Merge "Make certs in A1 controller configurable"
diff --git a/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/java/org/o_ran_sc/nonrtric/sdnc_a1/northbound/restadapter/RestAdapterImpl.java b/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/java/org/o_ran_sc/nonrtric/sdnc_a1/northbound/restadapter/RestAdapterImpl.java
index 928b65f..d2e602f 100644
--- a/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/java/org/o_ran_sc/nonrtric/sdnc_a1/northbound/restadapter/RestAdapterImpl.java
+++ b/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/java/org/o_ran_sc/nonrtric/sdnc_a1/northbound/restadapter/RestAdapterImpl.java
@@ -20,7 +20,7 @@
package org.o_ran_sc.nonrtric.sdnc_a1.northbound.restadapter;
-import java.io.FileNotFoundException;
+import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
@@ -36,6 +36,7 @@
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustAllStrategy;
import org.apache.http.impl.client.HttpClients;
+import org.apache.http.ssl.SSLContextBuilder;
import org.apache.http.ssl.SSLContexts;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -58,7 +59,6 @@
public class RestAdapterImpl implements RestAdapter {
- private static final String PROPERTIES_FILE = "nonrt-ric-api-provider.properties";
private final Logger log = LoggerFactory.getLogger(RestAdapterImpl.class);
private RestTemplate restTemplateHttp;
@@ -76,24 +76,26 @@
private RestTemplate createRestTemplateForHttps() throws IOException, UnrecoverableKeyException, CertificateException,
NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
- InputStream inputStream = RestAdapterImpl.class.getClassLoader().getResourceAsStream(PROPERTIES_FILE);
- if (inputStream == null) {
- throw new FileNotFoundException("properties file not found in classpath");
- } else {
+ try (InputStream inputStream = new FileInputStream(ResourceUtils.getFile("/opt/onap/sdnc/data/properties/https-props.properties"))) {
Properties properties = new Properties();
properties.load(inputStream);
- final String keystorePassword = properties.getProperty("key-store-password");
- SSLConnectionSocketFactory scsf = new SSLConnectionSocketFactory(
- SSLContexts.custom()
- .loadKeyMaterial(ResourceUtils.getFile(properties.getProperty("key-store")),
- keystorePassword.toCharArray(), keystorePassword.toCharArray())
- .loadTrustMaterial(null, new TrustAllStrategy())
- .build(),
- NoopHostnameVerifier.INSTANCE);
+ final String keyPassword = properties.getProperty("key-password");
+ final String keystorePassword = properties.getProperty("keystore-password");
+ final String truststorePassword = properties.getProperty("truststore-password");
+ final boolean isTrustStoreUsed = Boolean.parseBoolean(properties.getProperty("isTrustStoreUsed"));
+ SSLContextBuilder builder = SSLContexts.custom()
+ .loadKeyMaterial(ResourceUtils.getFile(properties.getProperty("key-store")),
+ keystorePassword.toCharArray(), keyPassword.toCharArray());
+ if (isTrustStoreUsed) {
+ builder.loadTrustMaterial(ResourceUtils.getFile(properties.getProperty("trust-store")),
+ truststorePassword.toCharArray());
+ } else {
+ builder.loadTrustMaterial(null, new TrustAllStrategy());
+ }
+ SSLConnectionSocketFactory scsf = new SSLConnectionSocketFactory(builder.build(), NoopHostnameVerifier.INSTANCE);
HttpClient client = HttpClients.custom().setSSLSocketFactory(scsf).build();
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(client);
- inputStream.close();
return new RestTemplate(requestFactory);
}
}
diff --git a/sdnc-a1-controller/oam/installation/sdnc-a1/pom.xml b/sdnc-a1-controller/oam/installation/sdnc-a1/pom.xml
index cd58073..b8816ec 100644
--- a/sdnc-a1-controller/oam/installation/sdnc-a1/pom.xml
+++ b/sdnc-a1-controller/oam/installation/sdnc-a1/pom.xml
@@ -190,9 +190,7 @@
<resource>
<directory>src/main/resources</directory>
<includes>
