diff --git a/ballerina-tests/http-security-tests/tests/ssl_disable_ssl_test.bal b/ballerina-tests/http-security-tests/tests/ssl_disable_ssl_test.bal index 21bf5b34f..f1b003b61 100644 --- a/ballerina-tests/http-security-tests/tests/ssl_disable_ssl_test.bal +++ b/ballerina-tests/http-security-tests/tests/ssl_disable_ssl_test.bal @@ -61,19 +61,3 @@ public function testSslDisabledClient1() returns error? { test:assertFail(msg = "Found unexpected output: " + resp.message()); } } - -http:ClientConfiguration disableSslClientConf2 = { - secureSocket: { - } -}; - -@test:Config {} -public function testSslDisabledClient2() { - http:Client|error httpClient = new ("https://localhost:9238", disableSslClientConf2); - string expectedErrMsg = "Need to configure cert with client SSL certificates file"; - if (httpClient is error) { - test:assertEquals(httpClient.message(), expectedErrMsg); - } else { - test:assertFail(msg = "Expected mutual SSL error not found"); - } -} diff --git a/ballerina-tests/http-security-tests/tests/ssl_sni_host_name_test.bal b/ballerina-tests/http-security-tests/tests/ssl_sni_host_name_test.bal index 46eb64b1c..7eaa52b7e 100644 --- a/ballerina-tests/http-security-tests/tests/ssl_sni_host_name_test.bal +++ b/ballerina-tests/http-security-tests/tests/ssl_sni_host_name_test.bal @@ -76,6 +76,12 @@ http:ClientConfiguration http1SniClientConf2 = { } }; +http:ClientConfiguration http2SniClientConf3 = { + secureSocket: { + serverName: "localhost" + } +}; + @test:Config {} public function testHttp2WithSni() returns error? { http:Client clientEP = check new ("https://127.0.0.1:9207", http2SniClientConf); @@ -100,3 +106,25 @@ public function testSniFailure() returns error? { test:assertFail("Test `testSniFailure` is expecting an error. But received a success response"); } } + +@test:Config {} +public function testSniWhenUsingDefaultCerts() returns error? { + http:Client httpClient = check new("https://www.google.com", http2SniClientConf3); + string|error resp = httpClient->get("/"); + // This response is success because even though we send a wrong server name, google.com sends the default cert which + // is valid and trusted by the client. + if resp is error { + test:assertFail("Found unexpected output: " + resp.message()); + } +} + +@test:Config {} +public function testSniFailureWhenUsingDefaultCerts() returns error? { + http:Client clientEP = check new ("https://127.0.0.1:9208", http2SniClientConf3); + string|error resp = clientEP->get("/http1SniService/"); + if resp is error { + common:assertTrueTextPayload(resp.message(), "SSL connection failed:javax.net.ssl.SSLHandshakeException:"); + } else { + test:assertFail("Test `testSniFailureWhenUsingDefaultCerts` is expecting an error. But received a success response"); + } +} diff --git a/changelog.md b/changelog.md index 6b36b464e..d262664c1 100644 --- a/changelog.md +++ b/changelog.md @@ -6,7 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] -- [Add support for configuring server name to be used in the SSL SNI extension](https://github.com/ballerina-platform/ballerina-library/issues/7435) ### Added @@ -18,12 +17,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - [Migrate client and service data binding lang utils usage into data.jsondata module utils `toJson` and `parserAsType`](https://github.com/ballerina-platform/ballerina-library/issues/6747) - [Add static code rules](https://github.com/ballerina-platform/ballerina-library/issues/7283) - [Add relax data binding support for service and client data binding](https://github.com/ballerina-platform/ballerina-library/issues/7366) +- [Add support for configuring server name to be used in the SSL SNI extension](https://github.com/ballerina-platform/ballerina-library/issues/7435) ### Fixed - [Address CVE-2024-7254 vulnerability](https://github.com/ballerina-platform/ballerina-library/issues/7013) - [Fix duplicating `Content-Type` header via the `addHeader` method](https://github.com/ballerina-platform/ballerina-library/issues/7268) - [Update netty version](https://github.com/ballerina-platform/ballerina-library/issues/7358) +- [Fix the issue of not being able to configure only server name in the secureSocket config](https://github.com/ballerina-platform/ballerina-library/issues/7443) ## [2.12.0] - 2024-08-20 diff --git a/native/src/main/java/io/ballerina/stdlib/http/api/HttpUtil.java b/native/src/main/java/io/ballerina/stdlib/http/api/HttpUtil.java index e3710ad81..b15cd2818 100644 --- a/native/src/main/java/io/ballerina/stdlib/http/api/HttpUtil.java +++ b/native/src/main/java/io/ballerina/stdlib/http/api/HttpUtil.java @@ -1409,13 +1409,7 @@ public static void populateSSLConfiguration(SslConfiguration senderConfiguration } Object cert = secureSocket.get(HttpConstants.SECURESOCKET_CONFIG_CERT); if (cert == null) { - BMap key = getBMapValueIfPresent(secureSocket, HttpConstants.SECURESOCKET_CONFIG_KEY); - if (key != null) { - senderConfiguration.useJavaDefaults(); - } else { - throw createHttpError("Need to configure cert with client SSL certificates file", - HttpErrorType.SSL_ERROR); - } + senderConfiguration.useJavaDefaults(); } else { evaluateCertField(cert, senderConfiguration); } diff --git a/native/src/main/java/io/ballerina/stdlib/http/transport/contract/config/SslConfiguration.java b/native/src/main/java/io/ballerina/stdlib/http/transport/contract/config/SslConfiguration.java index 0db8ffdeb..23975cbc8 100644 --- a/native/src/main/java/io/ballerina/stdlib/http/transport/contract/config/SslConfiguration.java +++ b/native/src/main/java/io/ballerina/stdlib/http/transport/contract/config/SslConfiguration.java @@ -245,6 +245,7 @@ private SSLConfig getSSLConfigForListener() { } private SSLConfig getSSLConfigForSender() { + setSslParameters(); if (sslConfig.isDisableSsl() || sslConfig.useJavaDefaults()) { return sslConfig; } @@ -265,7 +266,10 @@ private SSLConfig getSSLConfigForSender() { sslConfig.setSSLProtocol(sslProtocol); String tlsStoreType = sslConfig.getTLSStoreType() != null ? sslConfig.getTLSStoreType() : JKS; sslConfig.setTLSStoreType(tlsStoreType); + return sslConfig; + } + private void setSslParameters() { if (parameters != null) { for (Parameter parameter : parameters) { switch (parameter.getName()) { @@ -287,6 +291,5 @@ private SSLConfig getSSLConfigForSender() { } } } - return sslConfig; } }