public class SecurityEnhancedTLSSocketFactory extends Object implements org.apache.http.conn.socket.LayeredConnectionSocketFactory
LayeredConnectionSocketFactory
.
This implementation wraps an existing TLS socket factory instance, decorating it with additional support for:
TrustEngine
and CriteriaSet
supplied by the HttpClient caller via the HttpContext
.X509Credential
used for client TLS.
The context keys used by this component are as follows, defined in HttpClientSecurityConstants
:
HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE
: The trust engine instance used.
Supplied by the HttpClient caller. Must be an instance of TrustEngine
.HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET
: The criteria set instance used.
Supplied by the HttpClient caller. Must be an instance of CriteriaSet
. HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED
: The result of the
trust evaluation, if it was performed. Populated by this component. Will be a Boolean
,
where true
means the server TLS was evaluated as trusted, false
means
the credential was evaluated as untrusted. A null or missing value means that trust engine
evaluation was not performed.HttpClientSecurityConstants.CONTEXT_KEY_CLIENT_TLS_CREDENTIAL
: The client TLS credential used.
Supplied by the HttpClient caller. Must be an instance of X509Credential
.If the trust engine context attribute is not populated by the caller, then no trust evaluation is performed. This allows use of this implementation with use cases where, given a particular HttpClient instance, sometimes trust engine evaluation is to be performed, and sometimes not.
Since this implementation may typically be used with and wrap a "no trust" SSL socket factory,
an optional instance of X509HostnameVerifier
may also be supplied. If supplied, hostname
verification will be performed against the new SSLSocket
via
X509HostnameVerifier.verify(String, SSLSocket)
.
If the client TLS context attribute is not populated by the caller, then client TLS is not attempted.
Client TLS support requires use of a compatible ssl.KeyManager
implementation configured in the
ssl.SSLContext
of the wrapped LayeredConnectionSocketFactory
, such as
ThreadLocalX509CredentialKeyManager
.
Modifier and Type | Field and Description |
---|---|
private org.apache.http.conn.ssl.X509HostnameVerifier |
hostnameVerifier
The hostname verifier evaluated by this implementation.
|
private org.slf4j.Logger |
log
Logger.
|
private org.apache.http.conn.socket.LayeredConnectionSocketFactory |
wrappedFactory
The HttpClient socket factory instance wrapped by this implementation.
|
Constructor and Description |
---|
SecurityEnhancedTLSSocketFactory(org.apache.http.conn.socket.LayeredConnectionSocketFactory factory)
Constructor.
|
SecurityEnhancedTLSSocketFactory(org.apache.http.conn.socket.LayeredConnectionSocketFactory factory,
org.apache.http.conn.ssl.X509HostnameVerifier verifier)
Constructor.
|
Modifier and Type | Method and Description |
---|---|
Socket |
connectSocket(int connectTimeout,
Socket sock,
org.apache.http.HttpHost host,
InetSocketAddress remoteAddress,
InetSocketAddress localAddress,
org.apache.http.protocol.HttpContext context) |
Socket |
createLayeredSocket(Socket socket,
String target,
int port,
org.apache.http.protocol.HttpContext context) |
Socket |
createSocket(org.apache.http.protocol.HttpContext context) |
protected X509Credential |
extractCredential(SSLSocket sslSocket)
Extract the server TLS
X509Credential from the supplied SSLSocket . |
protected void |
performHostnameVerification(Socket socket,
String hostname,
org.apache.http.protocol.HttpContext context)
Perform hostname verification on the connection represented by the supplied socket.
|
protected void |
performTrustEval(Socket socket,
org.apache.http.protocol.HttpContext context)
Deprecated.
