diff --git a/parent/pom.xml b/parent/pom.xml index bea01ea7804..01bbcbf1c88 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -132,7 +132,7 @@ 4.5.14 [4.3,4.5.0) 4.4.16 - 5.6.2 + 5.6.4 5.4.3 3.2.1 3.2.1 diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java index 2d280edf8ba..382425e6a45 100644 --- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java +++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java @@ -83,6 +83,7 @@ import org.apache.hc.client5.http.impl.auth.BasicScheme; import org.apache.hc.client5.http.protocol.HttpClientContext; import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; +import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy; import org.apache.hc.core5.concurrent.BasicFuture; import org.apache.hc.core5.concurrent.FutureCallback; import org.apache.hc.core5.http.Header; @@ -591,7 +592,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context sslContext.getSupportedSSLParameters().getProtocols()); tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols, - cipherSuites, SSLBufferMode.STATIC, verifier); + cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier); } catch (final GeneralSecurityException e) { LOG.warning(e.getMessage()); } diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java index 900c778adad..d81240d5325 100644 --- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java +++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java @@ -78,6 +78,7 @@ import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider; import org.apache.hc.client5.http.protocol.HttpClientContext; import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy; +import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy; import org.apache.hc.core5.concurrent.BasicFuture; import org.apache.hc.core5.concurrent.FutureCallback; import org.apache.hc.core5.http.Header; @@ -584,7 +585,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context sslContext.getSupportedSSLParameters().getProtocols()); tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols, - cipherSuites, SSLBufferMode.STATIC, verifier); + cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier); } catch (final GeneralSecurityException e) { LOG.warning(e.getMessage()); } diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java index e09755c19ef..6a7963fe2ca 100644 --- a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java +++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java @@ -19,11 +19,14 @@ package org.apache.cxf.transport.https; +import java.net.Socket; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.logging.Logger; +import javax.net.ssl.SSLEngine; import javax.net.ssl.TrustManager; +import javax.net.ssl.X509ExtendedTrustManager; import javax.net.ssl.X509TrustManager; import org.apache.cxf.common.logging.LogUtils; @@ -45,6 +48,11 @@ public static TrustManager[] getNoOpX509TrustManagers() { return new TrustManager[] {new NoOpX509TrustManager()}; } + public static TrustManager[] getNoOpX509ExtendedTrustManagers() { + LOG.warning("This class essentially disables TLS trust verification and is insecure!"); + return new TrustManager[] {new NoOpX509ExtendedTrustManager()}; + } + private static final class NoOpX509TrustManager implements X509TrustManager { private NoOpX509TrustManager() { @@ -65,4 +73,39 @@ public X509Certificate[] getAcceptedIssuers() { } } + + private static final class NoOpX509ExtendedTrustManager extends X509ExtendedTrustManager { + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { + } + + @Override + public X509Certificate[] getAcceptedIssuers() { + return null; + } + + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket) + throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket) + throws CertificateException { + } + + @Override + public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine) + throws CertificateException { + } + + @Override + public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine) + throws CertificateException { + } + } } diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java index b93efc56b0b..768250babc2 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java @@ -170,7 +170,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2) } // Create TrustManager instance which trusts all clients and servers - params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); params.setDisableCNCheck(true); } diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java index 3c51d83b16b..5bb02bda4e6 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java @@ -408,7 +408,7 @@ public void testCheckKeyManagersWithCertAlias() throws Exception { assertNotNull("Service is null", service); // Set up (shared) KeyManagers/TrustManagers - TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers(); + TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509ExtendedTrustManagers(); KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java index 9898ed2c94c..82a9ae36bda 100644 --- a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java +++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java @@ -125,7 +125,7 @@ public void testNoOpX509TrustManager() throws Exception { } TLSClientParameters tlsParams = new TLSClientParameters(); - tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); tlsParams.setDisableCNCheck(true); Client client = ClientProxy.getClient(port); diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml index 474245dd328..3aaef1085de 100644 --- a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml +++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml @@ -31,7 +31,7 @@ - + diff --git a/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java b/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java index faac3e1d231..d7717b0c849 100644 --- a/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java +++ b/systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java @@ -117,7 +117,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2) } // Create TrustManager instance which trusts all clients and servers - params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); + params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); params.setDisableCNCheck(true); }