From 5b60db394cbbbb031b615ff3278ec43cbe3fe88c Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Thu, 05 May 2011 18:40:39 -0400
Subject: [PATCH] Automatically generate a self-signed certificate with BouncyCastle.
---
src/com/gitblit/GitBlitServer.java | 149 ++++++++++++++++++++++++++++++++++++++++---------
1 files changed, 121 insertions(+), 28 deletions(-)
diff --git a/src/com/gitblit/GitBlitServer.java b/src/com/gitblit/GitBlitServer.java
index 4f1aecc..b5acd3d 100644
--- a/src/com/gitblit/GitBlitServer.java
+++ b/src/com/gitblit/GitBlitServer.java
@@ -2,22 +2,40 @@
import java.io.BufferedReader;
import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
+import java.math.BigInteger;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.URL;
import java.net.UnknownHostException;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
import java.security.ProtectionDomain;
+import java.security.SecureRandom;
+import java.security.Security;
+import java.security.cert.X509Certificate;
+import java.text.MessageFormat;
import java.util.ArrayList;
+import java.util.Date;
import java.util.List;
import org.apache.log4j.ConsoleAppender;
import org.apache.log4j.PatternLayout;
import org.apache.wicket.protocol.http.ContextParamWebApplicationFactory;
import org.apache.wicket.protocol.http.WicketFilter;
+import org.bouncycastle.asn1.x500.X500NameBuilder;
+import org.bouncycastle.asn1.x500.style.BCStyle;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.eclipse.jetty.http.security.Constraint;
import org.eclipse.jetty.security.ConstraintMapping;
import org.eclipse.jetty.security.ConstraintSecurityHandler;
@@ -44,12 +62,15 @@
import com.beust.jcommander.Parameter;
import com.beust.jcommander.ParameterException;
import com.beust.jcommander.Parameters;
+import com.gitblit.utils.StringUtils;
import com.gitblit.wicket.GitBlitWebApp;
public class GitBlitServer {
private final static Logger logger = Log.getLogger(GitBlitServer.class.getSimpleName());
private final static String border_star = "***********************************************************";
+
+ private final static FileSettings fileSettings = new FileSettings();
public static void main(String[] args) {
Params params = new Params();
@@ -79,7 +100,7 @@
}
if (jc != null) {
jc.usage();
- System.out.println("\nExample:\n java -server -Xmx1024M -jar go-git-go.jar --repos c:\\git --port 80 --securePort 443");
+ System.out.println("\nExample:\n java -server -Xmx1024M -jar gitblit.jar --repos c:\\git --port 80 --securePort 443");
}
System.exit(0);
}
@@ -106,10 +127,23 @@
* Start Server.
*/
private static void start(Params params) {
- // instantiate GitBlit
- GitBlit.self();
-
- PatternLayout layout = new PatternLayout(StoredSettings.getString("log4jPattern", "%-5p %d{MM-dd HH:mm:ss.SSS} %-20.20c{1} %m%n"));
+ String pattern = fileSettings.getString(Keys.server.log4jPattern, "%-5p %d{MM-dd HH:mm:ss.SSS} %-20.20c{1} %m%n");
+
+ // allow os override of logging pattern
+ String os = System.getProperty("os.name").toLowerCase();
+ if (os.indexOf("windows") > -1) {
+ String winPattern = fileSettings.getString(Keys.server.log4jPattern_windows, pattern);
+ if (!StringUtils.isEmpty(winPattern)) {
+ pattern = winPattern;
+ }
+ } else if (os.indexOf("linux") > -1) {
+ String linuxPattern = fileSettings.getString(Keys.server.log4jPattern_linux, pattern);
+ if (!StringUtils.isEmpty(linuxPattern)) {
+ pattern = linuxPattern;
+ }
+ }
+
+ PatternLayout layout = new PatternLayout(pattern);
org.apache.log4j.Logger rootLogger = org.apache.log4j.Logger.getRootLogger();
rootLogger.addAppender(new ConsoleAppender(layout));
@@ -121,23 +155,34 @@
String osversion = System.getProperty("os.version");
logger.info("Running on " + osname + " (" + osversion + ")");
- if (StoredSettings.getBoolean("debugMode", false)) {
- logger.warn("DEBUG Mode");
- }
-
// Determine port connectors
List<Connector> connectors = new ArrayList<Connector>();
if (params.port > 0) {
Connector httpConnector = createConnector(params.useNIO, params.port);
