Skip to content

Commit dffe22a

Browse files
nebhalenebhale
committed
Polishing
This change polishes up the contribution to be a bit more idomatic for the project. [cloudfoundry#385]
1 parent 58fcfc0 commit dffe22a

7 files changed

Lines changed: 132 additions & 173 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ To learn how to configure various properties of the buildpack, follow the "Confi
8989
* [Play Framework Auto Reconfiguration](docs/framework-play_framework_auto_reconfiguration.md) ([Configuration](docs/framework-play_framework_auto_reconfiguration.md#configuration))
9090
* [Play Framework JPA Plugin](docs/framework-play_framework_jpa_plugin.md) ([Configuration](docs/framework-play_framework_jpa_plugin.md#configuration))
9191
* [PostgreSQL JDBC](docs/framework-postgresql_jdbc.md) ([Configuration](docs/framework-postgresql_jdbc.md#configuration))
92+
* [ProtectApp Security Provider](docs/framework-protect_app_security_provider.md) ([Configuration](docs/framework-protect_app_security_provider.md#configuration))
9293
* [Spring Auto Reconfiguration](docs/framework-spring_auto_reconfiguration.md) ([Configuration](docs/framework-spring_auto_reconfiguration.md#configuration))
9394
* [Spring Insight](docs/framework-spring_insight.md)
9495
* [YourKit Profiler](docs/framework-your_kit_profiler.md) ([Configuration](docs/framework-your_kit_profiler.md#configuration))

‎config/components.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ frameworks:
5252
- "JavaBuildpack::Framework::NewRelicAgent"
5353
- "JavaBuildpack::Framework::PlayFrameworkAutoReconfiguration"
5454
- "JavaBuildpack::Framework::PlayFrameworkJPAPlugin"
55-
- "JavaBuildpack::Framework::PostgresqlJDBC
55+
- "JavaBuildpack::Framework::PostgresqlJDBC"
5656
- "JavaBuildpack::Framework::ProtectAppSecurityProvider"
5757
- "JavaBuildpack::Framework::SpringAutoReconfiguration"
5858
- "JavaBuildpack::Framework::SpringInsight"

‎docs/framework-protect_app_security_provider.md‎

Lines changed: 23 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ProtectApp Security Provider Framework
2-
The ProtectApp Security Provider Framework causes an application to be automatically configured to work with a bound [ProtectApp Security Service][].
2+
The ProtectApp Security Provider Framework causes an application to be automatically configured to work with a bound [ProtectApp Security Service][].
33

44
<table>
55
<tr>
@@ -20,65 +20,61 @@ When binding to the ProtectApp Security Provider using a user-provided service,
2020
| Name | Description
2121
| ---- | -----------
2222
| `client` | The client configuration
23-
| `trustedcerts` | An array of certs containing trust information
23+
| `trusted_certificates` | An array of certs containing trust information
2424
| `NAE_IP.1` | A list of KeySecure server ips or hostnames to be used
2525
| `***` | (Optional) Any additional entries will be applied as a system property appended to `-Dcom.ingrian.security.nae.` to allow full configuration of the library.
2626

27-
2827
#### Client Configuration
2928
| Name | Description
3029
| ---- | -----------
3130
| `certificate` | A PEM encoded client certificate
32-
| `private-key` | A PEM encoded client private key
31+
| `private_key` | A PEM encoded client private key
3332

3433
#### Trusted Certs Configuration
35-
One or more PEM encoded certificate
36-
34+
One or more PEM encoded certificate
3735

3836
### Example Credentials Payload
3937
```
4038
{
4139
"client": {
4240
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
43-
"private-key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
41+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
4442
},
45-
"trustedcerts": [
46-
"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
47-
,
43+
"trusted_certificates": [
44+
"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
4845
"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
4946
],
5047
"NAE_IP.1": "192.168.1.25:192.168.1.26"
51-
5248
}
5349
```
5450

5551
### Creating Credential Payload
5652
In order to create the credentials payload, you should collapse the JSON payload to a single line and set it like the following
5753

5854
```
59-
$ cf create-user-provided-service protectapp -p '{"client":{"certificate":"-----BEGIN CERTIFICATE-----\n....\n-----END CERTIFICATE-----","private-key":"-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----\n"},"trustedcerts":["-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"],NAE_IP.1":"172.17.34.100"}
55+
$ cf create-user-provided-service protectapp -p '{"client":{"certificate":"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----","private_key":"-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"},"trusted_certificates":["-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----","-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"],"NAE_IP.1":"192.168.1.25:192.168.1.26"}'
6056
```
6157

62-
6358
You may want to use a file for this
6459

6560
Note the client portion is very exacting and needs line breaks in the body every 64 characters.
6661

67-
1. The file must contain:
68-
-----BEGIN CERTIFICATE-----
69-
on a separate line (i.e. it must be terminated with a newline).
70-
2. Each line of "gibberish" must be 64 characters wide.
71-
3. The file must end with:
72-
-----END CERTIFICATE-----
73-
and also be terminated with a newline.
74-
4. Don't save the cert text with Word. It must be in ASCII.
75-
5. Don't mix DOS and UNIX style line terminations.
62+
1. The file must contain:
63+
`-----BEGIN CERTIFICATE-----`
64+
on a separate line (i.e. it must be terminated with a newline).
65+
1. Each line of "gibberish" must be 64 characters wide.
66+
1. The file must end with:
67+
`-----END CERTIFICATE-----`
68+
and also be terminated with a newline.
69+
1. Don't save the cert text with Word. It must be in ASCII.
70+
1. Don't mix DOS and UNIX style line terminations.
7671

