mirror of https://github.com/hyperledger/besu
Karim TAAM
10 months ago
committed by
GitHub
commit
6620e1d951
@ -0,0 +1,492 @@ |
||||
/* |
||||
* Copyright Hyperledger Besu Contributors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on |
||||
* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the |
||||
* specific language governing permissions and limitations under the License. |
||||
* |
||||
* SPDX-License-Identifier: Apache-2.0 |
||||
*/ |
||||
package org.hyperledger.besu.cli.options.stable; |
||||
|
||||
import static java.util.Arrays.asList; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.JsonRpcConfiguration.DEFAULT_JSON_RPC_PORT; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.JsonRpcConfiguration.DEFAULT_PRETTY_JSON_ENABLED; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.RpcApis.DEFAULT_RPC_APIS; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.RpcApis.VALID_APIS; |
||||
|
||||
import org.hyperledger.besu.cli.DefaultCommandValues; |
||||
import org.hyperledger.besu.cli.custom.CorsAllowedOriginsProperty; |
||||
import org.hyperledger.besu.cli.custom.RpcAuthFileValidator; |
||||
import org.hyperledger.besu.cli.util.CommandLineUtils; |
||||
import org.hyperledger.besu.ethereum.api.jsonrpc.JsonRpcConfiguration; |
||||
import org.hyperledger.besu.ethereum.api.jsonrpc.RpcMethod; |
||||
import org.hyperledger.besu.ethereum.api.jsonrpc.authentication.JwtAlgorithm; |
||||
import org.hyperledger.besu.ethereum.api.tls.FileBasedPasswordProvider; |
||||
import org.hyperledger.besu.ethereum.api.tls.TlsClientAuthConfiguration; |
||||
import org.hyperledger.besu.ethereum.api.tls.TlsConfiguration; |
||||
|
||||
import java.io.File; |
||||
import java.nio.file.Path; |
||||
import java.security.KeyManagementException; |
||||
import java.security.NoSuchAlgorithmException; |
||||
import java.util.ArrayList; |
||||
import java.util.Arrays; |
||||
import java.util.List; |
||||
import java.util.Optional; |
||||
import java.util.function.Predicate; |
||||
import java.util.stream.Collectors; |
||||
import javax.net.ssl.SSLContext; |
||||
import javax.net.ssl.SSLEngine; |
||||
|
||||
import com.google.common.base.Strings; |
||||
import org.slf4j.Logger; |
||||
import picocli.CommandLine; |
||||
|
||||
/** |
||||
* Handles configuration options for the JSON-RPC HTTP service, including validation and creation of |
||||
* a JSON-RPC configuration. |
||||
*/ |
||||
public class JsonRpcHttpOptions { |
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-enabled"}, |
||||
description = "Set to start the JSON-RPC HTTP service (default: ${DEFAULT-VALUE})") |
||||
private final Boolean isRpcHttpEnabled = false; |
||||
|
||||
@SuppressWarnings({"FieldCanBeFinal", "FieldMayBeFinal"}) // PicoCLI requires non-final Strings.
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-host"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_HOST_FORMAT_HELP, |
||||
description = "Host for JSON-RPC HTTP to listen on (default: ${DEFAULT-VALUE})", |
||||
arity = "1") |
||||
private String rpcHttpHost; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-port"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_PORT_FORMAT_HELP, |
||||
description = "Port for JSON-RPC HTTP to listen on (default: ${DEFAULT-VALUE})", |
||||
arity = "1") |
||||
private final Integer rpcHttpPort = DEFAULT_JSON_RPC_PORT; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-max-active-connections"}, |
||||
description = |
||||
"Maximum number of HTTP connections allowed for JSON-RPC (default: ${DEFAULT-VALUE}). Once this limit is reached, incoming connections will be rejected.", |
||||
arity = "1") |
||||
private final Integer rpcHttpMaxConnections = DefaultCommandValues.DEFAULT_HTTP_MAX_CONNECTIONS; |
||||
|
||||
// A list of origins URLs that are accepted by the JsonRpcHttpServer (CORS)
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-cors-origins"}, |
||||
description = "Comma separated origin domain URLs for CORS validation (default: none)") |
||||
private final CorsAllowedOriginsProperty rpcHttpCorsAllowedOrigins = |
||||
new CorsAllowedOriginsProperty(); |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-api", "--rpc-http-apis"}, |
||||
paramLabel = "<api name>", |
||||
split = " {0,1}, {0,1}", |
||||
arity = "1..*", |
||||
description = |
||||
"Comma separated list of APIs to enable on JSON-RPC HTTP service (default: ${DEFAULT-VALUE})") |
||||
private final List<String> rpcHttpApis = DEFAULT_RPC_APIS; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-api-method-no-auth", "--rpc-http-api-methods-no-auth"}, |
||||
paramLabel = "<api name>", |
||||
split = " {0,1}, {0,1}", |
||||
arity = "1..*", |
||||
description = |
||||
"Comma separated list of API methods to exclude from RPC authentication services, RPC HTTP authentication must be enabled") |
||||
private final List<String> rpcHttpApiMethodsNoAuth = new ArrayList<String>(); |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-authentication-enabled"}, |
||||
description = |
||||
"Require authentication for the JSON-RPC HTTP service (default: ${DEFAULT-VALUE})") |
||||
private final Boolean isRpcHttpAuthenticationEnabled = false; |
||||
|
||||
@SuppressWarnings({"FieldCanBeFinal", "FieldMayBeFinal"}) // PicoCLI requires non-final Strings.
