Create secure connector for Client Certificate

whois-api/src/main/java/net/ripe/db/whois/api/httpserver/JettyBootstrap.java

@@ -2,7 +2,6 @@
 
 import io.netty.handler.ssl.util.TrustManagerFactoryWrapper;
 import jakarta.servlet.DispatcherType;
-import jakarta.ws.rs.HEAD;
 import net.ripe.db.whois.common.ApplicationService;
 import net.ripe.db.whois.common.aspects.RetryFor;
 import org.eclipse.jetty.alpn.server.ALPNServerConnectionFactory;
@@ -107,6 +106,10 @@ public class JettyBootstrap implements ApplicationService {
     private int port;
     private final int idleTimeout;
 
+    private int clientAuthPort;
+
+    private final boolean clientCertEnabled;
+
     @Autowired
     public JettyBootstrap(final RemoteAddressFilter remoteAddressFilter,
                           final ExtensionOverridesAcceptHeaderFilter extensionOverridesAcceptHeaderFilter,
@@ -119,8 +122,10 @@ public JettyBootstrap(final RemoteAddressFilter remoteAddressFilter,
                           @Value("${dos.filter.enabled:false}") final boolean dosFilterEnabled,
                           @Value("${rewrite.engine.enabled:false}") final boolean rewriteEngineEnabled,
                           @Value("${port.api:0}") final int port,
-                          @Value("${port.api.secure:-1}") final int securePort
-              ) throws MalformedObjectNameException {
+                          @Value("${port.api.secure:-1}") final int securePort,
+                          @Value("${port.client.auth:-1}") final int clientAuthPort,
+                          @Value("${client.auth.enabled:false}") final boolean clientCertEnabled
+                        ) throws MalformedObjectNameException {
         this.remoteAddressFilter = remoteAddressFilter;
         this.extensionOverridesAcceptHeaderFilter = extensionOverridesAcceptHeaderFilter;
         this.servletDeployers = servletDeployers;
@@ -136,6 +141,8 @@ public JettyBootstrap(final RemoteAddressFilter remoteAddressFilter,
         this.securePort = securePort;
         this.port = port;
         this.server = null;
+        this.clientAuthPort = clientAuthPort;
+        this.clientCertEnabled = clientCertEnabled;
     }
 
     @Override
@@ -158,6 +165,10 @@ public int getSecurePort() {
         return this.securePort;
     }
 
+    public int getClientAuthPort(){
+        return this.clientAuthPort;
+    }
+
     public Server getServer() {
         return this.server;
     }
@@ -180,11 +191,15 @@ private Server createAndStartServer() {
     private Server createServer() {
         final Server server = new Server();
 
+        server.setConnectors(new Connector[]{createConnector(server)});
+
         if (this.securePort >= 0) {
-             server.setConnectors(new Connector[]{createConnector(server), createSecureConnector(server)});
-         } else {
-             server.setConnectors(new Connector[]{createConnector(server)});
-         }
+             server.addConnector(createSecureConnector(server, this.securePort, false));
+        }
+
+        if (this.clientAuthPort >= 0 && this.clientCertEnabled) {
+            server.addConnector(createSecureConnector(server, this.clientAuthPort, true));
+        }
 
         final WebAppContext context = new WebAppContext();
         context.setContextPath("/");
@@ -234,6 +249,8 @@ private Connector createConnector(final Server server) {
         return connector;
     }
 
+
+
     /**
      * Use the DoSFilter from Jetty for rate limiting: https://www.eclipse.org/jetty/documentation/current/dos-filter.html.
      * See {@link WhoisDoSFilter} for the customisations added.
@@ -265,7 +282,7 @@ private FilterHolder createDosFilter() throws JmxException, JMException {
         return holder;
     }
 
-    private Connector createSecureConnector(final Server server) {
+    private Connector createSecureConnector(final Server server, final int port, final boolean isClientCertificate) {
         // allow (untrusted) self-signed certificates to connect
         final SslContextFactory.Server sslContextFactory = new SslContextFactory.Server() {
             @Override
@@ -288,11 +305,13 @@ protected TrustManagerFactory getTrustManagerFactoryInstance() {
         sslContextFactory.setKeyStorePassword(whoisKeystore.getPassword());
         sslContextFactory.setCipherComparator(HTTP2Cipher.COMPARATOR);
 
