pax_global_header00006660000000000000000000000064152531725710014522gustar00rootroot0000000000000052 comment=6e2c11537bd45cd1b6cab44436f9604230bd3775 OpenVoxProject-trapperkeeper-metrics-499ae4c/000077500000000000000000000000001525317257100214065ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/000077500000000000000000000000001525317257100227465ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/dependabot.yml000066400000000000000000000005751525317257100256050ustar00rootroot00000000000000version: 2 updates: # raise PRs for gem updates - package-ecosystem: bundler directory: "/" schedule: interval: daily time: "13:00" open-pull-requests-limit: 10 # Maintain dependencies for GitHub Actions - package-ecosystem: github-actions directory: "/" schedule: interval: daily time: "13:00" open-pull-requests-limit: 10 OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/release.yml000066400000000000000000000013231525317257100251100ustar00rootroot00000000000000--- # https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes changelog: exclude: labels: - duplicate - invalid - modulesync - question - skip-changelog - wont-fix - wontfix categories: - title: Breaking Changes 🛠 labels: - backwards-incompatible - title: New Features 🎉 labels: - enhancement - title: Bug Fixes 🐛 labels: - bug - title: Documentation Updates 📚 labels: - documentation - docs - title: Dependency Updates ⬆️ labels: - dependencies - title: Other Changes labels: - "*" OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/workflows/000077500000000000000000000000001525317257100250035ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/workflows/lein-test.yaml000066400000000000000000000032371525317257100276000ustar00rootroot00000000000000--- name: lein_test on: pull_request: {} push: branches: - main permissions: contents: read jobs: run-lein-tests: name: lein test - Java ${{ matrix.java }} runs-on: ubuntu-latest strategy: matrix: java: [ '17', '21', '25' ] steps: - name: Check out repository code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup java uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: temurin java-version: ${{ matrix.java }} - name: Install Clojure tools uses: DeLaGuardo/setup-clojure@6d46099eae24853c33c0482f2bb54edf4f1a4c74 # 13.7.0 with: cli: latest # Clojure CLI based on tools.deps lein: latest # Leiningen boot: latest # Boot.clj bb: latest # Babashka clj-kondo: latest # Clj-kondo cljstyle: latest # cljstyle zprint: latest # zprint - name: Run lein tests with dev profile run: lein with-profile dev test env: FIPS: false # To be fixed soon - disabling until it is resolved #- name: Run lein tests with fips profile # run: lein with-profile fips test # env: # FIPS: true tests: if: always() needs: - run-lein-tests runs-on: ubuntu-24.04 name: Test suite steps: - name: Decide whether the needed jobs succeeded or failed uses: re-actors/alls-green@release/v1 with: jobs: ${{ toJSON(needs) }} OpenVoxProject-trapperkeeper-metrics-499ae4c/.github/workflows/release.yaml000066400000000000000000000007411525317257100273110ustar00rootroot00000000000000--- name: Release and publish package to clojars.org permissions: contents: write packages: write on: workflow_dispatch: jobs: release: uses: 'openvoxproject/shared-actions/.github/workflows/clojure_release.yml@main' secrets: github_pat: ${{ secrets.OPENVOXBOT_COMMIT_AND_PRS }} ssh_private_key: ${{ secrets.OPENVOXBOT_SSH_PRIVATE_KEY }} clojars_username: ${{ secrets.CLOJARS_USERNAME }} clojars_password: ${{ secrets.CLOJARS_PASSWORD }} OpenVoxProject-trapperkeeper-metrics-499ae4c/.gitignore000066400000000000000000000003361525317257100234000ustar00rootroot00000000000000pom.xml pom.xml.asc *jar /lib/ /classes/ /target/ /checkouts/ .lein-deps-sum .lein-repl-history .lein-plugins/ .lein-failures .nrepl-port /resources/locales.clj /dev-resources/i18n/bin /resources/**/Messages*.class /.idea OpenVoxProject-trapperkeeper-metrics-499ae4c/CHANGELOG.md000066400000000000000000000146001525317257100232200ustar00rootroot00000000000000## 2.0.3 * add the license key to project.clj to allow promotion to clojars ## 2.0.2 -- not released to clojars due to license key misssing * update clj-parent to 7.3.6 to allow the version of tk-jetty-10 to be managed * update the version of i18n to 0.9.2 * update the version of lein-parent to 0.3.9 * update the dependencies to avoid mixing maps and keys in vectors as this is deprecated by lein ## 2.0.1 * update tk-jetty-10 to 1.0.8 to address broken ring handler getRequestCharacterEncoding() function and set default character encoding of ring handler responses to UTF-8. ## 2.0.0 * major breaking change to Jetty 10 using the trapperkeeper-webserver-jetty10 service. ## 1.5.0 * update clj-parent to 5.2.6 to allow use of bouncy-castle libs `18on` that replaced the `15on` naming ## 1.4.3 (1.4.2 release failed, do not use) * Update project specification to work correctly in FIPS mode. ## 1.4.1 * Update Jolokia to 1.7.0. This is a routine maintenance bump that includes some cleanup of reflective accesses that trigger warnings in Java 9 and newer. ## 1.4.0 * [PE-28647](https://tickets.puppetlabs.com/browse/PE-28647) - Allow remote connections to the v2 metrics endpoint now that the connection can be authenticated. ## 1.3.0 * [TK-489](https://tickets.puppetlabs.com/browse/TK-489) - Add trapperkeeper-authorization support. See that project for configuration. The jolokia access configuration still defaults to disallowing remote access, so this needs to be overridden by the user if using tk-authorization. ## 1.2.3 * [TK-486](https://tickets.puppetlabs.com/browse/TK-486) - Deprecate the v1 endpoint, so it can be removed in a future release. Going forward all metrics gathering should go through the v2 endpoint, access to which can be flexibly controlled via jolokia access rules. ## 1.2.2 * Publicly published version of 1.2.1. ## 1.2.1 This is an internal-only release. * [PE-28468](https://tickets.puppetlabs.com/browse/PE-28468) - Disable the v1 metrics endpoint and restrict v2 to localhost-only access, to fix a CVE where sensitive Puppet data could appear in metrics names. ## 1.2.0 * Update Jolokia to 1.6.0. This was a security release of Jolokia, though we do not use the affected features of Jolokia it is still recommended to upgrade. ## 1.1.0 * [TK-442](https://tickets.puppetlabs.com/browse/TK-442) - Updates dropwizard from 3.1.2 to 3.2.2. NOTE: This is done by bumping the dependency on clj-parent which also brings in a new version of tk-jetty9. Java 7 is no longer supported. ## 1.0.0 This is a major backwards incompatible feature release. The major new feature is support for exporting to graphite. See the [documentation](documentation/configuration.md) for details about how to enable graphite exporting. The breaking changes are: * The `metrics` section of the configuration has changed to allow configuration of jmx and graphite reporters per domain instead of globally. See the [documentation](documentation/configuration.md) for details about the new format. * Domains must be specified as keywords instead of strings in the clojure API. * `initialize-registry-settings` has been renamed to `update-registry-settings` Additional changes: * Allow multiple services to register `default-metrics-allowed` lists through the `update-registry-settings` service function to limit the number of metrics sent to graphite Jira Links: * [TK-361](https://tickets.puppetlabs.com/browse/TK-361) - Move pe-trapperkeeper-metrics code, including graphite exporting, into OSS trapperkeeper-metrics. * [TK-393](https://tickets.puppetlabs.com/browse/TK-393) - Make jmx enabled per-registry. Deprecate enabling jmx globally * [TK-394](https://tickets.puppetlabs.com/browse/TK-394) - Only accept metrics domain as keyword instead of string * [TK-436](https://tickets.puppetlabs.com/browse/TK-436) - Add support for appending registry settings from multiple services ## 0.6.0 This is a feature release. * [TK-433](https://tickets.puppetlabs.com/browse/TK-433) - Add a new `get-server-id` services function. * [TK-430](https://tickets.puppetlabs.com/browse/TK-430) - Bump clj-parent to 0.3.3 and i18n to 0.6.0 ## 0.5.0 This is a feature release that also contains bug fixes. * [TK-404](https://tickets.puppetlabs.com/browse/TK-404) - Added a new "v2" API that is based on the [Jolokia](https://jolokia.org) library. Jolokia provides a superset of functionality found in the current "v1" metrics API. Refer to 'document/configuration.md' for more information on setting up Jolokia with Trapperkeeper. The [Jolokia Documentation](https://jolokia.org/reference/html/protocol.html) has the specifics on the new metrics API. * [TK-427](https://tickets.puppetlabs.com/browse/TK-427) - Ensure the JSON request is fully parsed before closing the input stream of the request * [TK-394](https://tickets.puppetlabs.com/browse/TK-394) - Tolerate either keywords or strings for metric domains * Remove explicit ring-core, servlet-api, and slf4j-api deps * Switch to using lein parent (and puppetlabs/clj-parent) for most dependency versions, which also now requires Leiningen 2.7.1 or greater ## 0.4.2 This is a bug fix release. * Don't require JMX to be enabled for the metrics endpoint to work. Now, if the `metrics-webservice` is added to the config, the `/metrics` endpoint will always be registered. ## 0.4.1 This is a maintenance release. * Bump puppetlabs/ring-middleware dependency from 0.3.1 to 1.0.0. ## 0.4.0 This is a feature release. * Add an `initialize-registry-settings` function to the MetricsService protocol. The implementation of this function in the trapperkeeper-metrics service in this repo is not yet implemented and currently just throws an error. ## 0.3.0 This is a minor feature, maintenance, and bugfix release. * Introduce i18n library and lay groundwork for future i18n work * Update project.clj to prefer explicit dependencies instead of implicit transitive dependencies to resolve conflicts * Extract common ring utils into puppetlabs/ring-middleware ## 0.2.0 This is a feature release. * Add the ability to configure multiple metrics registries * Add a new metrics-server service (ported from the PuppetDB `/metrics` API) for querying JMX metrics ## 0.1.2 This is a feature release. * [TK-252](https://tickets.puppetlabs.com/browse/TK-252) Always build a metrics registry, deprecate metrics.enabled setting * Add `mean-millis` and related utility fns OpenVoxProject-trapperkeeper-metrics-499ae4c/LICENSE000066400000000000000000000014011525317257100224070ustar00rootroot00000000000000 Trapperkeeper Metrics - A library to help make it easier to track metrics in other Trapperkeeper applications Copyright (C) 2005-2015 Puppet Labs Inc Puppet Labs can be contacted at: info@puppetlabs.com Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. OpenVoxProject-trapperkeeper-metrics-499ae4c/Makefile000066400000000000000000000000441525317257100230440ustar00rootroot00000000000000include dev-resources/Makefile.i18n OpenVoxProject-trapperkeeper-metrics-499ae4c/README.md000066400000000000000000000041621525317257100226700ustar00rootroot00000000000000# `trapperkeeper-metrics` [![Clojars Project](http://clojars.org/org.openvoxproject/trapperkeeper-metrics/latest-version.svg)](http://clojars.org/org.openvoxproject/trapperkeeper-metrics) `trapperkeeper-metrics` is a library intended to help make it easier to track metrics in other Trapperkeeper applications. It includes: * a TK service that manages the life cycle of your metrics registry * config-driven control of metrics and metrics reporting * other miscellaneous utility functions for working with metrics * support for configuring metrics to be reported to Graphite * support for filtering metrics before reporting them to Graphite For more detailed information (what this library does and doesn't do, more detailed tips on how to write code against it, future plans, etc.), check out the [documentation](./documentation/index.md). See the [configuration docs](./documentation/configuration.md) for info on how to configure the service, including Graphite reporting. See the [api docs](./documentation/api.md) for service API documentation. See the [metrics reporting and filtering](./documentation/metrics_reporting_and_filtering.md) for information on how metrics filtering works. ## Example code One example, a Trapperkeeper service which uses the metrics service in conjunction with a Ring handler, is included with this project ([source code](./examples/ring_app/README.md)). ## HTTP Metrics with `comidi` To get the most value out of this library, use it in concert with [comidi](https://github.com/openvoxproject/comidi) and [trapperkeeper-comidi-metrics](https://github.com/openvoxproject/trapperkeeper-comidi-metrics) (to take advantage of the built-in HTTP metrics; see the trapperkeeper-comidi-metrics docs) and the [Trapperkeeper Status Service](https://github.com/openvoxproject/trapperkeeper-status) (to expose the most useful metrics data from your app via HTTP). The `trapperkeeper-comidi-metrics` repo contains a working example app that illustrates how to tie everything together. ## Support GitHub issues and PRs are welcome! Additionally, drop us a line in [the Vox Pupuli Slack](https://voxpupuli.org/connect/). OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/000077500000000000000000000000001525317257100241745ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/Makefile.i18n000066400000000000000000000141461525317257100264200ustar00rootroot00000000000000# -*- Makefile -*- # This file was generated by the i18n leiningen plugin # Do not edit this file; it will be overwritten the next time you run # lein i18n init # # The name of the package into which the translations bundle will be placed BUNDLE=puppetlabs.trapperkeeper_metrics # The name of the POT file into which the gettext code strings (msgid) will be placed POT_NAME=trapperkeeper-metrics.pot # The list of names of packages covered by the translation bundle; # by default it contains a single package - the same where the translations # bundle itself is placed - but this can be overridden - preferably in # the top level Makefile PACKAGES?=$(BUNDLE) LOCALES=$(basename $(notdir $(wildcard locales/*.po))) BUNDLE_DIR=$(subst .,/,$(BUNDLE)) BUNDLE_FILES=$(patsubst %,resources/$(BUNDLE_DIR)/Messages_%.class,$(LOCALES)) FIND_SOURCES=find src -name \*.clj # xgettext before 0.19 does not understand --add-location=file. Even CentOS # 7 ships with an older gettext. We will therefore generate full location # info on those systems, and only file names where xgettext supports it LOC_OPT=$(shell xgettext --add-location=file -f - /dev/null 2>&1 && echo --add-location=file || echo --add-location) LOCALES_CLJ=resources/locales.clj define LOCALES_CLJ_CONTENTS { :locales #{$(patsubst %,"%",$(LOCALES))} :packages [$(patsubst %,"%",$(PACKAGES))] :bundle $(patsubst %,"%",$(BUNDLE).Messages) } endef export LOCALES_CLJ_CONTENTS i18n: msgfmt # Update locales/.pot update-pot: locales/$(POT_NAME) locales/$(POT_NAME): $(shell $(FIND_SOURCES)) | locales @tmp=$$(mktemp $@.tmp.XXXX); \ $(FIND_SOURCES) \ | xgettext --from-code=UTF-8 --language=lisp \ --copyright-holder='Puppet ' \ --package-name="$(BUNDLE)" \ --package-version="$(BUNDLE_VERSION)" \ --msgid-bugs-address="docs@puppet.com" \ -k \ -kmark:1 -ki18n/mark:1 \ -ktrs:1 -ki18n/trs:1 \ -ktru:1 -ki18n/tru:1 \ -ktrun:1,2 -ki18n/trun:1,2 \ -ktrsn:1,2 -ki18n/trsn:1,2 \ $(LOC_OPT) \ --add-comments --sort-by-file \ -o $$tmp -f -; \ sed -i.bak -e 's/charset=CHARSET/charset=UTF-8/' $$tmp; \ sed -i.bak -e 's/POT-Creation-Date: [^\\]*/POT-Creation-Date: /' $$tmp; \ rm -f $$tmp.bak; \ if ! diff -q -I POT-Creation-Date $$tmp $@ >/dev/null 2>&1; then \ mv $$tmp $@; \ else \ rm $$tmp; touch $@; \ fi # Run msgfmt over all .po files to generate Java resource bundles # and create the locales.clj file msgfmt: $(BUNDLE_FILES) $(LOCALES_CLJ) clean-orphaned-bundles # Force rebuild of locales.clj if its contents is not the the desired one. The # shell echo is used to add a trailing newline to match the one from `cat` ifneq ($(shell cat $(LOCALES_CLJ) 2> /dev/null),$(shell echo '$(LOCALES_CLJ_CONTENTS)')) .PHONY: $(LOCALES_CLJ) endif $(LOCALES_CLJ): | resources @echo "Writing $@" @echo "$$LOCALES_CLJ_CONTENTS" > $@ # Remove every resource bundle that wasn't generated from a PO file. # We do this because we used to generate the english bundle directly from the POT. .PHONY: clean-orphaned-bundles clean-orphaned-bundles: @for bundle in resources/$(BUNDLE_DIR)/Messages_*.class; do \ locale=$$(basename "$$bundle" | sed -E -e 's/\$$?1?\.class$$/_class/' | cut -d '_' -f 2;); \ if [ ! -f "locales/$$locale.po" -a -f "$$bundle" ]; then \ rm "$$bundle"; \ fi \ done resources/$(BUNDLE_DIR)/Messages_%.class: locales/%.po | resources msgfmt --java2 -d resources -r $(BUNDLE).Messages -l $(*F) $< # Use this to initialize translations. Updating the PO files is done # automatically through a CI job that utilizes the scripts in the project's # `bin` file, which themselves come from the `clj-i18n` project. locales/%.po: | locales @if [ ! -f $@ ]; then \ touch $@ && msginit --no-translator -l $(*F) -o $@ -i locales/$(POT_NAME); \ fi resources locales: @mkdir $@ help: $(info $(HELP)) @echo .PHONY: help define HELP This Makefile assists in handling i18n related tasks during development. Files that need to be checked into source control are put into the locales/ directory. They are locales/$(POT_NAME) - the POT file generated by 'make update-pot' locales/$$LANG.po - the translations for $$LANG Only the $$LANG.po files should be edited manually; this is usually done by translators. You can use the following targets: i18n: refresh all the files in locales/ and recompile resources update-pot: extract strings and update locales/$(POT_NAME) locales/LANG.po: create translations for LANG msgfmt: compile the translations into Java classes; this step is needed to make translations available to the Clojure code and produces Java class files in resources/ endef # @todo lutter 2015-04-20: for projects that use libraries with their own # translation, we need to combine all their translations into one big po # file and then run msgfmt over that so that we only have to deal with one # resource bundle OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/java.security.jdk11-fips000066400000000000000000001277111525317257100305670ustar00rootroot00000000000000# # This is the "master security properties file". # # An alternate java.security properties file may be specified # from the command line via the system property # # -Djava.security.properties= # # This properties file appends to the master security properties file. # If both properties files specify values for the same key, the value # from the command-line properties file is selected, as it is the last # one loaded. # # Also, if you specify # # -Djava.security.properties== (2 equals), # # then that properties file completely overrides the master security # properties file. # # To disable the ability to specify an additional properties file from # the command line, set the key security.overridePropertiesFile # to false in the master security properties file. It is set to true # by default. # In this file, various security properties are set for use by # java.security classes. This is where users can statically register # Cryptography Package Providers ("providers" for short). The term # "provider" refers to a package or set of packages that supply a # concrete implementation of a subset of the cryptography aspects of # the Java Security API. A provider may, for example, implement one or # more digital signature algorithms or message digest algorithms. # # Each provider must implement a subclass of the Provider class. # To register a provider in this master security properties file, # specify the provider and priority in the format # # security.provider.= # # This declares a provider, and specifies its preference # order n. The preference order is the order in which providers are # searched for requested algorithms (when no specific provider is # requested). The order is 1-based; 1 is the most preferred, followed # by 2, and so on. # # must specify the name of the Provider as passed to its super # class java.security.Provider constructor. This is for providers loaded # through the ServiceLoader mechanism. # # must specify the subclass of the Provider class whose # constructor sets the values of various properties that are required # for the Java Security API to look up the algorithms or other # facilities implemented by the provider. This is for providers loaded # through classpath. # # Note: Providers can be dynamically registered instead by calls to # either the addProvider or insertProviderAt method in the Security # class. # # List of providers and their preference orders (see above): # security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.3=SUN security.provider.4=SunRsaSign #security.provider.5=SunEC #security.provider.6=SunJSSE #security.provider.7=SunJCE #security.provider.8=SunJGSS #security.provider.9=SunSASL #security.provider.10=XMLDSig #security.provider.11=SunPCSC #security.provider.12=JdkLDAP #security.provider.13=JdkSASL #security.provider.14=SunPKCS11 # # A list of preferred providers for specific algorithms. These providers will # be searched for matching algorithms before the list of registered providers. # Entries containing errors (parsing, etc) will be ignored. Use the # -Djava.security.debug=jca property to debug these errors. # # The property is a comma-separated list of serviceType.algorithm:provider # entries. The serviceType (example: "MessageDigest") is optional, and if # not specified, the algorithm applies to all service types that support it. # The algorithm is the standard algorithm name or transformation. # Transformations can be specified in their full standard name # (ex: AES/CBC/PKCS5Padding), or as partial matches (ex: AES, AES/CBC). # The provider is the name of the provider. Any provider that does not # also appear in the registered list will be ignored. # # There is a special serviceType for this property only to group a set of # algorithms together. The type is "Group" and is followed by an algorithm # keyword. Groups are to simplify and lessen the entries on the property # line. Current groups are: # Group.SHA2 = SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 # Group.HmacSHA2 = HmacSHA224, HmacSHA256, HmacSHA384, HmacSHA512 # Group.SHA2RSA = SHA224withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA # Group.SHA2DSA = SHA224withDSA, SHA256withDSA, SHA384withDSA, SHA512withDSA # Group.SHA2ECDSA = SHA224withECDSA, SHA256withECDSA, SHA384withECDSA, \ # SHA512withECDSA # Group.SHA3 = SHA3-224, SHA3-256, SHA3-384, SHA3-512 # Group.HmacSHA3 = HmacSHA3-224, HmacSHA3-256, HmacSHA3-384, HmacSHA3-512 # # Example: # jdk.security.provider.preferred=AES/GCM/NoPadding:SunJCE, \ # MessageDigest.SHA-256:SUN, Group.HmacSHA2:SunJCE # #jdk.security.provider.preferred= # # Sun Provider SecureRandom seed source. # # Select the primary source of seed data for the "NativePRNG", "SHA1PRNG" # and "DRBG" SecureRandom implementations in the "Sun" provider. # (Other SecureRandom implementations might also use this property.) # # On Unix-like systems (for example, Solaris/Linux/MacOS), the # "NativePRNG", "SHA1PRNG" and "DRBG" implementations obtains seed data from # special device files such as file:/dev/random. # # On Windows systems, specifying the URLs "file:/dev/random" or # "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding # mechanism for SHA1PRNG and DRBG. # # By default, an attempt is made to use the entropy gathering device # specified by the "securerandom.source" Security property. If an # exception occurs while accessing the specified URL: # # NativePRNG: # a default value of /dev/random will be used. If neither # are available, the implementation will be disabled. # "file" is the only currently supported protocol type. # # SHA1PRNG and DRBG: # the traditional system/thread activity algorithm will be used. # # The entropy gathering device can also be specified with the System # property "java.security.egd". For example: # # % java -Djava.security.egd=file:/dev/random MainClass # # Specifying this System property will override the # "securerandom.source" Security property. # # In addition, if "file:/dev/random" or "file:/dev/urandom" is # specified, the "NativePRNG" implementation will be more preferred than # DRBG and SHA1PRNG in the Sun provider. # securerandom.source=file:/dev/random # # A list of known strong SecureRandom implementations. # # To help guide applications in selecting a suitable strong # java.security.SecureRandom implementation, Java distributions should # indicate a list of known strong implementations using the property. # # This is a comma-separated list of algorithm and/or algorithm:provider # entries. # securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN # # Sun provider DRBG configuration and default instantiation request. # # NIST SP 800-90Ar1 lists several DRBG mechanisms. Each can be configured # with a DRBG algorithm name, and can be instantiated with a security strength, # prediction resistance support, etc. This property defines the configuration # and the default instantiation request of "DRBG" SecureRandom implementations # in the SUN provider. (Other DRBG implementations can also use this property.) # Applications can request different instantiation parameters like security # strength, capability, personalization string using one of the # getInstance(...,SecureRandomParameters,...) methods with a # DrbgParameters.Instantiation argument, but other settings such as the # mechanism and DRBG algorithm names are not currently configurable by any API. # # Please note that the SUN implementation of DRBG always supports reseeding. # # The value of this property is a comma-separated list of all configurable # aspects. The aspects can appear in any order but the same aspect can only # appear at most once. Its BNF-style definition is: # # Value: # aspect { "," aspect } # # aspect: # mech_name | algorithm_name | strength | capability | df # # // The DRBG mechanism to use. Default "Hash_DRBG" # mech_name: # "Hash_DRBG" | "HMAC_DRBG" | "CTR_DRBG" # # // The DRBG algorithm name. The "SHA-***" names are for Hash_DRBG and # // HMAC_DRBG, default "SHA-256". The "AES-***" names are for CTR_DRBG, # // default "AES-128" when using the limited cryptographic or "AES-256" # // when using the unlimited. # algorithm_name: # "SHA-224" | "SHA-512/224" | "SHA-256" | # "SHA-512/256" | "SHA-384" | "SHA-512" | # "AES-128" | "AES-192" | "AES-256" # # // Security strength requested. Default "128" # strength: # "112" | "128" | "192" | "256" # # // Prediction resistance and reseeding request. Default "none" # // "pr_and_reseed" - Both prediction resistance and reseeding # // support requested # // "reseed_only" - Only reseeding support requested # // "none" - Neither prediction resistance not reseeding # // support requested # pr: # "pr_and_reseed" | "reseed_only" | "none" # # // Whether a derivation function should be used. only applicable # // to CTR_DRBG. Default "use_df" # df: # "use_df" | "no_df" # # Examples, # securerandom.drbg.config=Hash_DRBG,SHA-224,112,none # securerandom.drbg.config=CTR_DRBG,AES-256,192,pr_and_reseed,use_df # # The default value is an empty string, which is equivalent to # securerandom.drbg.config=Hash_DRBG,SHA-256,128,none # securerandom.drbg.config= # # Class to instantiate as the javax.security.auth.login.Configuration # provider. # login.configuration.provider=sun.security.provider.ConfigFile # # Default login configuration file # #login.config.url.1=file:${user.home}/.java.login.config # # Class to instantiate as the system Policy. This is the name of the class # that will be used as the Policy object. The system class loader is used to # locate this class. # policy.provider=sun.security.provider.PolicyFile # The default is to have a single system-wide policy file, # and a policy file in the user's home directory. # policy.url.1=file:${java.home}/conf/security/java.policy policy.url.2=file:${user.home}/.java.policy # whether or not we expand properties in the policy file # if this is set to false, properties (${...}) will not be expanded in policy # files. # policy.expandProperties=true # whether or not we allow an extra policy to be passed on the command line # with -Djava.security.policy=somefile. Comment out this line to disable # this feature. # policy.allowSystemProperty=true # whether or not we look into the IdentityScope for trusted Identities # when encountering a 1.1 signed JAR file. If the identity is found # and is trusted, we grant it AllPermission. Note: the default policy # provider (sun.security.provider.PolicyFile) does not support this property. # policy.ignoreIdentityScope=false # # Default keystore type. # keystore.type=pkcs12 # # Controls compatibility mode for JKS and PKCS12 keystore types. # # When set to 'true', both JKS and PKCS12 keystore types support loading # keystore files in either JKS or PKCS12 format. When set to 'false' the # JKS keystore type supports loading only JKS keystore files and the PKCS12 # keystore type supports loading only PKCS12 keystore files. # keystore.type.compat=true # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when passed to the # SecurityManager::checkPackageAccess method unless the corresponding # RuntimePermission("accessClassInPackage."+package) has been granted. # package.access=sun.misc.,\ sun.reflect.,\ org.GNOME.Accessibility. # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when passed to the # SecurityManager::checkPackageDefinition method unless the corresponding # RuntimePermission("defineClassInPackage."+package) has been granted. # # By default, none of the class loaders supplied with the JDK call # checkPackageDefinition. # package.definition=sun.misc.,\ sun.reflect. # # Determines whether this properties file can be appended to # or overridden on the command line via -Djava.security.properties # security.overridePropertiesFile=true # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. # ssl.KeyManagerFactory.algorithm=BCFKS ssl.TrustManagerFactory.algorithm=PKIX # # The Java-level namelookup cache policy for successful lookups: # # any negative value: caching forever # any positive value: the number of seconds to cache an address for # zero: do not cache # # default value is forever (FOREVER). For security reasons, this # caching is made forever when a security manager is set. When a security # manager is not set, the default behavior in this implementation # is to cache for 30 seconds. # # NOTE: setting this to anything other than the default value can have # serious security implications. Do not set it unless # you are sure you are not exposed to DNS spoofing attack. # #networkaddress.cache.ttl=-1 # The Java-level namelookup cache policy for failed lookups: # # any negative value: cache forever # any positive value: the number of seconds to cache negative lookup results # zero: do not cache # # In some Microsoft Windows networking environments that employ # the WINS name service in addition to DNS, name service lookups # that fail may take a noticeably long time to return (approx. 