You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by re...@apache.org on 2022/03/19 21:02:22 UTC
[cxf] branch 3.4.x-fixes updated (30f0ea4 -> 479c7cf)
This is an automated email from the ASF dual-hosted git repository.
reta pushed a change to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from 30f0ea4 [CXF-8655] Incorrect XSD resolution when the file name is the same in different folders (#904)
new ba93749 Update Hibernate Validator to 6.2.3.Final
new 730ee78 Update Hibernate to 5.6.7.Final
new 5624bc8 Custom certificate alias not being used when using HC5 AsyncHTTPConduit (#923)
new 479c7cf Recording .gitmergeinfo Changes
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.gitmergeinfo | 6 +
parent/pom.xml | 4 +-
.../http/asyncclient/hc5/AsyncHTTPConduit.java | 66 ++-
.../asyncclient/hc5/AsyncHTTPConduitFactory.java | 122 +++--
systests/transport-hc5/pom.xml | 10 +
.../org/apache/cxf/systest/hc5/GreeterImpl.java | 65 +++
.../hc5/https/clientauth/ClientAuthServer.java | 47 ++
.../hc5/https/clientauth/ClientAuthTest.java | 587 +++++++++++++++++++++
.../HostnameVerificationDeprecatedServer.java | 47 ++
.../HostnameVerificationDeprecatedTest.java | 320 +++++++++++
.../https/hostname/HostnameVerificationServer.java | 47 ++
.../https/hostname/HostnameVerificationTest.java | 369 +++++++++++++
.../systest/hc5/https/trust/TrustManagerTest.java | 474 +++++++++++++++++
.../cxf/systest/hc5/https/trust/TrustServer.java | 47 ++
.../hc5/https/trust/TrustServerNoSpring.java | 84 +++
.../src/test/resources/keymanagers.jks | Bin
.../hc5}/https/clientauth/client-auth-chain.xml | 0
.../hc5}/https/clientauth/client-auth-invalid.xml | 0
.../hc5}/https/clientauth/client-auth-invalid2.xml | 0
.../hc5/https/clientauth/client-auth-server.xml | 80 +++
.../systest/hc5}/https/clientauth/client-auth.xml | 0
.../hc5}/https/clientauth/client-no-auth.xml | 0
.../https/hostname/hostname-client-disablecn.xml | 0
.../https/hostname/hostname-client-usedefault.xml | 0
.../hc5}/https/hostname/hostname-client.xml | 0
.../https/hostname/hostname-server-deprecated.xml | 95 ++++
.../systest/hc5/https/hostname/hostname-server.xml | 137 +++++
.../hc5}/https/trust/client-trust-config.xml | 0
.../hc5}/https/trust/client-trust-empty-config.xml | 0
.../hc5}/https/trust/client-trust-manager-ref.xml | 0
.../cxf/systest/hc5}/https/trust/client-trust.xml | 0
.../cxf/systest/hc5/https/trust/trust-server.xml | 72 +++
32 files changed, 2611 insertions(+), 68 deletions(-)
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/GreeterImpl.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthServer.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedServer.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedTest.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationServer.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationTest.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServer.java
create mode 100644 systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServerNoSpring.java
copy systests/{transports => transport-hc5}/src/test/resources/keymanagers.jks (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/clientauth/client-auth-chain.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/clientauth/client-auth-invalid.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/clientauth/client-auth-invalid2.xml (100%)
create mode 100644 systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/clientauth/client-auth.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/clientauth/client-no-auth.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/hostname/hostname-client-disablecn.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/hostname/hostname-client-usedefault.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/hostname/hostname-client.xml (100%)
create mode 100644 systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server-deprecated.xml
create mode 100644 systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server.xml
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/trust/client-trust-config.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/trust/client-trust-empty-config.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/trust/client-trust-manager-ref.xml (100%)
copy systests/{transports/src/test/resources/org/apache/cxf/systest => transport-hc5/src/test/resources/org/apache/cxf/systest/hc5}/https/trust/client-trust.xml (100%)
create mode 100644 systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/trust-server.xml
[cxf] 03/04: Custom certificate alias not being used when using HC5 AsyncHTTPConduit (#923)
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 5624bc802b30d73fb0e6199c8b13a923f8cc872a
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Sat Mar 19 13:15:57 2022 -0400
Custom certificate alias not being used when using HC5 AsyncHTTPConduit (#923)
(cherry picked from commit be345311ffa68bc5138d7bc56d074534d9c5dd35)
(cherry picked from commit c6c02b90786b6f97c5f600903c2517fd6db50e70)
---
.../http/asyncclient/hc5/AsyncHTTPConduit.java | 66 ++-
.../asyncclient/hc5/AsyncHTTPConduitFactory.java | 122 +++--
systests/transport-hc5/pom.xml | 10 +
.../org/apache/cxf/systest/hc5/GreeterImpl.java | 65 +++
.../hc5/https/clientauth/ClientAuthServer.java | 47 ++
.../hc5/https/clientauth/ClientAuthTest.java | 587 +++++++++++++++++++++
.../HostnameVerificationDeprecatedServer.java | 47 ++
.../HostnameVerificationDeprecatedTest.java | 320 +++++++++++
.../https/hostname/HostnameVerificationServer.java | 47 ++
.../https/hostname/HostnameVerificationTest.java | 369 +++++++++++++
.../systest/hc5/https/trust/TrustManagerTest.java | 474 +++++++++++++++++
.../cxf/systest/hc5/https/trust/TrustServer.java | 47 ++
.../hc5/https/trust/TrustServerNoSpring.java | 84 +++
.../src/test/resources/keymanagers.jks | Bin 0 -> 5385 bytes
.../hc5/https/clientauth/client-auth-chain.xml | 44 ++
.../hc5/https/clientauth/client-auth-invalid.xml | 43 ++
.../hc5/https/clientauth/client-auth-invalid2.xml | 43 ++
.../hc5/https/clientauth/client-auth-server.xml | 80 +++
.../systest/hc5/https/clientauth/client-auth.xml | 44 ++
.../hc5/https/clientauth/client-no-auth.xml | 40 ++
.../https/hostname/hostname-client-disablecn.xml | 41 ++
.../https/hostname/hostname-client-usedefault.xml | 41 ++
.../systest/hc5/https/hostname/hostname-client.xml | 41 ++
.../https/hostname/hostname-server-deprecated.xml | 95 ++++
.../systest/hc5/https/hostname/hostname-server.xml | 137 +++++
.../hc5/https/trust/client-trust-config.xml | 39 ++
.../hc5/https/trust/client-trust-empty-config.xml | 43 ++
.../hc5/https/trust/client-trust-manager-ref.xml | 42 ++
.../cxf/systest/hc5/https/trust/client-trust.xml | 35 ++
