Revision: 40bb1a52b929
Author: Jean Deruelle <[email protected]>
Date: Thu Dec 6 13:43:03 2012
Log: Fixes Issue 179
http://code.google.com/p/sipservlets/source/detail?r=40bb1a52b929
Modified:
/jain-sip-170.x/src/gov/nist/core/net/DefaultNetworkLayer.java
/jain-sip-170.x/src/gov/nist/core/net/NetworkLayer.java
/jain-sip-170.x/src/gov/nist/core/net/SslNetworkLayer.java
/jain-sip-170.x/src/gov/nist/javax/sip/SipStackImpl.java
/jain-sip-170.x/src/gov/nist/javax/sip/stack/ClientAuthType.java
=======================================
--- /jain-sip-170.x/src/gov/nist/core/net/DefaultNetworkLayer.java Tue Dec
4 15:52:49 2012
+++ /jain-sip-170.x/src/gov/nist/core/net/DefaultNetworkLayer.java Thu Dec
6 13:43:03 2012
@@ -25,6 +25,8 @@
*/
package gov.nist.core.net;
+import gov.nist.javax.sip.SipStackImpl;
+
import java.io.IOException;
import java.net.ConnectException;
import java.net.DatagramSocket;
@@ -208,5 +210,8 @@
// else
// return new Socket(address, port);
}
+
+ @Override
+ public void setSipStack(SipStackImpl sipStackImpl) {}
}
=======================================
--- /jain-sip-170.x/src/gov/nist/core/net/NetworkLayer.java Mon Dec 3
18:06:27 2012
+++ /jain-sip-170.x/src/gov/nist/core/net/NetworkLayer.java Thu Dec 6
13:43:03 2012
@@ -25,6 +25,8 @@
*/
package gov.nist.core.net;
+import gov.nist.javax.sip.SipStackImpl;
+
import java.io.IOException;
import java.net.DatagramSocket;
import java.net.InetAddress;
@@ -149,5 +151,11 @@
*/
public DatagramSocket createDatagramSocket(int port, InetAddress laddr)
throws SocketException;
+
+ /**
+ * Set the sip stack impl so that the network layer can access it to
query properties
+ * @param sipStackImpl
+ */
+ public void setSipStack(SipStackImpl sipStackImpl);
}
=======================================
--- /jain-sip-170.x/src/gov/nist/core/net/SslNetworkLayer.java Thu Dec 6
12:51:42 2012
+++ /jain-sip-170.x/src/gov/nist/core/net/SslNetworkLayer.java Thu Dec 6
13:43:03 2012
@@ -25,6 +25,12 @@
*/
package gov.nist.core.net;
+import gov.nist.core.CommonLogger;
+import gov.nist.core.LogWriter;
+import gov.nist.core.StackLogger;
+import gov.nist.javax.sip.SipStackImpl;
+import gov.nist.javax.sip.stack.ClientAuthType;
+
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
@@ -39,6 +45,7 @@
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
@@ -46,7 +53,9 @@
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
/**
* extended implementation of a network layer that allows to define a
private java
@@ -59,11 +68,34 @@
*/
public class SslNetworkLayer implements NetworkLayer {
+ private static StackLogger logger =
CommonLogger.getLogger(SslNetworkLayer.class);
+
private SSLSocketFactory sslSocketFactory;
private SSLServerSocketFactory sslServerSocketFactory;
+
+ // Create a trust manager that does not validate certificate chains
+ TrustManager[] trustAllCerts = new TrustManager[] {
+ new X509TrustManager() {
+ public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+ return new X509Certificate[0];
+ }
+ public void checkClientTrusted(X509Certificate[] certs, String
authType) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "checkClientTrusted : Not validating certs " +
certs + " authType " + authType);
+ }
+ }
+ public void checkServerTrusted(X509Certificate[] certs, String
authType) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "checkServerTrusted : Not validating certs " +
certs + " authType " + authType);
+ }
+ }
+ }};
public SslNetworkLayer(
+ SipStackImpl sipStack,
String trustStoreFile,
String keyStoreFile,
char[] keyStorePassword,
@@ -84,8 +116,20 @@
trustStore.load(new FileInputStream(trustStoreFile),
keyStorePassword);
tmFactory.init(trustStore);
kmFactory.init(keyStore, keyStorePassword);
- sslContext.init(kmFactory.getKeyManagers(),
tmFactory.getTrustManagers(), secureRandom);
- sslServerSocketFactory = sslContext.getServerSocketFactory();
