<commit_before>/*
 * Copyright 2017 Yahoo Holdings, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.yahoo.athenz.instance.provider.impl;

import java.io.File;
import java.security.PublicKey;
import java.security.cert.X509Certificate;
import java.util.Map;
import java.util.concurrent.TimeUnit;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.amazonaws.regions.Regions;
import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.GetCallerIdentityRequest;
import com.amazonaws.services.securitytoken.model.GetCallerIdentityResult;
import com.yahoo.athenz.auth.KeyStore;
import com.yahoo.athenz.auth.util.Crypto;
import com.yahoo.athenz.auth.util.CryptoException;
import com.yahoo.athenz.instance.provider.InstanceConfirmation;
import com.yahoo.athenz.instance.provider.InstanceProvider;
import com.yahoo.athenz.instance.provider.ResourceException;
import com.yahoo.rdl.JSON;
import com.yahoo.rdl.Struct;
import com.yahoo.rdl.Timestamp;

import javax.net.ssl.*;

public class InstanceAWSProvider implements InstanceProvider {

    private static final Logger LOGGER = LoggerFactory.getLogger(InstanceAWSProvider.class);

    private static final String ATTR_ACCOUNT_ID   = "accountId";
    private static final String ATTR_REGION       = "region";
    private static final String ATTR_PENDING_TIME = "pendingTime";

    static final String ATTR_INSTANCE_ID  = "instanceId";

    static final String ZTS_CERT_USAGE            = "certUsage";
    static final String ZTS_CERT_USAGE_CLIENT     = "client";

    private static final String ZTS_CERT_INSTANCE_ID      = ".instanceid.athenz.";
    private static final String ZTS_INSTANCE_SAN_DNS      = "sanDNS";
    private static final String ZTS_INSTANCE_AWS_ACCOUNT  = "cloudAccount";

    static final String AWS_PROP_PUBLIC_CERT      = "athenz.zts.aws_public_cert";
    static final String AWS_PROP_BOOT_TIME_OFFSET = "athenz.zts.aws_boot_time_offset";
    static final String AWS_PROP_DNS_SUFFIX       = "athenz.zts.aws_dns_suffix";
    static final String AWS_PROP_REGION_NAME      = "athenz.zts.aws_region_name";

    PublicKey awsPublicKey = null;      // AWS public key for validating instance documents
    long bootTimeOffset;                // boot time offset in milliseconds
    boolean supportRefresh = false;
    String awsRegion;
    private String dnsSuffix = null;

    @Override
    public void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore) {
        
        String awsCertFileName = System.getProperty(AWS_PROP_PUBLIC_CERT);
        if (awsCertFileName != null && !awsCertFileName.isEmpty()) {
            File awsCertFile = new File(awsCertFileName);
            X509Certificate awsCert = Crypto.loadX509Certificate(awsCertFile);
            awsPublicKey = awsCert.getPublicKey();
        }
        
        if (awsPublicKey == null) {
            LOGGER.error("AWS Public Key not specified - no instance requests will be authorized");
        }
        
        // how long the instance must be booted in the past before we
        // stop validating the instance requests
        
        long timeout = TimeUnit.SECONDS.convert(5, TimeUnit.MINUTES);
        bootTimeOffset = 1000 * Long.parseLong(
                System.getProperty(AWS_PROP_BOOT_TIME_OFFSET, Long.toString(timeout)));
        
