Self-signed ES certificates, Snapshot plugin reloading
* Support self-signed certificates and host names not listed in certificates.
Correct handling of snapshot plugin reloading.
* Correct WarCdiFractory.java to use the ES Metrics configuration instead of the
ES storage configuration to access metrics data.
MODIFY
common/es/src/main/java/io/apiman/common/es/util/DefaultEsClientFactory.java
common/es/src/main/java/io/apiman/common/es/util/DefaultEsClientFactory.java
@@ -33,9 +33,12 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.math.NumberUtils;
import org.apache.http.HttpHost;
import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.nio.conn.SchemeIOSessionStrategy;
import org.apache.http.nio.conn.ssl.SSLIOSessionStrategy;
+import org.apache.http.ssl.SSLContextBuilder;
/**
* Factory for creating elasticsearch clients.
@@ -141,11 +144,21 @@ public class DefaultEsClientFactory extends AbstractClientFactory implements IEs
String trustStorePath = config.get("client.truststore");
String trustStorePassword = config.get("client.truststore.password");
- SSLContext sslContext = SSLContext.getInstance("TLS");
+ SSLContextBuilder sslContextBuilder = SSLContextBuilder.create();
+
+ String trustCertificate = config.get("client.trust.certificate");
+ if (!StringUtils.isBlank(trustCertificate) && trustCertificate.equals("true")) {
+ sslContextBuilder = sslContextBuilder.loadTrustMaterial(new TrustSelfSignedStrategy());
+ }
+
+ SSLContext sslContext = sslContextBuilder.build();
Info kPathInfo = new Info(clientKeystorePath, clientKeystorePassword);
Info tPathInfo = new Info(trustStorePath, trustStorePassword);
sslContext.init(KeyStoreUtil.getKeyManagers(kPathInfo), KeyStoreUtil.getTrustManagers(tPathInfo), new SecureRandom());
- HostnameVerifier hostnameVerifier = new DefaultHostnameVerifier();
+
+ String trustHost = config.get("client.trust.host");
+ HostnameVerifier hostnameVerifier = !StringUtils.isBlank(trustHost) && trustHost.equals("true") ? NoopHostnameVerifier.INSTANCE : new DefaultHostnameVerifier();
+
SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
SchemeIOSessionStrategy httpsIOSessionStrategy = new SSLIOSessionStrategy(sslContext, hostnameVerifier);

MODIFY
distro/tomcat8/src/main/resources/overlay/conf/apiman.properties
distro/tomcat8/src/main/resources/overlay/conf/apiman.properties
@@ -11,11 +11,18 @@ apiman-manager.config.logger=standard
# apiman components.
# ---------------------------------------------------------------------
apiman.es.protocol=http
+apiman.es.initialize=true
apiman.es.host=localhost
apiman.es.port=19200
apiman.es.username=
apiman.es.password=
apiman.es.timeout=10000
+apiman.es.keystore=
+apiman.es.keystore.password=
+apiman.es.truststore=
+apiman.es.truststore.password=
+apiman.es.trust.certificate=
+apiman.es.trust.host=
# ---------------------------------------------------------------------
# Some hibernate settings only useful when JPA is the storage.type.
@@ -39,7 +46,13 @@ apiman-manager.storage.es.client.port=${apiman.es.port}
apiman-manager.storage.es.client.username=${apiman.es.username}
apiman-manager.storage.es.client.password=${apiman.es.password}
apiman-manager.storage.es.client.timeout=${apiman.es.timeout}
-apiman-manager.storage.es.client.initialize=true
+apiman-manager.storage.es.client.initialize=${apiman.es.initialize}
+apiman-manager.storage.es.client.keystore=${apiman.es.keystore}
+apiman-manager.storage.es.client.keystore.password=${apiman.es.keystore.password}
+apiman-manager.storage.es.client.truststore=${apiman.es.truststore}
+apiman-manager.storage.es.client.truststore.password=${apiman.es.truststore.password}
+apiman-manager.storage.es.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-manager.storage.es.client.trust.host=${apiman.es.trust.host}
