Skip to content

Commit 6e34770

Browse files
dhoarddhoard
authored
Added environment variable to allow RMI SSL but disable use of SSL for the RMI registry (#952)
Signed-off-by: dhoard <doug.hoard@gmail.com>
1 parent 9bdbe78 commit 6e34770

File tree

11 files changed

+236
-4
lines changed

11 files changed

+236
-4
lines changed

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,6 @@ pom.xml.versionsBackup
1515
integration_test_suite/integration_tests/src/test/resources/common/**.jar
1616
output.log
1717
stress-test.log
18+
test.sh
19+
test.log
20+
.antublue-test-engine.properties

‎collector/src/main/java/io/prometheus/jmx/JmxScraper.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,10 @@ public void doScrape() throws Exception {
120120
environment.put(
121121
RMIConnectorServer.RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE,
122122
clientSocketFactory);
123-
environment.put("com.sun.jndi.rmi.factory.socket", clientSocketFactory);
123+
124+
if (!"true".equalsIgnoreCase(System.getenv("RMI_REGISTRY_SSL_DISABLED"))) {
125+
environment.put("com.sun.jndi.rmi.factory.socket", clientSocketFactory);
126+
}
124127
}
125128

126129
jmxc = JMXConnectorFactory.connect(new JMXServiceURL(jmxUrl), environment);

‎integration_test_suite/integration_tests/src/test/java/io/prometheus/jmx/test/rmi/ssl/MinimalTest.java renamed to ‎integration_test_suite/integration_tests/src/test/java/io/prometheus/jmx/test/rmi/ssl/MinimalRMISSLTest.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
import java.util.stream.Stream;
3737
import org.antublue.test.engine.api.TestEngine;
3838

39-
public class MinimalTest extends AbstractTest implements Consumer<HttpResponse> {
39+
public class MinimalRMISSLTest extends AbstractTest implements Consumer<HttpResponse> {
4040

4141
/**
4242
* Method to get the list of TestArguments

‎integration_test_suite/integration_tests/src/test/java/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest.java

