You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by ro...@apache.org on 2015/04/10 18:01:13 UTC
[2/4] qpid-jms git commit: QPIDJMS-38: use the default protocols
unless particular protocols are configured,
disabling legacy protocols by default in either case
QPIDJMS-38: use the default protocols unless particular protocols are configured, disabling legacy protocols by default in either case
Project: http://git-wip-us.apache.org/repos/asf/qpid-jms/repo
Commit: http://git-wip-us.apache.org/repos/asf/qpid-jms/commit/6e3b7038
Tree: http://git-wip-us.apache.org/repos/asf/qpid-jms/tree/6e3b7038
Diff: http://git-wip-us.apache.org/repos/asf/qpid-jms/diff/6e3b7038
Branch: refs/heads/master
Commit: 6e3b703865e7e463de3fa1b7e2ef624f986d7ecd
Parents: 35bf0a2
Author: Robert Gemmell <ro...@apache.org>
Authored: Fri Apr 10 15:14:54 2015 +0100
Committer: Robert Gemmell <ro...@apache.org>
Committed: Fri Apr 10 16:51:52 2015 +0100
----------------------------------------------------------------------
.../jms/transports/TransportSslOptions.java | 32 +++++-
.../qpid/jms/transports/TransportSupport.java | 30 ++++-
.../jms/transports/TransportSslOptionsTest.java | 5 +
.../jms/transports/TransportSupportTest.java | 111 ++++++++++++++++---
.../netty/NettySslTransportFactoryTest.java | 7 +-
.../transports/netty/NettySslTransportTest.java | 4 -
6 files changed, 159 insertions(+), 30 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSslOptions.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSslOptions.java b/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSslOptions.java
index c88e421..1de27f3 100644
--- a/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSslOptions.java
+++ b/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSslOptions.java
@@ -16,6 +16,10 @@
*/
package org.apache.qpid.jms.transports;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
/**
* Holds the defined SSL options for connections that operate over a secure
@@ -24,10 +28,10 @@ package org.apache.qpid.jms.transports;
*/
public class TransportSslOptions extends TransportOptions {
- public static final String[] DEFAULT_ENABLED_PROTOCOLS = {"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"};
public static final String DEFAULT_STORE_TYPE = "jks";
public static final boolean DEFAULT_TRUST_ALL = false;
public static final boolean DEFAULT_VERIFY_HOST = true;
+ public static final List<String> DEFAULT_DISABLED_PROTOCOLS = Collections.unmodifiableList(Arrays.asList(new String[]{"SSLv2Hello", "SSLv3"}));
public static final TransportSslOptions INSTANCE = new TransportSslOptions();
@@ -37,7 +41,8 @@ public class TransportSslOptions extends TransportOptions {
private String trustStorePassword;
private String storeType = DEFAULT_STORE_TYPE;
private String[] enabledCipherSuites;
- private String[] enabledProtocols = DEFAULT_ENABLED_PROTOCOLS;
+ private String[] enabledProtocols;
+ private String[] disabledProtocols = DEFAULT_DISABLED_PROTOCOLS.toArray(new String[0]);
private boolean trustAll = DEFAULT_TRUST_ALL;
private boolean verifyHost = DEFAULT_VERIFY_HOST;
@@ -139,20 +144,39 @@ public class TransportSslOptions extends TransportOptions {
}
/**
- * @return the enabledProtocols
+ * @return the enabledProtocols or null if the defaults should be used
*/
public String[] getEnabledProtocols() {
return enabledProtocols;
}
/**
- * @param enabledProtocols the enabledProtocols to set
+ * The protocols to be set as enabled.
+ *
+ * @param enabledProtocols the enabled protocols to set, or null if the defaults should be used.
*/
public void setEnabledProtocols(String[] enabledProtocols) {
this.enabledProtocols = enabledProtocols;
}
/**
+ *
+ * @return the protocols to disable or null if none should be
+ */
+ public String[] getDisabledProtocols() {
+ return disabledProtocols;
+ }
+
+ /**
+ * The protocols to be disable.
+ *
+ * @param disabledProtocols the protocols to disable, or null if none should be.