.../cxf/systest/hc5/https/trust/trust-server.xml | 72 +++
30 files changed, 3099 insertions(+), 66 deletions(-)
diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java
index d6195c6..3802db7 100644
--- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java
+++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java
@@ -85,7 +85,6 @@ import org.apache.hc.core5.http.Header;
import org.apache.hc.core5.http.HttpHost;
import org.apache.hc.core5.http.HttpResponse;
import org.apache.hc.core5.http.config.Registry;
-import org.apache.hc.core5.http.config.RegistryBuilder;
import org.apache.hc.core5.http.nio.ssl.BasicClientTlsStrategy;
import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
import org.apache.hc.core5.http.protocol.HttpContext;
@@ -115,9 +114,11 @@ public class AsyncHTTPConduit extends URLConnectionHTTPConduit {
this.factory = factory;
}
- public synchronized CloseableHttpAsyncClient getHttpAsyncClient() throws IOException {
+ public synchronized CloseableHttpAsyncClient getHttpAsyncClient(final TlsStrategy tlsStrategy)
+ throws IOException {
+
if (client == null) {
- client = factory.createClient(this);
+ client = factory.createClient(this, tlsStrategy);
}
if (client == null) {
throw new IOException("HttpAsyncClient is null");
@@ -523,9 +524,9 @@ public class AsyncHTTPConduit extends URLConnectionHTTPConduit {
ctx.setCredentialsProvider(credsProvider);
+ TlsStrategy tlsStrategy = null;
if ("https".equals(url.getScheme())) {
try {
- RegistryBuilder<TlsStrategy> regBuilder = RegistryBuilder.<TlsStrategy>create();
// check tlsClientParameters from message header
TLSClientParameters tlsClientParameters = outMessage.get(TLSClientParameters.class);
@@ -538,31 +539,28 @@ public class AsyncHTTPConduit extends URLConnectionHTTPConduit {
final SSLContext sslcontext = getSSLContext(tlsClientParameters);
final HostnameVerifier verifier = org.apache.cxf.transport.https.SSLUtils
.getHostnameVerifier(tlsClientParameters);
- regBuilder
- .register("https",
- new BasicClientTlsStrategy(
- sslcontext,
- new SSLSessionInitializer() {
- @Override
- public void initialize(NamedEndpoint endpoint, SSLEngine engine) {
- initializeSSLEngine(sslcontext, engine);
- }
- },
- new SSLSessionVerifier() {
- @Override
- public TlsDetails verify(NamedEndpoint endpoint, SSLEngine engine)
- throws SSLException {
- final SSLSession sslsession = engine.getSession();
-
- if (!verifier.verify(endpoint.getHostName(), sslsession)) {
- throw new SSLException("Could not verify host " + endpoint.getHostName());
- }
-
- setSSLSession(sslsession);
- return new TlsDetails(sslsession, engine.getApplicationProtocol());
- }
+
+ tlsStrategy = new BasicClientTlsStrategy(sslcontext,
+ new SSLSessionInitializer() {
+ @Override
+ public void initialize(NamedEndpoint endpoint, SSLEngine engine) {
+ initializeSSLEngine(sslcontext, engine);
+ }
+ },
+ new SSLSessionVerifier() {
+ @Override
+ public TlsDetails verify(NamedEndpoint endpoint, SSLEngine engine)
+ throws SSLException {
+ final SSLSession sslsession = engine.getSession();
+
+ if (!verifier.verify(endpoint.getHostName(), sslsession)) {
+ throw new SSLException("Could not verify host " + endpoint.getHostName());
}
- )
+
+ setSSLSession(sslsession);
+ return new TlsDetails(sslsession, engine.getApplicationProtocol());
+ }
+ }
);
} catch (final GeneralSecurityException e) {
LOG.warning(e.getMessage());
@@ -580,7 +578,9 @@ public class AsyncHTTPConduit extends URLConnectionHTTPConduit {
}
connectionFuture = new BasicFuture<>(callback);
- final HttpAsyncClient c = getHttpAsyncClient();
+ // The HttpClientContext is not available in the AsyncClientConnectionOperator, so we have
+ // to provide our own TLS strategy on construction.
+ final HttpAsyncClient c = getHttpAsyncClient(tlsStrategy);
final Credentials creds = (Credentials)outMessage.getContextualProperty(Credentials.class.getName());
if (creds != null) {
credsProvider.setCredentials(new AnyAuthScope(), creds);
@@ -960,6 +960,14 @@ public class AsyncHTTPConduit extends URLConnectionHTTPConduit {
sslengine.setEnabledProtocols(p);
}
}
+
+ @Override
+ public void close() {
+ super.close();
+ if (factory != null) {
+ factory.close(this.getClient());
+ }
+ }
private String[] findProtocols(String p, String[] options) {
List<String> list = new ArrayList<>();
diff --git a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduitFactory.java b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduitFactory.java
index 1594d1a..f660288 100644
--- a/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduitFactory.java
+++ b/rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduitFactory.java
@@ -22,11 +22,14 @@ package org.apache.cxf.transport.http.asyncclient.hc5;
import java.io.IOException;
import java.net.URI;
import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.logging.Logger;
import org.apache.cxf.Bus;
import org.apache.cxf.buslifecycle.BusLifeCycleListener;
import org.apache.cxf.buslifecycle.BusLifeCycleManager;
import org.apache.cxf.common.injection.NoJSR250Annotations;
+import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.common.util.SystemPropertyAction;
import org.apache.cxf.service.model.EndpointInfo;
import org.apache.cxf.transport.http.HTTPConduit;
@@ -47,7 +50,7 @@ import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
import org.apache.hc.core5.http.HttpRequest;
import org.apache.hc.core5.http.HttpResponse;
import org.apache.hc.core5.http.ProtocolException;
-import org.apache.hc.core5.http.config.Registry;
+import org.apache.hc.core5.http.config.Lookup;
import org.apache.hc.core5.http.config.RegistryBuilder;
import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
import org.apache.hc.core5.http.protocol.HttpContext;
@@ -63,7 +66,6 @@ import org.apache.hc.core5.util.Timeout;
*/
@NoJSR250Annotations
public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
-
//TCP related properties
public static final String TCP_NODELAY = "org.apache.cxf.transport.http.async.TCP_NODELAY";
public static final String SO_KEEPALIVE = "org.apache.cxf.transport.http.async.SO_KEEPALIVE";
@@ -84,6 +86,7 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
//CXF specific
public static final String USE_POLICY = "org.apache.cxf.transport.http.async.usePolicy";
+ private static final Logger LOG = LogUtils.getL7dLogger(AsyncHTTPConduitFactory.class);
public enum UseAsyncPolicy {
ALWAYS, ASYNC_ONLY, NEVER;
@@ -109,9 +112,31 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
return ASYNC_ONLY;
}
};
+
+ /**
+ * See please https://issues.apache.org/jira/browse/CXF-8678 and
+ * https://issues.apache.org/jira/browse/HTTPCLIENT-2209, the context propagation
+ * is necessary to remove per-HTTPClientPolicy caching.
