You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by or...@apache.org on 2020/02/05 14:52:19 UTC
[qpid-broker-j] branch master updated (2c624d4 -> 5801bb8)
This is an automated email from the ASF dual-hosted git repository.
orudyy pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-broker-j.git.
from 2c624d4 QPID-8402: [Broker-J] Generate TLS resources on the fly
new d99a8fc QPID-8367: [Broker-J] Discover CertificateFactory independently from other sun API
new c413f31 QPID-8402: [Broker-J] Include Bouncycastle license into allowed licenses
new 5801bb8 QPID-8402: [Broker-J] Fix failing tests on IBM JDK
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../transport/network/security/ssl/SSLUtil.java | 12 ++++++++++--
.../qpid/server/security/NonJavaKeyStoreTest.java | 3 +--
.../server/security/SiteSpecificTrustStoreTest.java | 3 ++-
pom.xml | 1 +
.../qpid/test/utils/tls/TlsResourceBuilder.java | 21 ++-------------------
.../org/apache/qpid/tests/http/HttpTestHelper.java | 2 +-
.../systests/QpidJmsClientConnectionBuilder.java | 2 ++
.../jms_1_1/extensions/sasl/AuthenticationTest.java | 8 ++++++++
8 files changed, 27 insertions(+), 25 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org
[qpid-broker-j] 01/03: QPID-8367: [Broker-J] Discover
CertificateFactory independently from other sun API
Posted by or...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
orudyy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-broker-j.git
commit d99a8fc1edb9de74912286866f79bb4cd17003f9
Author: Alex Rudyy <or...@apache.org>
AuthorDate: Wed Feb 5 11:53:52 2020 +0000
QPID-8367: [Broker-J] Discover CertificateFactory independently from other sun API
---
.../qpid/server/transport/network/security/ssl/SSLUtil.java | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java b/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java
index e664c2e..dd581ca 100644
--- a/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java
+++ b/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java
@@ -130,6 +130,15 @@ public class SSLUtil
try
{
+ certificateFactory = CertificateFactory.getInstance("X.509");
+ }
+ catch (CertificateException e)
+ {
+ // ignore
+ }
+
+ try
+ {
Class<?> certAndKeyGenClass;
try
{
@@ -162,9 +171,8 @@ public class SSLUtil
setExtensionMethod = certificateExtensionsClass.getMethod("set", String.class, Object.class);
extensionGetNameMethod = extensionClass.getMethod("getName");
canGenerateCerts = true;
- certificateFactory = CertificateFactory.getInstance("X.509");
}
- catch (ClassNotFoundException | LinkageError | CertificateException | NoSuchMethodException e)
+ catch (ClassNotFoundException | LinkageError | NoSuchMethodException e)
{
// ignore
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org
[qpid-broker-j] 02/03: QPID-8402: [Broker-J] Include Bouncycastle
license into allowed licenses
Posted by or...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
orudyy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-broker-j.git
commit c413f3156e2339b47da23b4c981cddaf92454e07
Author: Alex Rudyy <or...@apache.org>
AuthorDate: Wed Feb 5 11:56:17 2020 +0000
QPID-8402: [Broker-J] Include Bouncycastle license into allowed licenses
---
pom.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/pom.xml b/pom.xml
index 4f8aa0e..d95ae65 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1529,6 +1529,7 @@
<includedLicense>Academic Free License v2.1</includedLicense>
<includedLicense>COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0</includedLicense>
<includedLicense>Public Domain</includedLicense>