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-authentication-credentials-file"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_FILE_FORMAT_HELP, |
||||
description = |
||||
"Storage file for JSON-RPC HTTP authentication credentials (default: ${DEFAULT-VALUE})", |
||||
arity = "1") |
||||
private String rpcHttpAuthenticationCredentialsFile = null; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-authentication-jwt-public-key-file"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_FILE_FORMAT_HELP, |
||||
description = "JWT public key file for JSON-RPC HTTP authentication", |
||||
arity = "1") |
||||
private final File rpcHttpAuthenticationPublicKeyFile = null; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-authentication-jwt-algorithm"}, |
||||
description = |
||||
"Encryption algorithm used for HTTP JWT public key. Possible values are ${COMPLETION-CANDIDATES}" |
||||
+ " (default: ${DEFAULT-VALUE})", |
||||
arity = "1") |
||||
private final JwtAlgorithm rpcHttpAuthenticationAlgorithm = |
||||
DefaultCommandValues.DEFAULT_JWT_ALGORITHM; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-enabled"}, |
||||
description = "Enable TLS for the JSON-RPC HTTP service (default: ${DEFAULT-VALUE})") |
||||
private final Boolean isRpcHttpTlsEnabled = false; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-keystore-file"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_FILE_FORMAT_HELP, |
||||
description = |
||||
"Keystore (PKCS#12) containing key/certificate for the JSON-RPC HTTP service. Required if TLS is enabled.") |
||||
private final Path rpcHttpTlsKeyStoreFile = null; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-keystore-password-file"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_FILE_FORMAT_HELP, |
||||
description = |
||||
"File containing password to unlock keystore for the JSON-RPC HTTP service. Required if TLS is enabled.") |
||||
private final Path rpcHttpTlsKeyStorePasswordFile = null; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-client-auth-enabled"}, |
||||
description = |
||||
"Enable TLS client authentication for the JSON-RPC HTTP service (default: ${DEFAULT-VALUE})") |
||||
private final Boolean isRpcHttpTlsClientAuthEnabled = false; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-known-clients-file"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_FILE_FORMAT_HELP, |
||||
description = |
||||
"Path to file containing clients certificate common name and fingerprint for client authentication") |
||||
private final Path rpcHttpTlsKnownClientsFile = null; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-ca-clients-enabled"}, |
||||
description = |
||||
"Enable to accept clients certificate signed by a valid CA for client authentication (default: ${DEFAULT-VALUE})") |
||||
private final Boolean isRpcHttpTlsCAClientsEnabled = false; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-protocol", "--rpc-http-tls-protocols"}, |
||||
description = "Comma separated list of TLS protocols to support (default: ${DEFAULT-VALUE})", |
||||
split = ",", |
||||
arity = "1..*") |
||||
private final List<String> rpcHttpTlsProtocols = |
||||
new ArrayList<>(DefaultCommandValues.DEFAULT_TLS_PROTOCOLS); |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-tls-cipher-suite", "--rpc-http-tls-cipher-suites"}, |
||||
description = "Comma separated list of TLS cipher suites to support", |
||||
split = ",", |
||||
arity = "1..*") |
||||
private final List<String> rpcHttpTlsCipherSuites = new ArrayList<>(); |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-max-batch-size"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_INTEGER_FORMAT_HELP, |
||||
description = |
||||
"Specifies the maximum number of requests in a single RPC batch request via RPC. -1 specifies no limit (default: ${DEFAULT-VALUE})") |
||||
private final Integer rpcHttpMaxBatchSize = DefaultCommandValues.DEFAULT_HTTP_MAX_BATCH_SIZE; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--rpc-http-max-request-content-length"}, |
||||
paramLabel = DefaultCommandValues.MANDATORY_LONG_FORMAT_HELP, |
||||
description = "Specifies the maximum request content length. (default: ${DEFAULT-VALUE})") |
||||
private final Long rpcHttpMaxRequestContentLength = |
||||
DefaultCommandValues.DEFAULT_MAX_REQUEST_CONTENT_LENGTH; |
||||
|
||||
@CommandLine.Option( |
||||
names = {"--json-pretty-print-enabled"}, |
||||
description = "Enable JSON pretty print format (default: ${DEFAULT-VALUE})") |
||||
private final Boolean prettyJsonEnabled = DEFAULT_PRETTY_JSON_ENABLED; |
||||
|
||||
/** |
||||
* Validates the Rpc Http options. |
||||
* |
||||
* @param logger Logger instance |
||||
* @param commandLine CommandLine instance |
||||
* @param configuredApis Predicate for configured APIs |
||||
*/ |
||||
public void validate( |
||||
final Logger logger, final CommandLine commandLine, final Predicate<String> configuredApis) { |
||||
|
||||
if (!rpcHttpApis.stream().allMatch(configuredApis)) { |
||||
final List<String> invalidHttpApis = new ArrayList<>(rpcHttpApis); |
||||
invalidHttpApis.removeAll(VALID_APIS); |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"Invalid value for option '--rpc-http-api': invalid entries found " + invalidHttpApis); |
||||
} |
||||
|
||||
final boolean validHttpApiMethods = |
||||
rpcHttpApiMethodsNoAuth.stream().allMatch(RpcMethod::rpcMethodExists); |
