Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4386 from eclipse/jetty-9.4.x-4385-sslcontextfactory-sni-noexception 

Issue #4385 - Limit new UnsupportedOperationException to direct SslContextFactory usage
This commit is contained in:
Joakim Erdfelt 2019-12-03 10:05:56 -06:00 committed by GitHub
parent db9ad2fcec d1376c71eb
commit a5e31dce20
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 29 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java
View File

@ -1249,10 +1249,17 @@ public class SslContextFactory extends AbstractLifeCycle implements Dumpable
// Is SNI needed to select a certificate?
if (!_certWilds.isEmpty() || _certHosts.size() > 1 || (_certHosts.size() == 1 && _aliasX509.size() > 1))
{
for (int idx = 0; idx < managers.length; idx++)
if (this instanceof SslContextFactory.Server)
{
if (managers[idx] instanceof X509ExtendedKeyManager)
managers[idx] = newSniX509ExtendedKeyManager((X509ExtendedKeyManager)managers[idx]);
for (int idx = 0; idx < managers.length; idx++)
{
if (managers[idx] instanceof X509ExtendedKeyManager)
managers[idx] = newSniX509ExtendedKeyManager((X509ExtendedKeyManager)managers[idx]);
}
}
else
{
LOG.warn("Unable to support SNI on {} (expecting {})", this.getClass().getName(), SslContextFactory.Server.class.getName());
}
}
}
@ -1270,7 +1277,7 @@ public class SslContextFactory extends AbstractLifeCycle implements Dumpable
@Deprecated
protected X509ExtendedKeyManager newSniX509ExtendedKeyManager(X509ExtendedKeyManager keyManager)
{
throw new UnsupportedOperationException("X509ExtendedKeyManager only supported on Server");
throw new UnsupportedOperationException("X509ExtendedKeyManager only supported on " + SslContextFactory.Server.class.getName());
}
protected TrustManager[] getTrustManagers(KeyStore trustStore, Collection<? extends CRL> crls) throws Exception

22
jetty-util/src/test/java/org/eclipse/jetty/util/ssl/X509Test.java
View File

@ -18,10 +18,13 @@
package org.eclipse.jetty.util.ssl;
import java.nio.file.Path;
import java.security.cert.X509Certificate;
import javax.net.ssl.KeyManager;
import javax.net.ssl.X509ExtendedKeyManager;
import org.eclipse.jetty.toolchain.test.MavenTestingUtils;
import org.eclipse.jetty.util.resource.PathResource;
import org.eclipse.jetty.util.resource.Resource;
import org.junit.jupiter.api.Test;
@ -161,8 +164,19 @@ public class X509Test
{
SslContextFactory baseSsl = new SslContextFactory();
X509ExtendedKeyManager x509ExtendedKeyManager = getX509ExtendedKeyManager(baseSsl);
UnsupportedOperationException npe = assertThrows(UnsupportedOperationException.class, () -> baseSsl.newSniX509ExtendedKeyManager(x509ExtendedKeyManager));
assertThat("UnsupportedOperationException.message", npe.getMessage(), containsString("X509ExtendedKeyManager only supported on Server"));
UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class, () -> baseSsl.newSniX509ExtendedKeyManager(x509ExtendedKeyManager));
assertThat("UnsupportedOperationException.message", ex.getMessage(), containsString("X509ExtendedKeyManager only supported on " + SslContextFactory.Server.class.getName()));
}
@Test
public void testSniX509ExtendedKeyManager_BaseClass_Start() throws Exception
{
SslContextFactory baseSsl = new SslContextFactory();
Path keystorePath = MavenTestingUtils.getTestResourcePathFile("keystore_sni.p12");
baseSsl.setKeyStoreResource(new PathResource(keystorePath));
baseSsl.setKeyStorePassword("OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4");
baseSsl.setKeyManagerPassword("OBF:1u2u1wml1z7s1z7a1wnl1u2g");
baseSsl.start(); // should not throw an exception
}
@Test
@ -170,8 +184,8 @@ public class X509Test
{
SslContextFactory clientSsl = new SslContextFactory.Client();
X509ExtendedKeyManager x509ExtendedKeyManager = getX509ExtendedKeyManager(clientSsl);
UnsupportedOperationException re = assertThrows(UnsupportedOperationException.class, () -> clientSsl.newSniX509ExtendedKeyManager(x509ExtendedKeyManager));
assertThat("UnsupportedOperationException.message", re.getMessage(), containsString("X509ExtendedKeyManager only supported on Server"));
UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class, () -> clientSsl.newSniX509ExtendedKeyManager(x509ExtendedKeyManager));
assertThat("SNI X509 ExtendedKeyManager is unsupported in Client mode", ex.getMessage(), containsString("X509ExtendedKeyManager only supported on " + SslContextFactory.Server.class.getName()));
}
@Test

BIN
jetty-util/src/test/resources/keystore_sni.p12 Normal file
View File

Binary file not shown.