You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Niklas Gustavsson <ni...@protocol7.com> on 2006/11/05 23:17:59 UTC
[net] FTPS client auth required
Hi
I'm trying to create tests for client authentication for Apache
FtpServer. For this I'm using commons-net as the client but is running
into problems with the client auth support in FTPSClient. I'm setting
setNeedClientAuth(true) but still get problems due to FTPSClient sending
a null certificate chain. How should I set up my keystore so that
FTPSClient finds it and can use it to send the correct certificate to
the server for authentication? I've tried with the
javax.net.ssl.keyStore system property but to no avail.
Also, if I understand the current implementation of FTPSClient and
FTPSTrustManager. From what I can understand, the implementation only
checks if the service certificate is valid, not if it's trusted. Is this
correct? If so, this would probably be a security issue in that a fake
server serving up any valid certificate would be trusted by the client.
Is this the intended behavior?
/niklas
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: [net] FTPS client auth required
Posted by Niklas Gustavsson <ni...@protocol7.com>.
Niklas Gustavsson wrote:
> Rory Winston wrote:
>> Hi Niklas
>>
>> Done. Thanks
>
> Thanks! The build seems broken at the moment as
> org.apache.commons.net.PrintCommandListener is missing. COuld you fix
> this or do you produce binaries somewhere?
The attached patch fixes the broken build (still can't get tests to run
but I could build myself a binary :-).
For some reason the PrintCommandListener was deleted in rev 437767 so it
you don't want it in the code, please ignore this patch :-)
/niklas
Re: [net] FTPS client auth required
Posted by Niklas Gustavsson <ni...@protocol7.com>.
Rory Winston wrote:
> Hi Niklas
>
> Done. Thanks
Thanks! The build seems broken at the moment as
org.apache.commons.net.PrintCommandListener is missing. COuld you fix
this or do you produce binaries somewhere?
/niklas
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: [net] FTPS client auth required
Posted by Rory Winston <rw...@eircom.net>.
Hi Niklas
Done. Thanks
Rory
Niklas Gustavsson wrote:
> Thanks, making that settable makes a lot of sense. Would you mind
> doing the same thing for the KeyManager as that would make client auth
> possible? At least I'm not able to get it working without one :-)
>
> I'm attaching the patch I use for the client auth tests in FtpServer.
>
> /niklas
>
> Rory Winston wrote:
>> Niklas
>>
>> The current FTPSTrustManager implementation is a little bit sketchy -
>> maybe we could default to a more comprehensive validity check. I have
>> added the facility to plug in a custom trust manager to the
>> FTPSClient, as follows:
>>
>> FTPSClient client = new FTPSClient();
>>
>> client.setTrustManager(new X509TrustManager() {
>>
>> public void checkClientTrusted(X509Certificate[]
>> chain, String authType) throws CertificateException {
>> ...
>> }
>>
>> public void checkServerTrusted(X509Certificate[]
>> chain, String authType) throws CertificateException {
>> ...
>> }
>>
>> public X509Certificate[] getAcceptedIssuers() {
>> ...
>> }
>> });
>>
>> Thanks for the patch, by the way.
>>
>> Cheers
>> Rory
>>
>>
>> Niklas Gustavsson wrote:
>>> Hi
>>>
>>> I'm trying to create tests for client authentication for Apache
>>> FtpServer. For this I'm using commons-net as the client but is
>>> running into problems with the client auth support in FTPSClient.
>>> I'm setting setNeedClientAuth(true) but still get problems due to
>>> FTPSClient sending a null certificate chain. How should I set up my
>>> keystore so that FTPSClient finds it and can use it to send the
>>> correct certificate to the server for authentication? I've tried
>>> with the javax.net.ssl.keyStore system property but to no avail.
>>>
>>> Also, if I understand the current implementation of FTPSClient and
>>> FTPSTrustManager. From what I can understand, the implementation
>>> only checks if the service certificate is valid, not if it's
>>> trusted. Is this correct? If so, this would probably be a security
>>> issue in that a fake server serving up any valid certificate would
>>> be trusted by the client. Is this the intended behavior?
>>>
>>> /niklas
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
>>> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
>>>
>>>
>>>
>>>
>
> ------------------------------------------------------------------------
>
> Index: src/main/java/org/apache/commons/net/ftp/FTPSClient.java
> ===================================================================
> --- src/main/java/org/apache/commons/net/ftp/FTPSClient.java (revision 479111)
> +++ src/main/java/org/apache/commons/net/ftp/FTPSClient.java (working copy)
> @@ -23,6 +23,7 @@
> import java.security.KeyManagementException;
> import java.security.NoSuchAlgorithmException;
>
> +import javax.net.ssl.KeyManager;
> import javax.net.ssl.SSLContext;
> import javax.net.ssl.SSLException;
> import javax.net.ssl.SSLServerSocketFactory;
> @@ -80,6 +81,9 @@
> /** The FTPS {@link TrustManager} implementation. */
> private TrustManager trustManager = new FTPSTrustManager();
>
> + /** The {@link KeyManager} */
> + private KeyManager keyManager;
> +
> /**
> * Constructor for FTPSClient.