||||
|
||||
if (!validHttpApiMethods) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"Invalid value for option '--rpc-http-api-methods-no-auth', options must be valid RPC methods"); |
||||
} |
||||
|
||||
if (isRpcHttpAuthenticationEnabled) { |
||||
CommandLineUtils.checkOptionDependencies( |
||||
logger, |
||||
commandLine, |
||||
"--rpc-http-authentication-public-key-file", |
||||
rpcHttpAuthenticationPublicKeyFile == null, |
||||
List.of("--rpc-http-authentication-jwt-algorithm")); |
||||
} |
||||
|
||||
if (isRpcHttpAuthenticationEnabled |
||||
&& rpcHttpAuthenticationCredentialsFile(commandLine) == null |
||||
&& rpcHttpAuthenticationPublicKeyFile == null) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"Unable to authenticate JSON-RPC HTTP endpoint without a supplied credentials file or authentication public key file"); |
||||
} |
||||
|
||||
checkDependencies(logger, commandLine); |
||||
|
||||
if (isRpcTlsConfigurationRequired()) { |
||||
validateTls(commandLine); |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* Creates a JsonRpcConfiguration based on the provided options. |
||||
* |
||||
* @param hostsAllowlist List of hosts allowed |
||||
* @param defaultHostAddress Default host address |
||||
* @param timoutSec timeout in seconds |
||||
* @return A JsonRpcConfiguration instance |
||||
*/ |
||||
public JsonRpcConfiguration jsonRpcConfiguration( |
||||
final List<String> hostsAllowlist, final String defaultHostAddress, final Long timoutSec) { |
||||
|
||||
final JsonRpcConfiguration jsonRpcConfiguration = JsonRpcConfiguration.createDefault(); |
||||
jsonRpcConfiguration.setEnabled(isRpcHttpEnabled); |
||||
jsonRpcConfiguration.setHost( |
||||
Strings.isNullOrEmpty(rpcHttpHost) ? defaultHostAddress : rpcHttpHost); |
||||
jsonRpcConfiguration.setPort(rpcHttpPort); |
||||
jsonRpcConfiguration.setMaxActiveConnections(rpcHttpMaxConnections); |
||||
jsonRpcConfiguration.setCorsAllowedDomains(rpcHttpCorsAllowedOrigins); |
||||
jsonRpcConfiguration.setRpcApis(rpcHttpApis.stream().distinct().collect(Collectors.toList())); |
||||
jsonRpcConfiguration.setNoAuthRpcApis( |
||||
rpcHttpApiMethodsNoAuth.stream().distinct().collect(Collectors.toList())); |
||||
jsonRpcConfiguration.setHostsAllowlist(hostsAllowlist); |
||||
jsonRpcConfiguration.setAuthenticationEnabled(isRpcHttpAuthenticationEnabled); |
||||
jsonRpcConfiguration.setAuthenticationCredentialsFile(rpcHttpAuthenticationCredentialsFile); |
||||
jsonRpcConfiguration.setAuthenticationPublicKeyFile(rpcHttpAuthenticationPublicKeyFile); |
||||
jsonRpcConfiguration.setAuthenticationAlgorithm(rpcHttpAuthenticationAlgorithm); |
||||
jsonRpcConfiguration.setTlsConfiguration(rpcHttpTlsConfiguration()); |
||||
jsonRpcConfiguration.setHttpTimeoutSec(timoutSec); |
||||
jsonRpcConfiguration.setMaxBatchSize(rpcHttpMaxBatchSize); |
||||
jsonRpcConfiguration.setMaxRequestContentLength(rpcHttpMaxRequestContentLength); |
||||
jsonRpcConfiguration.setPrettyJsonEnabled(prettyJsonEnabled); |
||||
return jsonRpcConfiguration; |
||||
} |
||||
|
||||
/** |
||||
* Checks dependencies between options. |
||||
* |
||||
* @param logger Logger instance |
||||
* @param commandLine CommandLine instance |
||||
*/ |
||||
public void checkDependencies(final Logger logger, final CommandLine commandLine) { |
||||
checkRpcTlsClientAuthOptionsDependencies(logger, commandLine); |
||||
checkRpcTlsOptionsDependencies(logger, commandLine); |
||||
checkRpcHttpOptionsDependencies(logger, commandLine); |
||||
} |
||||
|
||||
private void checkRpcTlsClientAuthOptionsDependencies( |
||||
final Logger logger, final CommandLine commandLine) { |
||||
CommandLineUtils.checkOptionDependencies( |
||||
logger, |
||||
commandLine, |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
!isRpcHttpTlsClientAuthEnabled, |
||||
asList("--rpc-http-tls-known-clients-file", "--rpc-http-tls-ca-clients-enabled")); |
||||
} |
||||
|
||||
private void checkRpcTlsOptionsDependencies(final Logger logger, final CommandLine commandLine) { |
||||
CommandLineUtils.checkOptionDependencies( |
||||
logger, |
||||
commandLine, |
||||
"--rpc-http-tls-enabled", |
||||
!isRpcHttpTlsEnabled, |
||||
asList( |
||||
"--rpc-http-tls-keystore-file", |
||||
"--rpc-http-tls-keystore-password-file", |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
"--rpc-http-tls-known-clients-file", |
||||
"--rpc-http-tls-ca-clients-enabled", |
||||
"--rpc-http-tls-protocols", |
||||
"--rpc-http-tls-cipher-suite", |
||||
"--rpc-http-tls-cipher-suites")); |
||||
} |
||||
|
||||
private void checkRpcHttpOptionsDependencies(final Logger logger, final CommandLine commandLine) { |
||||
CommandLineUtils.checkOptionDependencies( |
||||
logger, |
||||
commandLine, |
||||
"--rpc-http-enabled", |
||||
!isRpcHttpEnabled, |
||||
asList( |
||||
"--rpc-http-api", |
||||
"--rpc-http-apis", |
||||
"--rpc-http-api-method-no-auth", |
||||
"--rpc-http-api-methods-no-auth", |
||||
"--rpc-http-cors-origins", |
||||
"--rpc-http-host", |
||||
"--rpc-http-port", |
||||
"--rpc-http-max-active-connections", |
||||
"--rpc-http-authentication-enabled", |
||||
"--rpc-http-authentication-credentials-file", |
||||
"--rpc-http-authentication-public-key-file", |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
"--rpc-http-tls-keystore-password-file", |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
