embulk-executor-remoteserver 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f28395ebbd29d2028501114573e227c225fd8b6c
-  data.tar.gz: ab865e0e32d2c4d4b56057497278ab61ee1d64be
+  metadata.gz: 06471b084ea22f52ecc00bfdfe47b86f87eeb69f
+  data.tar.gz: 729aa405aca16d6f929ed8fe7a5f74dd4ceedeac
 SHA512:
-  metadata.gz: 7de676f12a5aab6ff29d4b43c191b06637f40901037e21bf05a9c98432bff45766e67626d6d6d7cb097d7f065a92e3fe4924b2abaa22fc497d7b530f60a43112
-  data.tar.gz: 7dc8342789e19402d7a1d61f25bb7525aaed2525496eb93d482f42b078e25ba2ce387c78e35785788c0a89898c3ce99d074692fa99fd5f000f04372a3d10dc3f
+  metadata.gz: 1aa9cc6537396d1ccf54c21329743332cbaed54d76b57ccfeccdb2ba2426d944c1dcf04e39b61f19aabdfc4c57b4e7e4600068d3201ed04cc73902730c274aef
+  data.tar.gz: 50e4cff41b9e5726e5ac07f5ae57ba14a3e04088659c370eb2c6145d3203b13f1fde454ac85cd18237ac5c6d809006e27717eebaca9612b7e4635e31a7a0619f

data/README.md

@@ -15,12 +15,10 @@ Embulk executor plugin to run Embulk tasks on remote servers.
 - **hosts**: List of remote servers (`hostname` or `hostname:port`, default port is `30001`). If not specified, the executor runs as the local mode, which starts an Embulk server on its own process (array of string)
 - **timeout_seconds**: Timeout seconds of the whole execution (integer, default: `3600`)
 - **use_tls**: Enable to connect server over TLS (boolean, default: `false`)
-- **cert_p12_file**: Information of a P12 file used as your client certificate. It would be needed when client authentication is enabled on Embulk server.
-  - **path**: Path of the file (string, required)
-  - **password**: Password of the file (string, required)
-- **ca_p12_file**: Information of a P12 file used as CA certificate. It would be needed when Embulk server uses a certificate in which unknown CA signed.
+- **cert_p12_file**: Information of a PKCS12 file used as your client certificate. It would be needed when client authentication is enabled on Embulk server.
   - **path**: Path of the file (string, required)
   - **password**: Password of the file (string, required)
+- **ca_cert_path**: Path of a CA certificate file. It would be needed when Embulk server uses a certificate signed by an unknown CA.
 
 ## Example
 
@@ -51,8 +49,8 @@ There are some environment variables to configure the server
 - `PORT`: Port number to listen (default: `30001`)
 - `USE_TLS`: Try to connect to client via TLS if `true` (default: `false`)
 - `REQUIRE_TLS_CLIENT_AUTH`: Require client authentication if `true` (default: `false`) 
-- `CERT_P12_PATH`, `CERT_P12_PASSWORD`: Path and password of the P12 file for server certificate. Ignored unless both is set.
-- `CA_P12_PATH`, `CA_P12_PASSWORD`: Path and password of the P12 file for CA certificate. Ignored unless both is set.
+- `CERT_P12_PATH`, `CERT_P12_PASSWORD`: Path and password of the PKCS12 file for server certificate. Ignored unless both is set.
+- `CA_CERT_PATH`: Path of the CA certificate file. It would be needed when client authentication is enabled and client certificate is signed by an unknown CA.
 