+ */
+ private static class AsyncClient {
+ private final PoolingAsyncClientConnectionManager connectionManager;
+ private final CloseableHttpAsyncClient client;
+
+ AsyncClient(PoolingAsyncClientConnectionManager connectionManager, CloseableHttpAsyncClient client) {
+ this.connectionManager = connectionManager;
+ this.client = client;
+ }
+
+ public CloseableHttpAsyncClient getClient() {
+ return client;
+ }
+
+ public PoolingAsyncClientConnectionManager getConnectionManager() {
+ return connectionManager;
+ }
+ }
- private volatile PoolingAsyncClientConnectionManager connectionManager;
- private volatile CloseableHttpAsyncClient client;
+ private volatile Map<HTTPClientPolicy, AsyncClient> clients = new ConcurrentHashMap<>();
private boolean isShutdown;
private UseAsyncPolicy policy;
@@ -147,19 +172,15 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
}
public void update(Map<String, Object> props) {
- if (setProperties(props) && client != null) {
+ if (setProperties(props) && !clients.isEmpty()) {
restartReactor();
}
}
private void restartReactor() {
- CloseableHttpAsyncClient client2 = client;
- resetVars();
- shutdown(client2);
- }
- private synchronized void resetVars() {
- client = null;
- connectionManager = null;
+ final Map<HTTPClientPolicy, AsyncClient> clients2 = clients;
+ clients = new ConcurrentHashMap<>();
+ shutdown(clients2);
}
private boolean setProperties(Map<String, Object> s) {
@@ -178,9 +199,12 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
connectionMaxIdle = getInt(s.get(CONNECTION_MAX_IDLE), connectionMaxIdle);
maxPerRoute = getInt(s.get(MAX_PER_HOST_CONNECTIONS), maxPerRoute);
- if (connectionManager != null) {
- connectionManager.setMaxTotal(maxConnections);
- connectionManager.setDefaultMaxPerRoute(maxPerRoute);
+ if (!clients.isEmpty()) {
+ for (Map.Entry<HTTPClientPolicy, AsyncClient> entry: clients.entrySet()) {
+ final PoolingAsyncClientConnectionManager connectionManager = entry.getValue().getConnectionManager();
+ connectionManager.setMaxTotal(maxConnections);
+ connectionManager.setDefaultMaxPerRoute(maxPerRoute);
+ }
}
//properties that need a restart of the reactor
@@ -254,23 +278,28 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
}
public void shutdown() {
- if (client != null) {
- shutdown(client);
- connectionManager = null;
- client = null;
- }
+ shutdown(clients);
+ clients.clear();
isShutdown = true;
}
+ private static void shutdown(Map<HTTPClientPolicy, AsyncClient> clients) {
+ if (!clients.isEmpty()) {
+ for (Map.Entry<HTTPClientPolicy, AsyncClient> entry: clients.entrySet()) {
+ shutdown(entry.getValue().getClient());
+ entry.getValue().getConnectionManager().close();
+ }
+ }
+ }
+
private static void shutdown(CloseableHttpAsyncClient client) {
try {
client.close();
- } catch (IOException e1) {
- e1.printStackTrace();
+ } catch (IOException ex) {
+ LOG.warning(ex.getMessage());
}
}
-
private void addListener(Bus b) {
BusLifeCycleManager manager = b.getExtension(BusLifeCycleManager.class);
if (manager != null) {
@@ -286,11 +315,17 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
}
}
- public synchronized void setupNIOClient(HTTPClientPolicy clientPolicy) {
+ public synchronized void setupNIOClient(HTTPClientPolicy clientPolicy, final TlsStrategy tlsStrategy) {
+ final AsyncClient client = clients.get(clientPolicy);
+
if (client != null) {
return;
}
-
+
+ clients.computeIfAbsent(clientPolicy, key -> createNIOClient(key, tlsStrategy));
+ }
+
+ private AsyncClient createNIOClient(HTTPClientPolicy clientPolicy, final TlsStrategy tlsStrategy) {
final IOReactorConfig config = IOReactorConfig.custom()
.setIoThreadCount(ioThreadCount)
.setSelectInterval(TimeValue.ofMilliseconds(selectInterval))
@@ -300,12 +335,13 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
.setTcpNoDelay(tcpNoDelay)
.build();
- final Registry<TlsStrategy> tlsStrategy = RegistryBuilder.<TlsStrategy>create()
- .register("https", DefaultClientTlsStrategy.getSystemDefault())
+
+ final Lookup<TlsStrategy> tlsLookupStrategy = RegistryBuilder.<TlsStrategy>create()
+ .register("https", (tlsStrategy != null) ? tlsStrategy : DefaultClientTlsStrategy.getSystemDefault())
.build();
- connectionManager = new PoolingAsyncClientConnectionManager(
- tlsStrategy,
+ final PoolingAsyncClientConnectionManager connectionManager = new PoolingAsyncClientConnectionManager(
+ tlsLookupStrategy,
PoolConcurrencyPolicy.STRICT,
PoolReusePolicy.LIFO,
TimeValue.ofMilliseconds(connectionTTL),
@@ -338,25 +374,29 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
adaptClientBuilder(httpAsyncClientBuilder);
- client = httpAsyncClientBuilder
- .setIOReactorConfig(config)
- .build();
+ final CloseableHttpAsyncClient client = httpAsyncClientBuilder
+ .setIOReactorConfig(config)
+ .build();
+
// Start the client thread
client.start();
//Always start the idle checker thread to validate pending requests and
//use the ConnectionMaxIdle to close the idle connection
new CloseIdleConnectionThread(connectionManager, client).start();
+
+ return new AsyncClient(connectionManager, client);
}
//provide a hook to customize the builder
protected void adaptClientBuilder(HttpAsyncClientBuilder httpAsyncClientBuilder) {
}
- public CloseableHttpAsyncClient createClient(final AsyncHTTPConduit c) throws IOException {
- if (client == null) {
- setupNIOClient(c.getClient());
- }
- return client;
+ public CloseableHttpAsyncClient createClient(final AsyncHTTPConduit c, final TlsStrategy tlsStrategy)
+ throws IOException {
+
+ return clients
+ .computeIfAbsent(c.getClient(), key -> createNIOClient(key, tlsStrategy))
+ .getClient();
}
int getMaxConnections() {
@@ -395,4 +435,12 @@ public class AsyncHTTPConduitFactory implements HTTPConduitFactory {
}
}
}
+
+ public void close(HTTPClientPolicy clientPolicy) {
+ final AsyncClient client = clients.remove(clientPolicy);
+ if (client != null) {
+ shutdown(client.getClient());
+ client.getConnectionManager().close();
+ }
+ }
}
diff --git a/systests/transport-hc5/pom.xml b/systests/transport-hc5/pom.xml
index 60206d7..116dbf3 100644
--- a/systests/transport-hc5/pom.xml
+++ b/systests/transport-hc5/pom.xml
@@ -159,5 +159,15 @@
<artifactId>cglib-nodep</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-beans</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-context</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
</project>
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/GreeterImpl.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/GreeterImpl.java
new file mode 100644
index 0000000..6cbea95
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/GreeterImpl.java
@@ -0,0 +1,65 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5;
+
+import java.util.logging.Logger;
+
+import javax.jws.WebService;
+
+import org.apache.cxf.common.logging.LogUtils;
+import org.apache.hello_world.Greeter;
+
+
+@WebService(serviceName = "SOAPService",
+ endpointInterface = "org.apache.hello_world.Greeter",
+ targetNamespace = "http://apache.org/hello_world")
+public class GreeterImpl implements Greeter {
+
+ private static final Logger LOG =
+ LogUtils.getLogger(GreeterImpl.class,
+ null,
+ GreeterImpl.class.getPackage().getName());
+ private String myName;
+
+ public GreeterImpl() {
+ this("defaultGreeter");
+ }
+
+ public GreeterImpl(String name) {
+ myName = name;
+ }
+
+ public String greetMe(String me) {
+ LOG.info("Executing operation greetMe");
+ LOG.info("Message received: " + me);
+ return "Hello " + me;
+ }
+
+
+ public String sayHi() {
+ LOG.info("Executing operation sayHi");
+ return "Bonjour from " + myName;
+ }
+
+ public void pingMe() {
+ }
+
+
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthServer.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthServer.java
new file mode 100644
index 0000000..3761bd4
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthServer.java
@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.clientauth;
+
+import java.net.URL;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+
+public class ClientAuthServer extends AbstractBusTestServerBase {
+
+ public ClientAuthServer() {
+
+ }
+
+ protected void run() {
+ URL busFile = ClientAuthServer.class.getResource("client-auth-server.xml");
+ Bus busLocal = new SpringBusFactory().createBus(busFile);
+ BusFactory.setDefaultBus(busLocal);
+ setBus(busLocal);
+
+ try {
+ new ClientAuthServer();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ }
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java
new file mode 100644
index 0000000..678b642
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java
@@ -0,0 +1,587 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.clientauth;
+
+import java.io.InputStream;
+import java.net.URL;
+import java.security.KeyStore;
+import java.util.Arrays;
+import java.util.Collection;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.xml.ws.BindingProvider;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.common.classloader.ClassLoaderUtils;
+import org.apache.cxf.configuration.jsse.TLSClientParameters;
+import org.apache.cxf.endpoint.Client;
+import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
+import org.apache.hello_world.Greeter;
+import org.apache.hello_world.services.SOAPService;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * A set of tests for TLS client authentication.
