Re-enabled TLS netty
created netty specific feature separate from third-party-base
refactored boot features to ensure proper boot sequence for netty, sshd, and core-net
moved http codec to netty feature
Change-Id: Ie6e0ce14fba71603086b7cfe62e1c90a77fd18f2
Co-authored-by: Ray Milkey <ray@opennetworking.org>
diff --git a/core/store/dist/BUILD b/core/store/dist/BUILD
index e3e702c..fb42f8d 100644
--- a/core/store/dist/BUILD
+++ b/core/store/dist/BUILD
@@ -3,10 +3,10 @@
"//utils/rest:onlab-rest",
"//core/store/serializers:onos-core-serializers",
"@io_netty_netty_transport//jar",
- "@io_netty_netty_codec//jar",
- "@io_netty_netty_handler//jar",
"@io_netty_netty_transport_native_epoll//jar",
"@io_netty_netty_transport_native_unix_common//jar",
+ "@io_netty_netty_codec//jar",
+ "@io_netty_netty_handler//jar",
"@io_netty_netty_resolver//jar",
"@commons_math3//jar",
]
diff --git a/lib/deps.json b/lib/deps.json
index f21cca0..cc17968 100644
--- a/lib/deps.json
+++ b/lib/deps.json
@@ -251,6 +251,7 @@
"io_netty_netty_common": "mvn:io.netty:netty-common:4.1.27.Final",
"io_netty_netty_handler": "mvn:io.netty:netty-handler:4.1.27.Final",
"io_netty_netty_handler_proxy": "mvn:io.netty:netty-handler-proxy:4.1.27.Final",
+ "io_netty_netty_tcnative_boringssl": "mvn:io.netty:netty-tcnative-boringssl-static:2.0.12.Final",
"io_netty_netty_transport": "mvn:io.netty:netty-transport:4.1.27.Final",
"io_netty_netty_transport_native_unix_common": "mvn:io.netty:netty-transport-native-unix-common:4.1.27.Final",
"io_netty_netty_transport-native-epoll": "mvn:io.netty:netty-transport-native-epoll:4.1.27.Final",
diff --git a/protocols/grpc/BUILD b/protocols/grpc/BUILD
index 26e178c..a3f3f46 100644
--- a/protocols/grpc/BUILD
+++ b/protocols/grpc/BUILD
@@ -18,18 +18,6 @@
"@io_opencensus_opencensus_api//jar",
"@io_opencensus_opencensus_contrib_grpc_metrics//jar",
"@com_google_code_gson_gson//jar",
- # Lazily adding all netty-related packages.
- # Some of them might not be necessary.
- "@io_netty_netty//jar",
- "@io_netty_netty_buffer//jar",
- "@io_netty_netty_codec//jar",
- "@io_netty_netty_codec_http//jar",
- "@io_netty_netty_codec_http2//jar",
- "@io_netty_netty_common//jar",
- "@io_netty_netty_handler//jar",
- "@io_netty_netty_transport//jar",
- "@io_netty_netty_transport_native_epoll//jar",
- "@io_netty_netty_resolver//jar",
]
onos_app(
diff --git a/protocols/grpc/ctl/BUILD b/protocols/grpc/ctl/BUILD
index ac0703d..475a90e 100644
--- a/protocols/grpc/ctl/BUILD
+++ b/protocols/grpc/ctl/BUILD
@@ -3,6 +3,7 @@
"//protocols/grpc/proto:onos-protocols-grpc-proto",
"@io_grpc_grpc_java//core",
"@io_grpc_grpc_java//netty",
+ "@io_netty_netty_handler//jar",
]
osgi_jar(
diff --git a/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java b/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
index 375ff32..db29284 100644
--- a/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
+++ b/protocols/grpc/ctl/src/main/java/org/onosproject/grpc/ctl/AbstractGrpcClientController.java
@@ -19,8 +19,11 @@
import com.google.common.collect.Maps;
import com.google.common.util.concurrent.Striped;
import io.grpc.ManagedChannel;
-import io.grpc.ManagedChannelBuilder;
+import io.grpc.netty.GrpcSslContexts;
import io.grpc.netty.NettyChannelBuilder;