# API Manager metrics settings.
apiman-manager.metrics.type=es
@@ -49,6 +62,12 @@ apiman-manager.metrics.es.client.port=${apiman.es.port}
apiman-manager.metrics.es.client.username=${apiman.es.username}
apiman-manager.metrics.es.client.password=${apiman.es.password}
apiman-manager.metrics.es.client.timeout=${apiman.es.timeout}
+apiman-manager.metrics.es.client.keystore=${apiman.es.keystore}
+apiman-manager.metrics.es.client.keystore.password=${apiman.es.keystore.password}
+apiman-manager.metrics.es.client.truststore=${apiman.es.truststore}
+apiman-manager.metrics.es.client.truststore.password=${apiman.es.truststore.password}
+apiman-manager.metrics.es.client.trust.certificate=$eapiman.es.trust.certificate}
+apiman-manager.metrics.es.client.trust.host=${apiman.es.trust.host}
# API Manager API Catalog
apiman-manager.api-catalog.type=io.apiman.manager.api.core.catalog.JsonApiCatalog
@@ -89,10 +108,16 @@ apiman-gateway.metrics.client.type=jest
apiman-gateway.metrics.client.protocol=${apiman.es.protocol}
apiman-gateway.metrics.client.host=${apiman.es.host}
apiman-gateway.metrics.client.port=${apiman.es.port}
-apiman-gateway.metrics.client.initialize=true
+apiman-gateway.metrics.client.initialize=${apiman.es.initialize}
apiman-gateway.metrics.client.username=${apiman.es.username}
apiman-gateway.metrics.client.password=${apiman.es.password}
apiman-gateway.metrics.client.timeout=${apiman.es.timeout}
+apiman-gateway.metrics.client.keystore=${apiman.es.keystore}
+apiman-gateway.metrics.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.metrics.client.truststore=${apiman.es.truststore}
+apiman-gateway.metrics.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.metrics.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.metrics.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
# SSL/TLS settings for the gateway connector(s).
@@ -137,11 +162,17 @@ apiman-gateway.registry.client.type=jest
apiman-gateway.registry.client.protocol=${apiman.es.protocol}
apiman-gateway.registry.client.host=${apiman.es.host}
apiman-gateway.registry.client.port=${apiman.es.port}
-apiman-gateway.registry.client.initialize=true
+apiman-gateway.registry.client.initialize=${apiman.es.initialize}
apiman-gateway.registry.client.username=${apiman.es.username}
apiman-gateway.registry.client.password=${apiman.es.password}
apiman-gateway.registry.client.timeout=${apiman.es.timeout}
+apiman-gateway.registry.client.keystore=${apiman.es.keystore}
+apiman-gateway.registry.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.registry.client.truststore=${apiman.es.truststore}
+apiman-gateway.registry.client.truststore.password=${apiman.es.truststore.password}
#apiman-gateway.registry.cache-polling-interval=15
+apiman-gateway.registry.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.registry.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
# Shared State Component Settings
@@ -152,10 +183,16 @@ apiman-gateway.components.ISharedStateComponent.client.type=jest
apiman-gateway.components.ISharedStateComponent.client.protocol=${apiman.es.protocol}
apiman-gateway.components.ISharedStateComponent.client.host=${apiman.es.host}
apiman-gateway.components.ISharedStateComponent.client.port=${apiman.es.port}
-apiman-gateway.components.ISharedStateComponent.client.initialize=true
+apiman-gateway.components.ISharedStateComponent.client.initialize=${apiman.es.initialize}
apiman-gateway.components.ISharedStateComponent.client.username=${apiman.es.username}
apiman-gateway.components.ISharedStateComponent.client.password=${apiman.es.password}
apiman-gateway.components.ISharedStateComponent.client.timeout=${apiman.es.timeout}
+apiman-gateway.components.ISharedStateComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.ISharedStateComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.ISharedStateComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.ISharedStateComponent.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.components.ISharedStateComponent.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.components.ISharedStateComponent.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
@@ -167,10 +204,16 @@ apiman-gateway.components.IRateLimiterComponent.client.type=jest
apiman-gateway.components.IRateLimiterComponent.client.protocol=${apiman.es.protocol}
apiman-gateway.components.IRateLimiterComponent.client.host=${apiman.es.host}
apiman-gateway.components.IRateLimiterComponent.client.port=${apiman.es.port}
-apiman-gateway.components.IRateLimiterComponent.client.initialize=true
+apiman-gateway.components.IRateLimiterComponent.client.initialize=${apiman.es.initialize}
apiman-gateway.components.IRateLimiterComponent.client.username=${apiman.es.username}
apiman-gateway.components.IRateLimiterComponent.client.password=${apiman.es.password}
