[java-opensaml] 02/03: OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Brent Putman
putmanb at georgetown.edu
Wed Feb 19 17:18:35 EST 2020
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=70bf08765f41c2ec816265867d9ea6607cb4a146
commit 70bf08765f41c2ec816265867d9ea6607cb4a146
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Feb 19 15:57:28 2020 -0500
OSJ-300: Deprecation of HttpClient X509HostnameVerifier interface
Swap use of old deprecated verifier impls for the new ones.
---
.../resolver/impl/HTTPMetadataResolverTest.java | 3 ++-
.../httpclient/HttpClientSecuritySupportTest.java | 12 ++++++------
.../impl/SecurityEnhancedHttpClientSupport.java | 11 +++++------
.../impl/BasicHttpClientSecurityConfigurationTest.java | 5 ++---
.../BasicHttpClientSecurityParametersResolverTest.java | 4 ++--
.../impl/SecurityEnhancedTLSSocketFactoryTest.java | 17 ++++++++---------
6 files changed, 25 insertions(+), 27 deletions(-)
diff --git a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
index 5f5494e..c37c242 100644
--- a/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
+++ b/opensaml-saml-impl/src/test/java/org/opensaml/saml/metadata/resolver/impl/HTTPMetadataResolverTest.java
@@ -54,6 +54,7 @@ import com.google.common.io.ByteStreams;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
import net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder;
import net.shibboleth.utilities.java.support.httpclient.HttpClientSupport;
+import net.shibboleth.utilities.java.support.httpclient.TLSSocketFactory;
import net.shibboleth.utilities.java.support.repository.RepositorySupport;
import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import net.shibboleth.utilities.java.support.resolver.ResolverException;
@@ -361,7 +362,7 @@ public class HTTPMetadataResolverTest extends XMLObjectBaseTestCase {
public static LayeredConnectionSocketFactory buildTrustEngineSocketFactory(boolean trustEngineRequired) {
SecurityEnhancedTLSSocketFactory factory = new SecurityEnhancedTLSSocketFactory(
HttpClientSupport.buildNoTrustTLSSocketFactory(),
- SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER,
+ TLSSocketFactory.STRICT_HOSTNAME_VERIFIER,
trustEngineRequired
);
return factory;
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
index 3f79421..3a9ae98 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/httpclient/HttpClientSecuritySupportTest.java
@@ -43,7 +43,7 @@ import net.shibboleth.utilities.java.support.resolver.CriteriaSet;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.protocol.HttpClientContext;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.UsageType;
@@ -108,7 +108,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSProtocols(Lists.newArrayList("foo"));
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
- params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setHostnameVerifier(new DefaultHostnameVerifier());
params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, false);
@@ -134,7 +134,7 @@ public class HttpClientSecuritySupportTest {
context.setAttribute(CONTEXT_KEY_TLS_PROTOCOLS, Lists.newArrayList("foo"));
context.setAttribute(CONTEXT_KEY_TLS_CIPHER_SUITES, Lists.newArrayList("foo"));
context.setAttribute(CONTEXT_KEY_CLIENT_TLS_CREDENTIAL, new BasicX509Credential(cert));
- context.setAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER, new StrictHostnameVerifier());
+ context.setAttribute(CONTEXT_KEY_HOSTNAME_VERIFIER, new DefaultHostnameVerifier());
context.setAttribute(CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
HttpClientSecurityParameters params = new HttpClientSecurityParameters();
@@ -144,7 +144,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSProtocols(Lists.newArrayList("foo"));
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
- params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setHostnameVerifier(new DefaultHostnameVerifier());
params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, true);
@@ -169,7 +169,7 @@ public class HttpClientSecuritySupportTest {
List<String> protocols = Lists.newArrayList("foo");
List<String> cipherSuites = Lists.newArrayList("foo");
X509Credential clientTLSCred = new BasicX509Credential(cert);
- HostnameVerifier verifier = new StrictHostnameVerifier();
+ HostnameVerifier verifier = new DefaultHostnameVerifier();
context.setCredentialsProvider(credProvider);
context.setAttribute(CONTEXT_KEY_TRUST_ENGINE, trustEngine);
@@ -187,7 +187,7 @@ public class HttpClientSecuritySupportTest {
params.setTLSProtocols(Lists.newArrayList("foo"));
params.setTLSCipherSuites(Lists.newArrayList("foo"));
params.setClientTLSCredential(new BasicX509Credential(cert));
- params.setHostnameVerifier(new StrictHostnameVerifier());
+ params.setHostnameVerifier(new DefaultHostnameVerifier());
params.setServerTLSFailureFatal(Boolean.TRUE);
HttpClientSecuritySupport.marshalSecurityParameters(context, params, false);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
index 558a9ec..f18ed5b 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedHttpClientSupport.java
@@ -27,8 +27,8 @@ import javax.net.ssl.X509TrustManager;
import org.apache.http.client.HttpClient;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.opensaml.security.trust.TrustEngine;
import org.opensaml.security.x509.tls.impl.ThreadLocalX509CredentialKeyManager;