+ */
+ public void setDisabledProtocols(String[] disabledProtocols) {
+ this.disabledProtocols = disabledProtocols;
+ }
+
+ /**
* @return the trustAll
*/
public boolean isTrustAll() {
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSupport.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSupport.java b/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSupport.java
index 3c83d51..3b4323f 100644
--- a/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSupport.java
+++ b/qpid-jms-client/src/main/java/org/apache/qpid/jms/transports/TransportSupport.java
@@ -26,6 +26,9 @@ import java.security.KeyStore;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
@@ -127,7 +130,7 @@ public class TransportSupport {
engine = context.createSSLEngine(remote.getHost(), remote.getPort());
}
- engine.setEnabledProtocols(options.getEnabledProtocols());
+ engine.setEnabledProtocols(buildEnabledProtocols(engine, options));
engine.setUseClientMode(true);
if (options.isVerifyHost()) {
@@ -139,6 +142,31 @@ public class TransportSupport {
return engine;
}
+ private static String[] buildEnabledProtocols(SSLEngine engine, TransportSslOptions options) {
+ List<String> enabledProtocols = new ArrayList<String>();
+
+ if (options.getEnabledProtocols() != null) {
+ List<String> configuredProtocols = Arrays.asList(options.getEnabledProtocols());
+ LOG.trace("Configured protocols from transport options: {}", configuredProtocols);
+ enabledProtocols.addAll(configuredProtocols);
+ } else {
+ List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
+ LOG.trace("Default protocols from the SSLEngine: {}", engineProtocols);
+ enabledProtocols.addAll(engineProtocols);
+ }
+
+ String[] disabledProtocols = options.getDisabledProtocols();
+ if (disabledProtocols != null) {
+ List<String> disabled = Arrays.asList(disabledProtocols);
+ LOG.trace("Disabled protocols: {}", disabled);
+ enabledProtocols.removeAll(disabled);
+ }
+
+ LOG.trace("Enabled protocols: {}", enabledProtocols);
+
+ return enabledProtocols.toArray(new String[0]);
+ }
+
private static TrustManager[] loadTrustManagers(TransportSslOptions options) throws Exception {
if (options.isTrustAll()) {
return new TrustManager[] { createTrustAllTrustManager() };
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSslOptionsTest.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSslOptionsTest.java b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSslOptionsTest.java
index 828cfac..fac3d09 100644
--- a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSslOptionsTest.java
+++ b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSslOptionsTest.java
@@ -17,6 +17,7 @@
package org.apache.qpid.jms.transports;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertArrayEquals;
import static org.junit.Assert.assertNull;
import org.apache.qpid.jms.test.QpidJmsTestCase;
@@ -51,6 +52,10 @@ public class TransportSslOptionsTest extends QpidJmsTestCase {
assertEquals(TransportSslOptions.DEFAULT_TRUST_ALL, options.isTrustAll());
assertEquals(TransportSslOptions.DEFAULT_STORE_TYPE, options.getStoreType());
+ assertNull(options.getEnabledProtocols());
+ assertArrayEquals(TransportSslOptions.DEFAULT_DISABLED_PROTOCOLS.toArray(new String[0]),
+ options.getDisabledProtocols());
+
assertNull(options.getKeyStoreLocation());
assertNull(options.getKeyStorePassword());
assertNull(options.getTrustStoreLocation());
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSupportTest.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSupportTest.java b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSupportTest.java
index 0eeae88..6b641e8 100644
--- a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSupportTest.java
+++ b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/TransportSupportTest.java
@@ -16,11 +16,11 @@
*/
package org.apache.qpid.jms.transports;
-import static org.hamcrest.collection.IsIterableContainingInAnyOrder.containsInAnyOrder;
+import static org.junit.Assert.assertArrayEquals;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertThat;
import java.io.IOException;
import java.security.UnrecoverableKeyException;
@@ -59,6 +59,23 @@ public class TransportSupportTest extends QpidJmsTestCase {
public static final String KEYSTORE_JCEKS_TYPE = "jceks";
public static final String KEYSTORE_PKCS12_TYPE = "pkcs12";
+ public static final String[] ENABLED_PROTOCOLS = new String[] { "TLSv1" };
+
+ @Test
+ public void testLegacySslProtocolsDisabledByDefault() throws Exception {