+import io.netty.handler.ssl.NotSslRecordException;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import org.onosproject.event.AbstractListenerManager;
import org.onosproject.event.Event;
import org.onosproject.event.EventListener;
@@ -36,12 +39,14 @@
import org.osgi.service.component.annotations.ReferenceCardinality;
import org.slf4j.Logger;
+import javax.net.ssl.SSLException;
import java.io.IOException;
import java.util.Map;
import java.util.concurrent.locks.Lock;
import java.util.function.Supplier;
import static com.google.common.base.Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkState;
import static org.slf4j.LoggerFactory.getLogger;
/**
@@ -91,10 +96,15 @@
@Override
public boolean createClient(K clientKey) {
checkNotNull(clientKey);
- return withDeviceLock(() -> doCreateClient(clientKey), clientKey.deviceId());
+ /*
+ FIXME we might want to move "useTls" and "fallback" to properties of the netcfg and clientKey
+ For now, we will first try to connect with TLS (accepting any cert), then fall back to
+ plaintext for every device
+ */
+ return withDeviceLock(() -> doCreateClient(clientKey, true, true), clientKey.deviceId());
}
- private boolean doCreateClient(K clientKey) {
+ private boolean doCreateClient(K clientKey, boolean useTls, boolean fallbackToPlainText) {
DeviceId deviceId = clientKey.deviceId();
String serverAddr = clientKey.serverAddr();
int serverPort = clientKey.serverPort();
@@ -112,20 +122,57 @@
doRemoveClient(deviceId);
}
}
- log.info("Creating client for {} (server={}:{})...",
- deviceId, serverAddr, serverPort);
+ log.info("Creating client for {} (server={}:{})...", deviceId, serverAddr, serverPort);
+
+ SslContext sslContext = null;
+ if (useTls) {
+ try {
+ // Accept any server certificate; this is insecure and should not be used in production
+ sslContext = GrpcSslContexts.forClient().trustManager(InsecureTrustManagerFactory.INSTANCE).build();
+ } catch (SSLException e) {
+ log.error("Failed to build SSL Context", e);
+ return false;
+ }
+ }
+
GrpcChannelId channelId = GrpcChannelId.of(clientKey.deviceId(), clientKey.toString());
- ManagedChannelBuilder channelBuilder = NettyChannelBuilder
+ NettyChannelBuilder channelBuilder = NettyChannelBuilder
.forAddress(serverAddr, serverPort)
- .maxInboundMessageSize(DEFAULT_MAX_INBOUND_MSG_SIZE * MEGABYTES)
- .usePlaintext();
+ .maxInboundMessageSize(DEFAULT_MAX_INBOUND_MSG_SIZE * MEGABYTES);
+ if (sslContext != null) {
+ log.debug("Using SSL for gRPC connection to {}", deviceId);
+ channelBuilder
+ .sslContext(sslContext)
+ .useTransportSecurity();
+ } else {
+ checkState(!useTls,
+ "Not authorized to use plaintext for gRPC connection to {}", deviceId);
+ log.debug("Using plaintext TCP for gRPC connection to {}", deviceId);
+ channelBuilder.usePlaintext();
+ }
ManagedChannel channel;
try {
channel = grpcChannelController.connectChannel(channelId, channelBuilder);
} catch (IOException e) {
- log.warn("Unable to connect to gRPC server of {}: {}",
- clientKey.deviceId(), e.getMessage());
+ for (Throwable cause = e; cause != null; cause = cause.getCause()) {
+ if (useTls && cause instanceof NotSslRecordException) {
+ // Likely root cause is that server is using plaintext
+ log.info("Failed to connect to server (device={}) using TLS", deviceId);
