You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2018/06/06 19:30:49 UTC
[cxf] branch 3.1.x-fixes updated (fc12329 -> fb729a5)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from fc12329 [CXF-7752] update jackson to 2.8.11 and jackson-databind to 2.8.11.1
new 16d2c36 Refactor of deprecated hostname verification tests
new 8411de9 Adding disableCN tests
new e138a4f Adding wildcard test for hostname verification
new 18ccc10 Adding default HostnameVerifier tests
new d157ab8 Only read the default threshold system property once
new 8a8212a Recording .gitmergeinfo Changes
new 2e1068d Updating dependency plugin
new fb729a5 Fixing backport
The 8 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.gitmergeinfo | 3 +
.../org/apache/cxf/attachment/AttachmentUtil.java | 4 +-
.../java/org/apache/cxf/io/CachedOutputStream.java | 10 ++
pom.xml | 2 +-
.../HostnameVerificationDeprecatedServer.java | 2 +-
.../HostnameVerificationDeprecatedTest.java | 113 ++++++++++++++++++++-
.../https/hostname/HostnameVerificationTest.java | 95 ++++++++++++++++-
...nt-bethal.xml => hostname-client-disablecn.xml} | 4 +-
...t-bethal.xml => hostname-client-usedefault.xml} | 4 +-
...r-bethal.xml => hostname-server-deprecated.xml} | 25 ++++-
.../cxf/systest/https/hostname/hostname-server.xml | 32 ++++--
testutils/src/test/resources/keys/subjalt.jks | Bin 8891 -> 11103 bytes
12 files changed, 271 insertions(+), 23 deletions(-)
copy systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/{hostname-client-bethal.xml => hostname-client-disablecn.xml} (93%)
rename systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/{hostname-client-bethal.xml => hostname-client-usedefault.xml} (92%)
rename systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/{hostname-server-bethal.xml => hostname-server-deprecated.xml} (75%)
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 07/08: Updating dependency plugin
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 2e1068d93812c3fd629343405060e76f4d1604c0
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 18:14:35 2018 +0100
Updating dependency plugin
---
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 1e27734..100aaba 100644
--- a/pom.xml
+++ b/pom.xml
@@ -576,7 +576,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
- <version>3.0.0</version>
+ <version>3.1.1</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 05/08: Only read the default threshold system property once
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit d157ab8a6fee28bad1165abe92c2d40b0a33e2f8
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 15:54:39 2018 +0100
Only read the default threshold system property once
(cherry picked from commit 2f7fcc9cd52fa063947c249135592918b314836c)
---
.../main/java/org/apache/cxf/attachment/AttachmentUtil.java | 4 +---
core/src/main/java/org/apache/cxf/io/CachedOutputStream.java | 10 ++++++++++
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
index e42c6f7..1cedec3 100644
--- a/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
+++ b/core/src/main/java/org/apache/cxf/attachment/AttachmentUtil.java
@@ -53,10 +53,8 @@ import javax.activation.MailcapCommandMap;
import javax.activation.URLDataSource;
import org.apache.cxf.common.util.StringUtils;
-import org.apache.cxf.common.util.SystemPropertyAction;
import org.apache.cxf.helpers.HttpHeaderHelper;
import org.apache.cxf.interceptor.Fault;
-import org.apache.cxf.io.CachedConstants;
import org.apache.cxf.io.CachedOutputStream;
import org.apache.cxf.message.Attachment;
import org.apache.cxf.message.Message;
@@ -180,7 +178,7 @@ public final class AttachmentUtil {
} else {
bos.setThreshold(Long.parseLong((String)threshold));
}
- } else if (SystemPropertyAction.getProperty(CachedConstants.THRESHOLD_SYS_PROP) == null) {
+ } else if (!CachedOutputStream.isThresholdSysPropSet()) {
// Use the default AttachmentDeserializer Threshold only if there is no system property defined
bos.setThreshold(AttachmentDeserializer.THRESHOLD);
}
diff --git a/core/src/main/java/org/apache/cxf/io/CachedOutputStream.java b/core/src/main/java/org/apache/cxf/io/CachedOutputStream.java
index 9490dba..8d94efc 100644
--- a/core/src/main/java/org/apache/cxf/io/CachedOutputStream.java
+++ b/core/src/main/java/org/apache/cxf/io/CachedOutputStream.java
@@ -53,6 +53,7 @@ public class CachedOutputStream extends OutputStream {
private static int defaultThreshold;
