|
| 1 | +/* |
| 2 | + * Copyright 2025 Google LLC |
| 3 | + * |
| 4 | + * Redistribution and use in source and binary forms, with or without |
| 5 | + * modification, are permitted provided that the following conditions are |
| 6 | + * met: |
| 7 | + * |
| 8 | + * * Redistributions of source code must retain the above copyright |
| 9 | + * notice, this list of conditions and the following disclaimer. |
| 10 | + * * Redistributions in binary form must reproduce the above |
| 11 | + * copyright notice, this list of conditions and the following disclaimer |
| 12 | + * in the documentation and/or other materials provided with the |
| 13 | + * distribution. |
| 14 | + * * Neither the name of Google LLC nor the names of its |
| 15 | + * contributors may be used to endorse or promote products derived from |
| 16 | + * this software without specific prior written permission. |
| 17 | + * |
| 18 | + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| 19 | + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| 20 | + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| 21 | + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| 22 | + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 23 | + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| 24 | + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 25 | + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 26 | + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 27 | + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 28 | + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 29 | + */ |
| 30 | + |
| 31 | +package com.google.auth.mtls; |
| 32 | + |
| 33 | +import com.google.api.client.json.JsonParser; |
| 34 | +import com.google.api.client.json.gson.GsonFactory; |
| 35 | +import com.google.api.client.util.SecurityUtils; |
| 36 | +import com.google.common.annotations.VisibleForTesting; |
| 37 | +import com.google.common.collect.ImmutableList; |
| 38 | +import java.io.FileInputStream; |
| 39 | +import java.io.FileNotFoundException; |
| 40 | +import java.io.IOException; |
| 41 | +import java.io.InputStream; |
| 42 | +import java.security.GeneralSecurityException; |
| 43 | +import java.security.KeyStore; |
| 44 | +import java.util.List; |
| 45 | +import java.util.concurrent.TimeUnit; |
| 46 | + |
| 47 | +/** |
| 48 | + * This class implements {@link MtlsProvider} for the Google Auth library transport layer via {@link |
| 49 | + * ContextAwareMetadataJson}. This is only meant to be used internally by Google Cloud libraries, |
| 50 | + * and the public facing methods may be changed without notice, and have no guarantee of backwards |
| 51 | + * compatibility. |
| 52 | + * |
| 53 | + * <p>Note: This implementation is derived from the existing "MtlsProvider" found in the Gax |
| 54 | + * library, with two notable differences: 1) All logic associated with parsing environment variables |
| 55 | + * related to "mTLS usage" are omitted - a separate helper class will be introduced in the Gax |
| 56 | + * library to serve this purpose. 2) getKeyStore throws {@link |
| 57 | + * com.google.auth.mtls.CertificateSourceUnavailableException} instead of returning "null" if this |
| 58 | + * cert source is not available on the device. |
| 59 | + * |
| 60 | + * <p>Additionally, this implementation will replace the existing "MtlsProvider" in the Gax library. |
| 61 | + * The Gax library version of MtlsProvider will be marked as deprecated. |
| 62 | + */ |
| 63 | +public class SecureConnectProvider implements MtlsProvider { |
| 64 | + interface ProcessProvider { |
| 65 | + public Process createProcess(InputStream metadata) throws IOException; |
| 66 | + } |
| 67 | + |
| 68 | + static class DefaultProcessProvider implements ProcessProvider { |
| 69 | + @Override |
| 70 | + public Process createProcess(InputStream metadata) throws IOException { |
| 71 | + if (metadata == null) { |
| 72 | + throw new IOException("Error creating Process: metadata is null"); |
| 73 | + } |
| 74 | + List<String> command = extractCertificateProviderCommand(metadata); |
| 75 | + return new ProcessBuilder(command).start(); |
| 76 | + } |
| 77 | + } |
| 78 | + |
| 79 | + private static final String DEFAULT_CONTEXT_AWARE_METADATA_PATH = |
| 80 | + System.getProperty("user.home") + "/.secureConnect/context_aware_metadata.json"; |
| 81 | + |
