Examples with TLSCertificateChecker org.apache.druid.server.security.TLSCertificateChecker used on opensource projects

Example 1 with TLSCertificateChecker

use of org.apache.druid.server.security.TLSCertificateChecker in project druid by druid-io.

the class JettyTest method testCustomCheckX509TrustManagerSetEndpointIdentificationAlgorithmToNullWithValidateServerHostnamesSetToFalse.

@Test
public void testCustomCheckX509TrustManagerSetEndpointIdentificationAlgorithmToNullWithValidateServerHostnamesSetToFalse() throws Exception {
    SslContextFactory.Server server = injector.getInstance(SslContextFactory.Server.class);
    server.setEndpointIdentificationAlgorithm("HTTPS");
    server.start();
    SSLEngine sslEngine = server.newSSLEngine();
    X509ExtendedTrustManager mockX509ExtendedTrustManager = Mockito.mock(X509ExtendedTrustManager.class);
    TLSCertificateChecker mockTLSCertificateChecker = Mockito.mock(TLSCertificateChecker.class);
    X509Certificate mockX509Certificate = Mockito.mock(X509Certificate.class);
    String authType = "testAuthType";
    X509Certificate[] chain = new X509Certificate[] { mockX509Certificate };
    // The EndpointIdentificationAlgorithm should not be null as we set it to HTTPS earlier
    Assert.assertNotNull(sslEngine.getSSLParameters().getEndpointIdentificationAlgorithm());
    CustomCheckX509TrustManager customCheckX509TrustManager = new CustomCheckX509TrustManager(mockX509ExtendedTrustManager, mockTLSCertificateChecker, false);
    customCheckX509TrustManager.checkServerTrusted(chain, authType, sslEngine);
    ArgumentCaptor<SSLEngine> captor = ArgumentCaptor.forClass(SSLEngine.class);
    Mockito.verify(mockTLSCertificateChecker).checkServer(ArgumentMatchers.eq(chain), ArgumentMatchers.eq(authType), captor.capture(), ArgumentMatchers.eq(mockX509ExtendedTrustManager));
    SSLEngine transformedSSLEngine = captor.getValue();
    // The EndpointIdentificationAlgorithm should be null or empty Stringas the CustomCheckX509TrustManager
    // has validateServerHostnames set to false
    String endpointIdentificationAlgorithm = transformedSSLEngine.getSSLParameters().getEndpointIdentificationAlgorithm();
    Assert.assertTrue(endpointIdentificationAlgorithm == null || endpointIdentificationAlgorithm.isEmpty());
}