-        // enable optional client certificates
-        sslContextFactory.setWantClientAuth(true);
-        sslContextFactory.setValidateCerts(false);
-        sslContextFactory.setTrustAll(true);
-
+        if (isClientCertificate) {
+            // accept self-signed client certificates for authentication
+            sslContextFactory.setNeedClientAuth(true);
+            sslContextFactory.setValidateCerts(false);
+            sslContextFactory.setTrustAll(true);
+        }
+
         // Exclude weak / insecure ciphers
         // TODO CBC became weak, we need to skip them in the future https://support.kemptechnologies.com/hc/en-us/articles/9338043775757-CBC-ciphers-marked-as-weak-by-SSL-labs
         // Check client compatability first
@@ -318,7 +337,7 @@ protected TrustManagerFactory getTrustManagerFactoryInstance() {
         final SslConnectionFactory sslConnectionFactory = new SslConnectionFactory(sslContextFactory, alpn.getProtocol());
 
         final ServerConnector sslConnector = new ServerConnector(server, sslConnectionFactory, alpn, h2, new HttpConnectionFactory(httpsConfiguration));
-        sslConnector.setPort(this.securePort);
+        sslConnector.setPort(port);
         return sslConnector;
     }
 
@@ -408,11 +427,18 @@ private void logHttpsConfig() {
     private void updatePorts() {
         for (Connector connector : this.server.getConnectors()) {
             final int localPort = ((NetworkConnector) connector).getLocalPort();
-            if (connector.getProtocols().contains("ssl")) {
-                this.securePort = localPort;
-            } else {
+            if(!connector.getProtocols().contains("ssl")) {
                 this.port = localPort;
+                continue;
             }
+
+            if (this.clientCertEnabled) {
+                this.clientAuthPort = localPort;
+                continue;
+            }
+
+            this.securePort = localPort;
+
         }
     }
 

whois-api/src/main/java/net/ripe/db/whois/api/httpserver/RewriteEngine.java

@@ -1,5 +1,6 @@
 package net.ripe.db.whois.api.httpserver;
 
+import org.apache.commons.lang.StringUtils;
 import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.http.HttpScheme;
 import org.eclipse.jetty.http.HttpStatus;
@@ -27,14 +28,30 @@ public class RewriteEngine {
     private final String source;
     private final String nonAuthSource;
 
+    private String clientAuthHost;
+
+    private final boolean clientCertEnabled;
+
     @Autowired
-    public RewriteEngine(final @Value("${api.rest.baseurl}") String baseUrl,
-                         final @Value("${whois.source}") String source,
-                         final @Value("${whois.nonauth.source}") String nonAuthSource) {
+    public RewriteEngine(@Value("${api.rest.baseurl}") final String baseUrl,
+                         @Value("${whois.source}") final String source,
+                         @Value("${whois.nonauth.source}") final String nonAuthSource,
+                         @Value("${api.client.auth.baseurl:}") final String clientAuthBaseUrl,
+                         @Value("${client.auth.enabled:false}") final boolean clientCertEnabled) {
         this.source = source;
         this.nonAuthSource = nonAuthSource;
-        URI uri = URI.create(baseUrl);
-        restVirtualHost = uri.getHost();
+
+        URI restBaseUri = URI.create(baseUrl);
+        restVirtualHost = restBaseUri.getHost();
+
+        this.clientCertEnabled = clientCertEnabled;
+
+        if (this.clientCertEnabled && StringUtils.isNotBlank(clientAuthBaseUrl)) {
+            URI clientAuthBaseUri = URI.create(clientAuthBaseUrl);
+            clientAuthHost = clientAuthBaseUri.getHost();
+            LOGGER.info("Client Auth virtual host: {}", clientAuthHost);
+        }
+
         syncupdatesVirtualHost = restVirtualHost.replace("rest", "syncupdates");
         rdapVirtualHost = restVirtualHost.replace("rest", "rdap");
 
@@ -54,6 +71,14 @@ public RewriteHandler getRewriteHandler() {
         rewriteHandler.addRule(restVirtualHostRule);
         restRedirectRules(restVirtualHostRule);
 
