import javax.net.ssl.SSLSession;
import javax.ws.rs.client.ClientBuilder;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.onap.ccsdk.sli.core.utils.common.EnvProperties;
import org.onap.logging.filter.base.MetricLogClientFilter;
import org.onap.logging.filter.base.PayloadLoggingClientFilter;
}
private void defaultHostNameVerifier() {
- clientBuilder.hostnameVerifier(new HostnameVerifier() {
- @Override
- public boolean verify(String hostname, SSLSession session) {
- return true;
- }
- });
+ // Perform host name verification EXCEPT if 'host' is IP address
+ clientBuilder.hostnameVerifier(new AcceptIpAddressHostNameVerifier());
}
protected void enableMetricLogging() {
package org.onap.ccsdk.sli.adaptors.resource.mdsal;
import org.apache.commons.codec.binary.Base64;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
try {
HttpURLConnection conn = getRestConnection(fullUrl, method);
if (conn instanceof HttpsURLConnection) {
- HostnameVerifier hostnameVerifier = (hostname, session) -> true;
- ((HttpsURLConnection) conn).setHostnameVerifier(hostnameVerifier);
+ // Safely disable host name verification if host is an IP address or 'localhost'
+ ((HttpsURLConnection) conn).setHostnameVerifier(new AcceptIpAddressHostNameVerifier());
}
// Write message
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
</dependency>
+ <dependency>
+ <groupId>org.onap.ccsdk.sli.core</groupId>
+ <artifactId>utils-provider</artifactId>
+ <version>${project.version}</version>
+ </dependency>
</dependencies>
<build>
import org.onap.ccsdk.sli.adaptors.messagerouter.consumer.api.ConsumerApi;
import org.onap.ccsdk.sli.adaptors.messagerouter.consumer.api.RequestHandler;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
httpUrlConnection.setConnectTimeout(connectTimeout);
httpUrlConnection.setReadTimeout(readTimeout);
- // ignore hostname errors when dealing with HTTPS connections
+ // Safely ignore hostname errors if host is an ip address or localhost
if (httpUrlConnection instanceof HttpsURLConnection) {
HttpsURLConnection conn = (HttpsURLConnection) httpUrlConnection;
- conn.setHostnameVerifier(new HostnameVerifier() {
- @Override
- public boolean verify(String arg0, SSLSession arg1) {
- return true;
- }
- });
+ conn.setHostnameVerifier(new AcceptIpAddressHostNameVerifier());
}
return httpUrlConnection;
}
--- /dev/null
+/*-
+ * ============LICENSE_START=======================================================
+ * onap
+ * ================================================================================
+ * Copyright (C) 2021 AT&T
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+ package org.onap.ccsdk.sli.core.utils.common;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLSession;
+
+/**
+ * HostnameVerifier that accepts IP addresses without verification, but
+ * does default host name verification on true FQDNs
+ */
+public class AcceptIpAddressHostNameVerifier implements HostnameVerifier {
+
+ public static final String DISABLE_HOSTNAME_VERIFICATION = "org.onap.ccsdk.host.verification.disable";
+
+ public static final String IPV4_REGEX = "\\A(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z";
+ public static final String IPV6_HEX4DECCOMPRESSED_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?) ::((?:[0-9A-Fa-f]{1,4}:)*)(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z";
+ public static final String IPV6_6HEX4DEC_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}:){6,6})(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z";
+ public static final String IPV6_HEXCOMPRESSED_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)\\z";
+ public static final String IPV6_REGEX = "\\A(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\\z";
+
+ boolean disableHostVerification = false;
+
+ public AcceptIpAddressHostNameVerifier() {
+ // Allow for host name verification to be disabled if
+ // necessary (for example, if self-signed certificates must
+ // be supported)
+ String disableHostVerification = System.getProperty(DISABLE_HOSTNAME_VERIFICATION, "false");
+
+ if ("true".equalsIgnoreCase(disableHostVerification)) {
+ this.disableHostVerification = true;
+ } else {
+ this.disableHostVerification = false;
+ }
+ }
+
+ public AcceptIpAddressHostNameVerifier(boolean disableHostVerification) {
+ this.disableHostVerification = disableHostVerification;
+ }
+
+ @Override
+ public boolean verify(String hostName, SSLSession session) {
+
+ if (disableHostVerification) {
+ return true;
+ }
+
+ // Null host name should never happen, but better to be safe
+ if (hostName == null) {
+ return false;
+ }
+
+ // If "hostName" is an IP address, accept it
+ if (hostName.matches(IPV4_REGEX) ||
+ hostName.matches(IPV6_REGEX) ||
+ hostName.matches(IPV6_HEX4DECCOMPRESSED_REGEX) ||
+ hostName.matches(IPV6_6HEX4DEC_REGEX) ||
+ hostName.matches(IPV6_HEXCOMPRESSED_REGEX))
+ {
+ return true;
+ }
+
+ // Handle localhost as special case
+ if (hostName.equals("localhost")) {
+ return(true);
+ }
+
+ // Host name is not an IP address - perform default host
+ // name verification.
