HONEYCOMB-21 Add HTTPS for Restconf

Change-Id: If8bae91ce30592971584645b8dcecdbbeb4a0ddb
Signed-off-by: Maros Marsalek <mmarsale@cisco.com>

2 files changed, 93 insertions, 9 deletions

diff --git a/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/cfgattrs/HoneycombConfiguration.groovy b/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/cfgattrs/HoneycombConfiguration.groovy
index 78a1a04fd..422c84435 100644
--- a/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/cfgattrs/HoneycombConfiguration.groovy
+++ b/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/cfgattrs/HoneycombConfiguration.groovy
@@ -41,10 +41,16 @@ class HoneycombConfiguration {
     int notificationServiceQueueDepth
 
     // RESTCONF
-    @InjectConfig("restconf-websocket-port")
-    int restconfWebsocketPort
+    @InjectConfig("restconf-binding-address")
+    String restconfBindingAddress
     @InjectConfig("restconf-port")
     int restconfPort
+    @InjectConfig("restconf-https-binding-address")
+    String restconfHttpsBindingAddress
+    @InjectConfig("restconf-https-port")
+    int restconfHttpsPort
+    @InjectConfig("restconf-websocket-port")
+    int restconfWebsocketPort
     @InjectConfig("restconf-root-path")
     String restconfRootPath
 
diff --git a/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/restconf/RestconfProvider.groovy b/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/restconf/RestconfProvider.groovy
index ff96f4e86..bffe1da1a 100644
--- a/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/restconf/RestconfProvider.groovy
+++ b/infra/minimal-distribution/src/main/java/io/fd/honeycomb/infra/distro/restconf/RestconfProvider.groovy
@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2016 Cisco and/or its affiliates.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
+ * Licensed under the Apache License, Version 2.0 (the "License")
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
  *
@@ -21,7 +21,18 @@ import groovy.transform.ToString
 import groovy.util.logging.Slf4j
 import io.fd.honeycomb.infra.distro.ProviderTrait
 import io.fd.honeycomb.infra.distro.cfgattrs.HoneycombConfiguration
+import org.eclipse.jetty.http.HttpVersion
+import org.eclipse.jetty.security.ConstraintMapping
+import org.eclipse.jetty.security.ConstraintSecurityHandler
+import org.eclipse.jetty.security.HashLoginService
+import org.eclipse.jetty.security.authentication.BasicAuthenticator
+import org.eclipse.jetty.server.HttpConnectionFactory
 import org.eclipse.jetty.server.Server
+import org.eclipse.jetty.server.ServerConnector
+import org.eclipse.jetty.server.SslConnectionFactory
+import org.eclipse.jetty.util.security.Constraint
+import org.eclipse.jetty.util.security.Password
+import org.eclipse.jetty.util.ssl.SslContextFactory
 import org.eclipse.jetty.webapp.WebAppContext
 import org.opendaylight.controller.sal.core.api.Broker
 import org.opendaylight.netconf.sal.rest.api.RestConnector
@@ -32,6 +43,10 @@ import org.opendaylight.yang.gen.v1.urn.ietf.params.xml.ns.yang.ietf.inet.types.
 @ToString
 class RestconfProvider extends ProviderTrait<RestConnector> {
 
+    public static final String KEYSTORE_PASSWORD = "OBF:1v9s1unr1unn1vv51zlk1t331vg91x1b1vgl1t331zly1vu51uob1uo71v8u"
+    public static final String KEYSTORE_NAME = "/honeycomb-keystore"
+    public static final String REALM = "HCRealm"
+
     @Inject
     HoneycombConfiguration cfg
 
@@ -39,17 +54,60 @@ class RestconfProvider extends ProviderTrait<RestConnector> {
     Broker domBroker
 
     def create() {
-        RestconfProviderImpl instance = new RestconfProviderImpl()
+        def instance = new RestconfProviderImpl()
         instance.setWebsocketPort(new PortNumber(cfg.restconfWebsocketPort))
         domBroker.registerProvider(instance)
 