private static long defaultMaxSize;
private static String defaultCipherTransformation;
+ private static boolean thresholdSysPropSet;
static {
String s = SystemPropertyAction.getPropertyOrNull(CachedConstants.OUTPUT_DIRECTORY_SYS_PROP);
@@ -582,12 +583,21 @@ public class CachedOutputStream extends OutputStream {
i = Integer.parseInt(s);
if (i <= 0) {
i = 128 * 1024;
+ } else {
+ thresholdSysPropSet = true;
}
}
defaultThreshold = i;
}
+ /**
+ * Returns true if the default threshold is explicitly set via CachedConstants.THRESHOLD_SYS_PROP
+ */
+ public static boolean isThresholdSysPropSet() {
+ return thresholdSysPropSet;
+ }
+
public static void setDefaultCipherTransformation(String n) {
if (n == null) {
n = SystemPropertyAction.getPropertyOrNull(CachedConstants.CIPHER_TRANSFORMATION_SYS_PROP);
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 04/08: Adding default HostnameVerifier tests
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 18ccc10c1f09da6302f7cb44adb2d8ab1fc367be
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 15:16:35 2018 +0100
Adding default HostnameVerifier tests
(cherry picked from commit 6fe6f4396502aae5feecd3ef7e6537ef522bdd5e)
---
.../HostnameVerificationDeprecatedTest.java | 49 ++++++++++++++++++++++
.../https/hostname/HostnameVerificationTest.java | 41 ++++++++++++++++++
.../https/hostname/hostname-client-usedefault.xml | 34 +++++++++++++++
3 files changed, 124 insertions(+)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
index e5a322b..361b240 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
@@ -21,6 +21,8 @@ package org.apache.cxf.systest.https.hostname;
import java.net.URL;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -114,6 +116,52 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
bus.shutdown(true);
}
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifier() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+
+ // Note we need this method as well or else it won't work the with the
+ // deprecated HostnameVerifier interface
+ @SuppressWarnings("unused")
+ public boolean verify(final String host, final String certHostname) {
+ return true;
+ }
+ });
+
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-usedefault.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ port.greetMe("Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ }
+ }
+
// No Subject Alternative Name, but the CN matches ("localhost"), so the default HostnameVerifier
// should work fine
@org.junit.Test
@@ -172,4 +220,5 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
((java.io.Closeable)port).close();
bus.shutdown(true);
}
+
}
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
index 6aa8577..06de5d3 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
@@ -21,6 +21,8 @@ package org.apache.cxf.systest.https.hostname;
import java.net.URL;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -221,6 +223,45 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ // No Subject Alternative Name, no matching CN - but we are setting the JVM default hostname verifier to
+ // allow it
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDefaultVerifier() throws Exception {
+ HostnameVerifier hostnameVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
+ try {
+ HttpsURLConnection.setDefaultHostnameVerifier(
+ new javax.net.ssl.HostnameVerifier() {
+ public boolean verify(String hostName, javax.net.ssl.SSLSession session) {
+ return true;
+ }
+ });
+
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-usedefault.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ port.greetMe("Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ } finally {
+ if (hostnameVerifier != null) {
+ HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
+ }
+ }
+ }
+
// No Subject Alternative Name, but the CN wildcard matches
@org.junit.Test
public void testNoSubjectAlternativeNameCNWildcardMatch() throws Exception {
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-usedefault.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-usedefault.xml
new file mode 100644
index 0000000..8480dd7
--- /dev/null
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-usedefault.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:cxf="http://cxf.apache.org/core" xmlns:p="http://cxf.apache.org/policy" xmlns:sec="http://cxf.apache.org/configuration/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-b [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters useHttpsURLConnectionDefaultHostnameVerifier="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 03/08: Adding wildcard test for hostname verification