+ TransportSslOptions options = createJksSslOptions(null);
+
+ SSLContext context = TransportSupport.createSslContext(options);
+ assertNotNull(context);
+
+ SSLEngine engine = TransportSupport.createSslEngine(context, options);
+ assertNotNull(engine);
+
+ List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
+ assertFalse("SSLv3 should not be enabled by default", engineProtocols.contains("SSLv3"));
+ assertFalse("SSLv2Hello should not be enabled by default", engineProtocols.contains("SSLv2Hello"));
+ }
+
@Test
public void testCreateSslContextJksStore() throws Exception {
TransportSslOptions options = createJksSslOptions();
@@ -132,6 +149,33 @@ public class TransportSupportTest extends QpidJmsTestCase {
}
@Test
+ public void testCreateSslEngineFromPkcs12Store() throws Exception {
+ TransportSslOptions options = createPkcs12SslOptions();
+
+ SSLContext context = TransportSupport.createSslContext(options);
+ assertNotNull(context);
+
+ SSLEngine engine = TransportSupport.createSslEngine(context, options);
+ assertNotNull(engine);
+
+ List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
+ assertFalse(engineProtocols.isEmpty());
+ }
+
+ @Test
+ public void testCreateSslEngineFromPkcs12StoreWithExplicitEnabledProtocols() throws Exception {
+ TransportSslOptions options = createPkcs12SslOptions(ENABLED_PROTOCOLS);
+
+ SSLContext context = TransportSupport.createSslContext(options);
+ assertNotNull(context);
+
+ SSLEngine engine = TransportSupport.createSslEngine(context, options);
+ assertNotNull(engine);
+
+ assertArrayEquals("Enabled protocols not as expected", ENABLED_PROTOCOLS, engine.getEnabledProtocols());
+ }
+
+ @Test
public void testCreateSslEngineFromJksStore() throws Exception {
TransportSslOptions options = createJksSslOptions();
@@ -142,13 +186,24 @@ public class TransportSupportTest extends QpidJmsTestCase {
assertNotNull(engine);
List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
- List<String> defaultProtocols = Arrays.asList(TransportSslOptions.DEFAULT_ENABLED_PROTOCOLS);
+ assertFalse(engineProtocols.isEmpty());
+ }
+
+ @Test
+ public void testCreateSslEngineFromJksStoreWithExplicitEnabledProtocols() throws Exception {
+ TransportSslOptions options = createJksSslOptions(ENABLED_PROTOCOLS);
+
+ SSLContext context = TransportSupport.createSslContext(options);
+ assertNotNull(context);
- assertThat(engineProtocols, containsInAnyOrder(defaultProtocols.toArray()));
+ SSLEngine engine = TransportSupport.createSslEngine(context, options);
+ assertNotNull(engine);
+
+ assertArrayEquals("Enabled protocols not as expected", ENABLED_PROTOCOLS, engine.getEnabledProtocols());
}
@Test
- public void testCreateSslEngineFromJcsksStore() throws Exception {
+ public void testCreateSslEngineFromJceksStore() throws Exception {
TransportSslOptions options = createJceksSslOptions();
SSLContext context = TransportSupport.createSslContext(options);
@@ -158,9 +213,20 @@ public class TransportSupportTest extends QpidJmsTestCase {
assertNotNull(engine);
List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
- List<String> defaultProtocols = Arrays.asList(TransportSslOptions.DEFAULT_ENABLED_PROTOCOLS);
+ assertFalse(engineProtocols.isEmpty());
+ }
+
+ @Test
+ public void testCreateSslEngineFromJceksStoreWithExplicitEnabledProtocols() throws Exception {
+ TransportSslOptions options = createJceksSslOptions(ENABLED_PROTOCOLS);
+
+ SSLContext context = TransportSupport.createSslContext(options);
+ assertNotNull(context);
+
+ SSLEngine engine = TransportSupport.createSslEngine(context, options);
+ assertNotNull(engine);
- assertThat(engineProtocols, containsInAnyOrder(defaultProtocols.toArray()));
+ assertArrayEquals("Enabled protocols not as expected", ENABLED_PROTOCOLS, engine.getEnabledProtocols());
}
@Test
@@ -175,11 +241,6 @@ public class TransportSupportTest extends QpidJmsTestCase {
assertNotNull(engine);
assertEquals("HTTPS", engine.getSSLParameters().getEndpointIdentificationAlgorithm());
-
- List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
- List<String> defaultProtocols = Arrays.asList(TransportSslOptions.DEFAULT_ENABLED_PROTOCOLS);
-
- assertThat(engineProtocols, containsInAnyOrder(defaultProtocols.toArray()));
}
@Test
@@ -194,14 +255,13 @@ public class TransportSupportTest extends QpidJmsTestCase {
assertNotNull(engine);
assertNull(engine.getSSLParameters().getEndpointIdentificationAlgorithm());
-
- List<String> engineProtocols = Arrays.asList(engine.getEnabledProtocols());