+ */
+@RunWith(value = org.junit.runners.Parameterized.class)
+public class ClientAuthTest extends AbstractBusClientServerTestBase {
+ static final String PORT = allocatePort(ClientAuthServer.class);
+ static final String PORT2 = allocatePort(ClientAuthServer.class, 2);
+
+ final Boolean async;
+
+ public ClientAuthTest(Boolean async) {
+ this.async = async;
+ }
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(ClientAuthServer.class, true)
+ );
+ }
+
+ @Parameters(name = "{0}")
+ public static Collection<Boolean> data() {
+
+ return Arrays.asList(new Boolean[] {Boolean.FALSE, Boolean.TRUE});
+ }
+
+ @AfterClass
+ public static void cleanup() throws Exception {
+ stopAllServers();
+ }
+
+ // Server directly trusts the client cert
+ @org.junit.Test
+ public void testDirectTrust() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Server does not (directly) trust the client cert
+ @org.junit.Test
+ public void testInvalidDirectTrust() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth-invalid.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on an untrusted cert");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Client does not specify a KeyStore, only a TrustStore
+ @org.junit.Test
+ public void testNoClientCert() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-no-auth.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on no trusted cert");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Ignoring this test as it fails when run as part of the test class - testNoClientCert interferes with it
+ // It succeeds when run with testNoClientCert commented out
+ @org.junit.Test
+ @org.junit.Ignore
+ public void testSystemPropertiesWithEmptyKeystoreConfig() throws Exception {
+ try {
+ System.setProperty("javax.net.ssl.keyStore", "keys/Morpit.jks");
+ System.setProperty("javax.net.ssl.keyStorePassword", "password");
+ System.setProperty("javax.net.ssl.keyPassword", "password");
+ System.setProperty("javax.net.ssl.keyStoreType", "JKS");
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-no-auth.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ System.clearProperty("javax.net.ssl.keyStore");
+ System.clearProperty("javax.net.ssl.keyStorePassword");
+ System.clearProperty("javax.net.ssl.keyPassword");
+ System.clearProperty("javax.net.ssl.keyStoreType");
+ }
+ }
+
+ // Server trusts the issuer of the client cert
+ @org.junit.Test
+ public void testChainTrust() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth-chain.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Server does not trust the issuer of the client cert
+ @org.junit.Test
+ public void testInvalidChainTrust() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth-invalid2.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on no trusted cert");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Client does not trust the issuer of the server cert
+ @org.junit.Test
+ public void testClientInvalidCertChain() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth-invalid2.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on no trusted cert");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Client does not directly trust the server cert
+ @org.junit.Test
+ public void testClientInvalidDirectTrust() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = ClientAuthTest.class.getResource("client-auth-invalid.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on no trusted cert");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ @org.junit.Test
+ public void testSSLConnectionUsingJavaAPIs() throws Exception {
+ URL service = new URL("https://localhost:" + PORT);
+ HttpsURLConnection connection = (HttpsURLConnection) service.openConnection();
+
+ connection.setHostnameVerifier(new DisableCNCheckVerifier());
+
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+
+ KeyStore ts = KeyStore.getInstance("JKS");
+ try (InputStream trustStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Truststore.jks", ClientAuthTest.class)) {
+ ts.load(trustStore, "password".toCharArray());
+ }
+
+ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ tmf.init(ts);
+
+ KeyStore ks = KeyStore.getInstance("JKS");
+ try (InputStream keyStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Morpit.jks", ClientAuthTest.class)) {
+ ks.load(keyStore, "password".toCharArray());
+ }
+
+ KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ kmf.init(ks, "password".toCharArray());
+
+ sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new java.security.SecureRandom());
+
+ connection.setSSLSocketFactory(sslContext.getSocketFactory());
+
+ connection.connect();
+
+ connection.disconnect();
+ }
+
+ // https://issues.apache.org/jira/browse/CXF-7763
+ @org.junit.Test
+ public void testCheckKeyManagersWithCertAlias() throws Exception {
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+
+ // Set up (shared) KeyManagers/TrustManagers
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
+
+ KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+
+ try (InputStream inputStream = ClassLoaderUtils.getResourceAsStream("keymanagers.jks", this.getClass())) {
+ KeyStore keyStore = KeyStore.getInstance("JKS");
+ keyStore.load(inputStream, "password".toCharArray());
+
+ kmf.init(keyStore, "password".toCharArray());
+ }
+ KeyManager[] keyManagers = kmf.getKeyManagers();
+
+ // First call to PORT using Morpit
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ tlsParams.setKeyManagers(keyManagers);
+ tlsParams.setCertAlias("morpit");
+ tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setDisableCNCheck(true);
+
+ Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+ ((java.io.Closeable)port).close();
+
+ // Second call to PORT2 using "alice"
+ tlsParams = new TLSClientParameters();
+ tlsParams.setKeyManagers(keyManagers);
+ tlsParams.setCertAlias("alice");
+ tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setDisableCNCheck(true);
+
+ port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ client = ClientProxy.getClient(port);
+ http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+ ((java.io.Closeable)port).close();
+ }
+
+ // Server directly trusts the client cert
+ @org.junit.Test
+ public void testDirectTrustUsingKeyManagers() throws Exception {
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ // Set up KeyManagers/TrustManagers
+ KeyStore ts = KeyStore.getInstance("JKS");
+ try (InputStream trustStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Truststore.jks", ClientAuthTest.class)) {
+ ts.load(trustStore, "password".toCharArray());
+ }
+
+ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ tmf.init(ts);
+
+ KeyStore ks = KeyStore.getInstance("JKS");
+ try (InputStream keyStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Morpit.jks", ClientAuthTest.class)) {
+ ks.load(keyStore, "password".toCharArray());
+ }
+
+ KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ kmf.init(ks, "password".toCharArray());
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ tlsParams.setKeyManagers(kmf.getKeyManagers());
+ tlsParams.setTrustManagers(tmf.getTrustManagers());
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ }
+
+ // Server directly trusts the client cert
+ @org.junit.Test
+ public void testDirectTrustUsingSSLContext() throws Exception {
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ // Set up KeyManagers/TrustManagers
+ KeyStore ts = KeyStore.getInstance("JKS");
+ try (InputStream trustStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Truststore.jks", ClientAuthTest.class)) {
+ ts.load(trustStore, "password".toCharArray());
+ }
+
+ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ tmf.init(ts);
+
+ KeyStore ks = KeyStore.getInstance("JKS");
+ try (InputStream keyStore =
+ ClassLoaderUtils.getResourceAsStream("keys/Morpit.jks", ClientAuthTest.class)) {
+ ks.load(keyStore, "password".toCharArray());
+ }
+
+ KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ kmf.init(ks, "password".toCharArray());
+
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new java.security.SecureRandom());
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ tlsParams.setSslContext(sslContext);
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ // Enable Async
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ }
+
+ private static final class DisableCNCheckVerifier implements HostnameVerifier {
+
+ @Override
+ public boolean verify(String arg0, SSLSession arg1) {
+ return true;
+ }
+
+ };
+
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedServer.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedServer.java
new file mode 100644
index 0000000..f75ae0d
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedServer.java
@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.hostname;
+
+import java.net.URL;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+
+public class HostnameVerificationDeprecatedServer extends AbstractBusTestServerBase {
+
+ public HostnameVerificationDeprecatedServer() {
+
+ }
+
+ protected void run() {
+ URL busFile = HostnameVerificationDeprecatedServer.class.getResource("hostname-server-deprecated.xml");
+ Bus busLocal = new SpringBusFactory().createBus(busFile);
+ BusFactory.setDefaultBus(busLocal);
+ setBus(busLocal);
+
+ try {
+ new HostnameVerificationDeprecatedServer();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ }
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedTest.java
new file mode 100644
index 0000000..92c983c
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationDeprecatedTest.java
@@ -0,0 +1,320 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.hostname;
+
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Collection;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.xml.ws.BindingProvider;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.configuration.jsse.TLSClientParameters;
+import org.apache.cxf.endpoint.Client;
+import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.hello_world.Greeter;
+import org.apache.hello_world.services.SOAPService;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * A test for hostname verification when the Java system property "java.protocol.handler.pkgs" is set to
+ * "com.sun.net.ssl.internal.www.protocol". This means that com.sun.net.ssl.HostnameVerifier is used
+ * instead of the javax version.