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit e138a4fb3234490e21e237495d3a9538ee6eaa5f
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 11:56:57 2018 +0100
Adding wildcard test for hostname verification
(cherry picked from commit c92ecbc590cad16315e0fb0c636b681d0abab9f5)
---
.../HostnameVerificationDeprecatedTest.java | 30 +++++++++++++++++++++
.../https/hostname/HostnameVerificationTest.java | 28 +++++++++++++++++++
.../https/hostname/hostname-server-deprecated.xml | 20 ++++++++++++++
.../cxf/systest/https/hostname/hostname-server.xml | 30 +++++++++++++++++----
testutils/src/test/resources/keys/subjalt.jks | Bin 8891 -> 11103 bytes
5 files changed, 103 insertions(+), 5 deletions(-)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
index 124a6dc..e5a322b 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
@@ -41,6 +41,7 @@ import org.junit.BeforeClass;
public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerTestBase {
static final String PORT = allocatePort(HostnameVerificationDeprecatedServer.class);
static final String PORT2 = allocatePort(HostnameVerificationDeprecatedServer.class, 2);
+ static final String PORT3 = allocatePort(HostnameVerificationDeprecatedServer.class, 3);
@BeforeClass
public static void startServers() throws Exception {
@@ -142,4 +143,33 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
((java.io.Closeable)port).close();
bus.shutdown(true);
}
+
+ // No Subject Alternative Name, but the CN wildcard matches
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNWildcardMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT3);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ // Enable Async
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
}
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
index 05a62e7..6aa8577 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
@@ -221,4 +221,32 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ // No Subject Alternative Name, but the CN wildcard matches
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameCNWildcardMatch() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT5);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ // Enable Async
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
}
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
index fc3a627..a776d09 100644
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
@@ -64,4 +64,24 @@
address="https://localhost:${testutil.ports.HostnameVerificationDeprecatedServer.2}/SoapContext/HttpsPort"
serviceName="s:SOAPService"
endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-cn-wildcard-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationDeprecatedServer.3}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatchwildcard</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNWildcardMatch"
+ implementor="org.apache.cxf.systest.http.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationDeprecatedServer.3}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-wildcard-match-settings"/>
</beans>
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
index b3137f0..3592ba8 100644
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
@@ -98,12 +98,32 @@
</httpj:tlsServerParameters>
</httpj:engine>
</httpj:engine-factory>
-
- <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
- xmlns:s="http://apache.org/hello_world/services"
- id="NoSubjectAltNoCNMatch"
- implementor="org.apache.cxf.systest.http.GreeterImpl"
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltNoCNMatch"
+ implementor="org.apache.cxf.systest.http.GreeterImpl"
address="https://localhost:${testutil.ports.HostnameVerificationServer.4}/SoapContext/HttpsPort"
serviceName="s:SOAPService"
endpointName="e:HttpsPort" depends-on="no-subject-alt-no-cn-match-settings"/>
+
+ <httpj:engine-factory id="no-subject-alt-cn-wildcard-match-settings">
+ <httpj:engine port="${testutil.ports.HostnameVerificationServer.5}">
+ <httpj:tlsServerParameters>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:keyManagers>
+ <sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnmatchwildcard</sec:certAlias>
+ </httpj:tlsServerParameters>
+ </httpj:engine>
+ </httpj:engine-factory>