+ if(sipStack.getClientAuth() == ClientAuthType.DisabledAll) {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "ClientAuth " + sipStack.getClientAuth() + "
bypassing all cert validations");
+ }
+ sslContext.init(null, trustAllCerts, secureRandom);
+ } else {
+ if (logger.isLoggingEnabled(LogWriter.TRACE_DEBUG)) {
+ logger.logDebug(
+ "ClientAuth " + sipStack.getClientAuth());
+ }
+ sslContext.init(kmFactory.getKeyManagers(),
tmFactory.getTrustManagers(), secureRandom);
+ }
+ sslServerSocketFactory = sslContext.getServerSocketFactory();
sslSocketFactory = sslContext.getSocketFactory();
}
@@ -220,4 +264,7 @@
// else
// return new Socket(address, port);
}
+
+ @Override
+ public void setSipStack(SipStackImpl sipStackImpl) {}
}
=======================================
--- /jain-sip-170.x/src/gov/nist/javax/sip/SipStackImpl.java Mon Dec 3
18:06:27 2012
+++ /jain-sip-170.x/src/gov/nist/javax/sip/SipStackImpl.java Thu Dec 6
13:43:03 2012
@@ -539,9 +539,9 @@
* </li>
*
* <li><b>gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE = String </b> Valid
values are Default (backward compatible with previous versions)
- * , Enabled, Want or Disabled. Set to Enabled if you want the SSL stack
to require a valid certificate chain from the client before
+ * , Enabled, Want, Disabled or DisabledAll. Set to Enabled if you want
the SSL stack to require a valid certificate chain from the client before
* accepting a connection. Set to Want if you want the SSL stack to
request a client Certificate, but not fail if one isn't presented.
- * A Disabled value will not require a certificate chain.
+ * A Disabled value will not require a certificate chain for the Server
Connection. A DisabledAll will not require a certificate chain for both
Server and Client Connections.
* </li>
*
*<li><b>gov.nist.javax.sip.RELIABLE_CONNECTION_KEEP_ALIVE_TIMEOUT</b>
Value in seconds which is used as default keepalive timeout
@@ -850,6 +850,14 @@
this.addExtensionMethod(em);
}
}
+
+ // Allow application to choose the tls client auth policy on
the socket
+ String clientAuthType =
configurationProperties.getProperty("gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE");
+ if (clientAuthType != null) {
+ super.clientAuth = ClientAuthType.valueOf(clientAuthType);
+ logger.logInfo("using " + clientAuthType + " tls auth policy");
+ }
+
String keyStoreFile = configurationProperties
.getProperty("javax.net.ssl.keyStore");
String trustStoreFile = configurationProperties
@@ -861,7 +869,7 @@
String keyStorePassword = configurationProperties
.getProperty("javax.net.ssl.keyStorePassword");
try {
- this.networkLayer = new
SslNetworkLayer(trustStoreFile,
+ this.networkLayer = new SslNetworkLayer(this,
trustStoreFile,
keyStoreFile,
keyStorePassword != null ?
keyStorePassword.toCharArray() : null,
@@ -964,13 +972,6 @@
ex);
}
- // Allow application to choose the tls client auth policy on
the socket
- String clientAuthType =
configurationProperties.getProperty("gov.nist.javax.sip.TLS_CLIENT_AUTH_TYPE");
- if (clientAuthType != null) {
- super.clientAuth = ClientAuthType.valueOf(clientAuthType);
- logger.logInfo("using " + clientAuthType + " tls auth policy");
- }
-
// The following features are unique to the NIST implementation.
/*
@@ -987,6 +988,7 @@
Class<?> clazz = Class.forName(path);
Constructor<?> c = clazz.getConstructor(new
Class[0]);
networkLayer = (NetworkLayer) c.newInstance(new
Object[0]);
+ networkLayer.setSipStack(this);
} catch (Exception e) {
throw new PeerUnavailableException(
"can't find or instantiate
NetworkLayer implementation: "
=======================================
--- /jain-sip-170.x/src/gov/nist/javax/sip/stack/ClientAuthType.java Mon
Dec 3 18:06:27 2012
+++ /jain-sip-170.x/src/gov/nist/javax/sip/stack/ClientAuthType.java Thu
Dec 6 13:43:03 2012
@@ -30,5 +30,5 @@
*
*/
public enum ClientAuthType {
- Enabled, Disabled, Want, Default;
+ Enabled, Disabled, DisabledAll, Want, Default;
}
