modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheServerComponent.java
| 7 -
modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheVirtualHostServiceComponent.java
| 4
modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java
| 66 +++++++++-
modules/plugins/apache/src/main/resources/META-INF/rhq-plugin.xml
| 16 ++
4 files changed, 84 insertions(+), 9 deletions(-)
New commits:
commit f541d7383773529cc12d30faf9f154c9b5bae1fc
Author: John Sanda <jsanda(a)redhat.com>
Date: Thu Apr 7 10:05:47 2011 -0400
[BZ 690430] Adding support for disabling SSL cert verification
Adding the ability to disable certification validation for availability
checks. This may be useful when working with self-signed certs in a dev
or testing environment.
diff --git
a/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheServerComponent.java
b/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheServerComponent.java
index b320028..369c18f 100644
---
a/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheServerComponent.java
+++
b/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheServerComponent.java
@@ -44,6 +44,7 @@ import org.rhq.augeas.tree.AugeasTree;
import org.rhq.augeas.util.Glob;
import org.rhq.core.domain.configuration.Configuration;
import org.rhq.core.domain.configuration.ConfigurationUpdateStatus;
+import org.rhq.core.domain.configuration.PluginConfigurationUpdate;
import org.rhq.core.domain.configuration.PropertySimple;
import org.rhq.core.domain.configuration.definition.ConfigurationDefinition;
import org.rhq.core.domain.event.EventSeverity;
@@ -232,10 +233,12 @@ public class ApacheServerComponent implements
AugeasRHQComponent<PlatformCompone
// try to find a pid file under the server root, and then check if the
// process is running.
boolean available;
+ Configuration pluginConfig = resourceContext.getPluginConfiguration();
+ PropertySimple disableCertValidation =
pluginConfig.getSimple("disableCertificateValidation");
try {
if (this.url != null) {
long t1 = System.currentTimeMillis();
- available = WWWUtils.isAvailable(this.url);
+ available = WWWUtils.isAvailable(this.url,
disableCertValidation.getBooleanValue());
availPingTime = System.currentTimeMillis() - t1;
} else {
available = getSNMPSession().ping();
@@ -923,4 +926,4 @@ public class ApacheServerComponent implements
AugeasRHQComponent<PlatformCompone
return false;
}
}
-}
\ No newline at end of file
+}
diff --git
a/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheVirtualHostServiceComponent.java
b/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheVirtualHostServiceComponent.java
index c894fa9..d470b03 100644
---
a/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheVirtualHostServiceComponent.java
+++
b/modules/plugins/apache/src/main/java/org/rhq/plugins/apache/ApacheVirtualHostServiceComponent.java
@@ -133,7 +133,9 @@ public class ApacheVirtualHostServiceComponent implements
ResourceComponent<Apac
}
public AvailabilityType getAvailability() {
- return (this.url != null && WWWUtils.isAvailable(this.url)) ?
AvailabilityType.UP : AvailabilityType.DOWN;
+ Configuration pluginConfig = resourceContext.getPluginConfiguration();
+ PropertySimple disableCertValidation =
pluginConfig.getSimple("disableCertificateValidation");
+ return (this.url != null && WWWUtils.isAvailable(this.url,
disableCertValidation.getBooleanValue())) ? AvailabilityType.UP : AvailabilityType.DOWN;
}
public Configuration loadResourceConfiguration() throws Exception {
diff --git a/modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java
b/modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java
index 8e9f709..c1ff6eb 100644
--- a/modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java
+++ b/modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java
@@ -21,6 +21,19 @@ package org.rhq.plugins.www.util;
import java.io.IOException;
import java.net.HttpURLConnection;
import java.net.URL;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.X509Certificate;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
/**
* Helper class that contains methods that send http requests and evaluate results
@@ -28,16 +41,24 @@ import java.net.URL;
*/
public abstract class WWWUtils {
- /**
- * Sends a HEAD request to the passed url and returns if the server was reachable
- * @param httpURL a http or https URL to check
- * @return true if connecting to the URL succeeds, or false otherwise
- */
- public static boolean isAvailable(URL httpURL) {
+ private static final Log log = LogFactory.getLog(WWWUtils.class);
+
+ /**
+ * Sends a HEAD request to the passed url and returns if the server was
reachable
+ * @param httpURL a http or https URL to check
+ * @return true if connecting to the URL succeeds, or false otherwise
+ */
+
+ public static boolean isAvailable(URL httpURL, boolean disableCertValidation) {
try {
HttpURLConnection connection = (HttpURLConnection) httpURL.openConnection();
connection.setRequestMethod("HEAD");
connection.setConnectTimeout(3000);
+
+ if ((connection instanceof HttpsURLConnection) &&
disableCertValidation) {
+ disableCertificateVerification((HttpsURLConnection) connection);
+ }
+
connection.connect();
// get the respone code to actually trigger sending the Request.
