-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add disableSniHostCheck property to TLS and SSL configuration classes #1080
Labels
enhancement
A request for change or improvement to an existing feature
Milestone
Comments
sleberknight
added
the
enhancement
A request for change or improvement to an existing feature
label
Nov 22, 2023
For now, I added a new constructor, which becomes the "all-args" constructor. Deprecating and removal of these telescoping constructors should be done separately, if and when we think it makes sense. |
sleberknight
added a commit
that referenced
this issue
Nov 25, 2023
* Add disableSniHostCheck to TlsContextConfiguration, SSLContextConfiguration, and SimpleSSLContextFactory * Update SSLContextConfiguration#toSimpleSSLContextFactory factory method to provide disableSniHostCheck to SimpleSSLContextFactory * Update SSLContextConfiguration#toTlsContextConfiguration factory method to provide disableSniHostCheck to TlsContextConfiguration * Update javadoc of the conversion functions in TlsContextConfiguration to explain how disableSniHostCheck is handled (since it does not exist in Dropwizard TlsConfiguration) * Update TlsContextConfiguration#toSslContextConfiguration to provide disableSniHostCheck to SSLContextConfiguration * Add new all-args constructor to SimpleSSLContextFactory * Clean up duplicative code in SimpleSSLContextFactory by extracting several private helper methods * Change SimpleSSLContextFactory#configuration method to be public, and to return unmodifiable map. * Change tests with lots of assertions to use assertAll * Minor grammatical fixes in javadocs and comments Closes #1080 Closes #1085
terezivy
pushed a commit
that referenced
this issue
Nov 25, 2023
…#1086) * Add disableSniHostCheck to TlsContextConfiguration, SSLContextConfiguration, and SimpleSSLContextFactory * Update SSLContextConfiguration#toSimpleSSLContextFactory factory method to provide disableSniHostCheck to SimpleSSLContextFactory * Update SSLContextConfiguration#toTlsContextConfiguration factory method to provide disableSniHostCheck to TlsContextConfiguration * Update javadoc of the conversion functions in TlsContextConfiguration to explain how disableSniHostCheck is handled (since it does not exist in Dropwizard TlsConfiguration) * Update TlsContextConfiguration#toSslContextConfiguration to provide disableSniHostCheck to SSLContextConfiguration * Add new all-args constructor to SimpleSSLContextFactory * Clean up duplicative code in SimpleSSLContextFactory by extracting several private helper methods * Change SimpleSSLContextFactory#configuration method to be public, and to return unmodifiable map. * Change tests with lots of assertions to use assertAll * Minor grammatical fixes in javadocs and comments Closes #1080 Closes #1085
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Dropwizard 3.0 added the
disableSniHostCheck
option with a default value offalse
, meaning it enables SNI checking by default. While this is good, we need to support services that cannot yet enable strict SNI checking.So, we need to add this property to our own TLS and SSL configuration classes. The default should, like Dropwizard, be
false
(so strict security is the default), but also permit changing it totrue
(so SNI checking is disabled).disableSniHostCheck
toTlsContextConfiguration
disableSniHostCheck
toSSLContextConfiguration
disableSniHostCheck
toSimpleSSLContextFactory
(1)toTlsContextConfiguration
andtoSslContextConfiguration
) include thedisableSniHostCheck
propertyTlsContextConfiguration#toDropwizardTlsConfiguration
method that thedisableSniHostCheck
property does not exist in Dropwizard'sTlsConfiguration
class, so it is ignored.TlsContextConfiguration#fromDropwizardTlsConfiguration
method that thedisableSniHostCheck
property does not exist in Dropwizard'sTlsConfiguration
class, so we can't set a value from it, and that we are defaulting it tofalse
(which enables SNI checking) because that is the more secure option.I think these are all the things that must be changed, but when implementing there might be more. In that case, they should be added to the above list.
Notes:
SimpleSSLContextFactory
has telescoping constructors in addition to a builder, so we need to decide whether to adddisableSniHostCheck
only to the builder, or to also add yet another ugly constructor. We could also choose to deprecate those constructors, since we really want people using the builder anyway.The text was updated successfully, but these errors were encountered: