Skip to content

Commit fb73639

Browse files
tvernumtvernum
committed
Remove SSLService.getHostnameVerifier
1 parent 73689ea commit fb73639

File tree

7 files changed

+28
-35
lines changed

7 files changed

+28
-35
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/SSLService.java‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -257,14 +257,6 @@ SSLIOSessionStrategy sslIOSessionStrategy(SslConfiguration config, SSLContext ss
257257
return sslIOSessionStrategy(sslContext, supportedProtocols, ciphers, verifier);
258258
}
259259

260-
public static HostnameVerifier getHostnameVerifier(SslConfiguration sslConfiguration) {
261-
if (sslConfiguration.verificationMode().isHostnameVerificationEnabled()) {
262-
return new DefaultHostnameVerifier();
263-
} else {
264-
return NoopHostnameVerifier.INSTANCE;
265-
}
266-
}
267-
268260
/**
269261
* The {@link SSLParameters} that are associated with the {@code sslContext}.
270262
* <p>
@@ -836,11 +828,15 @@ public SSLSocketFactory socketFactory() {
836828

837829
@Override
838830
public HostnameVerifier hostnameVerifier() {
839-
return SSLService.getHostnameVerifier(this.sslConfiguration);
831+
if (this.sslConfiguration.verificationMode().isHostnameVerificationEnabled()) {
832+
return new DefaultHostnameVerifier();
833+
} else {
834+
return NoopHostnameVerifier.INSTANCE;
835+
}
840836
}
841837

842838
@Override
843-
public SSLConnectionSocketFactory socketConnectionFactory() {
839+
public SSLConnectionSocketFactory connectionSocketFactory() {
844840
return new SSLConnectionSocketFactory(socketFactory(), hostnameVerifier());
845841
}
846842

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/SslProfile.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public interface SslProfile {
2525

2626
HostnameVerifier hostnameVerifier();
2727

28-
SSLConnectionSocketFactory socketConnectionFactory();
28+
SSLConnectionSocketFactory connectionSocketFactory();
2929

3030
/**
3131
* @return An object that is useful for configuring Apache Http Client v4.x

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/jwt/JwtUtil.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@
4444
import org.elasticsearch.common.settings.RotatableSecret;
4545
import org.elasticsearch.common.settings.SecureString;
4646
import org.elasticsearch.common.settings.SettingsException;
47-
import org.elasticsearch.common.ssl.SslConfiguration;
4847
import org.elasticsearch.common.util.concurrent.ThreadContext;
4948
import org.elasticsearch.env.Environment;
5049
import org.elasticsearch.xcontent.XContentBuilder;
@@ -53,6 +52,7 @@
5352
import org.elasticsearch.xpack.core.security.authc.RealmSettings;
5453
import org.elasticsearch.xpack.core.security.authc.jwt.JwtRealmSettings;
5554
import org.elasticsearch.xpack.core.ssl.SSLService;
55+
import org.elasticsearch.xpack.core.ssl.SslProfile;
5656

5757
import java.io.IOException;
5858
import java.io.InputStream;
@@ -273,11 +273,13 @@ public static CloseableHttpAsyncClient createHttpClient(final RealmConfig realmC
273273
return AccessController.doPrivileged((PrivilegedExceptionAction<CloseableHttpAsyncClient>) () -> {
274274
final ConnectingIOReactor ioReactor = new DefaultConnectingIOReactor();
275275
final String sslKey = RealmSettings.realmSslPrefix(realmConfig.identifier());
276-
final SslConfiguration sslConfiguration = sslService.getSSLConfiguration(sslKey);
277-
final SSLContext clientContext = sslService.sslContext(sslConfiguration);
278-
final HostnameVerifier verifier = SSLService.getHostnameVerifier(sslConfiguration);
276+
277+
final SslProfile sslProfile = sslService.profile(sslKey);
278+
final SSLContext clientContext = sslProfile.sslContext();
279+
final HostnameVerifier verifier = sslProfile.hostnameVerifier();
279280
final Registry<SchemeIOSessionStrategy> registry = RegistryBuilder.<SchemeIOSessionStrategy>create()
280281
.register("http", NoopIOSessionStrategy.INSTANCE)
282+
// TODO: Should this use profile.ioSessionStrategy4 ?
281283
.register("https", new SSLIOSessionStrategy(clientContext, verifier))
282284
.build();
283285
final PoolingNHttpClientConnectionManager connectionManager = new PoolingNHttpClientConnectionManager(ioReactor, registry);

