001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.junit.jupiter.api.Assertions.assertEquals;
021
022import java.io.ByteArrayOutputStream;
023import java.io.File;
024import java.io.IOException;
025import java.io.InputStream;
026import java.net.URI;
027import java.net.URL;
028import java.security.GeneralSecurityException;
029import javax.net.ssl.HttpsURLConnection;
030import org.apache.hadoop.conf.Configuration;
031import org.apache.hadoop.fs.FileUtil;
032import org.apache.hadoop.hbase.HBaseCommonTestingUtil;
033import org.apache.hadoop.hbase.HBaseConfiguration;
034import org.apache.hadoop.hbase.http.ssl.KeyStoreTestUtil;
035import org.apache.hadoop.hbase.testclassification.MediumTests;
036import org.apache.hadoop.hbase.testclassification.MiscTests;
037import org.apache.hadoop.io.IOUtils;
038import org.apache.hadoop.net.NetUtils;
039import org.apache.hadoop.security.ssl.SSLFactory;
040import org.junit.jupiter.api.AfterAll;
041import org.junit.jupiter.api.BeforeAll;
042import org.junit.jupiter.api.Tag;
043import org.junit.jupiter.api.Test;
044import org.slf4j.Logger;
045import org.slf4j.LoggerFactory;
046
047/**
048 * This testcase issues SSL certificates configures the HttpServer to serve HTTPS using the created
049 * certficates and calls an echo servlet using the corresponding HTTPS URL.
050 */
051@Tag(MiscTests.TAG)
052@Tag(MediumTests.TAG)
053public class TestSSLHttpServer extends HttpServerFunctionalTest {
054
055  private static final Logger LOG = LoggerFactory.getLogger(TestSSLHttpServer.class);
056  private static Configuration serverConf;
057  private static HttpServer server;
058  private static URL baseUrl;
059  private static File keystoresDir;
060  private static String sslConfDir;
061  private static SSLFactory clientSslFactory;
062  private static HBaseCommonTestingUtil HTU;
063
064  @BeforeAll
065  public static void setup() throws Exception {
066
067    HTU = new HBaseCommonTestingUtil();
068    serverConf = HTU.getConfiguration();
069
070    serverConf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
071    serverConf.setBoolean(ServerConfigurationKeys.HBASE_SSL_ENABLED_KEY, true);
072
073    keystoresDir = new File(HTU.getDataTestDir("keystore").toString());
074    keystoresDir.mkdirs();
075
076    sslConfDir = KeyStoreTestUtil.getClasspathDir(TestSSLHttpServer.class);
077
078    KeyStoreTestUtil.setupSSLConfig(keystoresDir.getAbsolutePath(), sslConfDir, serverConf, false);
079    Configuration clientConf = new Configuration(false);
080    clientConf.addResource(serverConf.get(SSLFactory.SSL_CLIENT_CONF_KEY));
081    serverConf.addResource(serverConf.get(SSLFactory.SSL_SERVER_CONF_KEY));
082    clientConf.set(SSLFactory.SSL_CLIENT_CONF_KEY, serverConf.get(SSLFactory.SSL_CLIENT_CONF_KEY));
083
084    clientSslFactory = new SSLFactory(SSLFactory.Mode.CLIENT, clientConf);
085    clientSslFactory.init();
086
087    server = new HttpServer.Builder().setName("test").addEndpoint(new URI("https://localhost"))
088      .setConf(serverConf)
089      .keyPassword(
090        HBaseConfiguration.getPassword(serverConf, "ssl.server.keystore.keypassword", null))
091      .keyStore(serverConf.get("ssl.server.keystore.location"),
092        HBaseConfiguration.getPassword(serverConf, "ssl.server.keystore.password", null),
093        clientConf.get("ssl.server.keystore.type", "jks"))
094      .trustStore(serverConf.get("ssl.server.truststore.location"),
095        HBaseConfiguration.getPassword(serverConf, "ssl.server.truststore.password", null),
096        serverConf.get("ssl.server.truststore.type", "jks"))
097      .build();
098    server.addUnprivilegedServlet("echo", "/echo", TestHttpServer.EchoServlet.class);
099    server.start();
100    baseUrl = new URL("https://" + NetUtils.getHostPortString(server.getConnectorAddress(0)));
101    LOG.info("HTTP server started: " + baseUrl);
102  }
103
104  @AfterAll
105  public static void cleanup() throws Exception {
106    server.stop();
107    FileUtil.fullyDelete(new File(HTU.getDataTestDir().toString()));
108    KeyStoreTestUtil.cleanupSSLConfig(serverConf);
109    clientSslFactory.destroy();
110  }
111
112  @Test
113  public void testEcho() throws Exception {
114    assertEquals("a:b\nc:d\n", readOut(new URL(baseUrl, "/echo?a=b&c=d")));
115    assertEquals("a:b\nc&lt;:d\ne:&gt;\n", readOut(new URL(baseUrl, "/echo?a=b&c<=d&e=>")));
116  }
117
118  @Test
119  public void testSecurityHeaders() throws IOException, GeneralSecurityException {
120    HttpsURLConnection conn = (HttpsURLConnection) baseUrl.openConnection();
121    conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
122    assertEquals(HttpsURLConnection.HTTP_OK, conn.getResponseCode());
123    assertEquals("max-age=63072000;includeSubDomains;preload",
124      conn.getHeaderField("Strict-Transport-Security"));
125    assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
126      conn.getHeaderField("Content-Security-Policy"));
127  }
128
129  private static String readOut(URL url) throws Exception {
130    HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
131    conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
132    InputStream in = conn.getInputStream();
133    ByteArrayOutputStream out = new ByteArrayOutputStream();
134    IOUtils.copyBytes(in, out, 1024);
135    return out.toString();
136  }
137
138}