 ## Build
 

data/gradle.properties

@@ -1 +1 @@
-version=0.3.2
+version=0.4.0

data/src/main/java/org/embulk/executor/remoteserver/Launcher.java

@@ -28,18 +28,15 @@ public class Launcher {
         String keyP12Path = envVars.get("CERT_P12_PATH");
         String keyP12Password = envVars.get("CERT_P12_PASSWORD");
         if (keyP12Path != null && keyP12Password != null) {
-            tlsConfig.keyStore(new P12File(keyP12Path, keyP12Password));
+            tlsConfig.setKeyStore(new P12File(keyP12Path, keyP12Password));
         }
 
-        String trustP12Path = envVars.get("CA_P12_PATH");
-        String trustP12Password = envVars.get("CA_P12_PASSWORD");
-        if (trustP12Path != null && trustP12Password != null) {
-            tlsConfig.trustStore(new P12File(trustP12Path, trustP12Password));
+        String caCertPath = envVars.get("CA_CERT_PATH");
+        if (caCertPath != null) {
+            tlsConfig.setCaCertPath(caCertPath);
         }
 
-        if ("true".equals(envVars.get("REQUIRE_TLS_CLIENT_AUTH"))) {
-            tlsConfig.enableClientAuth(true);
-        }
+        tlsConfig.setEnableClientAuth("true".equals(envVars.get("REQUIRE_TLS_CLIENT_AUTH")));
         return tlsConfig;
     }
 

data/src/main/java/org/embulk/executor/remoteserver/RemoteServerExecutor.java

@@ -51,9 +51,9 @@ public class RemoteServerExecutor implements ExecutorPlugin {
         @ConfigDefault("null")
         Optional<P12File> getCertP12File();
 
-        @Config("ca_p12_file")
+        @Config("ca_cert_path")
         @ConfigDefault("null")
-        Optional<P12File> getCaP12File();
+        Optional<String> getCaCertPath();
 
         @ConfigInject
         ModelManager getModelManager();
@@ -63,9 +63,9 @@ public class RemoteServerExecutor implements ExecutorPlugin {
         @ConfigDefault("null")
         Optional<P12File> getServerCertP12File();
 
-        @Config("__server_ca_p12_file")
+        @Config("__server_ca_cert_path")
         @ConfigDefault("null")
-        Optional<P12File> getServerCaP12File();
+        Optional<String> getServerCaCertPath();
 
         @Config("__server_require_tls_client_auth")
         @ConfigDefault("false")
@@ -133,8 +133,8 @@ public class RemoteServerExecutor implements ExecutorPlugin {
             TLSConfig tlsConfig = null;
             if (pluginTask.getUseTls()) {
                 tlsConfig = new TLSConfig();
-                pluginTask.getCertP12File().ifPresent(tlsConfig::keyStore);
-                pluginTask.getCaP12File().ifPresent(tlsConfig::trustStore);
+                pluginTask.getCertP12File().ifPresent(tlsConfig::setKeyStore);
+                pluginTask.getCaCertPath().ifPresent(tlsConfig::setCaCertPath);
             }
 
             try (EmbulkClient client = EmbulkClient.open(session, hosts, tlsConfig)) {
@@ -171,11 +171,9 @@ public class RemoteServerExecutor implements ExecutorPlugin {
         TLSConfig tlsConfig = null;
         if (task.getUseTls()) {
             tlsConfig = new TLSConfig();
-            task.getServerCertP12File().ifPresent(tlsConfig::keyStore);
-            task.getServerCaP12File().ifPresent(tlsConfig::trustStore);
-            if (task.getServerRequireTlsClientAuth()) {
-                tlsConfig.enableClientAuth(true);
-            }
+            task.getServerCertP12File().ifPresent(tlsConfig::setKeyStore);
+            task.getServerCaCertPath().ifPresent(tlsConfig::setCaCertPath);
+            tlsConfig.setEnableClientAuth(task.getServerRequireTlsClientAuth());
         }
         return EmbulkServer.start(DEFAULT_HOST.getName(), DEFAULT_HOST.getPort(), 1, tlsConfig);
     }

data/src/main/java/org/embulk/executor/remoteserver/TLSConfig.java

@@ -8,43 +8,41 @@ import javax.net.ssl.TrustManagerFactory;
 import java.io.FileInputStream;
 import java.io.InputStream;
 import java.security.KeyStore;
+import java.security.cert.CertificateFactory;
 
 class TLSConfig {
     private P12File keyStore = null;
-    private P12File trustStore = null;
+    private String caCertPath = null;
     private boolean enableClientAuth = false;
 
