Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.4 in /parent

parent/pom.xml

@@ -132,7 +132,7 @@
         <cxf.httpcomponents.client.version>4.5.14</cxf.httpcomponents.client.version>
         <cxf.httpcomponents.core.version.range>[4.3,4.5.0)</cxf.httpcomponents.core.version.range>
         <cxf.httpcomponents.core.version>4.4.16</cxf.httpcomponents.core.version>
-        <cxf.httpcomponents.client5.version>5.6.2</cxf.httpcomponents.client5.version>
+        <cxf.httpcomponents.client5.version>5.6.4</cxf.httpcomponents.client5.version>
         <cxf.httpcomponents.core5.version>5.4.3</cxf.httpcomponents.core5.version>
         <cxf.jackson.version>3.2.1</cxf.jackson.version>
         <cxf.jackson.databind.version>3.2.1</cxf.jackson.databind.version>

rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/AsyncHTTPConduit.java

@@ -83,6 +83,7 @@
 import org.apache.hc.client5.http.impl.auth.BasicScheme;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
+import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy;
 import org.apache.hc.core5.concurrent.BasicFuture;
 import org.apache.hc.core5.concurrent.FutureCallback;
 import org.apache.hc.core5.http.Header;
@@ -591,7 +592,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context
                         sslContext.getSupportedSSLParameters().getProtocols());
 
                     tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols,
-                        cipherSuites, SSLBufferMode.STATIC, verifier);
+                        cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier);
                 } catch (final GeneralSecurityException e) {
                     LOG.warning(e.getMessage());
                 }

rt/transports/http-hc5/src/main/java/org/apache/cxf/transport/http/asyncclient/hc5/URLConnectionAsyncHTTPConduit.java

@@ -78,6 +78,7 @@
 import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
 import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
+import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy;
 import org.apache.hc.core5.concurrent.BasicFuture;
 import org.apache.hc.core5.concurrent.FutureCallback;
 import org.apache.hc.core5.http.Header;
@@ -584,7 +585,7 @@ public Credentials getCredentials(final AuthScope authscope, HttpContext context
                         sslContext.getSupportedSSLParameters().getProtocols());
 
                     tlsStrategy = new DefaultClientTlsStrategy(sslcontext, protocols,
-                        cipherSuites, SSLBufferMode.STATIC, verifier);
+                        cipherSuites, SSLBufferMode.STATIC, HostnameVerificationPolicy.CLIENT, verifier);
                 } catch (final GeneralSecurityException e) {
                     LOG.warning(e.getMessage());
                 }

rt/transports/http/src/main/java/org/apache/cxf/transport/https/InsecureTrustManager.java

@@ -19,11 +19,14 @@
 
 package org.apache.cxf.transport.https;
 
+import java.net.Socket;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.logging.Logger;
 
+import javax.net.ssl.SSLEngine;
 import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509ExtendedTrustManager;
 import javax.net.ssl.X509TrustManager;
 
 import org.apache.cxf.common.logging.LogUtils;
@@ -45,6 +48,11 @@ public static TrustManager[] getNoOpX509TrustManagers() {
         return new TrustManager[] {new NoOpX509TrustManager()};
     }
 
+    public static TrustManager[] getNoOpX509ExtendedTrustManagers() {
+        LOG.warning("This class essentially disables TLS trust verification and is insecure!");
+        return new TrustManager[] {new NoOpX509ExtendedTrustManager()};
+    }
+
     private static final class NoOpX509TrustManager implements X509TrustManager {
 
         private NoOpX509TrustManager() {
@@ -65,4 +73,39 @@ public X509Certificate[] getAcceptedIssuers() {
         }
 
     }
+
+    private static final class NoOpX509ExtendedTrustManager extends X509ExtendedTrustManager {
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+            return null;
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
+                throws CertificateException {
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
+                throws CertificateException {
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                throws CertificateException {
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
+                throws CertificateException {
+        }
+    }
 }

systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/http2/AbstractApacheClientServerHttp2Test.java

@@ -170,7 +170,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2)
             }
 
             // Create TrustManager instance which trusts all clients and servers
-            params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); 
+            params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); 
             params.setDisableCNCheck(true);
         }
 

systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/clientauth/ClientAuthTest.java

@@ -408,7 +408,7 @@ public void testCheckKeyManagersWithCertAlias() throws Exception {
         assertNotNull("Service is null", service);
 
         // Set up (shared) KeyManagers/TrustManagers
-        TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509TrustManagers();
+        TrustManager[] trustManagers = InsecureTrustManager.getNoOpX509ExtendedTrustManagers();
 
         KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
 

systests/transport-hc5/src/test/java/org/apache/cxf/systest/hc5/https/trust/TrustManagerTest.java

@@ -125,7 +125,7 @@ public void testNoOpX509TrustManager() throws Exception {
         }
 
         TLSClientParameters tlsParams = new TLSClientParameters();
-        tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers());
+        tlsParams.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers());
         tlsParams.setDisableCNCheck(true);
 
         Client client = ClientProxy.getClient(port);

systests/transport-hc5/src/test/resources/org/apache/cxf/systest/hc5/https/trust/client-trust-manager-ref.xml

@@ -31,7 +31,7 @@
         </cxf:features>
     </cxf:bus>
 
-    <bean id="trustManagers" class="org.apache.cxf.transport.https.InsecureTrustManager" factory-method="getNoOpX509TrustManagers"/>
+    <bean id="trustManagers" class="org.apache.cxf.transport.https.InsecureTrustManager" factory-method="getNoOpX509ExtendedTrustManagers"/>
 
     <http:conduit name="https://localhost:.*">
         <http:tlsClientParameters disableCNCheck="true">

systests/transport-undertow/src/test/java/org/apache/cxf/systest/http_undertow/http2/AbstractUndertowClientServerHttp2Test.java

@@ -117,7 +117,7 @@ private WebClient createWebClient(final String path, final boolean enableHttp2)
             }
 
             // Create TrustManager instance which trusts all clients and servers
-            params.setTrustManagers(InsecureTrustManager.getNoOpX509TrustManagers()); 
+            params.setTrustManagers(InsecureTrustManager.getNoOpX509ExtendedTrustManagers()); 
             params.setDisableCNCheck(true);
         }