This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/master by this push:
new 3157955 CXF-8253 - Provide a way to disable TLS trust verification
for the OSGi HttpConduitConfigApplier
3157955 is described below
commit 3157955899bc49e2e0dad145e9e6c52fb82e1d8c
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Tue Mar 31 15:52:11 2020 +0100
CXF-8253 - Provide a way to disable TLS trust verification for the OSGi
HttpConduitConfigApplier
---
.../http/osgi/HttpConduitConfigApplier.java | 10 +-
.../cxf/transport/https/InsecureTrustManager.java | 68 +++++++++++++
.../http/osgi/HttpConduitConfigApplierTest.java | 105 +++++++++++++++++++++
.../https/ciphersuites/CipherSuitesTest.java | 39 +-------
.../systest/https/clientauth/ClientAuthTest.java | 28 +-----
.../cxf/systest/https/trust/TrustManagerTest.java | 31 +-----
.../https/trust/client-trust-manager-ref.xml | 2 +-
7 files changed, 193 insertions(+), 90 deletions(-)
diff --git
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
index e0fcfe6..ddfa195 100644
---
a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
+++
b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
@@ -38,6 +38,7 @@ import
org.apache.cxf.configuration.security.SecureRandomParameters;
import org.apache.cxf.configuration.security.TrustManagersType;
import org.apache.cxf.transport.http.HTTPConduit;
import org.apache.cxf.transport.http.auth.HttpAuthSupplier;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.cxf.transports.http.configuration.ConnectionType;
import org.apache.cxf.transports.http.configuration.HTTPClientPolicy;
import org.apache.cxf.transports.http.configuration.ProxyServerType;
@@ -68,6 +69,8 @@ class HttpConduitConfigApplier {
KeyManagersType kmt = null;
TrustManagersType tmt = null;
boolean enableRevocation = false;
+ boolean disableTrustVerification = false;
+
while (keys.hasMoreElements()) {
String k = keys.nextElement();
if (k.startsWith("tlsClientParameters.")) {
@@ -121,6 +124,9 @@ class HttpConduitConfigApplier {
while (st.hasMoreTokens()) {
p.getCipherSuites().add(st.nextToken());
}
+ } else if ("trustManagers.disableTrustVerification".equals(k)
+ && Boolean.parseBoolean(v)) {
+ disableTrustVerification = true;
} else if (k.startsWith("trustManagers.")) {
tmt = getTrustManagers(tmt,
k.substring("trustManagers.".length()),
@@ -140,7 +146,9 @@ class HttpConduitConfigApplier {
if (kmt != null) {
p.setKeyManagers(TLSParameterJaxBUtils.getKeyManagers(kmt));
}
- if (tmt != null) {
+ if (disableTrustVerification) {
+
p.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
+ } else if (tmt != null) {
p.setTrustManagers(TLSParameterJaxBUtils.getTrustManagers(tmt,
enableRevocation));
}
} catch (RuntimeException e) {
diff --git
a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
new file mode 100644
index 0000000..e09755c
--- /dev/null
+++
b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
@@ -0,0 +1,68 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.transport.https;
+
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.logging.Logger;
+
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.cxf.common.logging.LogUtils;
+
+/**
+ * This class provides a static method to create an array of TrustManagers,
which disables TLS
+ * trust verification. This is insecure and must not be used in production,
only for testing!
+ */
+public final class InsecureTrustManager {
+
+ private static final Logger LOG =
LogUtils.getL7dLogger(InsecureTrustManager.class);
+
+ private InsecureTrustManager() {
+ // complete
+ }
+
+ public static TrustManager[] getNoOpX509TrustManagers() {
+ LOG.warning("This class essentially disables TLS trust verification
and is insecure!");
+ return new TrustManager[] {new NoOpX509TrustManager()};
+ }
+
+ private static final class NoOpX509TrustManager implements
X509TrustManager {
+
+ private NoOpX509TrustManager() {
+
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
+ }
+
+ @Override
+ public X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
+
+ }
+}
diff --git
a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
new file mode 100644
index 0000000..53b1917
--- /dev/null
+++
b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
@@ -0,0 +1,105 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.transport.http.osgi;
+
+import java.io.IOException;
+import java.util.Dictionary;
+import java.util.Hashtable;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.bus.extension.ExtensionManagerBus;
+import org.apache.cxf.service.model.EndpointInfo;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.http.URLConnectionHTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class HttpConduitConfigApplierTest {
+
+ @Test
+ public void testNormalTrustLoading() throws IOException {
+ HttpConduitConfigApplier configApplier = new
HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "false");
+ String address = "https://localhost:12345";;
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNull(conduit.getTlsClientParameters().getTrustManagers());
+ assertFalse(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+ @Test
+ public void testDisableTrustVerification() throws IOException {
+ HttpConduitConfigApplier configApplier = new
HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "true");
+
configValues.put("tlsClientParameters.trustManagers.disableTrustVerification",
"true");
+ String address = "https://localhost:12345";;
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNotNull(conduit.getTlsClientParameters().getTrustManagers());
+
assertEquals(conduit.getTlsClientParameters().getTrustManagers().length, 1);
+
