Skip to content

Commit a61cda1

Browse files
mondainmondain
committed
Refactor SSL in Tomcat for 11+ and update version to 2.0.10
1 parent 3576532 commit a61cda1

11 files changed

Lines changed: 88 additions & 21 deletions

File tree

‎client/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.red5</groupId>
55
<artifactId>red5-parent</artifactId>
6-
<version>2.0.9</version>
6+
<version>2.0.10</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>red5-client</artifactId>

‎client/src/main/java/org/red5/client/Red5Client.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ public final class Red5Client {
1818
/**
1919
* Current server version with revision
2020
*/
21-
public static final String VERSION = "Red5 Client 2.0.9";
21+
public static final String VERSION = "Red5 Client 2.0.10";
2222

2323
/**
2424
* Create a new Red5Client object using the connection local to the current thread A bit of magic that lets you access the red5 scope

‎common/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.red5</groupId>
55
<artifactId>red5-parent</artifactId>
6-
<version>2.0.9</version>
6+
<version>2.0.10</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>red5-server-common</artifactId>
@@ -105,7 +105,7 @@
105105
<dependency>
106106
<groupId>net.engio</groupId>
107107
<artifactId>mbassador</artifactId>
108-
<version>2.0.9</version>
108+
<version>2.0.10</version>
109109
</dependency> -->
110110
<dependency>
111111
<groupId>junit</groupId>

‎common/src/main/java/org/red5/server/api/Red5.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,12 +57,12 @@ public final class Red5 {
5757
/**
5858
* Server version with revision
5959
*/
60-
public static final String VERSION = "Red5 Server 2.0.9";
60+
public static final String VERSION = "Red5 Server 2.0.10";
6161

6262
/**
6363
* Server version for fmsVer requests
6464
*/
65-
public static final String FMS_VERSION = "RED5/2,0,9,0";
65+
public static final String FMS_VERSION = "RED5/2,0,10,0";
6666

6767
/**
6868
* Server capabilities

‎io/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.red5</groupId>
55
<artifactId>red5-parent</artifactId>
6-
<version>2.0.9</version>
6+
<version>2.0.10</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>red5-io</artifactId>

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<name>Red5</name>
2525
<description>The Red5 server</description>
2626
<groupId>org.red5</groupId>
27-
<version>2.0.9</version>
27+
<version>2.0.10</version>
2828
<url>https://github.com/Red5/red5-server</url>
2929
<inceptionYear>2005</inceptionYear>
3030
<organization>

‎server/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.red5</groupId>
55
<artifactId>red5-parent</artifactId>
6-
<version>2.0.9</version>
6+
<version>2.0.10</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>red5-server</artifactId>

‎server/src/main/java/org/red5/server/tomcat/TomcatConnector.java‎

Lines changed: 74 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,12 @@
1313
import java.util.Map.Entry;
1414

1515
import org.apache.catalina.connector.Connector;
16-
import org.apache.catalina.core.AprLifecycleListener;
1716
import org.apache.coyote.ProtocolHandler;
1817
import org.apache.coyote.http11.Http11Nio2Protocol;
1918
import org.apache.coyote.http11.Http11NioProtocol;
2019
import org.apache.tomcat.util.IntrospectionUtils;
20+
import org.apache.tomcat.util.net.SSLHostConfig;
21+
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
2122
import org.red5.logging.Red5LoggerFactory;
2223
import org.slf4j.Logger;
2324

