You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2020/04/01 07:32:38 UTC
[cxf] branch 3.3.x-fixes updated (12039ee -> 8c5d3db)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch 3.3.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git.
from 12039ee Recording .gitmergeinfo Changes
new 04ad8b5 Adding a test case for TlS trustManager refs in Spring
new 8c5d3db CXF-8253 - Provide a way to disable TLS trust verification for the OSGi HttpConduitConfigApplier
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../http/osgi/HttpConduitConfigApplier.java | 10 +-
.../cxf/transport/https/InsecureTrustManager.java | 68 +++++++++++++
.../http/osgi/HttpConduitConfigApplierTest.java | 105 +++++++++++++++++++++
.../https/ciphersuites/CipherSuitesTest.java | 39 +-------
.../systest/https/clientauth/ClientAuthTest.java | 28 +-----
.../cxf/systest/https/trust/TrustManagerTest.java | 56 ++++++-----
...pty-config.xml => client-trust-manager-ref.xml} | 9 +-
7 files changed, 225 insertions(+), 90 deletions(-)
create mode 100644 rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
create mode 100644 rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
copy systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/{client-trust-empty-config.xml => client-trust-manager-ref.xml} (90%)
[cxf] 02/02: CXF-8253 - Provide a way to disable TLS trust
verification for the OSGi HttpConduitConfigApplier
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.3.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 8c5d3db8ec16b35e43b578c405218678d2e2f562
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Mar 31 15:52:11 2020 +0100
CXF-8253 - Provide a way to disable TLS trust verification for the OSGi HttpConduitConfigApplier
(cherry picked from commit 3157955899bc49e2e0dad145e9e6c52fb82e1d8c)
---
.../http/osgi/HttpConduitConfigApplier.java | 10 +-
.../cxf/transport/https/InsecureTrustManager.java | 68 +++++++++++++
.../http/osgi/HttpConduitConfigApplierTest.java | 105 +++++++++++++++++++++
.../https/ciphersuites/CipherSuitesTest.java | 39 +-------
.../systest/https/clientauth/ClientAuthTest.java | 28 +-----
.../cxf/systest/https/trust/TrustManagerTest.java | 31 +-----
.../https/trust/client-trust-manager-ref.xml | 2 +-
7 files changed, 193 insertions(+), 90 deletions(-)
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
index e0fcfe6..ddfa195 100644
--- a/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplier.java
@@ -38,6 +38,7 @@ import org.apache.cxf.configuration.security.SecureRandomParameters;
import org.apache.cxf.configuration.security.TrustManagersType;
import org.apache.cxf.transport.http.HTTPConduit;
import org.apache.cxf.transport.http.auth.HttpAuthSupplier;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.cxf.transports.http.configuration.ConnectionType;
import org.apache.cxf.transports.http.configuration.HTTPClientPolicy;
import org.apache.cxf.transports.http.configuration.ProxyServerType;
@@ -68,6 +69,8 @@ class HttpConduitConfigApplier {
KeyManagersType kmt = null;
TrustManagersType tmt = null;
boolean enableRevocation = false;
+ boolean disableTrustVerification = false;
+
while (keys.hasMoreElements()) {
String k = keys.nextElement();
if (k.startsWith("tlsClientParameters.")) {
@@ -121,6 +124,9 @@ class HttpConduitConfigApplier {
while (st.hasMoreTokens()) {
p.getCipherSuites().add(st.nextToken());
}
+ } else if ("trustManagers.disableTrustVerification".equals(k)
+ && Boolean.parseBoolean(v)) {
+ disableTrustVerification = true;
} else if (k.startsWith("trustManagers.")) {
tmt = getTrustManagers(tmt,
k.substring("trustManagers.".length()),
@@ -140,7 +146,9 @@ class HttpConduitConfigApplier {
if (kmt != null) {
p.setKeyManagers(TLSParameterJaxBUtils.getKeyManagers(kmt));
}
- if (tmt != null) {
+ if (disableTrustVerification) {
+ p.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
+ } else if (tmt != null) {
p.setTrustManagers(TLSParameterJaxBUtils.getTrustManagers(tmt, enableRevocation));
}
} catch (RuntimeException e) {
diff --git a/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
new file mode 100644
index 0000000..e09755c
--- /dev/null
+++ b/rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java
@@ -0,0 +1,68 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.transport.https;
+
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.logging.Logger;
+
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.cxf.common.logging.LogUtils;
+
+/**
+ * This class provides a static method to create an array of TrustManagers, which disables TLS
+ * trust verification. This is insecure and must not be used in production, only for testing!