+ <includedLicense>Bouncy Castle Licence</includedLicense>
</includedLicenses>
<licenseMerges>
<licenseMerge>Apache Software License, Version 2.0|The Apache Software License, Version 2.0|Apache Software License - Version 2.0|Apache v2|Apache 2|Apache License, Version 2.0|Apache 2.0|Apache Public License 2.0</licenseMerge>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org
[qpid-broker-j] 03/03: QPID-8402: [Broker-J] Fix failing tests on
IBM JDK
Posted by or...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
orudyy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/qpid-broker-j.git
commit 5801bb8358e6bde61f41fc7268431881f3d5f858
Author: Alex Rudyy <or...@apache.org>
AuthorDate: Wed Feb 5 14:32:29 2020 +0000
QPID-8402: [Broker-J] Fix failing tests on IBM JDK
---
.../qpid/server/security/NonJavaKeyStoreTest.java | 3 +--
.../server/security/SiteSpecificTrustStoreTest.java | 3 ++-
.../qpid/test/utils/tls/TlsResourceBuilder.java | 21 ++-------------------
.../org/apache/qpid/tests/http/HttpTestHelper.java | 2 +-
.../systests/QpidJmsClientConnectionBuilder.java | 2 ++
.../jms_1_1/extensions/sasl/AuthenticationTest.java | 8 ++++++++
6 files changed, 16 insertions(+), 23 deletions(-)
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/NonJavaKeyStoreTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/NonJavaKeyStoreTest.java
index 1908f0c..e0dcd9f 100644
--- a/broker-core/src/test/java/org/apache/qpid/server/security/NonJavaKeyStoreTest.java
+++ b/broker-core/src/test/java/org/apache/qpid/server/security/NonJavaKeyStoreTest.java
@@ -135,8 +135,7 @@ public class NonJavaKeyStoreTest extends UnitTestBase
attributes.put(NonJavaKeyStore.TYPE, NON_JAVA_KEY_STORE);
KeyStoreTestHelper.checkExceptionThrownDuringKeyStoreCreation(FACTORY, BROKER, KeyStore.class, attributes,
- "Cannot load private key or certificate(s): java.security.cert.CertificateException: " +
- "Could not parse certificate: java.io.IOException: Empty input");
+ "Cannot load private key or certificate(s)");
}
@Test
diff --git a/broker-core/src/test/java/org/apache/qpid/server/security/SiteSpecificTrustStoreTest.java b/broker-core/src/test/java/org/apache/qpid/server/security/SiteSpecificTrustStoreTest.java
index 1da3c38..7c968cf 100644
--- a/broker-core/src/test/java/org/apache/qpid/server/security/SiteSpecificTrustStoreTest.java
+++ b/broker-core/src/test/java/org/apache/qpid/server/security/SiteSpecificTrustStoreTest.java
@@ -56,6 +56,7 @@ import org.apache.qpid.server.model.BrokerModel;
import org.apache.qpid.server.model.BrokerTestHelper;
import org.apache.qpid.server.model.ConfiguredObjectFactory;
import org.apache.qpid.server.model.TrustStore;
+import org.apache.qpid.server.transport.network.security.ssl.SSLUtil;
import org.apache.qpid.test.utils.UnitTestBase;
import org.apache.qpid.test.utils.tls.KeyCertificatePair;
import org.apache.qpid.test.utils.tls.PrivateKeyEntry;
@@ -327,7 +328,7 @@ public class SiteSpecificTrustStoreTest extends UnitTestBase
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(inMemoryKeyStore, secret);
KeyManager[] keyManagers = kmf.getKeyManagers();
- SSLContext sslContext = SSLContext.getInstance("TLS");
+ SSLContext sslContext = SSLUtil.tryGetSSLContext();
sslContext.init(keyManagers, null, new SecureRandom());
SSLServerSocketFactory socketFactory = sslContext.getServerSocketFactory();
ServerSocket serverSocket = socketFactory.createServerSocket(0);
diff --git a/qpid-test-utils/src/main/java/org/apache/qpid/test/utils/tls/TlsResourceBuilder.java b/qpid-test-utils/src/main/java/org/apache/qpid/test/utils/tls/TlsResourceBuilder.java
index 1d2fff4..ad75e15 100644