assertTrue(conduit.getTlsClientParameters().getTrustManagers()[0].getClass()
+ .getName().startsWith(InsecureTrustManager.class.getName()));
+ assertTrue(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+ @Test
+ public void testTrustVerificationEnabled() throws IOException {
+ HttpConduitConfigApplier configApplier = new
HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "true");
+
configValues.put("tlsClientParameters.trustManagers.disableTrustVerification",
"false");
+ String address = "https://localhost:12345";;
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNotNull(conduit.getTlsClientParameters().getTrustManagers());
+
assertEquals(conduit.getTlsClientParameters().getTrustManagers().length, 1);
+
assertFalse(conduit.getTlsClientParameters().getTrustManagers()[0].getClass()
+ .getName().startsWith(InsecureTrustManager.class.getName()));
+ assertTrue(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+}
\ No newline at end of file
diff --git
a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
index 3370c20..c81f98c 100644
---
a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
+++
b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
@@ -20,8 +20,6 @@
package org.apache.cxf.systest.https.ciphersuites;
import java.net.URL;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
@@ -30,7 +28,6 @@ import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -42,6 +39,7 @@ import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
@@ -346,9 +344,7 @@ public class CipherSuitesTest extends
AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -431,9 +427,7 @@ public class CipherSuitesTest extends
AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -480,9 +474,7 @@ public class CipherSuitesTest extends
AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -523,9 +515,7 @@ public class CipherSuitesTest extends
AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -574,23 +564,4 @@ public class CipherSuitesTest extends
AbstractBusClientServerTestBase {
bus.shutdown(true);
}
- private static class NoOpX509TrustManager implements X509TrustManager {
-
- NoOpX509TrustManager() {
- }
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
}
diff --git
a/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
b/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
index 695f35b..2fa82a5 100644
---
a/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
+++
b/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
@@ -23,8 +23,6 @@ import java.io.InputStream;
import java.net.URL;
import java.security.KeyStore;
import java.security.Security;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collection;
@@ -36,7 +34,6 @@ import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
-import javax.net.ssl.X509TrustManager;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -49,6 +46,7 @@ import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
@@ -414,9 +412,7 @@ public class ClientAuthTest extends
AbstractBusClientServerTestBase {
assertNotNull("Service is null", service);
// Set up (shared) KeyManagers/TrustManagers
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
KeyManagerFactory kmf =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
@@ -490,9 +486,7 @@ public class ClientAuthTest extends
AbstractBusClientServerTestBase {
assertNotNull("Service is null", service);
// Set up (shared) KeyManagers/TrustManagers
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers =
InsecureTrustManager.getNoOpX509TrustManagers();
KeyManagerFactory kmf =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
@@ -650,20 +644,4 @@ public class ClientAuthTest extends
AbstractBusClientServerTestBase {
};
- private static class NoOpX509TrustManager implements X509TrustManager {
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
}
diff --git
a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
index 90030a0..bde5322 100644
---
a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
+++
b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
@@ -45,6 +45,7 @@ import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
@@ -124,10 +125,7 @@ public class TrustManagerTest extends
AbstractBusClientServerTestBase {
}
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
- tlsParams.setTrustManagers(trustManagers);
+
tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
tlsParams.setDisableCNCheck(true);
Client client = ClientProxy.getClient(port);
@@ -441,31 +439,6 @@ public class TrustManagerTest extends
AbstractBusClientServerTestBase {
bus.shutdown(true);
}
- public static TrustManager[] getNoOpX509TrustManagers() {
- return new TrustManager[] {new NoOpX509TrustManager()};
- }
-
- public static class NoOpX509TrustManager implements X509TrustManager {
-
- public NoOpX509TrustManager() {
-
- }
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String
authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
-
public static class ServerCertX509TrustManager implements X509TrustManager
{
private String requiredServerPrincipalName;
diff --git
a/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
index b1dfa47..47803c1 100644
---
a/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
+++
b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
@@ -31,7 +31,7 @@
</cxf:features>
</cxf:bus>
- <bean id="trustManagers"
class="org.apache.cxf.systest.https.trust.TrustManagerTest"
factory-method="getNoOpX509TrustManagers"/>
+ <bean id="trustManagers"
class="org.apache.cxf.transport.https.InsecureTrustManager"
factory-method="getNoOpX509TrustManagers"/>
<http:conduit name="https://localhost:.*";>
<http:tlsClientParameters disableCNCheck="true">