-        Server server = new Server(cfg.restconfPort);
-        final URL resource = getClass().getResource("/");
-        WebAppContext webapp = new WebAppContext(resource.getPath(), cfg.restconfRootPath);
-        server.setHandler(webapp);
+        def server = new Server(InetSocketAddress.createUnresolved(cfg.restconfBindingAddress, cfg.restconfPort))
+
+        // Load Realm for basic auth
+        def service = new HashLoginService(REALM)
+        // Reusing the name as role
+        // TODO make this more configurable
+        service.putUser(cfg.username, new Password(cfg.password), cfg.username)
+        server.addBean(service)
+
+        final URL resource = getClass().getResource("/")
+        WebAppContext webapp = new WebAppContext(resource.getPath(), cfg.restconfRootPath)
+
+        ConstraintSecurityHandler security = getBaseAuth(service, webapp)
+        server.setHandler(security)
+
+        // SSL Context Factory
+        // Based on:
+        // https://github.com/eclipse/jetty.project/blob/jetty-9.3.x/examples/embedded/src/main/java/org/eclipse/jetty/embedded/LikeJettyXml.java
+        // https://wiki.eclipse.org/Jetty/Howto/Configure_SSL#Loading_Keys_and_Certificates_via_PKCS12
+        // Keystore created with:
+        // openssl genrsa -des3 -out honeycomb.key
+        // openssl req -new -x509 -key honeycomb.key -out honeycomb.crt
+        // openssl pkcs12 -inkey honeycomb.key -in honeycomb.crt -export -out honeycomb.pkcs12
+        // keytool -importkeystore -srckeystore honeycomb.pkcs12 -srcstoretype PKCS12 -destkeystore honeycomb-keystore
+        def sslContextFactory = new SslContextFactory()
+        def keystoreURL = getClass().getResource(KEYSTORE_NAME)
+        sslContextFactory.setKeyStorePath(keystoreURL.path)
+        sslContextFactory.setKeyStorePassword(KEYSTORE_PASSWORD)
+        sslContextFactory.setKeyManagerPassword(KEYSTORE_PASSWORD)
+        sslContextFactory.setTrustStorePath(keystoreURL.path)
+        sslContextFactory.setTrustStorePassword(KEYSTORE_PASSWORD)
+        sslContextFactory.setExcludeCipherSuites(
+                "SSL_RSA_WITH_DES_CBC_SHA",
+                "SSL_DHE_RSA_WITH_DES_CBC_SHA",
+                "SSL_DHE_DSS_WITH_DES_CBC_SHA",
+                "SSL_RSA_EXPORT_WITH_RC4_40_MD5",
+                "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",
+                "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
+                "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA")
+
+        // SSL Connector
+        def sslConnector = new ServerConnector(server,
+                new SslConnectionFactory(sslContextFactory, HttpVersion.HTTP_1_1.asString()),
+                new HttpConnectionFactory())
+        sslConnector.setHost(cfg.restconfHttpsBindingAddress)
+        sslConnector.setPort(cfg.restconfHttpsPort)
+        server.addConnector(sslConnector)
 
         try {
-            server.start();
+            server.start()
         } catch (Exception e) {
             log.error "Unable to start Restconf", e
             throw new RuntimeException("Unable to start Restconf", e)
@@ -57,4 +115,24 @@ class RestconfProvider extends ProviderTrait<RestConnector> {
 
         return instance
     }
+
+    private ConstraintSecurityHandler getBaseAuth(HashLoginService service, WebAppContext webapp) {
+        ConstraintSecurityHandler security = new ConstraintSecurityHandler()
+
+        Constraint constraint = new Constraint()
+        constraint.setName("auth")
+        constraint.setAuthenticate(true)
+        constraint.setRoles(cfg.username)
+
+        ConstraintMapping mapping = new ConstraintMapping()
+        mapping.setPathSpec("/*")
+        mapping.setConstraint(constraint)
+
+        security.setConstraintMappings(Collections.singletonList(mapping))
+        security.setAuthenticator(new BasicAuthenticator())
+        security.setLoginService(service)
+
+        security.setHandler(webapp)
+        security
+    }
 }