Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OkHttpConnector: Enforce use of TLSv1.2 to match current Github and Github Enterprise TLS support. #420

Merged
merged 1 commit into from
Mar 1, 2018
Merged

OkHttpConnector: Enforce use of TLSv1.2 to match current Github and Github Enterprise TLS support. #420

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions src/main/java/org/kohsuke/github/extras/OkHttpConnector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,25 @@
package org.kohsuke.github.extras;

import com.squareup.okhttp.ConnectionSpec;
import com.squareup.okhttp.OkHttpClient;
import com.squareup.okhttp.OkUrlFactory;

import org.kohsuke.github.HttpConnector;

import java.io.IOException;

import java.net.HttpURLConnection;
import java.net.URL;

import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;

import java.util.Arrays;
import java.util.List;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;

/**
* {@link HttpConnector} for {@link OkHttpClient}.
*
Expand All @@ -23,10 +35,33 @@ public class OkHttpConnector implements HttpConnector {
private final OkUrlFactory urlFactory;

public OkHttpConnector(OkUrlFactory urlFactory) {
urlFactory.client().setSslSocketFactory(TlsSocketFactory());
urlFactory.client().setConnectionSpecs(TlsConnectionSpecs());
this.urlFactory = urlFactory;
}

public HttpURLConnection connect(URL url) throws IOException {
return urlFactory.open(url);
}

/** Returns TLSv1.2 only SSL Socket Factory. */
private SSLSocketFactory TlsSocketFactory() {
SSLContext sc;
try {
sc = SSLContext.getInstance("TLSv1.2");
Copy link
Contributor

@jtnord jtnord Mar 2, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@randomvariable how does this affect people that are behind a HTTPS proxy where they connect to github via that proxyusing say TLS 1.1 or SSL and then the proxy does the connection. Does this lock them out as they will not be able to handshake with the proxy?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it will affect, also people can change connector on their side AFAIR.

} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e.getMessage(), e);
}
try {
sc.init(null, null, null);
return sc.getSocketFactory();
} catch (KeyManagementException e) {
throw new RuntimeException(e.getMessage(), e);
}
}

/** Returns connection spec with TLS v1.2 in it */
private List<ConnectionSpec> TlsConnectionSpecs() {
return Arrays.asList(ConnectionSpec.MODERN_TLS, ConnectionSpec.CLEARTEXT);
}
}