[java-opensaml] 09/16: Support new context property to indicate server TLS is non-fatal.

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch master
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=9fd09a657d2c29ef4238932e88a466e2d9be36ba

commit 9fd09a657d2c29ef4238932e88a466e2d9be36ba
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Sep 20 17:01:50 2018 -0400

    Support new context property to indicate server TLS is non-fatal.
---
 .../httpclient/HttpClientSecurityConstants.java    |  4 +++
 .../impl/SecurityEnhancedTLSSocketFactory.java     | 11 +++++--
 .../impl/SecurityEnhancedTLSSocketFactoryTest.java | 36 ++++++++++++++++++++++
 3 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
index d391641..399fa11 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
@@ -40,6 +40,10 @@ public final class HttpClientSecurityConstants {
      * of HttpClient socket factories. Type will be a {@link Boolean}. */
     public static final String CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED = "opensaml.ServerTLSCredentialTrusted";
     
+    /** Context key for indicating whether server TLS evaluation failure should be treated as a fatal error.
+     * Type will be a {@link Boolean}. */
+    public static final String CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL = "opensaml.ServerTLSFailureIsFatal";
+    
     /** HttpContext key for the client TLS credential. 
      * Must be an instance of {@link org.opensaml.security.x509.X509Credential}. */
     public static final String CONTEXT_KEY_CLIENT_TLS_CREDENTIAL = "opensaml.ClientTLSCredential";
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 47752ec..a58fa9d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -319,10 +319,17 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
                 context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED, 
                         Boolean.TRUE);
             } else {
-                log.debug("Credential evaluated as untrusted");
                 context.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED, 
                         Boolean.FALSE);
-                throw new SSLPeerUnverifiedException("Trust engine could not establish trust of server TLS credential");
+                final Boolean fatal = 
+                        (Boolean)context.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL);
+                if (fatal == null || fatal) {
+                    log.debug("Credential evaluated as untrusted, failure indicated as fatal");
+                    throw new SSLPeerUnverifiedException(
+                            "Trust engine could not establish trust of server TLS credential");
+                } else {
+                    log.debug("Credential evaluated as untrusted, failure indicated as non-fatal");
+                }
             }
         } catch (final SecurityException e) {
             log.error("Trust engine error evaluating credential", e);
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index 4b01cc3..32992d7 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -144,6 +144,42 @@ public class SecurityEnhancedTLSSocketFactoryTest {
        }
     }
     
+    @Test(expectedExceptions=SSLPeerUnverifiedException.class)
+    public void testFailUntrustedCertExplicitFatal() throws IOException {
+       X509Credential cred = getCredential("foo-1A1-good.crt");
+       List<Credential> emptyCreds = new ArrayList<>();
+       ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(emptyCreds));
+       httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
+       httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.TRUE);
+       
+       securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
+               Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+       Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
+       
+       try {
+           securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
+       } catch (Exception e) {
+           Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.FALSE);
+           throw e;
+       }
+    }
+    
+    @Test
+    public void testFailUntrustedCertNonFatal() throws IOException {
+       X509Credential cred = getCredential("foo-1A1-good.crt");
+       List<Credential> emptyCreds = new ArrayList<>();
+       ExplicitKeyTrustEngine trustEngine = new ExplicitKeyTrustEngine(new StaticCredentialResolver(emptyCreds));
+       httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
+       httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
+       
+       securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
+               Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+       Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
+       
+       securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
+       Assert.assertEquals(httpContext.getAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED), Boolean.FALSE);
+    }
+    
     @Test(expectedExceptions=SSLException.class)
     public void testFailBadHostname() throws IOException {
        X509Credential cred = getCredential("foo-1A1-good.crt");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.