[utilities COMMIT] in /java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient: HttpClientB...

[noreply at shibboleth.net]

Author: putmanb
Date: Tue Dec 16 15:34:00 2014
New Revision: 710

URL: http://svn.shibboleth.net/view/utilities?rev=710&view=rev
Log:
IDP-472: Configure the "StrictHostnameVerifier" as the default verifier for the Apache HttpClient TLS connections.
Also add HttpClientBuilder slot for a custom TLS socket factory.  This will be need in the future to support configuring a trust engine-based factory.

Modified:
    java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java
    java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientSupport.java

Modified: java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java?rev=710&r1=709&r2=710&view=diff
==============================================================================
--- java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java (original)
+++ java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java Tue Dec 16 15:34:00 2014
@@ -33,6 +33,7 @@
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.config.RequestConfig;
 import org.apache.http.config.ConnectionConfig;
+import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
 import org.apache.http.impl.client.BasicCredentialsProvider;
 import org.apache.http.util.CharsetUtils;
 
@@ -147,6 +148,9 @@
 
     /** Whether the SSL/TLS certificates used by the responder should be ignored. Default value: false */
     private boolean connectionDisregardTLSCertificate;
+    
+    /** The TLS socket factory to use.  Optional, defaults to null. */
+    @Nullable private LayeredConnectionSocketFactory tlsSocketFactory;
 
     /** Whether to instruct the server to close the connection after it has sent its response. Default value: true */
     private boolean connectionCloseAfterResponse;
@@ -305,6 +309,11 @@
     /**
      * Gets whether the responder's SSL/TLS certificate should be ignored.
      * 
+     * <p>
+     * This flag is overridden and ignored if a custom TLS socket factory is specified via
+     * {@link #setTLSSocketFactory}.
+     * </p>
+     * 
      * @return whether the responder's SSL/TLS certificate should be ignored
      * 
      * @deprecated use {@link #isConnectionDisregardTLSCertificate()}
@@ -317,6 +326,11 @@
     /**
      * Sets whether the responder's SSL/TLS certificate should be ignored.
      * 
+     * <p>
+     * This flag is overridden and ignored if a custom TLS socket factory is specified via
+     * {@link #setTLSSocketFactory}.
+     * </p>
+     * 
      * @param disregard whether the responder's SSL/TLS certificate should be ignored
      * 
      * @deprecated use {@link #setConnectionDisregardTLSCertificate(boolean)}
@@ -329,6 +343,11 @@
     /**
      * Gets whether the responder's SSL/TLS certificate should be ignored.
      * 
+     * <p>
+     * This flag is overridden and ignored if a custom TLS socket factory is specified via
+     * {@link #setTLSSocketFactory}.
+     * </p>
+     * 
      * @return whether the responder's SSL/TLS certificate should be ignored
      */
     public boolean isConnectionDisregardTLSCertificate() {
@@ -338,10 +357,33 @@
     /**
      * Sets whether the responder's SSL/TLS certificate should be ignored.
      * 
+     * <p>
+     * This flag is overridden and ignored if a custom TLS socket factory is specified via
+     * {@link #setTLSSocketFactory}.
+     * </p>
+     * 
      * @param disregard whether the responder's SSL/TLS certificate should be ignored
      */
     public void setConnectionDisregardTLSCertificate(final boolean disregard) {
         connectionDisregardTLSCertificate = disregard;
+    }
+
+    /**
+     * Get the TLS socket factory to use.
+     * 
+     * @return the socket factory, or null.
+     */
+    @Nullable public LayeredConnectionSocketFactory getTLSSocketFactory() {
+        return tlsSocketFactory;
+    }
+
+    /**
+     * Set the TLS socket factory to use.
+     * 
+     * @param factory the new socket factory, may be null
+     */
+    public void setTLSSocketFactory(@Nullable final LayeredConnectionSocketFactory factory) {
+        tlsSocketFactory = factory;
     }
 
     /**
@@ -533,8 +575,12 @@
     protected void decorateApacheBuilder() throws Exception {
         org.apache.http.impl.client.HttpClientBuilder builder = getApacheBuilder();
         
-        if (connectionDisregardTLSCertificate) {
+        if (getTLSSocketFactory() != null) {
+            builder.setSSLSocketFactory(getTLSSocketFactory());
+        } else if (connectionDisregardTLSCertificate) {
             builder.setSSLSocketFactory(HttpClientSupport.buildNoTrustSSLConnectionSocketFactory());
+        } else {
+            builder.setSSLSocketFactory(HttpClientSupport.buildStrictSSLConnectionSocketFactory());
         }
 

[... 37 lines stripped ...]