[java-support] 01/04: OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Brent Putman
putmanb at georgetown.edu
Wed Feb 19 17:18:24 EST 2020
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-support.
View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=7e93212d398c445ba3b4d37f800883e2fca924b8
commit 7e93212d398c445ba3b4d37f800883e2fca924b8
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sat Feb 15 05:17:24 2020 -0500
OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Update to use non-deprecated verifier interface, which is a super-type
of the deprecated one.
---
.../java/support/httpclient/HttpClientBuilder.java | 4 +--
.../java/support/httpclient/TLSSocketFactory.java | 39 ++++++++--------------
.../httpclient/TLSSocketFactoryBuilder.java | 15 ++++-----
3 files changed, 22 insertions(+), 36 deletions(-)
diff --git a/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java b/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java
index 1ecd92d..449d73c 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.java
@@ -97,7 +97,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
* <ul>
* <li><code>SSLSocketFactory</code> ({@link org.apache.http.conn.socket.LayeredConnectionSocketFactory})</li>
* <li>{@link javax.net.ssl.SSLContext}</li>
- * <li>{@link org.apache.http.conn.ssl.X509HostnameVerifier}</li>
+ * <li>{@link javax.net.ssl.HostnameVerifier}</li>
* <li>{@link org.apache.http.config.SocketConfig}</li>
* <li>{@link ConnectionConfig}</li>
* <li><code>maxConnTotal</code></li>
@@ -131,7 +131,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
*
* <ul>
* <li>{@link javax.net.ssl.SSLContext}</li>
- * <li>{@link org.apache.http.conn.ssl.X509HostnameVerifier}</li>
+ * <li>{@link javax.net.ssl.HostnameVerifier}</li>
* </ul>
* </li>
*
diff --git a/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactory.java b/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactory.java
index 48a296f..89f1c9c 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactory.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactory.java
@@ -27,6 +27,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import javax.net.SocketFactory;
+import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
@@ -40,9 +41,7 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
import org.apache.http.HttpHost;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
-import org.apache.http.conn.ssl.BrowserCompatHostnameVerifier;
import org.apache.http.conn.ssl.StrictHostnameVerifier;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.protocol.HttpContext;
import org.apache.http.util.Args;
import org.slf4j.Logger;
@@ -89,14 +88,10 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
@Nonnull @NotEmpty public static final String SSLV2 = "SSLv2";
/** Hostname verifier which passes all hostnames. */
- @Nonnull public static final X509HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER = new AllowAllHostnameVerifier();
-
- /** Hostname verifier which implements a policy similar to most browsers. */
- @Nonnull public static final X509HostnameVerifier BROWSER_COMPATIBLE_HOSTNAME_VERIFIER =
- new BrowserCompatHostnameVerifier();
+ @Nonnull public static final HostnameVerifier ALLOW_ALL_HOSTNAME_VERIFIER = new AllowAllHostnameVerifier();
/** Hostname verifier which implements a strict policy. */
- @Nonnull public static final X509HostnameVerifier STRICT_HOSTNAME_VERIFIER = new StrictHostnameVerifier();
+ @Nonnull public static final HostnameVerifier STRICT_HOSTNAME_VERIFIER = new StrictHostnameVerifier();
/** Logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(TLSSocketFactory.class);
@@ -105,7 +100,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
@Nonnull private final SSLSocketFactory socketfactory;
/** Hostname verifier. */
- @Nonnull private final X509HostnameVerifier hostnameVerifier;
+ @Nonnull private final HostnameVerifier hostnameVerifier;
/** Factory-wide supported protocols. */
private final String[] supportedProtocols;
@@ -131,7 +126,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
*/
public TLSSocketFactory(
@Nonnull final SSLContext sslContext,
- @Nullable final X509HostnameVerifier verifier) {
+ @Nullable final HostnameVerifier verifier) {
this(Constraint.isNotNull(sslContext, "SSL context cannot be null").getSocketFactory(), null, null, verifier);
}
@@ -147,7 +142,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
@Nonnull final SSLContext sslContext,
@Nullable final String[] protocols,
@Nullable final String[] cipherSuites,
- @Nullable final X509HostnameVerifier verifier) {
+ @Nullable final HostnameVerifier verifier) {
this(Constraint.isNotNull(sslContext, "SSL context cannot be null").getSocketFactory(),
protocols, cipherSuites, verifier);
}
@@ -160,7 +155,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
*/
public TLSSocketFactory(
@Nonnull final SSLSocketFactory factory,
- @Nullable final X509HostnameVerifier verifier) {
+ @Nullable final HostnameVerifier verifier) {
this(factory, null, null, verifier);
}
@@ -176,7 +171,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
@Nonnull final SSLSocketFactory factory,
@Nullable final String[] protocols,
@Nullable final String[] cipherSuites,
- @Nullable final X509HostnameVerifier verifier) {
+ @Nullable final HostnameVerifier verifier) {
socketfactory = Constraint.isNotNull(factory, "SSL socket factory cannot be null");
supportedProtocols = protocols;
supportedCipherSuites = cipherSuites;
@@ -197,7 +192,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
*
* @return the hostname verifier
*/
- @Nonnull protected X509HostnameVerifier getHostnameVerifier() {
+ @Nonnull protected HostnameVerifier getHostnameVerifier() {
return hostnameVerifier;
}
@@ -396,24 +391,16 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
protected void verifyHostname(@Nonnull final SSLSocket sslsock, @Nonnull final String hostname,
@Nullable final HttpContext context) throws IOException {
- try {
- X509HostnameVerifier verifier = null;
+ HostnameVerifier verifier = null;
if (context != null) {
- verifier = (X509HostnameVerifier) context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER);
+ verifier = (HostnameVerifier) context.getAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER);
}
if (verifier == null) {
verifier = getHostnameVerifier();
}
- verifier.verify(hostname, sslsock);
- } catch (final IOException iox) {
- // close the socket before re-throwing the exception
- try {
- sslsock.close();
- } catch (final Exception x) {
- /*ignore*/
+ if (! verifier.verify(hostname, sslsock.getSession())) {
+ throw new SSLPeerUnverifiedException("TLS hostname verification failed for hostname: " + hostname);
}
- throw iox;
- }
}
}
diff --git a/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactoryBuilder.java b/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactoryBuilder.java
index 5a1ee18..60d5dae 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactoryBuilder.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/httpclient/TLSSocketFactoryBuilder.java
@@ -27,14 +27,13 @@ import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
-
/**
* A builder for instances of {@link TLSSocketFactory} which allows easy specification
* of the full range of supported factory inputs.
@@ -45,7 +44,7 @@ public class TLSSocketFactoryBuilder {
private static final String DEFAULT_CONTEXT_PROTOCOL = "TLS";
/** The default hostname verifier used by the socket factory. */
- private static final X509HostnameVerifier DEFAULT_HOSTNAME_VERIFIER =
+ private static final HostnameVerifier DEFAULT_HOSTNAME_VERIFIER =
TLSSocketFactory.STRICT_HOSTNAME_VERIFIER;
/** The protocol used when obtaining the SSLContext instance. */
@@ -64,7 +63,7 @@ public class TLSSocketFactoryBuilder {
private SecureRandom secureRandom;
/** The hostname verifier used by the socket factory. */
- private X509HostnameVerifier hostnameVerifier;
+ private HostnameVerifier hostnameVerifier;
/** The SSL/TLS protocols enabled on sockets produced by the socket factory. */
private List<String> enabledProtocols;
@@ -206,13 +205,13 @@ public class TLSSocketFactoryBuilder {
}
/**
- * Get the {@link X509HostnameVerifier} instance used by the socket factory.
+ * Get the {@link HostnameVerifier} instance used by the socket factory.
*
* <p>If not specified, defaults to {@link TLSSocketFactory#STRICT_HOSTNAME_VERIFIER}.
*
* @return the hostname verifier, or null
*/
- @Nullable public X509HostnameVerifier getHostnameVerifier() {
+ @Nullable public HostnameVerifier getHostnameVerifier() {
return hostnameVerifier;
}
@@ -225,7 +224,7 @@ public class TLSSocketFactoryBuilder {
*
* @return this builder instance
*/
- public TLSSocketFactoryBuilder setHostnameVerifier(@Nullable final X509HostnameVerifier verifier) {
+ public TLSSocketFactoryBuilder setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
hostnameVerifier = verifier;
return this;
}
@@ -285,7 +284,7 @@ public class TLSSocketFactoryBuilder {
* @return a new socket factory instance
*/
@Nonnull public TLSSocketFactory build() {
- X509HostnameVerifier verifier = hostnameVerifier;
+ HostnameVerifier verifier = hostnameVerifier;
if (verifier == null) {
verifier = DEFAULT_HOSTNAME_VERIFIER;
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list