apiman-gateway.components.IRateLimiterComponent.client.timeout=${apiman.es.timeout}
+apiman-gateway.components.IRateLimiterComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.IRateLimiterComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.IRateLimiterComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.IRateLimiterComponent.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.components.IRateLimiterComponent.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.components.IRateLimiterComponent.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
# Cache Store Component Settings
@@ -181,10 +224,16 @@ apiman-gateway.components.ICacheStoreComponent.client.type=jest
apiman-gateway.components.ICacheStoreComponent.client.protocol=${apiman.es.protocol}
apiman-gateway.components.ICacheStoreComponent.client.host=${apiman.es.host}
apiman-gateway.components.ICacheStoreComponent.client.port=${apiman.es.port}
-apiman-gateway.components.ICacheStoreComponent.client.initialize=true
+apiman-gateway.components.ICacheStoreComponent.client.initialize=${apiman.es.initialize}
apiman-gateway.components.ICacheStoreComponent.client.username=${apiman.es.username}
apiman-gateway.components.ICacheStoreComponent.client.password=${apiman.es.password}
apiman-gateway.components.ICacheStoreComponent.client.timeout=${apiman.es.timeout}
+apiman-gateway.components.ICacheStoreComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.ICacheStoreComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.ICacheStoreComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.ICacheStoreComponent.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.components.ICacheStoreComponent.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.components.ICacheStoreComponent.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
# Execute Blocking Component Settings

MODIFY
distro/wildfly11/src/main/resources/overlay/standalone/configuration/apiman.properties
distro/wildfly11/src/main/resources/overlay/standalone/configuration/apiman.properties
@@ -20,6 +20,13 @@ apiman.es.port=19200
apiman.es.username=
apiman.es.password=
apiman.es.timeout=10000
+apiman.es.initialize=true
+apiman.es.keystore=
+apiman.es.keystore.password=
+apiman.es.truststore=
+apiman.es.truststore.password=
+apiman.es.trust.certificate=
+apiman.es.trust.host=
# ---------------------------------------------------------------------
# Some hibernate settings only useful when JPA is the storage.type.
@@ -45,7 +52,13 @@ apiman-manager.storage.jpa.initialize=true
#apiman-manager.storage.es.client.username=${apiman.es.username}
#apiman-manager.storage.es.client.password=${apiman.es.password}
#apiman-manager.storage.es.client.timeout=${apiman.es.timeout}
-#apiman-manager.storage.es.client.initialize=true
+#apiman-manager.storage.es.client.initialize=${apiman.es.initialize}
+#apiman-manager.storage.es.client.keystore=${apiman.es.keystore}
+#apiman-manager.storage.es.client.keystore.password=${apiman.es.keystore.password}
+#apiman-manager.storage.es.client.truststore=${apiman.es.truststore}
+#apiman-manager.storage.es.client.truststore.password=${apiman.es.truststore.password}
+#apiman-manager.storage.es.client.trust.certificate=${apiman.es.trust.certificate}
+#apiman-manager.storage.es.client.trust.host=${apiman.es.trust.host}
# API Manager metrics settings.
apiman-manager.metrics.type=es
@@ -56,6 +69,12 @@ apiman-manager.metrics.es.client.port=${apiman.es.port}
apiman-manager.metrics.es.client.username=${apiman.es.username}
apiman-manager.metrics.es.client.password=${apiman.es.password}
apiman-manager.metrics.es.client.timeout=${apiman.es.timeout}
+apiman-manager.metrics.es.client.keystore=${apiman.es.keystore}
+apiman-manager.metrics.es.client.keystore.password=${apiman.es.keystore.password}
+apiman-manager.metrics.es.client.truststore=${apiman.es.truststore}
+apiman-manager.metrics.es.client.truststore.password=${apiman.es.truststore.password}
+apiman-manager.metrics.es.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-manager.metrics.es.client.trust.host=${apiman.es.trust.host}
# API Manager API Catalog
apiman-manager.api-catalog.type=io.apiman.manager.api.core.catalog.JsonApiCatalog
@@ -99,7 +118,11 @@ apiman-gateway.metrics.client.port=${apiman.es.port}
apiman-gateway.metrics.client.username=${apiman.es.username}
apiman-gateway.metrics.client.password=${apiman.es.password}
apiman-gateway.metrics.client.timeout=${apiman.es.timeout}
-apiman-gateway.metrics.client.initialize=true
+apiman-gateway.metrics.client.initialize=${apiman.es.initialize}
+apiman-gateway.metrics.client.keystore=${apiman.es.keystore}
+apiman-gateway.metrics.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.metrics.client.truststore=${apiman.es.truststore}
+apiman-gateway.metrics.client.truststore.password=${apiman.es.truststore.password}