7772
So, here are a few steps you can take to normalize your certificate:
78-
1. Run it through dos2unix
79-
dos2unix cert.pem
80-
2. Run it through fold
81-
fold -w 64 cert.pem
73+
74+
1. Run it through `dos2unix`
75+
`$ dos2unix cert.pem`
76+
1. Run it through `fold`
77+
`$ fold -w 64 cert.pem`
8278

8379
## Configuration
8480
For general information on configuring the buildpack, including how to specify configuration values through environment variables, refer to [Configuration and Extension][].
@@ -91,7 +87,7 @@ The framework can be configured by modifying the [`config/protect_app_security_p
9187
| `version` | Version of the ProtectApp Security Provider to use.
9288

9389
### Additional Resources
94-
The framework can also be configured by overlaying a set of resources on the default distribution. To do this, add files to the `resources/pprotect_app_security_provider` directory in the buildpack fork.
90+
The framework can also be configured by overlaying a set of resources on the default distribution. To do this, add files to the `resources/protect_app_security_provider` directory in the buildpack fork.
9591

9692
[`config/protect_app_security_provider.yml`]: ../config/protect_app_security_provider.yml
9793
[ProtectApp Security Service]: https://safenet.gemalto.com/data-encryption/protectapp-application-protection/

‎lib/java_buildpack/framework/protect_app_security_provider.rb‎

Lines changed: 59 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -30,108 +30,61 @@ class ProtectAppSecurityProvider < JavaBuildpack::Component::VersionedDependency
3030

3131
# (see JavaBuildpack::Component::BaseComponent#compile)
3232
def compile
33-
download_zip
34-
35-
# copy default properties file
33+
download_zip false
3634
@droplet.copy_resources
3735

3836
credentials = @application.services.find_service(FILTER)['credentials']
39-
40-
write_client credentials['client']
41-
write_trusted_certs credentials['trustedcerts']
42-
43-
certificates.each_with_index { |certificate, index| add_certificate certificate, index }
44-
45-
# setup java keystore with provided values
46-
merge_clientcert
47-
import_clientcert
48-
37+
38+
pkcs12 = merge_client_credentials credentials['client']
39+
add_client_credentials pkcs12
40+
41+
add_trusted_certificates credentials['trusted_certificates']
4942
end
5043

5144
# (see JavaBuildpack::Component::BaseComponent#release)
5245
def release
53-
credentials = @application.services.find_service(FILTER)['credentials']
46+
credentials = @application.services.find_service(FILTER)['credentials']
5447
java_opts = @droplet.java_opts
55-
configuration = {}
56-
57-
filter_known_input(credentials, configuration)
58-
59-
write_java_opts(java_opts, configuration)
60-
@droplet.java_opts
48+
49+
java_opts
6150
.add_system_property('java.ext.dirs', ext_dirs)
62-
.add_system_property('com.ingrian.security.nae.IngrianNAE_Properties_Conf_Filename', @droplet.sandbox + 'IngrianNAE.properties')
63-
.add_system_property('com.ingrian.security.nae.Key_Store_Location', key_store)
51+
.add_system_property('java.security.properties', @droplet.sandbox + 'java.security')
52+
.add_system_property('com.ingrian.security.nae.IngrianNAE_Properties_Conf_Filename',
53+
@droplet.sandbox + 'IngrianNAE.properties')
54+
.add_system_property('com.ingrian.security.nae.Key_Store_Location', keystore)
6455
.add_system_property('com.ingrian.security.nae.Key_Store_Password', password)
56+
57+
credentials
58+
.reject { |key, _| key =~ /^client$/ || key =~ /^trusted_certificates$/ }
59+
.each { |key, value| java_opts.add_system_property("com.ingrian.security.nae.#{key}", value) }
6560
end
6661

6762
protected
6863

6964
# (see JavaBuildpack::Component::VersionedDependencyComponent#supports?)
7065
def supports?
71-
@application.services.one_service? FILTER, 'client', 'trustedcerts'
66+
@application.services.one_service? FILTER, 'client', 'trusted_certificates'
7267
end
7368

7469
private
7570

76-
FILTER = /protectapp/.freeze
71+
FILTER = /protectapp/
7772

7873
private_constant :FILTER
79-
80-
def merge_clientcert
81-
82-
shell "openssl pkcs12 -export -in #{client_certificate} -inkey #{client_private_key} -name #{myclientcert} -out #{myp12} -passout pass:#{password}"
83-
end
84-
85-
def import_clientcert
86-
87-
shell "#{keytool} -importkeystore -noprompt -destkeystore #{key_store} -deststorepass #{password} " \
88-
"-srckeystore #{myp12} -srcstorepass #{password} -srcstoretype pkcs12" \
89-
" -alias #{myclientcert}"
90-
end
9174

