Remote attribute-filter.xml not updating after upgrading

[Kaspar Brand]

On 01.09.15 17:35, Cantor, Scott wrote:
> On 9/1/15, 11:12 AM, "users on behalf of Christopher Greiner" <users-bounces at shibboleth.net on behalf of christopher.greiner at unil.ch> wrote:
> 
>> 2015-09-01 17:04:55,220 - DEBUG
>> [org.apache.commons.httpclient.HttpMethodDirector:443] -  - SSL peer
>> failed hostname validation for name: 130.59.138.32
>> javax.net.ssl.SSLPeerUnverifiedException: SSL peer failed hostname
>> validation for name: 130.59.138.32
> 
> Java bug, nothing to do with the IdP. See recent list traffic.

Yes and no. It definitely depends on whether the JRE includes the
CVE-2015-2625 "fix" [1], but as Chris is pointing out, the issue does
not occur with openws-1.5.4.jar... which seems quite puzzling, as the
only change from 1.5.4 to 1.5.5 is about setting timeouts (see attached
diff).

>From what I understood from Brent's analysis [2], the issue is triggered
by this specific way of calling the SSLSocketFactory:

http://svn.shibboleth.net/view/java-openws/tags/1.5.5/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java?revision=477&view=markup#l188

but as far as I remember, the [FileBacked]HttpResource is not using this
factory, so I'm quite puzzled as to why the timeout setting changes
would trigger a different way of creating the socket (?!).

Kaspar


[1] http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/a25640f4e518

[2] https://shibboleth.net/pipermail/users/2015-July/023100.html
-------------- next part --------------
Index: src/main/java/org/opensaml/ws/soap/client/http/HttpClientBuilder.java
===================================================================
--- src/main/java/org/opensaml/ws/soap/client/http/HttpClientBuilder.java	(.../branches/REL_1/src/main/java)	(revision 472)
+++ src/main/java/org/opensaml/ws/soap/client/http/HttpClientBuilder.java	(.../tags/1.5.5/src/main/java)	(revision 477)
@@ -79,6 +79,9 @@
 
     /** Number of times a failed connection to a host should be retried. */
     private int connectionRetryAttempts;
+    
+    /** Amount of time, in milliseconds, to wait for data to be read from a socket, defaults to 90000. */
+    private int socketTimeout;
 
     /** Socket factory used for the 'https' scheme. */
     private SecureProtocolSocketFactory httpsProtocolSocketFactory;
@@ -100,6 +103,7 @@
         maxConnectionsPerHost = 5;
         maxTotalConnectons = 20;
         connectionRetryAttempts = 0;
+        socketTimeout = 90*1000;
     }
 
     /**
@@ -126,6 +130,8 @@
         connMgrParams.setReceiveBufferSize(getReceiveBufferSize());
         connMgrParams.setSendBufferSize(getSendBufferSize());
         connMgrParams.setTcpNoDelay(isTcpNoDelay());
+        // Note: this is deliberately an internal default for now.
+        connMgrParams.setSoTimeout(socketTimeout);
 
         MultiThreadedHttpConnectionManager connMgr = new MultiThreadedHttpConnectionManager();
         connMgr.setParams(connMgrParams);
Index: src/main/java/org/opensaml/util/resource/HttpResource.java
===================================================================
--- src/main/java/org/opensaml/util/resource/HttpResource.java	(.../branches/REL_1/src/main/java)	(revision 472)
+++ src/main/java/org/opensaml/util/resource/HttpResource.java	(.../tags/1.5.5/src/main/java)	(revision 477)
@@ -26,6 +26,7 @@
 import org.apache.commons.httpclient.HttpStatus;
 import org.apache.commons.httpclient.methods.GetMethod;
 import org.apache.commons.httpclient.methods.HeadMethod;
+import org.apache.commons.httpclient.params.HttpConnectionManagerParams;
 import org.apache.commons.httpclient.util.DateParseException;
 import org.apache.commons.httpclient.util.DateUtil;
 import org.joda.time.DateTime;
@@ -36,6 +37,12 @@
  * A resource representing a file retrieved from a URL using Apache Commons HTTPClient.
  */
 public class HttpResource extends AbstractFilteredResource {
+    
+    /** HttpClient connection timeout in milliseconds. */
+    private static final int CONNECTION_TIMEOUT = 90*1000;
+    
+    /** HttpClient socket timeout in milliseconds. */
+    private static final int SOCKET_TIMEOUT = 90*1000;
 
     /** HTTP URL of the resource. */
     private String resourceUrl;
@@ -57,6 +64,10 @@
         }
 
         httpClient = new HttpClient();
+        
+        HttpConnectionManagerParams connMgrParams = httpClient.getHttpConnectionManager().getParams();
+        connMgrParams.setConnectionTimeout(CONNECTION_TIMEOUT);
+        connMgrParams.setSoTimeout(SOCKET_TIMEOUT);
     }
 
     /**
@@ -76,6 +87,10 @@
         }
 
         httpClient = new HttpClient();
+        
+        HttpConnectionManagerParams connMgrParams = httpClient.getHttpConnectionManager().getParams();
+        connMgrParams.setConnectionTimeout(CONNECTION_TIMEOUT);
+        connMgrParams.setSoTimeout(SOCKET_TIMEOUT);
     }
 
     /** {@inheritDoc} */