"--rpc-http-tls-known-clients-file", |
||||
"--rpc-http-tls-ca-clients-enabled", |
||||
"--rpc-http-authentication-jwt-algorithm", |
||||
"--rpc-http-tls-protocols", |
||||
"--rpc-http-tls-cipher-suite", |
||||
"--rpc-http-tls-cipher-suites")); |
||||
} |
||||
|
||||
private void validateTls(final CommandLine commandLine) { |
||||
if (rpcHttpTlsKeyStoreFile == null) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, "Keystore file is required when TLS is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
if (rpcHttpTlsKeyStorePasswordFile == null) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"File containing password to unlock keystore is required when TLS is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
if (isRpcHttpTlsClientAuthEnabled |
||||
&& !isRpcHttpTlsCAClientsEnabled |
||||
&& rpcHttpTlsKnownClientsFile == null) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"Known-clients file must be specified or CA clients must be enabled when TLS client authentication is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
rpcHttpTlsProtocols.retainAll(getJDKEnabledProtocols()); |
||||
if (rpcHttpTlsProtocols.isEmpty()) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, |
||||
"No valid TLS protocols specified (the following protocols are enabled: " |
||||
+ getJDKEnabledProtocols() |
||||
+ ")"); |
||||
} |
||||
|
||||
for (final String cipherSuite : rpcHttpTlsCipherSuites) { |
||||
if (!getJDKEnabledCipherSuites().contains(cipherSuite)) { |
||||
throw new CommandLine.ParameterException( |
||||
commandLine, "Invalid TLS cipher suite specified " + cipherSuite); |
||||
} |
||||
} |
||||
} |
||||
|
||||
private Optional<TlsConfiguration> rpcHttpTlsConfiguration() { |
||||
if (!isRpcTlsConfigurationRequired()) { |
||||
return Optional.empty(); |
||||
} |
||||
|
||||
rpcHttpTlsCipherSuites.retainAll(getJDKEnabledCipherSuites()); |
||||
|
||||
return Optional.of( |
||||
TlsConfiguration.Builder.aTlsConfiguration() |
||||
.withKeyStorePath(rpcHttpTlsKeyStoreFile) |
||||
.withKeyStorePasswordSupplier( |
||||
new FileBasedPasswordProvider(rpcHttpTlsKeyStorePasswordFile)) |
||||
.withClientAuthConfiguration(rpcHttpTlsClientAuthConfiguration()) |
||||
.withSecureTransportProtocols(rpcHttpTlsProtocols) |
||||
.withCipherSuites(rpcHttpTlsCipherSuites) |
||||
.build()); |
||||
} |
||||
|
||||
private boolean isRpcTlsConfigurationRequired() { |
||||
return isRpcHttpEnabled && isRpcHttpTlsEnabled; |
||||
} |
||||
|
||||
private TlsClientAuthConfiguration rpcHttpTlsClientAuthConfiguration() { |
||||
if (isRpcHttpTlsClientAuthEnabled) { |
||||
return TlsClientAuthConfiguration.Builder.aTlsClientAuthConfiguration() |
||||
.withKnownClientsFile(rpcHttpTlsKnownClientsFile) |
||||
.withCaClientsEnabled(isRpcHttpTlsCAClientsEnabled) |
||||
.build(); |
||||
} |
||||
|
||||
return null; |
||||
} |
||||
|
||||
private static List<String> getJDKEnabledCipherSuites() { |
||||
try { |
||||
final SSLContext context = SSLContext.getInstance("TLS"); |
||||
context.init(null, null, null); |
||||
final SSLEngine engine = context.createSSLEngine(); |
||||
return Arrays.asList(engine.getEnabledCipherSuites()); |
||||
} catch (final KeyManagementException | NoSuchAlgorithmException e) { |
||||
throw new RuntimeException(e); |
||||
} |
||||
} |
||||
|
||||
private static List<String> getJDKEnabledProtocols() { |
||||
try { |
||||
final SSLContext context = SSLContext.getInstance("TLS"); |
||||
context.init(null, null, null); |
||||
final SSLEngine engine = context.createSSLEngine(); |
||||
return Arrays.asList(engine.getEnabledProtocols()); |
||||
} catch (final KeyManagementException | NoSuchAlgorithmException e) { |
||||
throw new RuntimeException(e); |
||||
} |
||||
} |
||||
|
||||
private String rpcHttpAuthenticationCredentialsFile(final CommandLine commandLine) { |
||||
final String filename = rpcHttpAuthenticationCredentialsFile; |
||||
|
||||
if (filename != null) { |
||||
RpcAuthFileValidator.validate(commandLine, filename, "HTTP"); |
||||
} |
||||
return filename; |
||||
} |
||||
|
||||
/** |
||||
* Returns the list of APIs enabled for RPC over HTTP. |
||||
* |
||||
* @return A list of APIs |
||||
*/ |
||||
public List<String> getRpcHttpApis() { |
||||
return rpcHttpApis; |
||||
} |
||||
|
||||
/** |
||||
* Returns the port for RPC over HTTP. |
||||
* |
||||
* @return The port number |
||||
*/ |
||||
public Integer getRpcHttpPort() { |
||||
return rpcHttpPort; |
||||
} |
||||
|
||||
/** |
||||
* Checks if RPC over HTTP is enabled. |
||||
* |
||||
* @return true if enabled, false otherwise |
||||
*/ |
||||
public Boolean isRpcHttpEnabled() { |
||||
return isRpcHttpEnabled; |
||||
} |
||||
} |
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,926 @@ |
||||
/* |
||||
* Copyright Hyperledger Besu Contributors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with |
||||
* the License. You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on |
||||
* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the |
||||
* specific language governing permissions and limitations under the License. |
||||
* |
||||
* SPDX-License-Identifier: Apache-2.0 |
||||
*/ |
||||
package org.hyperledger.besu.cli.options; |
||||
|
||||
import static java.nio.charset.StandardCharsets.UTF_8; |
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.RpcApis.ETH; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.RpcApis.NET; |
