[jboss-cvs] JBossAS SVN: r78870 - trunk/security/src/main/org/jboss/security/ssl.
jboss-cvs-commits at lists.jboss.org
jboss-cvs-commits at lists.jboss.org
Thu Sep 25 13:41:53 EDT 2008
Author: sguilhen at redhat.com
Date: 2008-09-25 13:41:53 -0400 (Thu, 25 Sep 2008)
New Revision: 78870
Modified:
trunk/security/src/main/org/jboss/security/ssl/DomainServerSocketFactory.java
Log:
JBAS-5815: Added a check to set the wantClientAuth only when needClientAuth is false or has not been specified.
Modified: trunk/security/src/main/org/jboss/security/ssl/DomainServerSocketFactory.java
===================================================================
--- trunk/security/src/main/org/jboss/security/ssl/DomainServerSocketFactory.java 2008-09-25 17:38:51 UTC (rev 78869)
+++ trunk/security/src/main/org/jboss/security/ssl/DomainServerSocketFactory.java 2008-09-25 17:41:53 UTC (rev 78870)
@@ -1,24 +1,24 @@
/*
-* JBoss, Home of Professional Open Source
-* Copyright 2005, JBoss Inc., and individual contributors as indicated
-* by the @authors tag. See the copyright.txt in the distribution for a
-* full listing of individual contributors.
-*
-* This is free software; you can redistribute it and/or modify it
-* under the terms of the GNU Lesser General Public License as
-* published by the Free Software Foundation; either version 2.1 of
-* the License, or (at your option) any later version.
-*
-* This software is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-* Lesser General Public License for more details.
-*
-* You should have received a copy of the GNU Lesser General Public
-* License along with this software; if not, write to the Free
-* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
-* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-*/
+ * JBoss, Home of Professional Open Source
+ * Copyright 2005, JBoss Inc., and individual contributors as indicated
+ * by the @authors tag. See the copyright.txt in the distribution for a
+ * full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
package org.jboss.security.ssl;
import java.io.IOException;
@@ -39,32 +39,39 @@
import org.jboss.security.SecurityDomain;
import javassist.util.proxy.ProxyFactory;
-/** An implementation of ServerSocketFactory that creates SSL server sockets
- using the JSSE SSLContext and a JBossSX SecurityDomain for the KeyManagerFactory
- and TrustManagerFactory objects.
-
- @see javax.net.ssl.SSLContext
- @see org.jboss.security.SecurityDomain
-
- at author Scott.Stark at jboss.org
- at version $Revision: 44910 $
-*/
+/**
+ * An implementation of ServerSocketFactory that creates SSL server sockets using the JSSE SSLContext and a JBossSX
+ * SecurityDomain for the KeyManagerFactory and TrustManagerFactory objects.
+ *
+ * @see javax.net.ssl.SSLContext
+ * @see org.jboss.security.SecurityDomain
+ *
+ * @author Scott.Stark at jboss.org
+ * @version $Revision: 44910 $
+ */
public class DomainServerSocketFactory extends SSLServerSocketFactory
{
private static Logger log = Logger.getLogger(DomainServerSocketFactory.class);
+
/** WeakHashMap<String, SSLSession> */
private static WeakHashMap sessionMap = new WeakHashMap();
private transient SecurityDomain securityDomain;
+
private transient InetAddress bindAddress;
+
private transient SSLContext sslCtx = null;
+
private boolean wantsClientAuth = true;
+
private boolean needsClientAuth = false;
+
private String[] cipherSuites;
+
private String[] protocols;
- /** The default ServerSocketFactory which looks to the java:/jaas/other
- security domain configuration.
+ /**
+ * The default ServerSocketFactory which looks to the java:/jaas/other security domain configuration.
*/
public static ServerSocketFactory getDefault()
{
@@ -75,7 +82,7 @@
SecurityDomain sd = (SecurityDomain) iniCtx.lookup("java:/jaas/other");
ssf = new DomainServerSocketFactory(sd);
}
- catch(Exception e)
+ catch (Exception e)
{
log.error("Failed to create default ServerSocketFactory", e);
}
@@ -87,29 +94,34 @@
SSLSession session = (SSLSession) sessionMap.get(sessionID);
return session;
}
+
static synchronized SSLSession putSSLSession(String sessionID, SSLSession session)
{
SSLSession prevSession = (SSLSession) sessionMap.put(sessionID, session);
return prevSession;
}
+
static synchronized SSLSession removeSSLSession(String sessionID)
{
SSLSession session = (SSLSession) sessionMap.remove(sessionID);
return session;
}
- /** A default constructor for use when created by Class.newInstance. The
- factory is not usable until its SecurityDomain has been established.
+ /**
+ * A default constructor for use when created by Class.newInstance. The factory is not usable until its
+ * SecurityDomain has been established.
*/
public DomainServerSocketFactory()
{
}
- /** Create a socket factory instance that uses the given SecurityDomain
- as the source for the SSL KeyManagerFactory and TrustManagerFactory.
+
+ /**
+ * Create a socket factory instance that uses the given SecurityDomain as the source for the SSL KeyManagerFactory
+ * and TrustManagerFactory.