+ */
+@RunWith(value = org.junit.runners.Parameterized.class)
+public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerTestBase {
+ static final String PORT = allocatePort(HostnameVerificationDeprecatedServer.class);
+ static final String PORT2 = allocatePort(HostnameVerificationDeprecatedServer.class, 2);
+ static final String PORT3 = allocatePort(HostnameVerificationDeprecatedServer.class, 3);
+
+ private final Boolean async;
+
+ public HostnameVerificationDeprecatedTest(Boolean async) {
+ this.async = async;
+ }
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(HostnameVerificationDeprecatedServer.class, true)
+ );
+ }
+
+ @Parameters(name = "{0}")
+ public static Collection<Boolean> data() {
+
+ return Arrays.asList(new Boolean[] {Boolean.FALSE, Boolean.TRUE});
+ }
+
+ @AfterClass
+ public static void cleanup() throws Exception {
+ System.clearProperty("java.protocol.handler.pkgs");
+ stopAllServers();
+ }
+
+ // Here we expect an exception, as the default hostname verifier contributed by CXF will object to the
+ // fact that the server certificate does not have "CN=localhost".
+ @org.junit.Test
+ public void testLocalhostNotMatching() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationDeprecatedTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on the hostname verification");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are disabling the CN check so it should work OK
+ @org.junit.Test
+ public void testLocalhostNotMatchingDisableCN() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-disablecn.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifier() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+
+ // Note we need this method as well or else it won't work the with the
+ // deprecated HostnameVerifier interface
+ @SuppressWarnings("unused")
+ public boolean verify(final String host, final String certHostname) {
+ return true;
+ }
+ });
+
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-usedefault.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ }
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it. It differs to the method above, that we are not using a Spring configuration file, but
+ // instead are setting a TLSClientParameters on the HTTPConduit
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifierNoConfig() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ System.setProperty("javax.net.ssl.trustStore", "keys/subjalt.jks");
+ System.setProperty("javax.net.ssl.trustStorePassword", "security");
+ System.setProperty("javax.net.ssl.trustStoreType", "JKS");
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+
+ // Note we need this method as well or else it won't work the with the
+ // deprecated HostnameVerifier interface
+ @SuppressWarnings("unused")
+ public boolean verify(final String host, final String certHostname) {
+ return true;
+ }
+ });
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ TLSClientParameters clientParameters = new TLSClientParameters();
+ clientParameters.setUseHttpsURLConnectionDefaultHostnameVerifier(true);
+ Client client = ClientProxy.getClient(port);
+ ((HTTPConduit)client.getConduit()).setTlsClientParameters(clientParameters);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ System.clearProperty("javax.net.ssl.trustStore");
+ System.clearProperty("javax.net.ssl.trustStorePassword");
+ System.clearProperty("javax.net.ssl.trustStoreType");
+ }
+ }
+
+ // No Subject Alternative Name, but the CN matches ("localhost"), so the default HostnameVerifier
+ // should work fine
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationDeprecatedTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, but the CN wildcard matches
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNWildcardMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT3);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationServer.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationServer.java
new file mode 100644
index 0000000..ca23633
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationServer.java
@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.hostname;
+
+import java.net.URL;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+
+public class HostnameVerificationServer extends AbstractBusTestServerBase {
+
+ public HostnameVerificationServer() {
+
+ }
+
+ protected void run() {
+ URL busFile = HostnameVerificationServer.class.getResource("hostname-server.xml");
+ Bus busLocal = new SpringBusFactory().createBus(busFile);
+ BusFactory.setDefaultBus(busLocal);
+ setBus(busLocal);
+
+ try {
+ new HostnameVerificationServer();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ }
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationTest.java
new file mode 100644
index 0000000..5dbe9ba
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/hostname/HostnameVerificationTest.java
@@ -0,0 +1,369 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.hostname;
+
+import java.net.URL;
+import java.util.Arrays;
+import java.util.Collection;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.xml.ws.BindingProvider;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.configuration.jsse.TLSClientParameters;
+import org.apache.cxf.endpoint.Client;
+import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.hello_world.Greeter;
+import org.apache.hello_world.services.SOAPService;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * A set of tests for hostname verification, where the hostname in question is "localhost".
