-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1135 from eclipse-tractusx/feature/786-additional…
…-port-for-internal-requests feature(chore):786 added alternative port for internal access only.
- Loading branch information
Showing
16 changed files
with
253 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -212,6 +212,7 @@ backend: | |
| service: | ||
| type: ClusterIP | ||
| port: 8080 | ||
| trustedPort: 8181 | ||
|
|
||
| autoscaling: | ||
| enabled: false | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87 changes: 87 additions & 0 deletions
87
...src/main/java/org/eclipse/tractusx/traceability/common/config/TrustedEndpointsFilter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| /******************************************************************************** | ||
| * Copyright (c) 2024 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| ********************************************************************************/ | ||
| package org.eclipse.tractusx.traceability.common.config; | ||
|
|
||
| import jakarta.servlet.Filter; | ||
| import jakarta.servlet.FilterChain; | ||
| import jakarta.servlet.ServletException; | ||
| import jakarta.servlet.ServletRequest; | ||
| import jakarta.servlet.ServletResponse; | ||
| import jakarta.servlet.http.HttpServletRequestWrapper; | ||
| import jakarta.servlet.http.HttpServletResponse; | ||
| import jakarta.servlet.http.HttpServletResponseWrapper; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.eclipse.tractusx.irs.common.ApiConstants; | ||
| import org.springframework.context.annotation.Profile; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| import static org.eclipse.tractusx.traceability.common.config.ApplicationProfiles.NOT_INTEGRATION_TESTS; | ||
|
|
||
| @Profile(NOT_INTEGRATION_TESTS) | ||
| @Slf4j | ||
| public class TrustedEndpointsFilter implements Filter { | ||
| private int trustedPortNum; | ||
|
|
||
| /* package */ TrustedEndpointsFilter(final String trustedPort) { | ||
| try { | ||
| if (StringUtils.isNotEmpty(trustedPort)) { | ||
| trustedPortNum = Integer.parseInt(trustedPort); | ||
| } else { | ||
| trustedPortNum = 0; | ||
| } | ||
| } catch (NumberFormatException e) { | ||
| trustedPortNum = 0; | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse, | ||
| final FilterChain filterChain) throws IOException, ServletException { | ||
| if (trustedPortNum != 0) { | ||
|
|
||
| if (isRequestForTrustedEndpoint(servletRequest) && servletRequest.getLocalPort() != trustedPortNum) { | ||
| log.warn("denying request for trusted endpoint on untrusted port"); | ||
| if (servletResponse instanceof HttpServletResponseWrapper httpServletResponse) { | ||
| httpServletResponse.setStatus(HttpServletResponse.SC_NOT_FOUND); | ||
| } | ||
| servletResponse.getOutputStream().close(); | ||
| return; | ||
| } | ||
|
|
||
| if (!isRequestForTrustedEndpoint(servletRequest) && servletRequest.getLocalPort() == trustedPortNum) { | ||
| log.warn("denying request for untrusted endpoint on trusted port"); | ||
| if (servletResponse instanceof HttpServletResponseWrapper httpServletResponse) { | ||
| httpServletResponse.setStatus(HttpServletResponse.SC_NOT_FOUND); | ||
| } | ||
| servletResponse.getOutputStream().close(); | ||
| return; | ||
| } | ||
| } | ||
|
|
||
| filterChain.doFilter(servletRequest, servletResponse); | ||
| } | ||
|
|
||
| private boolean isRequestForTrustedEndpoint(final ServletRequest servletRequest) { | ||
| log.warn(((HttpServletRequestWrapper) servletRequest).getRequestURI()); | ||
| return ((HttpServletRequestWrapper) servletRequest).getRequestURI() | ||
| .startsWith(ApplicationConfig.CONTEXT_PATH + ApplicationConfig.INTERNAL_ENDPOINT); | ||
| } | ||
| } |
122 changes: 122 additions & 0 deletions
122
...c/main/java/org/eclipse/tractusx/traceability/common/config/TrustedPortConfiguration.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| /******************************************************************************** | ||
| * Copyright (c) 2024 Contributors to the Eclipse Foundation | ||
| * | ||
| * See the NOTICE file(s) distributed with this work for additional | ||
| * information regarding copyright ownership. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Apache License, Version 2.0 which is available at | ||
| * https://www.apache.org/licenses/LICENSE-2.0. | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT | ||
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the | ||
