Add setting to automatically redirect http requests to the https port

Change-Id: I33966b8292434c10ffd623838d09527aaebaca5f

diff --git a/releases.moxie b/releases.moxie
index 403d34fe1ad544893d612257e333ead527714ac0..3a0bee6056e870567ac6174b062082de1e1dff1a 100644 (file)
--- a/releases.moxie
+++ b/releases.moxie
@@ -26,6 +26,7 @@ r20: {
        - Removed "show readme" setting in favor of automatic detection
        - Support plain text "readme" files
        - Determine best commit id (e.g. "master") for the tree and docs pages and use that in links
+       - By default GO will now bind to all interfaces for both http and https connectors.  This simplifies setup for first-time users.
     additions:
        - Added branch graph image servlet based on EGit's branch graph renderer (issue-194)
        - Added option to render Markdown commit messages (issue-203)
@@ -35,6 +36,7 @@ r20: {
        - Support intradocument linking in Markdown content using [[WikiLinks]] syntax (issue-324)
        - Added setting to globally disable anonymous pushes in the receive pack
        - Added a normalized diffstat display to the commit, commitdiff, and compare pages
+       - Added GO setting to automatically redirect all http requests to the secure https connector
     dependencyChanges:
        - updated to Jetty 7.6.13
        - updated to JGit 3.1.0
@@ -45,6 +47,7 @@ r20: {
        - { name: 'git.defaultAccessRestriction', defaultValue: 'PUSH' }
        - { name: 'web.commitMessageRenderer', defaultValue: 'plain' }
        - { name: 'web.showBranchGraph', defaultValue: 'true' }
+       - { name: 'server.redirectToHttpsPort', defaultValue: 'true' }
     contributors:
        - James Moger
        - Robin Rosenberg

diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties
index 7c62c5ad9606e88bfa96888f39bb277709b1bcd1..41aa5a334fb3fc6a43eb6f185f9779007e247009 100644 (file)
--- a/src/main/distrib/data/gitblit.properties
+++ b/src/main/distrib/data/gitblit.properties
@@ -1545,6 +1545,16 @@ server.httpsPort = 8443
 # RESTART REQUIRED\r
 server.ajpPort = 0\r
 \r
+# Automatically redirect http requests to the secure https connector.\r
+#\r
+# This setting requires that you have configured server.httpPort and server.httpsPort.\r
+# Unless you are on a private LAN where you trust all client connections, it is\r
+# recommended to use https for all communications.\r
+#\r
+# SINCE 1.4.0\r
+# RESTART REQUIRED\r
+server.redirectToHttpsPort = true\r
+\r
 # Specify the interface for Jetty to bind the standard connector.\r
 # You may specify an ip or an empty value to bind to all interfaces.\r
 # Specifying localhost will result in Gitblit ONLY listening to requests to\r
@@ -1552,7 +1562,7 @@ server.ajpPort = 0
 #\r
 # SINCE 0.5.0\r
 # RESTART REQUIRED\r
-server.httpBindInterface = localhost\r
+server.httpBindInterface =\r
 \r
 # Specify the interface for Jetty to bind the secure connector.\r
 # You may specify an ip or an empty value to bind to all interfaces.\r
@@ -1561,7 +1571,7 @@ server.httpBindInterface = localhost
 #\r
 # SINCE 0.5.0\r
 # RESTART REQUIRED\r
-server.httpsBindInterface = localhost\r
+server.httpsBindInterface =\r
 \r
 # Specify the interface for Jetty to bind the AJP connector.\r
 # You may specify an ip or an empty value to bind to all interfaces.\r

