Fixes #327183 (Allow better configurability of HttpClient for TLS/SSL).

git-svn-id: svn+ssh://dev.eclipse.org/svnroot/rt/org.eclipse.jetty/jetty/trunk@2329 7e9141cc-0065-0410-87d8-b60c137991c4

VERSION.txt

@@ -4,6 +4,7 @@ jetty-7.2.0.RC1-SNAPSHOT
  + 323985 Xmlconfiguration pulls start.jar config properties
  + 326734 Configure Digest maxNonceAge with Security handler init param
  + 327109 Fixed AJP handling of empty packets
+ + 327183 Allow better configurability of HttpClient for TLS/SSL
 
 jetty-7.2.0.RC0 1 Oct 2010
  + 314087 Simplified SelectorManager

jetty-client/src/main/java/org/eclipse/jetty/client/HttpClient.java

@@ -25,11 +25,9 @@ import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
-import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
@@ -101,7 +99,6 @@ public class HttpClient extends HttpBuffers implements Attributes
     private int _maxRedirects = 20;
     private LinkedList<String> _registeredListeners;
 
-    // TODO clean up and add getters/setters to some of this maybe
     private String _keyStoreLocation;
     private String _keyStoreType = "JKS";
     private String _keyStorePassword;
@@ -111,13 +108,12 @@ public class HttpClient extends HttpBuffers implements Attributes
     private String _trustStoreType = "JKS";
     private String _trustStorePassword;
     private String _trustManagerAlgorithm = (Security.getProperty("ssl.TrustManagerFactory.algorithm")==null?"SunX509":Security.getProperty("ssl.TrustManagerFactory.algorithm"));
-
-    private SSLContext _sslContext;
-
     private String _protocol = "TLS";
     private String _provider;
     private String _secureRandomAlgorithm;
 
+    private SSLContext _sslContext;
+
     private RealmResolver _realmResolver;
 
     private AttributesMap _attributes=new AttributesMap();
@@ -548,7 +544,6 @@ public class HttpClient extends HttpBuffers implements Attributes
 
     protected SSLContext getStrictSSLContext() throws IOException
     {
-
         try
         {
             if (_trustStoreLocation == null)
@@ -557,45 +552,36 @@ public class HttpClient extends HttpBuffers implements Attributes
                 _trustStoreType = _keyStoreType;
             }
 
-            KeyManager[] keyManagers = null;
+            InputStream keyStoreInputStream = Resource.newResource(_keyStoreLocation).getInputStream();
-            InputStream keystoreInputStream = null;
-
-            keystoreInputStream = Resource.newResource(_keyStoreLocation).getInputStream();
             KeyStore keyStore = KeyStore.getInstance(_keyStoreType);
-            keyStore.load(keystoreInputStream, _keyStorePassword == null ? null : _keyStorePassword.toString().toCharArray());
+            keyStore.load(keyStoreInputStream, _keyStorePassword == null ? null : _keyStorePassword.toCharArray());
 
             KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(_keyManagerAlgorithm);
-            keyManagerFactory.init(keyStore, _keyManagerPassword == null ? null : _keyManagerPassword.toString().toCharArray());
+            keyManagerFactory.init(keyStore, _keyManagerPassword == null ? null : _keyManagerPassword.toCharArray());
-            keyManagers = keyManagerFactory.getKeyManagers();
+            KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();
 
-            TrustManager[] trustManagers = null;
+            InputStream trustStoreInputStream = Resource.newResource(_trustStoreLocation).getInputStream();
-            InputStream truststoreInputStream = null;
-
-            truststoreInputStream = Resource.newResource(_trustStoreLocation).getInputStream();
             KeyStore trustStore = KeyStore.getInstance(_trustStoreType);
-            trustStore.load(truststoreInputStream, _trustStorePassword == null ? null : _trustStorePassword.toString().toCharArray());
+            trustStore.load(trustStoreInputStream, _trustStorePassword == null ? null : _trustStorePassword.toCharArray());
 
             TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(_trustManagerAlgorithm);
             trustManagerFactory.init(trustStore);
-            trustManagers = trustManagerFactory.getTrustManagers();
+            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
 
             SecureRandom secureRandom = _secureRandomAlgorithm == null ? null : SecureRandom.getInstance(_secureRandomAlgorithm);
             SSLContext context = _provider == null ? SSLContext.getInstance(_protocol) : SSLContext.getInstance(_protocol, _provider);
             context.init(keyManagers, trustManagers, secureRandom);
             return context;
         }
-        catch (Exception e)
+        catch (Exception x)
         {
-            e.printStackTrace();
+            throw (IOException)new IOException("Error generating SSLContext for keystore " + _keyStoreLocation).initCause(x);
-            throw new IOException("error generating ssl context for " + _keyStoreLocation + " " + e.getMessage());
         }
     }
 
     protected SSLContext getLooseSSLContext() throws IOException
     {
-
+        // Create a trust manager that does not validate certificate chains
-        // Create a trust manager that does not validate certificate
-        // chains
         TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager()
         {
             public java.security.cert.X509Certificate[] getAcceptedIssuers()
@@ -612,26 +598,16 @@ public class HttpClient extends HttpBuffers implements Attributes
             }
         }};
 
-        HostnameVerifier hostnameVerifier = new HostnameVerifier()
-        {
-            public boolean verify(String urlHostName, SSLSession session)
-            {
-                Log.warn("Warning: URL Host: " + urlHostName + " vs." + session.getPeerHost());
-                return true;
-            }
-        };
-
         // Install the all-trusting trust manager
         try
         {
-            // TODO real trust manager
+            SSLContext sslContext = SSLContext.getInstance(_protocol);
-            SSLContext sslContext = SSLContext.getInstance("SSL");
+            sslContext.init(null, trustAllCerts, null);
-            sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
             return sslContext;
         }
-        catch (Exception e)
+        catch (Exception x)
         {
-            throw new IOException("issue ignoring certs");
+            throw (IOException)new IOException("Error generating loose SSLContext").initCause(x);
         }
     }
 
@@ -838,4 +814,64 @@ public class HttpClient extends HttpBuffers implements Attributes
     {
         this._trustStoreType = trustStoreType;
     }
+
+    /* ------------------------------------------------------------ */
+    public String getKeyManagerAlgorithm()
+    {
+        return _keyManagerAlgorithm;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setKeyManagerAlgorithm(String keyManagerAlgorithm)
+    {
+        this._keyManagerAlgorithm = keyManagerAlgorithm;
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getTrustManagerAlgorithm()
+    {
+        return _trustManagerAlgorithm;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setTrustManagerAlgorithm(String trustManagerAlgorithm)
+    {
+        this._trustManagerAlgorithm = trustManagerAlgorithm;
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getProtocol()
+    {
+        return _protocol;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProtocol(String protocol)
+    {
+        this._protocol = protocol;
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getProvider()
+    {
+        return _provider;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setProvider(String provider)
+    {
+        this._provider = provider;
+    }
+
+    /* ------------------------------------------------------------ */
+    public String getSecureRandomAlgorithm()
+    {
+        return _secureRandomAlgorithm;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setSecureRandomAlgorithm(String secureRandomAlgorithm)
+    {
+        this._secureRandomAlgorithm = secureRandomAlgorithm;
+    }
 }