diff options
11 files changed, 229 insertions, 30 deletions
diff --git a/adaptors/base/http/provider/src/main/java/org/onap/ccsdk/sli/adaptors/base/http/AbstractHttpAdapter.java b/adaptors/base/http/provider/src/main/java/org/onap/ccsdk/sli/adaptors/base/http/AbstractHttpAdapter.java index 65cbdd764..0950ceba8 100644 --- a/adaptors/base/http/provider/src/main/java/org/onap/ccsdk/sli/adaptors/base/http/AbstractHttpAdapter.java +++ b/adaptors/base/http/provider/src/main/java/org/onap/ccsdk/sli/adaptors/base/http/AbstractHttpAdapter.java @@ -10,6 +10,7 @@ import javax.net.ssl.HostnameVerifier; import javax.net.ssl.SSLSession; import javax.ws.rs.client.ClientBuilder; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.onap.ccsdk.sli.core.utils.common.EnvProperties; import org.onap.logging.filter.base.MetricLogClientFilter; import org.onap.logging.filter.base.PayloadLoggingClientFilter; @@ -32,12 +33,8 @@ public abstract class AbstractHttpAdapter { } private void defaultHostNameVerifier() { - clientBuilder.hostnameVerifier(new HostnameVerifier() { - @Override - public boolean verify(String hostname, SSLSession session) { - return true; - } - }); + // Perform host name verification EXCEPT if 'host' is IP address + clientBuilder.hostnameVerifier(new AcceptIpAddressHostNameVerifier()); } protected void enableMetricLogging() { diff --git a/adaptors/mdsal-resource/provider/src/main/java/org/onap/ccsdk/sli/adaptors/resource/mdsal/RestService.java b/adaptors/mdsal-resource/provider/src/main/java/org/onap/ccsdk/sli/adaptors/resource/mdsal/RestService.java index ebddc24ae..7f90ab43d 100644 --- a/adaptors/mdsal-resource/provider/src/main/java/org/onap/ccsdk/sli/adaptors/resource/mdsal/RestService.java +++ b/adaptors/mdsal-resource/provider/src/main/java/org/onap/ccsdk/sli/adaptors/resource/mdsal/RestService.java @@ -22,6 +22,7 @@ package org.onap.ccsdk.sli.adaptors.resource.mdsal; import org.apache.commons.codec.binary.Base64; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.w3c.dom.Document; @@ -90,8 +91,8 @@ public class RestService { try { HttpURLConnection conn = getRestConnection(fullUrl, method); if (conn instanceof HttpsURLConnection) { - HostnameVerifier hostnameVerifier = (hostname, session) -> true; - ((HttpsURLConnection) conn).setHostnameVerifier(hostnameVerifier); + // Safely disable host name verification if host is an IP address or 'localhost' + ((HttpsURLConnection) conn).setHostnameVerifier(new AcceptIpAddressHostNameVerifier()); } // Write message diff --git a/adaptors/message-router/consumer/provider/pom.xml b/adaptors/message-router/consumer/provider/pom.xml index 6eb580373..c3b6ef35b 100755 --- a/adaptors/message-router/consumer/provider/pom.xml +++ b/adaptors/message-router/consumer/provider/pom.xml @@ -27,6 +27,11 @@ <groupId>com.google.code.gson</groupId> <artifactId>gson</artifactId> </dependency> + <dependency> + <groupId>org.onap.ccsdk.sli.core</groupId> + <artifactId>utils-provider</artifactId> + <version>${project.version}</version> + </dependency> </dependencies> <build> diff --git a/adaptors/message-router/consumer/provider/src/main/java/org/onap/ccsdk/sli/adaptors/messagerouter/consumer/provider/impl/AbstractBaseConsumer.java b/adaptors/message-router/consumer/provider/src/main/java/org/onap/ccsdk/sli/adaptors/messagerouter/consumer/provider/impl/AbstractBaseConsumer.java index 8937f7b91..7924137ad 100755 --- a/adaptors/message-router/consumer/provider/src/main/java/org/onap/ccsdk/sli/adaptors/messagerouter/consumer/provider/impl/AbstractBaseConsumer.java +++ b/adaptors/message-router/consumer/provider/src/main/java/org/onap/ccsdk/sli/adaptors/messagerouter/consumer/provider/impl/AbstractBaseConsumer.java @@ -36,6 +36,7 @@ import javax.net.ssl.SSLSession; import org.onap.ccsdk.sli.adaptors.messagerouter.consumer.api.ConsumerApi; import org.onap.ccsdk.sli.adaptors.messagerouter.consumer.api.RequestHandler; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -163,15 +164,10 @@ public abstract class AbstractBaseConsumer implements ConsumerApi { httpUrlConnection.setConnectTimeout(connectTimeout); httpUrlConnection.setReadTimeout(readTimeout); - // ignore hostname errors when dealing with HTTPS connections + // Safely ignore hostname errors if host is an ip address or localhost if (httpUrlConnection instanceof HttpsURLConnection) { HttpsURLConnection conn = (HttpsURLConnection) httpUrlConnection; - conn.setHostnameVerifier(new