+ */
+public final class InsecureTrustManager {
+
+ private static final Logger LOG = LogUtils.getL7dLogger(InsecureTrustManager.class);
+
+ private InsecureTrustManager() {
+ // complete
+ }
+
+ public static TrustManager[] getNoOpX509TrustManagers() {
+ LOG.warning("This class essentially disables TLS trust verification and is insecure!");
+ return new TrustManager[] {new NoOpX509TrustManager()};
+ }
+
+ private static final class NoOpX509TrustManager implements X509TrustManager {
+
+ private NoOpX509TrustManager() {
+
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+ }
+
+ @Override
+ public X509Certificate[] getAcceptedIssuers() {
+ return null;
+ }
+
+ }
+}
diff --git a/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
new file mode 100644
index 0000000..53b1917
--- /dev/null
+++ b/rt/transports/http/src/test/java/org/apache/cxf/transport/http/osgi/HttpConduitConfigApplierTest.java
@@ -0,0 +1,105 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.transport.http.osgi;
+
+import java.io.IOException;
+import java.util.Dictionary;
+import java.util.Hashtable;
+
+import org.apache.cxf.Bus;
+import org.apache.cxf.bus.extension.ExtensionManagerBus;
+import org.apache.cxf.service.model.EndpointInfo;
+import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.http.URLConnectionHTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class HttpConduitConfigApplierTest {
+
+ @Test
+ public void testNormalTrustLoading() throws IOException {
+ HttpConduitConfigApplier configApplier = new HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "false");
+ String address = "https://localhost:12345";
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNull(conduit.getTlsClientParameters().getTrustManagers());
+ assertFalse(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+ @Test
+ public void testDisableTrustVerification() throws IOException {
+ HttpConduitConfigApplier configApplier = new HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "true");
+ configValues.put("tlsClientParameters.trustManagers.disableTrustVerification", "true");
+ String address = "https://localhost:12345";
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNotNull(conduit.getTlsClientParameters().getTrustManagers());
+ assertEquals(conduit.getTlsClientParameters().getTrustManagers().length, 1);
+ assertTrue(conduit.getTlsClientParameters().getTrustManagers()[0].getClass()
+ .getName().startsWith(InsecureTrustManager.class.getName()));
+ assertTrue(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+ @Test
+ public void testTrustVerificationEnabled() throws IOException {
+ HttpConduitConfigApplier configApplier = new HttpConduitConfigApplier();
+
+ Dictionary<String, String> configValues = new Hashtable<>();
+ configValues.put("tlsClientParameters.disableCNCheck", "true");
+ configValues.put("tlsClientParameters.trustManagers.disableTrustVerification", "false");
+ String address = "https://localhost:12345";
+ Bus bus = new ExtensionManagerBus();
+ EndpointInfo ei = new EndpointInfo();
+ ei.setAddress(address);
+ HTTPConduit conduit = new URLConnectionHTTPConduit(bus, ei, null);
+
+ configApplier.apply(configValues, conduit, address);
+
+ assertNotNull(conduit.getTlsClientParameters().getTrustManagers());
+ assertEquals(conduit.getTlsClientParameters().getTrustManagers().length, 1);
+ assertFalse(conduit.getTlsClientParameters().getTrustManagers()[0].getClass()
+ .getName().startsWith(InsecureTrustManager.class.getName()));
+ assertTrue(conduit.getTlsClientParameters().isDisableCNCheck());
+ }
+
+}
\ No newline at end of file
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
index 3370c20..c81f98c 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/ciphersuites/CipherSuitesTest.java
@@ -20,8 +20,6 @@
package org.apache.cxf.systest.https.ciphersuites;
import java.net.URL;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