5 seconds). # For this reason the default caching policy is to maintain these # results for 10 seconds. # networkaddress.cache.negative.ttl=10 # # Properties to configure OCSP for certificate revocation checking # # Enable OCSP # # By default, OCSP is not used for certificate revocation checking. # This property enables the use of OCSP when set to the value "true". # # NOTE: SocketPermission is required to connect to an OCSP responder. # # Example, # ocsp.enable=true # # Location of the OCSP responder # # By default, the location of the OCSP responder is determined implicitly # from the certificate being validated. This property explicitly specifies # the location of the OCSP responder. The property is used when the # Authority Information Access extension (defined in RFC 5280) is absent # from the certificate or when it requires overriding. # # Example, # ocsp.responderURL=http://ocsp.example.net:80 # # Subject name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. In cases where # the subject name alone is not sufficient to uniquely identify the certificate # then both the "ocsp.responderCertIssuerName" and # "ocsp.responderCertSerialNumber" properties must be used instead. When this # property is set then those two properties are ignored. # # Example, # ocsp.responderCertSubjectName=CN=OCSP Responder, O=XYZ Corp # # Issuer name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. When this # property is set then the "ocsp.responderCertSerialNumber" property must also # be set. When the "ocsp.responderCertSubjectName" property is set then this # property is ignored. # # Example, # ocsp.responderCertIssuerName=CN=Enterprise CA, O=XYZ Corp # # Serial number of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # of hexadecimal digits (colon or space separators may be present) which # identifies a certificate in the set of certificates supplied during cert path # validation. When this property is set then the "ocsp.responderCertIssuerName" # property must also be set. When the "ocsp.responderCertSubjectName" property # is set then this property is ignored. # # Example, # ocsp.responderCertSerialNumber=2A:FF:00 # # Policy for failed Kerberos KDC lookups: # # When a KDC is unavailable (network error, service failure, etc), it is # put inside a blacklist and accessed less often for future requests. The # value (case-insensitive) for this policy can be: # # tryLast # KDCs in the blacklist are always tried after those not on the list. # # tryLess[:max_retries,timeout] # KDCs in the blacklist are still tried by their order in the configuration, # but with smaller max_retries and timeout values. max_retries and timeout # are optional numerical parameters (default 1 and 5000, which means once # and 5 seconds). Please notes that if any of the values defined here is # more than what is defined in krb5.conf, it will be ignored. # # Whenever a KDC is detected as available, it is removed from the blacklist. # The blacklist is reset when krb5.conf is reloaded. You can add # refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is # reloaded whenever a JAAS authentication is attempted. # # Example, # krb5.kdc.bad.policy = tryLast # krb5.kdc.bad.policy = tryLess:2,2000 # krb5.kdc.bad.policy = tryLast # # Algorithm restrictions for certification path (CertPath) processing # # In some environments, certain algorithms or key lengths may be undesirable # for certification path building and validation. For example, "MD2" is # generally no longer considered to be a secure hash algorithm. This section # describes the mechanism for disabling algorithms based on algorithm name # and/or key length. This includes algorithms used in certificates, as well # as revocation information such as CRLs and signed OCSP Responses. # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | CAConstraint | DenyAfterConstraint | # UsageConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # CAConstraint: # jdkCA # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # # The "AlgorithmName" is the standard algorithm name of the disabled # algorithm. See "Java Cryptography Architecture Standard Algorithm Name # Documentation" for information about Standard Algorithm Names. Matching # is performed using a case-insensitive sub-element matching rule. (For # example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and # "ECDSA" for signatures.) If the assertion "AlgorithmName" is a # sub-element of the certificate algorithm name, the algorithm will be # rejected during certification path building and validation. For example, # the assertion algorithm name "DSA" will disable all certificate algorithms # that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion # will not disable algorithms related to "ECDSA". # # A "Constraint" defines restrictions on the keys and/or certificates for # a specified AlgorithmName: # # KeySizeConstraint: # keySize Operator KeyLength # The constraint requires a key of a valid size range if the # "AlgorithmName" is of a key algorithm. The "KeyLength" indicates # the key size specified in number of bits. For example, # "RSA keySize <= 1024" indicates that any RSA key with key size less # than or equal to 1024 bits should be disabled, and # "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key # with key size less than 1024 or greater than 2048 should be disabled. # This constraint is only used on algorithms that have a key size. # # CAConstraint: # jdkCA # This constraint prohibits the specified algorithm only if the # algorithm is used in a certificate chain that terminates at a marked # trust anchor in the lib/security/cacerts keystore. If the jdkCA # constraint is not set, then all chains using the specified algorithm # are restricted. jdkCA may only be used once in a DisabledAlgorithm # expression. # Example: To apply this constraint to SHA-1 certificates, include # the following: "SHA1 jdkCA" # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # This constraint prohibits a certificate with the specified algorithm # from being used after the date regardless of the certificate's # validity. JAR files that are signed and timestamped before the # constraint date with certificates containing the disabled algorithm # will not be restricted. The date is processed in the UTC timezone. # This constraint can only be used once in a DisabledAlgorithm # expression. # Example: To deny usage of RSA 2048 bit certificates after Feb 3 2020, # use the following: "RSA keySize == 2048 & denyAfter 2020-02-03" # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # This constraint prohibits the specified algorithm for # a specified usage. This should be used when disabling an algorithm # for all usages is not practical. 'TLSServer' restricts the algorithm # in TLS server certificate chains when server authentication is # performed. 'TLSClient' restricts the algorithm in TLS client # certificate chains when client authentication is performed. # 'SignedJAR' constrains use of certificates in signed jar files. # The usage type follows the keyword and more than one usage type can # be specified with a whitespace delimiter. # Example: "SHA1 usage TLSServer TLSClient" # # When an algorithm must satisfy more than one constraint, it must be # delimited by an ampersand '&'. For example, to restrict certificates in a # chain that terminate at a distribution provided trust anchor and contain # RSA keys that are less than or equal to 1024 bits, add the following # constraint: "RSA keySize <= 1024 & jdkCA". # # All DisabledAlgorithms expressions are processed in the order defined in the # property. This requires lower keysize constraints to be specified # before larger keysize constraints of the same algorithm. For example: # "RSA keySize < 1024 & jdkCA, RSA keySize < 2048". # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by Oracle's PKIX implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048 # # jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \ RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224 # # Algorithm restrictions for signed JAR files # # In some environments, certain algorithms or key lengths may be undesirable # for signed JAR validation. For example, "MD2" is generally no longer # considered to be a secure hash algorithm. This section describes the # mechanism for disabling algorithms based on algorithm name and/or key length. # JARs signed with any of the disabled algorithms or key sizes will be treated # as unsigned. # # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | DenyAfterConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # Note: This property is currently used by the JDK Reference # implementation. It is not guaranteed to be examined and used by other # implementations. # # See "jdk.certpath.disabledAlgorithms" for syntax descriptions. # jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \ DSA keySize < 1024 # # Algorithm restrictions for Secure Socket Layer/Transport Layer Security # (SSL/TLS/DTLS) processing # # In some environments, certain algorithms or key lengths may be undesirable # when using SSL/TLS/DTLS. This section describes the mechanism for disabling # algorithms during SSL/TLS/DTLS security parameters negotiation, including # protocol version negotiation, cipher suites selection, peer authentication # and key exchange mechanisms. # # Disabled algorithms will not be negotiated for SSL/TLS connections, even # if they are enabled explicitly in an application. # # For PKI-based peer authentication and key exchange mechanisms, this list # of disabled algorithms will also be checked during certification path # building and validation, including algorithms used in certificates, as # well as revocation information such as CRLs and signed OCSP Responses. # This is in addition to the jdk.certpath.disabledAlgorithms property above. # # See the specification of "jdk.certpath.disabledAlgorithms" for the # syntax of the disabled algorithm string. # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, 3DES_EDE_CBC, anon, NULL # # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation. # # In some environments, a certain algorithm may be undesirable but it # cannot be disabled because of its use in legacy applications. Legacy # algorithms may still be supported, but applications should not use them # as the security strength of legacy algorithms are usually not strong enough # in practice. # # During SSL/TLS security parameters negotiation, legacy algorithms will # not be negotiated unless there are no other candidates. # # The syntax of the legacy algorithms string is described as this Java # BNF-style: # LegacyAlgorithms: # " LegacyAlgorithm { , LegacyAlgorithm } " # # LegacyAlgorithm: # AlgorithmName (standard JSSE algorithm name) # # See the specification of security property "jdk.certpath.disabledAlgorithms" # for the syntax and description of the "AlgorithmName" notation. # # Per SSL/TLS specifications, cipher suites have the form: # SSL_KeyExchangeAlg_WITH_CipherAlg_MacAlg # or # TLS_KeyExchangeAlg_WITH_CipherAlg_MacAlg # # For example, the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA uses RSA as the # key exchange algorithm, AES_128_CBC (128 bits AES cipher algorithm in CBC # mode) as the cipher (encryption) algorithm, and SHA-1 as the message digest # algorithm for HMAC. # # The LegacyAlgorithm can be one of the following standard algorithm names: # 1. JSSE cipher suite name, e.g., TLS_RSA_WITH_AES_128_CBC_SHA # 2. JSSE key exchange algorithm name, e.g., RSA # 3. JSSE cipher (encryption) algorithm name, e.g., AES_128_CBC # 4. JSSE message digest algorithm name, e.g., SHA # # See SSL/TLS specifications and "Java Cryptography Architecture Standard # Algorithm Name Documentation" for information about the algorithm names. # # Note: If a legacy algorithm is also restricted through the # jdk.tls.disabledAlgorithms property or the # java.security.AlgorithmConstraints API (See # javax.net.ssl.SSLParameters.setAlgorithmConstraints()), # then the algorithm is completely disabled and will not be negotiated. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # There is no guarantee the property will continue to exist or be of the # same syntax in future releases. # # Example: # jdk.tls.legacyAlgorithms=DH_anon, DES_CBC, SSL_RSA_WITH_RC4_128_MD5 # jdk.tls.legacyAlgorithms= \ K_NULL, C_NULL, M_NULL, \ DH_anon, ECDH_anon, \ RC4_128, RC4_40, DES_CBC, DES40_CBC, \ 3DES_EDE_CBC # # The pre-defined default finite field Diffie-Hellman ephemeral (DHE) # parameters for Transport Layer Security (SSL/TLS/DTLS) processing. # # In traditional SSL/TLS/DTLS connections where finite field DHE parameters # negotiation mechanism is not used, the server offers the client group # parameters, base generator g and prime modulus p, for DHE key exchange. # It is recommended to use dynamic group parameters. This property defines # a mechanism that allows you to specify custom group parameters. # # The syntax of this property string is described as this Java BNF-style: # DefaultDHEParameters: # DefinedDHEParameters { , DefinedDHEParameters } # # DefinedDHEParameters: # "{" DHEPrimeModulus , DHEBaseGenerator "}" # # DHEPrimeModulus: # HexadecimalDigits # # DHEBaseGenerator: # HexadecimalDigits # # HexadecimalDigits: # HexadecimalDigit { HexadecimalDigit } # # HexadecimalDigit: one of # 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f # # Whitespace characters are ignored. # # The "DefinedDHEParameters" defines the custom group parameters, prime # modulus p and base generator g, for a particular size of prime modulus p. # The "DHEPrimeModulus" defines the hexadecimal prime modulus p, and the # "DHEBaseGenerator" defines the hexadecimal base generator g of a group # parameter. It is recommended to use safe primes for the custom group # parameters. # # If this property is not defined or the value is empty, the underlying JSSE # provider's default group parameter is used for each connection. # # If the property value does not follow the grammar, or a particular group # parameter is not valid, the connection will fall back and use the # underlying JSSE provider's default group parameter. # # Note: This property is currently used by OpenJDK's JSSE implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.server.defaultDHEParameters= # { \ # FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 \ # 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD \ # EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 \ # E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED \ # EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 \ # FFFFFFFF FFFFFFFF, 2} # # TLS key limits on symmetric cryptographic algorithms # # This security property sets limits on algorithms key usage in TLS 1.3. # When the amount of data encrypted exceeds the algorithm value listed below, # a KeyUpdate message will trigger a key change. This is for symmetric ciphers # with TLS 1.3 only. # # The syntax for the property is described below: # KeyLimits: # " KeyLimit { , KeyLimit } " # # WeakKeyLimit: # AlgorithmName Action Length # # AlgorithmName: # A full algorithm transformation. # # Action: # KeyUpdate # # Length: # The amount of encrypted data in a session before the Action occurs # This value may be an integer value in bytes, or as a power of two, 2^29. # # KeyUpdate: # The TLS 1.3 KeyUpdate handshake process begins when the Length amount # is fulfilled. # # Note: This property is currently used by OpenJDK's JSSE implementation. It # is not guaranteed to be examined and used by other implementations. # jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37 # # Cryptographic Jurisdiction Policy defaults # # Import and export control rules on cryptographic software vary from # country to country. By default, Java provides two different sets of # cryptographic policy files[1]: # # unlimited: These policy files contain no restrictions on cryptographic # strengths or algorithms # # limited: These policy files contain more restricted cryptographic # strengths # # The default setting is determined by the value of the "crypto.policy" # Security property below. If your country or usage requires the # traditional restrictive policy, the "limited" Java cryptographic # policy is still available and may be appropriate for your environment. # # If you have restrictions that do not fit either use case mentioned # above, Java provides the capability to customize these policy files. # The "crypto.policy" security property points to a subdirectory # within /conf/security/policy/ which can be customized. # Please see the /conf/security/policy/README.txt file or consult # the Java Security Guide/JCA documentation for more information. # # YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY # TO DETERMINE THE EXACT REQUIREMENTS. # # [1] Please note that the JCE for Java SE, including the JCE framework, # cryptographic policy files, and standard JCE providers provided with # the Java SE, have been reviewed and approved for export as mass market # encryption item by the US Bureau of Industry and Security. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # crypto.policy=unlimited # # The policy for the XML Signature secure validation mode. The mode is # enabled by setting the property "org.jcp.xml.dsig.secureValidation" to # true with the javax.xml.crypto.XMLCryptoContext.setProperty() method, # or by running the code with a SecurityManager. # # Policy: # Constraint {"," Constraint } # Constraint: # AlgConstraint | MaxTransformsConstraint | MaxReferencesConstraint | # ReferenceUriSchemeConstraint | KeySizeConstraint | OtherConstraint # AlgConstraint # "disallowAlg" Uri # MaxTransformsConstraint: # "maxTransforms" Integer # MaxReferencesConstraint: # "maxReferences" Integer # ReferenceUriSchemeConstraint: # "disallowReferenceUriSchemes" String { String } # KeySizeConstraint: # "minKeySize" KeyAlg Integer # OtherConstraint: # "noDuplicateIds" | "noRetrievalMethodLoops" # # For AlgConstraint, Uri is the algorithm URI String that is not allowed. # See the XML Signature Recommendation for more information on algorithm # URI Identifiers. For KeySizeConstraint, KeyAlg is the standard algorithm # name of the key type (ex: "RSA"). If the MaxTransformsConstraint, # MaxReferencesConstraint or KeySizeConstraint (for the same key type) is # specified more than once, only the last entry is enforced. # # Note: This property is currently used by the JDK Reference implementation. It # is not guaranteed to be examined and used by other implementations. # jdk.xml.dsig.secureValidationPolicy=\ disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\ maxTransforms 5,\ maxReferences 30,\ disallowReferenceUriSchemes file http https,\ minKeySize RSA 1024,\ minKeySize DSA 1024,\ minKeySize EC 224,\ noDuplicateIds,\ noRetrievalMethodLoops # # Serialization process-wide filter # # A filter, if configured, is used by java.io.ObjectInputStream during # deserialization to check the contents of the stream. # A filter is configured as a sequence of patterns, each pattern is either # matched against the name of a class in the stream or defines a limit. # Patterns are separated by ";" (semicolon). # Whitespace is significant and is considered part of the pattern. # # If the system property jdk.serialFilter is also specified, it supersedes # the security property value defined here. # # If a pattern includes a "=", it sets a limit. # If a limit appears more than once the last value is used. # Limits are checked before classes regardless of the order in the # sequence of patterns. # If any of the limits are exceeded, the filter status is REJECTED. # # maxdepth=value - the maximum depth of a graph # maxrefs=value - the maximum number of internal references # maxbytes=value - the maximum number of bytes in the input stream # maxarray=value - the maximum array length allowed # # Other patterns, from left to right, match the class or package name as # returned from Class.getName. # If the class is an array type, the class or package to be matched is the # element type. # Arrays of any number of dimensions are treated the same as the element type. # For example, a pattern of "!example.Foo", rejects creation of any instance or # array of example.Foo. # # If the pattern starts with "!", the status is REJECTED if the remaining # pattern is matched; otherwise the status is ALLOWED if the pattern matches. # If the pattern contains "/", the non-empty prefix up to the "/" is the # module name; # if the module name matches the module name of the class then # the remaining pattern is matched with the class name. # If there is no "/", the module name is not compared. # If the pattern ends with ".**" it matches any class in the package and all # subpackages. # If the pattern ends with ".*" it matches any class in the package. # If the pattern ends with "*", it matches any class with the pattern as a # prefix. # If the pattern is equal to the class name, it matches. # Otherwise, the status is UNDECIDED. # #jdk.serialFilter=pattern;pattern # # RMI Registry Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI Registry or to decrease limits but not # to increase limits. # If the limits (maxdepth, maxrefs, or maxbytes) are exceeded, the object is rejected. # # Each non-array type is allowed or rejected if it matches one of the patterns, # evaluated from left to right, and is otherwise allowed. Arrays of any # component type, including subarrays and arrays of primitives, are allowed. # # Array construction of any component type, including subarrays and arrays of # primitives, are allowed unless the length is greater than the maxarray limit. # The filter is applied to each array element. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # The built-in filter allows subclasses of allowed classes and # can approximately be represented as the pattern: # #sun.rmi.registry.registryFilter=\ # maxarray=1000000;\ # maxdepth=20;\ # java.lang.String;\ # java.lang.Number;\ # java.lang.reflect.Proxy;\ # java.rmi.Remote;\ # sun.rmi.server.UnicastRef;\ # sun.rmi.server.RMIClientSocketFactory;\ # sun.rmi.server.RMIServerSocketFactory;\ # java.rmi.activation.ActivationID;\ # java.rmi.server.UID # # RMI Distributed Garbage Collector (DGC) Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI DGC. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # The builtin DGC filter can approximately be represented as the filter pattern: # #sun.rmi.transport.dgcFilter=\ # java.rmi.server.ObjID;\ # java.rmi.server.UID;\ # java.rmi.dgc.VMID;\ # java.rmi.dgc.Lease;\ # maxdepth=5;maxarray=10000 # CORBA ORBIorTypeCheckRegistryFilter # Type check enhancement for ORB::string_to_object processing # # An IOR type check filter, if configured, is used by an ORB during # an ORB::string_to_object invocation to check the veracity of the type encoded # in the ior string. # # The filter pattern consists of a semi-colon separated list of class names. # The configured list contains the binary class names of the IDL interface types # corresponding to the IDL stub class to be instantiated. # As such, a filter specifies a list of IDL stub classes that will be # allowed by an ORB when an ORB::string_to_object is invoked. # It is used to specify a white list configuration of acceptable # IDL stub types which may be contained in a stringified IOR # parameter passed as input to an ORB::string_to_object method. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name # # JCEKS Encrypted Key Serial Filter # # This filter, if configured, is used by the JCEKS KeyStore during the # deserialization of the encrypted Key object stored inside a key entry. # If not configured or the filter result is UNDECIDED (i.e. none of the patterns # matches), the filter configured by jdk.serialFilter will be consulted. # # If the system property jceks.key.serialFilter is also specified, it supersedes # the security property value defined here. # # The filter pattern uses the same format as jdk.serialFilter. The default # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type, # and javax.crypto.spec.SecretKeySpec and rejects all the others. jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep;\ java.base/java.security.KeyRep$Type;java.base/javax.crypto.spec.SecretKeySpec;!* # # Enhanced exception message information # # By default, exception messages should not include potentially sensitive # information such as file names, host names, or port numbers. This property # accepts one or more comma separated values, each of which represents a # category of enhanced exception message information to enable. Values are # case-insensitive. Leading and trailing whitespaces, surrounding each value, # are ignored. Unknown values are ignored. # # NOTE: Use caution before setting this property. Setting this property # exposes sensitive information in Exceptions, which could, for example, # propagate to untrusted code or be emitted in stack traces that are # inadvertently disclosed and made accessible over a public network. # # The categories are: # # hostInfo - IOExceptions thrown by java.net.Socket and the socket types in the # java.nio.channels package will contain enhanced exception # message information # # The property setting in this file can be overridden by a system property of # the same name, with the same syntax and possible values. # #jdk.includeInExceptions=hostInfo # # Policies for distrusting Certificate Authorities (CAs). # # This is a comma separated value of one or more case-sensitive strings, each # of which represents a policy for determining if a CA should be distrusted. # The supported values are: # # SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec # root CA and issued after April 16, 2019 unless issued by one of the # following subordinate CAs which have a later distrust date: # 1. Apple IST CA 2 - G1, SHA-256 fingerprint: # AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B # Distrust after December 31, 2019. # 2. Apple IST CA 8 - G1, SHA-256 fingerprint: # A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED # Distrust after December 31, 2019. # # Leading and trailing whitespace surrounding each value are ignored. # Unknown values are ignored. If the property is commented out or set to the # empty String, no policies are enforced. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be supported by other SE implementations. Also, this # property does not override other security properties which can restrict # certificates such as jdk.tls.disabledAlgorithms or # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even # if this property is not enabled. # jdk.security.caDistrustPolicies=SYMANTEC_TLS OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/java.security.jdk17-fips000066400000000000000000001277111525317257100305750ustar00rootroot00000000000000# # This is the "master security properties file". # # An alternate java.security properties file may be specified # from the command line via the system property # # -Djava.security.properties= # # This properties file appends to the master security properties file. # If both properties files specify values for the same key, the value # from the command-line properties file is selected, as it is the last # one loaded. # # Also, if you specify # # -Djava.security.properties== (2 equals), # # then that properties file completely overrides the master security # properties file. # # To disable the ability to specify an additional properties file from # the command line, set the key security.overridePropertiesFile # to false in the master security properties file. It is set to true # by default. # In this file, various security properties are set for use by # java.security classes. This is where users can statically register # Cryptography Package Providers ("providers" for short). The term # "provider" refers to a package or set of packages that supply a # concrete implementation of a subset of the cryptography aspects of # the Java Security API. A provider may, for example, implement one or # more digital signature algorithms or message digest algorithms. # # Each provider must implement a subclass of the Provider class. # To register a provider in this master security properties file, # specify the provider and priority in the format # # security.provider.= # # This declares a provider, and specifies its preference # order n. The preference order is the order in which providers are # searched for requested algorithms (when no specific provider is # requested). The order is 1-based; 1 is the most preferred, followed # by 2, and so on. # # must specify the name of the Provider as passed to its super # class java.security.Provider constructor. This is for providers loaded # through the ServiceLoader mechanism. # # must specify the subclass of the Provider class whose # constructor sets the values of various properties that are required # for the Java Security API to look up the algorithms or other # facilities implemented by the provider. This is for providers loaded # through classpath. # # Note: Providers can be dynamically registered instead by calls to # either the addProvider or insertProviderAt method in the Security # class. # # List of providers and their preference orders (see above): # security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.3=SUN security.provider.4=SunRsaSign #security.provider.5=SunEC #security.provider.6=SunJSSE #security.provider.7=SunJCE #security.provider.8=SunJGSS #security.provider.9=SunSASL #security.provider.10=XMLDSig #security.provider.11=SunPCSC #security.provider.12=JdkLDAP #security.provider.13=JdkSASL #security.provider.14=SunPKCS11 # # A list of preferred providers for specific algorithms. These providers will # be searched for matching algorithms before the list of registered providers. # Entries containing errors (parsing, etc) will be ignored. Use the # -Djava.security.debug=jca property to debug these errors. # # The property is a comma-separated list of serviceType.algorithm:provider # entries. The serviceType (example: "MessageDigest") is optional, and if # not specified, the algorithm applies to all service types that support it. # The algorithm is the standard algorithm name or transformation. # Transformations can be specified in their full standard name # (ex: AES/CBC/PKCS5Padding), or as partial matches (ex: AES, AES/CBC). # The provider is the name of the provider. Any provider that does not # also appear in the registered list will be ignored. # # There is a special serviceType for this property only to group a set of # algorithms together. The type is "Group" and is followed by an algorithm # keyword. Groups are to simplify and lessen the entries on the property # line. Current groups are: # Group.SHA2 = SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 # Group.HmacSHA2 = HmacSHA224, HmacSHA256, HmacSHA384, HmacSHA512 # Group.SHA2RSA = SHA224withRSA, SHA256withRSA, SHA384withRSA, SHA512withRSA # Group.SHA2DSA = SHA224withDSA, SHA256withDSA, SHA384withDSA, SHA512withDSA # Group.SHA2ECDSA = SHA224withECDSA, SHA256withECDSA, SHA384withECDSA, \ # SHA512withECDSA # Group.SHA3 = SHA3-224, SHA3-256, SHA3-384, SHA3-512 # Group.HmacSHA3 = HmacSHA3-224, HmacSHA3-256, HmacSHA3-384, HmacSHA3-512 # # Example: # jdk.security.provider.preferred=AES/GCM/NoPadding:SunJCE, \ # MessageDigest.SHA-256:SUN, Group.HmacSHA2:SunJCE # #jdk.security.provider.preferred= # # Sun Provider SecureRandom seed source. # # Select the primary source of seed data for the "NativePRNG", "SHA1PRNG" # and "DRBG" SecureRandom implementations in the "Sun" provider. # (Other SecureRandom implementations might also use this property.) # # On Unix-like systems (for example, Solaris/Linux/MacOS), the # "NativePRNG", "SHA1PRNG" and "DRBG" implementations obtains seed data from # special device files such as file:/dev/random. # # On Windows systems, specifying the URLs "file:/dev/random" or # "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding # mechanism for SHA1PRNG and DRBG. # # By default, an attempt is made to use the entropy gathering device # specified by the "securerandom.source" Security property. If an # exception occurs while accessing the specified URL: # # NativePRNG: # a default value of /dev/random will be used. If neither # are available, the implementation will be disabled. # "file" is the only currently supported protocol type. # # SHA1PRNG and DRBG: # the traditional system/thread activity algorithm will be used. # # The entropy gathering device can also be specified with the System # property "java.security.egd". For example: # # % java -Djava.security.egd=file:/dev/random MainClass # # Specifying this System property will override the # "securerandom.source" Security property. # # In addition, if "file:/dev/random" or "file:/dev/urandom" is # specified, the "NativePRNG" implementation will be more preferred than # DRBG and SHA1PRNG in the Sun provider. # securerandom.source=file:/dev/random # # A list of known strong SecureRandom implementations. # # To help guide applications in selecting a suitable strong # java.security.SecureRandom implementation, Java distributions should # indicate a list of known strong implementations using the property. # # This is a comma-separated list of algorithm and/or algorithm:provider # entries. # securerandom.strongAlgorithms=NativePRNGBlocking:SUN,DRBG:SUN # # Sun provider DRBG configuration and default instantiation request. # # NIST SP 800-90Ar1 lists several DRBG mechanisms. Each can be configured # with a DRBG algorithm name, and can be instantiated with a security strength, # prediction resistance support, etc. This property defines the configuration # and the default instantiation request of "DRBG" SecureRandom implementations # in the SUN provider. (Other DRBG implementations can also use this property.) # Applications can request different instantiation parameters like security # strength, capability, personalization string using one of the # getInstance(...,SecureRandomParameters,...) methods with a # DrbgParameters.Instantiation argument, but other settings such as the # mechanism and DRBG algorithm names are not currently configurable by any API. # # Please note that the SUN implementation of DRBG always supports reseeding. # # The value of this property is a comma-separated list of all configurable # aspects. The aspects can appear in any order but the same aspect can only # appear at most once. Its BNF-style definition is: # # Value: # aspect { "," aspect } # # aspect: # mech_name | algorithm_name | strength | capability | df # # // The DRBG mechanism to use. Default "Hash_DRBG" # mech_name: # "Hash_DRBG" | "HMAC_DRBG" | "CTR_DRBG" # # // The DRBG algorithm name. The "SHA-***" names are for Hash_DRBG and # // HMAC_DRBG, default "SHA-256". The "AES-***" names are for CTR_DRBG, # // default "AES-128" when using the limited cryptographic or "AES-256" # // when using the unlimited. # algorithm_name: # "SHA-224" | "SHA-512/224" | "SHA-256" | # "SHA-512/256" | "SHA-384" | "SHA-512" | # "AES-128" | "AES-192" | "AES-256" # # // Security strength requested. Default "128" # strength: # "112" | "128" | "192" | "256" # # // Prediction resistance and reseeding request. Default "none" # // "pr_and_reseed" - Both prediction resistance and reseeding # // support requested # // "reseed_only" - Only reseeding support requested # // "none" - Neither prediction resistance not reseeding # // support requested # pr: # "pr_and_reseed" | "reseed_only" | "none" # # // Whether a derivation function should be used. only applicable # // to CTR_DRBG. Default "use_df" # df: # "use_df" | "no_df" # # Examples, # securerandom.drbg.config=Hash_DRBG,SHA-224,112,none # securerandom.drbg.config=CTR_DRBG,AES-256,192,pr_and_reseed,use_df # # The default value is an empty string, which is equivalent to # securerandom.drbg.config=Hash_DRBG,SHA-256,128,none # securerandom.drbg.config= # # Class to instantiate as the javax.security.auth.login.Configuration # provider. # login.configuration.provider=sun.security.provider.ConfigFile # # Default login configuration file # #login.config.url.1=file:${user.home}/.java.login.config # # Class to instantiate as the system Policy. This is the name of the class # that will be used as the Policy object. The system class loader is used to # locate this class. # policy.provider=sun.security.provider.PolicyFile # The default is to have a single system-wide policy file, # and a policy file in the user's home directory. # policy.url.1=file:${java.home}/conf/security/java.policy policy.url.2=file:${user.home}/.java.policy # whether or not we expand properties in the policy file # if this is set to false, properties (${...