+ *
+ * Keys created via something like:
+ * keytool -genkey -validity 3650 -alias subjalt -keyalg RSA -keystore subjalt.jks
+ * -dname "CN=Colm,OU=WSS4J,O=Apache,L=Dublin,ST=Leinster,C=IE" -ext SAN=DNS:localhost
+ */
+@RunWith(value = org.junit.runners.Parameterized.class)
+public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
+ static final String PORT = allocatePort(HostnameVerificationServer.class);
+ static final String PORT2 = allocatePort(HostnameVerificationServer.class, 2);
+ static final String PORT3 = allocatePort(HostnameVerificationServer.class, 3);
+ static final String PORT4 = allocatePort(HostnameVerificationServer.class, 4);
+ static final String PORT5 = allocatePort(HostnameVerificationServer.class, 5);
+
+ private final Boolean async;
+
+ public HostnameVerificationTest(Boolean async) {
+ this.async = async;
+ }
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(HostnameVerificationServer.class, true)
+ );
+ }
+
+ @Parameters(name = "{0}")
+ public static Collection<Boolean> data() {
+
+ return Arrays.asList(new Boolean[] {Boolean.FALSE, Boolean.TRUE});
+ }
+
+ @AfterClass
+ public static void cleanup() throws Exception {
+ stopAllServers();
+ }
+
+ // Subject Alternative Name matches (but not the CN)
+ @org.junit.Test
+ public void testSubjectAlternativeNameMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Subject Alternative Name does not match (but the CN does - still an error)
+ @org.junit.Test
+ public void testSubjectAlternativeNameNoMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on a non-matching subject alternative name");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, but the CN matches
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT3);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, no matching CN
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected with no matching Subject Alt Name or CN");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are disabling the CN check so it should work OK
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDisableCN() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-disablecn.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifier() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+ });
+
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-usedefault.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ }
+ }
+
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it. It differs to the method above, that we are not using a Spring configuration file, but
+ // instead are setting a TLSClientParameters on the HTTPConduit
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifierNoConfig() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ System.setProperty("javax.net.ssl.trustStore", "keys/subjalt.jks");
+ System.setProperty("javax.net.ssl.trustStorePassword", "security");
+ System.setProperty("javax.net.ssl.trustStoreType", "JKS");
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+ });
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ TLSClientParameters clientParameters = new TLSClientParameters();
+ clientParameters.setUseHttpsURLConnectionDefaultHostnameVerifier(true);
+ Client client = ClientProxy.getClient(port);
+ ((HTTPConduit)client.getConduit()).setTlsClientParameters(clientParameters);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ System.clearProperty("javax.net.ssl.trustStore");
+ System.clearProperty("javax.net.ssl.trustStorePassword");
+ System.clearProperty("javax.net.ssl.trustStoreType");
+ }
+ }
+
+ // No Subject Alternative Name, but the CN wildcard matches
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNWildcardMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT5);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java
new file mode 100644
index 0000000..bedade5
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java
@@ -0,0 +1,474 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.trust;
+
+import java.io.InputStream;
+import java.net.URL;
+import java.security.KeyStore;
+import java.security.Security;
+import java.security.cert.CertificateException;
+import java.security.cert.PKIXBuilderParameters;
+import java.security.cert.X509CertSelector;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Collection;
+
+import javax.net.ssl.CertPathTrustManagerParameters;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+import javax.xml.ws.BindingProvider;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.common.classloader.ClassLoaderUtils;
+import org.apache.cxf.configuration.jsse.TLSClientParameters;
+import org.apache.cxf.endpoint.Client;
+import org.apache.cxf.frontend.ClientProxy;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
+import org.apache.hello_world.Greeter;
+import org.apache.hello_world.services.SOAPService;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+/**
+ * A set of tests for specifying a TrustManager
+ */
+@RunWith(value = org.junit.runners.Parameterized.class)
+public class TrustManagerTest extends AbstractBusClientServerTestBase {
+ static final String PORT = allocatePort(TrustServer.class);
+ static final String PORT2 = allocatePort(TrustServer.class, 2);
+ static final String PORT3 = allocatePort(TrustServer.class, 3);
+
+ private final Boolean async;
+
+ public TrustManagerTest(Boolean async) {
+ this.async = async;
+ }
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(TrustServer.class, true)
+ );
+ assertTrue(
+ "Server failed to launch",
+ // run the server in the same process
+ // set this to false to fork
+ launchServer(TrustServerNoSpring.class, true)
+ );
+ }
+
+ @Parameters(name = "{0}")
+ public static Collection<Boolean> data() {
+
+ return Arrays.asList(new Boolean[] {Boolean.FALSE, Boolean.TRUE});
+ }
+
+ @AfterClass
+ public static void cleanup() throws Exception {
+ stopAllServers();
+ }
+
+ // The X509TrustManager is effectively empty here so trust verification should work
+ @org.junit.Test
+ public void testNoOpX509TrustManager() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // The X509TrustManager is effectively empty here so trust verification should work
+ @org.junit.Test
+ public void testNoOpX509TrustManagerTrustManagersRef() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust-manager-ref.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Here the Trust Manager checks the server cert
+ @org.junit.Test
+ public void testValidServerCertX509TrustManager() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ String validPrincipalName = "CN=Bethal,OU=Bethal,O=ApacheTest,L=Syracuse,C=US";
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ X509TrustManager trustManager =
+ new ServerCertX509TrustManager(validPrincipalName);
+ TrustManager[] trustManagers = new TrustManager[1];
+ trustManagers[0] = trustManager;
+ tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ // Here we're using spring config but getting the truststore from the standard system properties
+ @org.junit.Test
+ public void testSystemPropertiesWithEmptyTLSClientParametersConfig() throws Exception {
+ try {
+ System.setProperty("javax.net.ssl.trustStore", "keys/Bethal.jks");
+ System.setProperty("javax.net.ssl.trustStorePassword", "password");
+ System.setProperty("javax.net.ssl.trustStoreType", "JKS");
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust-config.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ System.clearProperty("javax.net.ssl.trustStore");
+ System.clearProperty("javax.net.ssl.trustStorePassword");
+ System.clearProperty("javax.net.ssl.trustStoreType");
+ }
+ }
+
+ // Here we're using spring config but getting the truststore from the standard system properties
+ @org.junit.Test
+ public void testSystemPropertiesWithEmptyKeystoreConfig() throws Exception {
+ try {
+ System.setProperty("javax.net.ssl.trustStore", "keys/Bethal.jks");
+ System.setProperty("javax.net.ssl.trustStorePassword", "password");
+ System.setProperty("javax.net.ssl.trustStoreType", "JKS");
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust-empty-config.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ System.clearProperty("javax.net.ssl.trustStore");
+ System.clearProperty("javax.net.ssl.trustStorePassword");
+ System.clearProperty("javax.net.ssl.trustStoreType");
+ }
+ }
+
+ // Here the Trust Manager checks the server cert. this time we are invoking on the
+ // service that is configured in code (not by spring)
+ @org.junit.Test
+ public void testValidServerCertX509TrustManager2() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT3);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ String validPrincipalName = "CN=Bethal,OU=Bethal,O=ApacheTest,L=Syracuse,C=US";
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ X509TrustManager trustManager =
+ new ServerCertX509TrustManager(validPrincipalName);
+ TrustManager[] trustManagers = new TrustManager[1];
+ trustManagers[0] = trustManager;
+ tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ @org.junit.Test
+ public void testInvalidServerCertX509TrustManager() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ String invalidPrincipalName = "CN=Bethal2,OU=Bethal,O=ApacheTest,L=Syracuse,C=US";
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ X509TrustManager trustManager =
+ new ServerCertX509TrustManager(invalidPrincipalName);
+ TrustManager[] trustManagers = new TrustManager[1];
+ trustManagers[0] = trustManager;
+ tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on an invalid principal name");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ @org.junit.Test
+ public void testOSCPOverride() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT2);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ // Read truststore
+ KeyStore ts = KeyStore.getInstance("JKS");
+ try (InputStream trustStore =
+ ClassLoaderUtils.getResourceAsStream("keys/cxfca.jks", TrustManagerTest.class)) {
+ ts.load(trustStore, "password".toCharArray());
+ }
+
+ try {
+ Security.setProperty("ocsp.enable", "true");
+
+ PKIXBuilderParameters param = new PKIXBuilderParameters(ts, new X509CertSelector());
+ param.setRevocationEnabled(true);
+
+ TrustManagerFactory tmf =
+ TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+ tmf.init(new CertPathTrustManagerParameters(param));
+
+ TLSClientParameters tlsParams = new TLSClientParameters();
+ tlsParams.setTrustManagers(tmf.getTrustManagers());
+ tlsParams.setDisableCNCheck(true);
+
+ Client client = ClientProxy.getClient(port);
+ HTTPConduit http = (HTTPConduit) client.getConduit();
+ http.setTlsClientParameters(tlsParams);
+
+ try {
+ port.greetMe("Kitty");
+ fail("Failure expected on an invalid OCSP responder URL");
+ } catch (Exception ex) {
+ // expected
+ }
+
+ } finally {
+ Security.setProperty("ocsp.enable", "false");
+ }
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
+ public static class ServerCertX509TrustManager implements X509TrustManager {
+
+ private String requiredServerPrincipalName;
+
+ public ServerCertX509TrustManager(String principalName) {
+ requiredServerPrincipalName = principalName;
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+ if (chain == null || chain.length == 0) {
+ throw new CertificateException("X509 Certificate chain is empty");
+ }
+ X509Certificate serverCert = chain[0];
+ if (requiredServerPrincipalName != null
+ && !requiredServerPrincipalName.equals(serverCert.getSubjectX500Principal().getName())) {
+ throw new CertificateException("X509 server certificate does not match requirement");
+ }
+
+ }
+
+ @Override
+ public X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
+
+ }
+
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServer.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServer.java
new file mode 100644
index 0000000..fd0b32a
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServer.java
@@ -0,0 +1,47 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.trust;
+