        // determine the dns suffix. if this is not specified we'll
        // rejecting all entries
        
        dnsSuffix = System.getProperty(AWS_PROP_DNS_SUFFIX);
        if (dnsSuffix == null || dnsSuffix.isEmpty()) {
            LOGGER.error("AWS DNS Suffix not specified - no instance requests will be authorized");
        }
<commit_msg>dns suffix must be protected not private (#476)<commit_after>/*
 * Copyright 2017 Yahoo Holdings, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.yahoo.athenz.instance.provider.impl;

import java.io.File;
import java.security.PublicKey;
import java.security.cert.X509Certificate;
import java.util.Map;
import java.util.concurrent.TimeUnit;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.amazonaws.regions.Regions;
import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.services.securitytoken.AWSSecurityTokenService;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.services.securitytoken.model.GetCallerIdentityRequest;
import com.amazonaws.services.securitytoken.model.GetCallerIdentityResult;
import com.yahoo.athenz.auth.KeyStore;
import com.yahoo.athenz.auth.util.Crypto;
import com.yahoo.athenz.auth.util.CryptoException;
import com.yahoo.athenz.instance.provider.InstanceConfirmation;
import com.yahoo.athenz.instance.provider.InstanceProvider;
import com.yahoo.athenz.instance.provider.ResourceException;
import com.yahoo.rdl.JSON;
import com.yahoo.rdl.Struct;
import com.yahoo.rdl.Timestamp;

import javax.net.ssl.*;

public class InstanceAWSProvider implements InstanceProvider {

    private static final Logger LOGGER = LoggerFactory.getLogger(InstanceAWSProvider.class);

    private static final String ATTR_ACCOUNT_ID   = "accountId";
    private static final String ATTR_REGION       = "region";
    private static final String ATTR_PENDING_TIME = "pendingTime";

    static final String ATTR_INSTANCE_ID  = "instanceId";

    static final String ZTS_CERT_USAGE            = "certUsage";
    static final String ZTS_CERT_USAGE_CLIENT     = "client";

    private static final String ZTS_CERT_INSTANCE_ID      = ".instanceid.athenz.";
    private static final String ZTS_INSTANCE_SAN_DNS      = "sanDNS";
    private static final String ZTS_INSTANCE_AWS_ACCOUNT  = "cloudAccount";

    static final String AWS_PROP_PUBLIC_CERT      = "athenz.zts.aws_public_cert";
    static final String AWS_PROP_BOOT_TIME_OFFSET = "athenz.zts.aws_boot_time_offset";
    static final String AWS_PROP_DNS_SUFFIX       = "athenz.zts.aws_dns_suffix";
    static final String AWS_PROP_REGION_NAME      = "athenz.zts.aws_region_name";

    PublicKey awsPublicKey = null;      // AWS public key for validating instance documents
    long bootTimeOffset;                // boot time offset in milliseconds
    boolean supportRefresh = false;
    String awsRegion;
    String dnsSuffix = null;

    @Override
    public void initialize(String provider, String providerEndpoint, SSLContext sslContext,
            KeyStore keyStore) {
        
        String awsCertFileName = System.getProperty(AWS_PROP_PUBLIC_CERT);
        if (awsCertFileName != null && !awsCertFileName.isEmpty()) {
            File awsCertFile = new File(awsCertFileName);
            X509Certificate awsCert = Crypto.loadX509Certificate(awsCertFile);
            awsPublicKey = awsCert.getPublicKey();
        }
        
        if (awsPublicKey == null) {
            LOGGER.error("AWS Public Key not specified - no instance requests will be authorized");
        }
        
        // how long the instance must be booted in the past before we
        // stop validating the instance requests
        
        long timeout = TimeUnit.SECONDS.convert(5, TimeUnit.MINUTES);
        bootTimeOffset = 1000 * Long.parseLong(
                System.getProperty(AWS_PROP_BOOT_TIME_OFFSET, Long.toString(timeout)));
        
        // determine the dns suffix. if this is not specified we'll
        // rejecting all entries
        
        dnsSuffix = System.getProperty(AWS_PROP_DNS_SUFFIX);
        if (dnsSuffix == null || dnsSuffix.isEmpty()) {
            LOGGER.error("AWS DNS Suffix not specified - no instance requests will be authorized");
        }

{'fraction_non_alphanumeric': 0.07787433155080214, 'fraction_numerical': 0.005681818181818182, 'mean_word_length': 3.540718259989884, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7666091', 'n_tokens_mistral': 2571, 'n_tokens_neox': 2538, 'n_words': 684}