--- a/qpid-test-utils/src/main/java/org/apache/qpid/test/utils/tls/TlsResourceBuilder.java
+++ b/qpid-test-utils/src/main/java/org/apache/qpid/test/utils/tls/TlsResourceBuilder.java
@@ -43,6 +43,7 @@ import org.bouncycastle.asn1.x500.style.RFC4519Style;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.CRLDistPoint;
import org.bouncycastle.asn1.x509.CRLNumber;
+import org.bouncycastle.asn1.x509.CRLReason;
import org.bouncycastle.asn1.x509.DistributionPoint;
import org.bouncycastle.asn1.x509.DistributionPointName;
import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
@@ -270,8 +271,7 @@ public class TlsResourceBuilder
for (X509Certificate c : certificate)
{
- // crlBuilder.addCRLEntry(c.getSerialNumber(), now, CRLReason.privilegeWithdrawn);
- crlBuilder.addCRLEntry(c.getSerialNumber(), now, 0);
+ crlBuilder.addCRLEntry(c.getSerialNumber(), now, CRLReason.privilegeWithdrawn);
}
crlBuilder.addExtension(createAuthorityKeyExtension(ca.getCertificate().getPublicKey()));
@@ -281,23 +281,6 @@ public class TlsResourceBuilder
final X509CRLHolder crl = crlBuilder.build(contentSigner);
return new JcaX509CRLConverter().getCRL(crl);
-
-
- /*
-
- JcaContentSignerBuilder contentSignerBuilder =
- new JcaContentSignerBuilder(SIGNATURE_ALGORITHM_SHA_512_WITH_RSA); //"SHA256WithRSAEncryption"
-
- contentSignerBuilder.setProvider("BC");
-
- X509CRLHolder crlHolder = crlBuilder.build(contentSignerBuilder.build(ca.getPrivateKey()));
-
- JcaX509CRLConverter converter = new JcaX509CRLConverter();
-
- converter.setProvider("BC");
-
- return converter.getCRL(crlHolder);
- */
}
catch (OperatorException | IOException | CertificateException e)
{
diff --git a/systests/qpid-systests-http-management/src/main/java/org/apache/qpid/tests/http/HttpTestHelper.java b/systests/qpid-systests-http-management/src/main/java/org/apache/qpid/tests/http/HttpTestHelper.java
index 4addf67..b297a4c 100644
--- a/systests/qpid-systests-http-management/src/main/java/org/apache/qpid/tests/http/HttpTestHelper.java
+++ b/systests/qpid-systests-http-management/src/main/java/org/apache/qpid/tests/http/HttpTestHelper.java
@@ -142,7 +142,7 @@ public class HttpTestHelper
HttpsURLConnection httpsCon = (HttpsURLConnection) httpCon;
try
{
- SSLContext sslContext = SSLContext.getInstance("TLS");
+ SSLContext sslContext = SSLUtil.tryGetSSLContext();
TrustManager[] trustAllCerts = new TrustManager[] {new TrustAllTrustManager()};
KeyManager[] keyManagers = null;
diff --git a/systests/qpid-systests-jms-core/src/main/java/org/apache/qpid/systests/QpidJmsClientConnectionBuilder.java b/systests/qpid-systests-jms-core/src/main/java/org/apache/qpid/systests/QpidJmsClientConnectionBuilder.java
index 30cef33..b7c0d6b 100644
--- a/systests/qpid-systests-jms-core/src/main/java/org/apache/qpid/systests/QpidJmsClientConnectionBuilder.java
+++ b/systests/qpid-systests-jms-core/src/main/java/org/apache/qpid/systests/QpidJmsClientConnectionBuilder.java
@@ -57,6 +57,8 @@ public class QpidJmsClientConnectionBuilder implements ConnectionBuilder
_options.put("jms.clientID", getNextClientId());
_options.put("jms.username", USERNAME);
_options.put("jms.password", PASSWORD);
+ _options.put("transport.enabledProtocols", "TLSv1.2");
+ _options.put("transport.disabledProtocols", "SSLv2Hello,SSLv3,TLSv1,TLSv1.1");
_host = "localhost";
}
diff --git a/systests/qpid-systests-jms_1.1/src/test/java/org/apache/qpid/systests/jms_1_1/extensions/sasl/AuthenticationTest.java b/systests/qpid-systests-jms_1.1/src/test/java/org/apache/qpid/systests/jms_1_1/extensions/sasl/AuthenticationTest.java
index ac74cd7..b7e68e4 100644
