Enable peer verification of remote RabbitMq server

By checking the received certificate and fail to make a connection
if the verification fail.

Solves: Jira GER-1791
Change-Id: Ibb38a84b48039b62077939592425007cb23335bd

src/main/java/com/googlesource/gerrit/plugins/eventseiffel/config/RabbitMqConfig.java

diff --git a/src/main/java/com/googlesource/gerrit/plugins/eventseiffel/config/RabbitMqConfig.java b/src/main/java/com/googlesource/gerrit/plugins/eventseiffel/config/RabbitMqConfig.java
index 353cc21..e52fcff 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/eventseiffel/config/RabbitMqConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/eventseiffel/config/RabbitMqConfig.java
@@ -23,12 +23,17 @@
 import com.google.inject.Singleton;
 import com.rabbitmq.client.AMQP;
 import com.rabbitmq.client.ConnectionFactory;
+import java.io.FileInputStream;
 import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
 import java.security.KeyManagementException;
+import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateFactory;
 import java.util.Date;
 import java.util.concurrent.TimeUnit;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
 import org.eclipse.jgit.lib.Config;
 
 @Singleton
@@ -45,6 +50,7 @@
     private static final String VIRTUAL_HOST = "virtualHost";
     private static final String WAIT_FOR_CONFIRM = "waitForConfirm";
     private static final String MAX_BATCH_SIZE = "maxBatchSize";
+    private static final String CERTIFICATE = "certificate";
     private static final boolean DEFAULT_PERSISTENT_DELIVERY = true;
     private static final long DEFAULT_WAIT_FOR_CONFIRM = 5000;
     private static final int DEFAULT_MAX_BATCH_SIZE = 1;
@@ -64,6 +70,7 @@
               cfg.getBoolean(RABBIT_MQ, null, PERSISTENT_DELIVERY, DEFAULT_PERSISTENT_DELIVERY),
               cfg.getString(RABBIT_MQ, null, ROUTING_KEY_TAG),
               cfg.getString(RABBIT_MQ, null, APP_ID),
+              cfg.getString(RABBIT_MQ, null, CERTIFICATE),
               ConfigUtil.getTimeUnit(
                   cfg,
                   RABBIT_MQ,
@@ -105,6 +112,7 @@
       boolean persistentDelivery,
       String routingKey,
       String appId,
+      String certificatePath,
       long waitForConfirms,
       int maxBatchSize) {
     this.exchange = exchange;
@@ -119,7 +127,38 @@
       this.connectionFactory = null;
       return;
     }
+
     ConnectionFactory cf = new ConnectionFactory();
+
+    if (certificatePath != null) {
+      try {
+        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+
+        KeyStore tks = KeyStore.getInstance("JKS");
+        tks.load(null);
+        tks.setCertificateEntry(
+            "server_certificate",
+            certificateFactory.generateCertificate(new FileInputStream(certificatePath)));
+
+        TrustManagerFactory tmf =
+            TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        tmf.init(tks);
+
+        SSLContext c = SSLContext.getInstance("TLSv1.3");
+        c.init(null, tmf.getTrustManagers(), null);
+
+        cf.useSslProtocol(c);
+        cf.enableHostnameVerification();
+      } catch (Exception e) {
+        logger.atSevere().withCause(e).log(
+            "Failed to setup certificate for peer-verification of RabbitMQ-server");
+        this.connectionFactory = null;
+        return;
+      }
+    } else {
+      logger.atInfo().log("No certificate provided, continuing without peer verification.");
+    }
+
     try {
       cf.setUri(uri);
     } catch (KeyManagementException | NoSuchAlgorithmException | URISyntaxException e) {

src/main/resources/Documentation/config.md

diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index b3fa201..e68d8ba 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -12,6 +12,7 @@
       password = secret
       waitForConfirms = 7 seconds
       maxBatchSize = 100
+      certificate = /path/to/certificate.crt
     [EiffelRepoClient]
       graphQlUrl = https://eiffel.company.com/graphql
       goRestUrl = https://eiffel.company.com/rest/
@@ -76,6 +77,10 @@
   If confirms are disabled this option has no real effect.
   (Default: _1_.)
 
+certificate
+: The certificate used for peer verification of server. If no certificate is set
+we will trust anyone.
+
 ## Section "EiffelRepoClient" ##
 
 Configuration for connecting to the