Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OF-2559: Introduce Netty for S2S & C2S #2220

Merged
merged 57 commits into from
Aug 1, 2023
Merged

OF-2559: Introduce Netty for S2S & C2S #2220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
57 commits
Select commit Hold shift + click to select a range
3ec1999
OF-2559 Implement Netty inbound connection handlers
viv Jun 21, 2023
b0f8731
feat: OF-2559 - add compression for inbound and outbound traffic for …
AlexGidman Jun 29, 2023
2c91f91
OF-2559 Fixed tests after refactor
viv Jun 29, 2023
00aa6fa
OF-2559 Removed last of MINA from XMLLightweightParser
viv Jun 29, 2023
16a412e
fix: OF-2559 - isIdle now returns true when channel open but not conn…
AlexGidman Jun 29, 2023
5af394b
feat: OF-2559 - add channel options that match settings in MinaConnec…
AlexGidman Jun 30, 2023
6d9c6f3
feat: OF-2559 - add WriteTimeoutHandler to handle stalled sessions
AlexGidman Jul 3, 2023
78f05a7
fix: OF-2559 - improve write timeout system property description and …
AlexGidman Jul 3, 2023
1650fe5
OF-2559 Added TLS handler for inbound netty connections
viv Jul 3, 2023
48c9599
OF-2559 S2S outbound with Netty
AlexGidman Jul 5, 2023
c8a2ba2
OF-2559 - Direct TLS on Netty inbound and outbound S2S
AlexGidman Jul 13, 2023
c52100f
OF-2559 Refactor to remove duplication
viv Jul 17, 2023
ee5bd07
OF-2559 Remove temporary long timeout
viv Jul 17, 2023
3f6241f
OF-2559 Tidy up, removed unused properties
viv Jul 17, 2023
dec32a3
OF-2559 Tidy up comments
viv Jul 17, 2023
cc177aa
OF-2559 Refactor: extracted isDirectTLS method
viv Jul 17, 2023
fe819fb
OF-2559 Refactor: Log to application log
viv Jul 17, 2023
e71831c
OF-2559 Deprecate Mina-based ClientConnectionHandler
viv Jul 18, 2023
ad3c115
OF-2559 Improved comments
viv Jul 18, 2023
4ee6a39
OF-2559 Removed unused connection handler
viv Jul 18, 2023
04ecba7
OF-2559 Netty is always used for S2S and C2S
viv Jul 18, 2023
31c1b23
OF-2559 Refactor to remove unused code following Netty migration
viv Jul 18, 2023
e186bc5
feat: OF-2559 - surface session initialise timeout to a system property
AlexGidman Jul 18, 2023
30237c6
feat: OF-2559 - implement handling for idle states in inbound C2S and…
AlexGidman Jul 20, 2023
cdac496
OF-2559 Remove HTML tags in comments
viv Jul 21, 2023
08fe9cf
OF-2559 Fixed minor typo
viv Jul 21, 2023
8223d5e
OF-2559 Netty ConnectionAcceptor reconfigure logic
viv Jul 21, 2023
b8c4554
fix: OF-2559 - rename clientConnection boolean as isClientConnection …
AlexGidman Jul 21, 2023
70294c6
OF-2611: Add unit tests for outbound server session (#2165)
guusdk Jul 20, 2023
444836c
OF-2559 WIP after tests merge
viv Jul 25, 2023
9385d9e
OF-2559 Implement Netty inbound connection handlers
viv Jun 21, 2023
e56b34c
OF-2559 Added TLS handler for inbound netty connections
viv Jul 3, 2023
545fc8c
OF-2559 S2S outbound with Netty
AlexGidman Jul 5, 2023
394c090
OF-2559 - Direct TLS on Netty inbound and outbound S2S
AlexGidman Jul 13, 2023
d28136c
OF-2559 Tidy up comments
viv Jul 17, 2023
2066e82
OF-2559 Improved comments
viv Jul 18, 2023
987eb52
OF-2559 Remove HTML tags in comments
viv Jul 21, 2023
3f4b065
feat: OF-2599 - add stats updates on Netty channel read and write ope…
AlexGidman Jul 25, 2023
20ac715
OF-2559 Faster fallback to Dialback
viv Jul 26, 2023
7e43cee
Remove duplication of connection configuration
guusdk Jul 26, 2023
b43d30b
fix: OF-2599 - move NettyConnectionHandler creation to a factory method
AlexGidman Jul 26, 2023
c89095a
feat: OF-2599 - add NettyComponentConnectionHandler to handle Compone…
AlexGidman Jul 26, 2023
c095508
feat: OF-2599 - add NettyMultiplexerConnectionHandler to handle Mutip…
AlexGidman Jul 26, 2023
b25f6ba
OF-2559 Ensure NioEventLoopGroup is closed for outbound S2S
viv Jul 27, 2023
ce54590
feat: OF-2599 - Delete all MINA dependencies, references, and depreca…
AlexGidman Jul 27, 2023
2b95a74
OF-2632: Do not offer StartTLS when the identity store is empty
guusdk Jul 27, 2023
b3832d9
OF-2559 WIP Fixed TLS negotiation
viv Jul 31, 2023
681c496
fix: OF-2559 - re-implement strictCertificateValidation logic so that…
AlexGidman Jul 31, 2023
f591cc9
chore: OF-2559 - remove unnecessary System.out statements
AlexGidman Jul 31, 2023
edec92b
fix: OF-2599 - switch SSLHandshakeException check to a CertificateExc…
AlexGidman Jul 31, 2023
8d8dd7f
OF-2559 WIP startTLS does not need to return
viv Aug 1, 2023
e4dd9df