+        if (this.clientCertEnabled) {
+            // Client Auth
+            VirtualHostRuleContainer clientAuthVirtualHostRule = new VirtualHostRuleContainer();
+            clientAuthVirtualHostRule.addVirtualHost(clientAuthHost);
+            rewriteHandler.addRule(clientAuthVirtualHostRule);
+            restRedirectRules(clientAuthVirtualHostRule);
+        }
+
         // rdap
         VirtualHostRuleContainer rdapVirtualHostRule = new VirtualHostRuleContainer();
         rdapVirtualHostRule.addVirtualHost(rdapVirtualHost);

whois-api/src/test/java/net/ripe/db/whois/api/httpserver/AbstractClientCertificateIntegrationTest.java

@@ -6,6 +6,7 @@
 import net.ripe.db.whois.common.rpsl.RpslObject;
 import net.ripe.db.whois.common.rpsl.RpslObjectBuilder;
 import net.ripe.db.whois.update.keycert.X509CertificateWrapper;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
 
 import javax.net.ssl.KeyManager;
@@ -45,7 +46,14 @@ public class AbstractClientCertificateIntegrationTest extends AbstractHttpsInteg
 
     @BeforeAll
     public static void enableClientAuth() {
-        System.setProperty("client.cert.auth.enabled", "true");
+        System.setProperty("client.auth.enabled", "true");
+        System.setProperty("port.client.auth", "0");
+    }
+
+    @AfterAll
+    public static void disableClientAuth() {
+        System.clearProperty("client.auth.enabled");
+        System.clearProperty("port.client.auth");
     }
 
     public SSLContext getClientSSLContext() {
@@ -112,4 +120,7 @@ public static RpslObject createKeycertObject(final X509Certificate x509, final S
         return builder.get();
     }
 
+    public int getClientCertificatePort() {
+        return jettyBootstrap.getClientAuthPort();
+    }
 }

whois-api/src/test/java/net/ripe/db/whois/api/httpserver/ClientCertificateServiceTestIntegration.java

@@ -1,6 +1,6 @@
 package net.ripe.db.whois.api.httpserver;
 
-import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.ProcessingException;
 import jakarta.ws.rs.core.MediaType;
 import net.ripe.db.whois.api.SecureRestTest;
 import org.junit.jupiter.api.Tag;
@@ -16,7 +16,7 @@ public class ClientCertificateServiceTestIntegration extends AbstractClientCerti
 
     @Test
     public void client_certificate() {
-        final String response = SecureRestTest.target(getClientSSLContext(), getSecurePort(), "whois/client")
+        final String response = SecureRestTest.target(getClientSSLContext(), getClientCertificatePort(), "whois/client")
             .request()
             .get(String.class);
 
@@ -28,13 +28,13 @@ public void client_certificate() {
     @Test
     public void no_client_certificate() {
         try {
-            SecureRestTest.target(getSecurePort(), "whois/client")
+            SecureRestTest.target(getClientCertificatePort(), "whois/client")
                 .request()
                 .accept(MediaType.TEXT_PLAIN)
                 .get(String.class);
             fail();
-        } catch (BadRequestException e) {
-            assertThat(e.getResponse().readEntity(String.class), containsString("Bad Request"));
+        } catch (ProcessingException e) {
+            assertThat(e.getMessage(), containsString("javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate"));
         }
     }
 

whois-api/src/test/java/net/ripe/db/whois/api/rest/WhoisRestBasicAuthTestIntegration.java

@@ -69,7 +69,7 @@ public class WhoisRestBasicAuthTestIntegration extends AbstractHttpsIntegrationT
             "mnt-by:      OWNER-MNT\n" +
             "source:      TEST");
 
-    private static String TEST_ROLE_STRING = "" +
+    private static final String TEST_ROLE_STRING = "" +
             "role:           Test Role\n" +
             "address:        Singel 258\n" +
             "phone:          +31 6 12345678\n" +

whois-api/src/test/java/net/ripe/db/whois/api/rest/WhoisRestServiceClientCertificateTestIntegration.java