+ log.debug("TLS connection exception", e);
+ if (fallbackToPlainText) {
+ log.info("Falling back to plaintext for connection to {}", deviceId);
+ return doCreateClient(clientKey, false, false);
+ }
+ }
+ if (!useTls && "Connection reset by peer".equals(cause.getMessage())) {
+ // Not a great signal, but could indicate the server is expected a TLS connection
+ log.error("Failed to connect to server (device={}) using plaintext TCP; is the server using TLS?",
+ deviceId);
+ break;
+ }
+ }
+ log.warn("Unable to connect to gRPC server for {}", deviceId, e);
return false;
}
diff --git a/tools/build/bazel/generate_workspace.bzl b/tools/build/bazel/generate_workspace.bzl
index 494eedd..69c8326 100644
--- a/tools/build/bazel/generate_workspace.bzl
+++ b/tools/build/bazel/generate_workspace.bzl
@@ -1,4 +1,4 @@
-# ***** This file was auto-generated at Tue, 27 Nov 2018 23:06:01 GMT. Do not edit this file manually. *****
+# ***** This file was auto-generated at Fri, 14 Dec 2018 00:07:54 GMT. Do not edit this file manually. *****
# ***** Use onos-lib-gen *****
load("//tools/build/bazel:variables.bzl", "ONOS_GROUP_ID", "ONOS_VERSION")
@@ -771,6 +771,12 @@
jar_sha256 = "84b00dd1cd25a99b88bd598577825b4be9ad592e2d78b08bd703e7e999fe3498",
licenses = ["notice"],
jar_urls = ["http://repo1.maven.org/maven2/io/netty/netty-handler-proxy/4.1.27.Final/netty-handler-proxy-4.1.27.Final.jar"], )
+ if "io_netty_netty_tcnative_boringssl" not in native.existing_rules():
+ java_import_external(
+ name = "io_netty_netty_tcnative_boringssl",
+ jar_sha256 = "3df756e569504137e90ff368c2fe09f1f953efeddb717d47ed391dfa6ba8b7e3",
+ licenses = ["notice"],
+ jar_urls = ["http://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/2.0.12.Final/netty-tcnative-boringssl-static-2.0.12.Final.jar"], )
if "io_netty_netty_transport" not in native.existing_rules():
java_import_external(
name = "io_netty_netty_transport",
@@ -1519,6 +1525,7 @@
artifact_map["@io_netty_netty_common//:io_netty_netty_common"] = "mvn:io.netty:netty-common:jar:4.1.27.Final"
artifact_map["@io_netty_netty_handler//:io_netty_netty_handler"] = "mvn:io.netty:netty-handler:jar:4.1.27.Final"
artifact_map["@io_netty_netty_handler_proxy//:io_netty_netty_handler_proxy"] = "mvn:io.netty:netty-handler-proxy:jar:4.1.27.Final"
+artifact_map["@io_netty_netty_tcnative_boringssl//:io_netty_netty_tcnative_boringssl"] = "mvn:io.netty:netty-tcnative-boringssl-static:jar:2.0.12.Final"
artifact_map["@io_netty_netty_transport//:io_netty_netty_transport"] = "mvn:io.netty:netty-transport:jar:4.1.27.Final"
artifact_map["@io_netty_netty_transport_native_unix_common//:io_netty_netty_transport_native_unix_common"] = "mvn:io.netty:netty-transport-native-unix-common:jar:4.1.27.Final"
artifact_map["@io_netty_netty_transport_native_epoll//:io_netty_netty_transport_native_epoll"] = "mvn:io.netty:netty-transport-native-epoll:jar:4.1.27.Final"
diff --git a/tools/build/bazel/modules.bzl b/tools/build/bazel/modules.bzl
index 1872d2b..bead8f2 100644
--- a/tools/build/bazel/modules.bzl
+++ b/tools/build/bazel/modules.bzl
@@ -299,6 +299,7 @@
]
FEATURES = [
+ "//tools/package/features:onos-netty",
"//tools/package/features:onos-thirdparty-base",
"//tools/package/features:onos-thirdparty-web",
"//tools/package/features:onos-api",