- <include>idmlight.db.mv.db</include>
- <include>keystore.jks</include>
- <include>aaa-app-config.xml</include>
+ <include>*.jks</include>
</includes>
<filtering>false</filtering>
</resource>
diff --git a/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/docker/standalone.Dockerfile b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/docker/standalone.Dockerfile
index 03977f8..e80187a 100755
--- a/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/docker/standalone.Dockerfile
+++ b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/docker/standalone.Dockerfile
@@ -45,7 +45,7 @@
ENV JAVA_SECURITY_DIR /etc/ssl/certs/java
ENV SDNC_NORTHBOUND_REPO mvn:org.o-ran-sc.nonrtric.sdnc-a1.northbound/sdnc-a1-northbound-all/${sdnc.northbound.version}/xml/features
ENV SDNC_KEYSTORE keystore.jks
-ENV SDNC_KEYPASS sdnc-a1-controller
+ENV SDNC_TRUSTSTORE truststore.jks
ENV SDNC_SECUREPORT 8443
USER root
@@ -60,13 +60,11 @@
# Install java certificate
COPY $SDNC_KEYSTORE $JAVA_SECURITY_DIR
+COPY $SDNC_TRUSTSTORE $JAVA_SECURITY_DIR
# Secure with TLS
RUN echo org.osgi.service.http.secure.enabled=true >> $ODL_HOME/etc/custom.properties
RUN echo org.osgi.service.http.secure.port=$SDNC_SECUREPORT >> $ODL_HOME/etc/custom.properties
-RUN echo org.ops4j.pax.web.ssl.keystore=$JAVA_SECURITY_DIR/$SDNC_KEYSTORE >> $ODL_HOME/etc/custom.properties
-RUN echo org.ops4j.pax.web.ssl.password=$SDNC_KEYPASS >> $ODL_HOME/etc/custom.properties
-RUN echo org.ops4j.pax.web.ssl.keypassword=$SDNC_KEYPASS >> $ODL_HOME/etc/custom.properties
RUN chown -R odl:odl /opt
diff --git a/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/resources/truststore.jks b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/resources/truststore.jks
new file mode 100644
index 0000000..ce2d0ed
--- /dev/null
+++ b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/resources/truststore.jks
Binary files differ
diff --git a/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/scripts/startODL.sh b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/scripts/startODL.sh
index 78d3ea3..54a7b6b 100755
--- a/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/scripts/startODL.sh
+++ b/sdnc-a1-controller/oam/installation/sdnc-a1/src/main/scripts/startODL.sh
@@ -27,12 +27,17 @@
ODL_HOME=${ODL_HOME:-/opt/opendaylight/current}
ODL_ADMIN_USERNAME=${ODL_ADMIN_USERNAME:-admin}
ODL_ADMIN_PASSWORD=${ODL_ADMIN_PASSWORD:-Kp8bJ4SXszM0WXlhak3eHlcse2gAw84vaoGGmJvUy2U}
+HTTPS_PROPS=${HTTPS_PROPS:-/opt/onap/sdnc/data/properties/https-props.properties}
SDNC_HOME=${SDNC_HOME:-/opt/onap/sdnc}
SDNC_BIN=${SDNC_BIN:-/opt/onap/sdnc/bin}
MYSQL_PASSWD=${MYSQL_PASSWD:-openECOMP1.0}
INSTALLED_DIR=${INSTALLED_FILE:-/opt/opendaylight/current/daexim}
export ODL_ADMIN_PASSWORD ODL_ADMIN_USERNAME
+echo org.ops4j.pax.web.ssl.keystore=$(cat $HTTPS_PROPS | grep -w key-store | cut -d '=' -f2) >> /opt/opendaylight/etc/custom.properties
+echo org.ops4j.pax.web.ssl.password=$(cat $HTTPS_PROPS | grep -w keystore-password | cut -d '=' -f2) >> /opt/opendaylight/etc/custom.properties
+echo org.ops4j.pax.web.ssl.keypassword=$(cat $HTTPS_PROPS | grep -w key-password | cut -d '=' -f2) >> /opt/opendaylight/etc/custom.properties
+
#
# Wait for database
#
diff --git a/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/resources/nonrt-ric-api-provider.properties b/sdnc-a1-controller/oam/installation/src/main/properties/https-props.properties
similarity index 76%
rename from sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/resources/nonrt-ric-api-provider.properties
rename to sdnc-a1-controller/oam/installation/src/main/properties/https-props.properties
index 6a066a6..e3155c5 100644
--- a/sdnc-a1-controller/northbound/nonrt-ric-api/provider/src/main/resources/nonrt-ric-api-provider.properties
+++ b/sdnc-a1-controller/oam/installation/src/main/properties/https-props.properties