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectAuthenticator.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@
8080
import org.elasticsearch.SpecialPermission;
8181
import org.elasticsearch.action.ActionListener;
8282
import org.elasticsearch.common.Strings;
83-
import org.elasticsearch.common.ssl.SslConfiguration;
8483
import org.elasticsearch.common.util.concurrent.ListenableFuture;
8584
import org.elasticsearch.core.CheckedRunnable;
8685
import org.elasticsearch.core.Nullable;
@@ -93,6 +92,7 @@
9392
import org.elasticsearch.xpack.core.security.authc.RealmSettings;
9493
import org.elasticsearch.xpack.core.security.authc.oidc.OpenIdConnectRealmSettings;
9594
import org.elasticsearch.xpack.core.ssl.SSLService;
95+
import org.elasticsearch.xpack.core.ssl.SslProfile;
9696
import org.elasticsearch.xpack.security.PrivilegedFileWatcher;
9797
import org.elasticsearch.xpack.security.authc.jwt.JwtUtil;
9898

@@ -715,11 +715,12 @@ private CloseableHttpAsyncClient createHttpClient() {
715715
IOReactorConfig.custom().setSoKeepAlive(realmConfig.getSetting(HTTP_TCP_KEEP_ALIVE)).build()
716716
);
717717
final String sslKey = RealmSettings.realmSslPrefix(realmConfig.identifier());
718-
final SslConfiguration sslConfiguration = sslService.getSSLConfiguration(sslKey);
719-
final SSLContext clientContext = sslService.sslContext(sslConfiguration);
720-
final HostnameVerifier verifier = SSLService.getHostnameVerifier(sslConfiguration);
718+
final SslProfile sslProfile = sslService.profile(sslKey);
719+
final SSLContext clientContext = sslProfile.sslContext();
720+
final HostnameVerifier verifier = sslProfile.hostnameVerifier();
721721
Registry<SchemeIOSessionStrategy> registry = RegistryBuilder.<SchemeIOSessionStrategy>create()
722722
.register("http", NoopIOSessionStrategy.INSTANCE)
723+
// TODO: Should this use profile.ioSessionStrategy4 ?
723724
.register("https", new SSLIOSessionStrategy(clientContext, verifier))
724725
.build();
725726
PoolingNHttpClientConnectionManager connectionManager = new PoolingNHttpClientConnectionManager(ioReactor, registry);

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/saml/SamlRealm.java‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import org.elasticsearch.common.Strings;
2424
import org.elasticsearch.common.settings.Setting;
2525
import org.elasticsearch.common.settings.SettingsException;
26-
import org.elasticsearch.common.ssl.SslConfiguration;
2726
import org.elasticsearch.common.ssl.SslKeyConfig;
2827
import org.elasticsearch.common.util.CollectionUtils;
2928
import org.elasticsearch.common.util.concurrent.ThreadContext;
@@ -49,6 +48,7 @@
4948
import org.elasticsearch.xpack.core.security.user.User;
5049
import org.elasticsearch.xpack.core.ssl.CertParsingUtils;
5150
import org.elasticsearch.xpack.core.ssl.SSLService;
51+
import org.elasticsearch.xpack.core.ssl.SslProfile;
5252
import org.elasticsearch.xpack.security.PrivilegedFileWatcher;
5353
import org.elasticsearch.xpack.security.authc.Realms;
5454
import org.elasticsearch.xpack.security.authc.TokenService;
@@ -107,7 +107,6 @@
107107
import java.util.stream.Collectors;
108108
import java.util.stream.Stream;
109109

110-
import javax.net.ssl.HostnameVerifier;
111110
import javax.net.ssl.X509KeyManager;
112111

113112
import static org.elasticsearch.common.Strings.collectionToCommaDelimitedString;
@@ -684,9 +683,8 @@ private static Tuple<AbstractReloadingMetadataResolver, Supplier<EntityDescripto
684683
HttpClientBuilder builder = HttpClientBuilder.create();
685684
// ssl setup
686685
final String sslKey = RealmSettings.realmSslPrefix(config.identifier());
687-
final SslConfiguration sslConfiguration = sslService.getSSLConfiguration(sslKey);
688-
final HostnameVerifier verifier = SSLService.getHostnameVerifier(sslConfiguration);
689-
SSLConnectionSocketFactory factory = new SSLConnectionSocketFactory(sslService.sslSocketFactory(sslConfiguration), verifier);
686+
final SslProfile sslProfile = sslService.profile(sslKey);
687+
final SSLConnectionSocketFactory factory = sslProfile.connectionSocketFactory();
690688
builder.setSSLSocketFactory(factory);
691689

