From 26cf16e43ec1d35199aa1f2ef0d18b1df423e2d8 Mon Sep 17 00:00:00 2001 From: BitterPanda63 Date: Fri, 27 Jun 2025 17:34:28 +0200 Subject: [PATCH 1/4] create a default ssl context --- .../background/cloud/RealtimeAPI.java | 17 +++++++ .../cloud/api/ReportingApiHTTP.java | 46 ++++++++++++++----- 2 files changed, 52 insertions(+), 11 deletions(-) diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java index 6b275cb8f..dbdd8f3e6 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java @@ -11,6 +11,9 @@ import java.net.http.HttpResponse; import java.time.Duration; import java.util.Optional; +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManagerFactory; +import java.security.KeyStore; import static dev.aikido.agent_api.helpers.env.Endpoints.getAikidoRealtimeEndpoint; @@ -25,10 +28,24 @@ public RealtimeAPI(Token token) { this.token = token; } public record ConfigResponse(long configUpdatedAt) {} + + private SSLContext createDefaultSSLContext() throws Exception { + // Get the default TrustManagerFactory + TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + trustManagerFactory.init((KeyStore) null); // Use the default trust store + + // Create an SSLContext with the default TrustManager + SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, trustManagerFactory.getTrustManagers(), null); + + return sslContext; + } + public Optional getConfig() { try { HttpClient httpClient = HttpClient.newBuilder() .connectTimeout(Duration.ofSeconds(timeoutInSec)) + .sslContext(createDefaultSSLContext()) .build(); URI uri = URI.create(endpoint + "config"); HttpRequest request = createConfigRequest(token.get(), uri); diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java index 602bcaaa8..42bb118d4 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java @@ -17,6 +17,9 @@ import java.time.Duration; import java.util.Optional; import java.util.zip.GZIPInputStream; +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManagerFactory; +import java.security.KeyStore; public class ReportingApiHTTP extends ReportingApi { private final Logger logger = LogManager.getLogger(ReportingApiHTTP.class); @@ -30,10 +33,23 @@ public ReportingApiHTTP(String reportingUrl, int timeoutInSec, Token token) { this.token = token; } + private SSLContext createDefaultSSLContext() throws Exception { + // Get the default TrustManagerFactory + TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + trustManagerFactory.init((KeyStore) null); // Use the default trust store + + // Create an SSLContext with the default TrustManager + SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, trustManagerFactory.getTrustManagers(), null); + + return sslContext; + } + public Optional fetchNewConfig() { try { HttpClient httpClient = HttpClient.newBuilder() .connectTimeout(Duration.ofSeconds(timeoutInSec)) + .sslContext(createDefaultSSLContext()) .build(); URI uri = URI.create(reportingUrl + "api/runtime/config"); @@ -54,6 +70,7 @@ public Optional report(APIEvent event) { try { HttpClient httpClient = HttpClient.newBuilder() .connectTimeout(Duration.ofSeconds(timeoutInSec)) + .sslContext(createDefaultSSLContext()) .build(); URI uri = URI.create(reportingUrl + "api/runtime/events"); @@ -75,25 +92,32 @@ public Optional fetchBlockedLists() { return Optional.empty(); } try { - // Make a GET request to api/runtime/firewall/lists - URL url = new URL(reportingUrl + "api/runtime/firewall/lists"); - HttpURLConnection connection = (HttpURLConnection) url.openConnection(); - connection.setRequestMethod("GET"); + HttpClient httpClient = HttpClient.newBuilder() + .connectTimeout(Duration.ofSeconds(timeoutInSec)) + .sslContext(createDefaultSSLContext()) + .build(); - // Set the Accept-Encoding header to gzip - connection.setRequestProperty("Accept-Encoding", "gzip"); - connection.setRequestProperty("Authorization", token.get()); + URI uri = URI.create(reportingUrl + "api/runtime/firewall/lists"); + HttpRequest request = HttpRequest.newBuilder() + .uri(uri) + .timeout(Duration.ofSeconds(timeoutInSec)) + .header("Accept-Encoding", "gzip") + .header("Authorization", token.get()) + .build(); - if (connection.getResponseCode() != HttpURLConnection.HTTP_OK) { + // Send the request and get the response + HttpResponse httpResponse = httpClient.send(request, HttpResponse.BodyHandlers.ofInputStream()); + if (httpResponse.statusCode() != HttpURLConnection.HTTP_OK) { return Optional.empty(); } - InputStream inputStream = connection.getInputStream(); + + InputStream inputStream = httpResponse.body(); // Check if the response is gzipped - if ("gzip".equalsIgnoreCase(connection.getContentEncoding())) { + if ("gzip".equalsIgnoreCase(httpResponse.headers().firstValue("Content-Encoding").orElse(""))) { inputStream = new GZIPInputStream(inputStream); } - // Read the response : + // Read the response APIListsResponse res = gson.fromJson(new InputStreamReader(inputStream), APIListsResponse.class); return Optional.of(res); } catch (Exception e) { From 536c3463eff6072266cbca8128f9f99220452226 Mon Sep 17 00:00:00 2001 From: BitterPanda63 Date: Fri, 27 Jun 2025 17:52:16 +0200 Subject: [PATCH 2/4] Move to helper SSLContextHelper --- .../background/cloud/RealtimeAPI.java | 13 +----------- .../background/cloud/SSLContextHelper.java | 20 +++++++++++++++++++ .../cloud/api/ReportingApiHTTP.java | 14 ++----------- 3 files changed, 23 insertions(+), 24 deletions(-) create mode 100644 agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java index dbdd8f3e6..0ccf9d6b3 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/RealtimeAPI.java @@ -15,6 +15,7 @@ import javax.net.ssl.TrustManagerFactory; import java.security.KeyStore; +import static dev.aikido.agent_api.background.cloud.SSLContextHelper.createDefaultSSLContext; import static dev.aikido.agent_api.helpers.env.Endpoints.getAikidoRealtimeEndpoint; public class RealtimeAPI { @@ -29,18 +30,6 @@ public RealtimeAPI(Token token) { } public record ConfigResponse(long configUpdatedAt) {} - private SSLContext createDefaultSSLContext() throws Exception { - // Get the default TrustManagerFactory - TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); - trustManagerFactory.init((KeyStore) null); // Use the default trust store - - // Create an SSLContext with the default TrustManager - SSLContext sslContext = SSLContext.getInstance("TLS"); - sslContext.init(null, trustManagerFactory.getTrustManagers(), null); - - return sslContext; - } - public Optional getConfig() { try { HttpClient httpClient = HttpClient.newBuilder() diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java new file mode 100644 index 000000000..aed2e3ea5 --- /dev/null +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java @@ -0,0 +1,20 @@ +package dev.aikido.agent_api.background.cloud; + +import javax.net.ssl.SSLContext; +import javax.net.ssl.TrustManagerFactory; +import java.security.KeyStore; + +public final class SSLContextHelper { + private SSLContextHelper() {} + public static SSLContext createDefaultSSLContext() throws Exception { + // Get the default TrustManagerFactory + TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); + trustManagerFactory.init((KeyStore) null); // Use the default trust store + + // Create an SSLContext with the default TrustManager + SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, trustManagerFactory.getTrustManagers(), null); + + return sslContext; + } +} diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java index 42bb118d4..5f658fb1d 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/api/ReportingApiHTTP.java @@ -21,6 +21,8 @@ import javax.net.ssl.TrustManagerFactory; import java.security.KeyStore; +import static dev.aikido.agent_api.background.cloud.SSLContextHelper.createDefaultSSLContext; + public class ReportingApiHTTP extends ReportingApi { private final Logger logger = LogManager.getLogger(ReportingApiHTTP.class); private final String reportingUrl; @@ -33,18 +35,6 @@ public ReportingApiHTTP(String reportingUrl, int timeoutInSec, Token token) { this.token = token; } - private SSLContext createDefaultSSLContext() throws Exception { - // Get the default TrustManagerFactory - TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); - trustManagerFactory.init((KeyStore) null); // Use the default trust store - - // Create an SSLContext with the default TrustManager - SSLContext sslContext = SSLContext.getInstance("TLS"); - sslContext.init(null, trustManagerFactory.getTrustManagers(), null); - - return sslContext; - } - public Optional fetchNewConfig() { try { HttpClient httpClient = HttpClient.newBuilder() From 859a56e761985357deadd6ae3ac8952870f9b6e4 Mon Sep 17 00:00:00 2001 From: BitterPanda63 Date: Fri, 27 Jun 2025 17:54:35 +0200 Subject: [PATCH 3/4] Update to v1.2 --- .../dev/aikido/agent_api/background/cloud/SSLContextHelper.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java index aed2e3ea5..cb8f73dbc 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java @@ -12,7 +12,7 @@ public static SSLContext createDefaultSSLContext() throws Exception { trustManagerFactory.init((KeyStore) null); // Use the default trust store // Create an SSLContext with the default TrustManager - SSLContext sslContext = SSLContext.getInstance("TLS"); + SSLContext sslContext = SSLContext.getInstance("TLSv1.2"); sslContext.init(null, trustManagerFactory.getTrustManagers(), null); return sslContext; From 3eb85f49c683cd1214e28f61ccf22f0809a01f1b Mon Sep 17 00:00:00 2001 From: BitterPanda63 Date: Fri, 27 Jun 2025 17:57:27 +0200 Subject: [PATCH 4/4] Revert "Update to v1.2" This reverts commit 859a56e761985357deadd6ae3ac8952870f9b6e4. --- .../dev/aikido/agent_api/background/cloud/SSLContextHelper.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java index cb8f73dbc..aed2e3ea5 100644 --- a/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java +++ b/agent_api/src/main/java/dev/aikido/agent_api/background/cloud/SSLContextHelper.java @@ -12,7 +12,7 @@ public static SSLContext createDefaultSSLContext() throws Exception { trustManagerFactory.init((KeyStore) null); // Use the default trust store // Create an SSLContext with the default TrustManager - SSLContext sslContext = SSLContext.getInstance("TLSv1.2"); + SSLContext sslContext = SSLContext.getInstance("TLS"); sslContext.init(null, trustManagerFactory.getTrustManagers(), null); return sslContext;