You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2016/12/09 16:34:39 UTC
svn commit: r1773431 - in
/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2:
impl/nio/bootstrap/ ssl/
Author: olegk
Date: Fri Dec 9 16:34:38 2016
New Revision: 1773431
URL: http://svn.apache.org/viewvc?rev=1773431&view=rev
Log:
RFC 7540: partial implementation of HTTP/2 TLS
Added:
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java (with props)
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java (with props)
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java (with props)
Modified:
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2RequesterBootstrap.java
httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2ServerBootstrap.java
Modified: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2RequesterBootstrap.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2RequesterBootstrap.java?rev=1773431&r1=1773430&r2=1773431&view=diff
==============================================================================
--- httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2RequesterBootstrap.java (original)
+++ httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2RequesterBootstrap.java Fri Dec 9 16:34:38 2016
@@ -39,13 +39,13 @@ import org.apache.hc.core5.http.impl.Con
import org.apache.hc.core5.http.impl.nio.bootstrap.ClientEndpoint;
import org.apache.hc.core5.http.impl.nio.bootstrap.HttpAsyncRequester;
import org.apache.hc.core5.http.nio.AsyncPushConsumer;
-import org.apache.hc.core5.http.nio.ssl.BasicClientTlsStrategy;
import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
import org.apache.hc.core5.http.protocol.HttpProcessor;
import org.apache.hc.core5.http2.config.H2Config;
import org.apache.hc.core5.http2.impl.Http2Processors;
import org.apache.hc.core5.http2.impl.nio.ClientHttpProtocolNegotiatorFactory;
import org.apache.hc.core5.http2.impl.nio.Http2StreamListener;
+import org.apache.hc.core5.http2.ssl.H2ClientTlsStrategy;
import org.apache.hc.core5.pool.ConnPoolListener;
import org.apache.hc.core5.pool.StrictConnPool;
import org.apache.hc.core5.reactor.IOReactorConfig;
@@ -204,7 +204,7 @@ public class H2RequesterBootstrap {
ioReactorConfig,
ioEventHandlerFactory,
connPool,
- tlsStrategy != null ? tlsStrategy : new BasicClientTlsStrategy(),
+ tlsStrategy != null ? tlsStrategy : new H2ClientTlsStrategy(),
exceptionListener);
}
Modified: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2ServerBootstrap.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2ServerBootstrap.java?rev=1773431&r1=1773430&r2=1773431&view=diff
==============================================================================
--- httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2ServerBootstrap.java (original)
+++ httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/impl/nio/bootstrap/H2ServerBootstrap.java Fri Dec 9 16:34:38 2016
@@ -46,6 +46,7 @@ import org.apache.hc.core5.http2.config.
import org.apache.hc.core5.http2.impl.Http2Processors;
import org.apache.hc.core5.http2.impl.nio.Http2StreamListener;
import org.apache.hc.core5.http2.impl.nio.ServerHttpProtocolNegotiatorFactory;
+import org.apache.hc.core5.http2.ssl.H2ServerTlsStrategy;
import org.apache.hc.core5.net.InetAddressUtils;
import org.apache.hc.core5.reactor.IOReactorConfig;
import org.apache.hc.core5.util.Args;
@@ -205,7 +206,7 @@ public class H2ServerBootstrap {
exchangeHandlerFactory,
charset != null ? charset : StandardCharsets.US_ASCII,
h2Config != null ? h2Config : H2Config.DEFAULT,
- tlsStrategy,
+ tlsStrategy != null ? tlsStrategy : new H2ServerTlsStrategy(new int[] {443, 8443}),
connectionListener,
streamListener);
return new HttpAsyncServer(
Added: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java?rev=1773431&view=auto
==============================================================================
--- httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java (added)
+++ httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java Fri Dec 9 16:34:38 2016
@@ -0,0 +1,100 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http2.ssl;
+
+import java.net.SocketAddress;
+
+import javax.net.ssl.SSLContext;
+
+import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
+import org.apache.hc.core5.reactor.ssl.SSLBufferManagement;
+import org.apache.hc.core5.reactor.ssl.SSLSessionInitializer;
+import org.apache.hc.core5.reactor.ssl.SSLSessionVerifier;
+import org.apache.hc.core5.reactor.ssl.TlsCapable;
+import org.apache.hc.core5.ssl.SSLContexts;
+import org.apache.hc.core5.util.Args;
+
+/**
+ * Basic client-side implementation of {@link TlsStrategy} that upgrades to TLS for all endpoints
+ * with {@code HTTPS} scheme.
