This is an automated email from the ASF dual-hosted git repository. reta pushed a commit to branch 3.5.x-fixes in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ce698b08d6fe2237528f754a177a1250149048ea Author: Andriy Redko <[email protected]> AuthorDate: Thu Jan 9 13:02:21 2025 -0500 CXF-9093: Client does not send entire payload (if size ~> 2500 bytes) when hc5, TLS1.3 are used (#2214) (cherry picked from commit f7da232ff5446cbf379a140652550ad6eecf7f95) (cherry picked from commit 92c971862796efd8514ab9cbd865c9b93f5fa8d8) (cherry picked from commit a68d008589470d83b2b7c5e268243f6254a9a93d) # Conflicts: # systests/transport-hc5/pom.xml --- systests/transport-hc5/pom.xml | 10 +++ .../hc5/https/clientauth/ClientAuthTest.java | 71 ++++++++++++++++++++++ .../hc5/https/clientauth/client-auth-server.xml | 25 +++++++- .../hc5/https/clientauth/client-auth-tls-1.3.xml | 44 ++++++++++++++ 4 files changed, 148 insertions(+), 2 deletions(-) diff --git a/systests/transport-hc5/pom.xml b/systests/transport-hc5/pom.xml index 7633c2050d..4ff72498dd 100644 --- a/systests/transport-hc5/pom.xml +++ b/systests/transport-hc5/pom.xml @@ -70,6 +70,16 @@ </execution> </executions> </plugin> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-surefire-plugin</artifactId> + <configuration> + <systemPropertyVariables> + <!-- See please https://issues.apache.org/jira/browse/HTTPCORE-775 --> + <jsse.SSLEngine.acceptLargeFragments>true</jsse.SSLEngine.acceptLargeFragments> + </systemPropertyVariables> + </configuration> + </plugin> </plugins> </build> <dependencies> diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java index 678b642f56..3d50791ecf 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java @@ -24,6 +24,8 @@ import java.net.URL; import java.security.KeyStore; import java.util.Arrays; import java.util.Collection; +import java.util.stream.Collectors; +import java.util.stream.IntStream; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; @@ -65,6 +67,7 @@ import static org.junit.Assert.fail; public class ClientAuthTest extends AbstractBusClientServerTestBase { static final String PORT = allocatePort(ClientAuthServer.class); static final String PORT2 = allocatePort(ClientAuthServer.class, 2); + static final String PORT3 = allocatePort(ClientAuthServer.class, 3); final Boolean async; @@ -575,6 +578,74 @@ public class ClientAuthTest extends AbstractBusClientServerTestBase { ((java.io.Closeable)port).close(); } + // Server directly trusts the client cert and uses TLSv1.3, no chunking + @org.junit.Test + public void testDirectTrustTls13LargeNoChunking() throws Exception { + SpringBusFactory bf = new SpringBusFactory(); + URL busFile = ClientAuthTest.class.getResource("client-auth-tls-1.3.xml"); + + Bus bus = bf.createBus(busFile.toString()); + BusFactory.setDefaultBus(bus); + BusFactory.setThreadDefaultBus(bus); + + URL url = SOAPService.WSDL_LOCATION; + SOAPService service = new SOAPService(url, SOAPService.SERVICE); + assertNotNull("Service is null", service); + final Greeter port = service.getHttpsPort(); + assertNotNull("Port is null", port); + + updateAddressPort(port, PORT3); + + // Enable Async + if (async) { + ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true); + } + + Client client = ClientProxy.getClient(port); + HTTPConduit http = (HTTPConduit) client.getConduit(); + http.getClient().setAllowChunking(false); + + final String name = IntStream.range(0, 500).mapToObj(i -> "Kitty ").collect(Collectors.joining()); + assertEquals(port.greetMe(name), "Hello " + name); + + ((java.io.Closeable)port).close(); + bus.shutdown(true); + } + + // Server directly trusts the client cert and uses TLSv1.3, chunking + @org.junit.Test + public void testDirectTrustTls13LargeChunking() throws Exception { + SpringBusFactory bf = new SpringBusFactory(); + URL busFile = ClientAuthTest.class.getResource("client-auth-tls-1.3.xml"); + + Bus bus = bf.createBus(busFile.toString()); + BusFactory.setDefaultBus(bus); + BusFactory.setThreadDefaultBus(bus); + + URL url = SOAPService.WSDL_LOCATION; + SOAPService service = new SOAPService(url, SOAPService.SERVICE); + assertNotNull("Service is null", service); + final Greeter port = service.getHttpsPort(); + assertNotNull("Port is null", port); + + updateAddressPort(port, PORT3); + + // Enable Async + if (async) { + ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true); + } + + Client client = ClientProxy.getClient(port); + HTTPConduit http = (HTTPConduit) client.getConduit(); + http.getClient().setAllowChunking(true); + + final String name = IntStream.range(0, 500).mapToObj(i -> "Kitty ").collect(Collectors.joining()); + assertEquals(port.greetMe(name), "Hello " + name); + + ((java.io.Closeable)port).close(); + bus.shutdown(true); + } + private static final class DisableCNCheckVerifier implements HostnameVerifier { @Override diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml index af5a90ffe6..1b96177faa 100644 --- a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml +++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml @@ -54,7 +54,7 @@ address="https://localhost:${testutil.ports.ClientAuthServer}/SoapContext/HttpsPort"; serviceName="s:SOAPService" endpointName="e:HttpsPort" depends-on="direct-trust-tls-settings"/> - + <httpj:engine-factory id="chain-trust-tls-settings"> <httpj:engine port="${testutil.ports.ClientAuthServer.2}"> <httpj:tlsServerParameters> @@ -76,5 +76,26 @@ address="https://localhost:${testutil.ports.ClientAuthServer.2}/SoapContext/HttpsPort"; serviceName="s:SOAPService" endpointName="e:HttpsPort" depends-on="chain-trust-tls-settings"/> - + + <httpj:engine-factory id="direct-trust-tls-1.3-settings"> + <httpj:engine port="${testutil.ports.ClientAuthServer.3}"> + <httpj:tlsServerParameters secureSocketProtocol="TLSv1.3"> + <sec:keyManagers keyPassword="password"> + <sec:keyStore type="jks" password="password" resource="keys/Bethal.jks"/> + </sec:keyManagers> + <sec:trustManagers> + <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/> + </sec:trustManagers> + <sec:clientAuthentication want="true" required="true"/> + </httpj:tlsServerParameters> + </httpj:engine> + </httpj:engine-factory> + + <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"; + xmlns:s="http://apache.org/hello_world/services"; + id="DirectTrustServerTls1.3" + implementor="org.apache.cxf.systest.hc5.GreeterImpl" + address="https://localhost:${testutil.ports.ClientAuthServer.3}/SoapContext/HttpsPort"; + serviceName="s:SOAPService" + endpointName="e:HttpsPort" depends-on="direct-trust-tls-1.3-settings"/> </beans> \ No newline at end of file diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-tls-1.3.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-tls-1.3.xml new file mode 100644 index 0000000000..dc19c42849 --- /dev/null +++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-tls-1.3.xml @@ -0,0 +1,44 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +--> +<beans xmlns="http://www.springframework.org/schema/beans"; + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xmlns:http="http://cxf.apache.org/transports/http/configuration"; + xmlns:jaxws="http://cxf.apache.org/jaxws"; + xmlns:cxf="http://cxf.apache.org/core"; + xmlns:p="http://cxf.apache.org/policy"; + xmlns:sec="http://cxf.apache.org/configuration/security"; + xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...] + + <cxf:bus> + <cxf:features> + <cxf:logging/> + </cxf:features> + </cxf:bus> + <http:conduit name="https://localhost:.*";> + <http:tlsClientParameters disableCNCheck="true" secureSocketProtocol="TLSv1.3"> + <sec:keyManagers keyPassword="password"> + <sec:keyStore type="jks" password="password" resource="keys/Morpit.jks"/> + </sec:keyManagers> + <sec:trustManagers> + <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/> + </sec:trustManagers> + </http:tlsClientParameters> + </http:conduit> +</beans> \ No newline at end of file