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
/*
2+
* Copyright (C) 2023 The Prometheus jmx_exporter Authors
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.prometheus.jmx.test.rmi.ssl;
18+
19+
import static io.prometheus.jmx.test.support.http.HttpResponseAssertions.assertHttpMetricsResponse;
20+
21+
import io.prometheus.jmx.test.AbstractTest;
22+
import io.prometheus.jmx.test.support.Mode;
23+
import io.prometheus.jmx.test.support.TestArgument;
24+
import io.prometheus.jmx.test.support.http.HttpHealthyRequest;
25+
import io.prometheus.jmx.test.support.http.HttpMetricsRequest;
26+
import io.prometheus.jmx.test.support.http.HttpOpenMetricsRequest;
27+
import io.prometheus.jmx.test.support.http.HttpPrometheusMetricsRequest;
28+
import io.prometheus.jmx.test.support.http.HttpPrometheusProtobufMetricsRequest;
29+
import io.prometheus.jmx.test.support.http.HttpResponse;
30+
import io.prometheus.jmx.test.support.http.HttpResponseAssertions;
31+
import io.prometheus.jmx.test.support.metrics.DoubleValueMetricAssertion;
32+
import io.prometheus.jmx.test.support.metrics.Metric;
33+
import io.prometheus.jmx.test.support.metrics.MetricsParser;
34+
import java.util.Collection;
35+
import java.util.function.Consumer;
36+
import java.util.stream.Stream;
37+
import org.antublue.test.engine.api.TestEngine;
38+
39+
public class RMIRegistrySSLDisabledTest extends AbstractTest implements Consumer<HttpResponse> {
40+
41+
/**
42+
* Method to get the list of TestArguments
43+
*
44+
* @return the return value
45+
*/
46+
@TestEngine.ArgumentSupplier
47+
protected static Stream<TestArgument> arguments() {
48+
// Filter the arguments..
49+
//
50+
// 1. only run the Standalone exporter
51+
// 2. filter out the GraalVM 1.8 JVM - exception is that SunJSSE is not found
52+
// 3. filter out all ibmjava* JVMs - exception is that SunJSSE is not found
53+
//
54+
return AbstractTest.arguments()
55+
.filter(testArgument -> testArgument.name().contains("Standalone"))
56+
.filter(
57+
testArgument1 ->
58+
!testArgument1.dockerImageName().contains("graalvm/jdk:java8"))
59+
.filter(testArgument1 -> !testArgument1.dockerImageName().contains("ibmjava"));
60+
}
61+
62+
@TestEngine.Test
63+
public void testHealthy() {
64+
new HttpHealthyRequest()
65+
.send(testContext.httpClient())
66+
.accept(HttpResponseAssertions::assertHttpHealthyResponse);
67+
}
68+
69+
@TestEngine.Test
70+
public void testMetrics() {
71+
new HttpMetricsRequest().send(testContext.httpClient()).accept(this);
72+
}
73+
74+
@TestEngine.Test
75+
public void testMetricsOpenMetricsFormat() {
76+
new HttpOpenMetricsRequest().send(testContext.httpClient()).accept(this);
77+
}
78+
79+
@TestEngine.Test
80+
public void testMetricsPrometheusFormat() {
81+
new HttpPrometheusMetricsRequest().send(testContext.httpClient()).accept(this);
82+
}
83+
84+
@TestEngine.Test
85+
public void testMetricsPrometheusProtobufFormat() {
86+
new HttpPrometheusProtobufMetricsRequest().send(testContext.httpClient()).accept(this);
87+
}
88+
89+
@Override
90+
public void accept(HttpResponse httpResponse) {
91+
assertHttpMetricsResponse(httpResponse);
92+
93+
Collection<Metric> metrics = MetricsParser.parse(httpResponse);
94+
95+
String buildInfoName =
96+
testArgument.mode() == Mode.JavaAgent
97+
? "jmx_prometheus_javaagent"
98+
: "jmx_prometheus_httpserver";
99+
100+
new DoubleValueMetricAssertion(metrics)
101+
.type("GAUGE")
102+
.name("jmx_exporter_build_info")
103+
.label("name", buildInfoName)
104+
.value(1d)
105+
.isPresent();
106+
107+
new DoubleValueMetricAssertion(metrics)
108+
.type("GAUGE")
109+
.name("jmx_scrape_error")
110+
.value(0d)
111+
.isPresent();
112+
113+
new DoubleValueMetricAssertion(metrics)
114+
.type("COUNTER")
115+
.name("jmx_config_reload_success_total")
116+
.value(0d)
117+
.isPresent();
118+
119+
new DoubleValueMetricAssertion(metrics)
120+
.type("GAUGE")
121+
.name("jvm_memory_used_bytes")
122+
.label("area", "nonheap")
123+
.isPresent(testArgument.mode() == Mode.JavaAgent);
124+
125+
new DoubleValueMetricAssertion(metrics)
126+
.type("GAUGE")
127+
.name("jvm_memory_used_bytes")
128+
.label("area", "heap")
129+
.isPresent(testArgument.mode() == Mode.JavaAgent);
130+
131+
new DoubleValueMetricAssertion(metrics)
132+
.type("GAUGE")
133+
.name("jvm_memory_used_bytes")
134+
.label("area", "nonheap")
135+
.isNotPresent(testArgument.mode() == Mode.Standalone);
136+
137+
new DoubleValueMetricAssertion(metrics)
138+
.type("GAUGE")
139+
.name("jvm_memory_used_bytes")
140+
.label("area", "heap")
141+
.isNotPresent(testArgument.mode() == Mode.Standalone);
142+
143+
new DoubleValueMetricAssertion(metrics)
144+
.type("UNTYPED")
145+
.name("io_prometheus_jmx_tabularData_Server_1_Disk_Usage_Table_size")
146+
.label("source", "/dev/sda1")
147+
.value(7.516192768E9d)
148+
.isPresent();
149+
150+
new DoubleValueMetricAssertion(metrics)
151+
.type("UNTYPED")
152+
.name("io_prometheus_jmx_tabularData_Server_2_Disk_Usage_Table_pcent")
153+
.label("source", "/dev/sda2")
154+
.value(0.8d)
155+
.isPresent();
156+
}
157+
}