||||
import static org.hyperledger.besu.ethereum.api.jsonrpc.RpcApis.PERM; |
||||
import static org.mockito.Mockito.times; |
||||
import static org.mockito.Mockito.verify; |
||||
import static org.mockito.Mockito.verifyNoInteractions; |
||||
|
||||
import org.hyperledger.besu.cli.CommandTestAbstract; |
||||
import org.hyperledger.besu.ethereum.api.jsonrpc.RpcMethod; |
||||
import org.hyperledger.besu.ethereum.api.jsonrpc.authentication.JwtAlgorithm; |
||||
import org.hyperledger.besu.ethereum.api.tls.TlsConfiguration; |
||||
import org.hyperledger.besu.plugin.services.rpc.PluginRpcRequest; |
||||
|
||||
import java.io.IOException; |
||||
import java.net.ServerSocket; |
||||
import java.nio.file.Files; |
||||
import java.nio.file.Path; |
||||
import java.util.Optional; |
||||
import java.util.function.Function; |
||||
|
||||
import org.junit.jupiter.api.Test; |
||||
import org.junit.jupiter.api.extension.ExtendWith; |
||||
import org.mockito.Mockito; |
||||
import org.mockito.junit.jupiter.MockitoExtension; |
||||
|
||||
@ExtendWith(MockitoExtension.class) |
||||
public class JsonRpcHttpOptionsTest extends CommandTestAbstract { |
||||
|
||||
@Test |
||||
public void rpcHttpEnabledPropertyMustBeUsed() { |
||||
parseCommand("--rpc-http-enabled"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().isEnabled()).isTrue(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcApisPropertyMustBeUsed() { |
||||
parseCommand("--rpc-http-api", "ETH,NET,PERM", "--rpc-http-enabled"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
verify(mockLogger) |
||||
.warn("Permissions are disabled. Cannot enable PERM APIs when not using Permissions."); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getRpcApis()) |
||||
.containsExactlyInAnyOrder(ETH.name(), NET.name(), PERM.name()); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcApisPropertyIgnoresDuplicatesAndMustBeUsed() { |
||||
parseCommand("--rpc-http-api", "ETH,NET,NET", "--rpc-http-enabled"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getRpcApis()) |
||||
.containsExactlyInAnyOrder(ETH.name(), NET.name()); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcApiNoAuthMethodsIgnoresDuplicatesAndMustBeUsed() { |
||||
parseCommand( |
||||
"--rpc-http-api-methods-no-auth", |
||||
"admin_peers, admin_peers, eth_getWork", |
||||
"--rpc-http-enabled"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getNoAuthRpcApis()) |
||||
.containsExactlyInAnyOrder( |
||||
RpcMethod.ADMIN_PEERS.getMethodName(), RpcMethod.ETH_GET_WORK.getMethodName()); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpNoAuthApiMethodsCannotBeInvalid() { |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-api-method-no-auth", "invalid"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains( |
||||
"Invalid value for option '--rpc-http-api-methods-no-auth', options must be valid RPC methods"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpOptionsRequiresServiceToBeEnabled() { |
||||
parseCommand( |
||||
"--rpc-http-api", |
||||
"ETH,NET", |
||||
"--rpc-http-host", |
||||
"0.0.0.0", |
||||
"--rpc-http-port", |
||||
"1234", |
||||
"--rpc-http-cors-origins", |
||||
"all", |
||||
"--rpc-http-max-active-connections", |
||||
"88"); |
||||
|
||||
verifyOptionsConstraintLoggerCall( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
"--rpc-http-port", |
||||
"--rpc-http-cors-origins", |
||||
"--rpc-http-api", |
||||
"--rpc-http-max-active-connections"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpOptionsRequiresServiceToBeEnabledToml() throws IOException { |
||||
final Path toml = |
||||
createTempFile( |
||||
"toml", |
||||
"rpc-http-api=[\"ETH\",\"NET\"]\n" |
||||
+ "rpc-http-host=\"0.0.0.0\"\n" |
||||
+ "rpc-http-port=1234\n" |
||||
+ "rpc-http-cors-origins=[\"all\"]\n" |
||||
+ "rpc-http-max-active-connections=88"); |
||||
|
||||
parseCommand("--config-file", toml.toString()); |
||||
|
||||
verifyOptionsConstraintLoggerCall( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
"--rpc-http-port", |
||||
"--rpc-http-cors-origins", |
||||
"--rpc-http-api", |
||||
"--rpc-http-max-active-connections"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpHostAndPortOptionsMustBeUsed() { |
||||
|
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
parseCommand( |
||||
"--rpc-http-enabled", "--rpc-http-host", host, "--rpc-http-port", String.valueOf(port)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpHostMayBeLocalhost() { |
||||
|
||||
final String host = "localhost"; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-host", host); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpHostMayBeIPv6() { |
||||
|
||||
final String host = "2600:DB8::8545"; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-host", host); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpMaxActiveConnectionsPropertyMustBeUsed() { |
||||
final int maxConnections = 99; |
||||
parseCommand("--rpc-http-max-active-connections", String.valueOf(maxConnections)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getMaxActiveConnections()) |
||||
.isEqualTo(maxConnections); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsRequiresRpcHttpEnabled() { |
||||
parseCommand("--rpc-http-tls-enabled"); |
||||
|
||||
verifyOptionsConstraintLoggerCall("--rpc-http-enabled", "--rpc-http-tls-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsRequiresRpcHttpEnabledToml() throws IOException { |