# ---------------------------------------------------------------------
# SSL/TLS settings for the gateway connector(s).
@@ -147,7 +170,13 @@ apiman-gateway.registry.client.port=${apiman.es.port}
apiman-gateway.registry.client.username=${apiman.es.username}
apiman-gateway.registry.client.password=${apiman.es.password}
apiman-gateway.registry.client.timeout=${apiman.es.timeout}
-apiman-gateway.registry.client.initialize=true
+apiman-gateway.registry.client.initialize=${apiman.es.initialize}
+apiman-gateway.registry.client.keystore=${apiman.es.keystore}
+apiman-gateway.registry.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.registry.client.truststore=${apiman.es.truststore}
+apiman-gateway.registry.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.registry.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.registry.client.trust.host=${apiman.es.trust.host}
#apiman-gateway.registry.cache-polling-interval=15
# ---------------------------------------------------------------------
@@ -162,7 +191,13 @@ apiman-gateway.components.ISharedStateComponent.client.port=${apiman.es.port}
apiman-gateway.components.ISharedStateComponent.client.username=${apiman.es.username}
apiman-gateway.components.ISharedStateComponent.client.password=${apiman.es.password}
apiman-gateway.components.ISharedStateComponent.client.timeout=${apiman.es.timeout}
-apiman-gateway.components.ISharedStateComponent.client.initialize=true
+apiman-gateway.components.ISharedStateComponent.client.initialize=${apiman.es.initialize}
+apiman-gateway.components.ISharedStateComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.ISharedStateComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.ISharedStateComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.ISharedStateComponent.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.components.ISharedStateComponent.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.components.ISharedStateComponent.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
@@ -177,7 +212,13 @@ apiman-gateway.components.IRateLimiterComponent.client.port=${apiman.es.port}
apiman-gateway.components.IRateLimiterComponent.client.username=${apiman.es.username}
apiman-gateway.components.IRateLimiterComponent.client.password=${apiman.es.password}
apiman-gateway.components.IRateLimiterComponent.client.timeout=${apiman.es.timeout}
-apiman-gateway.components.IRateLimiterComponent.client.initialize=true
+apiman-gateway.components.IRateLimiterComponent.client.initialize=${apiman.es.initialize}
+apiman-gateway.components.IRateLimiterComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.IRateLimiterComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.IRateLimiterComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.IRateLimiterComponent.client.truststore.password=${apiman.es.truststore.password}
+apiman-gateway.components.IRateLimiterComponent.client.trust.certificate=${apiman.es.trust.certificate}
+apiman-gateway.components.IRateLimiterComponent.client.trust.host=${apiman.es.trust.host}
# ---------------------------------------------------------------------
# Cache Store Component Settings
@@ -191,7 +232,11 @@ apiman-gateway.components.ICacheStoreComponent.client.port=${apiman.es.port}
apiman-gateway.components.ICacheStoreComponent.client.username=${apiman.es.username}
apiman-gateway.components.ICacheStoreComponent.client.password=${apiman.es.password}
apiman-gateway.components.ICacheStoreComponent.client.timeout=${apiman.es.timeout}
-apiman-gateway.components.ICacheStoreComponent.client.initialize=true
+apiman-gateway.components.ICacheStoreComponent.client.initialize=${apiman.es.initialize}
+apiman-gateway.components.ICacheStoreComponent.client.keystore=${apiman.es.keystore}
+apiman-gateway.components.ICacheStoreComponent.client.keystore.password=${apiman.es.keystore.password}
+apiman-gateway.components.ICacheStoreComponent.client.truststore=${apiman.es.truststore}
+apiman-gateway.components.ICacheStoreComponent.client.truststore.password=${apiman.es.truststore.password}
# ---------------------------------------------------------------------
# Execute Blocking Component Settings

MODIFY
gateway/engine/core/src/main/java/io/apiman/gateway/engine/impl/DefaultPluginRegistry.java
gateway/engine/core/src/main/java/io/apiman/gateway/engine/impl/DefaultPluginRegistry.java
@@ -212,9 +212,6 @@ public class DefaultPluginRegistry implements IPluginRegistry {
String pluginRelativePath = PluginUtils.getPluginRelativePath(coordinates);
File pluginDir = new File(pluginsDir, pluginRelativePath);
- if (!pluginDir.exists()) {
- pluginDir.mkdirs();
- }
File pluginFile = new File(pluginDir, "plugin." + coordinates.getType()); //$NON-NLS-1$
// Next try to load it from the plugin file registry
@@ -233,6 +230,10 @@ public class DefaultPluginRegistry implements IPluginRegistry {
}
}
+ if (!pluginDir.exists()) {
+ pluginDir.mkdirs();
+ }
+
// Next try to load it from the user's .m2 directory (copy it into the plugin file
// registry first though)
if (!handled) {

Self-signed ES certificates, Snapshot plugin reloading (#782)

* Support self-signed certificates and host names not listed in certificates.
Correct handling of snapshot plugin reloading.

* Correct WarCdiFractory.java to use the ES Metrics configuration instead of the
ES storage configuration to access metrics data.