+ HostnameVerifier defaultHv = HttpsURLConnection.getDefaultHostnameVerifier();
+ return(defaultHv.verify(hostName, session));
+ }
+
+
+}
+/*-
+ * ============LICENSE_START=======================================================
+ * onap
+ * ================================================================================
+ * Copyright (C) 2021 AT&T
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
package org.onap.ccsdk.sli.core.utils.common;
import java.io.IOException;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+/**
+ * Drop-in replacement for java.util.Properties that allows env
+ * variables to be used as settings for property files. For example,
+ *
+ * my.property = ${MY_PROPERTY}
+ *
+ * A default value can also be provided using :- notation. For example,
+ *
+ * my.property = ${MY_PROPERTY:-defaultValue}
+ */
+
public class EnvProperties extends Properties {
@Override
--- /dev/null
+package org.onap.ccsdk.sli.core.utils.common;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLSession;
+
+import org.junit.Test;
+import org.mockito.Mockito;
+
+public class AcceptIpAddressHostNameVerifierTest {
+
+ @Test
+ public void testVerify() {
+ HostnameVerifier hv = new AcceptIpAddressHostNameVerifier();
+ SSLSession sslSession = Mockito.mock(SSLSession.class);
+
+ // Test that IPv4 style address is accepted
+ assertTrue(hv.verify("127.0.0.1", sslSession));
+
+ // Test that IPv6 style addresses are also accepted
+ assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession));
+ assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession));
+ assertTrue(hv.verify("2001:db8::", sslSession));
+ assertTrue(hv.verify("::1234:5678", sslSession));
+ assertTrue(hv.verify("2001:db8::1234:5678", sslSession));
+ assertTrue(hv.verify("::1", sslSession));
+
+ // Test that localhost is accepted
+ assertTrue(hv.verify("localhost", sslSession));
+
+ // Test that FQDN is not accepted (since there is no certificate)
+ assertFalse(hv.verify("bogus.org", sslSession));
+
+ // Repeat tests with verification disabled via arg to constructor
+ hv = new AcceptIpAddressHostNameVerifier(true);
+
+ // Test that IPv4 style address is accepted
+ assertTrue(hv.verify("127.0.0.1", sslSession));
+
+ // Test that IPv6 style addresses are also accepted
+ assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession));
+ assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession));
+ assertTrue(hv.verify("2001:db8::", sslSession));
+ assertTrue(hv.verify("::1234:5678", sslSession));
+ assertTrue(hv.verify("2001:db8::1234:5678", sslSession));
+ assertTrue(hv.verify("::1", sslSession));
+
+ // Test that localhost is accepted
+ assertTrue(hv.verify("localhost", sslSession));
+
+ // Test that FQDN is accepted (since verification is disabled)
+ assertTrue(hv.verify("bogus.org", sslSession));
+
+ // Repeat tests with verification disabled via arg to constructor
+ System.setProperty(AcceptIpAddressHostNameVerifier.DISABLE_HOSTNAME_VERIFICATION, "true");
+ hv = new AcceptIpAddressHostNameVerifier();
+
+ // Test that IPv4 style address is accepted
+ assertTrue(hv.verify("127.0.0.1", sslSession));
+
+ // Test that IPv6 style addresses are also accepted
+ assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession));
+ assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession));