@@ -16,5 +16,9 @@
# limitations under the License.
# ========================LICENSE_END===================================
-key-store-password = sdnc-a1-controller
-key-store = /etc/ssl/certs/java/keystore.jks
\ No newline at end of file
+key-store=/etc/ssl/certs/java/keystore.jks
+key-password=sdnc-a1-controller
+keystore-password=sdnc-a1-controller
+isTrustStoreUsed=true
+trust-store=/etc/ssl/certs/java/truststore.jks
+truststore-password=sdnc-a1-controller
diff --git a/sdnc-a1-controller/oam/installation/src/main/yaml/README.md b/sdnc-a1-controller/oam/installation/src/main/yaml/README.md
new file mode 100644
index 0000000..a82c70d
--- /dev/null
+++ b/sdnc-a1-controller/oam/installation/src/main/yaml/README.md
@@ -0,0 +1,43 @@
+The SDNC-A1 controller uses the default keystore and truststore that are built into the container.
+
+The paths and passwords for these stores are located in a properties file:
+nonrtric/sdnc-a1-controller/oam/installation/src/main/properties/https-props.properties
+
+The default truststore includes the a1simulator cert as a trusted cert which is located here:
+https://gerrit.o-ran-sc.org/r/gitweb?p=sim/a1-interface.git;a=tree;f=near-rt-ric-simulator/certificate;h=172c1e5aacd52d760e4416288dc5648a5817ce65;hb=HEAD
+
+The default keystore, truststore, and https-props.properties files can be overridden by mounting new files using the "volumes" field of docker-compose. Uncommment the following lines in docker-compose to do this, and provide paths to the new files:
+
+#volumes:
+ # - <path_to_keystore>:/etc/ssl/certs/java/keystore.jks:ro
+ # - <path_to_truststore>:/etc/ssl/certs/java/truststore.jks:ro
+ # - <path_to_https-props>:/opt/onap/sdnc/data/properties/https-props.properties:ro
+
+The target paths in the container should not be modified.
+
+For example, assuming that the keystore, truststore, and https-props.properties files are located in the same directory as docker-compose:
+
+volumes:
+ - ./new_keystore.jks:/etc/ssl/certs/java/keystore.jks:ro
+ - ./new_truststore.jks:/etc/ssl/certs/java/truststore.jks:ro
+ - ./new_https-props.properties:/opt/onap/sdnc/data/properties/https-props.properties:ro
+
+
+## License
+
+Copyright (C) 2020 Nordix Foundation.
+Licensed under the Apache License, Version 2.0 (the "License")
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+For more information about license please see the [LICENSE](LICENSE.txt) file for details.
+
+
diff --git a/sdnc-a1-controller/oam/installation/src/main/yaml/docker-compose.yml b/sdnc-a1-controller/oam/installation/src/main/yaml/docker-compose.yml
index c2b9978..93121a7 100644
--- a/sdnc-a1-controller/oam/installation/src/main/yaml/docker-compose.yml
+++ b/sdnc-a1-controller/oam/installation/src/main/yaml/docker-compose.yml
@@ -55,6 +55,10 @@
environment:
- MYSQL_ROOT_PASSWORD=openECOMP1.0
- SDNC_CONFIG_DIR=/opt/onap/sdnc/data/properties
+ #volumes:
+ # - <path_to_keystore>:/etc/ssl/certs/java/keystore.jks:ro
+ # - <path_to_truststore>:/etc/ssl/certs/java/truststore.jks:ro
+ # - <path_to_https-props>:/opt/onap/sdnc/data/properties/https-props.properties:ro
dns:
- ${DNS_IP_ADDR-10.0.100.1}
logging: