[java-opensaml] 01/03: OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Brent Putman
putmanb at georgetown.edu
Wed Feb 19 17:18:34 EST 2020
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=1130908d44e9a99e7b51b17655a25cd9e03342b5
commit 1130908d44e9a99e7b51b17655a25cd9e03342b5
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sat Feb 15 05:18:10 2020 -0500
OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Update to use non-deprecated verifier interface, which is a super-type
of the deprecated one.
---
.../httpclient/HttpClientSecurityConfiguration.java | 4 ++--
.../security/httpclient/HttpClientSecurityConstants.java | 2 +-
.../httpclient/HttpClientSecurityParameters.java | 8 ++++----
.../httpclient/SecurityEnhancedHTTPResourceTest.java | 16 ++--------------
.../impl/BasicHttpClientSecurityConfiguration.java | 8 ++++----
.../impl/SecurityEnhancedTLSSocketFactory.java | 12 +++++++-----
6 files changed, 20 insertions(+), 30 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
index 9613ca6..1fb9ceb 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
@@ -20,9 +20,9 @@ package org.opensaml.security.httpclient;
import java.util.List;
import javax.annotation.Nullable;
+import javax.net.ssl.HostnameVerifier;
import org.apache.http.client.CredentialsProvider;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
@@ -64,7 +64,7 @@ public interface HttpClientSecurityConfiguration {
*
* @return the hostname verifier, or null
*/
- @Nullable public X509HostnameVerifier getHostnameVerifier();
+ @Nullable public HostnameVerifier getHostnameVerifier();
/**
* Get the optional client TLS credential.
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
index 399fa11..ed623ca 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConstants.java
@@ -56,7 +56,7 @@ public final class HttpClientSecurityConstants {
* Must be an instance of {@link java.util.List}<code><</code>{@link String}<code>></code>. */
public static final String CONTEXT_KEY_TLS_CIPHER_SUITES = TLSSocketFactory.CONTEXT_KEY_TLS_CIPHER_SUITES;
- /** HttpContext key for an instance of {@link org.apache.http.conn.ssl.X509HostnameVerifier}. */
+ /** HttpContext key for an instance of {@link javax.net.ssl.HostnameVerifier}. */
public static final String CONTEXT_KEY_HOSTNAME_VERIFIER = TLSSocketFactory.CONTEXT_KEY_HOSTNAME_VERIFIER;
/** Constructor. */
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
index b11e518..fcec0a0 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
@@ -22,6 +22,7 @@ import java.util.Collection;
import java.util.List;
import javax.annotation.Nullable;
+import javax.net.ssl.HostnameVerifier;
import net.shibboleth.utilities.java.support.primitive.StringSupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
@@ -30,7 +31,6 @@ import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.AuthCache;
import org.apache.http.client.CredentialsProvider;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.X509Credential;
@@ -59,7 +59,7 @@ public class HttpClientSecurityParameters {
@Nullable private List<String> tlsCipherSuites;
/** The hostname verifier. */
- @Nullable private X509HostnameVerifier hostnameVerifier;
+ @Nullable private HostnameVerifier hostnameVerifier;
/** The X509 credential used for client TLS. */
@Nullable private X509Credential clientTLSCredential;
@@ -241,7 +241,7 @@ public class HttpClientSecurityParameters {
*
* @return the hostname verifier, or null
*/
- @Nullable public X509HostnameVerifier getHostnameVerifier() {
+ @Nullable public HostnameVerifier getHostnameVerifier() {
return hostnameVerifier;
}
@@ -250,7 +250,7 @@ public class HttpClientSecurityParameters {
*
* @param verifier the hostname verifier, or null
*/
- public void setHostnameVerifier(@Nullable final X509HostnameVerifier verifier) {
+ public void setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
hostnameVerifier = verifier;
}
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
index 848b998..d764d29 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/SecurityEnhancedHTTPResourceTest.java
@@ -18,12 +18,10 @@
package org.opensaml.security.httpclient;
import java.io.IOException;
-import java.security.cert.X509Certificate;
import java.util.Collections;
-import javax.net.ssl.SSLException;
+import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;
-import javax.net.ssl.SSLSocket;
import net.shibboleth.ext.spring.resource.HTTPResource;
import net.shibboleth.ext.spring.resource.ResourceTestHelper;
@@ -32,7 +30,6 @@ import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
import net.shibboleth.utilities.java.support.repository.RepositorySupport;