+import java.net.URL;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.bus.spring.SpringBusFactory;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+
+public class TrustServer extends AbstractBusTestServerBase {
+
+ public TrustServer() {
+
+ }
+
+ protected void run() {
+ URL busFile = TrustServer.class.getResource("trust-server.xml");
+ Bus busLocal = new SpringBusFactory().createBus(busFile);
+ BusFactory.setDefaultBus(busLocal);
+ setBus(busLocal);
+
+ try {
+ new TrustServer();
+ } catch (Exception e) {
+ e.printStackTrace();
+ }
+ }
+}
diff --git a/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServerNoSpring.java b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServerNoSpring.java
new file mode 100644
index 0000000..c6e34a3
--- /dev/null
+++ b/systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustServerNoSpring.java
@@ -0,0 +1,84 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.hc5.https.trust;
+
+import java.security.KeyStore;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.net.ssl.KeyManagerFactory;
+import javax.xml.ws.Endpoint;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.BusFactory;
+import org.apache.cxf.common.classloader.ClassLoaderUtils;
+import org.apache.cxf.configuration.jsse.TLSServerParameters;
+import org.apache.cxf.configuration.security.ClientAuthentication;
+import org.apache.cxf.systest.hc5.GreeterImpl;
+import org.apache.cxf.testutil.common.AbstractBusTestServerBase;
+import org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory;
+
+public class TrustServerNoSpring extends AbstractBusTestServerBase {
+
+ public TrustServerNoSpring() {
+
+ }
+
+ protected void run() {
+ Bus busLocal = BusFactory.getDefaultBus(true);
+ setBus(busLocal);
+
+ String address = "https://localhost:" + TrustManagerTest.PORT3 + "/SoapContext/HttpsPort";
+
+ try {
+ KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+ keyStore.load(ClassLoaderUtils.getResourceAsStream("keys/Bethal.jks",
+ this.getClass()),
+ "password".toCharArray());
+
+ KeyManagerFactory kmf =
+ KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+ kmf.init(keyStore, "password".toCharArray());
+
+ TLSServerParameters tlsParams = new TLSServerParameters();
+ tlsParams.setKeyManagers(kmf.getKeyManagers());
+
+ ClientAuthentication clientAuthentication = new ClientAuthentication();
+ clientAuthentication.setRequired(false);
+ clientAuthentication.setWant(true);
+ tlsParams.setClientAuthentication(clientAuthentication);
+
+ Map<String, TLSServerParameters> map = new HashMap<>();
+ map.put("tlsId", tlsParams);
+
+ JettyHTTPServerEngineFactory factory =
+ busLocal.getExtension(JettyHTTPServerEngineFactory.class);
+ factory.setTlsServerParametersMap(map);
+ factory.createJettyHTTPServerEngine("localhost", Integer.parseInt(TrustManagerTest.PORT3),
+ "https", "tlsId");
+
+ factory.initComplete();
+ } catch (Exception ex) {
+ ex.printStackTrace();
+ }
+
+ Endpoint.publish(address, new GreeterImpl());
+ }
+}
diff --git a/systests/transport-hc5/src/test/resources/keymanagers.jks b/systests/transport-hc5/src/test/resources/keymanagers.jks
new file mode 100644
index 0000000..cdfbeba
Binary files /dev/null and b/systests/transport-hc5/src/test/resources/keymanagers.jks differ
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-chain.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-chain.xml
new file mode 100644
index 0000000..857eb1a
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-chain.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/alice.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/cxfca.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid.xml
new file mode 100644
index 0000000..6de6bfb
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/alice.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid2.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid2.xml
new file mode 100644
index 0000000..1aca21e
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-invalid2.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/Morpit.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/cxfca.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml
new file mode 100644
index 0000000..af5a90f
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth-server.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/policy http://cxf.apache.org/schemas/policy.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/confi [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <httpj:engine-factory id="direct-trust-tls-settings">
+ <httpj:engine port="${testutil.ports.ClientAuthServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/Bethal.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="DirectTrustServer"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.ClientAuthServer}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="direct-trust-tls-settings"/>
+
+ <httpj:engine-factory id="chain-trust-tls-settings">
+ <httpj:engine port="${testutil.ports.ClientAuthServer.2}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/bob.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/cxfca.jks"/>
+ </sec:trustManagers>
+ <sec:clientAuthentication want="true" required="true"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="ChainTrustServer"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.ClientAuthServer.2}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="chain-trust-tls-settings"/>
+
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth.xml
new file mode 100644
index 0000000..a99d49e
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-auth.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/Morpit.jks"/>
+ </sec:keyManagers>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-no-auth.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-no-auth.xml
new file mode 100644
index 0000000..05ac868
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/clientauth/client-no-auth.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="password" resource="keys/Truststore.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-disablecn.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-disablecn.xml
new file mode 100644
index 0000000..bc640e3
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-disablecn.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-usedefault.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-usedefault.xml
new file mode 100644
index 0000000..97442d8
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client-usedefault.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters useHttpsURLConnectionDefaultHostnameVerifier="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client.xml
new file mode 100644
index 0000000..2dc090f
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-client.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters>
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server-deprecated.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server-deprecated.xml
new file mode 100644
index 0000000..2dc2675
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server-deprecated.xml
@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/policy http://cxf.apache.org/schemas/policy.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/confi [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <httpj:engine-factory id="non-localhost-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationDeprecatedServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnnomatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NonLocalhostMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationDeprecatedServer}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="non-localhost-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-cn-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationDeprecatedServer.2}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationDeprecatedServer.2}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-cn-wildcard-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationDeprecatedServer.3}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatchwildcard</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNWildcardMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationDeprecatedServer.3}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-wildcard-match-settings"/>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server.xml
new file mode 100644
index 0000000..a495e9e
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/hostname/hostname-server.xml
@@ -0,0 +1,137 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/policy http://cxf.apache.org/schemas/policy.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/confi [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <httpj:engine-factory id="subject-alt-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>subjaltmatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="SubjectAltMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="subject-alt-match-settings"/>
+
+
+ <httpj:engine-factory id="subject-alt-nomatch-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer.2}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>subjaltnomatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="SubjectAltNoMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer.2}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="subject-alt-nomatch-settings"/>
+
+
+ <httpj:engine-factory id="no-subject-alt-cn-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer.3}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer.3}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-no-cn-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer.4}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnnomatch</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltNoCNMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer.4}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-no-cn-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-cn-wildcard-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer.5}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatchwildcard</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNWildcardMatch"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer.5}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-wildcard-match-settings"/>
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-config.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-config.xml
new file mode 100644
index 0000000..2bab3c9
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-config.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true" />
+ </http:conduit>
+
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-empty-config.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-empty-config.xml
new file mode 100644
index 0000000..d03df98
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-empty-config.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml
new file mode 100644
index 0000000..47803c1
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml
@@ -0,0 +1,42 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <bean id="trustManagers" class="org.apache.cxf.transport.https.InsecureTrustManager" factory-method="getNoOpX509TrustManagers"/>
+
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers ref="trustManagers" />
+ </http:tlsClientParameters>
+ </http:conduit>
+
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust.xml
new file mode 100644
index 0000000..9e1885b
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+</beans>
\ No newline at end of file
diff --git a/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/trust-server.xml b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/trust-server.xml
new file mode 100644
index 0000000..38ee8bd
--- /dev/null
+++ b/systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/trust-server.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/policy http://cxf.apache.org/schemas/policy.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/confi [...]
