[java-identity-provider] branch main updated: JSSH-16: Update to Apache HttpClient 5.x

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d8e9b637f7f660a966640833b2037f1611bd8651

The following commit(s) were added to refs/heads/main by this push:
     new d8e9b637f JSSH-16: Update to Apache HttpClient 5.x
d8e9b637f is described below

commit d8e9b637f7f660a966640833b2037f1611bd8651
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Tue Feb 28 18:45:59 2023 -0500

    JSSH-16: Update to Apache HttpClient 5.x
    
    Fix CAS test issue on hosts with IPv6 enabled.
---
 .../proxy/impl/HttpClientProxyValidatorTest.java   | 60 +++++++++++++++++++---
 1 file changed, 54 insertions(+), 6 deletions(-)

diff --git a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
index e0d701139..2cb4c780a 100644
--- a/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
+++ b/idp-cas-impl/src/test/java/net/shibboleth/idp/cas/proxy/impl/HttpClientProxyValidatorTest.java
@@ -21,14 +21,26 @@ import static org.testng.Assert.assertTrue;
 import static org.testng.Assert.fail;
 
 import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InterfaceAddress;
+import java.net.NetworkInterface;
 import java.net.URI;
+import java.nio.ByteBuffer;
 import java.security.cert.CertificateException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 import javax.security.auth.login.FailedLoginException;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 
+import org.apache.hc.client5.http.SystemDefaultDnsResolver;
 import org.eclipse.jetty.server.Connector;
 import org.eclipse.jetty.server.Handler;
 import org.eclipse.jetty.server.Request;
@@ -39,6 +51,7 @@ import org.eclipse.jetty.util.ssl.SslContextFactory;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.ApplicationContext;
+import org.testng.annotations.BeforeClass;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
@@ -61,6 +74,8 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
     @SuppressWarnings("unused")
     @Autowired
     private ApplicationContext context;
+    
+    private List<InetAddress> jettyListenAddrs;
 
     @DataProvider(name = "data")
     public Object[][] buildTestData() {
@@ -83,7 +98,7 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
                         404,
                         new FailedLoginException()
                 },
-/* TEMP disabled pending decision on how to fix failures under HC 5.x. -- Brent 2023-02-21
+
                 // Untrusted self-signed cert
                 new Object[] {
                         "https://localhost:8443",
@@ -99,9 +114,36 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
                         200,
                         new CertificateException(),
                 },
-*/
+
         };
     }
+    
+    @BeforeClass
+    public void resolveListenAddresses() throws Exception {
+        // As of HttpClient 5.x, we need Jetty to listen on all localhost IPv4 and IPv6 addresses,
+        // b/c on connection failure (e.g. TLS handshake failure) HC will try them all,
+        // so they all have to respond similarly for the tests that expect failure via a specified exception type.
+        // This is an attempt to get them portably depending on whether IPv4 and/or IPv6 is enabled.
+
+        // Resolve the 'localhost' addrs that will be resolved and used by HttpClient
+        final List<InetAddress> localhostAddrs = Arrays.asList(SystemDefaultDnsResolver.INSTANCE.resolve("localhost"));
+
+        // Resolve available loopback and link-local interfaces
+        // Using ByteBuffer just to get hashcode() and equals() for byte[] for filtering using the Set.
+       final Set<ByteBuffer> interfaceAddrs = Collections.list(NetworkInterface.getNetworkInterfaces()).stream()
+               .map(NetworkInterface::getInterfaceAddresses)
+               .flatMap(Collection::stream)
+               .map(InterfaceAddress::getAddress)
+               .filter(addr -> addr.isLoopbackAddress() || addr.isLinkLocalAddress() )
+               .map(InetAddress::getAddress)
+               .map(ByteBuffer::wrap)
+               .collect(Collectors.toSet());
+       
+       // Retain for listening those 'localhost' addrs which correspond to enabled interfaces
+       jettyListenAddrs = localhostAddrs.stream()
+               .filter(addr -> interfaceAddrs.contains(ByteBuffer.wrap(addr.getAddress())))
+               .collect(Collectors.toList());
+    }
 
     @Test(dataProvider = "data")
     public void testAuthenticate(
@@ -135,10 +177,16 @@ public class HttpClientProxyValidatorTest extends AbstractFlowActionTest {
         sslContextFactory.setKeyStoreType("PKCS12");
         sslContextFactory.setKeyStorePath(keyStorePath);
         sslContextFactory.setKeyStorePassword("changeit");
-        final ServerConnector connector = new ServerConnector(server, sslContextFactory);
-        connector.setHost("127.0.0.1");
-        connector.setPort(8443);
-        server.setConnectors(new Connector[] { connector });
+        
+        ArrayList<ServerConnector> connectors = new ArrayList<>();
+        jettyListenAddrs.forEach(addr ->  {
+            final ServerConnector connector = new ServerConnector(server, sslContextFactory);
+            connector.setHost(addr.getHostAddress());
+            connector.setPort(8443);
+            connectors.add(connector);
+        });
+        server.setConnectors(connectors.toArray(new Connector[] {}));
+
         server.setHandler(handler);
         try {
             server.start();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.