Add support for the TLS registry to the OTEL extension
cescoffier opened this issue · comments
Description
The OTEL extension has an internal HTTP client.
With the integrated TLS registry, it should be possible to configure TLS using the TLS registry instead of the specific OTEL configuration.
Implementation ideas
This is the code used for the mailer:
private void configureTLS(String name, MailerRuntimeConfig config, TlsConfigurationRegistry tlsRegistry, MailConfig cfg,
boolean globalTrustAll) {
TlsConfiguration configuration = null;
// Check if we have a named TLS configuration or a default configuration:
if (config.tlsConfigurationName.isPresent()) {
Optional<TlsConfiguration> maybeConfiguration = tlsRegistry.get(config.tlsConfigurationName.get());
if (!maybeConfiguration.isPresent()) {
throw new IllegalStateException("Unable to find the TLS configuration "
+ config.tlsConfigurationName.get() + " for the mailer " + name + ".");
}
configuration = maybeConfiguration.get();
} else if (tlsRegistry.getDefault().isPresent() && tlsRegistry.getDefault().get().isTlsEnabled()) {
configuration = tlsRegistry.getDefault().get();
}
// Apply the configuration
if (configuration != null) {
// This part is often the same (or close) for every Vert.x client:
cfg.setSsl(true);
if (configuration.getTrustStoreOptions() != null) {
cfg.setTrustOptions(configuration.getTrustStoreOptions());
}
// For mTLS:
if (configuration.getKeyStoreOptions() != null) {
cfg.setKeyCertOptions(configuration.getKeyStoreOptions());
}
if (configuration.isTrustAll()) {
cfg.setTrustAll(true);
}
if (configuration.getHostnameVerificationAlgorithm().isPresent()) {
// ACHTUNG HERE - this is protocol specific. The HTTP-based protocols should use HTTPS by default.
cfg.setHostnameVerificationAlgorithm(configuration.getHostnameVerificationAlgorithm().get());
}
SSLOptions sslOptions = configuration.getSSLOptions();
if (sslOptions != null) {
cfg.setSslHandshakeTimeout(sslOptions.getSslHandshakeTimeout());
cfg.setSslHandshakeTimeoutUnit(sslOptions.getSslHandshakeTimeoutUnit());
for (String suite : sslOptions.getEnabledCipherSuites()) {
cfg.addEnabledCipherSuite(suite);
}
for (Buffer buffer : sslOptions.getCrlValues()) {
cfg.addCrlValue(buffer);
}
cfg.setEnabledSecureTransportProtocols(sslOptions.getEnabledSecureTransportProtocols());
}
} else {
// Mailer specific configuration (very incomplete as you can see:
boolean trustAll = config.trustAll.isPresent() ? config.trustAll.get() : globalTrustAll;
cfg.setSsl(config.ssl);
cfg.setTrustAll(trustAll);
applyTruststore(config, cfg);
}
}
I'll take this one
What I don't see currently is how we know if something has been configured for the default configuration. Asking because it's always resolvable so how do we know if we should choose it or not? Is that what the new isTlsEnabled
flag in the mailer PR does?