}) will not be expanded in policy # files. # policy.expandProperties=true # whether or not we allow an extra policy to be passed on the command line # with -Djava.security.policy=somefile. Comment out this line to disable # this feature. # policy.allowSystemProperty=true # whether or not we look into the IdentityScope for trusted Identities # when encountering a 1.1 signed JAR file. If the identity is found # and is trusted, we grant it AllPermission. Note: the default policy # provider (sun.security.provider.PolicyFile) does not support this property. # policy.ignoreIdentityScope=false # # Default keystore type. # keystore.type=pkcs12 # # Controls compatibility mode for JKS and PKCS12 keystore types. # # When set to 'true', both JKS and PKCS12 keystore types support loading # keystore files in either JKS or PKCS12 format. When set to 'false' the # JKS keystore type supports loading only JKS keystore files and the PKCS12 # keystore type supports loading only PKCS12 keystore files. # keystore.type.compat=true # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when passed to the # SecurityManager::checkPackageAccess method unless the corresponding # RuntimePermission("accessClassInPackage."+package) has been granted. # package.access=sun.misc.,\ sun.reflect.,\ org.GNOME.Accessibility. # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when passed to the # SecurityManager::checkPackageDefinition method unless the corresponding # RuntimePermission("defineClassInPackage."+package) has been granted. # # By default, none of the class loaders supplied with the JDK call # checkPackageDefinition. # package.definition=sun.misc.,\ sun.reflect. # # Determines whether this properties file can be appended to # or overridden on the command line via -Djava.security.properties # security.overridePropertiesFile=true # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. # ssl.KeyManagerFactory.algorithm=BCFKS ssl.TrustManagerFactory.algorithm=PKIX # # The Java-level namelookup cache policy for successful lookups: # # any negative value: caching forever # any positive value: the number of seconds to cache an address for # zero: do not cache # # default value is forever (FOREVER). For security reasons, this # caching is made forever when a security manager is set. When a security # manager is not set, the default behavior in this implementation # is to cache for 30 seconds. # # NOTE: setting this to anything other than the default value can have # serious security implications. Do not set it unless # you are sure you are not exposed to DNS spoofing attack. # #networkaddress.cache.ttl=-1 # The Java-level namelookup cache policy for failed lookups: # # any negative value: cache forever # any positive value: the number of seconds to cache negative lookup results # zero: do not cache # # In some Microsoft Windows networking environments that employ # the WINS name service in addition to DNS, name service lookups # that fail may take a noticeably long time to return (approx. 5 seconds). # For this reason the default caching policy is to maintain these # results for 10 seconds. # networkaddress.cache.negative.ttl=10 # # Properties to configure OCSP for certificate revocation checking # # Enable OCSP # # By default, OCSP is not used for certificate revocation checking. # This property enables the use of OCSP when set to the value "true". # # NOTE: SocketPermission is required to connect to an OCSP responder. # # Example, # ocsp.enable=true # # Location of the OCSP responder # # By default, the location of the OCSP responder is determined implicitly # from the certificate being validated. This property explicitly specifies # the location of the OCSP responder. The property is used when the # Authority Information Access extension (defined in RFC 5280) is absent # from the certificate or when it requires overriding. # # Example, # ocsp.responderURL=http://ocsp.example.net:80 # # Subject name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. In cases where # the subject name alone is not sufficient to uniquely identify the certificate # then both the "ocsp.responderCertIssuerName" and # "ocsp.responderCertSerialNumber" properties must be used instead. When this # property is set then those two properties are ignored. # # Example, # ocsp.responderCertSubjectName=CN=OCSP Responder, O=XYZ Corp # # Issuer name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. When this # property is set then the "ocsp.responderCertSerialNumber" property must also # be set. When the "ocsp.responderCertSubjectName" property is set then this # property is ignored. # # Example, # ocsp.responderCertIssuerName=CN=Enterprise CA, O=XYZ Corp # # Serial number of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # of hexadecimal digits (colon or space separators may be present) which # identifies a certificate in the set of certificates supplied during cert path # validation. When this property is set then the "ocsp.responderCertIssuerName" # property must also be set. When the "ocsp.responderCertSubjectName" property # is set then this property is ignored. # # Example, # ocsp.responderCertSerialNumber=2A:FF:00 # # Policy for failed Kerberos KDC lookups: # # When a KDC is unavailable (network error, service failure, etc), it is # put inside a blacklist and accessed less often for future requests. The # value (case-insensitive) for this policy can be: # # tryLast # KDCs in the blacklist are always tried after those not on the list. # # tryLess[:max_retries,timeout] # KDCs in the blacklist are still tried by their order in the configuration, # but with smaller max_retries and timeout values. max_retries and timeout # are optional numerical parameters (default 1 and 5000, which means once # and 5 seconds). Please notes that if any of the values defined here is # more than what is defined in krb5.conf, it will be ignored. # # Whenever a KDC is detected as available, it is removed from the blacklist. # The blacklist is reset when krb5.conf is reloaded. You can add # refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is # reloaded whenever a JAAS authentication is attempted. # # Example, # krb5.kdc.bad.policy = tryLast # krb5.kdc.bad.policy = tryLess:2,2000 # krb5.kdc.bad.policy = tryLast # # Algorithm restrictions for certification path (CertPath) processing # # In some environments, certain algorithms or key lengths may be undesirable # for certification path building and validation. For example, "MD2" is # generally no longer considered to be a secure hash algorithm. This section # describes the mechanism for disabling algorithms based on algorithm name # and/or key length. This includes algorithms used in certificates, as well # as revocation information such as CRLs and signed OCSP Responses. # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | CAConstraint | DenyAfterConstraint | # UsageConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # CAConstraint: # jdkCA # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # # The "AlgorithmName" is the standard algorithm name of the disabled # algorithm. See "Java Cryptography Architecture Standard Algorithm Name # Documentation" for information about Standard Algorithm Names. Matching # is performed using a case-insensitive sub-element matching rule. (For # example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and # "ECDSA" for signatures.) If the assertion "AlgorithmName" is a # sub-element of the certificate algorithm name, the algorithm will be # rejected during certification path building and validation. For example, # the assertion algorithm name "DSA" will disable all certificate algorithms # that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion # will not disable algorithms related to "ECDSA". # # A "Constraint" defines restrictions on the keys and/or certificates for # a specified AlgorithmName: # # KeySizeConstraint: # keySize Operator KeyLength # The constraint requires a key of a valid size range if the # "AlgorithmName" is of a key algorithm. The "KeyLength" indicates # the key size specified in number of bits. For example, # "RSA keySize <= 1024" indicates that any RSA key with key size less # than or equal to 1024 bits should be disabled, and # "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key # with key size less than 1024 or greater than 2048 should be disabled. # This constraint is only used on algorithms that have a key size. # # CAConstraint: # jdkCA # This constraint prohibits the specified algorithm only if the # algorithm is used in a certificate chain that terminates at a marked # trust anchor in the lib/security/cacerts keystore. If the jdkCA # constraint is not set, then all chains using the specified algorithm # are restricted. jdkCA may only be used once in a DisabledAlgorithm # expression. # Example: To apply this constraint to SHA-1 certificates, include # the following: "SHA1 jdkCA" # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # This constraint prohibits a certificate with the specified algorithm # from being used after the date regardless of the certificate's # validity. JAR files that are signed and timestamped before the # constraint date with certificates containing the disabled algorithm # will not be restricted. The date is processed in the UTC timezone. # This constraint can only be used once in a DisabledAlgorithm # expression. # Example: To deny usage of RSA 2048 bit certificates after Feb 3 2020, # use the following: "RSA keySize == 2048 & denyAfter 2020-02-03" # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # This constraint prohibits the specified algorithm for # a specified usage. This should be used when disabling an algorithm # for all usages is not practical. 'TLSServer' restricts the algorithm # in TLS server certificate chains when server authentication is # performed. 'TLSClient' restricts the algorithm in TLS client # certificate chains when client authentication is performed. # 'SignedJAR' constrains use of certificates in signed jar files. # The usage type follows the keyword and more than one usage type can # be specified with a whitespace delimiter. # Example: "SHA1 usage TLSServer TLSClient" # # When an algorithm must satisfy more than one constraint, it must be # delimited by an ampersand '&'. For example, to restrict certificates in a # chain that terminate at a distribution provided trust anchor and contain # RSA keys that are less than or equal to 1024 bits, add the following # constraint: "RSA keySize <= 1024 & jdkCA". # # All DisabledAlgorithms expressions are processed in the order defined in the # property. This requires lower keysize constraints to be specified # before larger keysize constraints of the same algorithm. For example: # "RSA keySize < 1024 & jdkCA, RSA keySize < 2048". # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by Oracle's PKIX implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048 # # jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \ RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224 # # Algorithm restrictions for signed JAR files # # In some environments, certain algorithms or key lengths may be undesirable # for signed JAR validation. For example, "MD2" is generally no longer # considered to be a secure hash algorithm. This section describes the # mechanism for disabling algorithms based on algorithm name and/or key length. # JARs signed with any of the disabled algorithms or key sizes will be treated # as unsigned. # # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | DenyAfterConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # Note: This property is currently used by the JDK Reference # implementation. It is not guaranteed to be examined and used by other # implementations. # # See "jdk.certpath.disabledAlgorithms" for syntax descriptions. # jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \ DSA keySize < 1024 # # Algorithm restrictions for Secure Socket Layer/Transport Layer Security # (SSL/TLS/DTLS) processing # # In some environments, certain algorithms or key lengths may be undesirable # when using SSL/TLS/DTLS. This section describes the mechanism for disabling # algorithms during SSL/TLS/DTLS security parameters negotiation, including # protocol version negotiation, cipher suites selection, peer authentication # and key exchange mechanisms. # # Disabled algorithms will not be negotiated for SSL/TLS connections, even # if they are enabled explicitly in an application. # # For PKI-based peer authentication and key exchange mechanisms, this list # of disabled algorithms will also be checked during certification path # building and validation, including algorithms used in certificates, as # well as revocation information such as CRLs and signed OCSP Responses. # This is in addition to the jdk.certpath.disabledAlgorithms property above. # # See the specification of "jdk.certpath.disabledAlgorithms" for the # syntax of the disabled algorithm string. # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, 3DES_EDE_CBC, anon, NULL # # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation. # # In some environments, a certain algorithm may be undesirable but it # cannot be disabled because of its use in legacy applications. Legacy # algorithms may still be supported, but applications should not use them # as the security strength of legacy algorithms are usually not strong enough # in practice. # # During SSL/TLS security parameters negotiation, legacy algorithms will # not be negotiated unless there are no other candidates. # # The syntax of the legacy algorithms string is described as this Java # BNF-style: # LegacyAlgorithms: # " LegacyAlgorithm { , LegacyAlgorithm } " # # LegacyAlgorithm: # AlgorithmName (standard JSSE algorithm name) # # See the specification of security property "jdk.certpath.disabledAlgorithms" # for the syntax and description of the "AlgorithmName" notation. # # Per SSL/TLS specifications, cipher suites have the form: # SSL_KeyExchangeAlg_WITH_CipherAlg_MacAlg # or # TLS_KeyExchangeAlg_WITH_CipherAlg_MacAlg # # For example, the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA uses RSA as the # key exchange algorithm, AES_128_CBC (128 bits AES cipher algorithm in CBC # mode) as the cipher (encryption) algorithm, and SHA-1 as the message digest # algorithm for HMAC. # # The LegacyAlgorithm can be one of the following standard algorithm names: # 1. JSSE cipher suite name, e.g., TLS_RSA_WITH_AES_128_CBC_SHA # 2. JSSE key exchange algorithm name, e.g., RSA # 3. JSSE cipher (encryption) algorithm name, e.g., AES_128_CBC # 4. JSSE message digest algorithm name, e.g., SHA # # See SSL/TLS specifications and "Java Cryptography Architecture Standard # Algorithm Name Documentation" for information about the algorithm names. # # Note: If a legacy algorithm is also restricted through the # jdk.tls.disabledAlgorithms property or the # java.security.AlgorithmConstraints API (See # javax.net.ssl.SSLParameters.setAlgorithmConstraints()), # then the algorithm is completely disabled and will not be negotiated. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # There is no guarantee the property will continue to exist or be of the # same syntax in future releases. # # Example: # jdk.tls.legacyAlgorithms=DH_anon, DES_CBC, SSL_RSA_WITH_RC4_128_MD5 # jdk.tls.legacyAlgorithms= \ K_NULL, C_NULL, M_NULL, \ DH_anon, ECDH_anon, \ RC4_128, RC4_40, DES_CBC, DES40_CBC, \ 3DES_EDE_CBC # # The pre-defined default finite field Diffie-Hellman ephemeral (DHE) # parameters for Transport Layer Security (SSL/TLS/DTLS) processing. # # In traditional SSL/TLS/DTLS connections where finite field DHE parameters # negotiation mechanism is not used, the server offers the client group # parameters, base generator g and prime modulus p, for DHE key exchange. # It is recommended to use dynamic group parameters. This property defines # a mechanism that allows you to specify custom group parameters. # # The syntax of this property string is described as this Java BNF-style: # DefaultDHEParameters: # DefinedDHEParameters { , DefinedDHEParameters } # # DefinedDHEParameters: # "{" DHEPrimeModulus , DHEBaseGenerator "}" # # DHEPrimeModulus: # HexadecimalDigits # # DHEBaseGenerator: # HexadecimalDigits # # HexadecimalDigits: # HexadecimalDigit { HexadecimalDigit } # # HexadecimalDigit: one of # 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f # # Whitespace characters are ignored. # # The "DefinedDHEParameters" defines the custom group parameters, prime # modulus p and base generator g, for a particular size of prime modulus p. # The "DHEPrimeModulus" defines the hexadecimal prime modulus p, and the # "DHEBaseGenerator" defines the hexadecimal base generator g of a group # parameter. It is recommended to use safe primes for the custom group # parameters. # # If this property is not defined or the value is empty, the underlying JSSE # provider's default group parameter is used for each connection. # # If the property value does not follow the grammar, or a particular group # parameter is not valid, the connection will fall back and use the # underlying JSSE provider's default group parameter. # # Note: This property is currently used by OpenJDK's JSSE implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.server.defaultDHEParameters= # { \ # FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 \ # 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD \ # EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 \ # E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED \ # EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 \ # FFFFFFFF FFFFFFFF, 2} # # TLS key limits on symmetric cryptographic algorithms # # This security property sets limits on algorithms key usage in TLS 1.3. # When the amount of data encrypted exceeds the algorithm value listed below, # a KeyUpdate message will trigger a key change. This is for symmetric ciphers # with TLS 1.3 only. # # The syntax for the property is described below: # KeyLimits: # " KeyLimit { , KeyLimit } " # # WeakKeyLimit: # AlgorithmName Action Length # # AlgorithmName: # A full algorithm transformation. # # Action: # KeyUpdate # # Length: # The amount of encrypted data in a session before the Action occurs # This value may be an integer value in bytes, or as a power of two, 2^29. # # KeyUpdate: # The TLS 1.3 KeyUpdate handshake process begins when the Length amount # is fulfilled. # # Note: This property is currently used by OpenJDK's JSSE implementation. It # is not guaranteed to be examined and used by other implementations. # jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37 # # Cryptographic Jurisdiction Policy defaults # # Import and export control rules on cryptographic software vary from # country to country. By default, Java provides two different sets of # cryptographic policy files[1]: # # unlimited: These policy files contain no restrictions on cryptographic # strengths or algorithms # # limited: These policy files contain more restricted cryptographic # strengths # # The default setting is determined by the value of the "crypto.policy" # Security property below. If your country or usage requires the # traditional restrictive policy, the "limited" Java cryptographic # policy is still available and may be appropriate for your environment. # # If you have restrictions that do not fit either use case mentioned # above, Java provides the capability to customize these policy files. # The "crypto.policy" security property points to a subdirectory # within /conf/security/policy/ which can be customized. # Please see the /conf/security/policy/README.txt file or consult # the Java Security Guide/JCA documentation for more information. # # YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY # TO DETERMINE THE EXACT REQUIREMENTS. # # [1] Please note that the JCE for Java SE, including the JCE framework, # cryptographic policy files, and standard JCE providers provided with # the Java SE, have been reviewed and approved for export as mass market # encryption item by the US Bureau of Industry and Security. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # crypto.policy=unlimited # # The policy for the XML Signature secure validation mode. The mode is # enabled by setting the property "org.jcp.xml.dsig.secureValidation" to # true with the javax.xml.crypto.XMLCryptoContext.setProperty() method, # or by running the code with a SecurityManager. # # Policy: # Constraint {"," Constraint } # Constraint: # AlgConstraint | MaxTransformsConstraint | MaxReferencesConstraint | # ReferenceUriSchemeConstraint | KeySizeConstraint | OtherConstraint # AlgConstraint # "disallowAlg" Uri # MaxTransformsConstraint: # "maxTransforms" Integer # MaxReferencesConstraint: # "maxReferences" Integer # ReferenceUriSchemeConstraint: # "disallowReferenceUriSchemes" String { String } # KeySizeConstraint: # "minKeySize" KeyAlg Integer # OtherConstraint: # "noDuplicateIds" | "noRetrievalMethodLoops" # # For AlgConstraint, Uri is the algorithm URI String that is not allowed. # See the XML Signature Recommendation for more information on algorithm # URI Identifiers. For KeySizeConstraint, KeyAlg is the standard algorithm # name of the key type (ex: "RSA"). If the MaxTransformsConstraint, # MaxReferencesConstraint or KeySizeConstraint (for the same key type) is # specified more than once, only the last entry is enforced. # # Note: This property is currently used by the JDK Reference implementation. It # is not guaranteed to be examined and used by other implementations. # jdk.xml.dsig.secureValidationPolicy=\ disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\ maxTransforms 5,\ maxReferences 30,\ disallowReferenceUriSchemes file http https,\ minKeySize RSA 1024,\ minKeySize DSA 1024,\ minKeySize EC 224,\ noDuplicateIds,\ noRetrievalMethodLoops # # Serialization process-wide filter # # A filter, if configured, is used by java.io.ObjectInputStream during # deserialization to check the contents of the stream. # A filter is configured as a sequence of patterns, each pattern is either # matched against the name of a class in the stream or defines a limit. # Patterns are separated by ";" (semicolon). # Whitespace is significant and is considered part of the pattern. # # If the system property jdk.serialFilter is also specified, it supersedes # the security property value defined here. # # If a pattern includes a "=", it sets a limit. # If a limit appears more than once the last value is used. # Limits are checked before classes regardless of the order in the # sequence of patterns. # If any of the limits are exceeded, the filter status is REJECTED. # # maxdepth=value - the maximum depth of a graph # maxrefs=value - the maximum number of internal references # maxbytes=value - the maximum number of bytes in the input stream # maxarray=value - the maximum array length allowed # # Other patterns, from left to right, match the class or package name as # returned from Class.getName. # If the class is an array type, the class or package to be matched is the # element type. # Arrays of any number of dimensions are treated the same as the element type. # For example, a pattern of "!example.Foo", rejects creation of any instance or # array of example.Foo. # # If the pattern starts with "!", the status is REJECTED if the remaining # pattern is matched; otherwise the status is ALLOWED if the pattern matches. # If the pattern contains "/", the non-empty prefix up to the "/" is the # module name; # if the module name matches the module name of the class then # the remaining pattern is matched with the class name. # If there is no "/", the module name is not compared. # If the pattern ends with ".**" it matches any class in the package and all # subpackages. # If the pattern ends with ".*" it matches any class in the package. # If the pattern ends with "*", it matches any class with the pattern as a # prefix. # If the pattern is equal to the class name, it matches. # Otherwise, the status is UNDECIDED. # #jdk.serialFilter=pattern;pattern # # RMI Registry Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI Registry or to decrease limits but not # to increase limits. # If the limits (maxdepth, maxrefs, or maxbytes) are exceeded, the object is rejected. # # Each non-array type is allowed or rejected if it matches one of the patterns, # evaluated from left to right, and is otherwise allowed. Arrays of any # component type, including subarrays and arrays of primitives, are allowed. # # Array construction of any component type, including subarrays and arrays of # primitives, are allowed unless the length is greater than the maxarray limit. # The filter is applied to each array element. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # The built-in filter allows subclasses of allowed classes and # can approximately be represented as the pattern: # #sun.rmi.registry.registryFilter=\ # maxarray=1000000;\ # maxdepth=20;\ # java.lang.String;\ # java.lang.Number;\ # java.lang.reflect.Proxy;\ # java.rmi.Remote;\ # sun.rmi.server.UnicastRef;\ # sun.rmi.server.RMIClientSocketFactory;\ # sun.rmi.server.RMIServerSocketFactory;\ # java.rmi.activation.ActivationID;\ # java.rmi.server.UID # # RMI Distributed Garbage Collector (DGC) Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI DGC. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # The builtin DGC filter can approximately be represented as the filter pattern: # #sun.rmi.transport.dgcFilter=\ # java.rmi.server.ObjID;\ # java.rmi.server.UID;\ # java.rmi.dgc.VMID;\ # java.rmi.dgc.Lease;\ # maxdepth=5;maxarray=10000 # CORBA ORBIorTypeCheckRegistryFilter # Type check enhancement for ORB::string_to_object processing # # An IOR type check filter, if configured, is used by an ORB during # an ORB::string_to_object invocation to check the veracity of the type encoded # in the ior string. # # The filter pattern consists of a semi-colon separated list of class names. # The configured list contains the binary class names of the IDL interface types # corresponding to the IDL stub class to be instantiated. # As such, a filter specifies a list of IDL stub classes that will be # allowed by an ORB when an ORB::string_to_object is invoked. # It is used to specify a white list configuration of acceptable # IDL stub types which may be contained in a stringified IOR # parameter passed as input to an ORB::string_to_object method. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name # # JCEKS Encrypted Key Serial Filter # # This filter, if configured, is used by the JCEKS KeyStore during the # deserialization of the encrypted Key object stored inside a key entry. # If not configured or the filter result is UNDECIDED (i.e. none of the patterns # matches), the filter configured by jdk.serialFilter will be consulted. # # If the system property jceks.key.serialFilter is also specified, it supersedes # the security property value defined here. # # The filter pattern uses the same format as jdk.serialFilter. The default # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type, # and javax.crypto.spec.SecretKeySpec and rejects all the others. jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep;\ java.base/java.security.KeyRep$Type;java.base/javax.crypto.spec.SecretKeySpec;!* # # Enhanced exception message information # # By default, exception messages should not include potentially sensitive # information such as file names, host names, or port numbers. This property # accepts one or more comma separated values, each of which represents a # category of enhanced exception message information to enable. Values are # case-insensitive. Leading and trailing whitespaces, surrounding each value, # are ignored. Unknown values are ignored. # # NOTE: Use caution before setting this property. Setting this property # exposes sensitive information in Exceptions, which could, for example, # propagate to untrusted code or be emitted in stack traces that are # inadvertently disclosed and made accessible over a public network. # # The categories are: # # hostInfo - IOExceptions thrown by java.net.Socket and the socket types in the # java.nio.channels package will contain enhanced exception # message information # # The property setting in this file can be overridden by a system property of # the same name, with the same syntax and possible values. # #jdk.includeInExceptions=hostInfo # # Policies for distrusting Certificate Authorities (CAs). # # This is a comma separated value of one or more case-sensitive strings, each # of which represents a policy for determining if a CA should be distrusted. # The supported values are: # # SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec # root CA and issued after April 16, 2019 unless issued by one of the # following subordinate CAs which have a later distrust date: # 1. Apple IST CA 2 - G1, SHA-256 fingerprint: # AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B # Distrust after December 31, 2019. # 2. Apple IST CA 8 - G1, SHA-256 fingerprint: # A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED # Distrust after December 31, 2019. # # Leading and trailing whitespace surrounding each value are ignored. # Unknown values are ignored. If the property is commented out or set to the # empty String, no policies are enforced. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be supported by other SE implementations. Also, this # property does not override other security properties which can restrict # certificates such as jdk.tls.disabledAlgorithms or # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even # if this property is not enabled. # jdk.security.caDistrustPolicies=SYMANTEC_TLS OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/java.security.jdk8-fips000066400000000000000000001226601525317257100305130ustar00rootroot00000000000000# # This is the "master security properties file". # # An alternate java.security properties file may be specified # from the command line via the system property # # -Djava.security.properties= # # This properties file appends to the master security properties file. # If both properties files specify values for the same key, the value # from the command-line properties file is selected, as it is the last # one loaded. # # Also, if you specify # # -Djava.security.properties== (2 equals), # # then that properties file completely overrides the master security # properties file. # # To disable the ability to specify an additional properties file from # the command line, set the key security.overridePropertiesFile # to false in the master security properties file. It is set to true # by default. # In this file, various security properties are set for use by # java.security classes. This is where users can statically register # Cryptography Package Providers ("providers" for short). The term # "provider" refers to a package or set of packages that supply a # concrete implementation of a subset of the cryptography aspects of # the Java Security API. A provider may, for example, implement one or # more digital signature algorithms or message digest algorithms. # # Each provider must implement a subclass of the Provider class. # To register a provider in this master security properties file, # specify the Provider subclass name and priority in the format # # security.provider.