diff --git a/tools/package/etc/org.apache.karaf.features.cfg b/tools/package/etc/org.apache.karaf.features.cfg
index 9a6061c..75112a8 100644
--- a/tools/package/etc/org.apache.karaf.features.cfg
+++ b/tools/package/etc/org.apache.karaf.features.cfg
@@ -30,34 +30,38 @@
#
# Comma separated list of features to install at startup
+# Groups of features within parens are brought up in parallel
+# Groups of features are brought up sequentially
+# Features without a paren group are assigned to an implicit paren group that ends when the next paren is found
#
featuresBoot = \
- instance/4.2.1, \
- package/4.2.1, \
- log/4.2.1, \
- ssh/4.2.1, \
- framework/4.2.1, \
- system/4.2.1, \
- eventadmin/4.2.1, \
- feature/4.2.1, \
- shell/4.2.1, \
- management/4.2.1, \
- service/4.2.1, \
- jaas/4.2.1, \
- deployer/4.2.1, \
- diagnostic/4.2.1, \
+ (instance/4.2.1, \
+ package/4.2.1, \
+ log/4.2.1, \
+ framework/4.2.1, \
+ system/4.2.1, \
+ eventadmin/4.2.1, \
+ feature/4.2.1, \
+ shell/4.2.1, \
+ management/4.2.1, \
+ service/4.2.1, \
+ jaas/4.2.1, \
+ deployer/4.2.1, \
+ diagnostic/4.2.1), \
(wrap/2.5.4), \
- bundle/4.2.1, \
- config/4.2.1, \
- kar/4.2.1, \
- webconsole/4.2.1, \
- scr/4.2.1, \
- war/4.2.1, \
- onos-api/$ONOS_VERSION, \
- onos-core/$ONOS_VERSION, \
- onos-cli/$ONOS_VERSION, \
- onos-rest/$ONOS_VERSION, \
- onos-gui/$ONOS_VERSION
+ (bundle/4.2.1, \
+ config/4.2.1, \
+ kar/4.2.1, \
+ webconsole/4.2.1, \
+ scr/4.2.1, \
+ war/4.2.1), \
+ (onos-netty/$ONOS_VERSION), \
+ (onos-api/$ONOS_VERSION, \
+ onos-core/$ONOS_VERSION, \
+ onos-cli/$ONOS_VERSION, \
+ ssh/4.2.1, \
+ onos-rest/$ONOS_VERSION, \
+ onos-gui/$ONOS_VERSION)
#
diff --git a/tools/package/features/BUILD b/tools/package/features/BUILD
index 7d31d25..a0c9186 100644
--- a/tools/package/features/BUILD
+++ b/tools/package/features/BUILD
@@ -8,6 +8,27 @@
)
osgi_feature(
+ name = "onos-netty",
+ description = "ONOS Netty dependencies",
+ included_bundles = [
+ "@io_netty_netty//jar",
+ "@io_netty_netty_common//jar",
+ "@io_netty_netty_buffer//jar",
+ "@io_netty_netty_handler//jar",
+ "@io_netty_netty_tcnative_boringssl//jar",
+ "@io_netty_netty_codec//jar",
+ "@io_netty_netty_codec_http//jar",
+ "@io_netty_netty_codec_http2//jar",
+ "@io_netty_netty_transport//jar",
+ "@io_netty_netty_transport_native_epoll//jar",
+ "@io_netty_netty_transport_native_unix_common//jar",
+ "@io_netty_netty_resolver//jar",
+ ],
+ required_features = [],
+ visibility = ["//visibility:public"],
+)
+
+osgi_feature(
name = "onos-thirdparty-base",
description = "ONOS 3rd party dependencies",
included_bundles = ATOMIX + [
@@ -17,15 +38,6 @@
"@commons_codec//jar",
"@commons_configuration//jar",
"@com_google_guava_guava//jar",
- "@io_netty_netty//jar",
- "@io_netty_netty_common//jar",
- "@io_netty_netty_buffer//jar",
- "@io_netty_netty_transport//jar",
- "@io_netty_netty_handler//jar",
- "@io_netty_netty_codec//jar",
- "@io_netty_netty_transport_native_epoll//jar",
- "@io_netty_netty_transport_native_unix_common//jar",
- "@io_netty_netty_resolver//jar",
"@commons_pool//jar",
"@commons_math3//jar",
"@joda_time//jar",
@@ -53,7 +65,7 @@
"@org_osgi_util_function//jar",
"@org_osgi_util_promise//jar",
],
- required_features = [],
+ required_features = ["onos-netty"],
visibility = ["//visibility:public"],
)