Issue #2711 - TLS 1.3 compliance.
Disabled few tests that are TLS 1.2 specific.
Renegotiation in SslConnection is now skipped for TLS 1.3.
Replaced SNI keystore DSA certificate with RSA certificate.
First full build achieved with JDK 11+28.
Small changes after review.
Modified the test case to pass in JDK 8, where the implementation
throws SSLException, while in later JDKs throws SSLHandshakeException.
Minor cleanup
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Increased complexity of regex in order to use only one regex pattern and reworked state machine into simple for loop
Signed-off-by: lachan-roberts <lachlan@webtide.com>
Splitting elements into list using QuotedCSV and processing with state machine instead of using regex to split into multiple challenges.
Signed-off-by: lachan-roberts <lachlan@webtide.com>
Major refactor of SslConnection to address #2233 and to simplify in preparation for java-11 support.
Made the `needFillInterest` and `onIncompleteFlush` methods the primary stateful methods with state for fill and flush side that does not reproduce state already held by the SslEngine itself.
Signed-off-by: Greg Wilkins <gregw@webtide.com>
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
HttpClient was confused by servers that responded
with two 100 Continue in the same HTTP conversation.
Now, whether the 100 Continue response has been handled
already is stored per-request, not per-conversation.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
* Issue #2439 - Remove HTTP/2 data copy.
Implemented reference counting for the network buffer, with the
semantic that calling succeeded() on callbacks decrements the
reference count.
Introduced interface Retainable, used by the client when notifying
multiple application content listeners.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Changed the base64 pattern to only accept token68 pattern from rfc7235#appendix-C
Add limit to recusion depth of multiple challange matching to stop any vulnerablilties related to malicious server overflowing client stack
Regex no longer allows trailing whitespace
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
- Multiple challanges in the same header can now be parsed successfully.
- Will now allow a base64 value after the auth-scheme instead of parameters. Which can be used for the Negotiate auth-scheme.
- Added more in depth testing for tricky cases.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Removed the regex to separate out the realm parameter and instead parse it with the other parameters into HeaderInfo.
Changed HeaderInfo to store the parsed parameters as a Map instead of the un-parsed parameters in a string.
The parsing of the parameters is now done in AuthenticationProtocolHandler.newHeaderInfo(String) and then passed into the HeaderInfo instead of Parsing it in DigestAuthentication.
Replaced the usage of splitParams(String) with QuotedCSV used to parse the parameters.
Added test to check the ordering of parameters doesn't matter.
Allow not to have a realm parameter, changed DigestAuthentication.matches() to not match if realm is null, so that Digest Authentication requires realm parameter but any Basic Authentication can be done without it. There is currently no tests for this.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Regex will now look for comma and spaces before realm. Preventing issues accepting params with realm as a suffix like blahrealm.
Stops adding double commas when extracting realm param.
Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
Fixed method, added Javadocs and cleaned up code with a few renamings
to better comply with AtomicLong naming.
Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
Jesse McConnell
Simone Bordet
Ivanov Anton
Joakim Erdfelt
lachan-roberts
Greg Wilkins