= # # This declares a provider, and specifies its preference # order n. The preference order is the order in which providers are # searched for requested algorithms (when no specific provider is # requested). The order is 1-based; 1 is the most preferred, followed # by 2, and so on. # # must specify the subclass of the Provider class whose # constructor sets the values of various properties that are required # for the Java Security API to look up the algorithms or other # facilities implemented by the provider. # # There must be at least one provider specification in java.security. # There is a default provider that comes standard with the JDK. It # is called the "SUN" provider, and its Provider subclass # named Sun appears in the sun.security.provider package. Thus, the # "SUN" provider is registered via the following: # # security.provider.1=sun.security.provider.Sun # # (The number 1 is used for the default provider.) # # Note: Providers can be dynamically registered instead by calls to # either the addProvider or insertProviderAt method in the Security # class. # # List of providers and their preference orders (see above): # security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.3=sun.security.provider.Sun security.provider.4=sun.security.rsa.SunRsaSign #security.provider.5=sun.security.ec.SunEC #security.provider.6=com.sun.net.ssl.internal.ssl.Provider #security.provider.7=com.sun.crypto.provider.SunJCE #security.provider.8=sun.security.jgss.SunProvider #security.provider.9=com.sun.security.sasl.Provider #security.provider.10=org.jcp.xml.dsig.internal.dom.XMLDSigRI #security.provider.11=sun.security.smartcardio.SunPCSC # # Sun Provider SecureRandom seed source. # # Select the primary source of seed data for the "SHA1PRNG" and # "NativePRNG" SecureRandom implementations in the "Sun" provider. # (Other SecureRandom implementations might also use this property.) # # On Unix-like systems (for example, Solaris/Linux/MacOS), the # "NativePRNG" and "SHA1PRNG" implementations obtains seed data from # special device files such as file:/dev/random. # # On Windows systems, specifying the URLs "file:/dev/random" or # "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding # mechanism for SHA1PRNG. # # By default, an attempt is made to use the entropy gathering device # specified by the "securerandom.source" Security property. If an # exception occurs while accessing the specified URL: # # SHA1PRNG: # the traditional system/thread activity algorithm will be used. # # NativePRNG: # a default value of /dev/random will be used. If neither # are available, the implementation will be disabled. # "file" is the only currently supported protocol type. # # The entropy gathering device can also be specified with the System # property "java.security.egd". For example: # # % java -Djava.security.egd=file:/dev/random MainClass # # Specifying this System property will override the # "securerandom.source" Security property. # # In addition, if "file:/dev/random" or "file:/dev/urandom" is # specified, the "NativePRNG" implementation will be more preferred than # SHA1PRNG in the Sun provider. # securerandom.source=file:/dev/random # # A list of known strong SecureRandom implementations. # # To help guide applications in selecting a suitable strong # java.security.SecureRandom implementation, Java distributions should # indicate a list of known strong implementations using the property. # # This is a comma-separated list of algorithm and/or algorithm:provider # entries. # securerandom.strongAlgorithms=NativePRNGBlocking:SUN # # Class to instantiate as the javax.security.auth.login.Configuration # provider. # login.configuration.provider=sun.security.provider.ConfigFile # # Default login configuration file # #login.config.url.1=file:${user.home}/.java.login.config # # Class to instantiate as the system Policy. This is the name of the class # that will be used as the Policy object. # policy.provider=sun.security.provider.PolicyFile # The default is to have a single system-wide policy file, # and a policy file in the user's home directory. policy.url.1=file:${java.home}/lib/security/java.policy policy.url.2=file:${user.home}/.java.policy # whether or not we expand properties in the policy file # if this is set to false, properties (${...}) will not be expanded in policy # files. policy.expandProperties=true # whether or not we allow an extra policy to be passed on the command line # with -Djava.security.policy=somefile. Comment out this line to disable # this feature. policy.allowSystemProperty=true # whether or not we look into the IdentityScope for trusted Identities # when encountering a 1.1 signed JAR file. If the identity is found # and is trusted, we grant it AllPermission. policy.ignoreIdentityScope=false # # Default keystore type. # keystore.type=jks # # Controls compatibility mode for the JKS keystore type. # # When set to 'true', the JKS keystore type supports loading # keystore files in either JKS or PKCS12 format. When set to 'false' # it supports loading only JKS keystore files. # keystore.type.compat=true # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when # passed to checkPackageAccess unless the # corresponding RuntimePermission ("accessClassInPackage."+package) has # been granted. package.access=sun.,\ org.GNOME.Accessibility.,\ com.sun.xml.internal.,\ com.sun.imageio.,\ com.sun.istack.internal.,\ com.sun.jmx.,\ com.sun.media.sound.,\ com.sun.naming.internal.,\ com.sun.proxy.,\ com.sun.corba.se.,\ com.sun.org.apache.bcel.internal.,\ com.sun.org.apache.regexp.internal.,\ com.sun.org.apache.xerces.internal.,\ com.sun.org.apache.xpath.internal.,\ com.sun.org.apache.xalan.internal.extensions.,\ com.sun.org.apache.xalan.internal.lib.,\ com.sun.org.apache.xalan.internal.res.,\ com.sun.org.apache.xalan.internal.templates.,\ com.sun.org.apache.xalan.internal.utils.,\ com.sun.org.apache.xalan.internal.xslt.,\ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ com.sun.org.apache.xalan.internal.xsltc.trax.,\ com.sun.org.apache.xalan.internal.xsltc.util.,\ com.sun.org.apache.xml.internal.res.,\ com.sun.org.apache.xml.internal.resolver.helpers.,\ com.sun.org.apache.xml.internal.resolver.readers.,\ com.sun.org.apache.xml.internal.security.,\ com.sun.org.apache.xml.internal.serializer.utils.,\ com.sun.org.apache.xml.internal.utils.,\ com.sun.org.glassfish.,\ com.oracle.xmlns.internal.,\ com.oracle.webservices.internal.,\ oracle.jrockit.jfr.,\ org.jcp.xml.dsig.internal.,\ jdk.internal.,\ jdk.nashorn.internal.,\ jdk.nashorn.tools.,\ jdk.xml.internal.,\ com.sun.activation.registries. # # List of comma-separated packages that start with or equal this string # will cause a security exception to be thrown when # passed to checkPackageDefinition unless the # corresponding RuntimePermission ("defineClassInPackage."+package) has # been granted. # # by default, none of the class loaders supplied with the JDK call # checkPackageDefinition. # package.definition=sun.,\ com.sun.xml.internal.,\ com.sun.imageio.,\ com.sun.istack.internal.,\ com.sun.jmx.,\ com.sun.media.sound.,\ com.sun.naming.internal.,\ com.sun.proxy.,\ com.sun.corba.se.,\ com.sun.org.apache.bcel.internal.,\ com.sun.org.apache.regexp.internal.,\ com.sun.org.apache.xerces.internal.,\ com.sun.org.apache.xpath.internal.,\ com.sun.org.apache.xalan.internal.extensions.,\ com.sun.org.apache.xalan.internal.lib.,\ com.sun.org.apache.xalan.internal.res.,\ com.sun.org.apache.xalan.internal.templates.,\ com.sun.org.apache.xalan.internal.utils.,\ com.sun.org.apache.xalan.internal.xslt.,\ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ com.sun.org.apache.xalan.internal.xsltc.trax.,\ com.sun.org.apache.xalan.internal.xsltc.util.,\ com.sun.org.apache.xml.internal.res.,\ com.sun.org.apache.xml.internal.resolver.helpers.,\ com.sun.org.apache.xml.internal.resolver.readers.,\ com.sun.org.apache.xml.internal.security.,\ com.sun.org.apache.xml.internal.serializer.utils.,\ com.sun.org.apache.xml.internal.utils.,\ com.sun.org.glassfish.,\ com.oracle.xmlns.internal.,\ com.oracle.webservices.internal.,\ oracle.jrockit.jfr.,\ org.jcp.xml.dsig.internal.,\ jdk.internal.,\ jdk.nashorn.internal.,\ jdk.nashorn.tools.,\ jdk.xml.internal.,\ com.sun.activation.registries. # # Determines whether this properties file can be appended to # or overridden on the command line via -Djava.security.properties # security.overridePropertiesFile=true # # Determines the default key and trust manager factory algorithms for # the javax.net.ssl package. # ssl.KeyManagerFactory.algorithm=BCFKS ssl.TrustManagerFactory.algorithm=PKIX # # The Java-level namelookup cache policy for successful lookups: # # any negative value: caching forever # any positive value: the number of seconds to cache an address for # zero: do not cache # # default value is forever (FOREVER). For security reasons, this # caching is made forever when a security manager is set. When a security # manager is not set, the default behavior in this implementation # is to cache for 30 seconds. # # NOTE: setting this to anything other than the default value can have # serious security implications. Do not set it unless # you are sure you are not exposed to DNS spoofing attack. # #networkaddress.cache.ttl=-1 # The Java-level namelookup cache policy for failed lookups: # # any negative value: cache forever # any positive value: the number of seconds to cache negative lookup results # zero: do not cache # # In some Microsoft Windows networking environments that employ # the WINS name service in addition to DNS, name service lookups # that fail may take a noticeably long time to return (approx. 5 seconds). # For this reason the default caching policy is to maintain these # results for 10 seconds. # # networkaddress.cache.negative.ttl=10 # # Properties to configure OCSP for certificate revocation checking # # Enable OCSP # # By default, OCSP is not used for certificate revocation checking. # This property enables the use of OCSP when set to the value "true". # # NOTE: SocketPermission is required to connect to an OCSP responder. # # Example, # ocsp.enable=true # # Location of the OCSP responder # # By default, the location of the OCSP responder is determined implicitly # from the certificate being validated. This property explicitly specifies # the location of the OCSP responder. The property is used when the # Authority Information Access extension (defined in RFC 3280) is absent # from the certificate or when it requires overriding. # # Example, # ocsp.responderURL=http://ocsp.example.net:80 # # Subject name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. In cases where # the subject name alone is not sufficient to uniquely identify the certificate # then both the "ocsp.responderCertIssuerName" and # "ocsp.responderCertSerialNumber" properties must be used instead. When this # property is set then those two properties are ignored. # # Example, # ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp" # # Issuer name of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # distinguished name (defined in RFC 2253) which identifies a certificate in # the set of certificates supplied during cert path validation. When this # property is set then the "ocsp.responderCertSerialNumber" property must also # be set. When the "ocsp.responderCertSubjectName" property is set then this # property is ignored. # # Example, # ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp" # # Serial number of the OCSP responder's certificate # # By default, the certificate of the OCSP responder is that of the issuer # of the certificate being validated. This property identifies the certificate # of the OCSP responder when the default does not apply. Its value is a string # of hexadecimal digits (colon or space separators may be present) which # identifies a certificate in the set of certificates supplied during cert path # validation. When this property is set then the "ocsp.responderCertIssuerName" # property must also be set. When the "ocsp.responderCertSubjectName" property # is set then this property is ignored. # # Example, # ocsp.responderCertSerialNumber=2A:FF:00 # # Policy for failed Kerberos KDC lookups: # # When a KDC is unavailable (network error, service failure, etc), it is # put inside a blacklist and accessed less often for future requests. The # value (case-insensitive) for this policy can be: # # tryLast # KDCs in the blacklist are always tried after those not on the list. # # tryLess[:max_retries,timeout] # KDCs in the blacklist are still tried by their order in the configuration, # but with smaller max_retries and timeout values. max_retries and timeout # are optional numerical parameters (default 1 and 5000, which means once # and 5 seconds). Please notes that if any of the values defined here is # more than what is defined in krb5.conf, it will be ignored. # # Whenever a KDC is detected as available, it is removed from the blacklist. # The blacklist is reset when krb5.conf is reloaded. You can add # refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is # reloaded whenever a JAAS authentication is attempted. # # Example, # krb5.kdc.bad.policy = tryLast # krb5.kdc.bad.policy = tryLess:2,2000 krb5.kdc.bad.policy = tryLast # Algorithm restrictions for certification path (CertPath) processing # # In some environments, certain algorithms or key lengths may be undesirable # for certification path building and validation. For example, "MD2" is # generally no longer considered to be a secure hash algorithm. This section # describes the mechanism for disabling algorithms based on algorithm name # and/or key length. This includes algorithms used in certificates, as well # as revocation information such as CRLs and signed OCSP Responses. # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | CAConstraint | DenyAfterConstraint | # UsageConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # CAConstraint: # jdkCA # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # # The "AlgorithmName" is the standard algorithm name of the disabled # algorithm. See "Java Cryptography Architecture Standard Algorithm Name # Documentation" for information about Standard Algorithm Names. Matching # is performed using a case-insensitive sub-element matching rule. (For # example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and # "ECDSA" for signatures.) If the assertion "AlgorithmName" is a # sub-element of the certificate algorithm name, the algorithm will be # rejected during certification path building and validation. For example, # the assertion algorithm name "DSA" will disable all certificate algorithms # that rely on DSA, such as NONEwithDSA, SHA1withDSA. However, the assertion # will not disable algorithms related to "ECDSA". # # A "Constraint" defines restrictions on the keys and/or certificates for # a specified AlgorithmName: # # KeySizeConstraint: # keySize Operator KeyLength # The constraint requires a key of a valid size range if the # "AlgorithmName" is of a key algorithm. The "KeyLength" indicates # the key size specified in number of bits. For example, # "RSA keySize <= 1024" indicates that any RSA key with key size less # than or equal to 1024 bits should be disabled, and # "RSA keySize < 1024, RSA keySize > 2048" indicates that any RSA key # with key size less than 1024 or greater than 2048 should be disabled. # This constraint is only used on algorithms that have a key size. # # CAConstraint: # jdkCA # This constraint prohibits the specified algorithm only if the # algorithm is used in a certificate chain that terminates at a marked # trust anchor in the lib/security/cacerts keystore. If the jdkCA # constraint is not set, then all chains using the specified algorithm # are restricted. jdkCA may only be used once in a DisabledAlgorithm # expression. # Example: To apply this constraint to SHA-1 certificates, include # the following: "SHA1 jdkCA" # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # This constraint prohibits a certificate with the specified algorithm # from being used after the date regardless of the certificate's # validity. JAR files that are signed and timestamped before the # constraint date with certificates containing the disabled algorithm # will not be restricted. The date is processed in the UTC timezone. # This constraint can only be used once in a DisabledAlgorithm # expression. # Example: To deny usage of RSA 2048 bit certificates after Feb 3 2020, # use the following: "RSA keySize == 2048 & denyAfter 2020-02-03" # # UsageConstraint: # usage [TLSServer] [TLSClient] [SignedJAR] # This constraint prohibits the specified algorithm for # a specified usage. This should be used when disabling an algorithm # for all usages is not practical. 'TLSServer' restricts the algorithm # in TLS server certificate chains when server authentication is # performed. 'TLSClient' restricts the algorithm in TLS client # certificate chains when client authentication is performed. # 'SignedJAR' constrains use of certificates in signed jar files. # The usage type follows the keyword and more than one usage type can # be specified with a whitespace delimiter. # Example: "SHA1 usage TLSServer TLSClient" # # When an algorithm must satisfy more than one constraint, it must be # delimited by an ampersand '&'. For example, to restrict certificates in a # chain that terminate at a distribution provided trust anchor and contain # RSA keys that are less than or equal to 1024 bits, add the following # constraint: "RSA keySize <= 1024 & jdkCA". # # All DisabledAlgorithms expressions are processed in the order defined in the # property. This requires lower keysize constraints to be specified # before larger keysize constraints of the same algorithm. For example: # "RSA keySize < 1024 & jdkCA, RSA keySize < 2048". # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by Oracle's PKIX implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048 # # jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer, \ RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224 # # Algorithm restrictions for signed JAR files # # In some environments, certain algorithms or key lengths may be undesirable # for signed JAR validation. For example, "MD2" is generally no longer # considered to be a secure hash algorithm. This section describes the # mechanism for disabling algorithms based on algorithm name and/or key length. # JARs signed with any of the disabled algorithms or key sizes will be treated # as unsigned. # # The syntax of the disabled algorithm string is described as follows: # DisabledAlgorithms: # " DisabledAlgorithm { , DisabledAlgorithm } " # # DisabledAlgorithm: # AlgorithmName [Constraint] { '&' Constraint } # # AlgorithmName: # (see below) # # Constraint: # KeySizeConstraint | DenyAfterConstraint # # KeySizeConstraint: # keySize Operator KeyLength # # DenyAfterConstraint: # denyAfter YYYY-MM-DD # # Operator: # <= | < | == | != | >= | > # # KeyLength: # Integer value of the algorithm's key length in bits # # Note: This property is currently used by the JDK Reference # implementation. It is not guaranteed to be examined and used by other # implementations. # # See "jdk.certpath.disabledAlgorithms" for syntax descriptions. # jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024 # # Algorithm restrictions for Secure Socket Layer/Transport Layer Security # (SSL/TLS) processing # # In some environments, certain algorithms or key lengths may be undesirable # when using SSL/TLS. This section describes the mechanism for disabling # algorithms during SSL/TLS security parameters negotiation, including # protocol version negotiation, cipher suites selection, peer authentication # and key exchange mechanisms. # # Disabled algorithms will not be negotiated for SSL/TLS connections, even # if they are enabled explicitly in an application. # # For PKI-based peer authentication and key exchange mechanisms, this list # of disabled algorithms will also be checked during certification path # building and validation, including algorithms used in certificates, as # well as revocation information such as CRLs and signed OCSP Responses. # This is in addition to the jdk.certpath.disabledAlgorithms property above. # # See the specification of "jdk.certpath.disabledAlgorithms" for the # syntax of the disabled algorithm string. # # Note: The algorithm restrictions do not apply to trust anchors or # self-signed certificates. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.disabledAlgorithms=MD5, SSLv3, DSA, RSA keySize < 2048 jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, \ EC keySize < 224, 3DES_EDE_CBC, anon, NULL # Legacy algorithms for Secure Socket Layer/Transport Layer Security (SSL/TLS) # processing in JSSE implementation. # # In some environments, a certain algorithm may be undesirable but it # cannot be disabled because of its use in legacy applications. Legacy # algorithms may still be supported, but applications should not use them # as the security strength of legacy algorithms are usually not strong enough # in practice. # # During SSL/TLS security parameters negotiation, legacy algorithms will # not be negotiated unless there are no other candidates. # # The syntax of the legacy algorithms string is described as this Java # BNF-style: # LegacyAlgorithms: # " LegacyAlgorithm { , LegacyAlgorithm } " # # LegacyAlgorithm: # AlgorithmName (standard JSSE algorithm name) # # See the specification of security property "jdk.certpath.disabledAlgorithms" # for the syntax and description of the "AlgorithmName" notation. # # Per SSL/TLS specifications, cipher suites have the form: # SSL_KeyExchangeAlg_WITH_CipherAlg_MacAlg # or # TLS_KeyExchangeAlg_WITH_CipherAlg_MacAlg # # For example, the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA uses RSA as the # key exchange algorithm, AES_128_CBC (128 bits AES cipher algorithm in CBC # mode) as the cipher (encryption) algorithm, and SHA-1 as the message digest # algorithm for HMAC. # # The LegacyAlgorithm can be one of the following standard algorithm names: # 1. JSSE cipher suite name, e.g., TLS_RSA_WITH_AES_128_CBC_SHA # 2. JSSE key exchange algorithm name, e.g., RSA # 3. JSSE cipher (encryption) algorithm name, e.g., AES_128_CBC # 4. JSSE message digest algorithm name, e.g., SHA # # See SSL/TLS specifications and "Java Cryptography Architecture Standard # Algorithm Name Documentation" for information about the algorithm names. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # There is no guarantee the property will continue to exist or be of the # same syntax in future releases. # # Example: # jdk.tls.legacyAlgorithms=DH_anon, DES_CBC, SSL_RSA_WITH_RC4_128_MD5 # jdk.tls.legacyAlgorithms= \ K_NULL, C_NULL, M_NULL, \ DH_anon, ECDH_anon, \ RC4_128, RC4_40, DES_CBC, DES40_CBC, \ 3DES_EDE_CBC # The pre-defined default finite field Diffie-Hellman ephemeral (DHE) # parameters for Transport Layer Security (SSL/TLS/DTLS) processing. # # In traditional SSL/TLS/DTLS connections where finite field DHE parameters # negotiation mechanism is not used, the server offers the client group # parameters, base generator g and prime modulus p, for DHE key exchange. # It is recommended to use dynamic group parameters. This property defines # a mechanism that allows you to specify custom group parameters. # # The syntax of this property string is described as this Java BNF-style: # DefaultDHEParameters: # DefinedDHEParameters { , DefinedDHEParameters } # # DefinedDHEParameters: # "{" DHEPrimeModulus , DHEBaseGenerator "}" # # DHEPrimeModulus: # HexadecimalDigits # # DHEBaseGenerator: # HexadecimalDigits # # HexadecimalDigits: # HexadecimalDigit { HexadecimalDigit } # # HexadecimalDigit: one of # 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f # # Whitespace characters are ignored. # # The "DefinedDHEParameters" defines the custom group parameters, prime # modulus p and base generator g, for a particular size of prime modulus p. # The "DHEPrimeModulus" defines the hexadecimal prime modulus p, and the # "DHEBaseGenerator" defines the hexadecimal base generator g of a group # parameter. It is recommended to use safe primes for the custom group # parameters. # # If this property is not defined or the value is empty, the underlying JSSE # provider's default group parameter is used for each connection. # # If the property value does not follow the grammar, or a particular group # parameter is not valid, the connection will fall back and use the # underlying JSSE provider's default group parameter. # # Note: This property is currently used by OpenJDK's JSSE implementation. It # is not guaranteed to be examined and used by other implementations. # # Example: # jdk.tls.server.defaultDHEParameters= # { \ # FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 \ # 29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD \ # EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245 \ # E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED \ # EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381 \ # FFFFFFFF FFFFFFFF, 2} # Cryptographic Jurisdiction Policy defaults # # Import and export control rules on cryptographic software vary from # country to country. By default, the JDK provides two different sets of # cryptographic policy files: # # unlimited: These policy files contain no restrictions on cryptographic # strengths or algorithms. # # limited: These policy files contain more restricted cryptographic # strengths, and are still available if your country or # usage requires the traditional restrictive policy. # # The JDK JCE framework uses the unlimited policy files by default. # However the user may explicitly choose a set either by defining the # "crypto.policy" Security property or by installing valid JCE policy # jar files into the traditional JDK installation location. To better # support older JDK Update releases, the "crypto.policy" property is not # defined by default. See below for more information. # # The following logic determines which policy files are used: # # refers to the directory where the JRE was # installed and may be determined using the "java.home" # System property. # # 1. If the Security property "crypto.policy" has been defined, # then the following mechanism is used: # # The policy files are stored as jar files in subdirectories of # /lib/security/policy. Each directory contains a complete # set of policy files. # # The "crypto.policy" Security property controls the directory # selection, and thus the effective cryptographic policy. # # The default set of directories is: # # limited | unlimited # # 2. If the "crypto.policy" property is not set and the traditional # US_export_policy.jar and local_policy.jar files # (e.g. limited/unlimited) are found in the legacy # /lib/security directory, then the rules embedded within # those jar files will be used. This helps preserve compatibility # for users upgrading from an older installation. # # 3. If the jar files are not present in the legacy location # and the "crypto.policy" Security property is not defined, # then the JDK will use the unlimited settings (equivalent to # crypto.policy=unlimited) # # Please see the JCA documentation for additional information on these # files and formats. # # YOU ARE ADVISED TO CONSULT YOUR EXPORT/IMPORT CONTROL COUNSEL OR ATTORNEY # TO DETERMINE THE EXACT REQUIREMENTS. # # Please note that the JCE for Java SE, including the JCE framework, # cryptographic policy files, and standard JCE providers provided with # the Java SE, have been reviewed and approved for export as mass market # encryption item by the US Bureau of Industry and Security. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # crypto.policy=unlimited # # The policy for the XML Signature secure validation mode. The mode is # enabled by setting the property "org.jcp.xml.dsig.secureValidation" to # true with the javax.xml.crypto.XMLCryptoContext.setProperty() method, # or by running the code with a SecurityManager. # # Policy: # Constraint {"," Constraint } # Constraint: # AlgConstraint | MaxTransformsConstraint | MaxReferencesConstraint | # ReferenceUriSchemeConstraint | KeySizeConstraint | OtherConstraint # AlgConstraint # "disallowAlg" Uri # MaxTransformsConstraint: # "maxTransforms" Integer # MaxReferencesConstraint: # "maxReferences" Integer # ReferenceUriSchemeConstraint: # "disallowReferenceUriSchemes" String { String } # KeySizeConstraint: # "minKeySize" KeyAlg Integer # OtherConstraint: # "noDuplicateIds" | "noRetrievalMethodLoops" # # For AlgConstraint, Uri is the algorithm URI String that is not allowed. # See the XML Signature Recommendation for more information on algorithm # URI Identifiers. For KeySizeConstraint, KeyAlg is the standard algorithm # name of the key type (ex: "RSA"). If the MaxTransformsConstraint, # MaxReferencesConstraint or KeySizeConstraint (for the same key type) is # specified more than once, only the last entry is enforced. # # Note: This property is currently used by the JDK Reference implementation. It # is not guaranteed to be examined and used by other implementations. # jdk.xml.dsig.secureValidationPolicy=\ disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\ disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\ maxTransforms 5,\ maxReferences 30,\ disallowReferenceUriSchemes file http https,\ minKeySize RSA 1024,\ minKeySize DSA 1024,\ minKeySize EC 224,\ noDuplicateIds,\ noRetrievalMethodLoops # # Serialization process-wide filter # # A filter, if configured, is used by java.io.ObjectInputStream during # deserialization to check the contents of the stream. # A filter is configured as a sequence of patterns, each pattern is either # matched against the name of a class in the stream or defines a limit. # Patterns are separated by ";" (semicolon). # Whitespace is significant and is considered part of the pattern. # # If the system property jdk.serialFilter is also specified, it supersedes # the security property value defined here. # # If a pattern includes a "=", it sets a limit. # If a limit appears more than once the last value is used. # Limits are checked before classes regardless of the order in the sequence of patterns. # If any of the limits are exceeded, the filter status is REJECTED. # # maxdepth=value - the maximum depth of a graph # maxrefs=value - the maximum number of internal references # maxbytes=value - the maximum number of bytes in the input stream # maxarray=value - the maximum array length allowed # # Other patterns, from left to right, match the class or package name as # returned from Class.getName. # If the class is an array type, the class or package to be matched is the element type. # Arrays of any number of dimensions are treated the same as the element type. # For example, a pattern of "!example.Foo", rejects creation of any instance or # array of example.Foo. # # If the pattern starts with "!", the status is REJECTED if the remaining pattern # is matched; otherwise the status is ALLOWED if the pattern matches. # If the pattern ends with ".**" it matches any class in the package and all subpackages. # If the pattern ends with ".*" it matches any class in the package. # If the pattern ends with "*", it matches any class with the pattern as a prefix. # If the pattern is equal to the class name, it matches. # Otherwise, the status is UNDECIDED. # # Primitive types are not configurable with this filter. # #jdk.serialFilter=pattern;pattern # # RMI Registry Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI Registry or to decrease limits but not # to increase limits. # If the limits (maxdepth, maxrefs, or maxbytes) are exceeded, the object is rejected. # # The maxdepth of any array passed to the RMI Registry is set to # 10000. The maximum depth of the graph is set to 20. # These limits can be reduced via the maxarray, maxdepth limits. # #sun.rmi.registry.registryFilter=pattern;pattern # # Array construction of any component type, including subarrays and arrays of # primitives, are allowed unless the length is greater than the maxarray limit. # The filter is applied to each array element. # # The built-in filter allows subclasses of allowed classes and # can approximately be represented as the pattern: # #sun.rmi.registry.registryFilter=\ # maxarray=1000000;\ # maxdepth=20;\ # java.lang.String;\ # java.lang.Number;\ # java.lang.reflect.Proxy;\ # java.rmi.Remote;\ # sun.rmi.server.UnicastRef;\ # sun.rmi.server.RMIClientSocketFactory;\ # sun.rmi.server.RMIServerSocketFactory;\ # java.rmi.activation.ActivationID;\ # java.rmi.server.UID # # RMI Distributed Garbage Collector (DGC) Serial Filter # # The filter pattern uses the same format as jdk.serialFilter. # This filter can override the builtin filter if additional types need to be # allowed or rejected from the RMI DGC. # # The builtin DGC filter can approximately be represented as the filter pattern: # #sun.rmi.transport.dgcFilter=\ # java.rmi.server.ObjID;\ # java.rmi.server.UID;\ # java.rmi.dgc.VMID;\ # java.rmi.dgc.Lease;\ # maxdepth=5;maxarray=10000 # CORBA ORBIorTypeCheckRegistryFilter # Type check enhancement for ORB::string_to_object processing # # An IOR type check filter, if configured, is used by an ORB during # an ORB::string_to_object invocation to check the veracity of the type encoded # in the ior string. # # The filter pattern consists of a semi-colon separated list of class names. # The configured list contains the binary class names of the IDL interface types # corresponding to the IDL stub class to be instantiated. # As such, a filter specifies a list of IDL stub classes that will be # allowed by an ORB when an ORB::string_to_object is invoked. # It is used to specify a white list configuration of acceptable # IDL stub types which may be contained in a stringified IOR # parameter passed as input to an ORB::string_to_object method. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be examined and used by other implementations. # #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name # # JCEKS Encrypted Key Serial Filter # # This filter, if configured, is used by the JCEKS KeyStore during the # deserialization of the encrypted Key object stored inside a key entry. # If not configured or the filter result is UNDECIDED (i.e. none of the patterns # matches), the filter configured by jdk.serialFilter will be consulted. # # If the system property jceks.key.serialFilter is also specified, it supersedes # the security property value defined here. # # The filter pattern uses the same format as jdk.serialFilter. The default # pattern allows java.lang.Enum, java.security.KeyRep, java.security.KeyRep$Type, # and javax.crypto.spec.SecretKeySpec and rejects all the others. jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\ java.security.KeyRep$Type;javax.crypto.spec.SecretKeySpec;!* # # Policies for distrusting Certificate Authorities (CAs). # # This is a comma separated value of one or more case-sensitive strings, each # of which represents a policy for determining if a CA should be distrusted. # The supported values are: # # # SYMANTEC_TLS : Distrust TLS Server certificates anchored by a Symantec # root CA and issued after April 16, 2019 unless issued by one of the # following subordinate CAs which have a later distrust date: # 1. Apple IST CA 2 - G1, SHA-256 fingerprint: # AC2B922ECFD5E01711772FEA8ED372DE9D1E2245FCE3F57A9CDBEC77296A424B # Distrust after December 31, 2019. # 2. Apple IST CA 8 - G1, SHA-256 fingerprint: # A4FE7C7F15155F3F0AEF7AAA83CF6E06DEB97CA3F909DF920AC1490882D488ED # Distrust after December 31, 2019. # Leading and trailing whitespace surrounding each value are ignored. # Unknown values are ignored. If the property is commented out or set to the # empty String, no policies are enforced. # # Note: This property is currently used by the JDK Reference implementation. # It is not guaranteed to be supported by other SE implementations. Also, this # property does not override other security properties which can restrict # certificates such as jdk.tls.disabledAlgorithms or # jdk.certpath.disabledAlgorithms; those restrictions are still enforced even # if this property is not enabled. # jdk.security.caDistrustPolicies=SYMANTEC_TLS OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/logback-test.xml000066400000000000000000000005401525317257100272740ustar00rootroot00000000000000 %d %-5p [%c{2}] %m%n OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/000077500000000000000000000000001525317257100263535ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/trapperkeeper/000077500000000000000000000000001525317257100312245ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/trapperkeeper/services/000077500000000000000000000000001525317257100330475ustar00rootroot00000000000000metrics/000077500000000000000000000000001525317257100344365ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/trapperkeeper/servicesmetrics_service_test/000077500000000000000000000000001525317257100406635ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/trapperkeeper/services/metricsjolokia-access-permissive.xml000066400000000000000000000003221525317257100464550ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/puppetlabs/trapperkeeper/services/metrics/metrics_service_test OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/000077500000000000000000000000001525317257100247755ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/ca.pem000066400000000000000000000023551525317257100260700ustar00rootroot00000000000000-----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIUDJYUyp0efmPLt+DliGoXU47jk8AwDQYJKoZIhvcNAQEL BQAwSzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk9SMREwDwYDVQQHDAhQb3J0bGFu ZDEPMA0GA1UECgwGUHVwcGV0MQswCQYDVQQDDAJjYTAeFw0yMzA2MjAyMDQ0MzNa Fw0yNzA2MTkyMDQ0MzNaMEsxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJPUjERMA8G A1UEBwwIUG9ydGxhbmQxDzANBgNVBAoMBlB1cHBldDELMAkGA1UEAwwCY2EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpUdNnM0gmlgp8Ndf0DxuPpo4E ATIgTTvZYFfuGvImFyb81BA1/d6Dz94rHCF1pX32yn852At8UTqLRuB1el85iZ+q SLTh+Af4o0P641U//crbsV3Yp98Y0Lz+jJGItyzRkVoKq7qQMCpzSywSdEKSlqwz SGxJLY7w5+qfo/kXskI54nkGRuPlq1t0TYS33VQ7+eJRsR97yMo3kiX6gyBjnKhE nEGkliyms1I5q53f7mYVUjaCUyzxno3RcD3ARZ3/ZtM7zpmtvrSp18ei9jdlrW9y UcSqAHKEq0KTu72tbEGy/skcQMluEEWs4A/zMIIUnSQXjLZ5hvoYZDGLAapNAgMB AAGjUzBRMB0GA1UdDgQWBBQ9bGLAJw1nDiaM56J4KqMipIVDPjAfBgNVHSMEGDAW gBQ9bGLAJw1nDiaM56J4KqMipIVDPjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 DQEBCwUAA4IBAQAPTAksFtWnpcEXJ1A37AWRspjB1hz+Ss+WJSrp+i4nAzUjUqB4 5a8NmqXxhy/0picDdvT1+oN21SYWlaGaG3OU8AZaOcwJdOjAz9P5rkSnUDDZHdwx Xd51c0rovUEDbbda57we8+TUDgjJqkUt2ebN/kwVkQ/YFGZyLmAjHie/PFP+mX3O gBmLuD1OpU66fqHkRmDaFGDywpO7IunWKcU8ppwQG7XlsQPpEg7mNmS+sL0h7lHe chJ+6DdloVaqsbVfSx31eM4x8iHrfqif9YBjt8g3wAMYd4a4WPVsCXQvp7Tyqpci aLEJ9ZWG1IJoDQgys4wgEKlpszoinbfWAJCz -----END CERTIFICATE----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/cert.pem000066400000000000000000000021571525317257100264420ustar00rootroot00000000000000-----BEGIN CERTIFICATE----- MIIDGjCCAgICAQEwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCVVMxCzAJBgNV BAgMAk9SMREwDwYDVQQHDAhQb3J0bGFuZDEPMA0GA1UECgwGUHVwcGV0MQswCQYD VQQDDAJjYTAgFw0yMzA2MjAyMDQ3MDlaGA8yMTIzMDUyNzIwNDcwOVowWTELMAkG A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0 IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2r+H5HCGihCfovuBuQULBvV1UMJipeVGPm7 Lfs4B6pfxHBrNV1dejfmH8Vqs8DRTo5uHS8noodQfs/m0vBpqgKE4IPwzllE1+wY pi7Kq2mX35PLn6aYMAPJSSnTdAaOPPss0eeVGkNFGHPI4qr4aspZC6e9QspkhKoU ClDbLKYK9an61zbV4WeaFumdfli0uKR004lK9m9QnhLUmZ10KsY+4l9Nt3Vwflqi h6vqjZ0Tm77wcu7768vKCv5xXid9wiBFRn0gYDm3+EnAo03VtE7pz8x754EVRIrX hGBHxGFkGK1eRaUM0Q3FrJooITXCDcud+rfdetDvxt0ZcbabtQIDAQABMA0GCSqG SIb3DQEBCwUAA4IBAQBn6R99/CW+XyxPKqhm/haUuzgX4FJqzrU/grju4nYj3K9l Y094IOJNLNnxfQuRy1nAa8+cB+EDbA1Ct3wQ7p1AJgjTcdPagk5v/q3ZQ5V/hOY2 W41yVyEiNWOm5j7aa8YDUog2SPbI7UM8+RnYK19yeqJOsPUUe1OKUfI84drcCH7l gcQeVQYHbZiVX75MNOKOvur0oe72D1d36ZqZAA+xooM+wlrFB96ggBcqS07FMZQb d+N7SDZbhfO4ljHPT/R5xd1yItf8UlTzhHeH7IhY/e+vFx2PsIVB2EBJyGG6w2ig 757z++jrjVtsBc+sElcIta0hIZbe95cQ6uGIJKJR -----END CERTIFICATE----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/000077500000000000000000000000001525317257100262425ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/ca.pem000066400000000000000000000023551525317257100273350ustar00rootroot00000000000000-----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIUDJYUyp0efmPLt+DliGoXU47jk8AwDQYJKoZIhvcNAQEL BQAwSzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk9SMREwDwYDVQQHDAhQb3J0bGFu ZDEPMA0GA1UECgwGUHVwcGV0MQswCQYDVQQDDAJjYTAeFw0yMzA2MjAyMDQ0MzNa Fw0yNzA2MTkyMDQ0MzNaMEsxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJPUjERMA8G A1UEBwwIUG9ydGxhbmQxDzANBgNVBAoMBlB1cHBldDELMAkGA1UEAwwCY2EwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpUdNnM0gmlgp8Ndf0DxuPpo4E ATIgTTvZYFfuGvImFyb81BA1/d6Dz94rHCF1pX32yn852At8UTqLRuB1el85iZ+q SLTh+Af4o0P641U//crbsV3Yp98Y0Lz+jJGItyzRkVoKq7qQMCpzSywSdEKSlqwz SGxJLY7w5+qfo/kXskI54nkGRuPlq1t0TYS33VQ7+eJRsR97yMo3kiX6gyBjnKhE nEGkliyms1I5q53f7mYVUjaCUyzxno3RcD3ARZ3/ZtM7zpmtvrSp18ei9jdlrW9y UcSqAHKEq0KTu72tbEGy/skcQMluEEWs4A/zMIIUnSQXjLZ5hvoYZDGLAapNAgMB AAGjUzBRMB0GA1UdDgQWBBQ9bGLAJw1nDiaM56J4KqMipIVDPjAfBgNVHSMEGDAW gBQ9bGLAJw1nDiaM56J4KqMipIVDPjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3 DQEBCwUAA4IBAQAPTAksFtWnpcEXJ1A37AWRspjB1hz+Ss+WJSrp+i4nAzUjUqB4 5a8NmqXxhy/0picDdvT1+oN21SYWlaGaG3OU8AZaOcwJdOjAz9P5rkSnUDDZHdwx Xd51c0rovUEDbbda57we8+TUDgjJqkUt2ebN/kwVkQ/YFGZyLmAjHie/PFP+mX3O gBmLuD1OpU66fqHkRmDaFGDywpO7IunWKcU8ppwQG7XlsQPpEg7mNmS+sL0h7lHe chJ+6DdloVaqsbVfSx31eM4x8iHrfqif9YBjt8g3wAMYd4a4WPVsCXQvp7Tyqpci aLEJ9ZWG1IJoDQgys4wgEKlpszoinbfWAJCz -----END CERTIFICATE----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/ca_req.pem000066400000000000000000000020321525317257100301740ustar00rootroot00000000000000-----BEGIN CERTIFICATE REQUEST----- MIICzzCCAbcCAQAwSzELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk9SMREwDwYDVQQH DAhQb3J0bGFuZDEPMA0GA1UECgwGUHVwcGV0MQswCQYDVQQDDAJjYTCCASIwDQYJ KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKlR02czSCaWCnw11/QPG4+mjgQBMiBN O9lgV+4a8iYXJvzUEDX93oPP3iscIXWlffbKfznYC3xROotG4HV6XzmJn6pItOH4 B/ijQ/rjVT/9ytuxXdin3xjQvP6MkYi3LNGRWgqrupAwKnNLLBJ0QpKWrDNIbEkt jvDn6p+j+ReyQjnieQZG4+WrW3RNhLfdVDv54lGxH3vIyjeSJfqDIGOcqEScQaSW LKazUjmrnd/uZhVSNoJTLPGejdFwPcBFnf9m0zvOma2+tKnXx6L2N2Wtb3JRxKoA coSrQpO7va1sQbL+yRxAyW4QRazgD/MwghSdJBeMtnmG+hhkMYsBqk0CAwEAAaA/ MD0GCSqGSIb3DQEJDjEwMC4wCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAwFAYDVR0R BA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4IBAQBguGpJPBgYHD7uCYs/ 3eDGT7bC7TQOShX4V8lBEyE4/i43z71lO+QBn2vLN8L4v4EWunp2QKvZQmXeWsd6 LgIjs3UHY3PFUW2EOqI76FX98w7Ps+NZf39Wtc/9TgcqZKeQyUDVb9XCLJq9xH4A 6dgPiqaEGVIbMlaBcaBvbY1L5hDzeBw0aOkBhyI5Vh4YI4NBFQXnU3EXS9zrwNDw PwClRH0htVtocPzIo/XXGvcX/lkynS4oojfmMJsPOfLLyYam2fliWGYHXpINym7W sUR4qhimLzaSlinCpR90XygpWX0C/adoHZWuBa73JuBDwGks7ly1DtwtGr2OopL1 56UB -----END CERTIFICATE REQUEST----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/cakey.pem000066400000000000000000000000001525317257100300270ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/certdump/000077500000000000000000000000001525317257100300655ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/certdump/.gitkeep000066400000000000000000000000001525317257100315040ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/client-cert.pem000066400000000000000000000021571525317257100311630ustar00rootroot00000000000000-----BEGIN CERTIFICATE----- MIIDGjCCAgICAQEwDQYJKoZIhvcNAQELBQAwSzELMAkGA1UEBhMCVVMxCzAJBgNV BAgMAk9SMREwDwYDVQQHDAhQb3J0bGFuZDEPMA0GA1UECgwGUHVwcGV0MQswCQYD VQQDDAJjYTAgFw0yMzA2MjAyMDQ3MDlaGA8yMTIzMDUyNzIwNDcwOVowWTELMAkG A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0 IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2r+H5HCGihCfovuBuQULBvV1UMJipeVGPm7 Lfs4B6pfxHBrNV1dejfmH8Vqs8DRTo5uHS8noodQfs/m0vBpqgKE4IPwzllE1+wY pi7Kq2mX35PLn6aYMAPJSSnTdAaOPPss0eeVGkNFGHPI4qr4aspZC6e9QspkhKoU ClDbLKYK9an61zbV4WeaFumdfli0uKR004lK9m9QnhLUmZ10KsY+4l9Nt3Vwflqi h6vqjZ0Tm77wcu7768vKCv5xXid9wiBFRn0gYDm3+EnAo03VtE7pz8x754EVRIrX hGBHxGFkGK1eRaUM0Q3FrJooITXCDcud+rfdetDvxt0ZcbabtQIDAQABMA0GCSqG SIb3DQEBCwUAA4IBAQBn6R99/CW+XyxPKqhm/haUuzgX4FJqzrU/grju4nYj3K9l Y094IOJNLNnxfQuRy1nAa8+cB+EDbA1Ct3wQ7p1AJgjTcdPagk5v/q3ZQ5V/hOY2 W41yVyEiNWOm5j7aa8YDUog2SPbI7UM8+RnYK19yeqJOsPUUe1OKUfI84drcCH7l gcQeVQYHbZiVX75MNOKOvur0oe72D1d36ZqZAA+xooM+wlrFB96ggBcqS07FMZQb d+N7SDZbhfO4ljHPT/R5xd1yItf8UlTzhHeH7IhY/e+vFx2PsIVB2EBJyGG6w2ig 757z++jrjVtsBc+sElcIta0hIZbe95cQ6uGIJKJR -----END CERTIFICATE----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/client-key.pem000066400000000000000000000032501525317257100310110ustar00rootroot00000000000000-----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCvav4fkcIaKEJ+ i+4G5BQsG9XVQwmKl5UY+bst+zgHql/EcGs1XV16N+YfxWqzwNFOjm4dLyeih1B+ z+bS8GmqAoTgg/DOWUTX7BimLsqraZffk8ufppgwA8lJKdN0Bo48+yzR55UaQ0UY c8jiqvhqylkLp71CymSEqhQKUNsspgr1qfrXNtXhZ5oW6Z1+WLS4pHTTiUr2b1Ce EtSZnXQqxj7iX023dXB+WqKHq+qNnRObvvBy7vvry8oK/nFeJ33CIEVGfSBgObf4 ScCjTdW0TunPzHvngRVEiteEYEfEYWQYrV5FpQzRDcWsmighNcINy536t9160O/G 3Rlxtpu1AgMBAAECggEAEpB8aetjUyDZHqrg6y5Gmz9r4yi30QjHQPAm+NAKJzeG 8JNkKS7jFmzliA28w96/V/S3XxPPOkJfSLhoaYEDcbhYBym3eaMVZ9OG7Uls7fSc G894oIIBP62a5wkL5Y7PDVGYtfMwAqpFXPfd9e0ZorWc9GCRZUjll+um+MuDUodn wOu/BD2UddIEZhPg3W8OoAx8TxSsI4qPaw/S2hUKzTn+VZ6XRd338NHtLJvcMugc hYZX50xGD5D6Mo4OUcxaF4z4OPpKozfuOXYb/SOevcO5HTrRYsJfFfp63NQ9kEw7 khiImvrLaclAtL7T9mHyPFg6tk53SJzyc9HupxdkUQKBgQDzHWKFj+lMcmIPYtIv r3wdfrb32l4f1BzHUoDcF2epRnEKkj/lMvCeSycU1q2Nqkkia2+iXXPc2prnYcWD ldNhwNOqv4OSIxLMm30rMywPt+FmIQwaHoXUeFCPovOwdY7c01Gu3gPvJLWDC31d wzA+Y8GZhEAkztrw9c26QQoKRQKBgQC4txZvN22MjmfHi+UyPe1pDpKTCLCnx/yO MyLM5Lo2U9+yzNObnxN3u02vpcDQHKD3mMoEAlYiIJvZxhFNFw+ZT0KznBPlYi3/ wAnUL3hvCgC52/zKXgiqnZuN5aWHbQW/BVob65sC35kCoua/C+iu3blUYZtYexVS DGzWtriasQKBgQCCw0FkuX0woy1fPTX0dBz7+FYNhiSuVfaMtzGcL/KPt9XBa9x2 OSn22lFRAg8jbX4cx1CqMj3JgsNixNHp7sJdh8vRwWTRS5AnAVMX01RVt//CYPAT dGtjVrtuJqWQOgr3d6ottjjDfikrLRjnP79JL3rISbv+kExu4qcfETCHSQKBgQCK IN+1600Qfq08m3CZUZXnqe4R5b20uegyriqn7aMSXUY6/tB+30Y/kuFVKC43cjEs 9iSbOuQOQTRKdcMaUtRnYM4QYfa+4dxkE8dF1PnKj0BbvBYdfpQcgh+AzOori2tw nR/1IQqZ63sQbaD/3Hfzy/p7D0KLt/8JjCEXryv9AQKBgAQrK/U5wzbPrhCEmB9d /B5Ny3v8tbY+XyWMvG5YFotmBCF0DjRAjSb5XcgiO9vvGARyV4LXMsf6s4kbxjb1 6q6ZF0oc3PF0YKnkXJRgDlRN90kEZc46TvuE1sD0eKzXtMGtt984iZqOjmsbUmhR vsS3iyMbG+2XzMs/tQpAEqdc -----END PRIVATE KEY----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/client-req.pem000066400000000000000000000017311525317257100310120ustar00rootroot00000000000000-----BEGIN CERTIFICATE REQUEST----- MIICnjCCAYYCAQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9j YWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2r+H5HCGihC fovuBuQULBvV1UMJipeVGPm7Lfs4B6pfxHBrNV1dejfmH8Vqs8DRTo5uHS8noodQ fs/m0vBpqgKE4IPwzllE1+wYpi7Kq2mX35PLn6aYMAPJSSnTdAaOPPss0eeVGkNF GHPI4qr4aspZC6e9QspkhKoUClDbLKYK9an61zbV4WeaFumdfli0uKR004lK9m9Q nhLUmZ10KsY+4l9Nt3Vwflqih6vqjZ0Tm77wcu7768vKCv5xXid9wiBFRn0gYDm3 +EnAo03VtE7pz8x754EVRIrXhGBHxGFkGK1eRaUM0Q3FrJooITXCDcud+rfdetDv xt0ZcbabtQIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAIc0eUr2YxMoPzAraIiv FF3TEclNSTDjqZsmxOzlWP3M8LWN7AwU47pS3raeNrqL4k38pxhWqcqNg4DCi7t4 TEHvon+WZhcmfMf/C8OYD6xcoVLkFd7Nf4Vw7pacOVHMIzAXvtdShvvSjfXsU5Rf HbWdckcGIODkhkW9rAp6PdELeQlCWOsCsy6ej2osEo1f7UUI3oMLdPPkP3rPX+zo fE71qQaSw4Ib9vILhCrVguy65TtM0w7XIoyYKT31XZWPUi6BX1j/BVXP3Dyo8i3T rvCY5aD+gcL8063T0K6opezS55eAUxC6KaWr5B30yNIt9NfH3Z7T/VGWRP28yJvz nVI= -----END CERTIFICATE REQUEST----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/index.txt000066400000000000000000000001501525317257100301060ustar00rootroot00000000000000V 270619204433Z 0C9614CA9D1E7E63CBB7E0E5886A17538EE393C0 unknown /C=US/ST=OR/L=Portland/O=Puppet/CN=ca OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/index.txt.attr000066400000000000000000000000251525317257100310600ustar00rootroot00000000000000unique_subject = yes OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/move_files.sh000077500000000000000000000001351525317257100307300ustar00rootroot00000000000000#!/usr/bin/env sh cp ca.pem ../ cp client-key.pem ../key.pem cp client-cert.pem ../cert.pem OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/openssl.cnf000066400000000000000000000026241525317257100304210ustar00rootroot00000000000000[ ca ] default_ca = CA_default # The default ca section [ CA_default ] dir = . # Where everything is kept database = $dir/index.txt # database index file. new_certs_dir = $dir/certdump # certs sent to this location have garbage names certificate = $dir/ca.pem # The CA certificate private_key = $dir/private_keys/cakey.pem # The CA private key default_md = default # use public key default MD policy = policy_anything serial = $dir/serial # The current serial number default_days = 3650 # how long to certify for # For the CA policy [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional #################################################################### [ req ] distinguished_name = req_distinguished_name req_extensions = v3_req prompt = no [ req_distinguished_name ] C = US ST = OR L = Portland O = Puppet CN = ca [ v3_ca ] # Extensions for a typical CA # PKIX recommendation. subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer basicConstraints = critical,CA:true [ v3_req ] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = DNS:localhostOpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/private_keys/000077500000000000000000000000001525317257100307475ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/private_keys/cakey.pem000066400000000000000000000032501525317257100325460ustar00rootroot00000000000000-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCpUdNnM0gmlgp8 Ndf0DxuPpo4EATIgTTvZYFfuGvImFyb81BA1/d6Dz94rHCF1pX32yn852At8UTqL RuB1el85iZ+qSLTh+Af4o0P641U//crbsV3Yp98Y0Lz+jJGItyzRkVoKq7qQMCpz SywSdEKSlqwzSGxJLY7w5+qfo/kXskI54nkGRuPlq1t0TYS33VQ7+eJRsR97yMo3 kiX6gyBjnKhEnEGkliyms1I5q53f7mYVUjaCUyzxno3RcD3ARZ3/ZtM7zpmtvrSp 18ei9jdlrW9yUcSqAHKEq0KTu72tbEGy/skcQMluEEWs4A/zMIIUnSQXjLZ5hvoY ZDGLAapNAgMBAAECggEAI//fwLtohbu08v/HsH5dz8cLvtI6RB/nr6oKR/e2sF6P zYWRBMm7O69Af0311zuecpBPSI8ksgPbPK2PH6sq/+LA7cWTn8/KchTUaU1YXMir DtbBK0VV68LFzCE6+CRqBQywZkBo5Cs5e1XqQuoxFVWvux+U1mI3WAUXH2YPmffV vk2Nmd7aH5ZIN821YIsH8MF3iO0YAEwU8AIneD9yhh0TSu2BVvRbfg6Fb8bCyEqX /5nNFaVGzc+/tyIT0qBYTymfHNcpJ8o/1mb8YS3G/6mY6NhlPhcFSqwz+k6KKJjP Bg+h3RL/+yUNsZeMMOdIcW86jNVl5AEnV8NA3NkJCQKBgQDiuGm1udcdbuseMQla 1zYHmChUTu4uAacWQlTWJtZyBmDoe9EJi0b7rRF3zHbPTg4an5/X94SLARvKjmvT r7oLI7MBpZAlLDvBBwCwO2oA618gMr+9dk4Bkzq7Om9FpDKzWx+HzlfWPOG2wuvH 5cK3AFZiKbGk9gdhE1ixV5/JvwKBgQC/L7DpFSoSHPCGfkePJCVchHx8SuqcRwSw UY8KoRjX22KZYtl4nTEEB1/ef/FCjal3ZxzhJJOvlqjy+hU5zlQJCb6nP6G9Pitl YrSltqfzpkc+fBCcoi7xhK9G0Ns2nBNP0xoC3Lh24d4uqvN6IIu3JoH9fbZGEcqR ngCArTFW8wKBgDt0JLR1EYY0ag+2yD88JH0FV74UHL2PzWM27cxizuWD6rHMllqs XWbuUaBay+U9ENHGfkJCNE3HcqRBiOEwOddl+zE5W32EBf9ueK2+RuQK1R06cbGb boVXOJWUk01t66XBBZm1cK9Ls90bbH01MUSQIBcJ2/3oTrMUQbPvyIU9AoGAC6JH TaewC7IfINAGYrt8WojlWlrks+XObzxHTApJjLkY4uSU/zXxiaE5QDzg3X/pVA6+ PyUOp5yvYzm8mOvpSTOCmoLQwMdLtLuw6nSW+8iehTrfd+iWmrPMRq7m6AfPVQgv iQUNZI6SCpz0e/YHCnoZZueDc/gZL4tB1JK1cekCgYEA4oFvukGMuCcAjlN8djAZ matvyeIJ29VC2x55rr/zVAFn/DS5vOlJ4fxoIjG525BlyqTvV+BOwvCRftXnzWLC 3yC61FRyDOrTu9YS9O9aAjxflwWACYqQMdawG4k2hscMu1LrECK4e5OH8XYWjPpY ZK6PcybqLpVJ3MWEsideH0w= -----END PRIVATE KEY----- OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/regenerate_ca.sh000077500000000000000000000005411525317257100313650ustar00rootroot00000000000000#!/usr/bin/env sh #create a new CA cert and private key openssl req -new -newkey rsa:2048 -keyout private_keys/cakey.pem -extensions v3_ca -nodes -config ./openssl.cnf -out ca_req.pem openssl ca -batch -create_serial -days 1460 -keyfile private_keys/cakey.pem -selfsign -out ./ca.pem -notext -config ./openssl.cnf -extensions v3_ca -infiles ca_req.pem OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/config/serial000066400000000000000000000000511525317257100274400ustar00rootroot000000000000000C9614CA9D1E7E63CBB7E0E5886A17538EE393C1 OpenVoxProject-trapperkeeper-metrics-499ae4c/dev-resources/ssl/key.pem000066400000000000000000000032501525317257100262700ustar00rootroot00000000000000-----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCvav4fkcIaKEJ+ i+4G5BQsG9XVQwmKl5UY+bst+zgHql/EcGs1XV16N+YfxWqzwNFOjm4dLyeih1B+ z+bS8GmqAoTgg/DOWUTX7BimLsqraZffk8ufppgwA8lJKdN0Bo48+yzR55UaQ0UY c8jiqvhqylkLp71CymSEqhQKUNsspgr1qfrXNtXhZ5oW6Z1+WLS4pHTTiUr2b1Ce EtSZnXQqxj7iX023dXB+WqKHq+qNnRObvvBy7vvry8oK/nFeJ33CIEVGfSBgObf4 ScCjTdW0TunPzHvngRVEiteEYEfEYWQYrV5FpQzRDcWsmighNcINy536t9160O/G 3Rlxtpu1AgMBAAECggEAEpB8aetjUyDZHqrg6y5Gmz9r4yi30QjHQPAm+NAKJzeG 8JNkKS7jFmzliA28w96/V/S3XxPPOkJfSLhoaYEDcbhYBym3eaMVZ9OG7Uls7fSc G894oIIBP62a5wkL5Y7PDVGYtfMwAqpFXPfd9e0ZorWc9GCRZUjll+um+MuDUodn wOu/BD2UddIEZhPg3W8OoAx8TxSsI4qPaw/S2hUKzTn+VZ6XRd338NHtLJvcMugc hYZX50xGD5D6Mo4OUcxaF4z4OPpKozfuOXYb/SOevcO5HTrRYsJfFfp63NQ9kEw7 khiImvrLaclAtL7T9mHyPFg6tk53SJzyc9HupxdkUQKBgQDzHWKFj+lMcmIPYtIv r3wdfrb32l4f1BzHUoDcF2epRnEKkj/lMvCeSycU1q2Nqkkia2+iXXPc2prnYcWD ldNhwNOqv4OSIxLMm30rMywPt+FmIQwaHoXUeFCPovOwdY7c01Gu3gPvJLWDC31d wzA+Y8GZhEAkztrw9c26QQoKRQKBgQC4txZvN22MjmfHi+UyPe1pDpKTCLCnx/yO MyLM5Lo2U9+yzNObnxN3u02vpcDQHKD3mMoEAlYiIJvZxhFNFw+ZT0KznBPlYi3/ wAnUL3hvCgC52/zKXgiqnZuN5aWHbQW/BVob65sC35kCoua/C+iu3blUYZtYexVS DGzWtriasQKBgQCCw0FkuX0woy1fPTX0dBz7+FYNhiSuVfaMtzGcL/KPt9XBa9x2 OSn22lFRAg8jbX4cx1CqMj3JgsNixNHp7sJdh8vRwWTRS5AnAVMX01RVt//CYPAT dGtjVrtuJqWQOgr3d6ottjjDfikrLRjnP79JL3rISbv+kExu4qcfETCHSQKBgQCK IN+1600Qfq08m3CZUZXnqe4R5b20uegyriqn7aMSXUY6/tB+30Y/kuFVKC43cjEs 9iSbOuQOQTRKdcMaUtRnYM4QYfa+4dxkE8dF1PnKj0BbvBYdfpQcgh+AzOori2tw nR/1IQqZ63sQbaD/3Hfzy/p7D0KLt/8JjCEXryv9AQKBgAQrK/U5wzbPrhCEmB9d /B5Ny3v8tbY+XyWMvG5YFotmBCF0DjRAjSb5XcgiO9vvGARyV4LXMsf6s4kbxjb1 6q6ZF0oc3PF0YKnkXJRgDlRN90kEZc46TvuE1sD0eKzXtMGtt984iZqOjmsbUmhR vsS3iyMbG+2XzMs/tQpAEqdc -----END PRIVATE KEY----- OpenVoxProject-trapperkeeper-metrics-499ae4c/documentation/000077500000000000000000000000001525317257100242575ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/documentation/api.md000066400000000000000000000042061525317257100253540ustar00rootroot00000000000000# `MetricsService` API The `MetricsService` protocol provides two functions: `get-metrics-registry` and `update-registry-settings`. ### `get-metrics-registry` Takes an optional registry domain as a keyword. Returns the Dropwizard `MetricRegistry` for that domain, which can then be used to register new metrics. If no registry for this domain previously existed, creates the metric registry. If no domain is provided, returns the default registry. Can be called at any time, regardless of if or when `update-registry-settings` has been called. ### `update-registry-settings` Takes a domain and a map of settings, and registers these settings for the domain. Currently, the only available setting is `default-metrics-allowed`, which takes a vector of strings. This function can safely be called multiple times from different Trapperkeeper services. Since the only setting is currently `default-metrics-allowed`, each call to `update-registry-settings` will append the given `default-metrics-allowed` list to the existing list of allowed metrics for that domain. This means that different services can add metrics to the allowed list that are appropriate for that service, so that no one service needs to know the complete list of allowed metrics for the entire TK application Any calls to this function must be called during the `init` phase of the service lifecycle, since these settings are used to initialize registries and reporters during the metrics service's `start` phase. Example usage: ```clojure (trapperkeeper/defservice my-service [[:MetricsService get-metrics-registry update-registry-settings]] (init [this context] (update-registry-settings :foo {:default-metrics-allowed ["foo" "foo.bar"]) ...) (start [this context] (let [registry (get-metrics-registry :foo)] (core/do-something-with-metrics registry)) ...)) ``` ## Registry settings ### `default-metrics-allowed` This setting allows for specifying a list of metric names (as strings) that will be exported to configured reporters (e.g. Graphite - note that this setting does not apply to JMX). See [Metrics Filtering](./metrics_reporting_and_filtering.md) for more info. OpenVoxProject-trapperkeeper-metrics-499ae4c/documentation/configuration.md000066400000000000000000000065531525317257100274610ustar00rootroot00000000000000# Configuring the `MetricsService` All metrics get registered into a Dropwizard `MetricsRegistry`. Typically, each TK application will have its own metric registry, and multiple TK services will share that registry. The Metrics service has support for having multiple metrics registries. Each registry has its own `domain`, so that if multiple applications with different registries are running together in the same process, they will not have conflicts. There is also a `default` metrics registry that is automatically created. Much of the Metrics service configuration is per-registry. However, the `server-id` settings and the `reporters` settings (for `host`, `port`, and `update-interval-seconds`) are global (across all registries). To configure the Metrics service, edit the `metrics.conf` file in your `conf.d` directory. #### `metrics.conf` Here is a sample config file that illustrates the available settings for metrics: ``` metrics: { # a server id that will be used as part of the namespace for metrics produced # by this server server-id: localhost registries: { my-application: { # specify metrics to include in addition to the default list provided. # The combination of these two lists will be what gets exported to graphite and # other reporters (excluding JMX). metrics-allowed: [ "foo.bar" ] # the default prefix prepended to metric names on the # `metrics-allowed` list before filtering them is `puppetlabs.`. If # this does not match the prefix of an application's metrics, specify a different # prefix here so that metrics will be correctly filtered. metrics-prefix: "my-metrics" # enable and disable specific reporters, and set configuration # options specific for the registry. reporters: { # enable or disable JMX metrics reporter jmx: { enabled: true } # enable or disable graphite metrics reporter for this registry # and optionally override host/port/update-interval. graphite: { enabled: true update-interval-seconds: 5 } } } } # this section is used to configure host, port, and update-interval-seconds # for reporters. Note that reporters are not enabled in this section - # they must be enabled per-registry. reporters: { graphite: { # graphite host host: "127.0.0.1" # graphite metrics port port: 2003 # how often to send metrics to graphite update-interval-seconds: 60 } } metrics-webservice: { jolokia: { # Enable or disable the Jolokia-based metrics/v2 endpoint. # Default is true. enabled: false # Configure any of the settings listed at: # https://jolokia.org/reference/html/agents.html#war-agent-installation servlet-init-params: { # Specify a custom security policy: # https://jolokia.org/reference/html/security.html policyLocation: "file:///etc/puppetlabs//jolokia-access.xml" } } } } ``` OpenVoxProject-trapperkeeper-metrics-499ae4c/documentation/index.md000066400000000000000000000240421525317257100257120ustar00rootroot00000000000000# `trapperkeeper-metrics` Documentation ## What This Library Does The main purpose of this library is to provide some wrapper code around the [Dropwizard Metrics Java Library](https://dropwizard.github.io/metrics/3.1.0/), but there is some other functionality provided as well. Here are the major features available in `trapperkeeper-metrics`: * A `Trapperkeeper` service that handles life cycle management for objects from the Dropwizard Metrics library * Support for reading basic metrics configuration info from a `Trapperkeeper` config file, so that the metrics configuration syntax is consistent across all of your `Trapperkeeper` apps * Other utility functions for creating and interacting with metrics in your application For more detail on these features, read on. ### `MetricRegistry` Life Cycle The main entry point into the Dropwizard Metrics API is a class called [`MetricRegistry`](https://dropwizard.github.io/metrics/3.1.0/apidocs/com/codahale/metrics/MetricRegistry.html). This class requires some basic initialization, so `trapperkeeper-metrics` provides a Trapperkeeper service (`MetricsService`) that manages the life cycle of a `MetricRegistry`. The service includes a function, `get-metrics-registry`, so that all of your other Trapperkeeper services can access the registry and register new metrics with it. For example: ```clj (defservice my-service [[:MetricsService get-metrics-registry]] (init [this context] (let [metrics-registry (get-metrics-registry) my-metric-name (metrics/host-metric-name "localhost" "my-metric") my-timer (.timer metrics-registry my-metric-name)] (metrics/time! my-timer (do-some-work))) context)) ``` See the [source code for the sample app](https://github.com/puppetlabs/trapperkeeper-comidi-metrics/blob/master/dev/example/comidi_metrics_web_app.clj) for a working example. See the utility functions in the `trapperkeeper-metrics` [`puppetlabs.metrics`](../src/puppetlabs/metrics.clj) namespace for some helpers for constructing other kinds of metrics besides just `Timer`. See the [Dropwizard Metrics docs](https://dropwizard.github.io/metrics/3.1.0/) for more info about all of the available metrics types and their features. The `get-metrics-registry` also allows you to specify two additional fields, `registry-key` and `domain` which allow you to create other registries (besides the default given by `(get-metrics-registry)` and allow you to configure the namespace of the reporter for that registry. ```clj (defservice my-service [[:MetricsService get-metrics-registry]] (init [this context] (let [default-metrics-registry (get-metrics-registry) my-metrics-registry (get-metrics-registry "my.metrics.domain") ;; This will create the metric ;; `my.metrics.domain:name=puppetlabs.localhost.my-metric` my-metric-name (metrics/host-metric-name "localhost" "my-metric") my-timer (.timer metrics-registry my-metric-name)] (assert (not= default-metrics-registry my-metrics-registry)) (metrics/time! my-timer (do-some-work))) context) (start [this context] ;; We can retrieve the same metrics-registry later. (let [my-metrics-registry (get-metrics-registry "my.metrics.domain")] (do-some-other-work my-metrics-registry)) context)) ``` For more specific details on the service API, see the [`Metrics Service` API docs](./api.md). ### Configuration & Reporters The `MetricsService` also provides a configuration syntax that users can use to configure the metrics for a running TK app. This means that all TK services can provide a consistent interface for interacting with metrics. For more specific details, see the [`MetricsService` configuration docs](../documentation/configuration.md). ### Utility Functions The [`puppetlabs.metrics`](../src/puppetlabs/metrics.clj) namespace contains some utility functions for working with metrics. See the source code and docstrings for more detail. Here are a few bits of basic info: `time!` is a macro that can be used to time some Clojure forms against an existing `Timer`. e.g.: ```clj (let [my-timer (.timer (get-metrics-registry) "my.metric.name")] (time! my-timer (do-some-work!) (do-some-more-work!))) ``` `host-metric-name` can be used to provide a qualified, namespaced metric name. For best results, it is advisable to use this function to create a name for each of your application's metrics; this will ensure that the metrics are namespaced consistently across services. It will also ensure that metrics are namespaced by hostname, which is critical when consolidating metrics data from multiple hosts/services. You can use the `server-id` value from the `MetricsService` configuration to get the appropriate hostname for your metric. (TODO: this part of the API needs to be fleshed out a bit further. We might want to have a more dynamic way to get the hostname/server-id rather than having to put it into the config file. We may want to tweak some other things as well. *In the interim*, it's probably a good idea to *make it clear in your application/service documentation* that the specific metric namespaces should not be considered part of a formal API and may change in subsequent releases.) `register` can be used to add a metric to an existing `MetricRegistry`. `ratio`, `metered-ratio`, and `gauge` can be used to construct other types of Metrics. ### Low-level HTTP API To enable the HTTP API for accessing individual metrics add the service to your `bootstrap.cfg` and configure the `web-router-service` accordingly: ``` web-router-service { "puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice" : "/metrics" } ``` #### Listing available metrics ##### Request format To get a list of all available metric names: * Request `/metrics/v1/mbeans`. * Use a `GET` request. ##### Response format Responses return a JSON object mapping a string to a string: * The key is the name of a valid MBean. * The value is a URI to use for requesting that MBean's attributes. #### Retrieving multiple metrics ##### Request format To get a the attributes for multiple metrics at the same time: * Request `/metrics/v1/mbeans`. * Use a `POST` request. * Use a request body which is either a JSON object whose values are metric names, JSON array of metric names or a JSON string of a metric name. ##### Response format The response format, though always JSON, depends on the request format: * Requests with a JSON object will return the a JSON object where the values of the original object have been transformed into the Mbeans' attributes for the metric names. * Requests with a JSON array will return the a JSON array where the items of the original array have been transformed into the Mbeans' attributes for the metric names. * Requests with a JSON string will return the a JSON object of the Mbean's attributes for the given metric name. #### Retrieving an specific metric ##### Request format To get the attributes of a particular metric: * Request `/metrics/v1/mbeans/`, where `` is something that was returned in the list of available metrics specified above. * Use a `GET` request. ##### Response format Responses return a JSON object mapping strings to (strings/numbers/Booleans). For example, using `curl` from localhost: curl 'http://localhost:8080/metrics/v1/mbeans/java.lang:type=Memory' { "ObjectPendingFinalizationCount" : 0, "HeapMemoryUsage" : { "committed" : 807403520, "init" : 268435456, "max" : 3817865216, "used" : 129257096 }, "NonHeapMemoryUsage" : { "committed" : 85590016, "init" : 24576000, "max" : 184549376, "used" : 85364904 }, "Verbose" : false, "ObjectName" : "java.lang:type=Memory" } #### Alternatives Since we support sending the metrics data to JMX, there are several existing tools and approaches that can be used to read the data for individual metrics via JMX. JVisualVM is one example; see [pe-puppetserver-jruby-jmx-client](https://github.com/puppetlabs/pe-puppetserver-jruby-jmx-client) for an example of how to do this from a JRuby script. ## What This Library Does *Not* Do ## Notes for Developers For best results, use this library in combination with the [`comidi`](https://github.com/puppetlabs/comidi) library, and then take advantage of the `wrap-with-request-metrics` Ring middleware to track metrics about all HTTP requests made to your application. See the `comidi` docs for more info. ## In The Future There Will Be Robots Some ideas for things we might want to add/change in the future: ### metrics-clojure There is an existing clojure library that wraps Dropwizard Metrics: [`metrics-clojure`](https://github.com/sjl/metrics-clojure). At the time when we originally wrote our metrics code, this library was very out-of-date and didn't support some of the features we needed. It also seemed like a pretty thin facade around the Java library, and we decided that it wasn't worth adding an extra dependency. Since then, it's been updated and should be much more compatible with the more recent versions of Dropwizard Metrics. At a glance, it seems like it would be possible for other TK services to use `metrics-clojure` in combination with `trapperkeeper-metrics` as-is; it mostly just provides utility functions that should work fine with the `MetricRegistry` object surfaced by `trapperkeeper-metrics`. So, if you feel like the abstractions it provides over the Java library are worthwhile, try it out and let us know if something doesn't work properly. At some point in the future we may go ahead and add it as a direct dependency and refactor things in `trapperkeeper-metrics` to use it, but so far there hasn't been a hugely compelling reason to do so. ### Additional Facilities for Exposing Metrics There are a few other ideas floating around for how to make it easier for apps/services that are using `trapperkeeper-metrics` to expose the metrics info to end users. More utility functions for easier integration with status service, other tools for facilitating consumption / visualization / etc. Stay tuned. OpenVoxProject-trapperkeeper-metrics-499ae4c/documentation/metrics_reporting_and_filtering.md000066400000000000000000000056121525317257100332310ustar00rootroot00000000000000# Metrics Reporting and Filtering ## Metrics Reporting Currently, trapperkeeper-metrics has the ability to export metrics to two metrics reporters: JMX and Graphite. In order to set up metrics reporting, all that must be done is for the metrics registry domain to be listed under the `registries` key, and for the desired reporters to be enabled under that. In addition, the Graphite `host`, `port`, and `update-interval-seconds` must be set if reporting to Graphite. ## Metrics Filtering Some applications may have many more metrics than Graphite or other reporters can handle, or than users might find useful to see in Graphite. For this purpose, trapperkeeper-metrics provides the ability to filter the metrics an application has registered before sending them to configured reporters. If no filter is provided, all metrics are allowed through. If a filter is provided, then only the metrics on the `allow` list are allowed through. The `allow` list is made up of 1) the metrics on the `default-metrics-allowed` list, and 2) the metric names in the `metrics-allowed` section of the config. TK application developers who want to have a list of metric names that users cannot change (and don't have to worry about and will always be present after upgrade) should set these with the `default-metrics-allowed` setting. This is done using the [`update-registry-settings` service function](./api.md#update-registry-settings). The `metrics-allowed` setting in the config allows users to add additional metrics (on top of the `default-metrics-allowed`) that they would like to have exported. this is especially useful for metric names that include information from their environment - e.g. a node name. The metric names from the two lists (`default-metrics-allowed` and `metrics-allowed`) are combined and then prefixed with either `puppetlabs.