create();
builder.register("http", PlainConnectionSocketFactory.getSocketFactory());
- builder.register("https", SSLConnectionSocketFactory.getSystemSocketFactory());
+
+ // logic to turn off peer host check
+ SSLConnectionSocketFactory sslConnectionSocketFactory = null;
+ boolean sslCheckPeerName = toBooleanDefaultIfNull(
+ toBooleanObject(System.getProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME)), true);
+ if (sslCheckPeerName) {
+ sslConnectionSocketFactory = SSLConnectionSocketFactory.getSystemSocketFactory();
+ } else {
+ sslConnectionSocketFactory = new SSLConnectionSocketFactory(SSLContexts.createSystemDefault(),
+ NoopHostnameVerifier.INSTANCE);
+ logger.debug(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME + "is false, hostname checks disabled.");
+ }
+ builder.register("https", sslConnectionSocketFactory);
+
return builder.build();
}
}
@@ -459,5 +489,26 @@ public class HttpClientUtil {
cookiePolicy = policyName;
}
+ /**
+ * @lucene.internal
+ */
+ static boolean toBooleanDefaultIfNull(Boolean bool, boolean valueIfNull) {
+ if (bool == null) {
+ return valueIfNull;
+ }
+ return bool.booleanValue() ? true : false;
+ }
+ /**
+ * @lucene.internal
+ */
+ static Boolean toBooleanObject(String str) {
+ if ("true".equalsIgnoreCase(str)) {
+ return Boolean.TRUE;
+ } else if ("false".equalsIgnoreCase(str)) {
+ return Boolean.FALSE;
+ }
+ // no match
+ return null;
+ }
}
diff --git a/solr/solrj/src/test/org/apache/solr/client/solrj/impl/HttpClientUtilTest.java b/solr/solrj/src/test/org/apache/solr/client/solrj/impl/HttpClientUtilTest.java
new file mode 100644
index 00000000000..ce2f8b7875d
--- /dev/null
+++ b/solr/solrj/src/test/org/apache/solr/client/solrj/impl/HttpClientUtilTest.java
@@ -0,0 +1,108 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.solr.client.solrj.impl;
+
+import javax.net.ssl.HostnameVerifier;
+import java.io.IOException;
+
+import org.apache.solr.client.solrj.impl.HttpClientUtil.SchemaRegistryProvider;
+
+import org.apache.commons.lang.reflect.FieldUtils;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.lucene.util.LuceneTestCase;
+import org.apache.lucene.util.TestRuleRestoreSystemProperties;
+
+import org.junit.After;
+import org.junit.Rule;
+import org.junit.rules.TestRule;
+import org.junit.Test;
+
+public class HttpClientUtilTest extends LuceneTestCase {
+
+ @Rule
+ public TestRule syspropRestore = new TestRuleRestoreSystemProperties
+ (HttpClientUtil.SYS_PROP_CHECK_PEER_NAME);
+
+ @After
+ public void resetHttpClientBuilder() {
+ HttpClientUtil.resetHttpClientBuilder();
+ }
+
+ public void testSSLSystemProperties() throws IOException {
+
+ assertNotNull("HTTPS scheme could not be created using system defaults",
+ HttpClientUtil.getSchemaRegisteryProvider().getSchemaRegistry().lookup("https"));
+
+ assertSSLHostnameVerifier(DefaultHostnameVerifier.class, HttpClientUtil.getSchemaRegisteryProvider());
+
+ System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "true");
+ resetHttpClientBuilder();
+ assertSSLHostnameVerifier(DefaultHostnameVerifier.class, HttpClientUtil.getSchemaRegisteryProvider());
+
+ System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "");
+ resetHttpClientBuilder();
+ assertSSLHostnameVerifier(DefaultHostnameVerifier.class, HttpClientUtil.getSchemaRegisteryProvider());
+
+ System.setProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME, "false");
+ resetHttpClientBuilder();
+ assertSSLHostnameVerifier(NoopHostnameVerifier.class, HttpClientUtil.getSchemaRegisteryProvider());
+ }
+
+ private void assertSSLHostnameVerifier(Class expected,
+ SchemaRegistryProvider provider) {
+ ConnectionSocketFactory socketFactory = provider.getSchemaRegistry().lookup("https");
+ assertNotNull("unable to lookup https", socketFactory);
+ assertTrue("socketFactory is not an SSLConnectionSocketFactory: " + socketFactory.getClass(),
+ socketFactory instanceof SSLConnectionSocketFactory);
+ SSLConnectionSocketFactory sslSocketFactory = (SSLConnectionSocketFactory) socketFactory;
+ try {
+ Object hostnameVerifier = FieldUtils.readField(sslSocketFactory, "hostnameVerifier", true);
+ assertNotNull("sslSocketFactory has null hostnameVerifier", hostnameVerifier);
+ assertEquals("sslSocketFactory does not have expected hostnameVerifier impl",
+ expected, hostnameVerifier.getClass());
+ } catch (IllegalAccessException e) {
+ throw new AssertionError("Unexpected access error reading hostnameVerifier field", e);