|
protected void |
performTrustEval(Socket socket,
String hostname,
org.apache.http.protocol.HttpContext context)
Perform trust evaluation by extracting the server TLS
X509Credential from the
SSLSession and evaluating it via a TrustEngine
and CriteriaSet supplied by the caller via the HttpContext . |
protected void |
setup(org.apache.http.protocol.HttpContext context)
Load the
ThreadLocalX509CredentialContext with the client TLS credential obtained from
the HttpContext . |
protected void |
teardown(org.apache.http.protocol.HttpContext context)
Clear the
ThreadLocalX509CredentialContext of the client TLS credential obtained from
the HttpContext . |
private final org.slf4j.Logger log
@Nonnull private org.apache.http.conn.socket.LayeredConnectionSocketFactory wrappedFactory
@Nullable private org.apache.http.conn.ssl.X509HostnameVerifier hostnameVerifier
public SecurityEnhancedTLSSocketFactory(@Nonnull org.apache.http.conn.socket.LayeredConnectionSocketFactory factory)
No hostname verifier is configured in this implementation. (Does not affect whether hostname is or is not evaluated by the wrapped socket factory).
factory
- the underlying HttpClient socket factory wrapped by this implementation.public SecurityEnhancedTLSSocketFactory(@Nonnull org.apache.http.conn.socket.LayeredConnectionSocketFactory factory, @Nullable org.apache.http.conn.ssl.X509HostnameVerifier verifier)
factory
- the underlying HttpClient socket factory wrapped by this implementation.verifier
- the hostname verifier evaluated by this implementationpublic Socket createSocket(org.apache.http.protocol.HttpContext context) throws IOException
createSocket
in interface org.apache.http.conn.socket.ConnectionSocketFactory
IOException
public Socket connectSocket(int connectTimeout, Socket sock, org.apache.http.HttpHost host, InetSocketAddress remoteAddress, InetSocketAddress localAddress, org.apache.http.protocol.HttpContext context) throws IOException
connectSocket
in interface org.apache.http.conn.socket.ConnectionSocketFactory
IOException
public Socket createLayeredSocket(Socket socket, String target, int port, org.apache.http.protocol.HttpContext context) throws IOException
createLayeredSocket
in interface org.apache.http.conn.socket.LayeredConnectionSocketFactory
IOException
protected void performTrustEval(@Nonnull Socket socket, @Nonnull org.apache.http.protocol.HttpContext context) throws IOException
performTrustEval(Socket, String, HttpContext)
X509Credential
from the
SSLSession
and evaluating it via a TrustEngine
and CriteriaSet
supplied by the caller via the HttpContext
.socket
- the socket instance being processedcontext
- the HttpClient context being processedIOException
- if the server TLS credential is untrusted, or if there is a fatal error
attempting trust evaluation.protected void performTrustEval(@Nonnull Socket socket, @Nullable String hostname, @Nonnull org.apache.http.protocol.HttpContext context) throws IOException
X509Credential
from the
SSLSession
and evaluating it via a TrustEngine
and CriteriaSet
supplied by the caller via the HttpContext
.socket
- the socket instance being processedhostname
- the hostname being processedcontext
- the HttpClient context being processedIOException
- if the server TLS credential is untrusted, or if there is a fatal error
attempting trust evaluation.@Nonnull protected X509Credential extractCredential(@Nonnull SSLSocket sslSocket) throws IOException
X509Credential
from the supplied SSLSocket
.sslSocket
- the SSL socket instance to processIOException
- if credential data can not be extracted from the socketprotected void performHostnameVerification(Socket socket, String hostname, org.apache.http.protocol.HttpContext context) throws IOException
socket
- the socket instance being processedhostname
- the hostname against which to verifycontext
- the current HttpClient context instanceIOException
- if an I/O error occurs or the verification process failsprotected void setup(@Nullable org.apache.http.protocol.HttpContext context)
ThreadLocalX509CredentialContext
with the client TLS credential obtained from
the HttpContext
.context
- the HttpContext instanceprotected void teardown(@Nullable org.apache.http.protocol.HttpContext context)
ThreadLocalX509CredentialContext
of the client TLS credential obtained from
the HttpContext
.context
- the HttpContext instanceCopyright © 1999–2020 Shibboleth Consortium. All rights reserved.