` (where `server-id` is taken from that setting in the config) or the value of the `metrics-prefix` from the config. So, for example, a metric that is named `foo.bar` and prefixed with `puppetlabs.` to be `puppetlabs..foo.bar` could be "allowed" by adding it to the `default-metrics-allowed` list or the `metrics-allowed` config setting as `foo.bar`. If it was instead `some.other.prefix.foo.bar` then in addition to having `foo.bar` added to one of the allowed metrics lists, the `metrics-prefix` would need to be set to `some.other.metrics.prefix` in the config. Note that this filtering does not apply to JMX - if JMX reporting is enabled, all metrics will be sent to it, regardless of whether they are in the `metrics-allowed` list or not. In addition to metric name filtering, not all the metric "fields" are reported to Graphite for histogram/timer metrics. For these metrics, the `min`, `max`, `mean`, `count`, `stddev`, `p50`, `p75`, and `p95` are reported (`p98`, `p99`, `p9999`, `m5rate`, `m10rate`, and `m15rate` are not reported). This is not configurable. OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/000077500000000000000000000000001525317257100232245ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/000077500000000000000000000000001525317257100250235ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/README.md000066400000000000000000000137601525317257100263110ustar00rootroot00000000000000# Simple Ring App with Metrics Example This example demonstrates how to incorporate the trapperkeeper-metrics service into a simple Ring app. This is based loosely upon the [ring_app example] (https://github.com/openvoxproject/trapperkeeper-webserver/tree/master/examples/ring_app) in the trapperkeeper-webserver project. See that example for more information on the use of the `jetty-service` and the Jetty web server integration with Ring. All code needed to execute this example is located in `./src/examples/ring_app`. The Clojure code is contained in the `ring_app.clj` file. This example configures a metrics registry for the count service and adds two counters to that registry, `count-service-report-me` and `count-service-dont-report-me`. During initialization, the service only includes the `count-service-report-me` counter but not the `count-service-dont-report-me` counter in its list of `:default-metrics-allowed` for the count service registry: ~~~~clj (update-registry-settings :count-service {:default-metrics-allowed ["count-service-report-me"]}) ~~~~ Metric info for the `count-service-report-me` counter would be periodically reported to a Graphite server when the Graphite reporter is enabled. Info for the `count-service-dont-report-me` counter, however, would not be reported to the Graphite server -- whether or not the Graphite reporter is enabled. The JMX reporter is enabled by default in the `ring-example.conf` file. Both the `count-service-report-me` and `count-service-dont-report-me` counters are available via JMX, through the `/metrics` webservice endpoint. ## Launching trapperkeeper and running the app To start up trapperkeeper and launch the sample application, use the following `lein` command while in the root of the trapperkeeper-metrics repo: ~~~~sh lein trampoline run --config ./examples/ring_app/ring-example.conf \ --bootstrap-config ./examples/ring_app/bootstrap.cfg ~~~~ For convenience, the application could also be run instead via the `ring-example` alias: ~~~~sh lein ring-example ~~~~ ### Running the app from the repl To startup the sample application from the repl, use the following `lein` command while in the root of the trapperkeeper-metrics repo: ~~~~sh lein repl ~~~~ The `repl` prompt should display the namespace of the ring-app example. Type `(go)` and press enter in order to launch the app: ~~~~sh examples.ring-app.repl=> (go) ~~~~ ### The `bootstrap.cfg` file The bootstrap config file contains a list of services that trapperkeeper will load up and make available. They are listed as fully-qualified Clojure namespaces and service names. For this example, the bootstrap.cfg looks like this: ~~~~ puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-service puppetlabs.trapperkeeper.services.webserver.jetty-service/jetty-service puppetlabs.trapperkeeper.services.webrouting.webrouting-service/webrouting-service examples.ring-app.ring-app/count-service ~~~~ This configuration indicates that the metrics services, `WebserverService` and `WebroutingService` from the `trapperkeeper-webserver` project, and the count service, defined in the `ring_app.clj` file, are to be loaded. ### The `ring-example.conf` configuration file For the application configuration, a file called `ring-example.conf` provides a fairly minimal configuration for the count service: ~~~~hocon global: { logging-config: ./examples/ring_app/logback.xml } webserver: { port: 8080 } web-router-service: { "puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice": "/metrics" } metrics: { server-id: "localhost" registries: { count-service: { reporters: { jmx: { enabled: true } graphite: { enabled: false } } } } metrics-webservice: { jolokia: { enabled: true } } reporters: { graphite: { host: "127.0.0.1" port: 2003 update-interval-seconds: 5 } } } ~~~~ The Graphite reporter is disabled by default in the `ring-example.conf` configuration file. Assuming a Graphite server were running on host `foo`, you could make the following changes to the configuration to enable reporting to the `foo` server: ~~~ ... metrics: { ... registries: { count-service: { reporters: { ... graphite: { enabled: true } } } } ... reporters: { graphite: { host: "foo" ... } } ~~~ ### Testing the counter service metrics The counter service increments the `count-service-report-me` and `count-service-dont-report-me` counters each time a request is made to its `/count` endpoint. To view the latest value stored in JMX for each counter, query the `/metrics` webservice. For example, the following request would obtain info for the `count-service-report-me` counter: ~~~~sh curl http://127.0.0.1:8080/metrics/v2/read/count-service:name=puppetlabs.localhost.count-service-report-me ~~~~ Just after startup, this would show that the current counter value is 0: ~~~~json { "request": { "mbean": "count-service:name=puppetlabs.localhost.count-service-report-me", "type": "read" }, "status": 200, "timestamp": 1486831476, "value": { "Count": 0 } } ~~~~ Make a request to the count service's endpoint to increment the counters: ~~~~ curl http://127.0.0.1:8080/count ~~~~ When the `.../metrics/v2` request from above is repeated, the value returned from JMX should have increased by 1: ~~~~json { "request": { "mbean": "count-service:name=puppetlabs.localhost.count-service-report-me", "type": "read" }, "status": 200, "timestamp": 1486831664, "value": { "Count": 1 } } ~~~~ OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/bootstrap.cfg000066400000000000000000000005331525317257100275220ustar00rootroot00000000000000puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-service puppetlabs.trapperkeeper.services.webserver.jetty-service/jetty-service puppetlabs.trapperkeeper.services.webrouting.webrouting-service/webrouting-service examples.ring-app.ring-app/count-service OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/logback.xml000066400000000000000000000004521525317257100271500ustar00rootroot00000000000000 %d %-5p [%c{2}] %m%n OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/ring-example.conf000066400000000000000000000013511525317257100302620ustar00rootroot00000000000000global: { logging-config: ./examples/ring_app/logback.xml } webserver: { port: 8080 } web-router-service: { "puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice": "/metrics" } metrics: { server-id: "localhost" registries: { count-service: { reporters: { jmx: { enabled: true } graphite: { enabled: false } } } } metrics-webservice: { jolokia: { enabled: true } } reporters: { graphite: { host: "127.0.0.1" port: 2003 update-interval-seconds: 5 } } } OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/src/000077500000000000000000000000001525317257100256125ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/src/examples/000077500000000000000000000000001525317257100274305ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/src/examples/ring_app/000077500000000000000000000000001525317257100312275ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/src/examples/ring_app/repl.clj000066400000000000000000000035471525317257100326740ustar00rootroot00000000000000(ns examples.ring-app.repl (:require [puppetlabs.trapperkeeper.core :as tk] [puppetlabs.trapperkeeper.app :as tka] [puppetlabs.trapperkeeper.bootstrap :as bootstrap] [puppetlabs.trapperkeeper.config :as config] [clojure.tools.namespace.repl :refer (refresh)])) ;; This namespace shows an example of the "reloaded" clojure workflow ;; ( http://thinkrelevance.com/blog/2013/06/04/clojure-workflow-reloaded ) ;; ;; It's based on the pattern from Stuart Sierra's `Component` library: ;; ( https://github.com/stuartsierra/component#reloading ) ;; ;; You can load this namespace up into a REPL and then run `(go)` to boot ;; and run the sample application. Then, you can run `(reset)` at any time ;; to stop the running app, reload all of the necessary namespaces, and start ;; a new instance of the app. This means that you can do iterative development ;; without having to restart the whole JVM. ;; ;; You can also view the context of the application (and all of the ;; trapperkeeper services) via `(context)` (or pretty-printed with ;; `print-context`). (def system nil) (defn init [] (alter-var-root #'system (fn [_] (tk/build-app (bootstrap/parse-bootstrap-config! "./examples/ring_app/bootstrap.cfg") (config/load-config "./examples/ring_app/ring-example.conf")))) (alter-var-root #'system tka/init) (tka/check-for-errors! system)) (defn start [] (alter-var-root #'system (fn [s] (if s (tka/start s)))) (tka/check-for-errors! system)) (defn stop [] (alter-var-root #'system (fn [s] (if s (tka/stop s))))) (defn go [] (init) (start)) (defn context [] @(tka/app-context system)) (defn print-context [] (clojure.pprint/pprint (context))) (defn reset [] (stop) (refresh :after 'examples.ring-app.repl/go)) OpenVoxProject-trapperkeeper-metrics-499ae4c/examples/ring_app/src/examples/ring_app/ring_app.clj000066400000000000000000000027251525317257100335260ustar00rootroot00000000000000(ns examples.ring-app.ring-app (:require [clojure.tools.logging :as log] [puppetlabs.metrics :as metrics] [puppetlabs.trapperkeeper.core :refer [defservice]] [puppetlabs.trapperkeeper.services :refer [service-context]])) (defservice count-service [[:MetricsService update-registry-settings get-metrics-registry get-server-id] [:WebserverService add-ring-handler]] (init [this context] (log/info "Count service starting up") (let [registry (get-metrics-registry :count-service) server-id (get-server-id) counter-to-report (.counter registry (metrics/host-metric-name server-id "count-service-report-me")) counter-to-not-report (.counter registry (metrics/host-metric-name server-id "count-service-dont-report-me"))] (add-ring-handler (fn [_] (.inc counter-to-report) (.inc counter-to-not-report) {:status 200 :headers {"Content-Type" "text/plain"} :body (str "Requests made since startup: " (.getCount counter-to-report))}) "/count")) (update-registry-settings :count-service {:default-metrics-allowed ["count-service-report-me"]}) context)) OpenVoxProject-trapperkeeper-metrics-499ae4c/locales/000077500000000000000000000000001525317257100230305ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/locales/trapperkeeper-metrics.pot000066400000000000000000000015441525317257100300750ustar00rootroot00000000000000# SOME DESCRIPTIVE TITLE. # Copyright (C) YEAR Puppet # This file is distributed under the same license as the puppetlabs.trapperkeeper_metrics package. # FIRST AUTHOR , YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: puppetlabs.trapperkeeper_metrics \n" "Report-Msgid-Bugs-To: docs@puppet.com\n" "POT-Creation-Date: \n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #: src/clj/puppetlabs/trapperkeeper/services/metrics/metrics_core.clj msgid "metrics request must be a JSON array, string, or object" msgstr "" #: src/clj/puppetlabs/trapperkeeper/services/metrics/metrics_core.clj msgid "No mbean ''{0}'' found" msgstr "" OpenVoxProject-trapperkeeper-metrics-499ae4c/project.clj000066400000000000000000000141421525317257100235500ustar00rootroot00000000000000(def i18n-version "1.0.5") (def dropwizard-metrics-version "3.2.6") (defproject org.openvoxproject/trapperkeeper-metrics "2.3.3" :description "Trapperkeeper Metrics Service" :url "http://github.com/openvoxproject/trapperkeeper-metrics" :license {:name "Apache License, Version 2.0" :url "http://www.apache.org/licenses/LICENSE-2.0.html"} :min-lein-version "2.12.0" :pedantic? :abort ;; Generally, try to keep version pins in :managed-dependencies and the libraries ;; this project actually uses in :dependencies, inheriting the version from ;; :managed-dependencies. This prevents endless version conflicts due to deps of deps. ;; Renovate should keep the versions largely in sync between projects. :managed-dependencies [[org.clojure/clojure "1.12.6"] [org.clojure/java.jmx "1.1.1"] [org.clojure/tools.logging "1.3.1"] [cheshire "6.2.0"] [commons-codec "1.22.1"] [commons-io "2.22.0"] [io.dropwizard.metrics/metrics-core ~dropwizard-metrics-version] [io.dropwizard.metrics/metrics-graphite ~dropwizard-metrics-version] [org.bouncycastle/bcpkix-jdk18on "1.84"] [org.bouncycastle/bcpkix-fips "1.0.8"] [org.bouncycastle/bc-fips "1.0.2.6"] [org.bouncycastle/bctls-fips "1.0.19"] [org.jolokia/jolokia-server-core "2.6.2"] [org.jolokia/jolokia-service-jmx "2.6.2"] [org.jolokia/jolokia-service-serializer "2.6.2"] [org.openvoxproject/comidi "1.1.4"] [org.openvoxproject/http-client "2.4.1"] [org.openvoxproject/i18n ~i18n-version] [org.openvoxproject/kitchensink "3.5.8"] [org.openvoxproject/kitchensink "3.5.8" :classifier "test"] [org.openvoxproject/ring-middleware "2.2.1"] [org.openvoxproject/trapperkeeper "5.0.6"] [org.openvoxproject/trapperkeeper "5.0.6" :classifier "test"] [org.openvoxproject/trapperkeeper-authorization "2.4.1"] [org.openvoxproject/trapperkeeper-webserver "12.1.1"] [org.ring-clojure/ring-jakarta-servlet "1.15.5"] [org.slf4j/slf4j-api "2.0.19"] [prismatic/schema "1.4.2"] [ring/ring-codec "1.3.0"] [ring/ring-core "1.15.5"]] :dependencies [[org.clojure/clojure] [org.clojure/java.jmx] [org.clojure/tools.logging] [cheshire] [io.dropwizard.metrics/metrics-core] [io.dropwizard.metrics/metrics-graphite] [org.jolokia/jolokia-server-core] [org.jolokia/jolokia-service-jmx] [org.jolokia/jolokia-service-serializer] [org.openvoxproject/comidi] [org.openvoxproject/i18n] [org.openvoxproject/kitchensink] [org.openvoxproject/ring-middleware] [org.openvoxproject/trapperkeeper] [org.openvoxproject/trapperkeeper-authorization] [org.ring-clojure/ring-jakarta-servlet] [prismatic/schema]] :plugins [[org.openvoxproject/i18n ~i18n-version]] :source-paths ["src/clj"] :java-source-paths ["src/java"] :deploy-repositories [["releases" {:url "https://clojars.org/repo" :username :env/CLOJARS_USERNAME :password :env/CLOJARS_PASSWORD :sign-releases false}]] :classifiers [["test" :testutils]] :profiles {:defaults {:dependencies [[org.openvoxproject/http-client] [org.openvoxproject/kitchensink :classifier "test"] [org.openvoxproject/trapperkeeper :classifier "test"] [org.openvoxproject/trapperkeeper-webserver]]} :dev-dependencies {:dependencies [[org.bouncycastle/bcpkix-jdk18on]]} :dev [:defaults :dev-dependencies] :fips-dependencies {:dependencies [[org.bouncycastle/bcpkix-fips] [org.bouncycastle/bc-fips] [org.bouncycastle/bctls-fips]] :jvm-opts ~(let [version (System/getProperty "java.specification.version") [major minor _] (clojure.string/split version #"\.") unsupported-ex (ex-info "Unsupported major Java version. Expects 17, 21 or 25." {:major major :minor minor})] (condp = (java.lang.Integer/parseInt major) 17 ["-Djava.security.properties==./dev-resources/java.security.jdk17-fips"] 21 ["-Djava.security.properties==./dev-resources/java.security.jdk21-fips"] 25 ["-Djava.security.properties==./dev-resources/java.security.jdk25-fips"] (throw unsupported-ex)))} :fips [:defaults :fips-dependencies] ;; per https://github.com/technomancy/leiningen/issues/1907 ;; the provided profile is necessary for lein jar / lein install :provided {:dependencies [[org.bouncycastle/bcpkix-jdk18on]]} :testutils {:source-paths ^:replace ["test"] :java-source-paths ^:replace []}} :repl-options {:init-ns examples.ring-app.repl} :main puppetlabs.trapperkeeper.main) OpenVoxProject-trapperkeeper-metrics-499ae4c/renovate.json000066400000000000000000000004061525317257100241240ustar00rootroot00000000000000{ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "addLabels": ["renovate", "dependencies"], "assigneesFromCodeOwners": true, "automerge": true, "automergeType": "pr", "dependencyDashboard": true, "enabledManagers": ["leiningen"] } OpenVoxProject-trapperkeeper-metrics-499ae4c/resources/000077500000000000000000000000001525317257100234205ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/resources/jolokia-access.xml000066400000000000000000000005441525317257100270340ustar00rootroot00000000000000 read list version search OpenVoxProject-trapperkeeper-metrics-499ae4c/src/000077500000000000000000000000001525317257100221755ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/000077500000000000000000000000001525317257100227455ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/000077500000000000000000000000001525317257100251245ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/metrics.clj000066400000000000000000000056131525317257100272710ustar00rootroot00000000000000;; Utility functions for working with the Metrics library (ns puppetlabs.metrics (:import (com.codahale.metrics MetricRegistry RatioGauge RatioGauge$Ratio Gauge Metric Metered Sampling Timer) (java.util.concurrent TimeUnit)) (:require [schema.core :as schema])) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;; Public (schema/defn ^:always-validate host-metric-name :- schema/Str "Given a hostname and a metric name, build a qualified metric name for use with Metrics." [hostname :- schema/Str metric-name :- schema/Str] (MetricRegistry/name "puppetlabs" (into-array String [hostname metric-name]))) (schema/defn ^:always-validate http-metric-name :- schema/Str "Given a hostname and a metric name, build a qualified http metric name for use with Metrics." [hostname :- schema/Str metric-name :- schema/Str] (MetricRegistry/name "puppetlabs" (into-array String [hostname "http" metric-name]))) (schema/defn ^:always-validate register :- Metric "Register a metric with a metrics registry, using the given metric name." [registry :- MetricRegistry metric-name :- schema/Str metric :- Metric] (.register registry metric-name metric)) (schema/defn mean :- Double "Given a Timer or Histogram object, get the current mean value." [sampling :- Sampling] (.. sampling getSnapshot getMean)) (schema/defn mean-millis :- Long "Given a Timer or Histogram object, get the mean sample time in milliseconds." [sampling :- Sampling] (.toMillis TimeUnit/NANOSECONDS (mean sampling))) (schema/defn mean-in-unit :- Long "Given a Timer or Histogram object, get the mean sample time in the specified time unit." [sampling :- Sampling time-unit :- TimeUnit] (.convert time-unit (mean sampling) TimeUnit/NANOSECONDS)) (schema/defn ^:always-validate ratio :- RatioGauge "Given two functions, return a Ratio metric whose value will be computed by calling the first function to retrieve the numerator and the second function to retrieve the denominator" [numerator-fn :- (schema/pred ifn?) denominator-fn :- (schema/pred ifn?)] (proxy [RatioGauge] [] (getRatio [] (RatioGauge$Ratio/of (numerator-fn) (denominator-fn))))) (schema/defn ^:always-validate metered-ratio :- RatioGauge "Given two Metered metrics, construct a Ratio metric whose numerator and denominator are computed by calling the `getCount` method of the Metered metrics." [numerator :- Metered denominator :- Metered] (ratio #(.getCount numerator) #(.getCount denominator))) (schema/defn ^:always-validate gauge :- Gauge "Returns a Gauge metric with an initial value" [value] (proxy [Gauge] [] (getValue [] value))) (defmacro time! "Times the body forms against the given Timer metric" [^Timer t & body] `(.time ~(vary-meta t assoc :tag `Timer) (proxy [Callable] [] (call [] (do ~@body))))) OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/000077500000000000000000000000001525317257100277755ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/000077500000000000000000000000001525317257100316205ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/metrics/000077500000000000000000000000001525317257100332665ustar00rootroot00000000000000jolokia.clj000066400000000000000000000103421525317257100353310ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.jolokia "Clojure helpers for constructing and configuring Jolokia servlets." (:require [clojure.tools.logging :as log] [clojure.walk :as walk] [ring.util.jakarta.servlet :as ring-servlet] [schema.core :as schema]) (:import [jakarta.servlet.http HttpServletRequest] [org.jolokia.core.api LogHandler] [org.jolokia.server.core.config ConfigKey] [org.jolokia.server.core.http AgentServlet])) (def config-mapping "Inspects the Jolokia ConfigKey Enum and generates a mapping that associates a Clojure keyword with each configuration parameter. The keyword used is the camel-cased identifier that would be used to configure a servlet via a web.xml file. For example, `ConfigKey/AGENT_ID` is associated with the keyword `:agentId`. For a complete list of configuration options, see: https://jolokia.org/reference/html/agents.html#agent-war-init-params" (->> (ConfigKey/values) (map (juxt #(-> % .getKeyValue keyword) identity)) (into {}))) (schema/defschema JolokiaConfig "Schema for validating Clojure maps containing Jolokia configuration. Creates a map of optional keys which have string values using the config-mapping extracted from the ConfigKey enum." (->> (keys config-mapping) (map #(vector (schema/optional-key %) schema/Str)) (into {}))) (def config-defaults "Default configuration values for Jolokia." {;; When set to "false", no debug-level messages are produced by the Jolokia ;; namespace. This is unfortunate for debuggability, but having debug set to ;; "true" causes a lot of useless error messages and backtraces to flood the ;; logs when 404 results are generated by requests for JMX items that ;; do not exist. :debug "false" ;; Don't include backtraces in error results returned by the API. :allowErrorDetails "false" ;; Used by jolokia-access to match IPv4 and IPv6 to "localhost" :allowDnsReverseLookup "true" ;; Load access policy from: resources/jolokia-access.xml :policyLocation "classpath:/jolokia-access.xml" :mimeType "application/json"}) (defn create-servlet-config "Generate Jolokia AgentServlet configuration from a Clojure map" ([] (create-servlet-config {})) ([config] (->> config (merge config-defaults) ;; Validate here to ensure defaults are also valid. (schema/validate JolokiaConfig) walk/stringify-keys))) (defn create-logger "Return an object that implements the Jolokia logging interface using the logger from clojure.tools.logging" [] (reify LogHandler (debug [this message] (log/debug message)) (info [this message] (log/info message)) (error [this message throwable] (log/error throwable message)) (isDebug [this] (log/enabled? :debug)))) (defn create-servlet "Builds a Jolokia Servlet that uses Clojure logging." [auth-check-fn] (let [check-auth (if auth-check-fn (fn [^HttpServletRequest request] (auth-check-fn (ring-servlet/build-request-map request))) (fn [^HttpServletRequest request] {:authorized true :message ""}))] (if auth-check-fn (log/info "Metrics access control using trapperkeeper-authorization is enabled.") (log/warn "Metrics access control using trapperkeeper-authorization is disabled. Add the authorization service to the trapperkeeper bootstrap configuration file to enable it.")) (proxy [AgentServlet] [] ;; NOTE: An alternative to this method override would be to use defrecord ;; to create a class that can be set as `:logHandlerClass` in the servlet ;; configuration. This requires AOT compilation for the namespace defining ;; the record so that Jolokia can find the resulting class. (createLogHandler [_ _] (create-logger)) (service [request response] (let [{:keys [authorized message]} (check-auth request)] (if-not authorized (ring-servlet/update-servlet-response response {:status 403 :headers {} :body message}) (proxy-super service request response))))))) metrics_core.clj000066400000000000000000000402741525317257100363660ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-core (:import (com.codahale.metrics JmxReporter MetricRegistry) (com.fasterxml.jackson.core JsonParseException) (com.puppetlabs.trapperkeeper.metrics GraphiteReporter AllowedNamesMetricFilter) (java.util.concurrent TimeUnit) (java.net InetSocketAddress) (com.codahale.metrics.graphite Graphite GraphiteSender)) (:require [cheshire.core :as json] [clojure.java.io :as io] [puppetlabs.comidi :as comidi] [puppetlabs.i18n.core :as i18n :refer [tru]] [puppetlabs.kitchensink.core :as ks] [puppetlabs.ring-middleware.utils :as ringutils] [puppetlabs.trapperkeeper.services.metrics.jolokia :as jolokia] [puppetlabs.trapperkeeper.services.metrics.metrics-utils :as metrics-utils] [ring.middleware.content-type :as ring-content-type] [ring.middleware.keyword-params :as ring-keyword-params] [ring.middleware.not-modified :as ring-not-modified] [ring.middleware.params :as ring-params] [schema.core :as schema])) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;; Schemas (def JmxReporterConfig {:enabled schema/Bool}) (def JolokiaApiConfig {(schema/optional-key :enabled) schema/Bool (schema/optional-key :servlet-init-params) jolokia/JolokiaConfig}) (def MbeansApiConfig {(schema/optional-key :enabled) schema/Bool}) (def WebserviceConfig {(schema/optional-key :mbeans) MbeansApiConfig (schema/optional-key :jolokia) JolokiaApiConfig}) (def BaseGraphiteReporterConfig {:host schema/Str :port schema/Int :update-interval-seconds schema/Int}) (def GraphiteReporterConfig (assoc BaseGraphiteReporterConfig :enabled schema/Bool)) ;; schema for what is read from config file for a registry (def GraphiteRegistryReporterConfig (assoc (ks/mapkeys schema/optional-key BaseGraphiteReporterConfig) :enabled schema/Bool)) (def RegistryReportersConfig {(schema/optional-key :jmx) JmxReporterConfig (schema/optional-key :graphite) GraphiteRegistryReporterConfig}) (def RegistryConfig {(schema/optional-key :metrics-allowed) [schema/Str] (schema/optional-key :metric-prefix) schema/Str (schema/optional-key :reporters) RegistryReportersConfig}) (def RegistriesConfig {schema/Any RegistryConfig}) (def ReportersConfig {(schema/optional-key :graphite) BaseGraphiteReporterConfig}) (def MetricsConfig {:server-id schema/Str (schema/optional-key :registries) RegistriesConfig (schema/optional-key :reporters) ReportersConfig (schema/optional-key :metrics-webservice) WebserviceConfig}) (def RegistryContext {:registry (schema/maybe MetricRegistry) :jmx-reporter (schema/maybe JmxReporter) (schema/optional-key :graphite-reporter) GraphiteReporter}) (def DefaultRegistrySettings {:default-metrics-allowed [schema/Str]}) (def MetricsServiceContext {:registries (schema/atom {schema/Keyword RegistryContext}) :can-update-registry-settings? schema/Bool :registry-settings (schema/atom {schema/Keyword DefaultRegistrySettings}) :metrics-config MetricsConfig}) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;; Private (schema/defn jmx-reporter :- JmxReporter [registry :- MetricRegistry domain :- (schema/maybe schema/Keyword)] (let [b (JmxReporter/forRegistry registry)] (when domain (.inDomain b (name domain))) (.build b))) (schema/defn initialize-registry-context :- RegistryContext "Create initial registry context. This will include a MetricsRegistry and a JMX reporter, but not a Graphite reporter." [config :- (schema/maybe RegistryConfig) domain :- schema/Keyword] (let [jmx-config (get-in config [:reporters :jmx]) registry (MetricRegistry.)] {:registry registry :jmx-reporter (when (:enabled jmx-config) (doto ^JmxReporter (jmx-reporter registry domain) (.start)))})) (schema/defn construct-metric-names :- #{schema/Str} "Prefixes the metric prefix to each metric name. Returns a set of metric names (duplicates are removed)." [prefix :- schema/Str metric-names :- [schema/Str]] (set (map #(format "%s.%s" prefix %) metric-names))) (schema/defn build-metric-filter :- AllowedNamesMetricFilter [metrics-allowed :- #{schema/Str}] (AllowedNamesMetricFilter. metrics-allowed)) (schema/defn get-metric-prefix :- schema/Str "Determines what the metric prefix should be. If a metric-prefix is set in the config, we use that. Else default to the server-id" [metrics-config :- MetricsConfig domain :- schema/Keyword] (if-let [metric-prefix (get-in metrics-config [:registries domain :metric-prefix])] metric-prefix (format "puppetlabs.