--- a/systests/qpid-systests-jms_1.1/src/test/java/org/apache/qpid/systests/jms_1_1/extensions/sasl/AuthenticationTest.java
+++ b/systests/qpid-systests-jms_1.1/src/test/java/org/apache/qpid/systests/jms_1_1/extensions/sasl/AuthenticationTest.java
@@ -20,6 +20,7 @@
*/
package org.apache.qpid.systests.jms_1_1.extensions.sasl;
+import static org.apache.qpid.test.utils.UnitTestBase.getJvmVendor;
import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.CoreMatchers.equalTo;
import static org.hamcrest.CoreMatchers.is;
@@ -55,6 +56,7 @@ import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.server.handler.AbstractHandler;
import org.eclipse.jetty.server.handler.ContextHandler;
import org.eclipse.jetty.server.handler.HandlerCollection;
+import org.hamcrest.Matchers;
import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.ClassRule;
@@ -72,6 +74,7 @@ import org.apache.qpid.systests.AmqpManagementFacade;
import org.apache.qpid.systests.ConnectionBuilder;
import org.apache.qpid.systests.JmsTestBase;
import org.apache.qpid.systests.jms_1_1.extensions.BrokerManagementHelper;
+import org.apache.qpid.test.utils.JvmVendor;
import org.apache.qpid.test.utils.tls.CertificateEntry;
import org.apache.qpid.test.utils.tls.KeyCertificatePair;
import org.apache.qpid.test.utils.tls.PrivateKeyEntry;
@@ -421,6 +424,7 @@ public class AuthenticationTest extends JmsTestBase
@Test
public void externalWithRevocationAndAllowedCertificateWithCrlUrl() throws Exception
{
+ assumeThat(getJvmVendor(), Matchers.not(JvmVendor.IBM));
final Map<String, Object> trustStoreAttributes = getBrokerTrustStoreAttributes();
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
final int port = createExternalProviderAndTlsPort(trustStoreAttributes, null, false);
@@ -439,6 +443,7 @@ public class AuthenticationTest extends JmsTestBase
@Test
public void externalWithRevocationAndRevokedCertificateWithCrlUrlWithEmptyCrl() throws Exception
{
+ assumeThat(getJvmVendor(), Matchers.not(JvmVendor.IBM));
final Map<String, Object> trustStoreAttributes = getBrokerTrustStoreAttributes();
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
final int port = createExternalProviderAndTlsPort(trustStoreAttributes, null, false);
@@ -467,6 +472,7 @@ public class AuthenticationTest extends JmsTestBase
@Test
public void externalWithRevocationAndRevokedCertificateWithCrlUrlWithSoftFail() throws Exception
{
+ assumeThat(getJvmVendor(), Matchers.not(JvmVendor.IBM));
final Map<String, Object> trustStoreAttributes = getBrokerTrustStoreAttributes();
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_WITH_IGNORING_SOFT_FAILURES, true);
@@ -488,6 +494,7 @@ public class AuthenticationTest extends JmsTestBase
@Test
public void externalWithRevocationAndRevokedCertificateWithCrlUrlWithoutPreferCrlsWithFallback() throws Exception
{
+ assumeThat(getJvmVendor(), Matchers.not(JvmVendor.IBM));
final Map<String, Object> trustStoreAttributes = getBrokerTrustStoreAttributes();
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_WITH_PREFERRING_CERTIFICATE_REVOCATION_LIST,
@@ -511,6 +518,7 @@ public class AuthenticationTest extends JmsTestBase
@Test
public void externalWithRevocationAndRevokedIntermediateCertificateWithCrlUrlOnlyEndEntity() throws Exception
{
+ assumeThat(getJvmVendor(), Matchers.not(JvmVendor.IBM));
final Map<String, Object> trustStoreAttributes = getBrokerTrustStoreAttributes();
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_ENABLED, true);
trustStoreAttributes.put(FileTrustStore.CERTIFICATE_REVOCATION_CHECK_OF_ONLY_END_ENTITY_CERTIFICATES, true);
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org