{"action":"created","issue":{"url":"https://api.github.com/repos/tinkerpop/rexster/issues/378","labels_url":"https://api.github.com/repos/tinkerpop/rexster/issues/378/labels{/name}","comments_url":"https://api.github.com/repos/tinkerpop/rexster/issues/378/comments","events_url":"https://api.github.com/repos/tinkerpop/rexster/issues/378/events","html_url":"https://github.com/tinkerpop/rexster/pull/378","id":52366822,"number":378,"title":"Rexster SSL Support","user":{"login":"alszeb","id":5851426,"avatar_url":"https://avatars.githubusercontent.com/u/5851426?v=3","gravatar_id":"","url":"https://api.github.com/users/alszeb","html_url":"https://github.com/alszeb","followers_url":"https://api.github.com/users/alszeb/followers","following_url":"https://api.github.com/users/alszeb/following{/other_user}","gists_url":"https://api.github.com/users/alszeb/gists{/gist_id}","starred_url":"https://api.github.com/users/alszeb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alszeb/subscriptions","organizations_url":"https://api.github.com/users/alszeb/orgs","repos_url":"https://api.github.com/users/alszeb/repos","events_url":"https://api.github.com/users/alszeb/events{/privacy}","received_events_url":"https://api.github.com/users/alszeb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":25,"created_at":"2014-12-18T14:03:44Z","updated_at":"2015-07-23T14:53:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/tinkerpop/rexster/pulls/378","html_url":"https://github.com/tinkerpop/rexster/pull/378","diff_url":"https://github.com/tinkerpop/rexster/pull/378.diff","patch_url":"https://github.com/tinkerpop/rexster/pull/378.patch"},"body":"# Summary - Rexster HTTP SSL\r\nThis pull request provides SSL security to Rexster’s HTTP based services.  There are no API changes, only one line of code modified, and behavior is not affected unless SSL is enabled.  Documentation is provided via changes to the Rexster Wiki.  SSL is configured via rexster.xml.  Designed with the intent to extend SSL support to RexPro.\r\n\r\n## Wiki Changes\r\nIncludes a new page for Rexster-SSL and minor changes to Rexster-Configuration.\r\n\r\n### Rexster-SSL.textile \r\nThis document includes basic info on where to find SSL configuration for Rexster and how to enable it.  It does not provide documentation on configuring SSL in general.\r\n\r\n### Rexster-Configuration.textile\r\nAdded a line that that says Rexster supports SSL and links to Rexster-SSL.textile. Added property to configuration layout section: ‘rexster.http.enable-ssl’ with a default value of false. Added default SSL configuration to configuration layout section.\r\n\r\n## rexster.xml\r\nAdded a section for SSL configuration between 'security' and 'metrics' sections.\r\nAdded a property ‘http.enable-ssl’ which takes a boolean value and turns SSL on and off for HttpRexsterServer\r\n\r\n## Code\r\n\r\n### HttpRexsterServer.java\r\nIn configureNetworkListener() a check is performed to see if the property http.enable-ssl is true.  When SSL is enabled a private method is called that configures SSL on the NetworkListener and calls setSecure(true) on it.\r\n\r\n### RexsterSslHelper.java\r\nContains most of the SSL setup code. Is constructed with a configuration (from rexster.xml) and provides helper methods to access SSL properties.  Has a helper method for creating the SSLContext, which can be used in the future for securing RexPro with SSL.\r\n\r\n### Tests\r\nIntegration tests are included.\r\n\r\n## Limitations \r\nGenerally none, these changes should only provide new features. There is one gotcha where the http.base-uri property needs to be changed (http -> https) in order to get Dog House to work correctly; this is documented in the new Rexster-SSL wiki page.\r\n\r\n# Summary - Rexster RexPro SSL\r\nThis MR provides TLS/SSL security to Rexster’s binary protocol based interfaces.  There are small additions to the API to permit SSL support with Rexster Clients (new methods and constructors outlined below). There are no behavior changes unless SSL is enabled. Documentation is provided via changes to the Rexster Wiki. SSL is configured via the currently existing SSL settings in rexster.xml. RexPro has one new property with which SSL support can be enabled/disabled (separate from http.enable-ssl). \r\n\r\n## Wiki Changes\r\n\r\n### Rexster-SSL.textile \r\nNew sections for RexPro Server, Rexster Console and RexPro-Java.\r\n\r\n### RexPro-Java.textile \r\nAdded new SSL properties to configuration table.\r\n\r\n### Rexster-Console.textile\r\nAdded ‘-s’ and ‘-sc’ parameter and description to ‘Command Line’ table. These are used to enable SSL and pass the location of the SSL config for Rexster-Console, respectively.\r\n\r\nFor example the following turns SSL on and specifies a file to look in for SSL configuration:\r\n```\r\nrexster-console.sh -s true --sc path_to_config.xml\r\n```\r\n\r\n### Rexster-Configuration.textile\r\nAdded property to configuration layout section: ‘rexster.rexpro.ssl-enabled’ with a default value of false.\r\n\r\n## rexster.xml\r\n‘rexpro.enable-ssl’ property added with default value of false.\r\n\r\n## Code\r\n\r\n### ConsoleSettings.java\r\nAdded additional command line parameter ‘-sc’ for SSL configuration.  