+
+ <jaxws:endpoint xmlns:e="http://apache.org/hello_world/services"
+ xmlns:s="http://apache.org/hello_world/services"
+ id="NoSubjectAltCNWildcardMatch"
+ implementor="org.apache.cxf.systest.http.GreeterImpl"
+ address="https://localhost:${testutil.ports.HostnameVerificationServer.5}/SoapContext/HttpsPort"
+ serviceName="s:SOAPService"
+ endpointName="e:HttpsPort" depends-on="no-subject-alt-cn-wildcard-match-settings"/>
</beans>
diff --git a/testutils/src/test/resources/keys/subjalt.jks b/testutils/src/test/resources/keys/subjalt.jks
index fefac18..bd33b38 100644
Binary files a/testutils/src/test/resources/keys/subjalt.jks and b/testutils/src/test/resources/keys/subjalt.jks differ
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 01/08: Refactor of deprecated hostname verification tests
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 16d2c36519672ae253be9e38ed6be817138e2a51
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 11:01:38 2018 +0100
Refactor of deprecated hostname verification tests
(cherry picked from commit b2b6199885a87f244feda4dc1ba084a097b4be3f)
---
.../HostnameVerificationDeprecatedServer.java | 2 +-
.../HostnameVerificationDeprecatedTest.java | 10 +++----
.../https/hostname/hostname-client-bethal.xml | 34 ----------------------
...r-bethal.xml => hostname-server-deprecated.xml} | 5 ++--
.../cxf/systest/https/hostname/hostname-server.xml | 2 +-
5 files changed, 10 insertions(+), 43 deletions(-)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedServer.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedServer.java
index 28c8d41..3c624bf 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedServer.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedServer.java
@@ -33,7 +33,7 @@ public class HostnameVerificationDeprecatedServer extends AbstractBusTestServerB
}
protected void run() {
- URL busFile = HostnameVerificationDeprecatedServer.class.getResource("hostname-server-bethal.xml");
+ URL busFile = HostnameVerificationDeprecatedServer.class.getResource("hostname-server-deprecated.xml");
Bus busLocal = new SpringBusFactory().createBus(busFile);
BusFactory.setDefaultBus(busLocal);
setBus(busLocal);
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
index b464c2b..a9ea8a1 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
@@ -34,8 +34,8 @@ import org.junit.AfterClass;
import org.junit.BeforeClass;
/**
- * A test for hostname verification when the Java system property "java.protocol.handler.pkgs" is set to
- * "com.sun.net.ssl.internal.www.protocol". This means that com.sun.net.ssl.HostnameVerifier is used
+ * A test for hostname verification when the Java system property "java.protocol.handler.pkgs" is set to
+ * "com.sun.net.ssl.internal.www.protocol". This means that com.sun.net.ssl.HostnameVerifier is used
* instead of the javax version.
*/
public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerTestBase {
@@ -64,7 +64,7 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
@org.junit.Test
public void testLocalhostNotMatching() throws Exception {
SpringBusFactory bf = new SpringBusFactory();
- URL busFile = HostnameVerificationDeprecatedTest.class.getResource("hostname-client-bethal.xml");
+ URL busFile = HostnameVerificationDeprecatedTest.class.getResource("hostname-client.xml");
Bus bus = bf.createBus(busFile.toString());
BusFactory.setDefaultBus(bus);
@@ -77,7 +77,7 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
assertNotNull("Port is null", port);
updateAddressPort(port, PORT);
-
+
try {
port.greetMe("Kitty");
fail("Failure expected on the hostname verification");
@@ -88,7 +88,7 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
((java.io.Closeable)port).close();
bus.shutdown(true);
}
-
+
// No Subject Alternative Name, but the CN matches ("localhost"), so the default HostnameVerifier
// should work fine
@org.junit.Test
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-bethal.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-bethal.xml
deleted file mode 100644
index 87f3596..0000000
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-bethal.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
--->
-<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:cxf="http://cxf.apache.org/core" xmlns:p="http://cxf.apache.org/policy" xmlns:sec="http://cxf.apache.org/configuration/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-b [...]