+ *
+ * @since 5.0
+ */
+public class H2ClientTlsStrategy implements TlsStrategy {
+
+ private final SSLContext sslContext;
+ private final SSLBufferManagement sslBufferManagement;
+ private final SSLSessionInitializer initializer;
+ private final SSLSessionVerifier verifier;
+
+ public H2ClientTlsStrategy(
+ final SSLContext sslContext,
+ final SSLBufferManagement sslBufferManagement,
+ final SSLSessionInitializer initializer,
+ final SSLSessionVerifier verifier) {
+ this.sslContext = Args.notNull(sslContext, "SSL context");
+ this.sslBufferManagement = sslBufferManagement;
+ this.initializer = initializer;
+ this.verifier = verifier;
+ }
+
+ public H2ClientTlsStrategy(
+ final SSLContext sslContext,
+ final SSLSessionInitializer initializer,
+ final SSLSessionVerifier verifier) {
+ this(sslContext, null, initializer, verifier);
+ }
+
+ public H2ClientTlsStrategy(
+ final SSLContext sslContext,
+ final SSLSessionVerifier verifier) {
+ this(sslContext, null, null, verifier);
+ }
+
+ public H2ClientTlsStrategy(final SSLContext sslContext) {
+ this(sslContext, null, null, null);
+ }
+
+ public H2ClientTlsStrategy() {
+ this(SSLContexts.createSystemDefault());
+ }
+
+ @Override
+ public void upgrade(
+ final TlsCapable tlsCapable,
+ final String scheme,
+ final SocketAddress localAddress,
+ final SocketAddress remoteAddress,
+ final String... parameters) {
+ if ("https".equalsIgnoreCase(scheme)) {
+ tlsCapable.startTls(sslContext, sslBufferManagement,
+ H2TlsSupport.decorateInitializer(initializer), verifier);
+ }
+ }
+
+}
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java
------------------------------------------------------------------------------
svn:keywords = Date Revision
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ClientTlsStrategy.java
------------------------------------------------------------------------------
svn:mime-type = text/plain
Added: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java?rev=1773431&view=auto
==============================================================================
--- httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java (added)
+++ httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java Fri Dec 9 16:34:38 2016
@@ -0,0 +1,110 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http2.ssl;
+
+import java.net.InetSocketAddress;
+import java.net.SocketAddress;
+
+import javax.net.ssl.SSLContext;
+
+import org.apache.hc.core5.http.nio.ssl.TlsStrategy;
+import org.apache.hc.core5.reactor.ssl.SSLBufferManagement;
+import org.apache.hc.core5.reactor.ssl.SSLSessionInitializer;
+import org.apache.hc.core5.reactor.ssl.SSLSessionVerifier;
+import org.apache.hc.core5.reactor.ssl.TlsCapable;
+import org.apache.hc.core5.ssl.SSLContexts;
+import org.apache.hc.core5.util.Args;
+
+/**
+ * Basic side-side implementation of {@link TlsStrategy} that upgrades to TLS for endpoints
+ * with the specified local ports.