||||
final Path toml = createTempFile("toml", "rpc-http-tls-enabled=true\n"); |
||||
|
||||
parseCommand("--config-file", toml.toString()); |
||||
|
||||
verifyOptionsConstraintLoggerCall("--rpc-http-enabled", "--rpc-http-tls-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsWithoutKeystoreReportsError() { |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-tls-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Keystore file is required when TLS is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsWithoutPasswordfileReportsError() { |
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
"/tmp/test.p12"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains( |
||||
"File containing password to unlock keystore is required when TLS is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsKeystoreAndPasswordMustBeUsed() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration.isPresent()).isTrue(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().isEmpty()).isTrue(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsClientAuthWithoutKnownFileReportsError() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-client-auth-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains( |
||||
"Known-clients file must be specified or CA clients must be enabled when TLS client authentication is enabled for JSON-RPC HTTP endpoint"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsClientAuthWithKnownClientFile() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
final String knownClientFile = "/tmp/knownClientFile"; |
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
"--rpc-http-tls-known-clients-file", |
||||
knownClientFile); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration.isPresent()).isTrue(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().isPresent()).isTrue(); |
||||
assertThat( |
||||
tlsConfiguration.get().getClientAuthConfiguration().get().getKnownClientsFile().get()) |
||||
.isEqualTo(Path.of(knownClientFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().get().isCaClientsEnabled()) |
||||
.isFalse(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsClientAuthWithCAClient() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
"--rpc-http-tls-ca-clients-enabled"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration.isPresent()).isTrue(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().isPresent()).isTrue(); |
||||
assertThat( |
||||
tlsConfiguration |
||||
.get() |
||||
.getClientAuthConfiguration() |
||||
.get() |
||||
.getKnownClientsFile() |
||||
.isEmpty()) |
||||
.isTrue(); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().get().isCaClientsEnabled()) |
||||
.isTrue(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsClientAuthWithCAClientAndKnownClientFile() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
final String knownClientFile = "/tmp/knownClientFile"; |
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-client-auth-enabled", |
||||
"--rpc-http-tls-ca-clients-enabled", |
||||
"--rpc-http-tls-known-clients-file", |
||||
knownClientFile); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration.isPresent()).isTrue(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().isPresent()).isTrue(); |
||||
assertThat( |
||||
tlsConfiguration.get().getClientAuthConfiguration().get().getKnownClientsFile().get()) |
||||
.isEqualTo(Path.of(knownClientFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration().get().isCaClientsEnabled()) |
||||
.isTrue(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsCheckDefaultProtocolsAndCipherSuites() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration).isPresent(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration()).isEmpty(); |
||||
assertThat(tlsConfiguration.get().getCipherSuites().get()).isEmpty(); |
||||
assertThat(tlsConfiguration.get().getSecureTransportProtocols().get()) |
||||
.containsExactly("TLSv1.3", "TLSv1.2"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsCheckInvalidProtocols() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
final String protocol = "TLsv1.4"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-protocols", |
||||
protocol); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).contains("No valid TLS protocols specified"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsCheckInvalidCipherSuites() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
final String cipherSuites = "Invalid"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-cipher-suites", |
||||
cipherSuites); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Invalid TLS cipher suite specified " + cipherSuites); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsCheckValidProtocolsAndCipherSuites() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String keystoreFile = "/tmp/test.p12"; |
||||
final String keystorePasswordFile = "/tmp/test.txt"; |
||||
final String protocols = "TLSv1.3,TLSv1.2"; |
||||
final String cipherSuites = |
||||
"TLS_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-enabled", |
||||
"--rpc-http-tls-keystore-file", |
||||
keystoreFile, |
||||
"--rpc-http-tls-keystore-password-file", |
||||
keystorePasswordFile, |
||||
"--rpc-http-tls-protocols", |
||||
protocols, |
||||
"--rpc-http-tls-cipher-suites", |
||||