fix: OF-2599 - remove generic type on connection
AlexGidman Aug 1, 2023
1d10a99
Merge branch 'OF-2559_mina-to-netty' of https://github.com/surevine/O…
AlexGidman Aug 1, 2023
381286d
OF-2559: Remove MINA artifacts from pom.xml
guusdk Aug 1, 2023
7c9f90d
OF-2559 Create new business logic handler for each session
viv Aug 1, 2023
0dbf629
OF-2559 Pass netty events along pipeline
viv Aug 1, 2023
5e06b1e
OF-2559 Prevent old ssl engine from using TLS 1.3
viv Aug 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions i18n/src/main/resources/openfire_i18n.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1659,6 +1659,7 @@ system_property.hybridAuthProvider.tertiaryProvider.className=The third class th
system_property.admin.authorizedJIDs=The bare JID of every admin user for the DefaultAdminProvider
system_property.xmpp.auth.ssl.context_protocol=The TLS protocol to use for encryption context initialization, overriding the Java default.
system_property.xmpp.socket.ssl.active=Set to true to enable legacy encrypted connections for clients, otherwise false
system_property.xmpp.socket.write-timeout-seconds=The write timeout time in seconds to handle stalled sessions and prevent DoS
system_property.xmpp.component.ssl.active=Set to true to enable legacy encrypted connections for external components, otherwise false
system_property.xmpp.server.startup.retry.delay=Set to a positive value to allow a retry of a failed startup after the specified duration.
system_property.sasl.realm=The realm used for SASL authentication, which can be used when realms that are passed through SASL are different from the XMPP domain name.
Expand All @@ -1670,7 +1671,7 @@ system_property.sasl.scram-sha-1.iteration-count=The number of iterations when s
system_property.xmpp.auth.anonymous=Set to true to allow anonymous login, otherwise false
system_property.xmpp.auth.external.client.skip-cert-revalidation=Set to true to avoid validation of the client-provided PKIX certificate (for mutual authentication) other than the validation that happens when the TLS session is established.
system_property.xmpp.auth.ssl.default-trustmanager-impl=The class to use as the default SSL/TLS TrustManager (which checks certificates from peers).
system_property.xmpp.client.idle=How long, in milliseconds, before idle sessions are dropped. Set to -1 to never drop idle sessions.
system_property.xmpp.client.idle=How long, in milliseconds, before idle client sessions are dropped. Set to -1 to never drop idle sessions.
system_property.xmpp.client.idle.ping=Set to true to ping idle clients, otherwise false
system_property.xmpp.client.version-query.enabled=Send a version request query to clients when they connect.
system_property.xmpp.client.version-query.delay=After this amount of time has passed since a new client connection has been accepted, a version request is being sent to the peer.
Expand All @@ -1682,6 +1683,8 @@ system_property.xmpp.server.outgoing.max.threads=Minimum amount of threads in th
system_property.xmpp.server.outgoing.min.threads=Maximum amount of threads in the thread pool that is used to establish outbound server-to-server connections
system_property.xmpp.server.outgoing.threads-timeout=Amount of time after which idle, surplus threads are removed from the thread pool that is used to establish outbound server-to-server connections.
system_property.xmpp.server.outgoing.queue=Maximum amount of outbound server-to-server connections that can be in process of establishment in the thread pool (surplus connections will be created on the calling thread, possibly / gracefully slowing down other operations considerably)
system_property.xmpp.server.session.initialise-timeout=Maximum amount of time in seconds for an outbound S2S session to be initialised
system_property.xmpp.server.idle=How long, in milliseconds, before idle inbound server sessions are dropped. Set to -1 to never drop idle sessions.
system_property.cluster-monitor.service-enabled=Set to true to send messages to admins on cluster events, otherwise false
system_property.ldap.override.avatar=Set to true to save avatars in the local database, otherwise false
system_property.xmpp.domain=The XMPP domain of this server. Do not change this property directly, instead re-run the setup process.
Expand Down Expand Up @@ -2677,7 +2680,7 @@ ssl.certificates.trust-store.c2s=Trust store used for connections from clients