+ *
+ * @since 5.0
+ */
+public class H2ServerTlsStrategy implements TlsStrategy {
+
+ private final int[] securePorts;
+ private final SSLContext sslContext;
+ private final SSLBufferManagement sslBufferManagement;
+ private final SSLSessionInitializer initializer;
+ private final SSLSessionVerifier verifier;
+
+ public H2ServerTlsStrategy(
+ final int[] securePorts,
+ final SSLContext sslContext,
+ final SSLBufferManagement sslBufferManagement,
+ final SSLSessionInitializer initializer,
+ final SSLSessionVerifier verifier) {
+ this.securePorts = Args.notNull(securePorts, "Array of ports");
+ this.sslContext = Args.notNull(sslContext, "SSL context");
+ this.sslBufferManagement = sslBufferManagement;
+ this.initializer = initializer;
+ this.verifier = verifier;
+ }
+
+ public H2ServerTlsStrategy(
+ final int[] securePorts,
+ final SSLContext sslContext,
+ final SSLSessionInitializer initializer,
+ final SSLSessionVerifier verifier) {
+ this(securePorts, sslContext, null, initializer, verifier);
+ }
+
+ public H2ServerTlsStrategy(
+ final int[] securePorts,
+ final SSLContext sslContext,
+ final SSLSessionVerifier verifier) {
+ this(securePorts, sslContext, null, null, verifier);
+ }
+
+ public H2ServerTlsStrategy(final int[] securePorts, final SSLContext sslContext) {
+ this(securePorts, sslContext, null, null, null);
+ }
+
+ public H2ServerTlsStrategy(final int[] securePorts) {
+ this(securePorts, SSLContexts.createSystemDefault());
+ }
+
+ @Override
+ public void upgrade(
+ final TlsCapable tlsCapable,
+ final String scheme,
+ final SocketAddress localAddress,
+ final SocketAddress remoteAddress,
+ final String... parameters) {
+ final int port = ((InetSocketAddress) localAddress).getPort();
+ for (int securePort: securePorts) {
+ if (port == securePort) {
+ tlsCapable.startTls(sslContext, sslBufferManagement,
+ H2TlsSupport.decorateInitializer(initializer), verifier);
+ break;
+ }
+ }
+ }
+
+}
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java
------------------------------------------------------------------------------
svn:keywords = Date Revision
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2ServerTlsStrategy.java
------------------------------------------------------------------------------
svn:mime-type = text/plain
Added: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java
URL: http://svn.apache.org/viewvc/httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java?rev=1773431&view=auto
==============================================================================
--- httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java (added)
+++ httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java Fri Dec 9 16:34:38 2016
@@ -0,0 +1,376 @@
+/*
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation. For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.hc.core5.http2.ssl;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.concurrent.CopyOnWriteArraySet;
+
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLException;
+
+import org.apache.hc.core5.reactor.ssl.SSLSessionInitializer;
+
+final class H2TlsSupport {
+
+ private final static String[] PROTOCOL_BLACKLIST = {
+ "TLSv1",
+ "TLSv1.1"
+ };
+
+ private final static String[] CIPHER_BLACKLIST = {
+ "TLS_NULL_WITH_NULL_NULL",
+ "TLS_RSA_WITH_NULL_MD5",
+ "TLS_RSA_WITH_NULL_SHA",
+ "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
+ "TLS_RSA_WITH_RC4_128_MD5",
+ "TLS_RSA_WITH_RC4_128_SHA",
+ "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
+ "TLS_RSA_WITH_IDEA_CBC_SHA",
+ "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_RSA_WITH_DES_CBC_SHA",
+ "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_DH_DSS_WITH_DES_CBC_SHA",
+ "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_DH_RSA_WITH_DES_CBC_SHA",
+ "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_DHE_DSS_WITH_DES_CBC_SHA",
+ "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_DHE_RSA_WITH_DES_CBC_SHA",
+ "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
+ "TLS_DH_anon_WITH_RC4_128_MD5",
+ "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
+ "TLS_DH_anon_WITH_DES_CBC_SHA",
+ "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA",
+ "TLS_KRB5_WITH_DES_CBC_SHA",
+ "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
+ "TLS_KRB5_WITH_RC4_128_SHA",
+ "TLS_KRB5_WITH_IDEA_CBC_SHA",
+ "TLS_KRB5_WITH_DES_CBC_MD5",
+ "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
+ "TLS_KRB5_WITH_RC4_128_MD5",
+ "TLS_KRB5_WITH_IDEA_CBC_MD5",
+ "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
+ "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
+ "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
+ "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
+ "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
+ "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
