Revision: ccab74707755
Author: deruelle_jean <deruelle_jean@8e71dc83-d81e-6649-80f2-80b843a9b2be>
Date: Thu Dec 6 14:40:43 2012
Log: Update Issue 39
(git repo)
http://java.net/jira/browse/JSIP-441
Introducing a new Value for ClientAuthType : DisabledAll to disable both
client and server side tls cert validation for testing environments
(cherry picked from commit 99b8232c73143239bfeb0607db9150f86e42a769)
git-svn-id:
https://svn.java.net/svn/jsip~svn/branches/JAIN-SIP-NIO-year-2012@2196
8e71dc83-d81e-6649-80f2-80b843a9b2be
http://code.google.com/p/jain-sip/source/detail?r=ccab74707755
Modified:
/src/gov/nist/core/net/DefaultNetworkLayer.java
/src/gov/nist/core/net/NetworkLayer.java
/src/gov/nist/core/net/SslNetworkLayer.java
/src/gov/nist/javax/sip/SipStackImpl.java
/src/gov/nist/javax/sip/stack/ClientAuthType.java
/src/gov/nist/javax/sip/stack/TLSMessageChannel.java
=======================================
--- /src/gov/nist/core/net/DefaultNetworkLayer.java Tue Dec 4 22:13:49 2012
+++ /src/gov/nist/core/net/DefaultNetworkLayer.java Thu Dec 6 14:40:43 2012
@@ -25,6 +25,8 @@
*/
package gov.nist.core.net;
+import gov.nist.javax.sip.SipStackImpl;
+
import java.io.IOException;
import java.net.ConnectException;
import java.net.DatagramSocket;
@@ -208,5 +210,8 @@
// else
// return new Socket(address, port);
}
+
+ @Override
+ public void setSipStack(SipStackImpl sipStackImpl) {}
}
=======================================
--- /src/gov/nist/core/net/NetworkLayer.java Thu Jul 30 10:07:09 2009
+++ /src/gov/nist/core/net/NetworkLayer.java Thu Dec 6 14:40:43 2012
@@ -25,6 +25,8 @@
*/
package gov.nist.core.net;
+import gov.nist.javax.sip.SipStackImpl;
+
import java.io.IOException;
import java.net.DatagramSocket;
import java.net.InetAddress;
@@ -150,4 +152,9 @@
public DatagramSocket createDatagramSocket(int port, InetAddress laddr)
throws SocketException;
+ /**
+ * Set the sip stack impl so that the network layer can access it to
query properties
+ * @param sipStackImpl
+ */
+ public void setSipStack(SipStackImpl sipStackImpl);
}
=======================================
--- /src/gov/nist/core/net/SslNetworkLayer.java Thu Dec 6 13:12:01 2012
+++ /src/gov/nist/core/net/SslNetworkLayer.java Thu Dec 6 14:40:43 2012
@@ -25,6 +25,12 @@
*/
package gov.nist.core.net;
+import gov.nist.core.CommonLogger;
+import gov.nist.core.LogWriter;
+import gov.nist.core.StackLogger;
+import gov.nist.javax.sip.SipStackImpl;
+import gov.nist.javax.sip.stack.ClientAuthType;
+
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
@@ -39,6 +45,7 @@
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
@@ -46,7 +53,9 @@
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
/**
* extended implementation of a network layer that allows to define a
private java
@@ -59,11 +68,34 @@
*/
public class SslNetworkLayer implements NetworkLayer {
+ private static StackLogger logger =
CommonLogger.getLogger(SslNetworkLayer.class);
+
private SSLSocketFactory sslSocketFactory;
private SSLServerSocketFactory sslServerSocketFactory;
+
+ // Create a trust manager that does not validate certificate chains
+ TrustManager[] trustAllCerts = new TrustManager[] {
+ new X509TrustManager() {
+ public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+ return new X509Certificate[0];
+ }
+ public void checkClientTrusted(X509Certificate[] certs, String
authType) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "checkClientTrusted : Not validating certs " +
certs + " authType " + authType);
+ }
+ }
+ public void checkServerTrusted(X509Certificate[] certs, String
authType) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "checkServerTrusted : Not validating certs " +
certs + " authType " + authType);
+ }
+ }
+ }};
public SslNetworkLayer(
+ SipStackImpl sipStack,
String trustStoreFile,
String keyStoreFile,
char[] keyStorePassword,
@@ -84,8 +116,20 @@
trustStore.load(new FileInputStream(trustStoreFile),
keyStorePassword);
tmFactory.init(trustStore);
kmFactory.init(keyStore, keyStorePassword);
- sslContext.init(kmFactory.getKeyManagers(),
tmFactory.getTrustManagers(), secureRandom);
- sslServerSocketFactory = sslContext.getServerSocketFactory();
+ if(sipStack.getClientAuth() == ClientAuthType.DisabledAll) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "ClientAuth " + sipStack.getClientAuth() + "
bypassing all cert validations");
+ }
+ sslContext.init(null, trustAllCerts, secureRandom);
+ } else {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "ClientAuth " + sipStack.getClientAuth());
+ }
+ sslContext.init(kmFactory.getKeyManagers(),
tmFactory.getTrustManagers(), secureRandom);
+ }
+ sslServerSocketFactory = sslContext.getServerSocketFactory();
sslSocketFactory = sslContext.getSocketFactory();
}
@@ -220,4 +264,7 @@
// else
// return new Socket(address, port);
}
+
+ @Override
+ public void setSipStack(SipStackImpl sipStackImpl) {}
}
=======================================
--- /src/gov/nist/javax/sip/SipStackImpl.java Wed Nov 7 03:50:35 2012
+++ /src/gov/nist/javax/sip/SipStackImpl.java Thu Dec 6 14:40:43 2012
@@ -528,9 +528,9 @@
* </li>
*
* <li><b>gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE = String </b> Valid
values are Default (backward compatible with previous versions)
- * , Enabled, Want or Disabled. Set to Enabled if you want the SSL stack
to require a valid certificate chain from the client before
+ * , Enabled, Want, Disabled or DisabledAll. Set to Enabled if you want
the SSL stack to require a valid certificate chain from the client before
* accepting a connection. Set to Want if you want the SSL stack to
request a client Certificate, but not fail if one isn't presented.