| 82 | + private String metadataPath; |
| 83 | + private ProcessProvider processProvider; |
| 84 | + |
| 85 | + @VisibleForTesting |
| 86 | + SecureConnectProvider(ProcessProvider processProvider, String metadataPath) { |
| 87 | + this.processProvider = processProvider; |
| 88 | + this.metadataPath = metadataPath; |
| 89 | + } |
| 90 | + |
| 91 | + public SecureConnectProvider() { |
| 92 | + this(new DefaultProcessProvider(), DEFAULT_CONTEXT_AWARE_METADATA_PATH); |
| 93 | + } |
| 94 | + |
| 95 | + /** |
| 96 | + * Returns a mutual TLS key store backed by the certificate provided by the SecureConnect tool. |
| 97 | + * |
| 98 | + * @return a KeyStore containing the certificate provided by the SecureConnect tool. |
| 99 | + * @throws CertificateSourceUnavailableException if the certificate source is unavailable (ex. |
| 100 | + * missing configuration file). |
| 101 | + * @throws IOException if a general I/O error occurs while creating the KeyStore. |
| 102 | + */ |
| 103 | + @Override |
| 104 | + public KeyStore getKeyStore() throws CertificateSourceUnavailableException, IOException { |
| 105 | + try (InputStream stream = new FileInputStream(metadataPath)) { |
| 106 | + return getKeyStore(stream, processProvider); |
| 107 | + } catch (InterruptedException e) { |
| 108 | + throw new IOException("SecureConnect: Interrupted executing certificate provider command", e); |
| 109 | + } catch (GeneralSecurityException e) { |
| 110 | + throw new CertificateSourceUnavailableException( |
| 111 | + "SecureConnect encountered GeneralSecurityException:", e); |
| 112 | + } catch (FileNotFoundException exception) { |
| 113 | + // If the metadata file doesn't exist, then there is no key store, so we will throw sentinel |
| 114 | + // error |
| 115 | + throw new CertificateSourceUnavailableException("SecureConnect metadata does not exist."); |
| 116 | + } |
| 117 | + } |
| 118 | + |
| 119 | + /** |
| 120 | + * Returns true if the SecureConnect mTLS provider is available. |
| 121 | + * |
| 122 | + * @throws IOException if a general I/O error occurs while determining availability. |
| 123 | + */ |
| 124 | + @Override |
| 125 | + public boolean isAvailable() throws IOException { |
| 126 | + try { |
| 127 | + this.getKeyStore(); |
| 128 | + } catch (CertificateSourceUnavailableException e) { |
| 129 | + return false; |
| 130 | + } |
| 131 | + return true; |
| 132 | + } |
| 133 | + |
| 134 | + @VisibleForTesting |
| 135 | + static KeyStore getKeyStore(InputStream metadata, ProcessProvider processProvider) |
| 136 | + throws IOException, InterruptedException, GeneralSecurityException { |
| 137 | + Process process = processProvider.createProcess(metadata); |
| 138 | + |
| 139 | + // Run the command and timeout after 1000 milliseconds. |
| 140 | + // The cert provider command usually finishes instantly (if it doesn't hang), |
| 141 | + // so 1000 milliseconds is plenty of time. |
| 142 | + int exitCode = runCertificateProviderCommand(process, 1000); |
| 143 | + if (exitCode != 0) { |
| 144 | + throw new IOException( |
| 145 | + "SecureConnect: Cert provider command failed with exit code: " + exitCode); |
| 146 | + } |
| 147 | + |
| 148 | + // Create mTLS key store with the input certificates from shell command. |
| 149 | + return SecurityUtils.createMtlsKeyStore(process.getInputStream()); |
| 150 | + } |
| 151 | + |
| 152 | + @VisibleForTesting |
| 153 | + static ImmutableList<String> extractCertificateProviderCommand(InputStream contextAwareMetadata) |
| 154 | + throws IOException { |
| 155 | + JsonParser parser = new GsonFactory().createJsonParser(contextAwareMetadata); |
| 156 | + ContextAwareMetadataJson json = parser.parse(ContextAwareMetadataJson.class); |
| 157 | + return json.getCommands(); |
| 158 | + } |
| 159 | + |
| 160 | + @VisibleForTesting |
| 161 | + static int runCertificateProviderCommand(Process commandProcess, long timeoutMilliseconds) |
| 162 | + throws IOException, InterruptedException { |
| 163 | + boolean terminated = commandProcess.waitFor(timeoutMilliseconds, TimeUnit.MILLISECONDS); |
| 164 | + if (!terminated) { |
| 165 | + commandProcess.destroy(); |
| 166 | + throw new IOException("SecureConnect: Cert provider command timed out"); |
| 167 | + } |
| 168 | + return commandProcess.exitValue(); |
| 169 | + } |
| 170 | +} |
0 commit comments