+ String bindInterface = fileSettings.getString(Keys.server.httpBindInterface, null);
+ if (!StringUtils.isEmpty(bindInterface)) {
+ logger.warn(MessageFormat.format("Binding connector on port {0} to {1}", params.port, bindInterface));
+ httpConnector.setHost(bindInterface);
+ }
connectors.add(httpConnector);
}
if (params.securePort > 0) {
- if (new File("keystore").exists()) {
- Connector secureConnector = createSSLConnector(params.useNIO, params.securePort, params.storePassword);
+ File keystore = new File("keystore");
+ if (!keystore.exists()) {
+ logger.info("Generating self-signed ssl certificate");
+ generateSelfSignedCertificate("localhost", keystore, params.storePassword);
+ }
+ if (keystore.exists()) {
+ Connector secureConnector = createSSLConnector(keystore, params.storePassword, params.useNIO, params.securePort);
+ String bindInterface = fileSettings.getString(Keys.server.httpsBindInterface, null);
+ if (!StringUtils.isEmpty(bindInterface)) {
+ logger.warn(MessageFormat.format("Binding ssl connector on port {0} to {1}", params.securePort, bindInterface));
+ secureConnector.setHost(bindInterface);
+ }
connectors.add(secureConnector);
} else {
- logger.warn("Failed to find Keystore? Did you run \"makekeystore\"?");
+ logger.warn("Failed to find or load Keystore?");
logger.warn("SSL connector DISABLED.");
}
}
@@ -177,12 +222,12 @@
// Git Servlet
ServletHolder gitServlet = null;
String gitServletPathSpec = "/git/*";
- if (StoredSettings.getBoolean("allowPushPull", true)) {
+ if (fileSettings.getBoolean(Keys.git.allowPushPull, true)) {
gitServlet = rootContext.addServlet(GitServlet.class, gitServletPathSpec);
gitServlet.setInitParameter("base-path", params.repositoriesFolder);
gitServlet.setInitParameter("export-all", params.exportAll ? "1" : "0");
}
-
+
// Login Service
LoginService loginService = null;
String realmUsers = params.realmFile;
@@ -192,7 +237,7 @@
GitBlit.self().setLoginService(jettyLoginService);
loginService = jettyLoginService;
}
-
+
// Determine what handler to use
Handler handler;
if (gitServlet != null) {
@@ -235,6 +280,11 @@
// Set the server's contexts
server.setHandler(handler);
+ // Setup the GitBlit context
+ GitBlit gitblit = GitBlit.self();
+ gitblit.configureContext(fileSettings);
+ rootContext.addEventListener(gitblit);
+
// Start the Server
try {
if (params.shutdownPort > 0) {
@@ -268,24 +318,67 @@
return connector;
}
- private static Connector createSSLConnector(boolean useNIO, int port, String password) {
+ private static Connector createSSLConnector(File keystore, String password, boolean useNIO, int port) {
SslConnector connector;
if (useNIO) {
logger.info("Setting up NIO SslSelectChannelConnector on port " + port);
SslSelectChannelConnector ssl = new SslSelectChannelConnector();
ssl.setSoLingerTime(-1);
- ssl.setThreadPool(new QueuedThreadPool(20));
+ ssl.setThreadPool(new QueuedThreadPool(20));
connector = ssl;
} else {
logger.info("Setting up NIO SslSocketConnector on port " + port);
SslSocketConnector ssl = new SslSocketConnector();
connector = ssl;
}
- connector.setKeystore("keystore");
+ connector.setAllowRenegotiate(true);
+ connector.setKeystore(keystore.getAbsolutePath());
connector.setPassword(password);
connector.setPort(port);
connector.setMaxIdleTime(30000);
return connector;
+ }
+
+ private static void generateSelfSignedCertificate(String hostname, File keystore, String keystorePassword) {
+ try {
+ Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
+
+ final String BC = org.bouncycastle.jce.provider.BouncyCastleProvider.PROVIDER_NAME;
+
+ KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", "BC");
+ kpGen.initialize(1024, new SecureRandom());
+ KeyPair pair = kpGen.generateKeyPair();
+
+ // Generate self-signed certificate
+ X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
+ builder.addRDN(BCStyle.OU, Constants.NAME);
+ builder.addRDN(BCStyle.O, Constants.NAME);
+ builder.addRDN(BCStyle.CN, hostname);
+
