[java-opensaml] 01/02: OSJ-209: Support mandatory use of TrustEngine in SecurityEnhancedTLSSocketFactory
Brent Putman
putmanb at georgetown.edu
Thu Jun 29 19:05:55 EDT 2017
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=d9231b88a800722502a2b405e064f471dc272a73
commit d9231b88a800722502a2b405e064f471dc272a73
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Jun 29 18:21:33 2017 -0400
OSJ-209: Support mandatory use of TrustEngine in
SecurityEnhancedTLSSocketFactory
Refactor socket factory to make trustEngineRequired flag a ctor
arg only, don't want to allow modification by setter after
construction.
---
.../impl/FileBackedHTTPMetadataResolverTest.java | 4 +-
...ctionDrivenDynamicHTTPMetadataResolverTest.java | 4 +-
.../resolver/impl/HTTPMetadataResolverTest.java | 4 +-
.../impl/SecurityEnhancedTLSSocketFactory.java | 56 ++++++++++++++--------
.../impl/SecurityEnhancedTLSSocketFactoryTest.java | 3 +-
5 files changed, 43 insertions(+), 28 deletions(-)
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
index 48f39cd..2f1194c 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FileBackedHTTPMetadataResolverTest.java
@@ -450,9 +450,9 @@ public class FileBackedHTTPMetadataResolverTest extends XMLObjectBaseTestCase {
private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER
+ SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
+ trustEngineRequired
);
- factory.setTrustEngineRequired(trustEngineRequired);
return factory;
}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
index 7428ffe..db3accb 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/FunctionDrivenDynamicHTTPMetadataResolverTest.java
@@ -537,9 +537,9 @@ public class FunctionDrivenDynamicHTTPMetadataResolverTest extends XMLObjectBase
private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER
+ SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
+ trustEngineRequired
);
- factory.setTrustEngineRequired(trustEngineRequired);
return factory;
}
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
index 2e0ab96..da1f3fb 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
@@ -296,9 +296,9 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
private LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER
+ SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
+ trustEngineRequired
);
- factory.setTrustEngineRequired(trustEngineRequired);
return factory;
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index b68864e..2c1969f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -31,11 +31,6 @@ import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
-import net.shibboleth.utilities.java.support.logic.Constraint;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
-import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
-import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
-
import org.apache.http.HttpHost;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
import org.apache.http.conn.ssl.X509HostnameVerifier;
@@ -52,6 +47,11 @@ import org.opensaml.security.x509.tls.impl.ThreadLocalX509CredentialContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
+import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
+
/**
* An security-enhanced implementation of HttpClient's TLS-capable {@link LayeredConnectionSocketFactory}.
*
@@ -126,7 +126,22 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
/** Flag indicating whether a context trust engine attribute is required for TLS server validation.
* Default: true. */
- private boolean trustEngineRequired;
+ private boolean engineRequired = true;
+
+ /**
+ * Constructor.
+ *
+ * <p>No hostname verifier is configured in this implementation. (Does not affect whether hostname
+ * is or is not evaluated by the wrapped socket factory).</p>
+ *
+ * @param factory the underlying HttpClient socket factory wrapped by this implementation.
+ * @param trustEngineRequired flag indicating whether a context trust engine attribute is required
+ * for TLS server validation.
+ */
+ public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory,
+ boolean trustEngineRequired) {
+ this(factory, null, trustEngineRequired);
+ }
/**
* Constructor.
@@ -137,7 +152,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
* @param factory the underlying HttpClient socket factory wrapped by this implementation.
*/
public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory) {
- this(factory, null);
+ this(factory, null, true);
}
/**
@@ -148,9 +163,21 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
*/
public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory,
@Nullable final X509HostnameVerifier verifier) {
+ this(factory, verifier, true);
+ }
+ /**
+ * Constructor.
+ *
+ * @param factory the underlying HttpClient socket factory wrapped by this implementation.
+ * @param verifier the hostname verifier evaluated by this implementation
+ * @param trustEngineRequired flag indicating whether a context trust engine attribute is required
+ * for TLS server validation.
+ */
+ public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory,
+ @Nullable final X509HostnameVerifier verifier, boolean trustEngineRequired) {
wrappedFactory = Constraint.isNotNull(factory, "Socket factory was null");
hostnameVerifier = verifier;
- trustEngineRequired = true;
+ engineRequired = trustEngineRequired;
}
/**
@@ -161,18 +188,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
* @return true if trust engine is required, false if not
*/
public boolean isTrustEngineRequired() {
- return trustEngineRequired;
- }
-
- /**
- * Set the flag indicating whether a context trust engine attribute is required for TLS server validation.
- *
- * <p>Default: true.</p>
- *
- * @param flag true if trust engine is required, false if not
- */
- public void setTrustEngineRequired(boolean flag) {
- trustEngineRequired = flag;
+ return engineRequired;
}
/** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index b7db7a7..4b01cc3 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -87,8 +87,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
X509Credential cred = getCredential("foo-1A1-good.crt");
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null);
- securityEnhancedSocketFactory.setTrustEngineRequired(false);
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), null, false);
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list