
||
| Collection<X509Certificate> certs = (Collection<X509Certificate>) cf.generateCertificates(in); | ||
| int count = 0; | ||
| for (Certificate cert : certs) { | ||
| trustKeyStore.setCertificateEntry("cert-" + (count++), cert); | ||
| } | ||
|
|
||
| selfTmf.init(trustKeyStore); | ||
| return selfTmf.getTrustManagers(); | ||
| } catch (Exception e) { | ||
| LOGGER.error("build client trustManagerFactory failed", e); | ||
| throw new SSLException(e); | ||
| } finally { | ||
| IoUtils.closeQuietly(in); | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这里的逻辑是不是可以独立为一个函数，看起来相对简洁点。
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
是指tlsFileWatcher这一段吗？
addSSLContextChangeListener(FileChangeListener Listener)?独立成一个函数，这样至少对使用AbstractHttpClientFactory.java 类的开发者来说屏蔽一些
tlsClientTrustCertPath这样的细节。是好点，我改下。There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
从51行开始到68行，感觉这里可以独立为一个函数。