*/
public DomainServerSocketFactory(SecurityDomain securityDomain) throws IOException
{
- if( securityDomain == null )
+ if (securityDomain == null)
throw new IOException("The securityDomain may not be null");
this.securityDomain = securityDomain;
}
@@ -117,10 +129,11 @@
public String getBindAddress()
{
String address = null;
- if( bindAddress != null )
+ if (bindAddress != null)
address = bindAddress.getHostAddress();
return address;
}
+
public void setBindAddress(String host) throws UnknownHostException
{
bindAddress = InetAddress.getByName(host);
@@ -130,6 +143,7 @@
{
return securityDomain;
}
+
public void setSecurityDomain(SecurityDomain securityDomain)
{
this.securityDomain = securityDomain;
@@ -139,6 +153,7 @@
{
return wantsClientAuth;
}
+
public void setWantsClientAuth(boolean wantsClientAuth)
{
this.wantsClientAuth = wantsClientAuth;
@@ -148,20 +163,22 @@
{
return needsClientAuth;
}
+
public void setNeedsClientAuth(boolean needsClientAuth)
{
this.needsClientAuth = needsClientAuth;
}
/**
- @return current set of cipher suite names
+ * @return current set of cipher suite names
*/
public String[] getCipherSuites()
{
return cipherSuites;
}
+
/**
- @param cipherSuites - set of cipher suite names to use
+ * @param cipherSuites - set of cipher suite names to use
*/
public void setCipherSuites(String[] cipherSuites)
{
@@ -169,20 +186,24 @@
}
/**
- This is an error due to a typo in the ciperSuites ivar
- @deprecated use getCipherSuites
- @return current set of cipher suite names
+ * This is an error due to a typo in the ciperSuites ivar
+ *
+ * @deprecated use getCipherSuites
+ * @return current set of cipher suite names
*/
+ @Deprecated
public String[] getCiperSuites()
{
return cipherSuites;
}
/**
- This is an error due to a typo in the ciperSuites ivar
- @deprecated use getCipherSuites
- @param cipherSuites - set of cipher suite names to use
+ * This is an error due to a typo in the ciperSuites ivar
+ *
+ * @deprecated use getCipherSuites
+ * @param cipherSuites - set of cipher suite names to use
*/
+ @Deprecated
public void setCiperSuites(String[] cipherSuites)
{
this.cipherSuites = cipherSuites;
@@ -192,42 +213,45 @@
{
return protocols;
}
+
public void setProtocols(String[] protocols)
{
this.protocols = protocols;
}
-// --- Begin SSLServerSocketFactory interface methods
+ // --- Begin SSLServerSocketFactory interface methods
+ @Override
public ServerSocket createServerSocket(int port) throws IOException
{
return createServerSocket(port, 50, bindAddress);
}
- public ServerSocket createServerSocket(int port, int backlog)
- throws IOException
+
+ @Override
+ public ServerSocket createServerSocket(int port, int backlog) throws IOException
{
return createServerSocket(port, backlog, bindAddress);
}
+
/**
- * Returns a server socket which uses only the specified network
- * interface on the local host, is bound to a the specified port,
- * and uses the specified connection backlog. The socket is configured
- * with the socket options (such as accept timeout) given to this factory.
- *
+ * Returns a server socket which uses only the specified network interface on the local host, is bound to a the
+ * specified port, and uses the specified connection backlog. The socket is configured with the socket options (such
+ * as accept timeout) given to this factory.
+ *
* @param port the port to listen to
* @param backlog how many connections are queued
* @param ifAddress the network interface address to use
- *
+ *
* @exception IOException for networking errors
*/
- public ServerSocket createServerSocket(int port, int backlog, InetAddress ifAddress)
- throws IOException
+ @Override
+ public ServerSocket createServerSocket(int port, int backlog, InetAddress ifAddress) throws IOException
{
initSSLContext();
SSLServerSocketFactory factory = sslCtx.getServerSocketFactory();
SSLServerSocket socket = (SSLServerSocket) factory.createServerSocket(port, backlog, ifAddress);
SSLSessionContext ctx = sslCtx.getServerSessionContext();
System.out.println(ctx);
- if( log.isTraceEnabled() )
+ if (log.isTraceEnabled())
{
String[] supportedProtocols = socket.getSupportedProtocols();
log.debug("Supported protocols: " + Arrays.asList(supportedProtocols));
@@ -235,10 +259,13 @@
log.debug("Supported CipherSuites: " + Arrays.asList(supportedCipherSuites));
}
socket.setNeedClientAuth(needsClientAuth);
- socket.setWantClientAuth(wantsClientAuth);
- if( protocols != null )
+ // JBAS-5815: only set the wantClientAuth property if needClientAuth hasn't been already set.
+ if (!needsClientAuth)
+ socket.setWantClientAuth(wantsClientAuth);
+
+ if (protocols != null)
socket.setEnabledProtocols(protocols);
- if( cipherSuites != null )
+ if (cipherSuites != null)
socket.setEnabledCipherSuites(cipherSuites);
DomainServerSocket handler = new DomainServerSocket(socket);
@@ -262,6 +289,7 @@
return proxy;
}
+ @Override
public String[] getDefaultCipherSuites()
{
String[] cipherSuites = {};
@@ -271,13 +299,14 @@
SSLServerSocketFactory factory = sslCtx.getServerSocketFactory();
cipherSuites = factory.getDefaultCipherSuites();
}
- catch(IOException e)
+ catch (IOException e)
{
log.error("Failed to get default SSLServerSocketFactory", e);
}
return cipherSuites;
}
+ @Override
public String[] getSupportedCipherSuites()
{
String[] cipherSuites = {};
@@ -287,19 +316,18 @@
SSLServerSocketFactory factory = sslCtx.getServerSocketFactory();
cipherSuites = factory.getSupportedCipherSuites();
}
- catch(IOException e)
+ catch (IOException e)
{
log.error("Failed to get default SSLServerSocketFactory", e);
}
return cipherSuites;
}
-// --- End SSLServerSocketFactory interface methods
+ // --- End SSLServerSocketFactory interface methods
- private void initSSLContext()
- throws IOException
+ private void initSSLContext() throws IOException
{
- if( sslCtx != null )
+ if (sslCtx != null)
return;
sslCtx = Context.forDomain(securityDomain);
}
More information about the jboss-cvs-commits
mailing list