diff --git a/src/main/java/com/gitblit/GitBlitServer.java b/src/main/java/com/gitblit/GitBlitServer.java
index ca2f7ebbfe3b1eca7c421d75ba5eee57f97568c8..0c5000cfe250d1e34cb95ce09ab103201a7c76fd 100644 (file)
--- a/src/main/java/com/gitblit/GitBlitServer.java
+++ b/src/main/java/com/gitblit/GitBlitServer.java
@@ -36,6 +36,8 @@ import java.util.List;
 import java.util.Scanner;\r
 \r
 import org.eclipse.jetty.ajp.Ajp13SocketConnector;\r
+import org.eclipse.jetty.security.ConstraintMapping;\r
+import org.eclipse.jetty.security.ConstraintSecurityHandler;\r
 import org.eclipse.jetty.server.Connector;\r
 import org.eclipse.jetty.server.Server;\r
 import org.eclipse.jetty.server.bio.SocketConnector;\r
@@ -44,6 +46,7 @@ import org.eclipse.jetty.server.session.HashSessionManager;
 import org.eclipse.jetty.server.ssl.SslConnector;\r
 import org.eclipse.jetty.server.ssl.SslSelectChannelConnector;\r
 import org.eclipse.jetty.server.ssl.SslSocketConnector;\r
+import org.eclipse.jetty.util.security.Constraint;\r
 import org.eclipse.jetty.util.thread.QueuedThreadPool;\r
 import org.eclipse.jetty.webapp.WebAppContext;\r
 import org.eclipse.jgit.storage.file.FileBasedConfig;\r
@@ -213,6 +216,14 @@ public class GitBlitServer {
                        if (params.port < 1024 && !isWindows()) {\r
                                logger.warn("Gitblit needs to run with ROOT permissions for ports < 1024!");\r
                        }\r
+                       if (params.port > 0 && params.securePort > 0 && settings.getBoolean(Keys.server.redirectToHttpsPort, true)) {\r
+                               // redirect HTTP requests to HTTPS\r
+                               if (httpConnector instanceof SelectChannelConnector) {\r
+                                       ((SelectChannelConnector) httpConnector).setConfidentialPort(params.securePort);\r
+                               } else {\r
+                                       ((SocketConnector) httpConnector).setConfidentialPort(params.securePort);\r
+                               }\r
+                       }\r
                        connectors.add(httpConnector);\r
                }\r
 \r
@@ -380,6 +391,24 @@ public class GitBlitServer {
                // Set the server's contexts\r
                server.setHandler(rootContext);\r
 \r
+               // redirect HTTP requests to HTTPS\r
+               if (params.port > 0 && params.securePort > 0 && settings.getBoolean(Keys.server.redirectToHttpsPort, true)) {\r
+                       logger.info(String.format("Configuring automatic http(%1$s) -> https(%2$s) redirects", params.port, params.securePort));\r
+                       // Create the internal mechanisms to handle secure connections and redirects\r
+                       Constraint constraint = new Constraint();\r
+                       constraint.setDataConstraint(Constraint.DC_CONFIDENTIAL);\r
+\r
+                       ConstraintMapping cm = new ConstraintMapping();\r
+                       cm.setConstraint(constraint);\r
+                       cm.setPathSpec("/*");\r
+\r
+                       ConstraintSecurityHandler sh = new ConstraintSecurityHandler();\r
+                       sh.setConstraintMappings(new ConstraintMapping[] { cm });\r
+\r
+                       // Configure this context to use the Security Handler defined before\r
+                       rootContext.setHandler(sh);\r
+               }\r
+\r
                // Setup the GitBlit context\r
                GitBlit gitblit = getGitBlitInstance();\r
                gitblit.configureContext(settings, baseFolder, true);\r

diff --git a/src/site/setup_go.mkd b/src/site/setup_go.mkd
index 839fd2c8488c2a0251bd90d27c7764a585365758..5d422fad876ee14dd6d3dc0408ef38219361249a 100644 (file)
--- a/src/site/setup_go.mkd
+++ b/src/site/setup_go.mkd
@@ -5,8 +5,7 @@
 2. The server itself is configured through a simple text file.\r
 Open `data/gitblit.properties` in your favorite text editor and make sure to review and set:\r
     - *server.httpPort* and *server.httpsPort*\r
-    - *server.httpBindInterface* and *server.httpsBindInterface*  \r
-       - *server.storePassword*\r
+    - *server.storePassword*\r
     **https** is strongly recommended because passwords are insecurely transmitted form your browser/git client using Basic authentication!\r
     - *git.packedGitLimit* (set larger than the size of your largest repository)\r
     - *git.streamFileThreshold* (set larger than the size of your largest committed file)\r