import org.apache.http.client.HttpClient;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.springframework.core.io.ClassPathResource;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
@@ -75,19 +72,10 @@ public class SecurityEnhancedHTTPResourceTest {
final HTTPResource existsResource = new HTTPResource(client, existsHttps);
existsResource.setHttpClientContextHandler(handler);
- params.setHostnameVerifier(new X509HostnameVerifier() {
+ params.setHostnameVerifier(new HostnameVerifier() {
public boolean verify(String arg0, SSLSession arg1) {
return false;
}
- public void verify(String host, SSLSocket ssl) throws IOException {
- throw new IOException("Rejecting hostname for test");
- }
- public void verify(String host, X509Certificate cert) throws SSLException {
- throw new SSLException("Rejecting hostname for test");
- }
- public void verify(String host, String[] cns, String[] subjectAlts) throws SSLException {
- throw new SSLException("Rejecting hostname for test");
- }
});
Assert.assertFalse(existsResource.exists());
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
index df0863b..d6ba4f7 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
@@ -22,11 +22,11 @@ import java.util.Collection;
import java.util.List;
import javax.annotation.Nullable;
+import javax.net.ssl.HostnameVerifier;
import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
import org.opensaml.security.trust.TrustEngine;
@@ -52,7 +52,7 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
@Nullable private List<String> tlsCipherSuites;
/** The hostname verifier. */
- @Nullable private X509HostnameVerifier hostnameVerifier;
+ @Nullable private HostnameVerifier hostnameVerifier;
/** The X509 credential used for client TLS. */
@Nullable private X509Credential clientTLSCredential;
@@ -193,7 +193,7 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
*
* @return the hostname verifier, or null
*/
- @Nullable public X509HostnameVerifier getHostnameVerifier() {
+ @Nullable public HostnameVerifier getHostnameVerifier() {
return hostnameVerifier;
}
@@ -202,7 +202,7 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
*
* @param verifier the hostname verifier, or null
*/
- public void setHostnameVerifier(@Nullable final X509HostnameVerifier verifier) {
+ public void setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
hostnameVerifier = verifier;
}
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index d4f4b94..c3e854f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -27,6 +27,7 @@ import java.util.Collections;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
@@ -34,7 +35,6 @@ import javax.net.ssl.SSLSocket;
import org.apache.http.HttpHost;
import org.apache.http.client.protocol.HttpClientContext;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.protocol.HttpContext;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.UsageType;
@@ -129,7 +129,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
@Nonnull private LayeredConnectionSocketFactory wrappedFactory;
/** The hostname verifier evaluated by this implementation. */
- @Nullable private X509HostnameVerifier hostnameVerifier;
+ @Nullable private HostnameVerifier hostnameVerifier;
/** Flag indicating whether a context trust engine attribute is required for TLS server validation.
* Default: true. */
@@ -169,7 +169,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
* @param verifier the hostname verifier evaluated by this implementation
*/
public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory,
- @Nullable final X509HostnameVerifier verifier) {
+ @Nullable final HostnameVerifier verifier) {
this(factory, verifier, true);
}
/**
@@ -181,7 +181,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
* for TLS server validation.
*/
public SecurityEnhancedTLSSocketFactory(@Nonnull final LayeredConnectionSocketFactory factory,
- @Nullable final X509HostnameVerifier verifier, final boolean trustEngineRequired) {
+ @Nullable final HostnameVerifier verifier, final boolean trustEngineRequired) {
wrappedFactory = Constraint.isNotNull(factory, "Socket factory was null");
hostnameVerifier = verifier;
engineRequired = trustEngineRequired;
@@ -354,7 +354,9 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
protected void performHostnameVerification(final Socket socket, final String hostname, final HttpContext context)
throws IOException {
if (hostnameVerifier != null && socket instanceof SSLSocket) {
- hostnameVerifier.verify(hostname, (SSLSocket) socket);
+ if (! hostnameVerifier.verify(hostname, ((SSLSocket) socket).getSession())) {
+ throw new SSLPeerUnverifiedException("TLS hostname verification failed for hostname: " + hostname);
+ }
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list