cipherSuites); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getHost()).isEqualTo(host); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
final Optional<TlsConfiguration> tlsConfiguration = |
||||
jsonRpcConfigArgumentCaptor.getValue().getTlsConfiguration(); |
||||
assertThat(tlsConfiguration).isPresent(); |
||||
assertThat(tlsConfiguration.get().getKeyStorePath()).isEqualTo(Path.of(keystoreFile)); |
||||
assertThat(tlsConfiguration.get().getClientAuthConfiguration()).isEmpty(); |
||||
assertThat(tlsConfiguration.get().getCipherSuites().get()) |
||||
.containsExactlyInAnyOrder( |
||||
"TLS_AES_256_GCM_SHA384", |
||||
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", |
||||
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"); |
||||
assertThat(tlsConfiguration.get().getSecureTransportProtocols().get()) |
||||
.containsExactlyInAnyOrder("TLSv1.2", "TLSv1.3"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpTlsWarnIfCipherSuitesSpecifiedWithoutTls() { |
||||
final String host = "1.2.3.4"; |
||||
final int port = 1234; |
||||
final String cipherSuites = "Invalid"; |
||||
|
||||
parseCommand( |
||||
"--rpc-http-enabled", |
||||
"--engine-rpc-enabled", |
||||
"--rpc-http-host", |
||||
host, |
||||
"--rpc-http-port", |
||||
String.valueOf(port), |
||||
"--rpc-http-tls-cipher-suite", |
||||
cipherSuites); |
||||
verify( |
||||
mockLogger, |
||||
times(2)) // this is verified for both the full suite of apis, and the engine group.
|
||||
.warn( |
||||
"{} has been ignored because {} was not defined on the command line.", |
||||
"--rpc-http-tls-cipher-suite", |
||||
"--rpc-http-tls-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsTwoDomainsMustBuildListWithBothDomains() { |
||||
final String[] origins = {"http://domain1.com", "https://domain2.com"}; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getCorsAllowedDomains().toArray()) |
||||
.isEqualTo(origins); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsDoubleCommaFilteredOut() { |
||||
final String[] origins = {"http://domain1.com", "https://domain2.com"}; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-cors-origins", String.join(",,", origins)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getCorsAllowedDomains().toArray()) |
||||
.isEqualTo(origins); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsWithWildcardMustBuildListWithWildcard() { |
||||
final String[] origins = {"*"}; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getCorsAllowedDomains().toArray()) |
||||
.isEqualTo(origins); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsWithAllMustBuildListWithWildcard() { |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-cors-origins", "all"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getCorsAllowedDomains()).containsExactly("*"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsWithNoneMustBuildEmptyList() { |
||||
final String[] origins = {"none"}; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getCorsAllowedDomains()).isEmpty(); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsNoneWithAnotherDomainMustFail() { |
||||
final String[] origins = {"http://domain1.com", "none"}; |
||||
parseCommand("--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Value 'none' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsNoneWithAnotherDomainMustFailNoneFirst() { |
||||
final String[] origins = {"none", "http://domain1.com"}; |
||||
parseCommand("--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Value 'none' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsAllWithAnotherDomainMustFail() { |
||||
parseCommand("--rpc-http-cors-origins=http://domain1.com,all"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Values '*' or 'all' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsAllWithAnotherDomainMustFailAsFlags() { |
||||
parseCommand("--rpc-http-cors-origins=http://domain1.com", "--rpc-http-cors-origins=all"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Values '*' or 'all' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsWildcardWithAnotherDomainMustFail() { |
||||
parseCommand("--rpc-http-cors-origins=http://domain1.com,*"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Values '*' or 'all' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsWildcardWithAnotherDomainMustFailAsFlags() { |
||||
parseCommand("--rpc-http-cors-origins=http://domain1.com", "--rpc-http-cors-origins=*"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Values '*' or 'all' can't be used with other domains"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsInvalidRegexShouldFail() { |
||||
final String[] origins = {"**"}; |
||||
parseCommand("--rpc-http-cors-origins", String.join(",", origins)); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Domain values result in invalid regex pattern"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpCorsOriginsEmptyValueFails() { |
||||
parseCommand("--rpc-http-cors-origins="); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Domain cannot be empty string or null string."); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcApisPropertyWithInvalidEntryMustDisplayError() { |
||||
parseCommand("--rpc-http-api", "BOB"); |
||||
|
||||
Mockito.verifyNoInteractions(mockRunnerBuilder); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
// PicoCLI uses longest option name for message when option has multiple names, so here plural.