%s" (:server-id metrics-config)))) (schema/defn build-graphite-reporter :- GraphiteReporter "Constructs a GraphiteReporter instance for the given registry, with the given allowed metrics, and using the given graphite-sender" [registry :- MetricRegistry metrics-allowed :- #{schema/Str} graphite-sender :- GraphiteSender] (-> (GraphiteReporter/forRegistry registry) (.convertRatesTo (TimeUnit/MILLISECONDS)) (.convertDurationsTo (TimeUnit/MILLISECONDS)) (.filter (build-metric-filter metrics-allowed)) (.build graphite-sender))) (schema/defn build-graphite-sender :- GraphiteSender [graphite-config :- GraphiteReporterConfig ;; The domain is only needed as an argument for testing, which is unfortunate. In the future, it ;; would be nice to add the ability to register a function that could receive a callback when a ;; reporter is added, which could solve the problem of needing this extra argument solely for ;; testing (see PE-17010). domain :- schema/Keyword] (Graphite. (InetSocketAddress. (:host graphite-config) (:port graphite-config)))) (schema/defn add-graphite-reporter :- RegistryContext "Adds a graphite reporter to the given registry context if graphite is enabled in the configuration. Starts up a thread which reports the metrics to graphite on the interval specified in :update-interval-seconds" [registry-context :- RegistryContext graphite-config :- (schema/maybe GraphiteReporterConfig) metrics-allowed :- #{schema/Str} domain :- schema/Keyword] (if (:enabled graphite-config) (let [graphite-sender (build-graphite-sender graphite-config domain) graphite-reporter (build-graphite-reporter (:registry registry-context) metrics-allowed graphite-sender)] (.start graphite-reporter (:update-interval-seconds graphite-config) (TimeUnit/SECONDS)) (assoc registry-context :graphite-reporter graphite-reporter)) registry-context)) (schema/defn get-graphite-config :- (schema/maybe GraphiteReporterConfig) "Merge together the graphite config for the registry with the global graphite config." [config :- MetricsConfig domain :- schema/Keyword] (let [reporter-config (get-in config [:reporters :graphite]) registry-config (get-in config [:registries domain :reporters :graphite]) merged-config (merge reporter-config registry-config)] ;; the default value for enabled is false (if (nil? merged-config) merged-config (update-in merged-config [:enabled] #(if (nil? %) false %))))) (schema/defn get-metrics-allowed :- #{schema/Str} "Get the metrics allowed for the registry. Looks at the metrics-allowed registered for the registry in the registry settings atom using the `update-registry-settings` function as well as the metrics-allowed listed in the config file under the `:metrics-allowed` key. Merges these lists together and then adds the metrics prefix to them, returning a set of prefixed allowed metrics." [metrics-config :- MetricsConfig registry-settings :- {schema/Any DefaultRegistrySettings} domain :- schema/Keyword] (let [metric-prefix (get-metric-prefix metrics-config domain) default-metrics-allowed (get-in registry-settings [domain :default-metrics-allowed]) configured-metrics-allowed (get-in metrics-config [:registries domain :metrics-allowed]) metrics-allowed (concat default-metrics-allowed configured-metrics-allowed)] (construct-metric-names metric-prefix metrics-allowed))) (schema/defn maybe-add-default-to-config :- MetricsConfig "Add a `:default` key with an empty map as the value to the registries config if it is not present." [metrics-config :- MetricsConfig] (update-in metrics-config [:registries :default] #(if (nil? %) {} %))) (schema/defn initialize-registries-from-config :- {schema/Any RegistryContext} "Read through the config and create a MetricsRegistry (+ JMX reporter if configured) for every registry mentioned in it. Also create the default registry if not mentioned in the config. Should be called from `init` of the metrics-service." [metrics-config :- MetricsConfig] (let [registries-config (:registries metrics-config)] (into {} (map (fn [x] {x (initialize-registry-context (get registries-config x) x)}) (keys registries-config))))) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;; Public (schema/defn ^:always-validate add-graphite-reporters :- MetricsServiceContext "Add Graphite reporters to all registries with Graphite enabled in the config, using the configured settings for each registry. Returns an updated service context. Should be called from `start` of the metrics-service." [service-context :- MetricsServiceContext] (let [config (:metrics-config service-context) registry-settings @(:registry-settings service-context)] (doseq [registry @(:registries service-context)] (let [domain (key registry) graphite-config (get-graphite-config config domain) metrics-allowed (get-metrics-allowed config registry-settings domain) registry-with-graphite-reporter (add-graphite-reporter (val registry) graphite-config metrics-allowed domain)] (swap! (:registries service-context) assoc domain registry-with-graphite-reporter)))) service-context) ;; Note here that the return schema includes registries that could have Graphite reporters. If the ;; registry was in the config, then a Graphite reporter could have been configured for it. Any ;; registries not in the config will not have Graphite reporters. (schema/defn ^:always-validate get-or-initialize-registry-context :- RegistryContext "If a registry exists within the service context for a given domain already, return it. Otherwise initialize a new registry for that domain and return it. Modifies the registries atom in the service context to add the new registry" [{:keys [registries metrics-config]} :- MetricsServiceContext domain :- schema/Keyword] (if-let [metric-registry-context (get @registries domain)] metric-registry-context (let [registry-config (get-in metrics-config [:registries domain]) new-registry-context (initialize-registry-context registry-config domain)] (swap! registries assoc domain new-registry-context) new-registry-context))) (schema/defn ^:always-validate create-initial-service-context :- MetricsServiceContext "Create the initial service context for the metrics-service. Initialize all registries in the config, add them to the `registries` atom, and include that in the service context map, along with an empty atom for `registry-settings` and the metrics config." [metrics-config :- MetricsConfig] (let [config-with-default (maybe-add-default-to-config metrics-config) registries (initialize-registries-from-config config-with-default)] {:registries (atom registries) :can-update-registry-settings? true :registry-settings (atom {}) :metrics-config config-with-default})) (schema/defn lock-registry-settings :- MetricsServiceContext "Switch the `can-update-registry-settings?` boolean to false to show that it is after the `init` phase and registry settings can no longer be set." [context :- MetricsServiceContext] (assoc context :can-update-registry-settings? false)) (schema/defn ^:always-validate update-registry-settings :- {schema/Any DefaultRegistrySettings} "Update the `registry-settings` atom for the given domain. If called again for the same domain, the new settings will be merged in, and lists such as :default-metrics-allowed, will be concat'd together." [context :- MetricsServiceContext domain :- schema/Keyword settings :- DefaultRegistrySettings] (when (= false (:can-update-registry-settings? context)) (throw (RuntimeException. "Registry settings must be initialized in the `init` phase of the lifecycle."))) (let [registry-settings (:registry-settings context) deep-merge-fn (fn [first second] ; first will be nil if no settings exist for this domain, ; and deep-merge-with doesn't like that (ks/deep-merge-with concat (or first {}) second))] ; Swap out the atom by updating the value under the specified domain. ; Update using deep-merge-fn to do a deep merge between the existing settings ; and the new settings, concating values together if two keys match (swap! registry-settings update domain deep-merge-fn settings))) (schema/defn ^:always-validate stop [context :- RegistryContext] (if-let [jmx-reporter (:jmx-reporter context)] (.close jmx-reporter)) (if-let [graphite-reporter (:graphite-reporter context)] (.close graphite-reporter))) (schema/defn ^:always-validate stop-all [service-context :- MetricsServiceContext] (let [registries (:registries service-context)] (doseq [[_ metrics-registry] @registries] (stop metrics-registry)) service-context)) (schema/defn ^:always-validate default-middleware [] (fn [handler] (-> handler (ring-keyword-params/wrap-keyword-params {:parse-namespaces? true}) (ring-params/wrap-params) (ring-not-modified/wrap-not-modified) (ring-content-type/wrap-content-type) (i18n/locale-negotiator)))) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;; Comidi (defn build-handler [path] (comidi/routes->handler (comidi/wrap-routes (comidi/context path (comidi/context "/v1" (comidi/context "/mbeans" (comidi/GET "" [] (fn [req] (ringutils/json-response 200 (metrics-utils/mbean-names)))) (comidi/POST "" [] (fn [req] (try (let [metrics (with-open [reader (-> req :body io/reader)] (doall (json/parse-stream reader true)))] (cond (seq? metrics) (ringutils/json-response 200 (map metrics-utils/get-mbean metrics)) (string? metrics) (ringutils/json-response 200 (metrics-utils/get-mbean metrics)) (map? metrics) (ringutils/json-response 200 (ks/mapvals metrics-utils/get-mbean metrics)) :else (ringutils/json-response 400 (tru "metrics request must be a JSON array, string, or object")))) (catch JsonParseException e (ringutils/json-response 400 {:error (str e)}))))) (comidi/GET ["/" [#".*" :names]] [] (fn [{:keys [route-params] :as req}] (let [name (java.net.URLDecoder/decode (:names route-params))] (if-let [mbean (metrics-utils/get-mbean name)] (ringutils/json-response 200 mbean) (ringutils/json-response 404 (tru "No mbean ''{0}'' found" name))))))))) (default-middleware)))) metrics_service.clj000066400000000000000000000077371525317257100371050ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-service (:require [puppetlabs.trapperkeeper.core :as trapperkeeper] [puppetlabs.trapperkeeper.services.authorization.authorization-service :as tk-auth] [puppetlabs.trapperkeeper.services.protocols.metrics :as metrics] [puppetlabs.trapperkeeper.services.metrics.metrics-core :as core] [puppetlabs.trapperkeeper.services.metrics.jolokia :as jolokia] [puppetlabs.trapperkeeper.services :as tk-services] [clojure.tools.logging :as log] [schema.core :as schema] [puppetlabs.kitchensink.core :as ks] [puppetlabs.trapperkeeper.core :as tk])) (trapperkeeper/defservice metrics-service metrics/MetricsService [[:ConfigService get-in-config]] (init [this context] (let [config (get-in-config [:metrics]) metrics-config (if (nil? (get-in config [:reporters :jmx :enabled])) config (do (log/warn "Enabling JMX globally is deprecated;" "JMX can only be enabled per-registry.") (ks/dissoc-in config [:reporters :jmx :enabled])))] (schema/validate core/MetricsConfig metrics-config) (log/debug "Creating metrics registries") (core/create-initial-service-context metrics-config))) (start [this context] ;; registry settings can only be updated in the `init` phase of the lifecycle (let [updated-context (core/lock-registry-settings context)] (log/debug "Creating graphite reporters") (core/add-graphite-reporters updated-context))) (stop [this context] (core/stop-all (tk-services/service-context this))) (update-registry-settings [this domain settings] (let [context (tk-services/service-context this)] (core/update-registry-settings context domain settings))) (get-metrics-registry [this] (get-in @(:registries (tk-services/service-context this)) [:default :registry])) (get-metrics-registry [this domain] (let [context (tk-services/service-context this)] (:registry (core/get-or-initialize-registry-context context domain)))) (get-server-id [this] (get-in-config [:metrics :server-id]))) (trapperkeeper/defservice metrics-webservice {:required [[:ConfigService get-in-config] [:WebroutingService add-ring-handler get-route get-server] [:WebserverService add-servlet-handler]] :optional [AuthorizationService]} (init [this context] (when (get-in-config [:metrics :metrics-webservice :mbeans :enabled] false) (log/warn "The v1 metrics endpoint is deprecated and will be removed in a future release." "Use the v2 endpoint instead.") (add-ring-handler this (core/build-handler (get-route this)))) (when (get-in-config [:metrics :metrics-webservice :jolokia :enabled] true) (let [config (->> (get-in-config [:metrics :metrics-webservice :jolokia :servlet-init-params] {}) jolokia/create-servlet-config) ;; NOTE: Normally, these route and server lookups would be done by ;; WebroutingService/add-servlet-handler, but that doesn't properly ;; mount sub-paths at the moment (TK-420). So we explicitly compute ;; these items and use WebserverService/add-servlet-handler instead. route (str (get-route this) "/v2") server (get-server this) options (if (nil? server) {:servlet-init-params config} {:servlet-init-params config :server-id (keyword server)}) auth-service (tk-services/maybe-get-service this :AuthorizationService) auth-check-fn (if auth-service (partial tk-auth/authorization-check auth-service))] (add-servlet-handler (jolokia/create-servlet auth-check-fn) route options))) context) (stop [this context] context)) metrics_utils.clj000066400000000000000000000026411525317257100365720ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-utils (:require [cheshire.custom :refer [JSONable]] [clojure.java.jmx :as jmx] [puppetlabs.kitchensink.core :as ks])) (defn filter-mbean "Converts an mbean to a map. For attributes that can't be converted to JSON, return a string representation of the value." [mbean] {:post [(map? %)]} (->> mbean (ks/mapvals (fn [v] (cond ;; Nested structures should themselves be filtered (map? v) (filter-mbean v) (instance? java.util.HashMap v) (->> v (into {}) filter-mbean) (satisfies? JSONable v) v :else (str v)))))) (defn all-mbean-names "Return a seq of all mbeans names" [] {:post [(coll? %)]} (map str (jmx/mbean-names "*:*"))) (defn mbean-names "Return a map of mbean name to a link that will retrieve the attributes" [] (->> (all-mbean-names) (map (fn [mbean-name] [mbean-name (format "/mbeans/%s" (java.net.URLEncoder/encode mbean-name "UTF-8"))])) (into (sorted-map)))) (defn get-mbean "Returns the attributes of a given MBean" [name] (when (some #(= name %) (all-mbean-names)) (filter-mbean (jmx/mbean name)))) OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/protocols/000077500000000000000000000000001525317257100336445ustar00rootroot00000000000000metrics.clj000066400000000000000000000016211525317257100357250ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/clj/puppetlabs/trapperkeeper/services/protocols(ns puppetlabs.trapperkeeper.services.protocols.metrics) (defprotocol MetricsService "A service that tracks runtime metrics for the process." (get-metrics-registry [this] [this domain] "Provides access to a MetricsRegistry where `domain` is the string used to look up the registry. Specifing no `domain` will return the default MetricsRegistry. The `domain` is the name that will appear at the front of the JMX metric. For example in `foo:name=my-metric`, `foo` is the `domain`.") (get-server-id [this] "Get the server-id from the `metrics` -> `server-id` part of the config.") (update-registry-settings [this domain settings] "Allows for specifying settings for a metric registry reporter that don't go into a config file. Must be called during the 'init' phase of a service's lifecycle. Will error if called more than once per metric registry.")) OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/000077500000000000000000000000001525317257100231165ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/000077500000000000000000000000001525317257100236745ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/puppetlabs/000077500000000000000000000000001525317257100260535ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/puppetlabs/trapperkeeper/000077500000000000000000000000001525317257100307245ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/puppetlabs/trapperkeeper/metrics/000077500000000000000000000000001525317257100323725ustar00rootroot00000000000000AllowedNamesMetricFilter.java000066400000000000000000000012121525317257100400370ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/puppetlabs/trapperkeeper/metricspackage com.puppetlabs.trapperkeeper.metrics; import com.codahale.metrics.Metric; import com.codahale.metrics.MetricFilter; import java.util.Set; // Takes in a whitelist of strings to match against public class AllowedNamesMetricFilter implements MetricFilter{ private final Set allowedMetricNames; public AllowedNamesMetricFilter(Set allowedMetricNames){ this.allowedMetricNames = allowedMetricNames; } @Override public boolean matches(String name, Metric metric) { if (allowedMetricNames.isEmpty()) { return true; } else return allowedMetricNames.contains(name); } } GraphiteReporter.java000066400000000000000000000255621525317257100364560ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/src/java/com/puppetlabs/trapperkeeper/metricspackage com.puppetlabs.trapperkeeper.metrics; import com.codahale.metrics.Clock; import com.codahale.metrics.Counter; import com.codahale.metrics.Gauge; import com.codahale.metrics.Histogram; import com.codahale.metrics.Meter; import com.codahale.metrics.Metered; import com.codahale.metrics.MetricFilter; import com.codahale.metrics.MetricRegistry; import com.codahale.metrics.ScheduledReporter; import com.codahale.metrics.Snapshot; import com.codahale.metrics.Timer; import com.codahale.metrics.graphite.Graphite; import com.codahale.metrics.graphite.GraphiteSender; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import java.io.IOException; import java.util.Locale; import java.util.Map; import java.util.SortedMap; import java.util.concurrent.TimeUnit; /** * A reporter which publishes metric values to a Graphite server. * A modified version of {@link com.codahale.metrics.graphite.GraphiteReporter}, which sends a reduced set of statistics * for {@link Timer} and {@link Histogram} metrics * * @see Graphite - Scalable Realtime Graphing */ public class GraphiteReporter extends ScheduledReporter { /** * Returns a new {@link Builder} for {@link GraphiteReporter}. * * @param registry the registry to report * @return a {@link Builder} instance for a {@link GraphiteReporter} */ public static Builder forRegistry(MetricRegistry registry) { return new Builder(registry); } /** * A builder for {@link GraphiteReporter} instances. Defaults to not using a prefix, using the * default clock, converting rates to events/second, converting durations to milliseconds, and * not filtering metrics. */ public static class Builder { private final MetricRegistry registry; private Clock clock; private String prefix; private TimeUnit rateUnit; private TimeUnit durationUnit; private MetricFilter filter; private Builder(MetricRegistry registry) { this.registry = registry; this.clock = Clock.defaultClock(); this.prefix = null; this.rateUnit = TimeUnit.SECONDS; this.durationUnit = TimeUnit.MILLISECONDS; this.filter = MetricFilter.ALL; } /** * Use the given {@link Clock} instance for the time. * * @param clock a {@link Clock} instance * @return {@code this} */ public Builder withClock(Clock clock) { this.clock = clock; return this; } /** * Prefix all metric names with the given string. * * @param prefix the prefix for all metric names * @return {@code this} */ public Builder prefixedWith(String prefix) { this.prefix = prefix; return this; } /** * Convert rates to the given time unit. * * @param rateUnit a unit of time * @return {@code this} */ public Builder convertRatesTo(TimeUnit rateUnit) { this.rateUnit = rateUnit; return this; } /** * Convert durations to the given time unit. * * @param durationUnit a unit of time * @return {@code this} */ public Builder convertDurationsTo(TimeUnit durationUnit) { this.durationUnit = durationUnit; return this; } /** * Only report metrics which match the given filter. * * @param filter a {@link MetricFilter} * @return {@code this} */ public Builder filter(MetricFilter filter) { this.filter = filter; return this; } /** * Builds a {@link GraphiteReporter} with the given properties, sending metrics using the * given {@link GraphiteSender}. * * Present for binary compatibility * * @param graphite a {@link Graphite} * @return a {@link GraphiteReporter} */ public GraphiteReporter build(Graphite graphite) { return build((GraphiteSender) graphite); } /** * Builds a {@link GraphiteReporter} with the given properties, sending metrics using the * given {@link GraphiteSender}. * * @param graphite a {@link GraphiteSender} * @return a {@link GraphiteReporter} */ public GraphiteReporter build(GraphiteSender graphite) { return new GraphiteReporter(registry, graphite, clock, prefix, rateUnit, durationUnit, filter); } } private static final Logger LOGGER = LoggerFactory.getLogger(GraphiteReporter.class); private final GraphiteSender graphite; private final Clock clock; private final String prefix; private GraphiteReporter(MetricRegistry registry, GraphiteSender graphite, Clock clock, String prefix, TimeUnit rateUnit, TimeUnit durationUnit, MetricFilter filter) { super(registry, "graphite-reporter", filter, rateUnit, durationUnit); this.graphite = graphite; this.clock = clock; this.prefix = prefix; } @Override public void report(SortedMap gauges, SortedMap counters, SortedMap histograms, SortedMap meters, SortedMap timers) { final long timestamp = clock.getTime() / 1000; // oh it'd be lovely to use Java 7 here try { if (!graphite.isConnected()) { graphite.connect(); } for (Map.Entry entry : gauges.entrySet()) { reportGauge(entry.getKey(), entry.getValue(), timestamp); } for (Map.Entry entry : counters.entrySet()) { reportCounter(entry.getKey(), entry.getValue(), timestamp); } for (Map.Entry entry : histograms.entrySet()) { reportHistogram(entry.getKey(), entry.getValue(), timestamp); } for (Map.Entry entry : meters.entrySet()) { reportMetered(entry.getKey(), entry.getValue(), timestamp); } for (Map.Entry entry : timers.entrySet()) { reportTimer(entry.getKey(), entry.getValue(), timestamp); } graphite.flush(); } catch (IOException e) { LOGGER.warn("Unable to report to Graphite", graphite, e); try { graphite.close(); } catch (IOException e1) { LOGGER.warn("Error closing Graphite", graphite, e1); } } } @Override public void stop() { try { super.stop(); } finally { try { graphite.close(); } catch (IOException e) { LOGGER.debug("Error disconnecting from Graphite", graphite, e); } } } private void reportTimer(String name, Timer timer, long timestamp) throws IOException { final Snapshot snapshot = timer.getSnapshot(); graphite.send(prefix(name, "max"), format(convertDuration(snapshot.getMax())), timestamp); graphite.send(prefix(name, "mean"), format(convertDuration(snapshot.getMean())), timestamp); graphite.send(prefix(name, "min"), format(convertDuration(snapshot.getMin())), timestamp); graphite.send(prefix(name, "stddev"), format(convertDuration(snapshot.getStdDev())), timestamp); graphite.send(prefix(name, "p50"), format(convertDuration(snapshot.getMedian())), timestamp); graphite.send(prefix(name, "p75"), format(convertDuration(snapshot.get75thPercentile())), timestamp); graphite.send(prefix(name, "p95"), format(convertDuration(snapshot.get95thPercentile())), timestamp); reportMetered(name, timer, timestamp); } private void reportMetered(String name, Metered meter, long timestamp) throws IOException { graphite.send(prefix(name, "count"), format(meter.getCount()), timestamp); } private void reportHistogram(String name, Histogram histogram, long timestamp) throws IOException { final Snapshot snapshot = histogram.getSnapshot(); graphite.send(prefix(name, "count"), format(histogram.getCount()), timestamp); graphite.send(prefix(name, "max"), format(snapshot.getMax()), timestamp); graphite.send(prefix(name, "mean"), format(snapshot.getMean()), timestamp); graphite.send(prefix(name, "min"), format(snapshot.getMin()), timestamp); graphite.send(prefix(name, "stddev"), format(snapshot.getStdDev()), timestamp); graphite.send(prefix(name, "p50"), format(snapshot.getMedian()), timestamp); graphite.send(prefix(name, "p75"), format(snapshot.get75thPercentile()), timestamp); graphite.send(prefix(name, "p95"), format(snapshot.get95thPercentile()), timestamp); } private void reportCounter(String name, Counter counter, long timestamp) throws IOException { graphite.send(prefix(name, "count"), format(counter.getCount()), timestamp); } private void reportGauge(String name, Gauge gauge, long timestamp) throws IOException { final String value = format(gauge.getValue()); if (value != null) { graphite.send(prefix(name), value, timestamp); } } private String format(Object o) { if (o instanceof Float) { return format(((Float) o).doubleValue()); } else if (o instanceof Double) { return format(((Double) o).doubleValue()); } else if (o instanceof Byte) { return format(((Byte) o).longValue()); } else if (o instanceof Short) { return format(((Short) o).longValue()); } else if (o instanceof Integer) { return format(((Integer) o).longValue()); } else if (o instanceof Long) { return format(((Long) o).longValue()); } return null; } private String prefix(String... components) { return MetricRegistry.name(prefix, components); } private String format(long n) { return Long.toString(n); } private String format(double v) { // the Carbon plaintext format is pretty underspecified, but it seems like it just wants // US-formatted digits return String.format(Locale.US, "%2.2f", v); } } OpenVoxProject-trapperkeeper-metrics-499ae4c/test/000077500000000000000000000000001525317257100223655ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/000077500000000000000000000000001525317257100245445ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/metrics_test.clj000066400000000000000000000057751525317257100277610ustar00rootroot00000000000000(ns puppetlabs.metrics-test (:import (com.codahale.metrics MetricRegistry Meter Timer) (java.util.concurrent TimeUnit)) (:require [clojure.test :refer :all] [puppetlabs.metrics :refer :all] [schema.test :as schema-test])) (use-fixtures :once schema-test/validate-schemas) (deftest test-host-metric-name (testing "host-metric-name should create a metric name" (is (= "puppetlabs.localhost.foocount" (host-metric-name "localhost" "foocount"))))) (deftest test-http-metric-name (testing "http-metric-name should create a metric name" (is (= "puppetlabs.localhost.http.foocount" (http-metric-name "localhost" "foocount"))))) (deftest test-register (testing "register should add a metric to the registry" (let [registry (MetricRegistry.)] (register registry (host-metric-name "localhost" "foo") (gauge 2)) (let [gauges (.getGauges registry)] (is (= 1 (count gauges))) (is (= "puppetlabs.localhost.foo" (first (.keySet gauges)))))))) (deftest test-mean-utils (let [timer (Timer.)] (time! timer (Thread/sleep 1)) (is (= 1 (.getCount timer))) (let [elapsed-nanos (mean timer) elapsed-millis (mean-millis timer) elapsed-in-millis (mean-in-unit timer TimeUnit/MILLISECONDS) elapsed-in-nanos (mean-in-unit timer TimeUnit/NANOSECONDS)] (is (>= elapsed-millis 1)) (is (>= elapsed-in-millis 1)) (is (<= elapsed-millis 100)) (is (<= elapsed-in-millis 100)) (is (>= elapsed-nanos (* 1000 1000))) (is (>= elapsed-in-nanos (* 1000 1000))) (is (<= elapsed-nanos (* 1000 1000 100))) (is (<= elapsed-in-nanos (* 1000 1000 100)))))) (deftest test-ratio (testing "ratio should create a ratio metric" (let [numerator (atom 4) numerator-fn (fn [] @numerator) denominator-fn (constantly 2) ratio-metric (ratio numerator-fn denominator-fn)] (is (= 2.0 (.. ratio-metric getRatio getValue))) (reset! numerator 6) (is (= 3.0 (.. ratio-metric getRatio getValue)))))) (deftest test-metered-ratio (testing "metered-ratio builds a ratio metric from two counters" (let [numerator-meter (Meter.) denominator-timer (Timer.) ratio-metric (metered-ratio numerator-meter denominator-timer)] (dotimes [_ 2] (.update denominator-timer 0 TimeUnit/MILLISECONDS)) (dotimes [_ 4] (.mark numerator-meter)) (is (= 2.0 (.. ratio-metric getRatio getValue))) (dotimes [_ 2] (.mark numerator-meter)) (is (= 3.0 (.. ratio-metric getRatio getValue)))))) (deftest test-gauge (testing "gauge creates a gauge metric with an initial value" (let [gauge-metric (gauge 42)] (is (= 42 (.getValue gauge-metric)))))) (deftest test-time! (testing "time! will time the enclosed form" (let [timer (Timer.)] (time! timer (Thread/sleep 1)) (is (= 1 (.getCount timer))) (let [elapsed (mean-millis timer)] (is (>= elapsed 1)) (is (<= elapsed 100)))))) OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/000077500000000000000000000000001525317257100274155ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/services/000077500000000000000000000000001525317257100312405ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/services/metrics/000077500000000000000000000000001525317257100327065ustar00rootroot00000000000000metrics_core_test.clj000066400000000000000000000532551525317257100370500ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-core-test (:import (com.codahale.metrics MetricRegistry JmxReporter) (com.puppetlabs.trapperkeeper.metrics GraphiteReporter) (clojure.lang ExceptionInfo)) (:require [clojure.test :refer :all] [puppetlabs.trapperkeeper.testutils.logging :refer :all] [puppetlabs.trapperkeeper.services.metrics.metrics-core :as core] [puppetlabs.trapperkeeper.services.metrics.metrics-testutils :as utils] [schema.test :as schema-test] [puppetlabs.kitchensink.core :as ks])) (use-fixtures :once schema-test/validate-schemas) (deftest test-initialize-registry-context (testing "initializes registry and adds to context" (let [domain :my.epic.domain context (core/initialize-registry-context {} domain)] (is (instance? MetricRegistry (:registry context))) (is (nil? (:jmx-reporter context))))) (testing "enables jmx reporter if configured to do so" (let [domain :foo.bar.baz context (core/initialize-registry-context {:reporters {:jmx {:enabled true}}} domain)] (is (instance? MetricRegistry (:registry context))) (is (instance? JmxReporter (:jmx-reporter context))))) (testing "does not enable jmx reporter if configured to not do so" (let [domain :foo.bar.baz context (core/initialize-registry-context {:reporters {:jmx {:enabled false}}} domain)] (is (instance? MetricRegistry (:registry context))) (is (nil? (:jmx-reporter context)))))) (deftest test-lifecycle (testing "enables graphite reporter if configured to do so" (let [context (-> utils/test-config (assoc-in [:registries :default :reporters :graphite :enabled] true) core/create-initial-service-context core/add-graphite-reporters) default-registry (get @(:registries context) :default)] (is (instance? MetricRegistry (:registry default-registry))) (is (instance? GraphiteReporter (:graphite-reporter default-registry))) (core/stop default-registry))) (testing "does not enable graphite reporter if not configured to do so" (let [context (-> utils/test-config core/create-initial-service-context core/add-graphite-reporters) default-registry (get @(:registries context) :default)] (is (instance? MetricRegistry (:registry default-registry))) (is (nil? (:graphite-reporter default-registry)))))) (deftest get-graphite-config-test (testing "get-graphite-config function works with `reporters` section" (let [config (utils/build-config-with-registries {:no.graphite.settings {:metrics-allowed ["foo" "bar"]} :enabled.graphite {:reporters {:graphite {:enabled true}}} :new.interval.graphite {:reporters {:graphite {:enabled true :update-interval-seconds 42}}} :disabled.graphite {:reporters {:graphite {:enabled false}}}})] (testing "returns defaults if no registry settings in config" (is (= {:enabled false :host "my.graphite.server" :port 2003 :update-interval-seconds 10} (core/get-graphite-config config :not.in.the.config)))) (testing "returns disabled graphite if no registry-specific graphite settings" (is (= {:enabled false :host "my.graphite.server" :port 2003 :update-interval-seconds 10} (core/get-graphite-config config :no.graphite.settings)))) (testing "returns defaults with enabled graphite for registry with graphite enabled" (is (= {:enabled true :host "my.graphite.server" :port 2003 :update-interval-seconds 10} (core/get-graphite-config config :enabled.graphite)))) (testing "returns overrides for registry with graphite overrides" (is (= {:enabled true :host "my.graphite.server" :port 2003 :update-interval-seconds 42} (core/get-graphite-config config :new.interval.graphite)))) (testing "sets enabled to false if specified for the registry" (is (= {:enabled false :host "my.graphite.server" :port 2003 :update-interval-seconds 10} (core/get-graphite-config config :no.graphite)))) (testing "get-graphite-config function does the right thing without `reporters` section" (testing "returns nil if no graphite settings are in the config" (is (= nil (core/get-graphite-config {:server-id "localhost"} :foo)))) (testing "throws error if output does not include full Graphite config" (is (thrown? ExceptionInfo (core/get-graphite-config {:server-id "localhost" :registries {:incomplete.graphite {:reporters {:graphite {:enabled true :update-interval-seconds 10}}}}} :incomplete.graphite)))) (testing "works if output does include full Graphite config" (is (= {:enabled true :host "my.graphite.server" :port 2003 :update-interval-seconds 10} (core/get-graphite-config {:server-id "localhost" :registries {:graphite.set.in.registry {:reporters (assoc-in utils/graphite-config [:graphite :enabled] true)}}} :graphite.set.in.registry)))))))) (deftest get-or-initialize-test (let [config (utils/build-config-with-registries {:pre-existing {:reporters {:jmx {:enabled true}}}}) context (core/create-initial-service-context config)] (testing "returns existing registry if already created" (let [pre-existing-registry (:pre-existing @(:registries context))] (is (instance? MetricRegistry (:registry pre-existing-registry))) (is (instance? JmxReporter (:jmx-reporter pre-existing-registry))) (is (= pre-existing-registry (core/get-or-initialize-registry-context context :pre-existing))))) (testing "creates a new registry if it does not already exist in context" (is (nil? (:new-registry @(:registries