[java-opensaml] branch master updated: OSJ-209: Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=13438bd5ea7e5510461ba0db63eb6b1c16268f16

The following commit(s) were added to refs/heads/master by this push:
       new  13438bd   OSJ-209: Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory
13438bd is described below

commit 13438bd5ea7e5510461ba0db63eb6b1c16268f16
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Jun 7 18:57:14 2017 -0400

    OSJ-209: Support mandatory use of TrustEngine in
    SecurityEnhancedTLSSocketFactory
---
 .../impl/SecurityEnhancedTLSSocketFactory.java     | 51 +++++++++++++++++++---
 .../impl/SecurityEnhancedTLSSocketFactoryTest.java | 12 +++++
 2 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 6823494..d2c31c9 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -81,9 +81,16 @@ import org.slf4j.LoggerFactory;
  * </p>
  * 
  * <p>
- * If the trust engine context attribute is not populated by the caller, then no trust 
- * evaluation is performed.  This allows use of this implementation with use cases where, given a particular 
- * HttpClient instance, sometimes trust engine evaluation is to be performed, and sometimes not.
+ * If the trust engine context attribute is not populated by the caller and {@link #isTrustEngineRequired()} 
+ * is <code>true</code> (the default), then an {@link SSLPeerUnverifiedException} is thrown.
+ * </p>
+ * 
+ * <p>
+ * If the trust engine context attribute is not populated by the caller and {@link #isTrustEngineRequired()}
+ * is <code>false</code>, then no trust evaluation is performed. This allows use of this implementation 
+ * with use cases where, given a particular HttpClient instance, sometimes TLS trust engine evaluation is to 
+ * be performed, and sometimes not. The caller is then responsible for ensuring they supply a trust engine or not,
+ * as appropriate.
  * </p>
  * 
  * <p>
@@ -94,7 +101,7 @@ import org.slf4j.LoggerFactory;
  * </p>
  * 
  * <p>
- * If the client TLS context attribute is not populated by the caller, then client TLS is not attempted.
+ * If the client TLS credential context attribute is not populated by the caller, then client TLS is not attempted.
  * </p>
  * 
  * <p>
@@ -115,6 +122,10 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
     /** The hostname verifier evaluated by this implementation. */
     @Nullable private X509HostnameVerifier hostnameVerifier;
     
+    /** Flag indicating whether a context trust engine attribute is required for TLS server validation. 
+     * Default: true. */
+    private boolean trustEngineRequired;
+    
     /**
      * Constructor. 
      * 
@@ -137,6 +148,29 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
             @Nullable final X509HostnameVerifier verifier) {
         wrappedFactory = Constraint.isNotNull(factory, "Socket factory was null");
         hostnameVerifier = verifier;
+        trustEngineRequired = true;
+    }
+
+    /**
+     * Get the flag indicating whether a context trust engine attribute is required for TLS server validation. 
+     * 
+     * <p>Default: true.</p>
+     * 
+     * @return true if trust engine is required, false if not
+     */
+    public boolean isTrustEngineRequired() {
+        return trustEngineRequired;
+    }
+
+   /**
+     * Set the flag indicating whether a context trust engine attribute is required for TLS server validation. 
+     * 
+     * <p>Default: true.</p>
+     * 
+     * @param flag true if trust engine is required, false if not
+     */
+    public void setTrustEngineRequired(boolean flag) {
+        trustEngineRequired = flag;
     }
 
     /** {@inheritDoc} */
@@ -227,8 +261,13 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
         TrustEngine<? super X509Credential> trustEngine = (TrustEngine<? super X509Credential>) context.getAttribute(
                 HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE);
         if (trustEngine == null) {
-            log.debug("No trust engine supplied by caller, skipping trust eval");
-            return;
+            if (isTrustEngineRequired()) {
+                log.warn("The required trust engine was not supplied by the caller, failing socket TLS creation");
+                throw new SSLPeerUnverifiedException("The required trust engine was not supplied by the caller");
+            } else  {
+                log.debug("No trust engine supplied by caller, skipping trust eval");
+                return;
+            }
         } else {
             log.trace("Saw trust engine of type: {}", trustEngine.getClass().getName());
         }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index 0f5962f..b7db7a7 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -71,12 +71,24 @@ public class SecurityEnhancedTLSSocketFactoryTest {
         Assert.assertNull(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED));
     }
     
+    @Test(expectedExceptions=SSLPeerUnverifiedException.class)
+    public void testDefaultFailNoTrustEngine() throws IOException {
+       X509Credential cred = getCredential("foo-1A1-good.crt");
+       
+       securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
+               Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null);
+       Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
+       
+       securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
+    }
+    
     @Test
     public void testSuccessNoTrustEngine() throws IOException {
        X509Credential cred = getCredential("foo-1A1-good.crt");
        
        securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
                Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null);
+       securityEnhancedSocketFactory.setTrustEngineRequired(false);
        Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
        
        securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.