1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
#include "server.h"
#include "config.h"
#include <yt/yt/core/http/server.h>
#include <yt/yt/core/http/private.h>
#include <yt/yt/core/crypto/tls.h>
#include <yt/yt/core/logging/log.h>
#include <yt/yt/core/misc/fs.h>
#include <yt/yt/core/net/address.h>
#include <yt/yt/core/concurrency/poller.h>
#include <yt/yt/core/concurrency/periodic_executor.h>
#include <yt/yt/core/concurrency/thread_pool_poller.h>
namespace NYT::NHttps {
static constexpr auto& Logger = NHttp::HttpLogger;
using namespace NNet;
using namespace NHttp;
using namespace NCrypto;
using namespace NConcurrency;
////////////////////////////////////////////////////////////////////////////////
class TServer
: public IServer
{
public:
TServer(IServerPtr underlying, TPeriodicExecutorPtr certificateUpdater)
: Underlying_(std::move(underlying))
, CertificateUpdater_(certificateUpdater)
{ }
void AddHandler(
const TString& pattern,
const IHttpHandlerPtr& handler) override
{
Underlying_->AddHandler(pattern, handler);
}
const TNetworkAddress& GetAddress() const override
{
return Underlying_->GetAddress();
}
//! Starts the server.
void Start() override
{
Underlying_->Start();
if (CertificateUpdater_) {
CertificateUpdater_->Start();
}
}
//! Stops the server.
void Stop() override
{
Underlying_->Stop();
if (CertificateUpdater_) {
YT_UNUSED_FUTURE(CertificateUpdater_->Stop());
}
if (OwnPoller_) {
OwnPoller_->Shutdown();
}
}
void SetPathMatcher(const IRequestPathMatcherPtr& matcher) override
{
Underlying_->SetPathMatcher(matcher);
}
IRequestPathMatcherPtr GetPathMatcher() override
{
return Underlying_->GetPathMatcher();
}
void SetOwnPoller(IPollerPtr poller)
{
OwnPoller_ = std::move(poller);
}
private:
const IServerPtr Underlying_;
const TPeriodicExecutorPtr CertificateUpdater_;
IPollerPtr OwnPoller_;
};
static void ApplySslConfig(const TSslContextPtr& sslContext, const TServerCredentialsConfigPtr& sslConfig)
{
if (sslConfig->CertChain->FileName) {
sslContext->AddCertificateChainFromFile(*sslConfig->CertChain->FileName);
} else if (sslConfig->CertChain->Value) {
sslContext->AddCertificateChain(*sslConfig->CertChain->Value);
} else {
YT_ABORT();
}
if (sslConfig->PrivateKey->FileName) {
sslContext->AddPrivateKeyFromFile(*sslConfig->PrivateKey->FileName);
} else if (sslConfig->PrivateKey->Value) {
sslContext->AddPrivateKey(*sslConfig->PrivateKey->Value);
} else {
YT_ABORT();
}
}
IServerPtr CreateServer(
const TServerConfigPtr& config,
const IPollerPtr& poller,
const IPollerPtr& acceptor,
const IInvokerPtr& controlInvoker)
{
auto sslContext = New<TSslContext>();
ApplySslConfig(sslContext, config->Credentials);
sslContext->Commit();
auto sslConfig = config->Credentials;
TPeriodicExecutorPtr certificateUpdater;
if (sslConfig->UpdatePeriod &&
sslConfig->CertChain->FileName &&
sslConfig->PrivateKey->FileName)
{
YT_VERIFY(controlInvoker);
certificateUpdater = New<TPeriodicExecutor>(
controlInvoker,
BIND([=] {
try {
auto modificationTime = Max(
NFS::GetPathStatistics(*sslConfig->CertChain->FileName).ModificationTime,
NFS::GetPathStatistics(*sslConfig->PrivateKey->FileName).ModificationTime);
// Detect fresh and stable updates.
if (modificationTime > sslContext->GetCommitTime() &&
modificationTime + sslConfig->UpdatePeriod <= TInstant::Now())
{
YT_LOG_INFO("Updating TLS certificates (ServerName: %v, ModificationTime: %v)",
config->ServerName,
modificationTime);
sslContext->Reset();
ApplySslConfig(sslContext, sslConfig);
sslContext->Commit(modificationTime);
YT_LOG_INFO("TLS certificates updated (ServerName: %v)",
config->ServerName);
}
} catch (const std::exception& ex) {
YT_LOG_WARNING(ex,
"Unexpected exception while updating TLS certificates (ServerName: %v)",
config->ServerName);
}
}),
sslConfig->UpdatePeriod);
}
auto address = TNetworkAddress::CreateIPv6Any(config->Port);
auto tlsListener = sslContext->CreateListener(address, poller, acceptor);
auto configCopy = CloneYsonStruct(config);
configCopy->IsHttps = true;
auto httpServer = NHttp::CreateServer(configCopy, tlsListener, poller, acceptor);
return New<TServer>(std::move(httpServer), std::move(certificateUpdater));
}
IServerPtr CreateServer(const TServerConfigPtr& config, const IPollerPtr& poller)
{
return CreateServer(config, poller, poller, /*controlInvoker*/ nullptr);
}
IServerPtr CreateServer(const TServerConfigPtr& config, int pollerThreadCount)
{
auto poller = CreateThreadPoolPoller(pollerThreadCount, config->ServerName);
auto server = CreateServer(config, poller);
StaticPointerCast<TServer>(server)->SetOwnPoller(std::move(poller));
return server;
}
////////////////////////////////////////////////////////////////////////////////
} // namespace NYT::NHttps
|