@@ -30,7 +28,6 @@ import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -42,6 +39,7 @@ import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
@@ -346,9 +344,7 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -431,9 +427,7 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -480,9 +474,7 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -523,9 +515,7 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
HTTPConduit conduit = (HTTPConduit) client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
tlsParams.setTrustManagers(trustManagers);
tlsParams.setDisableCNCheck(true);
@@ -574,23 +564,4 @@ public class CipherSuitesTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
- private static class NoOpX509TrustManager implements X509TrustManager {
-
- NoOpX509TrustManager() {
- }
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
}
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
index 695f35b..2fa82a5 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/clientauth/ClientAuthTest.java
@@ -23,8 +23,6 @@ import java.io.InputStream;
import java.net.URL;
import java.security.KeyStore;
import java.security.Security;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collection;
@@ -36,7 +34,6 @@ import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
-import javax.net.ssl.X509TrustManager;
import javax.xml.ws.BindingProvider;
import org.apache.cxf.Bus;
@@ -49,6 +46,7 @@ import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.helpers.JavaUtils;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
@@ -414,9 +412,7 @@ public class ClientAuthTest extends AbstractBusClientServerTestBase {
assertNotNull("Service is null", service);
// Set up (shared) KeyManagers/TrustManagers
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
@@ -490,9 +486,7 @@ public class ClientAuthTest extends AbstractBusClientServerTestBase {
assertNotNull("Service is null", service);
// Set up (shared) KeyManagers/TrustManagers
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
+ TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
@@ -650,20 +644,4 @@ public class ClientAuthTest extends AbstractBusClientServerTestBase {
};
- private static class NoOpX509TrustManager implements X509TrustManager {
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
}
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
index 90030a0..bde5322 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
@@ -45,6 +45,7 @@ import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
import org.apache.cxf.transport.http.HTTPConduit;
+import org.apache.cxf.transport.https.InsecureTrustManager;
import org.apache.hello_world.Greeter;
import org.apache.hello_world.services.SOAPService;
@@ -124,10 +125,7 @@ public class TrustManagerTest extends AbstractBusClientServerTestBase {
}
TLSClientParameters tlsParams = new TLSClientParameters();
- X509TrustManager trustManager = new NoOpX509TrustManager();
- TrustManager[] trustManagers = new TrustManager[1];
- trustManagers[0] = trustManager;
- tlsParams.setTrustManagers(trustManagers);
+ tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
tlsParams.setDisableCNCheck(true);
Client client = ClientProxy.getClient(port);
@@ -441,31 +439,6 @@ public class TrustManagerTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
- public static TrustManager[] getNoOpX509TrustManagers() {
- return new TrustManager[] {new NoOpX509TrustManager()};
- }
-
- public static class NoOpX509TrustManager implements X509TrustManager {
-
- public NoOpX509TrustManager() {
-
- }
-
- @Override
- public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
- }
-
- @Override
- public X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- }
-
public static class ServerCertX509TrustManager implements X509TrustManager {
private String requiredServerPrincipalName;
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
index b1dfa47..47803c1 100644
