OVSDB-449 Fixes loading keystores dynamically per connection

Currently when OVSDB manager is started with SSL, the SSL Context is
only fetched once, which inherently means the keystores are only read
that one time.  This patch changes the behavior so that the SSL Context
is fetched everytime a new connection is opened, which in turn will
update the keystore data.

Change-Id: Iaafbd34afcb5f4708b48eb3d64eca14ef0a107e8
Signed-off-by: Tim Rozet <trozet@redhat.com>

diff --git a/library/impl/src/main/java/org/opendaylight/ovsdb/lib/OvsdbConnection.java b/library/impl/src/main/java/org/opendaylight/ovsdb/lib/OvsdbConnection.java
index 2ad61db9740a01ebd5066d79016341c57fc76140..517c499f53453fa9fec45da72998e6e16143029a 100644 (file)
--- a/library/impl/src/main/java/org/opendaylight/ovsdb/lib/OvsdbConnection.java
+++ b/library/impl/src/main/java/org/opendaylight/ovsdb/lib/OvsdbConnection.java
@@ -10,7 +10,7 @@ package org.opendaylight.ovsdb.lib;
 import io.netty.channel.Channel;
 import java.net.InetAddress;
 import java.util.Collection;
-import javax.net.ssl.SSLContext;
+import org.opendaylight.aaa.cert.api.ICertificateManager;
 
 /**
  * OvsDBConnection Interface provides OVSDB connection management APIs which includes
@@ -40,10 +40,10 @@ public interface OvsdbConnection {
      * connection from the controller towards ovsdb-server.
      * @param address IP Address of the remote server that hosts the ovsdb server.
      * @param port Layer 4 port on which the remote ovsdb server is listening on.
-     * @param sslContext Netty sslContext for channel configuration
+     * @param certificateManagerSrv Certificate manager for SSL/TLS
      * @return OvsDBClient The primary Client interface for the ovsdb connection.
      */
-    OvsdbClient connectWithSsl(InetAddress address, int port, SSLContext sslContext);
+    OvsdbClient connectWithSsl(InetAddress address, int port, ICertificateManager certificateManagerSrv);
 
     /**
      * Method to disconnect an existing connection.
@@ -60,16 +60,17 @@ public interface OvsdbConnection {
      * Method to start ovsdb server for passive connection with SSL.
      */
     boolean startOvsdbManagerWithSsl(int ovsdbListenPort,
-                                     SSLContext sslContext, String[] protocols, String[] cipherSuites);
+                                     ICertificateManager certificateManagerSrv,
+                                     String[] protocols, String[] cipherSuites);
 
     /**
      * Method to restart ovsdb server for passive connection with SSL and user
      * specifies protocols and cipher suites.
      */
     boolean restartOvsdbManagerWithSsl(int ovsdbListenPort,
-        SSLContext sslContext,
-        String[] protocols,
-        String[] cipherSuites);
+                                       ICertificateManager certificateManagerSrv,
+                                       String[] protocols,
+                                       String[] cipherSuites);
 
     /**
      * Method to register a Passive Connection Listener with the ConnectionService.

diff --git a/library/impl/src/main/java/org/opendaylight/ovsdb/lib/impl/OvsdbConnectionService.java b/library/impl/src/main/java/org/opendaylight/ovsdb/lib/impl/OvsdbConnectionService.java
index eb5f1fa7622b5de44007dc6e464ef481ea227802..9fb188422975b158a2b7b1855cc20ac12461f38b 100644 (file)
--- a/library/impl/src/main/java/org/opendaylight/ovsdb/lib/impl/OvsdbConnectionService.java
+++ b/library/impl/src/main/java/org/opendaylight/ovsdb/lib/impl/OvsdbConnectionService.java
@@ -131,7 +131,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
                 LOG.error("Certificate Manager service is not available cannot establish the SSL communication.");
                 return null;
             }
-            return connectWithSsl(address, port, certManagerSrv.getServerContext());
+            return connectWithSsl(address, port, certManagerSrv);
         } else {
             return connectWithSsl(address, port, null /* SslContext */);
         }
@@ -139,7 +139,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
 
