public class TrustEngineTLSSocketFactory extends Object implements org.apache.http.conn.socket.LayeredConnectionSocketFactory
LayeredConnectionSocketFactory
, which supports
verifying the server TLS certificate and chain via a TrustEngine
and CriteriaSet
supplied by the HttpClient caller via the HttpContext
.
The context keys used by this component are as follows, defined in HttpClientSecurityConstants
:
HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE
: The trust engine instance used.
Supplied by the HttpClient caller. Must be an instance of TrustEngine
.HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET
: The criteria set instance used.
Supplied by the HttpClient caller. Must be an instance of CriteriaSet
. HttpClientSecurityConstants.CONTEXT_KEY_SERVER_TLS_CREDENTIAL_TRUSTED
: The result of the
trust evaluation, if it was performed. Populated by this component. Will be a Boolean
,
where true
means the server TLS was evaluated as trusted, false
means
the credential was evaluated as untrusted. A null or missing value means that trust engine
evaluation was not performed.If the trust engine context attribute is not populated by the caller, then no trust evaluation is performed. This allows use of this implementation with use cases where, given a particular HttpClient instance, sometimes trust engine evaluation is to be performed, and sometimes not.
Since this implementation may typically be used with and wrap a "no trust" SSL socket factory,
an optional instance of X509HostnameVerifier
may also be supplied. If supplied, hostname
verification will be performed against the new SSLSocket
via
X509HostnameVerifier.verify(String, SSLSocket)
.
Constructor and Description |
---|
TrustEngineTLSSocketFactory(org.apache.http.conn.socket.LayeredConnectionSocketFactory factory,
org.apache.http.conn.ssl.X509HostnameVerifier verifier)
Constructor.
|
Modifier and Type | Method and Description |
---|---|
Socket |
connectSocket(int connectTimeout,
Socket sock,
org.apache.http.HttpHost host,
InetSocketAddress remoteAddress,
InetSocketAddress localAddress,
org.apache.http.protocol.HttpContext context) |
Socket |
createLayeredSocket(Socket socket,
String target,
int port,
org.apache.http.protocol.HttpContext context) |
Socket |
createSocket(org.apache.http.protocol.HttpContext context) |
protected X509Credential |
extractCredential(SSLSocket sslSocket)
Extract the server TLS
X509Credential from the supplied SSLSocket . |
protected void |
performHostnameVerification(Socket socket,
String hostname,
org.apache.http.protocol.HttpContext context)
Perform hostname verification on the connection represented by the supplied socket.
|
protected void |
performTrustEval(Socket socket,
org.apache.http.protocol.HttpContext context)
Perform trust evaluation by extracting the server TLS
X509Credential from the
SSLSession and evaluating it via a TrustEngine
and CriteriaSet supplied by the caller via the HttpContext . |
public TrustEngineTLSSocketFactory(org.apache.http.conn.socket.LayeredConnectionSocketFactory factory, org.apache.http.conn.ssl.X509HostnameVerifier verifier)
factory
- the underlying HttpClient socket factory wrapped by this implementation.verifier
- the hostname verifier evaluated by this implementationpublic Socket createSocket(org.apache.http.protocol.HttpContext context) throws IOException
createSocket
in interface org.apache.http.conn.socket.ConnectionSocketFactory
IOException
public Socket connectSocket(int connectTimeout, Socket sock, org.apache.http.HttpHost host, InetSocketAddress remoteAddress, InetSocketAddress localAddress, org.apache.http.protocol.HttpContext context) throws IOException
connectSocket
in interface org.apache.http.conn.socket.ConnectionSocketFactory
IOException
public Socket createLayeredSocket(Socket socket, String target, int port, org.apache.http.protocol.HttpContext context) throws IOException
createLayeredSocket
in interface org.apache.http.conn.socket.LayeredConnectionSocketFactory
IOException
protected void performTrustEval(@Nonnull Socket socket, @Nonnull org.apache.http.protocol.HttpContext context) throws IOException
X509Credential
from the
SSLSession
and evaluating it via a TrustEngine
and CriteriaSet
supplied by the caller via the HttpContext
.socket
- the socket instance being processedcontext
- the HttpClient context being processedIOException
- if the server TLS credential is untrusted, or if there is a fatal error
attempting trust evaluation.@Nonnull protected X509Credential extractCredential(@Nonnull SSLSocket sslSocket) throws IOException
X509Credential
from the supplied SSLSocket
.sslSocket
- the SSL socket instance to processIOException
- if credential data can not be extracted from the socketprotected void performHostnameVerification(Socket socket, String hostname, org.apache.http.protocol.HttpContext context) throws IOException
socket
- the socket instance being processedhostname
- the hostname against which to verifycontext
- the current HttpClient context instanceIOException
- if an I/O error occurs or the verification process failsCopyright © 2019. All rights reserved.