--- a/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
@@ -31,7 +31,7 @@
</cxf:features>
</cxf:bus>
- <bean id="trustManagers" class="org.apache.cxf.systest.https.trust.TrustManagerTest" factory-method="getNoOpX509TrustManagers"/>
+ <bean id="trustManagers" class="org.apache.cxf.transport.https.InsecureTrustManager" factory-method="getNoOpX509TrustManagers"/>
<http:conduit name="https://localhost:.*">
<http:tlsClientParameters disableCNCheck="true">
[cxf] 01/02: Adding a test case for TlS trustManager refs in Spring
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.3.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
commit 04ad8b57f8f9261653fc00e31a0e5a985edab143
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Mar 31 13:20:59 2020 +0100
Adding a test case for TlS trustManager refs in Spring
(cherry picked from commit 7b4622f5689507e9c2415b239569d849613a1672)
---
.../cxf/systest/https/trust/TrustManagerTest.java | 33 +++++++++++++++++
.../https/trust/client-trust-manager-ref.xml | 42 ++++++++++++++++++++++
2 files changed, 75 insertions(+)
diff --git a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
index 1516342..90030a0 100644
--- a/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
+++ b/systests/transports/src/test/java/org/apache/cxf/systest/https/trust/TrustManagerTest.java
@@ -140,6 +140,35 @@ public class TrustManagerTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ // The X509TrustManager is effectively empty here so trust verification should work
+ @org.junit.Test
+ public void testNoOpX509TrustManagerTrustManagersRef() throws Exception {
+ SpringBusFactory bf = new SpringBusFactory();
+ URL busFile = TrustManagerTest.class.getResource("client-trust-manager-ref.xml");
+
+ Bus bus = bf.createBus(busFile.toString());
+ BusFactory.setDefaultBus(bus);
+ BusFactory.setThreadDefaultBus(bus);
+
+ URL url = SOAPService.WSDL_LOCATION;
+ SOAPService service = new SOAPService(url, SOAPService.SERVICE);
+ assertNotNull("Service is null", service);
+ final Greeter port = service.getHttpsPort();
+ assertNotNull("Port is null", port);
+
+ updateAddressPort(port, PORT);
+
+ // Enable Async
+ if (async) {
+ ((BindingProvider)port).getRequestContext().put("use.async.http.conduit", true);
+ }
+
+ assertEquals(port.greetMe("Kitty"), "Hello Kitty");
+
+ ((java.io.Closeable)port).close();
+ bus.shutdown(true);
+ }
+
// Here the Trust Manager checks the server cert
@org.junit.Test
public void testValidServerCertX509TrustManager() throws Exception {
@@ -412,6 +441,10 @@ public class TrustManagerTest extends AbstractBusClientServerTestBase {
bus.shutdown(true);
}
+ public static TrustManager[] getNoOpX509TrustManagers() {
+ return new TrustManager[] {new NoOpX509TrustManager()};
+ }
+
public static class NoOpX509TrustManager implements X509TrustManager {
public NoOpX509TrustManager() {
diff --git a/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
new file mode 100644
index 0000000..b1dfa47
--- /dev/null
+++ b/systests/transports/src/test/resources/org/apache/cxf/systest/https/trust/client-trust-manager-ref.xml
@@ -0,0 +1,42 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xmlns:http="http://cxf.apache.org/transports/http/configuration"
+ xmlns:jaxws="http://cxf.apache.org/jaxws"
+ xmlns:cxf="http://cxf.apache.org/core"
+ xmlns:p="http://cxf.apache.org/policy"
+ xmlns:sec="http://cxf.apache.org/configuration/security"
+ xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache [...]
+
+ <cxf:bus>
+ <cxf:features>
+ <cxf:logging/>
+ </cxf:features>
+ </cxf:bus>
+
+ <bean id="trustManagers" class="org.apache.cxf.systest.https.trust.TrustManagerTest" factory-method="getNoOpX509TrustManagers"/>
+
+ <http:conduit name="https://localhost:.*">
+ <http:tlsClientParameters disableCNCheck="true">
+ <sec:trustManagers ref="trustManagers" />
+ </http:tlsClientParameters>
+ </http:conduit>
+
+</beans>
\ No newline at end of file