opensource/graylog2-server
1
0
Fork 0
mirror of https://github.com/Graylog2/graylog2-server.git synced 2026-03-13 09:32:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Datanode keystore implementation (#19536)

Browse Source 
* Datanode keystore implementation

* Bind keystore check, remove legacy private key storage

* added license

* code cleanup, better cert signed verification

* added changelog

* code cleanup
This commit is contained in:
Tomas Dvorak
2024-06-06 07:48:12 +02:00
committed by GitHub
parent 9316275b43
commit 682aac7e93
34 changed files with 819 additions and 580 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
data-node/src/main/java/org/graylog/datanode/initializers/JerseyService.java
View File

@@ -44,12 +44,13 @@ import org.glassfish.jersey.server.ResourceConfig;
import org.glassfish.jersey.server.ServerProperties;
import org.glassfish.jersey.server.model.Resource;
import org.graylog.datanode.Configuration;
import org.graylog.datanode.configuration.variants.KeystoreInformation;
import org.graylog.datanode.configuration.variants.OpensearchSecurityConfiguration;
import org.graylog.datanode.opensearch.OpensearchConfigurationChangeEvent;
import org.graylog.datanode.opensearch.configuration.OpensearchConfiguration;
import org.graylog.datanode.rest.config.SecuredNodeAnnotationFilter;
import org.graylog.security.certutil.CertConstants;
import org.graylog.security.certutil.csr.FilesystemKeystoreInformation;
import org.graylog.security.certutil.csr.KeystoreInformation;
import org.graylog2.configuration.TLSProtocolsConfiguration;
import org.graylog2.plugin.inject.Graylog2Module;
import org.graylog2.rest.MoreMediaTypes;
@@ -259,7 +260,7 @@ public class JerseyService extends AbstractIdleService {
return httpServer;
}
private SSLEngineConfigurator buildSslEngineConfigurator(KeystoreInformation keystoreInformation)
private SSLEngineConfigurator buildSslEngineConfigurator(FilesystemKeystoreInformation keystoreInformation)
throws GeneralSecurityException, IOException {
if (keystoreInformation == null || !Files.isRegularFile(keystoreInformation.location()) || !Files.isReadable(keystoreInformation.location())) {
throw new IllegalArgumentException("Unreadable to read private key");
@@ -280,7 +281,7 @@ public class JerseyService extends AbstractIdleService {
return sslEngineConfigurator;
}
private static KeyStore readKeystore(KeystoreInformation keystoreInformation) {
private static KeyStore readKeystore(FilesystemKeystoreInformation keystoreInformation) {
try (var in = Files.newInputStream(keystoreInformation.location())) {
KeyStore caKeystore = KeyStore.getInstance(CertConstants.PKCS12);
caKeystore.load(in, keystoreInformation.password());