package org.cacert.gigi;
+import java.io.ByteArrayInputStream;
import java.io.IOException;
+import java.net.InetSocketAddress;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
import java.util.List;
import java.util.Locale;
import java.util.Properties;
import org.cacert.gigi.email.EmailProvider;
import org.cacert.gigi.natives.SetUID;
import org.cacert.gigi.util.CipherInfo;
+import org.cacert.gigi.util.PEM;
import org.cacert.gigi.util.ServerConstants;
+import org.eclipse.jetty.http.HttpFields;
import org.eclipse.jetty.http.HttpHeader;
import org.eclipse.jetty.http.HttpVersion;
import org.eclipse.jetty.server.Connector;
import org.eclipse.jetty.server.Handler;
import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConfiguration.Customizer;
import org.eclipse.jetty.server.HttpConnectionFactory;
+import org.eclipse.jetty.server.Request;
import org.eclipse.jetty.server.SecureRequestCustomizer;
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
public class Launcher {
+ class ExtendedForwarded implements Customizer {
+
+ @Override
+ public void customize(Connector connector, HttpConfiguration config, Request request) {
+ HttpFields httpFields = request.getHttpFields();
+
+ String ip = httpFields.getStringField("X-Real-IP");
+ String proto = httpFields.getStringField("X-Real-Proto");
+ String cert = httpFields.getStringField("X-Client-Cert");
+ request.setSecure("https".equals(proto));
+ request.setScheme(proto);
+ if ( !"https".equals(proto)) {
+ cert = null;
+
+ }
+ if (cert != null) {
+ X509Certificate[] certs = new X509Certificate[1];
+ try {
+ certs[0] = (X509Certificate) CertificateFactory.getInstance("X509").generateCertificate(new ByteArrayInputStream(PEM.decode("CERTIFICATE", cert)));
+ request.setAttribute("javax.servlet.request.X509Certificate", certs);
+ } catch (CertificateException e) {
+ e.printStackTrace();
+ }
+ }
+ if (ip != null) {
+ String[] parts = ip.split(":");
+ if (parts.length == 2) {
+ request.setRemoteAddr(InetSocketAddress.createUnresolved(parts[0], Integer.parseInt(parts[1])));
+ }
+ }
+
+ }
+ }
+
public static void main(String[] args) throws Exception {
System.setProperty("jdk.tls.ephemeralDHKeySize", "4096");
new Launcher().boot();
}
private void initConnectors() throws GeneralSecurityException, IOException {
- HttpConfiguration httpsConfig = createHttpConfiguration();
- // for client-cert auth
- httpsConfig.addCustomizer(new SecureRequestCustomizer());
HttpConfiguration httpConfig = createHttpConfiguration();
- s.setConnectors(new Connector[] {
- ConnectorsLauncher.createConnector(conf, s, httpsConfig, true), ConnectorsLauncher.createConnector(conf, s, httpConfig, false)
- });
+ if (conf.getMainProps().getProperty("proxy", "false").equals("true")) {
+ httpConfig.addCustomizer(new ExtendedForwarded());
+ s.setConnectors(new Connector[] {
+ ConnectorsLauncher.createConnector(conf, s, httpConfig, false)
+ });
+ } else {
+ HttpConfiguration httpsConfig = createHttpConfiguration();
+ // for client-cert auth
+ httpsConfig.addCustomizer(new SecureRequestCustomizer());
+ s.setConnectors(new Connector[] {
+ ConnectorsLauncher.createConnector(conf, s, httpsConfig, true), ConnectorsLauncher.createConnector(conf, s, httpConfig, false)
+ });
+ }
}
private void initEmails(GigiConfig conf) throws GeneralSecurityException, IOException, KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
KeyStore privateStore = conf.getPrivateStore();
- Certificate mail = privateStore.getCertificate("mail");
- Key k = privateStore.getKey("mail", conf.getPrivateStorePw().toCharArray());
+ Certificate mail = null;
+ Key k = null;
+ if (privateStore != null && privateStore.containsAlias("mail")) {
+ mail = privateStore.getCertificate("mail");
+ k = privateStore.getKey("mail", conf.getPrivateStorePw().toCharArray());
+ }
EmailProvider.initSystem(conf.getMainProps(), mail, k);
}
final SslContextFactory sslContextFactory = generateSSLContextFactory(conf, "www");
final SslContextFactory secureContextFactory = generateSSLContextFactory(conf, "secure");
secureContextFactory.setWantClientAuth(true);
- secureContextFactory.setNeedClientAuth(false);
+ secureContextFactory.setNeedClientAuth(true);
final SslContextFactory staticContextFactory = generateSSLContextFactory(conf, "static");
final SslContextFactory apiContextFactory = generateSSLContextFactory(conf, "api");
apiContextFactory.setWantClientAuth(true);
ContextHandler ch = generateGigiServletContext(webAppServlet);
ch.setVirtualHosts(new String[] {
- ServerConstants.getWwwHostName()
+ ServerConstants.getWwwHostName()
});
ContextHandler chSecure = generateGigiServletContext(webAppServlet);
chSecure.setVirtualHosts(new String[] {
- ServerConstants.getSecureHostName()
+ ServerConstants.getSecureHostName()
});
HandlerList hl = new HandlerList();
hw.setHandler(rh);
ServletContextHandler servlet = new ServletContextHandler(ServletContextHandler.SESSIONS);
- servlet.setInitParameter(SessionManager.__SessionCookieProperty, "CACert-Session");
+ servlet.setInitParameter(SessionManager.__SessionCookieProperty, "SomeCA-Session");
servlet.addServlet(webAppServlet, "/*");
ErrorPageErrorHandler epeh = new ErrorPageErrorHandler();
epeh.addErrorPage(404, "/error");
ContextHandler ch = new ContextHandler();
ch.setHandler(rh);
ch.setVirtualHosts(new String[] {
- ServerConstants.getStaticHostName()
+ ServerConstants.getStaticHostName()
});
return ch;
ServletContextHandler sch = new ServletContextHandler();
sch.addVirtualHosts(new String[] {
- ServerConstants.getApiHostName()
+ ServerConstants.getApiHostName()
});
sch.addServlet(new ServletHolder(new GigiAPI()), "/*");
return sch;