+ assertTrue(hv.verify("2001:db8::", sslSession));
+ assertTrue(hv.verify("::1234:5678", sslSession));
+ assertTrue(hv.verify("2001:db8::1234:5678", sslSession));
+ assertTrue(hv.verify("::1", sslSession));
+
+ // Test that localhost is accepted
+ assertTrue(hv.verify("localhost", sslSession));
+
+ // Test that FQDN is accepted (since verification is disabled)
+ assertTrue(hv.verify("bogus.org", sslSession));
+ }
+
+}
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;
import org.apache.commons.codec.binary.Base64;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
httpConn.setUseCaches(false);
if (httpConn instanceof HttpsURLConnection) {
- HostnameVerifier hostnameVerifier = new HostnameVerifier() {
- @Override
- public boolean verify(String hostname, SSLSession session) {
- return true;
- }
- };
+ // Safely disable host name verification if host is an ip address or 'localhost'
+ HostnameVerifier hostnameVerifier = new AcceptIpAddressHostNameVerifier();
((HttpsURLConnection) httpConn).setHostnameVerifier(hostnameVerifier);
}
import javax.net.ssl.SSLSession;
import org.apache.commons.codec.binary.Base64;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
httpConn.setUseCaches(false);
if (httpConn instanceof HttpsURLConnection) {
- HostnameVerifier hostnameVerifier = new HostnameVerifier() {
- @Override
- public boolean verify(String hostname, SSLSession session) {
- return true;
- }
- };
+ HostnameVerifier hostnameVerifier = new AcceptIpAddressHostNameVerifier();
((HttpsURLConnection) httpConn).setHostnameVerifier(hostnameVerifier);
}
import org.onap.ccsdk.sli.core.sli.SvcLogicContext;
import org.onap.ccsdk.sli.core.sli.SvcLogicException;
import org.onap.ccsdk.sli.core.sli.SvcLogicJavaPlugin;
+import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier;
import org.onap.ccsdk.sli.core.utils.common.EnvProperties;
import org.onap.logging.filter.base.HttpURLConnectionMetricUtil;
import org.onap.logging.filter.base.MetricLogClientFilter;
Client client;
if (ssl != null) {
HttpsURLConnection.setDefaultSSLSocketFactory(ssl.getSocketFactory());
- client = ClientBuilder.newBuilder().sslContext(ssl).hostnameVerifier((s, sslSession) -> true).build();
+ client = ClientBuilder.newBuilder().sslContext(ssl).hostnameVerifier(new AcceptIpAddressHostNameVerifier()).build();
} else {
- client = ClientBuilder.newBuilder().hostnameVerifier((s, sslSession) -> true).build();
+ client = ClientBuilder.newBuilder().hostnameVerifier(new AcceptIpAddressHostNameVerifier()).build();
}
setClientTimeouts(client);
protected SSLContext createSSLContext(Parameters p) {
try (FileInputStream in = new FileInputStream(p.keyStoreFileName)) {
- HttpsURLConnection.setDefaultHostnameVerifier((string, ssls) -> true);
+ HttpsURLConnection.setDefaultHostnameVerifier(new AcceptIpAddressHostNameVerifier());
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
KeyStore ks = KeyStore.getInstance("PKCS12");
char[] pwd = p.keyStorePassword.toCharArray();
log.info("Closed connection to SSE source");
}
+ // Note: Sonar complains about host name verification being
+ // disabled here. This is necessary to handle devices using self-signed
+ // certificates (where CA would be unknown) - so we are leaving this code as is.
private Client ignoreSslClient() {
SSLContext sslcontext = null;
Code Review / ccsdk / sli.git / commitdiff