692690
TimeValue maxRefresh = config.getSetting(IDP_METADATA_HTTP_REFRESH);

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/ssl/SSLErrorMessageCertificateVerificationTests.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
import org.elasticsearch.test.http.MockWebServer;
3030
import org.elasticsearch.xpack.core.common.socket.SocketAccess;
3131
import org.elasticsearch.xpack.core.ssl.SSLService;
32+
import org.elasticsearch.xpack.core.ssl.SslProfile;
3233

3334
import java.io.FileNotFoundException;
3435
import java.io.IOException;
@@ -170,18 +171,18 @@ private void connect(SSLSocket clientSocket, MockWebServer webServer) throws IOE
170171
}
171172

172173
private CloseableHttpClient buildHttpClient(SSLService sslService) {
173-
final SslConfiguration sslConfiguration = sslService.getSSLConfiguration(HTTP_CLIENT_SSL);
174-
final HostnameVerifier verifier = SSLService.getHostnameVerifier(sslConfiguration);
175-
final SSLSocketFactory socketFactory = sslService.sslSocketFactory(sslConfiguration);
174+
final SslProfile profile = sslService.profile(HTTP_CLIENT_SSL);
175+
final HostnameVerifier verifier = profile.hostnameVerifier();
176+
final SSLSocketFactory socketFactory = profile.socketFactory();
176177
final SSLConnectionSocketFactory connectionSocketFactory = new SSLConnectionSocketFactory(socketFactory, verifier);
177178
return HttpClientBuilder.create().setSSLSocketFactory(connectionSocketFactory).build();
178179
}
179180

180181
private RestClient buildRestClient(SSLService sslService, MockWebServer webServer) {
181-
final SslConfiguration sslConfiguration = sslService.getSSLConfiguration(HTTP_CLIENT_SSL);
182+
final SslProfile profile = sslService.profile(HTTP_CLIENT_SSL);
182183
final HttpHost httpHost = new HttpHost(webServer.getHostName(), webServer.getPort(), "https");
183184
return RestClient.builder(httpHost)
184-
.setHttpClientConfigCallback(client -> client.setSSLStrategy(sslService.sslIOSessionStrategy(sslConfiguration)))
185+
.setHttpClientConfigCallback(client -> client.setSSLStrategy(profile.ioSessionStrategy4()))
185186
.build();
186187
}
187188

‎x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/common/http/HttpClient.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@
4848
import org.elasticsearch.common.Strings;
4949
import org.elasticsearch.common.regex.Regex;
5050
import org.elasticsearch.common.settings.Settings;
51-
import org.elasticsearch.common.ssl.SslConfiguration;
5251
import org.elasticsearch.common.unit.ByteSizeValue;
5352
import org.elasticsearch.common.util.Maps;
5453
import org.elasticsearch.core.Streams;
@@ -76,8 +75,6 @@
7675
import java.util.concurrent.TimeUnit;
7776
import java.util.concurrent.atomic.AtomicReference;
7877

79-
import javax.net.ssl.HostnameVerifier;
80-
8178
public class HttpClient implements Closeable {
8279

8380
private static final String SETTINGS_SSL_PREFIX = "xpack.http.ssl.";
@@ -117,9 +114,7 @@ private CloseableHttpClient createHttpClient() {
117114
HttpClientBuilder clientBuilder = HttpClientBuilder.create();
118115

119116
// ssl setup
120-
SslConfiguration sslConfiguration = sslService.getSSLConfiguration(SETTINGS_SSL_PREFIX);
121-
HostnameVerifier verifier = SSLService.getHostnameVerifier(sslConfiguration);
122-
SSLConnectionSocketFactory factory = new SSLConnectionSocketFactory(sslService.sslSocketFactory(sslConfiguration), verifier);
117+
SSLConnectionSocketFactory factory = sslService.profile(SETTINGS_SSL_PREFIX).connectionSocketFactory();
123118
clientBuilder.setSSLSocketFactory(factory);
124119

125120
final SocketConfig.Builder socketConfigBuilder = SocketConfig.custom();

0 commit comments

Comments
 (0)