+ }
+ }
+
+ @Test
+ public void testToBooleanDefaultIfNull() throws Exception {
+ assertFalse(HttpClientUtil.toBooleanDefaultIfNull(Boolean.FALSE, true));
+ assertTrue(HttpClientUtil.toBooleanDefaultIfNull(Boolean.TRUE, false));
+ assertFalse(HttpClientUtil.toBooleanDefaultIfNull(null, false));
+ assertTrue(HttpClientUtil.toBooleanDefaultIfNull(null, true));
+ }
+
+ @Test
+ public void testToBooleanObject() throws Exception {
+ assertEquals(Boolean.TRUE, HttpClientUtil.toBooleanObject("true"));
+ assertEquals(Boolean.TRUE, HttpClientUtil.toBooleanObject("TRUE"));
+ assertEquals(Boolean.TRUE, HttpClientUtil.toBooleanObject("tRuE"));
+
+ assertEquals(Boolean.FALSE, HttpClientUtil.toBooleanObject("false"));
+ assertEquals(Boolean.FALSE, HttpClientUtil.toBooleanObject("FALSE"));
+ assertEquals(Boolean.FALSE, HttpClientUtil.toBooleanObject("fALSE"));
+
+ assertEquals(null, HttpClientUtil.toBooleanObject("t"));
+ assertEquals(null, HttpClientUtil.toBooleanObject("f"));
+ assertEquals(null, HttpClientUtil.toBooleanObject("foo"));
+ assertEquals(null, HttpClientUtil.toBooleanObject(null));
+ }
+}
diff --git a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
index 8268fcdcc11..3b03f6e1711 100644
--- a/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
+++ b/solr/test-framework/src/java/org/apache/solr/util/SSLTestConfig.java
@@ -16,8 +16,6 @@
*/
package org.apache.solr.util;
-import javax.net.ssl.SSLContext;
-import java.io.IOException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
@@ -27,15 +25,17 @@ import java.security.SecureRandomSpi;
import java.security.UnrecoverableKeyException;
import java.util.Random;
+import javax.net.ssl.SSLContext;
+
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLContextBuilder;
-import org.apache.http.conn.ssl.SSLContexts;
-import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.ssl.SSLContexts;
import org.apache.solr.client.solrj.embedded.SSLConfig;
import org.apache.solr.client.solrj.impl.HttpClientUtil;
import org.apache.solr.client.solrj.impl.HttpClientUtil.SchemaRegistryProvider;
@@ -49,9 +49,11 @@ import org.eclipse.jetty.util.ssl.SslContextFactory;
*/
public class SSLTestConfig extends SSLConfig {
- private static final String TEST_KEYSTORE_RESOURCE = "SSLTestConfig.testing.keystore";
+ private static final String TEST_KEYSTORE_BOGUSHOST_RESOURCE = "SSLTestConfig.hostname-and-ip-missmatch.keystore";
+ private static final String TEST_KEYSTORE_LOCALHOST_RESOURCE = "SSLTestConfig.testing.keystore";
private static final String TEST_KEYSTORE_PASSWORD = "secret";
+ private final boolean checkPeerName;
private final Resource keyStore;
private final Resource trustStore;
@@ -59,44 +61,59 @@ public class SSLTestConfig extends SSLConfig {
public SSLTestConfig() {
this(false, false);
}
-
- /**
- * Create an SSLTestConfig based on a few caller specified options. As needed,
- * keystore/truststore information will be pulled from a hardocded resource file provided
- * by the solr test-framework.
+
+ /**
+ * Create an SSLTestConfig based on a few caller specified options,
+ * implicitly assuming checkPeerName=false.
+ *
+ * As needed, keystore/truststore information will be pulled from a hardcoded resource
+ * file provided by the solr test-framework
+ *
*
- * @param useSSL - wether SSL should be required.
+ * @param useSSL - whether SSL should be required.
* @param clientAuth - whether client authentication should be required.
*/
public SSLTestConfig(boolean useSSL, boolean clientAuth) {
+ this(useSSL, clientAuth, false);
+ }
+
+ // NOTE: if any javadocs below change, update create-keystores.sh
+ /**
+ * Create an SSLTestConfig based on a few caller specified options. As needed,
+ * keystore/truststore information will be pulled from a hardcoded resource files provided
+ * by the solr test-framework based on the value of checkPeerName:
+ *
+ * true - A keystore resource file will be used that specifies
+ * a CN of localhost and a SAN IP of 127.0.0.1, to
+ * ensure that all connections should be valid regardless of what machine runs the tests.false - A keystore resource file will be used that specifies
+ * a bogus hostname in the CN and reserved IP as the SAN, since no (valid) tests using this
+ * SSLTestConfig should care what CN/SAN are.
+ *
+ * @param useSSL - whether SSL should be required.
+ * @param clientAuth - whether client authentication should be required.