-
- <cxf:bus>
- <cxf:features>
- <cxf:logging/>
- </cxf:features>
- </cxf:bus>
- <http:conduit name="https://localhost:.*">
- <http:tlsClientParameters>
- <sec:trustManagers>
- <sec:keyStore type="jks" password="password" resource="keys/Bethal.jks"/>
- </sec:trustManagers>
- </http:tlsClientParameters>
- </http:conduit>
-</beans>
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-bethal.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
similarity index 95%
rename from systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-bethal.xml
rename to systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
index 9babe68..fc3a627 100644
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-bethal.xml
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server-deprecated.xml
@@ -28,10 +28,11 @@
<httpj:engine-factory id="non-localhost-match-settings">
<httpj:engine port="${testutil.ports.HostnameVerificationDeprecatedServer}">
<httpj:tlsServerParameters>
- <sec:keyManagers keyPassword="password">
- <sec:keyStore type="jks" password="password" resource="keys/Bethal.jks"/>
+ <sec:keyManagers keyPassword="security">
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
</sec:keyManagers>
<sec:clientAuthentication want="false" required="false"/>
+ <sec:certAlias>nosubjaltcnnomatch</sec:certAlias>
</httpj:tlsServerParameters>
</httpj:engine>
</httpj:engine-factory>
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
index 21101e0..b3137f0 100644
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-server.xml
@@ -94,7 +94,7 @@
<sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
</sec:keyManagers>
<sec:clientAuthentication want="false" required="false"/>
- <sec:certAlias>nosubjaltnocnmatch</sec:certAlias>
+ <sec:certAlias>nosubjaltcnnomatch</sec:certAlias>
</httpj:tlsServerParameters>
</httpj:engine>
</httpj:engine-factory>
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 08/08: Fixing backport
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit fb729a56a725ccd28d56e9aa06d643a84e29da96
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 18:46:28 2018 +0100
Fixing backport
---
.../cxf/systest/https/hostname/HostnameVerificationTest.java | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
index 06de5d3..fb3bc69 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
@@ -206,8 +206,8 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
URL busFile = HostnameVerificationTest.class.getResource("hostname-client-disablecn.xml");
Bus bus = bf.createBus(busFile.toString());
- BusFactory.setDefaultBus(bus);
- BusFactory.setThreadDefaultBus(bus);
+ SpringBusFactory.setDefaultBus(bus);
+ SpringBusFactory.setThreadDefaultBus(bus);
URL url = SOAPService.WSDL_LOCATION;
SOAPService service = new SOAPService(url, SOAPService.SERVICE);
@@ -240,8 +240,8 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
URL busFile = HostnameVerificationTest.class.getResource("hostname-client-usedefault.xml");
Bus bus = bf.createBus(busFile.toString());
- BusFactory.setDefaultBus(bus);
- BusFactory.setThreadDefaultBus(bus);
+ SpringBusFactory.setDefaultBus(bus);
+ SpringBusFactory.setThreadDefaultBus(bus);
URL url = SOAPService.WSDL_LOCATION;
SOAPService service = new SOAPService(url, SOAPService.SERVICE);
@@ -269,8 +269,8 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
URL busFile = HostnameVerificationTest.class.getResource("hostname-client.xml");
Bus bus = bf.createBus(busFile.toString());
- BusFactory.setDefaultBus(bus);
- BusFactory.setThreadDefaultBus(bus);
+ SpringBusFactory.setDefaultBus(bus);
+ SpringBusFactory.setThreadDefaultBus(bus);
URL url = SOAPService.WSDL_LOCATION;
SOAPService service = new SOAPService(url, SOAPService.SERVICE);
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 02/08: Adding disableCN tests
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8411de987a05820d9d98279bd60e7373f6520ac4
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 11:25:11 2018 +0100
Adding disableCN tests
(cherry picked from commit 61879e4e6dc65eca136ca74ec6a22c6f4024546d)
# Conflicts:
# systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
---
.../HostnameVerificationDeprecatedTest.java | 24 +++++++++++++++