@@ -72,26 +73,89 @@ public void init() {
7273
// set connection properties
7374
if (connectionProperties != null) {
7475
for (String key : connectionProperties.keySet()) {
76+
// skip ssl related properties
77+
if (key.startsWith("keystore") || key.startsWith("truststore") || key.startsWith("certificate") || key.equals("clientAuth") || key.equals("allowUnsafeLegacyRenegotiation")) {
78+
continue;
79+
}
7580
connector.setProperty(key, connectionProperties.get(key));
7681
}
7782
}
7883
// turn off native apr support
79-
AprLifecycleListener listener = new AprLifecycleListener();
80-
listener.setSSLEngine("off");
81-
connector.addLifecycleListener(listener);
82-
// determine if https support is requested
83-
if (secure) {
84-
// set connection properties
85-
connector.setSecure(true);
86-
connector.setScheme("https");
87-
}
84+
//AprLifecycleListener listener = new AprLifecycleListener();
85+
//listener.setSSLEngine("off");
86+
//connector.addLifecycleListener(listener);
8887
// apply the bind address to the handler
8988
ProtocolHandler handler = connector.getProtocolHandler();
9089
if (handler instanceof Http11Nio2Protocol) {
9190
((Http11Nio2Protocol) handler).setAddress(address.getAddress());
9291
} else if (handler instanceof Http11NioProtocol) {
9392
((Http11NioProtocol) handler).setAddress(address.getAddress());
9493
}
94+
// Reference https://tomcat.apache.org/tomcat-11.0-doc/ssl-howto.html#SSL_and_Tomcat
95+
// determine if https support is requested
96+
if (secure) {
97+
// set connection properties
98+
connector.setSecure(true);
99+
connector.setScheme("https");
100+
connector.setProperty("SSLEnabled", "true");
101+
// create a new ssl host config
102+
SSLHostConfig sslHostConfig = new SSLHostConfig();
103+
/*
104+
<entry key="sslProtocol" value="TLS" />
105+
<entry key="keystoreFile" value="${rtmps.keystorefile}" />
106+
<entry key="keystorePass" value="${rtmps.keystorepass}" />
107+
<entry key="truststoreFile" value="${rtmps.truststorefile}" />
108+
<entry key="truststorePass" value="${rtmps.truststorepass}" />
109+
<entry key="clientAuth" value="false" />
110+
<entry key="allowUnsafeLegacyRenegotiation" value="true" />
111+
*/
112+
sslHostConfig.setSslProtocol("TLS");
113+
sslHostConfig.setTruststoreFile(connectionProperties.get("truststoreFile"));
114+
sslHostConfig.setTruststorePassword(connectionProperties.get("truststorePass"));
115+
if (connectionProperties.containsKey("truststoreType")) {
116+
sslHostConfig.setTruststoreType(connectionProperties.get("truststoreType"));
117+
} else {
118+
sslHostConfig.setTruststoreType("JKS");
119+
}
120+
// set the protocols
121+
if (connectionProperties.containsKey("protocols")) {
122+
String[] protocols = connectionProperties.get("protocols").split(",");
123+
//sslHostConfig.setProtocols(protocols);
124+
sslHostConfig.setEnabledProtocols(protocols);
125+
} else {
126+
sslHostConfig.setProtocols("TLSv1.2");
127+
sslHostConfig.setEnabledProtocols(new String[] { "TLSv1.2" });
128+
}
129+
// set the ciphers
130+
if (connectionProperties.containsKey("ciphers")) {
131+
String[] ciphers = connectionProperties.get("ciphers").split(",");
132+
//sslHostConfig.setCiphers(ciphers);
133+
sslHostConfig.setEnabledCiphers(ciphers);
134+
} else {
135+
//sslHostConfig.setCiphers("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384");
136+
}
137+
// dont allow unsafe renegotiation
138+
sslHostConfig.setInsecureRenegotiation(!secure);
139+
// create a new ssl host config certificate
140+
SSLHostConfigCertificate sslHostConfigCert = new SSLHostConfigCertificate(sslHostConfig, SSLHostConfigCertificate.Type.RSA);
141+
sslHostConfigCert.setCertificateKeystoreFile(connectionProperties.get("keystoreFile"));
142+
sslHostConfigCert.setCertificateKeystorePassword(connectionProperties.get("keystorePass"));
143+
if (connectionProperties.containsKey("keystoreType")) {
144+
sslHostConfigCert.setCertificateKeystoreType(connectionProperties.get("keystoreType"));
145+
} else {
146+
sslHostConfigCert.setCertificateKeystoreType("JKS");
147+
}
148+
// set the certificate key alias
149+
if (connectionProperties.containsKey("certificateKeyAlias")) {
150+
sslHostConfigCert.setCertificateKeyAlias(connectionProperties.get("certificateKeyAlias"));
151+
} else {
152+
//sslHostConfigCert.setCertificateKeyAlias("red5");
153+
}
154+
// add the ssl host config certificate to the ssl host config
155+
sslHostConfig.addCertificate(sslHostConfigCert);
156+
// add the ssl host config to the handler
157+
handler.addSslHostConfig(sslHostConfig);
158+
}
95159
// set initialized flag
96160
initialized = true;
97161
} catch (Throwable t) {

‎server/src/main/server/conf/jee-container.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@
7272
<map>
7373
<entry key="port" value="${https.port}" />
7474
<entry key="redirectPort" value="${http.port}" />
75+
7576
<entry key="SSLEnabled" value="true" />
7677
<entry key="sslProtocol" value="TLS" />
7778
<entry key="keystoreFile" value="${rtmps.keystorefile}" />
@@ -80,9 +81,11 @@
8081
<entry key="truststorePass" value="${rtmps.truststorepass}" />
8182
<entry key="clientAuth" value="false" />
8283
<entry key="allowUnsafeLegacyRenegotiation" value="true" />
84+
8385
<entry key="maxHttpHeaderSize" value="${http.max_headers_size}"/>
8486
<entry key="maxKeepAliveRequests" value="${http.max_keep_alive_requests}"/>
8587
<entry key="keepAliveTimout" value="-1"/>
88+
8689
<entry key="useExecutor" value="true"/>
8790
<entry key="maxThreads" value="${http.max_threads}"/>
8891
<entry key="acceptorThreadCount" value="${http.acceptor_thread_count}"/>

‎service/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>org.red5</groupId>
55
<artifactId>red5-parent</artifactId>
6-
<version>2.0.9</version>
6+
<version>2.0.10</version>
77
</parent>
88
<modelVersion>4.0.0</modelVersion>
99
<artifactId>red5-service</artifactId>

0 commit comments

Comments
 (0)