X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=org.argeo.cms%2Fsrc%2Forg%2Fargeo%2Fcms%2Finternal%2Fkernel%2FInitUtils.java;h=95d17d8a2367982e9bf46497effa39de249ed4ae;hb=48a1bccfd878f84300c798b3b6508682d5429cd9;hp=5e18ee6764da150afdc285e591168dec9f09eb3a;hpb=e7dc62c485696931a3e048d9102a7c86f9323b92;p=lgpl%2Fargeo-commons.git diff --git a/org.argeo.cms/src/org/argeo/cms/internal/kernel/InitUtils.java b/org.argeo.cms/src/org/argeo/cms/internal/kernel/InitUtils.java index 5e18ee676..95d17d8a2 100644 --- a/org.argeo.cms/src/org/argeo/cms/internal/kernel/InitUtils.java +++ b/org.argeo.cms/src/org/argeo/cms/internal/kernel/InitUtils.java @@ -5,27 +5,39 @@ import static org.argeo.cms.internal.kernel.KernelUtils.getFrameworkProp; import java.io.File; import java.io.FileFilter; import java.io.IOException; +import java.io.Reader; import java.net.InetAddress; import java.net.URI; +import java.net.URISyntaxException; +import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; import java.security.KeyStore; import java.util.ArrayList; import java.util.Arrays; import java.util.Dictionary; +import java.util.HashMap; import java.util.Hashtable; import java.util.List; +import java.util.Map; +import javax.jcr.Repository; +import javax.jcr.RepositoryException; +import javax.jcr.RepositoryFactory; import javax.security.auth.x500.X500Principal; import org.apache.commons.io.FileUtils; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.argeo.api.NodeConstants; -import org.argeo.cms.CmsException; import org.argeo.cms.internal.http.InternalHttpConstants; import org.argeo.cms.internal.jcr.RepoConf; +import org.argeo.jackrabbit.client.ClientDavexRepositoryFactory; +import org.argeo.jcr.JcrException; +import org.argeo.naming.LdapAttrs; import org.argeo.osgi.useradmin.UserAdminConf; +import org.osgi.framework.BundleContext; +import org.osgi.framework.Constants; /** * Interprets framework properties in order to generate the initial deploy @@ -39,8 +51,11 @@ class InitUtils { Dictionary props = provided != null ? provided : new Hashtable(); for (RepoConf repoConf : RepoConf.values()) { Object value = getFrameworkProp(NodeConstants.NODE_REPO_PROP_PREFIX + repoConf.name()); - if (value != null) + if (value != null) { props.put(repoConf.name(), value); + if (log.isDebugEnabled()) + log.debug("Set node repo configuration " + repoConf.name() + " to " + value); + } } props.put(NodeConstants.CN, NodeConstants.NODE_REPOSITORY); return props; @@ -53,8 +68,11 @@ class InitUtils { for (RepoConf repoConf : RepoConf.values()) { Object value = getFrameworkProp( NodeConstants.NODE_REPOS_PROP_PREFIX + dataModelName + '.' + repoConf.name()); - if (value != null) + if (value != null) { props.put(repoConf.name(), value); + if (log.isDebugEnabled()) + log.debug("Set " + dataModelName + " repo configuration " + repoConf.name() + " to " + value); + } } if (props.size() != 0) props.put(NodeConstants.CN, dataModelName); @@ -66,8 +84,10 @@ class InitUtils { String httpPort = getFrameworkProp("org.osgi.service.http.port"); String httpsPort = getFrameworkProp("org.osgi.service.http.port.secure"); /// TODO make it more generic - String httpHost = getFrameworkProp(InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.HTTP_HOST); - String httpsHost = getFrameworkProp(InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.HTTPS_HOST); + String httpHost = getFrameworkProp( + InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.HTTP_HOST); + String httpsHost = getFrameworkProp( + InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.HTTPS_HOST); String webSocketEnabled = getFrameworkProp( InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.WEBSOCKET_ENABLED); @@ -92,15 +112,40 @@ class InitUtils { // server certificate Path keyStorePath = KernelUtils.getOsgiInstancePath(KernelConstants.DEFAULT_KEYSTORE_PATH); - String keyStorePassword = getFrameworkProp( + Path pemKeyPath = KernelUtils.getOsgiInstancePath(KernelConstants.DEFAULT_PEM_KEY_PATH); + Path pemCertPath = KernelUtils.getOsgiInstancePath(KernelConstants.DEFAULT_PEM_CERT_PATH); + String keyStorePasswordStr = getFrameworkProp( InternalHttpConstants.JETTY_PROPERTY_PREFIX + InternalHttpConstants.SSL_PASSWORD); - if (keyStorePassword == null) - keyStorePassword = "changeit"; + char[] keyStorePassword; + if (keyStorePasswordStr == null) + keyStorePassword = "changeit".toCharArray(); + else + keyStorePassword = keyStorePasswordStr.toCharArray(); + + // if PEM files both exists, update the PKCS12 file + if (Files.exists(pemCertPath) && Files.exists(pemKeyPath)) { + // TODO check certificate update time? monitor changes? + KeyStore keyStore = PkiUtils.getKeyStore(keyStorePath, keyStorePassword, PkiUtils.PKCS12); + try (Reader key = Files.newBufferedReader(pemKeyPath, StandardCharsets.US_ASCII); + Reader cert = Files.newBufferedReader(pemCertPath, StandardCharsets.US_ASCII);) { + PkiUtils.loadPem(keyStore, key, keyStorePassword, cert); + PkiUtils.saveKeyStore(keyStorePath, keyStorePassword, keyStore); + if (log.isDebugEnabled()) + log.debug("PEM certificate stored in " + keyStorePath); + } catch (IOException e) { + log.error("Cannot read PEM files " + pemKeyPath + " and " + pemCertPath, e); + } + } + if (!Files.exists(keyStorePath)) createSelfSignedKeyStore(keyStorePath, keyStorePassword, PkiUtils.PKCS12); props.put(InternalHttpConstants.SSL_KEYSTORETYPE, PkiUtils.PKCS12); props.put(InternalHttpConstants.SSL_KEYSTORE, keyStorePath.toString()); - props.put(InternalHttpConstants.SSL_PASSWORD, keyStorePassword); + props.put(InternalHttpConstants.SSL_PASSWORD, new String(keyStorePassword)); + +// props.put(InternalHttpConstants.SSL_KEYSTORETYPE, "PKCS11"); +// props.put(InternalHttpConstants.SSL_KEYSTORE, "../../nssdb"); +// props.put(InternalHttpConstants.SSL_PASSWORD, keyStorePassword); // client certificate authentication String wantClientAuth = getFrameworkProp( @@ -138,7 +183,7 @@ class InitUtils { FileUtils.copyInputStreamToFile(InitUtils.class.getResourceAsStream(baseNodeRoleDn + ".ldif"), nodeRolesFile); } catch (IOException e) { - throw new CmsException("Cannot copy demo resource", e); + throw new RuntimeException("Cannot copy demo resource", e); } // nodeRolesUri = nodeRolesFile.toURI().toString(); } @@ -149,13 +194,13 @@ class InitUtils { String baseNodeTokensDn = NodeConstants.TOKENS_BASEDN; if (nodeTokensUri == null) { nodeTokensUri = baseNodeTokensDn + ".ldif"; - File nodeRolesFile = new File(nodeBaseDir, nodeRolesUri); - if (!nodeRolesFile.exists()) + File nodeTokensFile = new File(nodeBaseDir, nodeTokensUri); + if (!nodeTokensFile.exists()) try { FileUtils.copyInputStreamToFile(InitUtils.class.getResourceAsStream(baseNodeTokensDn + ".ldif"), - nodeRolesFile); + nodeTokensFile); } catch (IOException e) { - throw new CmsException("Cannot copy demo resource", e); + throw new RuntimeException("Cannot copy demo resource", e); } // nodeRolesUri = nodeRolesFile.toURI().toString(); } @@ -176,7 +221,7 @@ class InitUtils { FileUtils.copyInputStreamToFile( InitUtils.class.getResourceAsStream("example-ou=roles,ou=node.ldif"), systemRolesFile); } catch (IOException e) { - throw new CmsException("Cannot copy demo resources", e); + throw new RuntimeException("Cannot copy demo resources", e); } // userAdminUris = businessRolesFile.toURI().toString(); log.warn("## DEV Using dummy base DN " + demoBaseDn); @@ -191,7 +236,8 @@ class InitUtils { try { u = new URI(uri); if (u.getPath() == null) - throw new CmsException("URI " + uri + " must have a path in order to determine base DN"); + throw new IllegalArgumentException( + "URI " + uri + " must have a path in order to determine base DN"); if (u.getScheme() == null) { if (uri.startsWith("/") || uri.startsWith("./") || uri.startsWith("../")) u = new File(uri).getCanonicalFile().toURI(); @@ -199,12 +245,12 @@ class InitUtils { // u = KernelUtils.getOsgiInstanceUri(KernelConstants.DIR_NODE + '/' + uri); u = new URI(uri); } else - throw new CmsException("Cannot interpret " + uri + " as an uri"); + throw new IllegalArgumentException("Cannot interpret " + uri + " as an uri"); } else if (u.getScheme().equals(UserAdminConf.SCHEME_FILE)) { u = new File(u).getCanonicalFile().toURI(); } } catch (Exception e) { - throw new CmsException("Cannot interpret " + uri + " as an uri", e); + throw new RuntimeException("Cannot interpret " + uri + " as an uri", e); } Dictionary properties = UserAdminConf.uriAsProperties(u.toString()); res.add(properties); @@ -218,61 +264,93 @@ class InitUtils { * some files (typically LDIF, etc). */ static void prepareFirstInitInstanceArea() { - String nodeInit = getFrameworkProp(NodeConstants.NODE_INIT); - if (nodeInit == null) - nodeInit = "../../init"; - if (nodeInit.startsWith("http")) { - // remoteFirstInit(nodeInit); - return; - } + String nodeInits = getFrameworkProp(NodeConstants.NODE_INIT); + if (nodeInits == null) + nodeInits = "../../init"; - // TODO use java.nio.file - File initDir; - if (nodeInit.startsWith(".")) - initDir = KernelUtils.getExecutionDir(nodeInit); - else - initDir = new File(nodeInit); - // TODO also uncompress archives - if (initDir.exists()) - try { - FileUtils.copyDirectory(initDir, KernelUtils.getOsgiInstanceDir(), new FileFilter() { + for (String nodeInit : nodeInits.split(",")) { + + if (nodeInit.startsWith("http")) { + registerRemoteInit(nodeInit); + } else { - @Override - public boolean accept(File pathname) { - if (pathname.getName().equals(".svn") || pathname.getName().equals(".git")) - return false; - return true; + // TODO use java.nio.file + File initDir; + if (nodeInit.startsWith(".")) + initDir = KernelUtils.getExecutionDir(nodeInit); + else + initDir = new File(nodeInit); + // TODO also uncompress archives + if (initDir.exists()) + try { + FileUtils.copyDirectory(initDir, KernelUtils.getOsgiInstanceDir(), new FileFilter() { + + @Override + public boolean accept(File pathname) { + if (pathname.getName().equals(".svn") || pathname.getName().equals(".git")) + return false; + return true; + } + }); + log.info("CMS initialized from " + initDir.getCanonicalPath()); + } catch (IOException e) { + throw new RuntimeException("Cannot initialize from " + initDir, e); } - }); - log.info("CMS initialized from " + initDir.getCanonicalPath()); - } catch (IOException e) { - throw new CmsException("Cannot initialize from " + initDir, e); } + } + } + + private static void registerRemoteInit(String uri) { + try { + BundleContext bundleContext = KernelUtils.getBundleContext(); + Repository repository = createRemoteRepository(new URI(uri)); + Hashtable properties = new Hashtable<>(); + properties.put(NodeConstants.CN, NodeConstants.NODE_INIT); + properties.put(LdapAttrs.labeledURI.name(), uri); + properties.put(Constants.SERVICE_RANKING, -1000); + bundleContext.registerService(Repository.class, repository, properties); + } catch (RepositoryException e) { + throw new JcrException(e); + } catch (URISyntaxException e) { + throw new IllegalArgumentException(e); + } + } + + private static Repository createRemoteRepository(URI uri) throws RepositoryException { + RepositoryFactory repositoryFactory = new ClientDavexRepositoryFactory(); + Map params = new HashMap(); + params.put(ClientDavexRepositoryFactory.JACKRABBIT_DAVEX_URI, uri.toString()); + // TODO make it configurable + params.put(ClientDavexRepositoryFactory.JACKRABBIT_REMOTE_DEFAULT_WORKSPACE, NodeConstants.SYS_WORKSPACE); + return repositoryFactory.getRepository(params); } - private static void createSelfSignedKeyStore(Path keyStorePath, String keyStorePassword, String keyStoreType) { + private static void createSelfSignedKeyStore(Path keyStorePath, char[] keyStorePassword, String keyStoreType) { // for (Provider provider : Security.getProviders()) // System.out.println(provider.getName()); - File keyStoreFile = keyStorePath.toFile(); - char[] ksPwd = keyStorePassword.toCharArray(); - char[] keyPwd = Arrays.copyOf(ksPwd, ksPwd.length); - if (!keyStoreFile.exists()) { +// File keyStoreFile = keyStorePath.toFile(); + char[] keyPwd = Arrays.copyOf(keyStorePassword, keyStorePassword.length); + if (!Files.exists(keyStorePath)) { try { - keyStoreFile.getParentFile().mkdirs(); - KeyStore keyStore = PkiUtils.getKeyStore(keyStoreFile, ksPwd, keyStoreType); + Files.createDirectories(keyStorePath.getParent()); + KeyStore keyStore = PkiUtils.getKeyStore(keyStorePath, keyStorePassword, keyStoreType); PkiUtils.generateSelfSignedCertificate(keyStore, new X500Principal("CN=" + InetAddress.getLocalHost().getHostName() + ",OU=UNSECURE,O=UNSECURE"), 1024, keyPwd); - PkiUtils.saveKeyStore(keyStoreFile, ksPwd, keyStore); + PkiUtils.saveKeyStore(keyStorePath, keyStorePassword, keyStore); if (log.isDebugEnabled()) - log.debug("Created self-signed unsecure keystore " + keyStoreFile); + log.debug("Created self-signed unsecure keystore " + keyStorePath); } catch (Exception e) { - if (keyStoreFile.length() == 0) - keyStoreFile.delete(); - log.error("Cannot create keystore " + keyStoreFile, e); + try { + if (Files.size(keyStorePath) == 0) + Files.delete(keyStorePath); + } catch (IOException e1) { + // silent + } + log.error("Cannot create keystore " + keyStorePath, e); } } else { - throw new CmsException("Keystore " + keyStorePath + " already exists"); + throw new IllegalStateException("Keystore " + keyStorePath + " already exists"); } }