+ Date notBefore = new Date(System.currentTimeMillis() - 1*24*60*60*1000l);
+ Date notAfter = new Date(System.currentTimeMillis() + 10*365*24*60*60*1000l);
+ BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
+
+ X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(builder.build(), serial, notBefore, notAfter, builder.build(), pair.getPublic());
+ ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(BC).build(pair.getPrivate());
+ X509Certificate cert = new JcaX509CertificateConverter().setProvider(BC).getCertificate(certGen.build(sigGen));
+ cert.checkValidity(new Date());
+ cert.verify(cert.getPublicKey());
+
+ // Save to keystore
+ KeyStore store = KeyStore.getInstance("JKS");
+ if (keystore.exists()) {
+ FileInputStream fis = new FileInputStream(keystore);
+ store.load(fis, keystorePassword.toCharArray());
+ } else {
+ store.load(null);
+ }
+ store.setKeyEntry(hostname, pair.getPrivate(), keystorePassword.toCharArray(), new java.security.cert.Certificate[] { cert });
+ store.store(new FileOutputStream(keystore), keystorePassword.toCharArray());
+ } catch (Throwable t) {
+ t.printStackTrace();
+ throw new RuntimeException("Failed to generate self-signed certificate!", t);
+ }
}
/**
@@ -356,43 +449,43 @@
public Boolean stop = false;
@Parameter(names = { "--temp" }, description = "Server temp folder")
- public String temp = StoredSettings.getString("tempFolder", "temp");
+ public String temp = fileSettings.getString(Keys.server.tempFolder, "temp");
/*
* GIT Servlet Parameters
*/
@Parameter(names = { "--repos" }, description = "Git Repositories Folder")
- public String repositoriesFolder = StoredSettings.getString("repositoriesFolder", "repos");
+ public String repositoriesFolder = fileSettings.getString(Keys.git.repositoriesFolder, "repos");
@Parameter(names = { "--exportAll" }, description = "Export All Found Repositories")
- public Boolean exportAll = StoredSettings.getBoolean("exportAll", true);
+ public Boolean exportAll = fileSettings.getBoolean(Keys.git.exportAll, true);
/*
* Authentication Parameters
*/
@Parameter(names = { "--authenticatePushPull" }, description = "Authenticate Git Push/Pull access")
- public Boolean authenticatePushPull = StoredSettings.getBoolean("authenticatePushPull", true);
+ public Boolean authenticatePushPull = fileSettings.getBoolean(Keys.git.authenticate, true);
@Parameter(names = { "--realm" }, description = "Users Realm Hash File")
- public String realmFile = StoredSettings.getString("realmFile", "users.properties");
+ public String realmFile = fileSettings.getString(Keys.server.realmFile, "users.properties");
/*
* JETTY Parameters
*/
@Parameter(names = { "--nio" }, description = "Use NIO Connector else use Socket Connector.")
- public Boolean useNIO = StoredSettings.getBoolean("useNio", true);
+ public Boolean useNIO = fileSettings.getBoolean(Keys.server.useNio, true);
@Parameter(names = "--port", description = "HTTP port for to serve. (port <= 0 will disable this connector)")
- public Integer port = StoredSettings.getInteger("httpPort", 80);
+ public Integer port = fileSettings.getInteger(Keys.server.httpPort, 80);
@Parameter(names = "--securePort", description = "HTTPS port to serve. (port <= 0 will disable this connector)")
- public Integer securePort = StoredSettings.getInteger("httpsPort", 443);
+ public Integer securePort = fileSettings.getInteger(Keys.server.httpsPort, 443);
@Parameter(names = "--storePassword", description = "Password for SSL (https) keystore.")
- public String storePassword = StoredSettings.getString("storePassword", "");
+ public String storePassword = fileSettings.getString(Keys.server.storePassword, "");
@Parameter(names = "--shutdownPort", description = "Port for Shutdown Monitor to listen on. (port <= 0 will disable this monitor)")
- public Integer shutdownPort = StoredSettings.getInteger("shutdownPort", 8081);
+ public Integer shutdownPort = fileSettings.getInteger(Keys.server.shutdownPort, 8081);
}
}
\ No newline at end of file
--
Gitblit v1.9.1