92-
def add_certificate(certificate, index)
93-
94-
file = write_certificate certificate
95-
shell "#{keytool} -importcert -noprompt -keystore #{key_store} -storepass #{password} " \
96-
"-file #{file.to_path} -alias certificate-#{index}"
97-
end
98-
99-
def certificates
100-
certificates = []
101-
102-
certificate = nil
103-
File.open(trusted_certificates).each_line do |line|
104-
if line =~ /BEGIN CERTIFICATE/
105-
certificate = line
106-
elsif line =~ /END CERTIFICATE/
107-
certificate += line
108-
certificates << certificate
109-
certificate = nil
110-
elsif !certificate.nil?
111-
certificate += line
112-
end
113-
end
114-
115-
certificates
116-
end
117-
118-
def keytool
119-
@droplet.java_home.root + 'bin/keytool'
120-
end
121-
122-
def password
123-
'nae-jks-password'
75+
def add_client_credentials(pkcs12)
76+
shell "#{keytool} -importkeystore -noprompt -destkeystore #{keystore} -deststorepass #{password} " \
77+
"-srckeystore #{pkcs12.path} -srcstorepass #{password} -srcstoretype pkcs12" \
78+
" -alias #{File.basename(pkcs12)}"
12479
end
12580

126-
def key_store
127-
@droplet.sandbox + 'keystore.jks'
128-
end
81+
def add_trusted_certificates(trusted_certificates)
82+
trusted_certificates.each do |certificate|
83+
pem = write_certificate certificate
12984

130-
def write_certificate(certificate)
131-
file = Tempfile.new('certificate-')
132-
file.write(certificate)
133-
file.fsync
134-
file
85+
shell "#{keytool} -importcert -noprompt -keystore #{keystore} -storepass #{password} " \
86+
"-file #{pem.path} -alias #{File.basename(pem)}"
87+
end
13588
end
13689

13790
def ext_dir
@@ -142,54 +95,45 @@ def ext_dirs
14295
"#{qualify_path(@droplet.java_home.root + 'lib/ext', @droplet.root)}:" \
14396
"#{qualify_path(ext_dir, @droplet.root)}"
14497
end
145-
146-
def client_certificate
147-
File.join(Dir.tmpdir,'/client-certificate.pem')
148-
end
14998

150-
def client_private_key
151-
File.join(Dir.tmpdir,'/client-private-key.pem')
99+
def keystore
100+
@droplet.sandbox + 'nae-keystore.jks'
152101
end
153102

154-
def trusted_certificates
155-
File.join(Dir.tmpdir, 'trusted_certificates.pem')
156-
end
157-
158-
def myclientcert
159-
'myclientcert'
160-
end
161-
162-
def myp12
163-
File.join(Dir.tmpdir,'/clientwrap.p12')
103+
def keytool
104+
@droplet.java_home.root + 'bin/keytool'
164105
end
165106

166-
def write_client(client)
167-
File.open(client_certificate, File::CREAT | File::WRONLY) do |f|
168-
f.write "#{client['certificate']}\n"
169-
end
107+
def merge_client_credentials(credentials)
108+
certificate = write_certificate credentials['certificate']
109+
private_key = write_private_key credentials['private_key']
170110

171-
File.open(client_private_key, File::CREAT | File::WRONLY) do |f|
172-
f.write "#{client['private-key']}\n"
173-
end
111+
pkcs12 = Tempfile.new('pkcs12-')
112+
pkcs12.close
113+
114+
shell "openssl pkcs12 -export -in #{certificate.path} -inkey #{private_key.path} " \
115+
"-name #{File.basename(pkcs12)} -out #{pkcs12.path} -passout pass:#{password}"
116+
117+
pkcs12
174118
end
175-
176-
def write_trusted_certs(trusted_certs)
177-
File.open(trusted_certificates,File::CREAT | File::WRONLY) do |f|
178-
trusted_certs.each { |cert| f.write "#{cert}\n" }
179-
end
119+
120+
def password
121+
'nae-keystore-password'
180122
end
181-
182-
def filter_known_input(credentials, configuration)
183-
credentials.each do |key, value|
184-
if key != "client" and key != "trustedcerts"
185-
configuration[key] = value
186-
end
123+
124+
def write_certificate(certificate)
125+
Tempfile.open('certificate-') do |f|
126+
f.write "#{certificate}\n"
127+
f.sync
128+
f
187129
end
188-
end
189-
190-
def write_java_opts(java_opts, configuration2)
191-
configuration2.each do |key, value|
192-
java_opts.add_system_property("com.ingrian.security.nae.#{key}", value )
130+
end
131+
132+
def write_private_key(private_key)
133+
Tempfile.open('private-key-') do |f|
134+
f.write "#{private_key}\n"
135+
f.sync
136+
f
193137
end
194138
end
195139

‎resources/protect_app_security_provider/java.security‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
security.provider.10=com.ingrian.security.nae.IngrianProvider

‎spec/fixtures/stub-protect-app-security-provider.zip‎

252 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)