HostnameVerifier() { - @Override - public boolean verify(String arg0, SSLSession arg1) { - return true; - } - }); + conn.setHostnameVerifier(new AcceptIpAddressHostNameVerifier()); } return httpUrlConnection; } diff --git a/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifier.java b/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifier.java new file mode 100644 index 000000000..25686d542 --- /dev/null +++ b/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifier.java @@ -0,0 +1,94 @@ +/*- + * ============LICENSE_START======================================================= + * onap + * ================================================================================ + * Copyright (C) 2021 AT&T + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + + package org.onap.ccsdk.sli.core.utils.common; + +import javax.net.ssl.HostnameVerifier; +import javax.net.ssl.HttpsURLConnection; +import javax.net.ssl.SSLSession; + +/** + * HostnameVerifier that accepts IP addresses without verification, but + * does default host name verification on true FQDNs + */ +public class AcceptIpAddressHostNameVerifier implements HostnameVerifier { + + public static final String DISABLE_HOSTNAME_VERIFICATION = "org.onap.ccsdk.host.verification.disable"; + + public static final String IPV4_REGEX = "\\A(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z"; + public static final String IPV6_HEX4DECCOMPRESSED_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?) ::((?:[0-9A-Fa-f]{1,4}:)*)(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z"; + public static final String IPV6_6HEX4DEC_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}:){6,6})(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}\\z"; + public static final String IPV6_HEXCOMPRESSED_REGEX = "\\A((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)\\z"; + public static final String IPV6_REGEX = "\\A(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\\z"; + + boolean disableHostVerification = false; + + public AcceptIpAddressHostNameVerifier() { + // Allow for host name verification to be disabled if + // necessary (for example, if self-signed certificates must + // be supported) + String disableHostVerification = System.getProperty(DISABLE_HOSTNAME_VERIFICATION, "false"); + + if ("true".equalsIgnoreCase(disableHostVerification)) { + this.disableHostVerification = true; + } else { + this.disableHostVerification = false; + } + } + + public AcceptIpAddressHostNameVerifier(boolean disableHostVerification) { + this.disableHostVerification = disableHostVerification; + } + + @Override + public boolean verify(String hostName, SSLSession session) { + + if (disableHostVerification) { + return true; + } + + // Null host name should never happen, but better to be safe + if (hostName == null) { + return false; + } + + // If "hostName" is an IP address, accept it + if (hostName.matches(IPV4_REGEX) || + hostName.matches(IPV6_REGEX) || + hostName.matches(IPV6_HEX4DECCOMPRESSED_REGEX) || + hostName.matches(IPV6_6HEX4DEC_REGEX) || + hostName.matches(IPV6_HEXCOMPRESSED_REGEX)) + { + return true; + } + + // Handle localhost as special case + if (hostName.equals("localhost")) { + return(true); + } + + // Host name is not an IP address - perform default host + // name verification. + HostnameVerifier defaultHv = HttpsURLConnection.getDefaultHostnameVerifier(); + return(defaultHv.verify(hostName, session)); + } + + +} diff --git a/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/EnvProperties.java b/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/EnvProperties.java index 0dca28427..463191fb2 100644 --- a/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/EnvProperties.java +++ b/core/utils/provider/src/main/java/org/onap/ccsdk/sli/core/utils/common/EnvProperties.java @@ -1,3 +1,23 @@ +/*- + * ============LICENSE_START======================================================= + * onap + * ================================================================================ + * Copyright (C) 2021 AT&T + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + package org.onap.ccsdk.sli.core.utils.common; import java.io.IOException; @@ -8,6 +28,17 @@ import java.util.Properties; import java.util.regex.Matcher; import java.util.regex.Pattern; +/** + * Drop-in replacement for java.util.Properties that allows env + * variables to be used as settings for property files. For example, + * + * my.property = ${MY_PROPERTY} + * + * A default value can also be provided using :- notation. For example, + * + * my.property = ${MY_PROPERTY:-defaultValue} + */ + public class EnvProperties extends Properties { @Override diff --git a/core/utils/provider/src/test/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifierTest.java b/core/utils/provider/src/test/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifierTest.java new file mode 100644 index 000000000..85fcdfafd --- /dev/null +++ b/core/utils/provider/src/test/java/org/onap/ccsdk/sli/core/utils/common/AcceptIpAddressHostNameVerifierTest.java @@ -0,0 +1,78 @@ +package org.onap.ccsdk.sli.core.utils.common; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import javax.net.ssl.HostnameVerifier; +import javax.net.ssl.SSLSession; + +import org.junit.Test; +import org.mockito.Mockito; + +public class AcceptIpAddressHostNameVerifierTest { + + @Test + public void testVerify() { + HostnameVerifier hv = new AcceptIpAddressHostNameVerifier(); + SSLSession sslSession = Mockito.mock(SSLSession.class); + + // Test that IPv4 style address is accepted + assertTrue(hv.verify("127.0.0.1", sslSession)); + + // Test that IPv6 style addresses are also accepted + assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession)); + assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession)); + assertTrue(hv.verify("2001:db8::", sslSession)); + assertTrue(hv.verify("::1234:5678", sslSession)); + assertTrue(hv.verify("2001:db8::1234:5678", sslSession)); + assertTrue(hv.verify("::1", sslSession)); + + // Test that localhost is accepted + assertTrue(hv.verify("localhost", sslSession)); + + // Test that FQDN is not accepted (since there is no certificate) + assertFalse(hv.verify("bogus.org", sslSession)); + + // Repeat tests with verification disabled via arg to constructor + hv = new AcceptIpAddressHostNameVerifier(true); + + // Test that IPv4 style address is accepted + assertTrue(hv.verify("127.0.0.1", sslSession)); + + // Test that IPv6 style addresses are also accepted + assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession)); + assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession)); + assertTrue(hv.verify("2001:db8::", sslSession)); + assertTrue(hv.verify("::1234:5678", sslSession)); + assertTrue(hv.verify("2001:db8::1234:5678", sslSession)); + assertTrue(hv.verify("::1", sslSession)); + + // Test that localhost is accepted + assertTrue(hv.verify("localhost", sslSession)); + + // Test that FQDN is accepted (since verification is disabled) + assertTrue(hv.verify("bogus.org", sslSession)); + + // Repeat tests with verification disabled via arg to constructor + System.setProperty(AcceptIpAddressHostNameVerifier.DISABLE_HOSTNAME_VERIFICATION, "true"); + hv = new AcceptIpAddressHostNameVerifier(); + + // Test that IPv4 style address is accepted + assertTrue(hv.verify("127.0.0.1", sslSession)); + + // Test that IPv6 style addresses are also accepted + assertTrue(hv.verify("2001:db8:3333:4444:5555:6666:7777:8888", sslSession)); + assertTrue(hv.verify("2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF", sslSession)); + assertTrue(hv.verify("2001:db8::", sslSession)); + assertTrue(hv.verify("::1234:5678", sslSession)); + assertTrue(hv.verify("2001:db8::1234:5678", sslSession)); + assertTrue(hv.verify("::1", sslSession)); + + // Test that localhost is accepted + assertTrue(hv.verify("localhost", sslSession)); + + // Test that FQDN is accepted (since verification is disabled) + assertTrue(hv.verify("bogus.org", sslSession)); + } + +} diff --git a/northbound/dmaap-listener/src/main/java/org/onap/ccsdk/sli/northbound/dmaapclient/SdncOdlConnection.java b/northbound/dmaap-listener/src/main/java/org/onap/ccsdk/sli/northbound/dmaapclient/SdncOdlConnection.java index 6eeef9b48..681502021 100644 --- a/northbound/dmaap-listener/src/main/java/org/onap/ccsdk/sli/northbound/dmaapclient/SdncOdlConnection.java +++ b/northbound/dmaap-listener/src/main/java/org/onap/ccsdk/sli/northbound/dmaapclient/SdncOdlConnection.java @@ -33,6 +33,7 @@ import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLSession; import org.apache.commons.codec.binary.Base64; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -106,12 +107,8 @@ public class SdncOdlConnection { httpConn.setUseCaches(false); if (httpConn instanceof HttpsURLConnection) { - HostnameVerifier hostnameVerifier = new HostnameVerifier() { - @Override - public boolean verify(String hostname, SSLSession session) { - return true; - } - }; + // Safely disable host name verification if host is an ip address or 'localhost' + HostnameVerifier hostnameVerifier = new AcceptIpAddressHostNameVerifier(); ((HttpsURLConnection) httpConn).setHostnameVerifier(hostnameVerifier); } diff --git a/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncOdlConnection.java b/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncOdlConnection.java index 78d9c5bc9..79bd2235f 100644 --- a/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncOdlConnection.java +++ b/northbound/ueb-listener/src/main/java/org/onap/ccsdk/sli/northbound/uebclient/SdncOdlConnection.java @@ -35,6 +35,7 @@ import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLSession; import org.apache.commons.codec.binary.Base64; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -110,12 +111,7 @@ public class SdncOdlConnection { httpConn.setUseCaches(false); if (httpConn instanceof HttpsURLConnection) { - HostnameVerifier hostnameVerifier = new HostnameVerifier() { - @Override - public boolean verify(String hostname, SSLSession session) { - return true; - } - }; + HostnameVerifier hostnameVerifier = new AcceptIpAddressHostNameVerifier(); ((HttpsURLConnection) httpConn).setHostnameVerifier(hostnameVerifier); } diff --git a/plugins/restapi-call-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/restapicall/RestapiCallNode.java b/plugins/restapi-call-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/restapicall/RestapiCallNode.java index ad74b02de..f1aa2b266 100755 --- a/plugins/restapi-call-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/restapicall/RestapiCallNode.java +++ b/plugins/restapi-call-node/provider/src/main/java/org/onap/ccsdk/sli/plugins/restapicall/RestapiCallNode.java @@ -81,6 +81,7 @@ import org.glassfish.jersey.media.multipart.file.FileDataBodyPart; import org.onap.ccsdk.sli.core.sli.SvcLogicContext; import org.onap.ccsdk.sli.core.sli.SvcLogicException; import org.onap.ccsdk.sli.core.sli.SvcLogicJavaPlugin; +import org.onap.ccsdk.sli.core.utils.common.AcceptIpAddressHostNameVerifier; import org.onap.ccsdk.sli.core.utils.common.EnvProperties; import org.onap.logging.filter.base.HttpURLConnectionMetricUtil; import org.onap.logging.filter.base.MetricLogClientFilter; @@ -795,9 +796,9 @@ public class RestapiCallNode implements SvcLogicJavaPlugin { Client client; if (ssl != null) { HttpsURLConnection.setDefaultSSLSocketFactory(ssl.getSocketFactory()); - client = ClientBuilder.newBuilder().sslContext(ssl).hostnameVerifier((s, sslSession) -> true).build(); + client = ClientBuilder.newBuilder().sslContext(ssl).hostnameVerifier(new AcceptIpAddressHostNameVerifier()).build(); } else { - client = ClientBuilder.newBuilder().hostnameVerifier((s, sslSession) -> true).build(); + client = ClientBuilder.newBuilder().hostnameVerifier(new AcceptIpAddressHostNameVerifier()).build(); } setClientTimeouts(client); @@ -924,7 +925,7 @@ public class RestapiCallNode implements SvcLogicJavaPlugin { protected SSLContext createSSLContext(Parameters p) { try (FileInputStream in = new FileInputStream(p.keyStoreFileName)) { - HttpsURLConnection.setDefaultHostnameVerifier((string, ssls) -> true); + HttpsURLConnection.setDefaultHostnameVerifier(new AcceptIpAddressHostNameVerifier()); KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); KeyStore ks = KeyStore.getInstance("PKCS12"); char[] pwd = p.keyStorePassword.toCharArray(); diff --git a/plugins/restconf-client/provider/src/main/java/org/onap/ccsdk/sli/plugins/restconfdiscovery/RestconfDiscoveryNode.java b/plugins/restconf-client/provider/src/main/java/org/onap/ccsdk/sli/plugins/restconfdiscovery/RestconfDiscoveryNode.java index cf69d7a3c..5b47cf5b6 100644 --- a/plugins/restconf-client/provider/src/main/java/org/onap/ccsdk/sli/plugins/restconfdiscovery/RestconfDiscoveryNode.java +++ b/plugins/restconf-client/provider/src/main/java/org/onap/ccsdk/sli/plugins/restconfdiscovery/RestconfDiscoveryNode.java @@ -167,6 +167,9 @@ public class RestconfDiscoveryNode implements SvcLogicDiscoveryPlugin { log.info("Closed connection to SSE source"); } + // Note: Sonar complains about host name verification being + // disabled here. This is necessary to handle devices using self-signed + // certificates (where CA would be unknown) - so we are leaving this code as is. private Client ignoreSslClient() { SSLContext sslcontext = null; |