+ "TLS_PSK_WITH_NULL_SHA",
+ "TLS_DHE_PSK_WITH_NULL_SHA",
+ "TLS_RSA_PSK_WITH_NULL_SHA",
+ "TLS_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
+ "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
+ "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_DH_anon_WITH_AES_128_CBC_SHA",
+ "TLS_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
+ "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
+ "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_DH_anon_WITH_AES_256_CBC_SHA",
+ "TLS_RSA_WITH_NULL_SHA256",
+ "TLS_RSA_WITH_AES_128_CBC_SHA256",
+ "TLS_RSA_WITH_AES_256_CBC_SHA256",
+ "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
+ "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
+ "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
+ "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA",
+ "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
+ "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
+ "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
+ "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
+ "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
+ "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
+ "TLS_DH_anon_WITH_AES_256_CBC_SHA256",
+ "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
+ "TLS_PSK_WITH_RC4_128_SHA",
+ "TLS_PSK_WITH_3DES_EDE_CBC_SHA",
+ "TLS_PSK_WITH_AES_128_CBC_SHA",
+ "TLS_PSK_WITH_AES_256_CBC_SHA",
+ "TLS_DHE_PSK_WITH_RC4_128_SHA",
+ "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
+ "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
+ "TLS_DHE_PSK_WITH_AES_256_CBC_SHA",
+ "TLS_RSA_PSK_WITH_RC4_128_SHA",
+ "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
+ "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
+ "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
+ "TLS_RSA_WITH_SEED_CBC_SHA",
+ "TLS_DH_DSS_WITH_SEED_CBC_SHA",
+ "TLS_DH_RSA_WITH_SEED_CBC_SHA",
+ "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
+ "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
+ "TLS_DH_anon_WITH_SEED_CBC_SHA",
+ "TLS_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
+ "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
+ "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
+ "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
+ "TLS_PSK_WITH_AES_128_GCM_SHA256",
+ "TLS_PSK_WITH_AES_256_GCM_SHA384",
+ "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
+ "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
+ "TLS_PSK_WITH_AES_128_CBC_SHA256",
+ "TLS_PSK_WITH_AES_256_CBC_SHA384",
+ "TLS_PSK_WITH_NULL_SHA256",
+ "TLS_PSK_WITH_NULL_SHA384",
+ "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
+ "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
+ "TLS_DHE_PSK_WITH_NULL_SHA256",
+ "TLS_DHE_PSK_WITH_NULL_SHA384",
+ "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
+ "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
+ "TLS_RSA_PSK_WITH_NULL_SHA256",
+ "TLS_RSA_PSK_WITH_NULL_SHA384",
+ "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256",
+ "TLS_EMPTY_RENEGOTIATION_INFO_SCSV",
+ "TLS_ECDH_ECDSA_WITH_NULL_SHA",
+ "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
+ "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
+ "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
+ "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
+ "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+ "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+ "TLS_ECDH_RSA_WITH_NULL_SHA",
+ "TLS_ECDH_RSA_WITH_RC4_128_SHA",
+ "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_ECDHE_RSA_WITH_NULL_SHA",
+ "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+ "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_ECDH_anon_WITH_NULL_SHA",
+ "TLS_ECDH_anon_WITH_RC4_128_SHA",
+ "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
+ "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
+ "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
+ "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
+ "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
+ "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
+ "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
+ "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
+ "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
+ "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
+ "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
+ "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
+ "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
+ "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+ "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+ "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
+ "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
+ "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