connection.getResponseCode();
@@ -70,4 +91,37 @@ public abstract class WWWUtils {
}
return ret;
}
+
+ // This method has been added in support of
https://bugzilla.redhat.com/show_bug.cgi?id=690430.
+ private static void disableCertificateVerification(HttpsURLConnection connection) {
+ TrustManager[] trustAllCerts = new TrustManager[]{
+ new X509TrustManager() {
+ public X509Certificate[] getAcceptedIssuers() {
+ return new X509Certificate[] {};
+ }
+
+ public void checkClientTrusted(X509Certificate[] certs, String authType)
{
+ }
+
+ public void checkServerTrusted(X509Certificate[] certs, String authType)
{
+ }
+ }
+ };
+ try {
+ SSLContext sslContext = SSLContext.getInstance("SSL");
+ sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
+ connection.setSSLSocketFactory(sslContext.getSocketFactory());
+ connection.setHostnameVerifier(new HostnameVerifier() {
+ @Override
+ public boolean verify(String s, SSLSession sslSession) {
+ return true;
+ }
+ });
+ } catch (NoSuchAlgorithmException e) {
+ log.warn("Failed to disable certificate validation.", e);
+ } catch (KeyManagementException e) {
+ log.warn("Failed to disable certificate validation.", e);
+ }
+ }
+
}
\ No newline at end of file
diff --git a/modules/plugins/apache/src/main/resources/META-INF/rhq-plugin.xml
b/modules/plugins/apache/src/main/resources/META-INF/rhq-plugin.xml
index b3f5aa3..adb7f73 100644
--- a/modules/plugins/apache/src/main/resources/META-INF/rhq-plugin.xml
+++ b/modules/plugins/apache/src/main/resources/META-INF/rhq-plugin.xml
@@ -280,6 +280,14 @@
description="the UDP port of the Apache SNMP agent
(typically '1610')"/>
<c:simple-property name="snmpAgentCommunity" displayName="SNMP
Agent Community" default="public"
description="the SNMP community of the Apache SNMP agent
(typically 'public')"/>
+ <c:simple-property name="disableCertificateValidation"
type="boolean" default="false"
+ description="If you use HTTPS URLs for availability
checks and the certificates aren't
+ trusted by the JVM that runs the agent or the
certificates aren't issued for the
+ hostname that you use for the availability checks, you
can use this property to switch
+ off the certificate validation. Note that this opens up a
possilibity of
+ man-in-the-middle attacks and other SSL related security
issues. The agent will switch
+ off the validation only for the duration of the request
to the configured URL and will
+ contact no other URL than the one configured."/>
<c:simple-property name="restartAfterConfigurationUpdate"
type="boolean" default="true" required="true">
<c:description>
@@ -492,6 +500,14 @@
<plugin-configuration>
<c:simple-property name="url" displayName="URL"
description="the http or https URL that will be used
to check availability for this virtual host"/>
+ <c:simple-property name="disableCertificateValidation"
type="boolean" default="false"
+ description="If you use HTTPS URLs for availability
checks and the certificates aren't
+ trusted by the JVM that runs the agent or the
certificates aren't issued for the
+ hostname that you use for the availability checks, you
can use this property to switch
+ off the certificate validation. Note that this opens up a
possilibity of
+ man-in-the-middle attacks and other SSL related security
issues. The agent will switch
+ off the validation only for the duration of the request
to the configured URL and will
+ contact no other URL than the one configured."/>
<c:group name="ResponseTime">
<c:simple-property name="responseTimeLogFile"
required="false"
description="the full path to the log file
containing response-time stats for this virtual host"/>