Skip to content

Commit bcf7f80

Browse files
hallfoxhallfox
committed
Support TLS listeners
Added ===== - TLS configuration in broker config - Helper script for generating test certs and CAs - TLS options for NtcChannel - Loading certificates and authority data specified from bmqbrkrcfg.json - SessionOptions to bmq package for configuring client sessions - --tls-authority and --tls-version options to bmqtool to configure session options - Client sessions will now require broker TLS sessions when TLS protocol versions are specified - Create CertificateStore component for bmqio - Integration tests for TLS Changed ======= - Update ntf-core and bde dependencies Signed-off-by: Taylor Foxhall <[email protected]> Signed-off-by: Evgeny Malygin <[email protected]>
1 parent 894fa9f commit bcf7f80

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+26301
-21630
lines changed

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,4 @@ settings.json
4141
src/applications/bmqbrkr/etc/etc
4242

4343
# 'sim_cpp11_features.pl' backups
44-
*.bak
44+
*.bak

‎bin/build-darwin.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ mkdir -p "${DIR_THIRDPARTY}"
9191
DIR_BUILD="${DIR_BUILD:-${DIR_ROOT}/build}"
9292
mkdir -p "${DIR_BUILD}"
9393

94-
DIR_INSTALL="${DIR_INSTALL:-${DIR_ROOT}}"
94+
DIR_INSTALL="${DIR_INSTALL:-${DIR_ROOT}/install}"
9595
mkdir -p "${DIR_INSTALL}"
9696

9797

@@ -103,7 +103,7 @@ if [ ! -d "${DIR_THIRDPARTY}/bde" ]; then
103103
git clone --depth 1 --branch 4.28.0.0 https://github.com/bloomberg/bde.git "${DIR_THIRDPARTY}/bde"
104104
fi
105105
if [ ! -d "${DIR_THIRDPARTY}/ntf-core" ]; then
106-
git clone --depth 1 --branch 2.4.2 https://github.com/bloomberg/ntf-core.git "${DIR_THIRDPARTY}/ntf-core"
106+
git clone --depth 1 --branch 2.5.4 https://github.com/bloomberg/ntf-core.git "${DIR_THIRDPARTY}/ntf-core"
107107
fi
108108

109109

‎bin/build-ubuntu.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ mkdir -p "${DIR_THIRDPARTY}"
5959
DIR_BUILD="${DIR_BUILD:-${DIR_ROOT}/build}"
6060
mkdir -p "${DIR_BUILD}"
6161

62-
DIR_INSTALL="${DIR_INSTALL:-${DIR_ROOT}}"
62+
DIR_INSTALL="${DIR_INSTALL:-${DIR_ROOT}/install}"
6363
mkdir -p "${DIR_INSTALL}"
6464

6565
# :: Clone dependencies :::::::::::::::::::::::::::::::::::::::::::::::::::::::
@@ -71,7 +71,7 @@ if [ ! -d "${DIR_THIRDPARTY}/bde" ]; then
7171
git clone --depth 1 --branch 4.28.0.0 https://github.com/bloomberg/bde.git "${DIR_THIRDPARTY}/bde"
7272
fi
7373
if [ ! -d "${DIR_THIRDPARTY}/ntf-core" ]; then
74-
git clone --depth 1 --branch 2.4.2 https://github.com/bloomberg/ntf-core.git "${DIR_THIRDPARTY}/ntf-core"
74+
git clone --depth 1 --branch 2.5.4 https://github.com/bloomberg/ntf-core.git "${DIR_THIRDPARTY}/ntf-core"
7575
fi
7676
# prometheus-cpp and its dependency for the plugin
7777
if [ "${BUILD_PROMETHEUS}" == true ]; then