+ "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
+ "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
+ "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
+ "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
+ "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
+ "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
+ "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
+ "TLS_ECDHE_PSK_WITH_NULL_SHA",
+ "TLS_ECDHE_PSK_WITH_NULL_SHA256",
+ "TLS_ECDHE_PSK_WITH_NULL_SHA384",
+ "TLS_RSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_RSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DH_anon_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DH_anon_WITH_ARIA_256_CBC_SHA384",
+ "TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256",
+ "TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384",
+ "TLS_RSA_WITH_ARIA_128_GCM_SHA256",
+ "TLS_RSA_WITH_ARIA_256_GCM_SHA384",
+ "TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256",
+ "TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384",
+ "TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256",
+ "TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384",
+ "TLS_DH_anon_WITH_ARIA_128_GCM_SHA256",
+ "TLS_DH_anon_WITH_ARIA_256_GCM_SHA384",
+ "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256",
+ "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384",
+ "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256",
+ "TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384",
+ "TLS_PSK_WITH_ARIA_128_CBC_SHA256",
+ "TLS_PSK_WITH_ARIA_256_CBC_SHA384",
+ "TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256",
+ "TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384",
+ "TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256",
+ "TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384",
+ "TLS_PSK_WITH_ARIA_128_GCM_SHA256",
+ "TLS_PSK_WITH_ARIA_256_GCM_SHA384",
+ "TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256",
+ "TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384",
+ "TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256",
+ "TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384",
+ "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256",
+ "TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384",
+ "TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256",
+ "TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384",
+ "TLS_RSA_WITH_AES_128_CCM",
+ "TLS_RSA_WITH_AES_256_CCM",
+ "TLS_RSA_WITH_AES_128_CCM_8",
+ "TLS_RSA_WITH_AES_256_CCM_8",
+ "TLS_PSK_WITH_AES_128_CCM",
+ "TLS_PSK_WITH_AES_256_CCM",
+ "TLS_PSK_WITH_AES_128_CCM_8",
+ "TLS_PSK_WITH_AES_256_CCM_8" };
+
+ private final static Set<String> BLACKLISED_PROTOCOLS = new CopyOnWriteArraySet<>(Arrays.asList(PROTOCOL_BLACKLIST));
+ private final static Set<String> BLACKLISED_CIPHERS = new CopyOnWriteArraySet<>(Arrays.asList(CIPHER_BLACKLIST));
+
+ public static String[] excludeBlacklistedProtocols(final String[] protocols) {
+ if (protocols == null) {
+ return null;
+ }
+ List<String> enabledProtocols = null;
+ for (String protocol: protocols) {
+ if (!protocol.startsWith("SSL") && !BLACKLISED_PROTOCOLS.contains(protocol)) {
+ if (enabledProtocols == null) {
+ enabledProtocols = new ArrayList<>();
+ }
+ enabledProtocols.add(protocol);
+ }
+ }
+ return enabledProtocols != null ? enabledProtocols.toArray(new String[enabledProtocols.size()]) : protocols;
+ }
+
+ public static String[] excludeBlacklistedCiphers(final String[] ciphers) {
+ if (ciphers == null) {
+ return null;
+ }
+ List<String> enabledCiphers = null;
+ for (String cipher: ciphers) {
+ if (!BLACKLISED_CIPHERS.contains(cipher)) {
+ if (enabledCiphers == null) {
+ enabledCiphers = new ArrayList<>();
+ }
+ enabledCiphers.add(cipher);
+ }
+ }
+ return enabledCiphers != null ? enabledCiphers.toArray(new String[enabledCiphers.size()]) : ciphers;
+ }
+
+ public static SSLSessionInitializer decorateInitializer(final SSLSessionInitializer initializer) {
+ return new SSLSessionInitializer() {
+
+ @Override
+ public void initialize(final SSLEngine sslengine) throws SSLException {
+ sslengine.setEnabledProtocols(H2TlsSupport.excludeBlacklistedProtocols(sslengine.getEnabledProtocols()));
+ sslengine.setEnabledCipherSuites(H2TlsSupport.excludeBlacklistedCiphers(sslengine.getEnabledCipherSuites()));
+ if (initializer != null) {
+ initializer.initialize(sslengine);
+ }
+ }
+
+ };
+ }
+
+}
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java
------------------------------------------------------------------------------
svn:keywords = Date Revision
Propchange: httpcomponents/httpcore/trunk/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/ssl/H2TlsSupport.java
------------------------------------------------------------------------------
svn:mime-type = text/plain