- * A Disabled value will not require a certificate chain.
+ * A Disabled value will not require a certificate chain for the Server
Connection. A DisabledAll will not require a certificate chain for both
Server and Client Connections.
* </li>
*
*<li><b>gov.nist.javax.sip.RELIABLE_CONNECTION_KEEP_ALIVE_TIMEOUT</b>
Value in seconds which is used as default keepalive timeout
@@ -844,6 +844,14 @@
this.addExtensionMethod(em);
}
}
+
+ // Allow application to choose the tls client auth policy on
the socket
+ String clientAuthType =
configurationProperties.getProperty("gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE");
+ if (clientAuthType != null) {
+ super.clientAuth = ClientAuthType.valueOf(clientAuthType);
+ logger.logInfo("using " + clientAuthType + " tls auth policy");
+ }
+
String keyStoreFile = configurationProperties
.getProperty("javax.net.ssl.keyStore");
String trustStoreFile = configurationProperties
@@ -855,7 +863,7 @@
String keyStorePassword = configurationProperties
.getProperty("javax.net.ssl.keyStorePassword");
try {
- this.networkLayer = new
SslNetworkLayer(trustStoreFile,
+ this.networkLayer = new SslNetworkLayer(this,
trustStoreFile,
keyStoreFile,
keyStorePassword != null ?
keyStorePassword.toCharArray() : null,
@@ -958,13 +966,6 @@
ex);
}
- // Allow application to choose the tls client auth policy on
the socket
- String clientAuthType =
configurationProperties.getProperty("gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE");
- if (clientAuthType != null) {
- super.clientAuth = ClientAuthType.valueOf(clientAuthType);
- logger.logInfo("using " + clientAuthType + " tls auth policy");
- }
-
// The following features are unique to the NIST implementation.
/*
@@ -981,6 +982,7 @@
Class<?> clazz = Class.forName(path);
Constructor<?> c = clazz.getConstructor(new
Class[0]);
networkLayer = (NetworkLayer) c.newInstance(new
Object[0]);
+ networkLayer.setSipStack(this);
} catch (Exception e) {
throw new PeerUnavailableException(
"can't find or instantiate
NetworkLayer implementation: "
=======================================
--- /src/gov/nist/javax/sip/stack/ClientAuthType.java Fri Jan 7 05:02:03
2011
+++ /src/gov/nist/javax/sip/stack/ClientAuthType.java Thu Dec 6 14:40:43
2012
@@ -30,5 +30,5 @@
*
*/
public enum ClientAuthType {
- Enabled, Disabled, Want, Default;
+ Enabled, Disabled, DisabledAll, Want, Default;
}
=======================================
--- /src/gov/nist/javax/sip/stack/TLSMessageChannel.java Fri Nov 23
08:22:14 2012
+++ /src/gov/nist/javax/sip/stack/TLSMessageChannel.java Thu Dec 6
14:40:43 2012
@@ -108,7 +108,7 @@
mySock = (SSLSocket) sock;
if (sock instanceof SSLSocket) {
SSLSocket sslSock = (SSLSocket) sock;
- if(sipStack.getClientAuth() != ClientAuthType.Want &&
sipStack.getClientAuth() != ClientAuthType.Disabled) {
+ if(sipStack.getClientAuth() != ClientAuthType.Want &&
sipStack.getClientAuth() != ClientAuthType.Disabled &&
sipStack.getClientAuth() != ClientAuthType.DisabledAll) {
sslSock.setNeedClientAuth(true);
}
if(logger.isLoggingEnabled(StackLogger.TRACE_DEBUG)) {
