[java-openws COMMIT] /branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java

[noreply at shibboleth.net]

Author: putmanb
Date: Wed Mar 13 19:13:54 2013
New Revision: 444

URL: http://svn.shibboleth.net/view/java-openws?rev=444&view=rev
Log:
JOST-186: HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification 

Modified:
    branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java

Modified: branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java
URL: http://svn.shibboleth.net/view/java-openws/branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java?rev=444&r1=443&r2=444&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java Wed Mar 13 19:13:54 2013
@@ -23,11 +23,15 @@
 import java.net.Socket;
 import java.net.SocketAddress;
 import java.security.GeneralSecurityException;
+import java.security.SecureRandom;
 
 import javax.net.SocketFactory;
-import javax.net.ssl.KeyManager;
+import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManager;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
 import javax.net.ssl.X509KeyManager;
 import javax.net.ssl.X509TrustManager;
 
@@ -40,31 +44,109 @@
 @ThreadSafe
 public class TLSProtocolSocketFactory implements SecureProtocolSocketFactory {
 
-    /** Manager used to retrieve client-cert authentication keys for a given host. */
-    private X509KeyManager keyManager;
-
-    /** Manager used to validate the X.509 credentials of a given host. */
-    private X509TrustManager trustManager;
-
+    /** Managers used to retrieve client-cert authentication keys for a given host. */
+    private X509KeyManager[] keyManagers;
+
+    /** Managers used to validate the X.509 credentials of a given host. */
+    private X509TrustManager[] trustManagers;
+    
+    /** The randomness generator to use when creating SSL sockets.*/
+    private SecureRandom secureRandom;
+    
+    /** Hostname verifier used to validate the peer's certificate against the hostname. */
+    private HostnameVerifier hostnameVerifier;
+    
     /** Currently active SSL context. */
     private SSLContext sslContext;
-
+    
     /**
      * Constructor.
      * 
      * @param keyMgr manager used to retrieve client-cert authentication keys for a given host
-     * @param trustMgr manager used to validate the X.509 credentials of a given host
+     * @param trustMgr manager used to validate the X.509 credentials of a given host. May be null, in which case
+     *          the JSSE default trust manager lookup mechanism is used.
      * 
      * @throws IllegalArgumentException thrown if the given key or trust manager can not be used to create the
      *             {@link SSLContext} used to create new sockets
      */
     public TLSProtocolSocketFactory(X509KeyManager keyMgr, X509TrustManager trustMgr) throws IllegalArgumentException {
-        keyManager = keyMgr;
-        trustManager = trustMgr;
-
+        this(keyMgr, trustMgr, null);
+    }
+    
+    /**
+     * Constructor.
+     * 
+     * @param keyMgr manager used to retrieve client-cert authentication keys for a given host.
+     * @param trustMgr manager used to validate the X.509 credentials of a given host. May be null, in which case
+     *          the JSSE default trust manager lookup mechanism is used.
+     * @param verifier the hostname verifier used to verify the SSL/TLS's peer's hostname. May be null, in which case
+     *          no hostname verification is performed.
+     * 
+     * @throws IllegalArgumentException thrown if the given key or trust manager can not be used to create the
+     *             {@link SSLContext} used to create new sockets
+     */
+    public TLSProtocolSocketFactory(X509KeyManager keyMgr, X509TrustManager trustMgr, HostnameVerifier verifier) 
+            throws IllegalArgumentException {
+        
+        keyManagers = new X509KeyManager[] { keyMgr };
+                
+        // Note: There is a huge difference with SSLContext.init between:
+        //    1) passing a null for TrustManager[]
+        //    2) passing a TrustManager[] that contains 1 null member.
+        //
+        // The former causes the default trust manager set to be used. That's what we want 
+        // if we TLS peer authN to happen (in the default way).
+        // The latter effectively disables trust processing entirely (but not in the way we'd probably want).
+        // So we need to make sure we don't do the latter.
+        if (trustMgr != null) {
+            trustManagers = new X509TrustManager[] { trustMgr };
+        } else {
+            trustManagers = null;
+        }
+        
+        hostnameVerifier = verifier;
+        
+        secureRandom = null;
+        
+        init();
+    }
+    
+    /**

[... 139 lines stripped ...]