@@ -126,7 +126,7 @@ public final class SecurityEnhancedHttpClientSupport {
final TLSSocketFactoryBuilder wrappedFactoryBuilder = new TLSSocketFactoryBuilder();
if (supportTrustEngine || supportClientTLS) {
- wrappedFactoryBuilder.setHostnameVerifier(new AllowAllHostnameVerifier());
+ wrappedFactoryBuilder.setHostnameVerifier(new NoopHostnameVerifier());
if (supportTrustEngine) {
wrappedFactoryBuilder.setTrustManagers(
@@ -138,13 +138,12 @@ public final class SecurityEnhancedHttpClientSupport {
Collections.<KeyManager>singletonList(new ThreadLocalX509CredentialKeyManager()));
}
- return new SecurityEnhancedTLSSocketFactory(wrappedFactoryBuilder.build(), new StrictHostnameVerifier(),
+ return new SecurityEnhancedTLSSocketFactory(wrappedFactoryBuilder.build(), new DefaultHostnameVerifier(),
supportTrustEngine);
- } else {
- return HttpClientSupport.buildStrictTLSSocketFactory();
}
+ return HttpClientSupport.buildStrictTLSSocketFactory();
}
}
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
index 36eb2c0..6fab6df 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
@@ -22,8 +22,7 @@ import java.net.URISyntaxException;
import java.security.cert.CertificateException;
import org.apache.http.auth.UsernamePasswordCredentials;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
-import org.apache.http.impl.client.BasicAuthCache;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.CredentialSupport;
@@ -56,7 +55,7 @@ public class BasicHttpClientSecurityConfigurationTest {
BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
config.setClientTLSCredential(x509Credential);
config.setCredentialsProvider(new BasicCredentialsProvider());
- config.setHostnameVerifier(new StrictHostnameVerifier());
+ config.setHostnameVerifier(new DefaultHostnameVerifier());
config.setTLSCipherSuites(Lists.newArrayList("test"));
config.setTLSProtocols(Lists.newArrayList("test"));
config.setTLSTrustEngine(new MockTrustEngine());
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index fbad80c..1ccbdcc 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -22,7 +22,7 @@ import java.net.URISyntaxException;
import java.security.KeyException;
import java.security.cert.CertificateException;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.opensaml.security.SecurityException;
import org.opensaml.security.credential.CredentialSupport;
@@ -232,7 +232,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
BasicHttpClientSecurityConfiguration config = new BasicHttpClientSecurityConfiguration();
config.setClientTLSCredential(x509Credential);
config.setCredentialsProvider(new BasicCredentialsProvider());
- config.setHostnameVerifier(new StrictHostnameVerifier());
+ config.setHostnameVerifier(new DefaultHostnameVerifier());
config.setTLSCipherSuites(Lists.newArrayList("test"));
config.setTLSProtocols(Lists.newArrayList("test"));
config.setTLSTrustEngine(new MockTrustEngine());
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index 32992d7..206a2cd 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -33,7 +33,7 @@ import javax.net.ssl.SSLPeerUnverifiedException;
import org.apache.http.HttpHost;
import org.apache.http.client.protocol.HttpClientContext;
import org.apache.http.conn.socket.LayeredConnectionSocketFactory;
-import org.apache.http.conn.ssl.StrictHostnameVerifier;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
import org.apache.http.protocol.HttpContext;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.impl.StaticCredentialResolver;
@@ -117,7 +117,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
@@ -133,7 +133,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
try {
@@ -153,7 +153,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.TRUE);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
try {
@@ -173,7 +173,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_FAILURE_IS_FATAL, Boolean.FALSE);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new StrictHostnameVerifier());
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
@@ -187,7 +187,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- Collections.singletonList((Certificate)cred.getEntityCertificate()), "bogus.example.com"), new StrictHostnameVerifier());
+ Collections.singletonList((Certificate)cred.getEntityCertificate()), "bogus.example.com"), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
@@ -207,7 +207,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
// Pass an empty cert list, to simulate unlikely condition of SSLSession not having any peerCertificates
securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
- new ArrayList<Certificate>(), hostname), new StrictHostnameVerifier());
+ new ArrayList<Certificate>(), hostname), new DefaultHostnameVerifier());
Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
securityEnhancedSocketFactory.connectSocket(0, socket, new HttpHost(hostname, 443, "https"), null, null, httpContext);
@@ -218,9 +218,8 @@ public class SecurityEnhancedTLSSocketFactoryTest {
private LayeredConnectionSocketFactory buildInnerSSLFactory(List<Certificate> certs, String host) {
if (certs == null) {
return new MockTLSSocketFactory();
- } else {
- return new MockTLSSocketFactory(certs, host);
}
+ return new MockTLSSocketFactory(certs, host);
}
private BasicX509Credential getCredential(String entityCertFileName, String ... chainMembers) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list