context)))) (let [new-registry (core/get-or-initialize-registry-context context :new-registry)] (is (instance? MetricRegistry (:registry new-registry))) (testing "updates the context to have the new registry" (is (= new-registry (:new-registry @(:registries context))))))))) (deftest add-graphite-reporters-test (testing "add-graphite-reporters function" (let [config (utils/build-config-with-registries {:enabled.graphite {:reporters {:graphite {:enabled true}}} :disabled.graphite {:reporters {:graphite {:enabled false}}} :enabled.graphite.with-defaults {:reporters {:graphite {:enabled true}}} :disabled.graphite.with-defaults {:reporters {:graphite {:enabled false}}} :enabled.graphite.with.metrics-allowed {:metrics-allowed ["foo"] :reporters {:graphite {:enabled true}}} :disabled.graphite.with.metrics-allowed {:metrics-allowed ["foo"] :reporters {:graphite {:enabled false}}}}) context (core/create-initial-service-context config) get-graphite-reporter (fn [domain] (get-in @(:registries context) [domain :graphite-reporter]))] (core/update-registry-settings context :enabled.graphite.with-defaults {:default-metrics-allowed ["bar"]}) (core/update-registry-settings context :disabled.graphite.with-defaults {:default-metrics-allowed ["bar"]}) (core/update-registry-settings context :not-in-config.with-defaults {:default-metrics-allowed ["bar"]}) (core/get-or-initialize-registry-context context :not-in-config) (core/add-graphite-reporters context) (testing "adds graphite reporter for registry with graphite enabled" (is (instance? GraphiteReporter (get-graphite-reporter :enabled.graphite)))) (testing "doesn't add graphite reporter for registry with graphite disabled" (is (nil? (get-graphite-reporter :disabled.graphite)))) (testing (str "adds graphite reporter for registry with default metrics allwowed" " and graphite enabled") (is (instance? GraphiteReporter (get-graphite-reporter :enabled.graphite)))) (testing (str "doesn't add graphite reporter for registry with default metrics allowed" " but graphite disabled") (is (nil? (get-graphite-reporter :disabled.graphite.with-defaults)))) (testing (str "adds graphite reporter for registry with metrics allowed" " and graphite enabled") (is (instance? GraphiteReporter (get-graphite-reporter :enabled.graphite.with.metrics-allowed)))) (testing (str "doesn't add graphite reporter for registry with metrics allowed" " but graphite disabled") (is (nil? (get-graphite-reporter :disabled.graphite.with.metrics-allowed)))) (testing "doesn't add graphite reporter for registry not in config" (is (nil? (get-graphite-reporter :not-in-config)))) (testing "doesn't add graphite for registry with default metrics-allowed not in config" (is (nil? (get-graphite-reporter :not-in-config.with-defaults)))) (core/stop-all context)))) (deftest initialize-registries-from-config-test (testing "initialize-registries-from-config + maybe-add-default-to-config creates default registry" (is (= [:default] (keys (core/initialize-registries-from-config (core/maybe-add-default-to-config {:server-id "localhost"})))))) (testing (str "initialize-registries-from-config + maybe-add-default-to-config creates registries" " for everything in config plus default") (let [registries (core/initialize-registries-from-config (core/maybe-add-default-to-config {:server-id "localhost" :registries {:foo {:reporters {:jmx {:enabled true}} :metrics-allowed ["foo"]}}}))] (is (= #{:default :foo} (ks/keyset registries))) (is (instance? MetricRegistry (get-in registries [:default :registry]))) (is (instance? MetricRegistry (get-in registries [:foo :registry]))) (testing "adds jmx reporter if configured" (is (nil? (get-in registries [:default :jmx-reporter]))) (is (instance? JmxReporter (get-in registries [:foo :jmx-reporter])))))) (testing "initialize-registries-from-config creates default with settings from config" (let [registries (core/initialize-registries-from-config (core/maybe-add-default-to-config {:server-id "localhost" :registries {:default {:reporters {:jmx {:enabled true}}} :foo {:metrics-allowed ["foo"]}}}))] (is (= #{:default :foo} (ks/keyset registries))) (is (instance? MetricRegistry (get-in registries [:default :registry]))) (is (instance? MetricRegistry (get-in registries [:foo :registry]))) (testing "adds jmx reporter if configured" (is (instance? JmxReporter (get-in registries [:default :jmx-reporter]))) (is (nil? (get-in registries [:foo :jmx-reporter]))))))) (deftest update-registry-settings-test (let [context (core/create-initial-service-context utils/test-config)] (testing "update-registry-settings adds settings for a registry" (is (= {:foo.bar {:default-metrics-allowed ["foo.bar"]}} (core/update-registry-settings context :foo.bar {:default-metrics-allowed ["foo.bar"]})))) (testing "update-registry-settings appends settings if the settings already exist" (is (= {:foo.bar {:default-metrics-allowed ["foo.bar" "bar.baz"]}} (core/update-registry-settings context :foo.bar {:default-metrics-allowed ["bar.baz"]})))) (testing "update-registry-settings throws an error if it is called after init lifecycle phase" (is (thrown? RuntimeException (core/update-registry-settings (core/lock-registry-settings context) :nope {:default-metrics-allowed ["default"]})))) ; Make sure all the graphite reporters get shutdown, otherwise they spawn background threads (core/stop-all context))) (deftest ^:unit construct-metric-names-test (testing "prefix is correctly added" (let [metrics ["one" "two" "two"] prefixed-metrics (core/construct-metric-names "foo.bar" metrics)] (is (= #{"foo.bar.one" "foo.bar.two"} prefixed-metrics))))) (deftest get-metrics-allowed-test (testing "get-metrics-allowed function") (let [config (utils/build-config-with-registries {:with-metrics-allowed {:metrics-allowed ["foo"]} :with-metrics-allowed-and-defaults {:metrics-allowed ["foo"]} :with-prefix {:metric-prefix "prefix"} :with-prefix-and-defaults {:metric-prefix "prefix"} :with-prefix-and-metrics-allowed {:metric-prefix "prefix" :metrics-allowed ["foo"]} :with-prefix-defaults-and-metrics-allowed {:metric-prefix "prefix" :metrics-allowed ["foo"]} :without-metrics-allowed-or-prefix {:reporters {:jmx {:enabled true}}}})] (testing "works with metrics allowed in config" (is (= #{"puppetlabs.localhost.foo"} (core/get-metrics-allowed config {} :with-metrics-allowed)))) (testing "works with default metrics allowed" (is (= #{"puppetlabs.localhost.default"} (core/get-metrics-allowed config {:with-defaults {:default-metrics-allowed ["default"]}} :with-defaults)))) (testing "works with metrics allowed in config and defaults" (is (= #{"puppetlabs.localhost.foo" "puppetlabs.localhost.default"} (core/get-metrics-allowed config {:with-metrics-allowed-and-defaults {:default-metrics-allowed ["default"]}} :with-metrics-allowed-and-defaults)))) (testing "removes duplicates between metrics allowed in config and defaults" (is (= #{"puppetlabs.localhost.foo" "puppetlabs.localhost.default"} (core/get-metrics-allowed config {:with-metrics-allowed-and-defaults {:default-metrics-allowed ["default" "foo"]}} :with-metrics-allowed-and-defaults)))) (testing "returns empty set if prefix but not metrics allowed" (is (= #{} (core/get-metrics-allowed config {} :with-prefix)))) (testing "works with prefix and defaults" (is (= #{"prefix.default"} (core/get-metrics-allowed config {:with-prefix-and-defaults {:default-metrics-allowed ["default"]}} :with-prefix-and-defaults)))) (testing "works with prefix and metrics allowed" (is (= #{"prefix.foo"} (core/get-metrics-allowed config {} :with-prefix-and-metrics-allowed)))) (testing "works with prefix, defaults, and metrics allowed in config" (is (= #{"prefix.default" "prefix.foo"} (core/get-metrics-allowed config {:with-prefix-defaults-and-metrics-allowed {:default-metrics-allowed ["default"]}} :with-prefix-defaults-and-metrics-allowed)))) (testing "returns empty set without metrics allowed or prefix" (is (= #{} (core/get-metrics-allowed config {} :without-metrics-allowed-or-prefix)))) (testing "returns empty set for registry not in config" (is (= #{} (core/get-metrics-allowed config {} :not-in-config)))) (testing "returns empty set when there is no registry config" (is (= #{} (core/get-metrics-allowed {:server-id "localhost"} {} :not-in-config)))))) (deftest ^:unit allowed-names-metrics-filter-match-test ; Wrap .matches so nil doesn't have to be passed every time (let [matches (fn [metric-filter name] (.matches metric-filter name nil))] (let [metrics-allowed #{"foo" "example.domain" "example.domain.more.specific" "compiler.evaluate_resource.Class[Puppet_enterprise::Profile::Console]"} metric-filter (core/build-metric-filter metrics-allowed)] (testing "allowed strings match" (is (true? (matches metric-filter "foo"))) (is (true? (matches metric-filter "example.domain"))) (is (true? (matches metric-filter "example.domain.more.specific"))) (is (true? (matches metric-filter "compiler.evaluate_resource.Class[Puppet_enterprise::Profile::Console]")))) (testing "non allowed strings don't match" (is (false? (matches metric-filter "foo.bar"))) (is (false? (matches metric-filter "example.domain.more"))) (is (false? (matches metric-filter "example"))) (is (false? (matches metric-filter "Class[Puppet_enterprise::Profile::Console]"))))) (testing "empty allow-metrics list allows everything" (let [metric-filter (core/build-metric-filter #{})] (is (matches metric-filter "anything")))))) (deftest get-metric-prefix-test (testing "get-metric-prefix chooses the correct prefix" (testing "no metric-prefix provided" (is (= "puppetlabs.localhost" (core/get-metric-prefix utils/test-config :default)))) (testing "metric-prefix provided" (let [config (assoc-in utils/test-config [:registries :default :metric-prefix] "test-prefix")] (is (= "test-prefix" (core/get-metric-prefix config :default))))))) (deftest graphite-reporter-filter-test (let [registry-context (core/initialize-registry-context nil :default) registry (:registry registry-context) reported-metrics (atom {}) metrics-allowed #{"test-histogram" "test-meter" "test-timer"} graphite-reporter (core/build-graphite-reporter registry metrics-allowed (utils/make-graphite-sender reported-metrics :default))] ; Create a few Metric objects of the types we'd like to test (.histogram registry "test-histogram") (.histogram registry "should-not-be-reported") (.meter registry "test-meter") (.timer registry "test-timer") ; Call report once so our GraphiteSender instance can collect some data (.report graphite-reporter) (testing "Graphite reporter only sends whitelisted metrics" (is (utils/reported? @reported-metrics "test-histogram.mean")) (is (not (utils/reported? @reported-metrics "should-not-be-reported.mean")))) (testing "Graphite reporter sends desired histogram fields" (is (utils/reported? @reported-metrics "test-histogram.mean")) (is (utils/reported? @reported-metrics "test-histogram.min")) (is (utils/reported? @reported-metrics "test-histogram.max")) (is (utils/reported? @reported-metrics "test-histogram.stddev")) (is (utils/reported? @reported-metrics "test-histogram.p50")) (is (utils/reported? @reported-metrics "test-histogram.p75")) (is (utils/reported? @reported-metrics "test-histogram.p95"))) (testing "Graphite reporter doesn't send any other histogram fields" (is (not (utils/reported? @reported-metrics "test-histogram.p98"))) (is (not (utils/reported? @reported-metrics "test-histogram.p99"))) (is (not (utils/reported? @reported-metrics "test-histogram.p999")))) (testing "Graphite reporter sends desired timer fields" (is (utils/reported? @reported-metrics "test-timer.mean")) (is (utils/reported? @reported-metrics "test-timer.min")) (is (utils/reported? @reported-metrics "test-timer.max")) (is (utils/reported? @reported-metrics "test-timer.stddev")) (is (utils/reported? @reported-metrics "test-timer.p50")) (is (utils/reported? @reported-metrics "test-timer.p75")) (is (utils/reported? @reported-metrics "test-timer.p95"))) (testing "Graphite reporter doesn't send any other timer fields" (is (not (utils/reported? @reported-metrics "test-timer.p98"))) (is (not (utils/reported? @reported-metrics "test-timer.p99"))) (is (not (utils/reported? @reported-metrics "test-timer.p999")))) (testing "Graphite reporter sends desired meter fields" (is (utils/reported? @reported-metrics "test-meter.count"))) (testing "Graphite reporter doesn't send any other meter fields" (is (not (utils/reported? @reported-metrics "test-meter.mean_rate"))) (is (not (utils/reported? @reported-metrics "test-meter.m1_rate"))) (is (not (utils/reported? @reported-metrics "test-meter.m5_rate"))) (is (not (utils/reported? @reported-metrics "test-meter.m15_rate")))))) metrics_service_test.clj000066400000000000000000000633731525317257100375620ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-service-test (:import (com.codahale.metrics MetricRegistry JmxReporter) (clojure.lang ExceptionInfo) (com.puppetlabs.trapperkeeper.metrics GraphiteReporter)) (:require [clojure.test :refer :all] [cheshire.core :as json] [clojure.string :as string] [ring.util.codec :as codec] [puppetlabs.http.client.sync :as http-client] [puppetlabs.metrics :as metrics] [puppetlabs.trapperkeeper.services.authorization.authorization-service :as authorization-service] [puppetlabs.trapperkeeper.services.metrics.metrics-service :refer :all] [puppetlabs.trapperkeeper.services.protocols.metrics :as metrics-protocol] [schema.test :as schema-test] [puppetlabs.trapperkeeper.services.webrouting.webrouting-service :as webrouting-service] [puppetlabs.trapperkeeper.services.webserver.jetty-service :as jetty-service] [puppetlabs.trapperkeeper.testutils.bootstrap :refer [with-app-with-config]] [puppetlabs.trapperkeeper.testutils.logging :refer [with-test-logging] :as logging] [puppetlabs.trapperkeeper.app :as app] [puppetlabs.kitchensink.core :as ks] [puppetlabs.trapperkeeper.core :as trapperkeeper] [puppetlabs.trapperkeeper.services.metrics.metrics-testutils :as utils] [puppetlabs.trapperkeeper.services :as tk-services] [puppetlabs.trapperkeeper.services.metrics.metrics-core :as core])) (use-fixtures :once schema-test/validate-schemas) (defn parse-response ([resp] (parse-response resp false)) ([resp keywordize?] (-> resp :body slurp (json/parse-string keywordize?)))) (defn jolokia-encode "Encodes a MBean name according to the rules laid out in: https://jolokia.org/reference/html/protocol.html#escape-rules" [mbean-name] (-> mbean-name (string/escape {\/ "!/" \! "!!" \" "!\""}) codec/url-encode)) (def test-resources-dir (ks/absolute-path "./dev-resources/puppetlabs/trapperkeeper/services/metrics/metrics_service_test")) (def services [jetty-service/jetty-service webrouting-service/webrouting-service metrics-service metrics-webservice]) (def ssl-opts {:ssl-cert "./dev-resources/ssl/cert.pem" :ssl-key "./dev-resources/ssl/key.pem" :ssl-ca-cert "./dev-resources/ssl/ca.pem"}) (def ssl-webserver-config {:webserver (merge {:ssl-port 8180 :ssl-host "0.0.0.0"} ssl-opts)}) (def metrics-service-config {:metrics {:server-id "localhost" :registries {:pl.test.reg {:reporters {:jmx {:enabled true}}} :pl.other.reg {:reporters {:jmx {:enabled true}}}}} :webserver {:port 8180 :host "0.0.0.0"} :web-router-service {:puppetlabs.trapperkeeper.services.metrics.metrics-service/metrics-webservice "/metrics"}}) (def auth-config {:authorization {:version 1 :rules [{:match-request {:path "/metrics/v2/list" :type "path" :method ["get" "head" "post" "put"]} :allow "localhost" :sort-order 500 :name "list"} {:match-request {:path "/metrics/v2" :type "path" :method ["get" "head" "post" "put"]} :deny "localhost" :sort-order 500 :name "metrics"}]}}) (deftest test-metrics-service-error (testing "Metrics service throws an error if missing server-id" (logging/with-test-logging (is (thrown-with-msg? ExceptionInfo #"Value does not match schema: .*server-id missing-required-key.*" (with-app-with-config app services (ks/dissoc-in metrics-service-config [:metrics :server-id]))))))) (deftest test-metrics-service (testing "Can boot metrics service and access registry" (with-test-logging (with-app-with-config app services (assoc-in metrics-service-config [:metrics :metrics-webservice :mbeans :enabled] true) (testing "metrics service functions" (let [svc (app/get-service app :MetricsService)] (testing "`get-metrics-registry` called without domain works" (is (instance? MetricRegistry (metrics-protocol/get-metrics-registry svc)))) (testing "`get-metrics-registry` called with domain works" (is (instance? MetricRegistry (metrics-protocol/get-metrics-registry svc :pl.foo.reg)))) (testing "`get-server-id` works" (is (= "localhost" (metrics-protocol/get-server-id svc)))))) (testing "returns latest status for all services" (let [resp (http-client/get "http://localhost:8180/metrics/v1/mbeans") body (parse-response resp)] (is (= 200 (:status resp))) (doseq [[metric path] body :let [resp (http-client/get (str "http://localhost:8180/metrics/v1" path))]] (is (= 200 (:status resp))))) (let [resp (http-client/get "http://localhost:8180/metrics/v2/list/java.lang") body (parse-response resp)] (is (= 200 (:status resp))) (doseq [mbean (keys (get body "value")) :let [url (str "http://localhost:8180/metrics/v2/read/" (jolokia-encode (str "java.lang:" mbean)) ;; NOTE: Some memory pools intentionally don't ;; implement MBean attributes. This results ;; in an error being thrown when those ;; attributes are read and is expected. "?ignoreErrors=true") resp (http-client/get url) body (parse-response resp)]] ;; NOTE: Jolokia returns 200 OK for most responses. The actual ;; status code is in the JSON payload that makes up the body. (is (= 200 (get body "status")))))) (testing "register should add a metric to the registry with a keyword domain" (let [svc (app/get-service app :MetricsService) register-and-get-metric (fn [domain metric] (metrics/register (metrics-protocol/get-metrics-registry svc domain) (metrics/host-metric-name "localhost" metric) (metrics/gauge 2)) (http-client/get (str "http://localhost:8180/metrics/v1/mbeans/" (codec/url-encode (str (name domain) ":name=puppetlabs.localhost." metric))))) resp (register-and-get-metric :pl.test.reg "foo")] (is (= 200 (:status resp))) (is (= {"Value" 2} (parse-response resp))))) (testing "querying multiple metrics via POST should work" (let [svc (app/get-service app :MetricsService) registry (metrics-protocol/get-metrics-registry svc :pl.other.reg)] (metrics/register registry (metrics/host-metric-name "localhost" "foo") (metrics/gauge 2)) (metrics/register registry (metrics/host-metric-name "localhost" "bar") (metrics/gauge 500)) (let [resp (http-client/post "http://localhost:8180/metrics/v1/mbeans" {:body (json/generate-string ["pl.other.reg:name=puppetlabs.localhost.foo" "pl.other.reg:name=puppetlabs.localhost.bar"])}) body (parse-response resp)] (is (= 200 (:status resp))) (is (= [{"Value" 2} {"Value" 500}] body))) (let [resp (http-client/post "http://localhost:8180/metrics/v1/mbeans" {:body (json/generate-string {:foo "pl.other.reg:name=puppetlabs.localhost.foo" :bar "pl.other.reg:name=puppetlabs.localhost.bar"})}) body (parse-response resp)] (is (= 200 (:status resp))) (is (= {"foo" {"Value" 2} "bar" {"Value" 500}} body))) (let [resp (http-client/post "http://localhost:8180/metrics/v1/mbeans" {:body (json/generate-string "pl.other.reg:name=puppetlabs.localhost.foo")}) body (parse-response resp)] (is (= 200 (:status resp))) (is (= {"Value" 2} body))) (let [resp (http-client/post "http://localhost:8180/metrics/v1/mbeans" {:body "{\"malformed json"}) body (slurp (:body resp))] (is (= 400 (:status resp))) (is (re-find #"Unexpected end-of-input" body))) (let [resp (http-client/post "http://localhost:8180/metrics/v2" {:body (json/generate-string [{:type "read" :mbean "pl.other.reg:name=puppetlabs.localhost.foo"} {:type "read" :mbean "pl.other.reg:name=puppetlabs.localhost.bar"}])}) body (parse-response resp true)] (is (= [200 200] (map :status body))) (is (= [{:Value 2} {:Value 500}] (map :value body)))))) (testing "metrics/v2 should deny write requests" (let [resp (http-client/get (str "http://localhost:8180/metrics/v2/write/" (jolokia-encode "java.lang:type=Memory") "/Verbose/true")) body (parse-response resp)] (is (= 403 (get body "status"))))) (testing "metrics/v2 should deny exec requests" (let [resp (http-client/get (str "http://localhost:8180/metrics/v2/exec/" (jolokia-encode "java.util.logging:type=Logging") "/getLoggerLevel/root")) body (parse-response resp)] (is (= 403 (get body "status"))))))))) (deftest metrics-service-with-tk-auth (testing "tk-auth works when included in bootstrap" (with-test-logging (with-app-with-config app (conj services authorization-service/authorization-service) (merge metrics-service-config auth-config ssl-webserver-config) (let [resp (http-client/get "https://localhost:8180/metrics/v2/list" ssl-opts)] (is (= 200 (:status resp)))) (let [resp (http-client/get "https://localhost:8180/metrics/v2" ssl-opts)] (is (= 403 (:status resp)))))))) (deftest metrics-v1-endpoint-disabled-by-default (testing "metrics/v1 is disabled by default, returns 404" (with-test-logging (with-app-with-config app [jetty-service/jetty-service webrouting-service/webrouting-service metrics-service metrics-webservice] metrics-service-config (let [resp (http-client/get "http://localhost:8180/metrics/v1/mbeans")] (is (= 404 (:status resp)))))))) (deftest metrics-endpoint-with-jolokia-disabled-test (testing "metrics/v2 returns 404 when Jolokia is not enabled" (let [config (assoc-in metrics-service-config [:metrics :metrics-webservice :jolokia :enabled] false)] (with-app-with-config app [jetty-service/jetty-service webrouting-service/webrouting-service metrics-service metrics-webservice] config (let [resp (http-client/get "http://localhost:8180/metrics/v2/version")] (is (= 404 (:status resp)))))))) (deftest metrics-endpoint-with-permissive-jolokia-policy (testing "metrics/v2 allows exec requests when configured with a permissive policy" (with-test-logging (let [config (assoc-in metrics-service-config [:metrics :metrics-webservice :jolokia :servlet-init-params :policyLocation] (str "file://" test-resources-dir "/jolokia-access-permissive.xml"))] (with-app-with-config app [jetty-service/jetty-service webrouting-service/webrouting-service metrics-service metrics-webservice] config (let [resp (http-client/get (str "http://localhost:8180/metrics/v2/exec/" (jolokia-encode "java.util.logging:type=Logging") "/getLoggerLevel/root")) body (parse-response resp)] (is (= 200 (get body "status"))))))))) (deftest metrics-endpoint-with-jmx-disabled-test (testing "returns data for jvm even when jmx is not enabled" (with-test-logging (let [config (-> metrics-service-config (assoc-in [:metrics :metrics-webservice :mbeans :enabled] true) (assoc :registries {:pl.no.jmx {:reporters {:jmx {:enabled false}}}}))] (with-app-with-config app [jetty-service/jetty-service webrouting-service/webrouting-service metrics-service metrics-webservice] config (testing "returns latest status for all services" (let [resp (http-client/get "http://localhost:8180/metrics/v1/mbeans") body (parse-response resp)] (is (= 200 (:status resp))) (is (not (empty? body))))) (testing "returns Memoory mbean information" (let [resp (http-client/get "http://localhost:8180/metrics/v1/mbeans/java.lang%3Atype%3DMemory") body (parse-response resp) heap-memory (get body "HeapMemoryUsage")] (is (= 200 (:status resp))) (is (= #{"committed" "init" "max" "used"} (ks/keyset heap-memory))) (is (every? #(< 0 %) (vals heap-memory)))))))))) (deftest get-metrics-registry-service-function-test (with-app-with-config app [metrics-service] {:metrics {:server-id "localhost"}} (let [svc (app/get-service app :MetricsService)] (testing "Can access default registry" (is (instance? MetricRegistry (metrics-protocol/get-metrics-registry svc)))) (testing "Can access other registries registry" (is (instance? MetricRegistry (metrics-protocol/get-metrics-registry svc :my-domain))))))) (deftest get-server-id-service-function-test (with-app-with-config app [metrics-service] {:metrics {:server-id "foo"}} (let [svc (app/get-service app :MetricsService)] (testing "Can access server-id" (is (= "foo" (metrics-protocol/get-server-id svc))))))) (deftest update-registry-settings-service-function-test (testing "intialize-registry-settings adds settings for a registry" (let [service (trapperkeeper/service [[:MetricsService update-registry-settings]] (init [this context] (update-registry-settings :foo.bar {:default-metrics-allowed ["foo.bar"]}) context)) metrics-app (trapperkeeper/build-app [service metrics-service] {:metrics utils/test-config}) metrics-svc (app/get-service metrics-app :MetricsService)] (try (app/init metrics-app) (is (= {:foo.bar {:default-metrics-allowed ["foo.bar"]}} @(:registry-settings (tk-services/service-context metrics-svc)))) (finally (app/stop metrics-app))))) (testing "update-registry-settings throws an error if called outside `init`" (let [service (trapperkeeper/service [[:MetricsService update-registry-settings]] (start [this context] (update-registry-settings :nope {:default-metrics-allowed ["fail"]}) context)) metrics-app (trapperkeeper/build-app [service metrics-service] {:metrics utils/test-config})] (with-test-logging (try (is (thrown? RuntimeException (app/check-for-errors! (app/start metrics-app)))) (finally (app/stop metrics-app))))))) (deftest jmx-enabled-globally-deprecated-test (with-test-logging (with-app-with-config app [metrics-service] {:metrics {:server-id "localhost" :reporters {:jmx {:enabled true}}}}) (is (logged? #"Enabling JMX globally is deprecated; JMX can only be enabled per-registry.")))) (deftest jmx-works-test (with-app-with-config app [metrics-service] {:metrics {:server-id "localhost" :registries {:jmx.registry {:reporters {:jmx {:enabled true}}} :no.jmx.registry {:reporters {:jmx {:enabled false}}} :foo {:metrics-allowed ["foo"]}}}} (let [svc (app/get-service app :MetricsService) context (tk-services/service-context svc) get-jmx-reporter (fn [domain] (get-in @(:registries context) [domain :jmx-reporter]))] (testing "Registry with jmx enabled gets a jmx reporter" (metrics-protocol/get-metrics-registry svc :jmx.registry) (is (instance? JmxReporter (get-jmx-reporter :jmx.registry)))) (testing "Registry with jmx disabled does not get a jmx reporter" (metrics-protocol/get-metrics-registry svc :jmx.registry) (is (nil? (get-jmx-reporter :no.jmx.registry)))) (testing "Registry with no mention of jmx does not get a jmx reporter" (metrics-protocol/get-metrics-registry svc :foo) (is (nil? (get-jmx-reporter :foo)))) (testing "Registry not mentioned in config does not get a jmx reporter" (metrics-protocol/get-metrics-registry svc :not.in.the.config) (is (nil? (get-jmx-reporter :not.in.the.config))))))) (defn create-meters! [registries meter-names] (doseq [{:keys [registry]} (vals registries) meter meter-names] (.meter registry meter ))) (defn report-to-graphite! [registries] (doseq [graphite-reporter (map :graphite-reporter (vals registries))] (when graphite-reporter (.report graphite-reporter)))) (def graphite-enabled {:reporters {:graphite {:enabled true}}}) (def metrics-allowed {:metrics-allowed ["not-default"]}) (def default-metrics-allowed {:default-metrics-allowed ["default"]}) (deftest integration-test (let [registries-config {:graphite-enabled graphite-enabled :graphite-with-default-metrics-allowed graphite-enabled :graphite-with-metrics-allowed (merge metrics-allowed graphite-enabled) :graphite-with-defaults-and-metrics-allowed (merge metrics-allowed graphite-enabled)} config {:metrics (utils/build-config-with-registries registries-config)} service (trapperkeeper/service [[:MetricsService get-metrics-registry update-registry-settings]] (init [this context] (get-metrics-registry :graphite-enabled) (get-metrics-registry :graphite-with-default-metrics-allowed) (update-registry-settings :graphite-with-default-metrics-allowed default-metrics-allowed) (get-metrics-registry :graphite-with-metrics-allowed) ;; shouldn't matter whether `get-metrics-registry` or ;; `update-registry-settings` is called first (update-registry-settings :graphite-with-defaults-and-metrics-allowed default-metrics-allowed) (get-metrics-registry :graphite-with-defaults-and-metrics-allowed) context)) reported-metrics-atom (atom {})] (with-redefs [core/build-graphite-sender (fn [_ domain] (utils/make-graphite-sender reported-metrics-atom domain))] (let [metrics-app (trapperkeeper/build-app [metrics-service service] config) metrics-svc (app/get-service metrics-app :MetricsService) get-context (fn [] (tk-services/service-context metrics-svc))] (try (testing "init phase of lifecycle" (app/init metrics-app) (let [context (get-context) registries @(:registries context) registry-settings @(:registry-settings context)] (testing "all registries in config (plus default) get created" (is (= #{:default :graphite-enabled :graphite-with-default-metrics-allowed :graphite-with-metrics-allowed :graphite-with-defaults-and-metrics-allowed} (ks/keyset registries))) (is (every? #(instance? MetricRegistry %) (map :registry (vals registries))))) (testing "graphite reporters are not created in it" (is (every? nil? (map :graphite-reproter (vals registries))))) (testing "registry settings are initialized in init" (is (= {:graphite-with-default-metrics-allowed default-metrics-allowed :graphite-with-defaults-and-metrics-allowed default-metrics-allowed} registry-settings))))) (testing "start phase of lifecycle" (app/start metrics-app) (let [context (get-context) registries @(:registries context) registry-settings @(:registry-settings context)] (testing "graphite reporters are created in start" (is (every? #(instance? MetricRegistry %) (map :registry (vals registries)))) (is (every? #(instance? GraphiteReporter %) (map :graphite-reporter (vals (dissoc registries :default))))) (is (nil? (get-in registries [:default :graphite-reporter])))) (testing "the right metrics are reported to graphite" (create-meters! registries ["puppetlabs.localhost.default" "puppetlabs.localhost.not-default" "puppetlabs.localhost.foo"]) (report-to-graphite! registries) (let [reported-metrics @reported-metrics-atom] (is (= #{:graphite-enabled :graphite-with-default-metrics-allowed :graphite-with-metrics-allowed :graphite-with-defaults-and-metrics-allowed} (ks/keyset reported-metrics))) (testing "without any metrics filter configured all metrics are reported" (is (utils/reported? reported-metrics :graphite-enabled "puppetlabs.localhost.foo.count")) (is (utils/reported? reported-metrics :graphite-enabled "puppetlabs.localhost.default.count")) (is (utils/reported? reported-metrics :graphite-enabled "puppetlabs.localhost.not-default.count"))) (testing "default metrics are reported to graphite" (is (not (utils/reported? reported-metrics :graphite-with-default-metrics-allowed "puppetlabs.localhost.foo.count"))) (is (utils/reported? reported-metrics :graphite-with-default-metrics-allowed "puppetlabs.localhost.default.count")) (is (not (utils/reported? reported-metrics :graphite-with-default-metrics-allowed "puppetlabs.localhost.not-default.count")))) (testing "configured metrics are reported to graphite" (is (not (utils/reported? reported-metrics :graphite-with-metrics-allowed "puppetlabs.localhost.foo.count"))) (is (not (utils/reported? reported-metrics :graphite-with-metrics-allowed "puppetlabs.localhost.default.count"))) (is (utils/reported? reported-metrics :graphite-with-metrics-allowed "puppetlabs.localhost.not-default.count"))) (testing "configured metrics and default allowed metrics are reported to graphite" (is (not (utils/reported? reported-metrics :graphite-with-defaults-and-metrics-allowed "localhost.foo.count"))) (is (utils/reported? reported-metrics :graphite-with-defaults-and-metrics-allowed "puppetlabs.localhost.default.count")) (is (utils/reported? reported-metrics :graphite-with-defaults-and-metrics-allowed "puppetlabs.localhost.not-default.count"))))))) (finally (app/stop metrics-app))))))) metrics_testutils.clj000066400000000000000000000025721525317257100371150ustar00rootroot00000000000000OpenVoxProject-trapperkeeper-metrics-499ae4c/test/puppetlabs/trapperkeeper/services/metrics(ns puppetlabs.trapperkeeper.services.metrics.metrics-testutils (:import (com.codahale.metrics.graphite GraphiteSender)) (:require [schema.core :as schema] [clojure.set :as set])) (def graphite-config {:graphite {:host "my.graphite.server" :port 2003 :update-interval-seconds 10}}) (def test-config {:server-id "localhost" :reporters graphite-config}) (defn build-config-with-registries [registries] (assoc test-config :registries registries)) (schema/defn make-graphite-sender :- GraphiteSender "Creates a GraphiteSender object which doesn't make any network requests, but instead collects the data from each call to send into the provided atom" [reported-metrics :- (schema/atom {schema/Keyword #{schema/Str}}) domain :- schema/Keyword] (reify GraphiteSender (connect [this]) (send [this name value timestamp] (swap! reported-metrics #(update-in % [domain] set/union #{name}))) (flush [this]) (isConnected [this] true) (getFailures [this] 0) (close [this]))) (schema/defn reported? "Returns true if the given metric-name is found in reported-metrics" ([reported-metrics metric-name] (reported? reported-metrics :default metric-name)) ([reported-metrics :- {schema/Keyword #{schema/Str}} domain :- schema/Keyword metric-name :- schema/Str] (contains? (get reported-metrics domain) metric-name)))