|
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Invalid value for option '--rpc-http-api': invalid entries found [BOB]"); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcApisPropertyWithPluginNamespaceAreValid() { |
||||
|
||||
rpcEndpointServiceImpl.registerRPCEndpoint( |
||||
"bob", "method", (Function<PluginRpcRequest, Object>) request -> "nothing"); |
||||
|
||||
parseCommand("--rpc-http-api", "BOB"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getRpcApis()) |
||||
.containsExactlyInAnyOrder("BOB"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpMaxRequestContentLengthOptionMustBeUsed() { |
||||
final int rpcHttpMaxRequestContentLength = 1; |
||||
parseCommand( |
||||
"--rpc-http-max-request-content-length", Long.toString(rpcHttpMaxRequestContentLength)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getMaxRequestContentLength()) |
||||
.isEqualTo(rpcHttpMaxRequestContentLength); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void rpcHttpMaxBatchSizeOptionMustBeUsed() { |
||||
final int rpcHttpMaxBatchSize = 1; |
||||
parseCommand("--rpc-http-max-batch-size", Integer.toString(rpcHttpMaxBatchSize)); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getMaxBatchSize()) |
||||
.isEqualTo(rpcHttpMaxBatchSize); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void portInUseReportsError() throws IOException { |
||||
final ServerSocket serverSocket = new ServerSocket(8545); |
||||
|
||||
parseCommandWithPortCheck("--rpc-http-enabled"); |
||||
|
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains("Port(s) '[8545]' already in use. Check for other processes using the port(s)."); |
||||
|
||||
serverSocket.close(); |
||||
} |
||||
|
||||
@Test |
||||
public void assertThatCheckPortClashRejectsAsExpected() throws Exception { |
||||
// use WS port for HTTP
|
||||
final int port = 8546; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-port", String.valueOf(port), "--rpc-ws-enabled"); |
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains( |
||||
"Port number '8546' has been specified multiple times. Please review the supplied configuration."); |
||||
} |
||||
|
||||
@Test |
||||
public void assertThatCheckPortClashAcceptsAsExpected() throws Exception { |
||||
// use WS port for HTTP
|
||||
final int port = 8546; |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-port", String.valueOf(port)); |
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getPort()).isEqualTo(port); |
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
public void httpAuthenticationWithoutRequiredConfiguredOptionsMustFail() { |
||||
parseCommand("--rpc-http-enabled", "--rpc-http-authentication-enabled"); |
||||
|
||||
verifyNoInteractions(mockRunnerBuilder); |
||||
assertThat(commandOutput.toString(UTF_8)).isEmpty(); |
||||
assertThat(commandErrorOutput.toString(UTF_8)) |
||||
.contains( |
||||
"Unable to authenticate JSON-RPC HTTP endpoint without a supplied credentials file or authentication public key file"); |
||||
} |
||||
|
||||
@Test |
||||
public void httpAuthenticationAlgorithIsConfigured() { |
||||
parseCommand("--rpc-http-authentication-jwt-algorithm", "ES256"); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getAuthenticationAlgorithm()) |
||||
.isEqualTo(JwtAlgorithm.ES256); |
||||
} |
||||
|
||||
@Test |
||||
public void httpAuthenticationPublicKeyIsConfigured() throws IOException { |
||||
final Path publicKey = Files.createTempFile("public_key", ""); |
||||
parseCommand("--rpc-http-authentication-jwt-public-key-file", publicKey.toString()); |
||||
|
||||
verify(mockRunnerBuilder).jsonRpcConfiguration(jsonRpcConfigArgumentCaptor.capture()); |
||||
verify(mockRunnerBuilder).build(); |
||||
|
||||
assertThat(jsonRpcConfigArgumentCaptor.getValue().getAuthenticationPublicKeyFile().getPath()) |
||||
.isEqualTo(publicKey.toString()); |
||||
} |
||||
} |
||||
Loading…
Reference in new issue