| * License for the specific language governing permissions and limitations | ||
| * under the License. | ||
| * | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| ********************************************************************************/ | ||
| package org.eclipse.tractusx.traceability.common.config; | ||
|
|
||
| import org.apache.catalina.connector.Connector; | ||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.boot.autoconfigure.web.ServerProperties; | ||
| import org.springframework.boot.autoconfigure.web.servlet.TomcatServletWebServerFactoryCustomizer; | ||
| import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory; | ||
| import org.springframework.boot.web.server.WebServerFactoryCustomizer; | ||
| import org.springframework.boot.web.servlet.FilterRegistrationBean; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.context.annotation.Profile; | ||
|
|
||
| import java.util.Arrays; | ||
| import java.util.HashSet; | ||
| import java.util.Set; | ||
|
|
||
| import static org.eclipse.tractusx.traceability.common.config.ApplicationProfiles.NOT_INTEGRATION_TESTS; | ||
|
|
||
| /** | ||
| * Configures the trusted port | ||
| */ | ||
| @Profile(NOT_INTEGRATION_TESTS) | ||
| @Configuration | ||
| public class TrustedPortConfiguration { | ||
| private final String serverPort; | ||
|
|
||
| private final String managementPort; | ||
|
|
||
| private final String trustedPort; | ||
|
|
||
| public TrustedPortConfiguration(@Value("${server.port:8080}") final String serverPort, | ||
| @Value("${management.server.port:${server.port:8080}}") final String managementPort, | ||
| @Value("${server.trustedPort}") final String trustedPort) { | ||
|
|
||
| this.serverPort = serverPort; | ||
| this.managementPort = managementPort; | ||
| this.trustedPort = trustedPort; | ||
| } | ||
|
|
||
| @Bean | ||
| public WebServerFactoryCustomizer<TomcatServletWebServerFactory> servletContainer() { | ||
|
|
||
| final Connector[] additionalConnectors = this.additionalConnector(); | ||
|
|
||
| final ServerProperties serverProperties = new ServerProperties(); | ||
| serverProperties.getServlet().setContextPath(ApplicationConfig.CONTEXT_PATH); | ||
| return new TomcatMultiConnectorServletWebServerFactoryCustomizer(serverProperties, additionalConnectors); | ||
| } | ||
|
|
||
| private Connector[] additionalConnector() { | ||
|
|
||
| if (StringUtils.isEmpty(this.trustedPort)) { | ||
| return new Connector[0]; | ||
| } | ||
|
|
||
| final Set<String> defaultPorts = new HashSet<>(); | ||
| defaultPorts.add(serverPort); | ||
| defaultPorts.add(managementPort); | ||
|
|
||
| if (defaultPorts.contains(trustedPort)) { | ||
| return new Connector[0]; | ||
| } else { | ||
| final Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol"); | ||
| connector.setScheme("http"); | ||
| try { | ||
| connector.setPort(Integer.parseInt(trustedPort)); | ||
| } catch (final NumberFormatException e) { | ||
| connector.setPort(0); | ||
| } | ||
| return new Connector[] { connector }; | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Customizer for additional connectors | ||
| */ | ||
| private static class TomcatMultiConnectorServletWebServerFactoryCustomizer | ||
| extends TomcatServletWebServerFactoryCustomizer { | ||
| private final Connector[] additionalConnectors; | ||
|
|
||
| /* package */ TomcatMultiConnectorServletWebServerFactoryCustomizer(final ServerProperties serverProperties, | ||
| final Connector... additionalConnectors) { | ||
| super(serverProperties); | ||
| serverProperties.getServlet().setContextPath(ApplicationConfig.CONTEXT_PATH); | ||
| this.additionalConnectors = Arrays.copyOf(additionalConnectors, additionalConnectors.length); | ||
| } | ||
|
|
||
| @Override | ||
| public void customize(final TomcatServletWebServerFactory factory) { | ||
| super.customize(factory); | ||
|
|
||
| if (additionalConnectors != null && additionalConnectors.length > 0) { | ||
| factory.addAdditionalTomcatConnectors(additionalConnectors); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| @Bean | ||
| public FilterRegistrationBean<TrustedEndpointsFilter> trustedEndpointsFilter() { | ||
| return new FilterRegistrationBean<>(new TrustedEndpointsFilter(trustedPort)); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -81,6 +81,7 @@ irs-edc-client: | |
|
|
||
|
|
||
| server: | ||
| trustedPort: ${TRUSTED_PORT} | ||
| servlet: | ||
| context-path: /api | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.