This takes an argument of the path to an SSL config file.  The config file should be in the same format as the SSL settings for Rexster Server. (Only the SSL section is needed).  Passing a value for this parameter automatically configures SSL to be on for the Console’s client.\r\n\r\n### RexsterConsole.java\r\nChecks to see if SSL has been enabled by looking at its instance of ConsoleSettings. If so it creates a new RemoteRexsterSession with any passed in settings (see RemoteRexsterSession below).  Else the original RemoteRexsterSession path is followed.\r\n\r\n### RemoteRexsterSession.java\r\nNew constructor which takes a String ‘sslConfigFile’ on top of the original constructor’s parameters.  Creates a new RexProClientConnection which takes a String ‘sslConfigFile’ (see below). \r\n\r\n### RexProClientConnection.java\r\nNew Constructor which takes a String ‘sslConfig’.  New method called by the new constructor “getSecureTransport(...)” which takes the sslConfig param and passes it to the RexsterClientSslFilterHelper (see below) in order to add SSL security via an SSL filter on the filter chain.  Method “startTransport(...)” extracted from original constructor as used by both ‘secure’ and ‘unsecured’ constructors. “connection” member no longer final as it is initialized in a method rather than the constructor.\r\n\r\n### RexsterClientSslFilterHelper.java\r\nHelper class to build SSLFilters appropriate for SSLClients.  Provides client specific logging and checks for client SSL configuration file location based on passed in parameters. Allows for overrides of all ‘default’ SSL properties (for use with ```RexsterClientFactory``` - see changes below). Used to provide filters for both Console (via configuration file) and custom java based RexPro connections  (via ```RexsterClientFactory```).\r\n\r\n### RexsterClientTokens.java\r\nAdded two new tokens ‘ssl-enabled’ and ‘ssl-client-config’.  Used in ```RexsterClientFactory``` in the same way the other tokens from this class are. \r\n\r\n### RexsterClientFactory.java\r\nAdds ability to create SSL enabled clients.  Added new tokens from RexsterClientTokens.java to base configuration (‘ssl-enabled’ and ‘ssl-client-config’).\r\n\r\nIf ‘ssl-enabled’ is set to true, a new method ```getSecureTransport(...)``` is used instead of the ```getTransport()``` method.  Unlike the ```getTransport()``` method (which maintains a static instance of a transport), ```getSecureTransport(...)``` produces a new transport every time a client is initialized as SSL settings may have changed .  ```getSecureTransport(...)``` results in an SSLFilter being added on to the transport’s filter chain.\r\n\r\nMethod ```getRexsterProcessor(...)``` was extracted from ```getTransport()``` as it is used by both ```getTransport()``` and ```getSecureTransport(...)```. it was modified to take a boolean *ssl-enabled* that determines if it adds an SSL filter to the filter chain. \r\n\r\n### RexProRexsterServer.java\r\nNow checks if property ‘rexpro.enable-ssl’ is set to true in rexster.xml.  If so, creates and adds an SSLFilter and adds it on to the filter chain on the RexPro Server.\r\n\r\n## Limitations\r\n\r\n- If the client is rejected via failure to authenticate with SSL, the RexPro client will still make retry attempts; this can be changed via configuration, although this shouldn't be an issue with SSL properly configured.\r\n- Adding additional integration tests seems to make some pre-existing memory management issues (specific to the integration tests) worse - Grizzly might not be good at cleaning up after itself?\r\n- Grizzly's client SSL implementation, the \"SSLFilter\", doesn't seem to support hostname verification at this version. If this is something users of RexPro SSL need, they will have to figure out how to implement it themselves and/or try to add that functionality to the Grizzly's client SSL support.\r\n"},"comment":{"url":"https://api.github.com/repos/tinkerpop/rexster/issues/comments/124131050","html_url":"https://github.com/tinkerpop/rexster/pull/378#issuecomment-124131050","issue_url":"https://api.github.com/repos/tinkerpop/rexster/issues/378","id":124131050,"user":{"login":"alszeb","id":5851426,"avatar_url":"https://avatars.githubusercontent.com/u/5851426?v=3","gravatar_id":"","url":"https://api.github.com/users/alszeb","html_url":"https://github.com/alszeb","followers_url":"https://api.github.com/users/alszeb/followers","following_url":"https://api.github.com/users/alszeb/following{/other_user}","gists_url":"https://api.github.com/users/alszeb/gists{/gist_id}","starred_url":"https://api.github.com/users/alszeb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alszeb/subscriptions","organizations_url":"https://api.github.com/users/alszeb/orgs","repos_url":"https://api.github.com/users/alszeb/repos","events_url":"https://api.github.com/users/alszeb/events{/privacy}","received_events_url":"https://api.github.com/users/alszeb/received_events","type":"User","site_admin":false},"created_at":"2015-07-23T14:53:37Z","updated_at":"2015-07-23T14:53:37Z","body":"no worries and no rush, it seemed like it could be a pretty tricky thing to solve!"}}