.../https/hostname/HostnameVerificationTest.java | 26 ++++++++++++++++-
.../https/hostname/hostname-client-disablecn.xml | 34 ++++++++++++++++++++++
3 files changed, 83 insertions(+), 1 deletion(-)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
index a9ea8a1..124a6dc 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationDeprecatedTest.java
@@ -89,6 +89,30 @@ public class HostnameVerificationDeprecatedTest extends AbstractBusClientServerT
bus.shutdown(true);
}
+ // No Subject Alternative Name, no matching CN - but we are disabling the CN check so it should work OK
+ @org.junit.Test
+ public void testLocalhostNotMatchingDisableCN() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-disablecn.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ port.greetMe("Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
// No Subject Alternative Name, but the CN matches ("localhost"), so the default HostnameVerifier
// should work fine
@org.junit.Test
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
index c55dccb..05a62e7 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/hostname/HostnameVerificationTest.java
@@ -196,5 +196,29 @@ public class HostnameVerificationTest extends AbstractBusClientServerTestBase {
((java.io.Closeable)port).close();
bus.shutdown(true);
}
-
+
+ // No Subject Alternative Name, no matching CN - but we are disabling the CN check so it should work OK
+ @org.junit.Test
+ public void testNoSubjectAlternativeNameNoCNMatchDisableCN() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = HostnameVerificationTest.class.getResource("hostname-client-disablecn.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT4);
+
+ port.greetMe("Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
}
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-disablecn.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-disablecn.xml
new file mode 100644
index 0000000..19c9471
--- /dev/null
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/hostname/hostname-client-disablecn.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:cxf="http://cxf.apache.org/core" xmlns:p="http://cxf.apache.org/policy" xmlns:sec="http://cxf.apache.org/configuration/security" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-b [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers>
+ <sec:keyStore type="jks" password="security" resource="keys/subjalt.jks"/>
+ </sec:trustManagers>
+ </http:tlsClientParameters>
+ </http:conduit>
+</beans>
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.
[cxf] 06/08: Recording .gitmergeinfo Changes
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8a8212a027d2d33aae295d814cf7f9fb6cfc227e
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jun 6 18:11:24 2018 +0100
Recording .gitmergeinfo Changes
---
.gitmergeinfo | 3 +++
1 file changed, 3 insertions(+)
diff --git a/.gitmergeinfo b/.gitmergeinfo
index 360ab9c..c282e5b 100644
--- a/.gitmergeinfo
+++ b/.gitmergeinfo
@@ -388,6 +388,7 @@ B 706eacc5ae12e1c95085d2f8602c632c921e849e
B 707fa4f3c3f3aa40979e57468a9ac3eb3102a71f
B 70ac8edcc95d88ae4a338005ffd07fe149b46793
B 7230763f340664c3c235e9acb123acc058062b30
+B 724f22436665d9971c22eb3dc6eb2a663390d612
B 7263bb6f9e9025c31cd5bcab1f270805587a6a6d
B 73d1f886ae5265131e8664ee952ffd1cdc82f71a
B 741c9e349e7e48d3fe278ba8d8f17dd6bf4c4370
@@ -516,6 +517,7 @@ B 9cffee539adc2abd5eaf198e16fde082ca4b3e92
B 9e6d2aa86c57e600baf66e42538036c927cadcf5
B 9e9da1ec63f5c30d99ceb6cd662fe89b789447dd
B 9ec8ff0c2978596c8c7715e76ae4460359ed1f8f
+B 9f0da3532c2059e956d845beb2c066ca01d2d95c
B 9f39272a5f92c8bc27a8d3adc4da89f0eb30a54b
B 9f727a9e1cbc5df87b752a3b7aa4bca94357e613
B 9f82ccd9d9a6f7db5b555c4040c41faf177f8e0b
@@ -1034,6 +1036,7 @@ M 5e17bc043723353937ee7f1f9ac1c51c83b74679
M 5f6cb0745adc5d8cb6dd53a46751f56f42928d94
M 6070ddeef82e3b7366f1dc7d1252bc03af8766dd
M 61392a9defa5f1d7efccacee02a817e255971114
+M 61879e4e6dc65eca136ca74ec6a22c6f4024546d
M 6242c682dfce4a2ba4869978c28b14f1472484c1
M 62ba50cc2cf934865d4646785137167cd44c29ff
M 62ca005b5c1b5e97a3ad75dceae9b355f65a9e35
--
To stop receiving notification emails like this one, please contact
coheigea@apache.org.