> * @throws NoSuchAlgorithmException A requested cryptographic algorithm
> @@ -194,10 +198,10 @@
> planeSocket = _socket_;
>
> try {
> - context.init(null, new TrustManager[] { getTrustManager() } , null);
> - } catch (KeyManagementException e) {
> - e.printStackTrace();
> - }
> + context.init(new KeyManager[] {keyManager}, new TrustManager[] { getTrustManager() } , null);
> + } catch (KeyManagementException e) {
> + e.printStackTrace();
> + }
>
> SSLSocketFactory ssf = context.getSocketFactory();
> String ip = _socket_.getInetAddress().getHostAddress();
> @@ -479,6 +483,22 @@
> this.trustManager = trustManager;
> }
>
> + /**
> + * Get the currently configured {@link KeyManager}.
> + *
> + * @return the keyManager
> + */
> + public KeyManager getKeyManager() {
> + return keyManager;
> + }
> +
> + /**
> + * Set a {@link KeyManager} to use
> + *
> + * @param keyManager The KeyManager implementation to set.
> + */
> + public void setKeyManager(KeyManager keyManager) {
> + this.keyManager = keyManager;
> + }
>
> -
> }
>
> ------------------------------------------------------------------------
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: [net] FTPS client auth required
Posted by Niklas Gustavsson <ni...@protocol7.com>.
Thanks, making that settable makes a lot of sense. Would you mind doing
the same thing for the KeyManager as that would make client auth
possible? At least I'm not able to get it working without one :-)
I'm attaching the patch I use for the client auth tests in FtpServer.
/niklas
Rory Winston wrote:
> Niklas
>
> The current FTPSTrustManager implementation is a little bit sketchy -
> maybe we could default to a more comprehensive validity check. I have
> added the facility to plug in a custom trust manager to the FTPSClient,
> as follows:
>
> FTPSClient client = new FTPSClient();
>
> client.setTrustManager(new X509TrustManager() {
>
> public void checkClientTrusted(X509Certificate[] chain,
> String authType) throws CertificateException {
> ...
> }
>
> public void checkServerTrusted(X509Certificate[] chain,
> String authType) throws CertificateException {
> ...
> }
>
> public X509Certificate[] getAcceptedIssuers() {
> ...
> }
> });
>
> Thanks for the patch, by the way.
>
> Cheers
> Rory
>
>
> Niklas Gustavsson wrote:
>> Hi
>>
>> I'm trying to create tests for client authentication for Apache
>> FtpServer. For this I'm using commons-net as the client but is running
>> into problems with the client auth support in FTPSClient. I'm setting
>> setNeedClientAuth(true) but still get problems due to FTPSClient
>> sending a null certificate chain. How should I set up my keystore so
>> that FTPSClient finds it and can use it to send the correct
>> certificate to the server for authentication? I've tried with the
>> javax.net.ssl.keyStore system property but to no avail.
>>
>> Also, if I understand the current implementation of FTPSClient and
>> FTPSTrustManager. From what I can understand, the implementation only
>> checks if the service certificate is valid, not if it's trusted. Is
>> this correct? If so, this would probably be a security issue in that a
>> fake server serving up any valid certificate would be trusted by the
>> client. Is this the intended behavior?
>>
>> /niklas
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
>>
>>
>>
>>
Re: [net] FTPS client auth required
Posted by Rory Winston <rw...@eircom.net>.
Niklas
The current FTPSTrustManager implementation is a little bit sketchy -
maybe we could default to a more comprehensive validity check. I have
added the facility to plug in a custom trust manager to the FTPSClient,
as follows:
FTPSClient client = new FTPSClient();
client.setTrustManager(new X509TrustManager() {
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
...
}
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
...
}
public X509Certificate[] getAcceptedIssuers() {
...
}
});
Thanks for the patch, by the way.
Cheers
Rory
Niklas Gustavsson wrote:
> Hi
>
> I'm trying to create tests for client authentication for Apache
> FtpServer. For this I'm using commons-net as the client but is running
> into problems with the client auth support in FTPSClient. I'm setting
> setNeedClientAuth(true) but still get problems due to FTPSClient
> sending a null certificate chain. How should I set up my keystore so
> that FTPSClient finds it and can use it to send the correct
> certificate to the server for authentication? I've tried with the
> javax.net.ssl.keyStore system property but to no avail.
>
> Also, if I understand the current implementation of FTPSClient and
> FTPSTrustManager. From what I can understand, the implementation only
> checks if the service certificate is valid, not if it's trusted. Is
> this correct? If so, this would probably be a security issue in that a
> fake server serving up any valid certificate would be trusted by the
> client. Is this the intended behavior?
>
> /niklas
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org