Add method to build SSL Handler for selected keys only

JIRA: NETCONF-5
Signed-off-by: Oleksii Mozghovyi <oleksii.mozghovyi@pantheon.tech>
Change-Id: I780949db6c425ac0fd682838e87f3893065434e6

diff --git a/netconf/netconf-client/src/main/java/org/opendaylight/netconf/client/SslHandlerFactory.java b/netconf/netconf-client/src/main/java/org/opendaylight/netconf/client/SslHandlerFactory.java
index 7fadf38e471ee758d8a04a4bf04be9bca8d16401..3a8a87de06c935f776a0531a584fe301bbdff625 100644 (file)
--- a/netconf/netconf-client/src/main/java/org/opendaylight/netconf/client/SslHandlerFactory.java
+++ b/netconf/netconf-client/src/main/java/org/opendaylight/netconf/client/SslHandlerFactory.java
@@ -8,6 +8,7 @@
 package org.opendaylight.netconf.client;
 
 import io.netty.handler.ssl.SslHandler;
+import java.util.Set;
 
 public interface SslHandlerFactory {
     /**
@@ -15,4 +16,6 @@ public interface SslHandlerFactory {
      * into the channel pipeline when the channel is active.
      */
     SslHandler createSslHandler();
+
+    SslHandler createSslHandler(Set<String> allowedKeys);
 }

diff --git a/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/netconf/sal/NetconfKeystoreAdapter.java b/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/netconf/sal/NetconfKeystoreAdapter.java
index 5adb6498c8e439812430d08bda25a7d02f962ef4..58d072a62b30f76d33f818978403bf4ada8445ea 100644 (file)
--- a/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/netconf/sal/NetconfKeystoreAdapter.java
+++ b/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/netconf/sal/NetconfKeystoreAdapter.java
@@ -7,6 +7,7 @@
  */
 package org.opendaylight.netconf.sal.connect.netconf.sal;
 
+import com.google.common.base.Preconditions;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
@@ -26,6 +27,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 import org.opendaylight.mdsal.binding.api.ClusteredDataTreeChangeListener;
 import org.opendaylight.mdsal.binding.api.DataBroker;
 import org.opendaylight.mdsal.binding.api.DataObjectModification;
@@ -74,6 +76,24 @@ public class NetconfKeystoreAdapter implements ClusteredDataTreeChangeListener<K
      * @throws IOException If there is an I/O problem with the keystore data
      */
     public java.security.KeyStore getJavaKeyStore() throws GeneralSecurityException, IOException {
+        return getJavaKeyStore(Collections.emptySet());
+    }
+
+    /**
+     * Using private keys and trusted certificates to create a new JDK <code>KeyStore</code> which
+     * will be used by TLS clients to create <code>SSLEngine</code>. The private keys are essential
+     * to create JDK <code>KeyStore</code> while the trusted certificates are optional.
+     *
+     * @param allowedKeys Set of keys to include during KeyStore generation, empty set will creatr
+     *                   a KeyStore with all possible keys.
+     * @return A JDK KeyStore object
+     * @throws GeneralSecurityException If any security exception occurred
+     * @throws IOException If there is an I/O problem with the keystore data
+     */
+    public java.security.KeyStore getJavaKeyStore(Set<String> allowedKeys) throws GeneralSecurityException,
+        IOException {
+        Preconditions.checkNotNull(allowedKeys);
+
         final java.security.KeyStore keyStore = java.security.KeyStore.getInstance("JKS");
 
         keyStore.load(null, null);
@@ -84,6 +104,9 @@ public class NetconfKeystoreAdapter implements ClusteredDataTreeChangeListener<K
             }
 
             for (Map.Entry<String, PrivateKey> entry : privateKeys.entrySet()) {
+                if (!allowedKeys.isEmpty() && !allowedKeys.contains(entry.getKey())) {
+                    continue;
+                }
                 final java.security.PrivateKey key = getJavaPrivateKey(entry.getValue().getData());
 
                 final List<X509Certificate> certificateChain =

diff --git a/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/util/SslHandlerFactoryImpl.java b/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/util/SslHandlerFactoryImpl.java
index fa2e4b085f5cddcdbe7f409c067211c70d7302e7..5e8453373978cb2702de41e7b72aa46a31c4aaeb 100644 (file)
--- a/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/util/SslHandlerFactoryImpl.java
+++ b/netconf/sal-netconf-connector/src/main/java/org/opendaylight/netconf/sal/connect/util/SslHandlerFactoryImpl.java
@@ -15,6 +15,7 @@ import io.netty.handler.ssl.SslHandler;
 import java.io.IOException;
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
+import java.util.Collections;
 import java.util.Set;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
@@ -30,6 +31,10 @@ public final class SslHandlerFactoryImpl implements SslHandlerFactory {
     private final NetconfKeystoreAdapter keystoreAdapter;
     private final @Nullable Specification specification;
 
+    public SslHandlerFactoryImpl(final NetconfKeystoreAdapter keystoreAdapter) {
+        this(keystoreAdapter, null);
+    }
+
     public SslHandlerFactoryImpl(final NetconfKeystoreAdapter keystoreAdapter, final Specification specification) {
         this.keystoreAdapter = requireNonNull(keystoreAdapter);
         this.specification = specification;
@@ -37,8 +42,13 @@ public final class SslHandlerFactoryImpl implements SslHandlerFactory {
 
     @Override
     public SslHandler createSslHandler() {
+        return createSslHandler(Collections.emptySet());
+    }
+
+    @Override
+    public SslHandler createSslHandler(Set<String> allowedKeys) {
         try {
-            final KeyStore keyStore = keystoreAdapter.getJavaKeyStore();
+            final KeyStore keyStore = keystoreAdapter.getJavaKeyStore(allowedKeys);
 
             final KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
             kmf.init(keyStore, "".toCharArray());