+ * @param checkPeerName - whether the client should validate the 'peer name' of the SSL Certificate (and which testing Cert should be used)
+ * @see HttpClientUtil#SYS_PROP_CHECK_PEER_NAME
+ */
+ public SSLTestConfig(boolean useSSL, boolean clientAuth, boolean checkPeerName) {
super(useSSL, clientAuth, null, TEST_KEYSTORE_PASSWORD, null, TEST_KEYSTORE_PASSWORD);
- trustStore = keyStore = Resource.newClassPathResource(TEST_KEYSTORE_RESOURCE);
+ this.checkPeerName = checkPeerName;
+
+ final String resourceName = checkPeerName
+ ? TEST_KEYSTORE_LOCALHOST_RESOURCE : TEST_KEYSTORE_BOGUSHOST_RESOURCE;
+ trustStore = keyStore = Resource.newClassPathResource(resourceName);
if (null == keyStore || ! keyStore.exists() ) {
throw new IllegalStateException("Unable to locate keystore resource file in classpath: "
- + TEST_KEYSTORE_RESOURCE);
+ + resourceName);
}
}
- /**
- * Helper utility for building resources from arbitrary user input paths/urls
- * if input is null, returns null; otherwise attempts to build Resource and verifies that Resource exists.
- */
- private static final Resource tryNewResource(String userInput, String type) {
- if (null == userInput) {
- return null;
- }
- Resource result;
- try {
- result = Resource.newResource(userInput);
- } catch (IOException e) {
- throw new IllegalArgumentException("Can't build " + type + " Resource: " + e.getMessage(), e);
- }
- if (! result.exists()) {
- throw new IllegalArgumentException(type + " Resource does not exist " + result.getName());
- }
- return result;
+ /** If true, then servers hostname/ip should be validated against the SSL Cert metadata */
+ public boolean getCheckPeerName() {
+ return checkPeerName;
}
-
+
/**
* NOTE: This method is meaningless in SSLTestConfig.
* @return null
@@ -175,7 +192,7 @@ public class SSLTestConfig extends SSLConfig {
SSLContextBuilder builder = SSLContexts.custom();
builder.setSecureRandom(NotSecurePsuedoRandom.INSTANCE);
-
+
builder.loadKeyMaterial(buildKeyStore(keyStore, getKeyStorePassword()), getKeyStorePassword().toCharArray());
if (isClientAuthMode()) {
@@ -229,11 +246,9 @@ public class SSLTestConfig extends SSLConfig {
}
SSLConnectionSocketFactory sslConnectionFactory;
try {
- boolean sslCheckPeerName = toBooleanDefaultIfNull(toBooleanObject(System.getProperty(HttpClientUtil.SYS_PROP_CHECK_PEER_NAME)), true);
SSLContext sslContext = buildClientSSLContext();
- if (sslCheckPeerName == false) {
- sslConnectionFactory = new SSLConnectionSocketFactory
- (sslContext, SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
+ if (checkPeerName == false) {
+ sslConnectionFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
} else {
sslConnectionFactory = new SSLConnectionSocketFactory(sslContext);
}
diff --git a/solr/test-framework/src/resources/SSLTestConfig.hostname-and-ip-missmatch.keystore b/solr/test-framework/src/resources/SSLTestConfig.hostname-and-ip-missmatch.keystore
new file mode 100644
index 00000000000..691a3bee025
Binary files /dev/null and b/solr/test-framework/src/resources/SSLTestConfig.hostname-and-ip-missmatch.keystore differ
diff --git a/solr/test-framework/src/resources/SSLTestConfig.testing.keystore b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore
index bcc6ec05d71..4fdb494f1bc 100644
Binary files a/solr/test-framework/src/resources/SSLTestConfig.testing.keystore and b/solr/test-framework/src/resources/SSLTestConfig.testing.keystore differ
diff --git a/solr/test-framework/src/resources/create-keystores.sh b/solr/test-framework/src/resources/create-keystores.sh
new file mode 100755
index 00000000000..0b43f288ba6
--- /dev/null
+++ b/solr/test-framework/src/resources/create-keystores.sh
@@ -0,0 +1,37 @@
+#!/bin/bash -ex
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+############
+
+# This script shows how the keystore files used for solr tests were generated.
+#
+# Running this script should only be necessary if the keystore files need to be
+# replaced, which shouldn't be required until sometime around the year 4751.
+
+# NOTE: if anything below changes, sanity check SSLTestConfig constructor javadocs
+
+echo "### remove old keystores"
+rm -f SSLTestConfig.testing.keystore SSLTestConfig.hostname-and-ip-missmatch.keystore
+
+echo "### create 'localhost' keystore and keys"
+keytool -keystore SSLTestConfig.testing.keystore -storepass "secret" -alias solrtest -keypass "secret" -genkey -keyalg RSA -dname "cn=localhost, ou=SolrTest, o=lucene.apache.org, c=US" -ext "san=dns:localhost,ip:127.0.0.1" -validity 999999
+
+# See https://tools.ietf.org/html/rfc5737
+echo "### create 'Bogus Host' keystore and keys"
+keytool -keystore SSLTestConfig.hostname-and-ip-missmatch.keystore -storepass "secret" -alias solrtest -keypass "secret" -genkey -keyalg RSA -dname "cn=bogus.hostname.tld, ou=SolrTest, o=lucene.apache.org, c=US" -ext "san=dns:bogus.hostname.tld,ip:192.0.2.0" -validity 999999
+
+