‎bin/gen-tls-certs.sh‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#!/bin/bash
2+
#
3+
#
4+
# This scripts generates:
5+
# - root CA certificate
6+
# - server certificate and keystore
7+
# - client keys
8+
#
9+
# Based off of
10+
# https://github.com/confluentinc/librdkafka/blob/master/tests/gen-ssl-certs.sh
11+
12+
OP="$1"
13+
CA_CERT="$2"
14+
PFX="$3"
15+
HOST="$4"
16+
17+
C=NN
18+
ST=NN
19+
L=NN
20+
O=NN
21+
OU=NN
22+
CN="$HOST"
23+
24+
25+
# Password
26+
PASS="secret"
27+
28+
# Cert validity, in days
29+
VALIDITY=10000
30+
31+
set -e
32+
33+
export LC_ALL=C
34+
35+
if [[ $OP == "ca" && -n "$CA_CERT" && -n "$3" ]]; then
36+
CN="$3"
37+
openssl req -new -x509 -keyout "${CA_CERT}.key" -out "${CA_CERT}" -days $VALIDITY -passin "pass:$PASS" -passout "pass:$PASS" <<EOF
38+
${C}
39+
${ST}
40+
${L}
41+
${O}
42+
${OU}
43+
${CN}
44+
$USER@${CN}
45+
.
46+
.
47+
EOF
48+
49+
50+
51+
elif [[ $OP == "server" && -n "$CA_CERT" && -n "$PFX" && -n "$CN" ]]; then
52+
HOST_CERT_CONFIG_PATH="${PFX}host_cert.cnf"
53+
HOST_PRIVATE_RSA_KEY_PATH="${PFX}host_private_key_rsa.pem"
54+
HOST_PRIVATE_KEY_PATH="${PFX}private_key.pem"
55+
HOST_CSR_PATH="${PFX}host_csr.pem"
56+
HOST_CERT_PATH="${PFX}host_cert.pem"
57+
HOST_CERT_CHAIN_PATH="${PFX}client_${CN}.pem"
58+
59+
# Create the CA cert config file
60+
echo "Setting up host certs..."
61+
62+
cat <<EOF > "${HOST_CERT_CONFIG_PATH}"
63+
[req]
64+
default_bits = 2048
65+
distinguished_name = req_distinguished_name
66+
req_extensions = v3_req
67+
prompt = no
68+
[req_distinguished_name]
69+
C = ${C}
70+
ST = ${ST}
71+
L = ${L}
72+
O = ${O}
73+
CN = ${CN}
74+
[v3_req]
75+
subjectAltName = @alt_names
76+
[alt_names]
77+
DNS.1 = ${CN}
78+
DNS.2 = localhost.
79+
EOF
80+
81+
#Step 1
82+
echo "############ Generating key"
83+
openssl genrsa -out "${HOST_PRIVATE_RSA_KEY_PATH}" 2048
84+
openssl pkcs8 -nocrypt -topk8 -v1 PBE-SHA1-RC4-128 -inform pem -outform pem -in "${HOST_PRIVATE_RSA_KEY_PATH}" -out "${HOST_PRIVATE_KEY_PATH}"
85+
86+
#Step 2
87+
echo "############ Generate the CSR"
88+
openssl req -nodes -new -extensions v3_req -sha256 -config "${HOST_CERT_CONFIG_PATH}" -key "${HOST_PRIVATE_KEY_PATH}" -out "${HOST_CSR_PATH}"
89+
90+
#Step 3
91+
echo "############ Generate the cert"
92+
openssl x509 -req -in "${HOST_CSR_PATH}" -CA "${CA_CERT}" -CAkey "${CA_CERT}.key" -CAcreateserial -out "${HOST_CERT_PATH}" -days ${VALIDITY} -sha256 -extensions v3_req -extfile "${HOST_CERT_CONFIG_PATH}" -passin "pass:${PASS}"
93+
94+
cat "${HOST_CERT_PATH}" > "${HOST_CERT_CHAIN_PATH}"
95+
96+
97+
elif [[ $OP == "client" && -n "$CA_CERT" && -n "$PFX" && -n "$CN" ]]; then
98+
99+
# Standard OpenSSL keys
100+
echo "############ Generating key"
101+
openssl genrsa -nodes -passout "pass:${PASS}" -out "${PFX}client.key" 2048
102+
103+
echo "############ Generating request"
104+
openssl req -passin "pass:${PASS}" -passout "pass:${PASS}" -key "${PFX}client.key" -new -out "${PFX}client.req" \
105+
<<EOF
106+
$C
107+
$ST
108+
$L
109+
$O
110+
$OU
111+
$CN
112+
.
113+
$PASS
114+
.
115+
EOF
116+
117+
echo "########### Signing key"
118+
openssl x509 -req -passin "pass:${PASS}" -in "${PFX}client.req" -CA "${CA_CERT}" -CAkey "${CA_CERT}.key" -CAcreateserial -out "${PFX}client.pem" -days ${VALIDITY}
119+
120+
121+
else
122+
echo "Usage: $0 ca <ca-cert-file> <CN>"
123+
echo " $0 server|client <ca-cert-file> <file_prefix> <hostname>"
124+
echo ""
125+
exit 1
126+
fi
127+