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/MinimalTest/Standalone/application.sh

-2
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@
1616
JMXREMOTE_ACCESS=jmxremote.access
1717
JMXREMOTE_PASSWORD=jmxremote.password
1818

19-
whoami
20-
2119
WHOAMI=$(whoami)
2220
if [ "${WHOAMI}" = "jboss" ] || [ "${WHOAMI}" = "default" ];
2321
then

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/application.sh

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
#
4+
# Code to run the test with RedHat UBI images
5+
#
6+
# When running on RedHat UBI images, testcontainers maps
7+
# the files as the current user, but the application runs
8+
# as "jboss" on UBI8 images and "default" on UBI9 images
9+
# preventing the chmod commands to change permissions on
10+
# the jmxremote.access and jmxremote.password files.
11+
#
12+
# The code copies the files to /tmp as the current user
13+
# then performs a chmod to change permissions.
14+
#
15+
16+
JMXREMOTE_ACCESS=jmxremote.access
17+
JMXREMOTE_PASSWORD=jmxremote.password
18+
19+
WHOAMI=$(whoami)
20+
if [ "${WHOAMI}" = "jboss" ] || [ "${WHOAMI}" = "default" ];
21+
then
22+
cp ${JMXREMOTE_ACCESS} /tmp/jmxremote.access
23+
cp ${JMXREMOTE_PASSWORD} /tmp/jmxremote.password
24+
chmod go-rwx /tmp/jmxremote.access
25+
chmod go-rwx /tmp/jmxremote.password
26+
JMXREMOTE_ACCESS=/tmp/jmxremote.access
27+
JMXREMOTE_PASSWORD=/tmp/jmxremote.password
28+
else
29+
chmod go-rwx jmxremote.access
30+
chmod go-rwx jmxremote.password
31+
fi
32+
33+
export RMI_REGISTRY_SSL_DISABLED=true
34+
35+
java \
36+
-Xmx512M \
37+
-Dcom.sun.management.jmxremote=true \
38+
-Dcom.sun.management.jmxremote.authenticate=true \
39+
-Dcom.sun.management.jmxremote.password.file=${JMXREMOTE_PASSWORD} \
40+
-Dcom.sun.management.jmxremote.port=9999 \
41+
-Dcom.sun.management.jmxremote.access.file=${JMXREMOTE_ACCESS} \
42+
-Dcom.sun.management.jmxremote.ssl=true \
43+
-Dcom.sun.management.jmxremote.rmi.port=8888 \
44+
-Djavax.net.ssl.keyStore=localhost.pkcs12 \
45+
-Djavax.net.ssl.keyStorePassword=changeit \
46+
-Djavax.net.ssl.keyStoreType=pkcs12 \
47+
-Djavax.net.ssl.trustStore=localhost.pkcs12 \
48+
-Djavax.net.ssl.trustStorePassword=changeit \
49+
-Djavax.net.ssl.trustStoreType=pkcs12 \
50+
-jar jmx_example_application.jar

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/exporter.sh

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
export RMI_REGISTRY_SSL_DISABLED=true
4+
5+
java \
6+
-Xmx512M \
7+
-Djavax.net.ssl.keyStore=localhost.pkcs12 \
8+
-Djavax.net.ssl.keyStorePassword=changeit \
9+
-Djavax.net.ssl.keyStoreType=pkcs12 \
10+
-Djavax.net.ssl.trustStore=localhost.pkcs12 \
11+
-Djavax.net.ssl.trustStorePassword=changeit \
12+
-Djavax.net.ssl.trustStoreType=pkcs12 \
13+
-jar jmx_prometheus_httpserver.jar 8888 exporter.yaml

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/exporter.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
hostPort: application:9999
2+
ssl: true
3+
username: Prometheus
4+
password: secret
5+
rules:
6+
- pattern: ".*"

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/jmxremote.access

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Prometheus readonly

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/jmxremote.password

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Prometheus secret

‎integration_test_suite/integration_tests/src/test/resources/io/prometheus/jmx/test/rmi/ssl/RMIRegistrySSLDisabledTest/Standalone/localhost.pkcs12

2.64 KB
Binary file not shown.

0 commit comments

Comments
 (0)