     TLSConfig() {
     }
 
-    TLSConfig keyStore(P12File keyStore) {
+    void setKeyStore(P12File keyStore) {
         this.keyStore = keyStore;
-        return this;
     }
 
-    TLSConfig trustStore(P12File trustStore) {
-        this.trustStore = trustStore;
-        return this;
+    void setEnableClientAuth(boolean enableClientAuth) {
+        this.enableClientAuth = enableClientAuth;
     }
 
-    TLSConfig enableClientAuth(boolean enableClientAuth) {
-        this.enableClientAuth = enableClientAuth;
-        return this;
+    void setCaCertPath(String caCertPath) {
+        this.caCertPath = caCertPath;
     }
 
     SSLContext getSSLContext() {
         try {
             KeyManager[] keyManagers = null;
             if (keyStore != null) {
-                KeyStore ks = load(keyStore);
+                KeyStore ks = loadKeyStore(keyStore);
                 KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                 kmf.init(ks, keyStore.getPassword().toCharArray());
                 keyManagers = kmf.getKeyManagers();
             }
 
             TrustManager[] trustManagers = null;
-            if (trustStore != null) {
-                KeyStore ts = load(trustStore);
+            if (caCertPath != null) {
+                KeyStore ts = loadTrustStore(caCertPath);
                 TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                 tmf.init(ts);
                 trustManagers = tmf.getTrustManagers();
@@ -62,7 +60,7 @@ class TLSConfig {
         return enableClientAuth;
     }
 
-    private static KeyStore load(P12File file) {
+    private static KeyStore loadKeyStore(P12File file) {
         try (InputStream keyStoreIS = new FileInputStream(file.getPath())) {
             KeyStore ks = KeyStore.getInstance("PKCS12");
             ks.load(keyStoreIS, file.getPassword().toCharArray());
@@ -71,4 +69,14 @@ class TLSConfig {
             throw new RuntimeException(e);
         }
     }
+
+    private static KeyStore loadTrustStore(String path) throws Exception {
+        try (FileInputStream inputStream = new FileInputStream(path)) {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            KeyStore ks = KeyStore.getInstance("JKS");
+            ks.load(null, null);
+            ks.setCertificateEntry("ca_cert", cf.generateCertificate(inputStream));
+            return ks;
+        }
+    }
 }

data/src/test/resources/config/exec_tls.yml

@@ -7,7 +7,4 @@ use_tls: true
 cert_p12_file:
   path: tmp/certs/client.p12
   password: fghij
-ca_p12_file:
-  path: tmp/certs/ca-chain.p12
-  password: p@ssw0rd
-
+ca_cert_path: tmp/certs/ca-chain.cert.pem

data/test/docker-compose.yml

@@ -24,8 +24,7 @@ services:
       REQUIRE_TLS_CLIENT_AUTH: "true"
       CERT_P12_PATH: /certs/embulk-server.local.p12
       CERT_P12_PASSWORD: abcde
-      CA_P12_PATH: /certs/ca-chain.p12
-      CA_P12_PASSWORD: p@ssw0rd
+      CA_CERT_PATH: /certs/ca-chain.cert.pem
     ports:
         - "30003:30001"
     volumes:

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: embulk-executor-remoteserver
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Shinichi Ishimura
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-04-25 00:00:00.000000000 Z
+date: 2019-04-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -51,7 +51,7 @@ files:
 - LICENSE
 - README.md
 - build.gradle
-- classpath/embulk-executor-remoteserver-0.3.2.jar
+- classpath/embulk-executor-remoteserver-0.4.0.jar
 - classpath/msgpack-core-0.8.16.jar
 - classpath/nsocket-0.3.4.jar
 - classpath/slf4j-api-1.7.26.jar