ssl.certificates.store-management.title=Certificate Stores
ssl.certificates.store-management.info-1=Certificates are used (through TLS and SSL protocols) to establish secure connections between servers and clients. When a secured connection is being created, parties can retrieve a certificate from the other party and (amongst others) examine the issuer of those certificates. If the issuer is trusted, a secured layer of communication can be established.
ssl.certificates.store-management.info-2=Certificates are kept in specialized repositories, or &#39;stores&#39;. Openfire provides two types of stores: <ul><li><em>Identity stores</em> are used to store certificates that identify this instance of Openfire. On request, they certificates from these stores are transmitted to other parties which use them to identify your server. </li> <li><em>Trust stores</em> contain certificates that identify parties that you choose to trust. Trust stores often do not include the certificate from the remote party directly, but instead holds certificates from organizations that are trusted to identify the certificate of the remote party. Such organizations are commonly referred to as "Certificate Authorities".</li></ul>
ssl.certificates.store-management.info-2=Certificates are kept in specialized repositories, or &#39;stores&#39;. Openfire provides two types of stores: <ul><li><em>Identity stores</em> are used to store certificates that identify this instance of Openfire. On request, the certificates from these stores are transmitted to other parties which use them to identify your server. </li> <li><em>Trust stores</em> contain certificates that identify parties that you choose to trust. Trust stores often do not include the certificate from the remote party directly, but instead holds certificates from organizations that are trusted to identify the certificate of the remote party. Such organizations are commonly referred to as "Certificate Authorities".</li></ul>
ssl.certificates.store-management.info-3=This section of the admin panel is dedicated to management of the various key and trust stores that act as repositories for sets of security certificates.
ssl.certificates.store-management.info-4=By default, a small set of stores is re-used for various purposes (as shown on this page), but Openfire <a href="security-certificate-store-management.jsp?showAll=true">allows you to configure a distinct set of stores for each connection type</a>.
ssl.certificates.store-management.combined-stores.title=Certificate Stores
Expand Down
14 changes: 1 addition & 13 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@
<!-- Note; the following jetty.version should be identical to the jetty.version in plugins/pom.xml -->
<jetty.version>9.4.43.v20210629</jetty.version>
<standard-taglib.version>1.2.5</standard-taglib.version>
<mina.version>2.2.1</mina.version>
<netty.version>4.1.94.Final</netty.version>
<bouncycastle.version>1.70</bouncycastle.version>
<slf4j.version>1.7.36</slf4j.version>
<log4j.version>2.17.1</log4j.version>
Expand Down Expand Up @@ -345,18 +345,6 @@
<fail>true</fail>
</configuration>
</plugin>

<!--
The various MINA dependencies rely on OSGi bundle artifacts rather than standard JAR files.
As such, it's necessary to add support for these bundle to Maven using the Apache Felix maven-bundle-plugin.
See https://stackoverflow.com/a/5409602 for a good explanation of OSGi bundles, with links to more info.
-->
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<version>4.2.0</version>
<extensions>true</extensions>
</plugin>
</plugins>
</build>

Expand Down
22 changes: 10 additions & 12 deletions xmppserver/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,23 +285,21 @@
<version>${standard-taglib.version}</version>
</dependency>

<!-- Apache MINA -->
<!-- Netty -->
<dependency>
<groupId>org.apache.mina</groupId>
<artifactId>mina-core</artifactId>
<version>${mina.version}</version>
</dependency>
<dependency>
<groupId>org.apache.mina</groupId>
<artifactId>mina-integration-jmx</artifactId>
<version>${mina.version}</version>
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
<version>${netty.version}</version>
</dependency>

<!-- JZLib -->
<dependency>
<groupId>org.apache.mina</groupId>
<artifactId>mina-filter-compression</artifactId>
<version>${mina.version}</version>
<groupId>com.jcraft</groupId>
<artifactId>jzlib</artifactId>
<version>1.1.3</version>
</dependency>


<!-- BouncyCastle -->
<dependency>
<groupId>org.bouncycastle</groupId>
Expand Down
Loading
Loading