‎src/applications/bmqbrkr/etc/bmqbrkrcfg.json‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,11 +86,28 @@
8686
"highWatermark": 1073741824,
8787
"nodeLowWatermark": 5242880,
8888
"nodeHighWatermark": 10485760,
89-
"heartbeatIntervalMs": 3000
89+
"heartbeatIntervalMs": 3000,
90+
"listeners": [
91+
{
92+
"name": "TCPListener",
93+
"port": 30114,
94+
"tls": false
95+
},
96+
{
97+
"name": "TLSListener",
98+
"port": 30115,
99+
"tls": true
100+
}
101+
]
90102
}
91103
},
92104
"bmqconfConfig": {
93105
"cacheTTLSeconds": 30
106+
},
107+
"tlsConfig": {
108+
"certificateAuthority": "/blazingmq/certs/ca-cert",
109+
"certificate": "/blazingmq/certs/broker_host_cert.pem",
110+
"key": "/blazingmq/certs/broker_private_key.pem"
94111
}
95112
}
96113
}

‎src/applications/bmqtool/bmqtool.m.cpp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,18 @@ static bool parseArgs(Parameters* parameters, int argc, const char* argv[])
204204
"address and port of the broker",
205205
balcl::TypeInfo(&params.broker()),
206206
balcl::OccurrenceInfo(params.broker())},
207+
{"tls-authority",
208+
"tlsAuthority",
209+
"Path to the certificate authority FILE for TLS mode."
210+
"The empty string value means that TLS is disabled, "
211+
"non-empty string value means that TLS is enabled",
212+
balcl::TypeInfo(&params.tlsAuthority()),
213+
balcl::OccurrenceInfo(params.tlsAuthority())},
214+
{"tls-versions",
215+
"tlsVersions",
216+
"TLS protocol versions, has effect only in TLS mode",
217+
balcl::TypeInfo(&params.tlsVersions()),
218+
balcl::OccurrenceInfo(params.tlsVersions())},
207219
{"q|queueuri",
208220
"uri",
209221
"URI of the queue (for auto/syschk modes)",

‎src/applications/bmqtool/bmqtoolcmd.xsd‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,8 @@
223223
<sequence>
224224
<element name='mode' type='string' default="cli"/>
225225
<element name='broker' type='string' default="tcp://localhost:30114"/>
226+
<element name='tlsAuthority' type='string' default=""/>
227+
<element name='tlsVersions' type='string' default="TLSv1.3"/>
226228
<element name='queueUri' type='string' default=""/>
227229
<element name='queueFlags' type='string' default=""/>
228230
<element name='latency' type='string' default="none"/>

‎src/applications/bmqtool/m_bmqtool_application.cpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -564,6 +564,11 @@ int Application::initialize()
564564
.setNumProcessingThreads(d_parameters.numProcessingThreads())
565565
.configureEventQueue(1000, 10 * 1000);
566566

567+
if (!d_parameters.tlsAuthority().empty()) {
568+
options.setTlsDetails(d_parameters.tlsAuthority(),
569+
d_parameters.tlsVersions());
570+
}
571+
567572
// Create the session
568573
if (d_parameters.noSessionEventHandler()) {
569574
d_session_mp.load(new (*d_allocator_p)

0 commit comments

Comments
 (0)