@@ -1,6 +1,7 @@
 package net.ripe.db.whois.api.rest;
 
 import jakarta.ws.rs.NotAuthorizedException;
+import jakarta.ws.rs.ProcessingException;
 import jakarta.ws.rs.client.Entity;
 import jakarta.ws.rs.core.MediaType;
 import net.ripe.db.whois.api.RestTest;
@@ -129,7 +130,7 @@ public void update_person_with_client_cert_no_mntner_cert_unauthorised() {
              "source: TEST");
 
         try {
-            SecureRestTest.target(getClientSSLContext(), getSecurePort(), "whois/test/person/TP1-TEST")
+            SecureRestTest.target(getClientSSLContext(), getClientCertificatePort(), "whois/test/person/TP1-TEST")
                 .request()
                 .put(Entity.entity(map(updatedPerson), MediaType.APPLICATION_XML), WhoisResources.class);
             fail();
@@ -159,7 +160,7 @@ public void update_person_with_client_cert_auth_different_mntner_cert_unauthoris
         databaseHelper.updateObject(updatedMntner);
 
         try {
-            SecureRestTest.target(getClientSSLContext(), getSecurePort(), "whois/test/person/TP1-TEST")
+            SecureRestTest.target(getClientSSLContext(), getClientCertificatePort(), "whois/test/person/TP1-TEST")
                 .request()
                 .put(Entity.entity(map(updatedPerson), MediaType.APPLICATION_XML), WhoisResources.class);
             fail();
@@ -190,7 +191,7 @@ public void update_person_with_client_cert_and_mntner_cert_successful() {
         databaseHelper.updateObject(updatedMntner);
 
         // connect with mntner's client cert for authentication
-        final WhoisResources whoisResources = SecureRestTest.target(getClientSSLContext(), getSecurePort(), "whois/test/person/TP1-TEST")
+        final WhoisResources whoisResources = SecureRestTest.target(getClientSSLContext(), getClientCertificatePort(), "whois/test/person/TP1-TEST")
                 .request()
                 .put(Entity.entity(map(updatedPerson), MediaType.APPLICATION_XML), WhoisResources.class);
 
@@ -222,16 +223,12 @@ public void update_person_missing_private_key_unauthorised() throws Exception {
         databaseHelper.updateObject(updatedMntner);
 
         try {
-            SecureRestTest.target(sslContext, getSecurePort(), "whois/test/person/TP1-TEST")
+            SecureRestTest.target(sslContext, getClientCertificatePort(), "whois/test/person/TP1-TEST")
                     .request()
                     .put(Entity.entity(map(updatedPerson), MediaType.APPLICATION_XML), WhoisResources.class);
             fail();
-        } catch (NotAuthorizedException e) {
-            final WhoisResources whoisResources = e.getResponse().readEntity(WhoisResources.class);
-            RestTest.assertErrorCount(whoisResources, 1);
-            RestTest.assertErrorMessage(whoisResources, 0, "Error",
-                "Authorisation for [%s] %s failed\nusing \"%s:\"\n" +
-                 "not authenticated by: %s", "person", "TP1-TEST", "mnt-by", "OWNER-MNT");
+        } catch (ProcessingException e) {
+            assertThat(e.getMessage(), containsString("javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate"));
         }
     }
 
@@ -255,7 +252,7 @@ public void update_route6_with_client_cert_and_mntner_cert_successful() {
         final RpslObject updatedRoute6 = new RpslObjectBuilder(route6).append(new RpslAttribute(AttributeType.REMARKS, "updated")).get();
 
         // connect with mntner's client cert for authentication
-        final WhoisResources whoisResources = SecureRestTest.target(getClientSSLContext(), getSecurePort(), "whois/test/route6/2001::/32AS12726")
+        final WhoisResources whoisResources = SecureRestTest.target(getClientSSLContext(), getClientCertificatePort(), "whois/test/route6/2001::/32AS12726")
                 .request()
                 .put(Entity.entity(map(updatedRoute6), MediaType.APPLICATION_XML), WhoisResources.class);
 

whois-update/src/main/java/net/ripe/db/whois/update/authentication/credential/ClientCertificateCredentialValidator.java

@@ -36,7 +36,7 @@ public class ClientCertificateCredentialValidator implements CredentialValidator
     public ClientCertificateCredentialValidator(final RpslObjectDao rpslObjectDao,
                                                 final DateTimeProvider dateTimeProvider,
                                                 final LoggerContext loggerContext,
-                                                final @Value("${client.cert.auth.enabled:false}") boolean enabled) {
+                                                final @Value("${client.auth.enabled:false}") boolean enabled) {
         this.rpslObjectDao = rpslObjectDao;
         this.dateTimeProvider = dateTimeProvider;
         this.loggerContext = loggerContext;