<commit_before>/*
 * Copyright 2015 Netflix, Inc.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

package com.netflix.spinnaker.config

import com.netflix.spinnaker.tomcat.x509.BlacklistingSSLImplementation
import com.netflix.spinnaker.tomcat.x509.SslExtensionConfigurationProperties
import groovy.util.logging.Slf4j
import org.apache.catalina.connector.Connector
import org.apache.coyote.http11.AbstractHttp11JsseProtocol
import org.apache.coyote.http11.Http11NioProtocol
import org.springframework.boot.actuate.endpoint.ResolvedEnvironmentEndpoint
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression
import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer
import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer
import org.springframework.boot.context.embedded.Ssl
import org.springframework.boot.context.embedded.tomcat.TomcatConnectorCustomizer
import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory
import org.springframework.boot.context.properties.EnableConfigurationProperties
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration

@Slf4j
@Configuration
@EnableConfigurationProperties([ResolvedEnvironmentEndpoint, SslExtensionConfigurationProperties, TomcatConfigurationProperties])
class TomcatConfiguration {

  /**
   * Setup multiple connectors:
   * - an https connector requiring client auth that will service API requests
   * - an http connector that will service legacy non-https requests
   */
  @Bean
  @ConditionalOnExpression('${server.ssl.enabled:false}')
  EmbeddedServletContainerCustomizer containerCustomizer(TomcatConfigurationProperties tomcatConfigurationProperties,
                                                         SslExtensionConfigurationProperties sslExtensionConfigurationProperties) throws Exception {
    return { ConfigurableEmbeddedServletContainer container ->
      TomcatEmbeddedServletContainerFactory tomcat = (TomcatEmbeddedServletContainerFactory) container
      //this will only handle the case where SSL is enabled on the main tomcat connector
      tomcat.addConnectorCustomizers(new TomcatConnectorCustomizer() {
        @Override
        void customize(Connector connector) {
          def handler = connector.getProtocolHandler()
          if (handler instanceof AbstractHttp11JsseProtocol) {
            if (handler.isSSLEnabled()) {
              handler.setSslImplementationName(BlacklistingSSLImplementation.name)
              handler.setCrlFile(sslExtensionConfigurationProperties.getCrlFile())
            }
          }
        }
      })

      if (tomcatConfigurationProperties.getLegacyServerPort()> 0) {
        log.info("Creating legacy connector on port ${tomcatConfigurationProperties.getLegacyServerPort()}")
        def httpConnector = new Connector("org.apache.coyote.http11.Http11NioProtocol")
        httpConnector.setScheme("http")
        httpConnector.setPort(tomcatConfigurationProperties.getLegacyServerPort())
        tomcat.addAdditionalTomcatConnectors(httpConnector)
      }

      if (tomcatConfigurationProperties.getApiPort()> 0) {
        log.info("Creating api connector on port ${tomcatConfigurationProperties.getApiPort()}")
        def apiConnector = new Connector("org.apache.coyote.http11.Http11NioProtocol")
        apiConnector.setScheme("https")
        apiConnector.setPort(tomcatConfigurationProperties.getApiPort())

        def ssl = new Ssl()
        tomcat.ssl.properties.each { k, v ->
          try {
            ssl."${k}" = v
          } catch (ReadOnlyPropertyException ignored) {}
        }
        ssl.clientAuth = Ssl.ClientAuth.NEED

        Http11NioProtocol handler = apiConnector.getProtocolHandler() as Http11NioProtocol
        handler.setSslImplementationName(BlacklistingSSLImplementation.name)
        handler.setCrlFile(sslExtensionConfigurationProperties.getCrlFile())

        tomcat.configureSsl(handler, ssl)
        tomcat.addAdditionalTomcatConnectors(apiConnector)
      }
    } as EmbeddedServletContainerCustomizer<commit_msg>fix(tls) - configure tomcat TLS settings<commit_after>/*
 * Copyright 2015 Netflix, Inc.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

package com.netflix.spinnaker.config

import com.netflix.spinnaker.okhttp.OkHttpClientConfigurationProperties
import com.netflix.spinnaker.tomcat.x509.BlacklistingSSLImplementation
import com.netflix.spinnaker.tomcat.x509.SslExtensionConfigurationProperties
import groovy.util.logging.Slf4j
import org.apache.catalina.connector.Connector
import org.apache.coyote.http11.AbstractHttp11JsseProtocol
import org.apache.coyote.http11.Http11NioProtocol
import org.springframework.boot.actuate.endpoint.ResolvedEnvironmentEndpoint
import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression
import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer
import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer
import org.springframework.boot.context.embedded.Ssl
import org.springframework.boot.context.embedded.tomcat.TomcatConnectorCustomizer
import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory
import org.springframework.boot.context.properties.EnableConfigurationProperties
import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration

@Slf4j
@Configuration
@EnableConfigurationProperties([ResolvedEnvironmentEndpoint, SslExtensionConfigurationProperties, TomcatConfigurationProperties])
class TomcatConfiguration {

  /**
   * Setup multiple connectors:
   * - an https connector requiring client auth that will service API requests
   * - an http connector that will service legacy non-https requests
   */
  @Bean
  @ConditionalOnExpression('${server.ssl.enabled:false}')
  EmbeddedServletContainerCustomizer containerCustomizer(OkHttpClientConfigurationProperties okHttpClientConfigurationProperties,
                                                         TomcatConfigurationProperties tomcatConfigurationProperties,
                                                         SslExtensionConfigurationProperties sslExtensionConfigurationProperties) throws Exception {
    return { ConfigurableEmbeddedServletContainer container ->
      TomcatEmbeddedServletContainerFactory tomcat = (TomcatEmbeddedServletContainerFactory) container
      //this will only handle the case where SSL is enabled on the main tomcat connector
      tomcat.addConnectorCustomizers(new TomcatConnectorCustomizer() {
        @Override
        void customize(Connector connector) {
          def handler = connector.getProtocolHandler()
          if (handler instanceof AbstractHttp11JsseProtocol) {
            if (handler.isSSLEnabled()) {
              handler.setProperty("sslEnabledProtocols", okHttpClientConfigurationProperties.tlsVersions.join(","))
              handler.setCiphers(okHttpClientConfigurationProperties.cipherSuites.join(","))
              handler.setSslImplementationName(BlacklistingSSLImplementation.name)
              handler.setCrlFile(sslExtensionConfigurationProperties.getCrlFile())
            }
          }
        }
      })

      if (tomcatConfigurationProperties.getLegacyServerPort()> 0) {
        log.info("Creating legacy connector on port ${tomcatConfigurationProperties.getLegacyServerPort()}")
        def httpConnector = new Connector("org.apache.coyote.http11.Http11NioProtocol")
        httpConnector.setScheme("http")
        httpConnector.setPort(tomcatConfigurationProperties.getLegacyServerPort())
        tomcat.addAdditionalTomcatConnectors(httpConnector)
      }

      if (tomcatConfigurationProperties.getApiPort()> 0) {
        log.info("Creating api connector on port ${tomcatConfigurationProperties.getApiPort()}")
        def apiConnector = new Connector("org.apache.coyote.http11.Http11NioProtocol")
        apiConnector.setScheme("https")
        apiConnector.setPort(tomcatConfigurationProperties.getApiPort())

        def ssl = new Ssl()
        tomcat.ssl.properties.each { k, v ->
          try {
            ssl."${k}" = v
          } catch (ReadOnlyPropertyException ignored) {}
        }
        ssl.clientAuth = Ssl.ClientAuth.NEED
        ssl.setCiphers(okHttpClientConfigurationProperties.cipherSuites as String[])

        Http11NioProtocol handler = apiConnector.getProtocolHandler() as Http11NioProtocol
        handler.setProperty("sslEnabledProtocols", okHttpClientConfigurationProperties.tlsVersions.join(","))
        handler.setSslImplementationName(BlacklistingSSLImplementation.name)
        handler.setCrlFile(sslExtensionConfigurationProperties.getCrlFile())

        tomcat.configureSsl(handler, ssl)
        tomcat.addAdditionalTomcatConnectors(apiConnector)
      }
    } as EmbeddedServletContainerCustomizer
{'fraction_non_alphanumeric': 0.07282575985555222, 'fraction_numerical': 0.008024877119069114, 'mean_word_length': 4.141825683341929, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '833227', 'n_tokens_mistral': 2520, 'n_tokens_neox': 2442, 'n_words': 521}