+ <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <httpj:engine-factory id="tls-settings">
+ <httpj:engine port="${testutil.ports.TrustServer}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/Bethal.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ <httpj:engine port="${testutil.ports.TrustServer.2}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="password">
+ <sec:keyStore type="jks" password="password" resource="keys/alice.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="TrustServer"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.TrustServer}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="tls-settings"/>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="TrustServer2"
+ implementor="org.apache.cxf.systest.hc5.GreeterImpl"
+ address="https://localhost:${testutil.ports.TrustServer.2}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="tls-settings"/>
+
+
+</beans>
\ No newline at end of file
[cxf] 02/04: Update Hibernate to 5.6.7.Final
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 730ee787c85debe33f214cce808c17082d459adc
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Fri Mar 18 17:53:19 2022 -0400
Update Hibernate to 5.6.7.Final
(cherry picked from commit f7266bfc57de4c32a32402c69e022513222e6b98)
(cherry picked from commit 6ebc028394e00285194405c60cfdf27928e85317)
# Conflicts:
# parent/pom.xml
---
parent/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index ab75c44..907b5a2 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -122,7 +122,7 @@
<cxf.guava.version>30.1-jre</cxf.guava.version>
<cxf.hamcrest.version>2.2</cxf.hamcrest.version>
<cxf.hazelcast.version>3.12.9</cxf.hazelcast.version>
- <cxf.hibernate.em.version>5.6.5.Final</cxf.hibernate.em.version>
+ <cxf.hibernate.em.version>5.6.7.Final</cxf.hibernate.em.version>
<cxf.hibernate.validator.version>6.2.3.Final</cxf.hibernate.validator.version>
<cxf.hsqldb.version>2.5.0</cxf.hsqldb.version>
<cxf.httpcomponents.asyncclient.version.range>[4.0,4.2)</cxf.httpcomponents.asyncclient.version.range>
[cxf] 01/04: Update Hibernate Validator to 6.2.3.Final
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit ba93749103c4128bc9a9b46aa8ffc216f0338755
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Thu Mar 17 15:33:58 2022 -0400
Update Hibernate Validator to 6.2.3.Final
(cherry picked from commit e62fc9ca089c3dc3bb1ef837167afb87a79267d8)
(cherry picked from commit 8128e9e88a1d644b44606839ff7ea542ef028d47)
# Conflicts:
# parent/pom.xml
---
parent/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/parent/pom.xml b/parent/pom.xml
index f37d739..ab75c44 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -123,7 +123,7 @@
<cxf.hamcrest.version>2.2</cxf.hamcrest.version>
<cxf.hazelcast.version>3.12.9</cxf.hazelcast.version>
<cxf.hibernate.em.version>5.6.5.Final</cxf.hibernate.em.version>
- <cxf.hibernate.validator.version>6.2.1.Final</cxf.hibernate.validator.version>
+ <cxf.hibernate.validator.version>6.2.3.Final</cxf.hibernate.validator.version>
<cxf.hsqldb.version>2.5.0</cxf.hsqldb.version>
<cxf.httpcomponents.asyncclient.version.range>[4.0,4.2)</cxf.httpcomponents.asyncclient.version.range>
<cxf.httpcomponents.asyncclient.version>4.1.5</cxf.httpcomponents.asyncclient.version>
[cxf] 04/04: Recording .gitmergeinfo Changes
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 3.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 479c7cf9c9bbef8ec828edd12fe0b7c773b9c2ac
Author: Andriy Redko <dr...@gmail.com>
AuthorDate: Sat Mar 19 16:48:36 2022 -0400
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index 9d14753..2b9f49d 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -129,6 +129,7 @@ M 0320ad320ba88a123a5296a8060d3ac1794009f6
M 049ed3c49a05f9997111afd66ba583dc2b4630f2
M 04c73ab64486b3806c3cc78d5196d2c52280ca89
M 0903bdd2f5f91de71425dedde8c5d7fbf44d297f
+M 0b137e22f2213a06b5325a0ef9d52b8a94829161
M 0c609dc1e242e4156ad55e10fa0699636da02ee9
M 0dad051a0f126b1e365f83dfe1e4647a36e163f9
M 0dda1ec488fa7187c26913d7190430bccd108bc3
@@ -161,6 +162,7 @@ M 2cd495719e7532657f7e8cad5b5347cedccd2de8
M 2dc9d11171f4f67b6fcd907427f2fbd341a9fdd4
M 2f844e251362ab62923cfc6b7061591375a1cb44
M 2ffd54661533e8a0f0ca221d1a903a23d44133a9
+M 327e0d2a1605f05a25ac491e5d1775d00f018d22
M 32d40493c0db97c4d207e99da5b8c491fc04eedd
M 33ecef385c10f1a3351103a01b591bd1fafb46f6
M 370f0926a5c3b092f987438109ab39db9fcae0a8
@@ -225,6 +227,7 @@ M 6b0c020e28c150d5913ec047c900d63bcc548f3f
M 6bce68f2019b17952069b1b516647f06fe81fea1
M 6d136a2635f0fe160bff6be1dcb8e52954dcbac3
M 6e645cb9a671c43bf61c2dd26b1363a96e94885d
+M 6ebc028394e00285194405c60cfdf27928e85317
M 700cf3929763d551d9fac6c570c2560039c6238c
M 70c7d6a1e3f23522609d58b72b61c52e3cbc919a
M 72abe7416755fcba5943a64299d5e687661cb4c1
@@ -237,6 +240,7 @@ M 79f8c812ec3e61d5702adb5ec54f5aecb7e04a8e
M 7a05e4fb0b67a89b86ed6eee68b9416005d6f631
M 7c15ae9596cf879bb4e8089816c3deffcd309c76
M 80bfaa1fbb9302ca257db211b36c3f0622356d56
+M 8128e9e88a1d644b44606839ff7ea542ef028d47
M 814a5de1e3dd84b621f239c73c56b3ac5ff32cf1
M 81d82da19ed43bbeaae12a7eda052a64890ec970
M 8231ba3d86cb225738453d51c5a4ee7781e08f62
@@ -273,6 +277,7 @@ M 9df9b22a4032b19ea953600ebdfa84e8c15d2370
M 9e116cb0dd283d5c2d3750ef6643a0716266b495
M 9ead0c6d83fad73ad3c3098e17ee0cffb2008184
M 9f939eefbd41ee5c0e88b41c2e177fdbc5cbdd26
+M a2a48bd789e66ffae82d35d156d02e58fbb4bb2b
M a2fc449969afa082065b1be644a3af890abcc1db
M a3a49c7ee82f83bc683b898594d5c4948578f25a
M a5699a05bd53de364ac3282fc6a4927ee93e0afc
@@ -282,6 +287,7 @@ M a894689ac803c234bf38a59f7d845aec4f4d70e0
M ac656dd13ac54b83aeb0c877e01dfb277d38ca96
M ad194637ee3dd22f445e34b6db72d314ee650d79
M ade1129cd94291f7fbd12cb536bc9367b19bb870
+M b2db8d9808e3bbd7c3440935e0542577fddb30e3
M b31779839e148b756d31ffac3886e291a03ef5f5
M b5c6ed22d517c217f178b4403ad367e5a3bab1bf
M b683d4ee1194d8efeae8bef4050bf34abf82501e