Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CXF-8668]:Set SniHostCheck to false for SSLNettyClientTest #918

Merged
merged 1 commit into from Apr 7, 2022
Merged

[CXF-8668]:Set SniHostCheck to false for SSLNettyClientTest #918

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 14 additions & 0 deletions core/src/main/java/org/apache/cxf/configuration/jsse/TLSServerParameters.java
View file
Open in desktop
Expand Up @@ -33,6 +33,7 @@ public class TLSServerParameters extends TLSParameterBase {
ClientAuthentication clientAuthentication;
List<String> excludeProtocols = new ArrayList<>();
List<String> includeProtocols = new ArrayList<>();
boolean sniHostCheck;

/**
* This parameter configures the server side to request and/or
Expand Down Expand Up @@ -83,4 +84,17 @@ public List<String> getIncludeProtocols() {
return includeProtocols;
}

/**
* Returns if the SNI host name must match
*/
public boolean isSniHostCheck() {
return sniHostCheck;
}

/**
* @param sniHostCheck if the SNI host name must match
*/
public void setSniHostCheck(boolean sniHostCheck) {
this.sniHostCheck = sniHostCheck;
}
}
3 changes: 3 additions & 0 deletions core/src/main/java/org/apache/cxf/configuration/jsse/TLSServerParametersConfig.java
View file
Open in desktop
Expand Up @@ -92,6 +92,9 @@ public TLSServerParametersConfig(TLSServerParametersType params)
if (params.isSetCertAlias()) {
this.setCertAlias(params.getCertAlias());
}
if (params.isSetSniHostCheck()) {
this.setSniHostCheck(params.isSniHostCheck());
}
if (iparams != null && iparams.isSetKeyManagersRef()) {
this.setKeyManagers(iparams.getKeyManagersRef());
}
Expand Down
7 changes: 7 additions & 0 deletions core/src/main/resources/schemas/configuration/security.xsd
View file
Open in desktop
Expand Up @@ -657,5 +657,12 @@
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="sniHostCheck" type="pt:ParameterizedBoolean" default="true">
<xs:annotation>
<xs:documentation>
If the SNI host name must match.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:schema>
3 changes: 2 additions & 1 deletion ...s/http-jetty/src/main/java/org/apache/cxf/transport/http_jetty/JettyHTTPServerEngine.java
View file
Open in desktop
Expand Up @@ -68,6 +68,7 @@
import org.eclipse.jetty.server.HttpConnectionFactory;
import org.eclipse.jetty.server.Request;
import org.eclipse.jetty.server.Response;
import org.eclipse.jetty.server.SecureRequestCustomizer;
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.server.SslConnectionFactory;
Expand Down Expand Up @@ -679,7 +680,7 @@ AbstractConnector createConnectorJetty(SslContextFactory sslcf, String hosto, in
result = new org.eclipse.jetty.server.ServerConnector(server);

if (tlsServerParameters != null) {
httpConfig.addCustomizer(new org.eclipse.jetty.server.SecureRequestCustomizer());
httpConfig.addCustomizer(new SecureRequestCustomizer(tlsServerParameters.isSniHostCheck()));

if (!isHttp2Enabled(bus)) {
final SslConnectionFactory scf = new SslConnectionFactory(sslcf, httpFactory.getProtocol());
Expand Down
2 changes: 1 addition & 1 deletion ...rc/test/resources/org/apache/cxf/transport/http/netty/client/integration/ServerConfig.xml
View file
Open in desktop
Expand Up @@ -31,7 +31,7 @@
<bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"/>
<httpj:engine-factory>
<httpj:engine port="${SSLNettyClientTest.port}">
<httpj:tlsServerParameters>
<httpj:tlsServerParameters sniHostCheck="false">
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

false is the default, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@reta Sorry for long delay, I missed this comment. Yes, false is the default for backward compatibility.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

np at all, 👍

<sec:keyManagers keyPassword="skpass">
<sec:keyStore type="jks" password="sspass" resource="keys/servicestore.jks"/>
</sec:keyManagers>
Expand Down