- List<String> defaultProtocols = Arrays.asList(TransportSslOptions.DEFAULT_ENABLED_PROTOCOLS);
-
- assertThat(engineProtocols, containsInAnyOrder(defaultProtocols.toArray()));
}
private TransportSslOptions createJksSslOptions() {
+ return createJksSslOptions(null);
+ }
+
+ private TransportSslOptions createJksSslOptions(String[] enabledProtocols) {
TransportSslOptions options = new TransportSslOptions();
options.setKeyStoreLocation(CLIENT_JKS_KEYSTORE);
@@ -209,11 +269,18 @@ public class TransportSupportTest extends QpidJmsTestCase {
options.setStoreType(KEYSTORE_JKS_TYPE);
options.setKeyStorePassword(PASSWORD);
options.setTrustStorePassword(PASSWORD);
+ if (enabledProtocols != null) {
+ options.setEnabledProtocols(enabledProtocols);
+ }
return options;
}
private TransportSslOptions createJceksSslOptions() {
+ return createJceksSslOptions(null);
+ }
+
+ private TransportSslOptions createJceksSslOptions(String[] enabledProtocols) {
TransportSslOptions options = new TransportSslOptions();
options.setKeyStoreLocation(CLIENT_JCEKS_KEYSTORE);
@@ -221,11 +288,18 @@ public class TransportSupportTest extends QpidJmsTestCase {
options.setStoreType(KEYSTORE_JCEKS_TYPE);
options.setKeyStorePassword(PASSWORD);
options.setTrustStorePassword(PASSWORD);
+ if (enabledProtocols != null) {
+ options.setEnabledProtocols(enabledProtocols);
+ }
return options;
}
private TransportSslOptions createPkcs12SslOptions() {
+ return createPkcs12SslOptions(null);
+ }
+
+ private TransportSslOptions createPkcs12SslOptions(String[] enabledProtocols) {
TransportSslOptions options = new TransportSslOptions();
options.setKeyStoreLocation(CLIENT_PKCS12_KEYSTORE);
@@ -233,6 +307,9 @@ public class TransportSupportTest extends QpidJmsTestCase {
options.setStoreType(KEYSTORE_PKCS12_TYPE);
options.setKeyStorePassword(PASSWORD);
options.setTrustStorePassword(PASSWORD);
+ if (enabledProtocols != null) {
+ options.setEnabledProtocols(enabledProtocols);
+ }
return options;
}
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportFactoryTest.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportFactoryTest.java b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportFactoryTest.java
index d40841c..4199c47 100644
--- a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportFactoryTest.java
+++ b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportFactoryTest.java
@@ -17,6 +17,7 @@
package org.apache.qpid.jms.transports.netty;
import static org.hamcrest.collection.IsIterableContainingInAnyOrder.containsInAnyOrder;
+import static org.junit.Assert.assertArrayEquals;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
@@ -82,10 +83,8 @@ public class NettySslTransportFactoryTest {
assertTrue(options instanceof TransportSslOptions);
TransportSslOptions sslOptions = (TransportSslOptions) options;
- List<String> enabledProtocols = Arrays.asList(sslOptions.getEnabledProtocols());
- List<String> defaultProtocols = Arrays.asList(TransportSslOptions.DEFAULT_ENABLED_PROTOCOLS);
- assertThat(enabledProtocols, containsInAnyOrder(defaultProtocols.toArray()));
-
+ assertNull(sslOptions.getEnabledProtocols());
+ assertArrayEquals(TransportSslOptions.DEFAULT_DISABLED_PROTOCOLS.toArray(new String[0]), sslOptions.getDisabledProtocols());
assertNull(sslOptions.getEnabledCipherSuites());
assertEquals(TransportSslOptions.DEFAULT_STORE_TYPE, sslOptions.getStoreType());
http://git-wip-us.apache.org/repos/asf/qpid-jms/blob/6e3b7038/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportTest.java
----------------------------------------------------------------------
diff --git a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportTest.java b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportTest.java
index d94bf6d..e590222 100644
--- a/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportTest.java
+++ b/qpid-jms-client/src/test/java/org/apache/qpid/jms/transports/netty/NettySslTransportTest.java
@@ -21,7 +21,6 @@ import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.fail;
-import io.netty.handler.ssl.SslHandler;
import java.io.IOException;
import java.net.URI;
@@ -29,9 +28,6 @@ import java.net.URISyntaxException;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
-import javax.net.ssl.SSLEngine;
-import javax.net.ssl.SSLSession;
-
import org.apache.qpid.jms.transports.Transport;
import org.apache.qpid.jms.transports.TransportListener;
import org.apache.qpid.jms.transports.TransportOptions;
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org