     @Override
     public OvsdbClient connectWithSsl(final InetAddress address, final int port,
-                               final SSLContext sslContext) {
+                               final ICertificateManager certificateManagerSrv) {
         try {
             Bootstrap bootstrap = new Bootstrap();
             bootstrap.group(new NioEventLoopGroup());
@@ -150,6 +150,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
             bootstrap.handler(new ChannelInitializer<SocketChannel>() {
                 @Override
                 public void initChannel(SocketChannel channel) throws Exception {
+                    SSLContext sslContext = certificateManagerSrv.getServerContext();
                     if (sslContext != null) {
                         /* First add ssl handler if ssl context is given */
                         SSLEngine engine =
@@ -256,9 +257,11 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
      */
     @Override
     public synchronized boolean startOvsdbManagerWithSsl(final int ovsdbListenPort,
-                                     final SSLContext sslContext, String[] protocols, String[] cipherSuites) {
+                                                         final ICertificateManager certificateManagerSrv,
+                                                         String[] protocols, String[] cipherSuites) {
         if (!singletonCreated.getAndSet(true)) {
-            new Thread(() -> ovsdbManagerWithSsl(ovsdbListenPort, sslContext, protocols, cipherSuites)).start();
+            new Thread(() -> ovsdbManagerWithSsl(ovsdbListenPort,
+                    certificateManagerSrv, protocols, cipherSuites)).start();
             return true;
         } else {
             return false;
@@ -267,7 +270,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
 
     @Override
     public synchronized boolean restartOvsdbManagerWithSsl(final int ovsdbListenPort,
-        final SSLContext sslContext,
+        final ICertificateManager certificateManagerSrv,
         final String[] protocols,
         final String[] cipherSuites) {
         if (singletonCreated.getAndSet(false) && serverChannel != null) {
@@ -275,7 +278,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
             LOG.info("Server channel closed");
         }
         serverChannel = null;
-        return startOvsdbManagerWithSsl(ovsdbListenPort, sslContext, protocols, cipherSuites);
+        return startOvsdbManagerWithSsl(ovsdbListenPort, certificateManagerSrv, protocols, cipherSuites);
     }
 
     /**
@@ -290,7 +293,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
                 LOG.error("Certificate Manager service is not available cannot establish the SSL communication.");
                 return;
             }
-            ovsdbManagerWithSsl(port, certManagerSrv.getServerContext(), certManagerSrv.getTlsProtocols(),
+            ovsdbManagerWithSsl(port, certManagerSrv, certManagerSrv.getTlsProtocols(),
                     certManagerSrv.getCipherSuites());
         } else {
             ovsdbManagerWithSsl(port, null /* SslContext */, null, null);
@@ -301,8 +304,8 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
      * OVSDB Passive listening thread that uses Netty ServerBootstrap to open
      * passive connection with Ssl and handle channel callbacks.
      */
-    private static void ovsdbManagerWithSsl(int port, final SSLContext sslContext, final String[] protocols,
-            final String[] cipherSuites) {
+    private static void ovsdbManagerWithSsl(int port, final ICertificateManager certificateManagerSrv,
+                                            final String[] protocols, final String[] cipherSuites) {
         EventLoopGroup bossGroup = new NioEventLoopGroup();
         EventLoopGroup workerGroup = new NioEventLoopGroup();
         try {
@@ -315,6 +318,7 @@ public class OvsdbConnectionService implements AutoCloseable, OvsdbConnection {
                         @Override
                         public void initChannel(SocketChannel channel) throws Exception {
                             LOG.debug("New Passive channel created : {}", channel);
+                            SSLContext sslContext = certificateManagerSrv.getServerContext();
                             if (sslContext != null) {
                                 /* Add SSL handler first if SSL context is provided */
                                 SSLEngine engine = sslContext.createSSLEngine();