[CXF-6761] JAX-RS ClientImpl does not set TLSClientParameters on HTTPConduit when only HostnameVerifier is configured

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.1.4
• Fix Version/s: 3.1.5, 3.0.8, 3.2.0
• Component/s: JAX-RS
• Estimated Complexity: Novice
• Assignee: Sergey Beryozkin
• Reporter: Chris Ribble
• Created: 27/Jan/16 00:51
• Updated: 14/Oct/16 14:15
• Resolved: 27/Jan/16 11:42

Description

org.apache.cxf.jaxrs.client.spec.ClientImpl only copies the TLSClientParameters configured by ClientBuilder.newBuilder().hostnameVerifier(HostnameVerifier) if an SSLSocketFactory or TrustManagers are configured.

This makes it impossible to use a custom HostnameVerifier without also declaring a custom SSLSocketFactory or TrustManagers.

Snip of incorrect code from rt/rs/client/src/main/java/org/apache/cxf/jaxrs/client/spec/ClientImpl.java, line 282

            // TLS
            TLSClientParameters tlsParams = secConfig.getTlsClientParams();
            if (tlsParams.getSSLSocketFactory() != null 
                || tlsParams.getTrustManagers() != null) {
                clientCfg.getHttpConduit().setTlsClientParameters(tlsParams);
            }

Proposed replacement:

            // TLS
            TLSClientParameters tlsParams = secConfig.getTlsClientParams();
            if (tlsParams.getSSLSocketFactory() != null 
                || tlsParams.getTrustManagers() != null
                || tlsParams.getHostnameVerifier() != null) {
                clientCfg.getHttpConduit().setTlsClientParameters(tlsParams);
            }