1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
#include "server.h"
#include "config.h"
#include <yt/yt/core/http/server.h>
#include <yt/yt/core/http/private.h>
#include <yt/yt/core/crypto/tls.h>
#include <yt/yt/core/logging/log.h>
#include <yt/yt/core/misc/fs.h>
#include <yt/yt/core/net/address.h>
#include <yt/yt/core/concurrency/poller.h>
#include <yt/yt/core/concurrency/periodic_executor.h>
namespace NYT::NHttps {
static const auto& Logger = NHttp::HttpLogger;
using namespace NNet;
using namespace NHttp;
using namespace NCrypto;
using namespace NConcurrency;
////////////////////////////////////////////////////////////////////////////////
class TServer
: public IServer
{
public:
explicit TServer(IServerPtr underlying, TPeriodicExecutorPtr certificateUpdater)
: Underlying_(std::move(underlying))
, CertificateUpdater_(certificateUpdater)
{ }
void AddHandler(
const TString& pattern,
const IHttpHandlerPtr& handler) override
{
Underlying_->AddHandler(pattern, handler);
}
const TNetworkAddress& GetAddress() const override
{
return Underlying_->GetAddress();
}
//! Starts the server.
void Start() override
{
Underlying_->Start();
if (CertificateUpdater_) {
CertificateUpdater_->Start();
}
}
//! Stops the server.
void Stop() override
{
Underlying_->Stop();
if (CertificateUpdater_) {
YT_UNUSED_FUTURE(CertificateUpdater_->Stop());
}
}
void SetPathMatcher(const IRequestPathMatcherPtr& matcher) override
{
Underlying_->SetPathMatcher(matcher);
}
IRequestPathMatcherPtr GetPathMatcher() override
{
return Underlying_->GetPathMatcher();
}
private:
const IServerPtr Underlying_;
const TPeriodicExecutorPtr CertificateUpdater_;
};
static void ApplySslConfig(const TSslContextPtr& sslContext, const TServerCredentialsConfigPtr& sslConfig)
{
if (sslConfig->CertChain->FileName) {
sslContext->AddCertificateChainFromFile(*sslConfig->CertChain->FileName);
} else if (sslConfig->CertChain->Value) {
sslContext->AddCertificateChain(*sslConfig->CertChain->Value);
} else {
YT_ABORT();
}
if (sslConfig->PrivateKey->FileName) {
sslContext->AddPrivateKeyFromFile(*sslConfig->PrivateKey->FileName);
} else if (sslConfig->PrivateKey->Value) {
sslContext->AddPrivateKey(*sslConfig->PrivateKey->Value);
} else {
YT_ABORT();
}
}
IServerPtr CreateServer(
const TServerConfigPtr& config,
const IPollerPtr& poller,
const IPollerPtr& acceptor)
{
auto sslContext = New<TSslContext>();
ApplySslConfig(sslContext, config->Credentials);
sslContext->Commit();
auto sslConfig = config->Credentials;
TPeriodicExecutorPtr certificateUpdater;
if (sslConfig->UpdatePeriod &&
sslConfig->CertChain->FileName &&
sslConfig->PrivateKey->FileName)
{
certificateUpdater = New<TPeriodicExecutor>(
poller->GetInvoker(),
BIND([=, serverName = config->ServerName] {
try {
auto modificationTime = Max(
NFS::GetPathStatistics(*sslConfig->CertChain->FileName).ModificationTime,
NFS::GetPathStatistics(*sslConfig->PrivateKey->FileName).ModificationTime);
// Detect fresh and stable updates.
if (modificationTime > sslContext->GetCommitTime() &&
modificationTime + sslConfig->UpdatePeriod <= TInstant::Now())
{
YT_LOG_INFO("Updating TLS certificates (ServerName: %v, ModificationTime: %v)", serverName, modificationTime);
sslContext->Reset();
ApplySslConfig(sslContext, sslConfig);
sslContext->Commit(modificationTime);
YT_LOG_INFO("TLS certificates updated (ServerName: %v)", serverName);
}
} catch (const std::exception& ex) {
YT_LOG_WARNING(ex, "Unexpected exception while updating TLS certificates (ServerName: %v)", serverName);
}
}),
sslConfig->UpdatePeriod);
}
auto address = TNetworkAddress::CreateIPv6Any(config->Port);
auto tlsListener = sslContext->CreateListener(address, poller, acceptor);
auto configCopy = CloneYsonStruct(config);
configCopy->IsHttps = true;
auto httpServer = NHttp::CreateServer(configCopy, tlsListener, poller, acceptor);
return New<TServer>(std::move(httpServer), std::move(certificateUpdater));
}
IServerPtr CreateServer(const TServerConfigPtr& config, const IPollerPtr& poller)
{
return CreateServer(config, poller, poller);
}
////////////////////////////////////////////////////////////////////////////////
} // namespace NYT::NHttps
|
