Merge pull request #2001 from rabbitmq/mergify/bp/v5.x/pr-1999

Introduce helper for dev/test TLS setup (backport #1999)

Author: acogoluegnes

AGENTS.md

@@ -0,0 +1,75 @@
+# Instructions for AI Agents
+
+## Overview
+
+This is the [RabbitMQ Java client](https://www.rabbitmq.com/client-libraries/java-api-guide), an AMQP 0-9-1 client library.
+
+Consult the [API guide](https://www.rabbitmq.com/client-libraries/java-api-guide) to learn about how this
+library is supposed to be used.
+
+## Supported Java Versions
+
+This client supports Java 8+.
+
+## Build and Test
+
+```bash
+make deps
+./mvnw clean compile
+./mvnw spotless:apply
+```
+
+### Running Tests
+
+Tests require a RabbitMQ node on `localhost:5672` with the default `localhost`-scoped credentials (`guest`/`guest`):
+
+```bash
+# start a RabbitMQ node in a container
+docker run -it --rm --name rabbitmq -p 5672:5672 rabbitmq
+```
+
+```bash
+./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq
+```
+
+To run a single test:
+
+```bash
+./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq -Dit.test=DeadLetterExchange
+```
+
+## Repository Layout
+
+ * `src/main/java/com/rabbitmq/client`: the public API
+ * `src/main/java/com/rabbitmq/client/impl`: internal packages
+ * `src/main/java/com/rabbitmq/client/impl/recovery`: automatic connection recovery implementation
+ * `src/test/java`: tests
+ * `deps/rabbitmq_codegen`: AMQP 0-9-1 framing code generation tooling (requires Python 3)
+ * `target/generated-sources`: the AMQP 0-9-1 framing code generated by `rabbitmq_codegen`
+ * `codegen.py`: a Python 3 script that drives the code generation process
+
+## Key Files
+
+Under `src/main/java/com/rabbitmq/client`:
+
+ * `ConnectionFactory.java`: entry point for creating connections
+ * `Connection.java`, `Channel.java`: key connection and channel interfaces
+ * `impl/AMQConnection.java`, `impl/ChannelN.java`: connection and channel implementations
+ * `impl/recovery/AutorecoveringConnection.java`: a `Connection` implementation that supports automatic recovery
+
+## Code Style
+
+ * Format code with `./mvnw spotless:apply` at the end of each task
+
+## Comments
+
+ * Only add very important comments, both in tests and in the implementation
+
+## Git Instructions
+
+ * Never add yourself to the list of commit co-authors
+ * Never mention yourself in commit messages in any way (no "Generated by", no AI tool links, etc)
+
+## Style Guide
+
+ * Never add full stops to Markdown list items

ci/start-broker.sh

@@ -44,7 +44,7 @@ echo "Running RabbitMQ ${RABBITMQ_IMAGE}"
 
 docker rm -f rabbitmq 2>/dev/null || echo "rabbitmq was not running"
 docker run -d --name rabbitmq \
-    --network host \
+    -p 5671:5671 -p 5672:5672 \
     -v "${PWD}"/rabbitmq-configuration:/etc/rabbitmq \
     "${RABBITMQ_IMAGE}"
 

src/main/java/com/rabbitmq/client/ConnectionFactory.java

@@ -29,11 +29,16 @@
 import io.netty.channel.EventLoopGroup;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URLDecoder;
 import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.time.Duration;
 import java.util.*;
@@ -47,8 +52,7 @@
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import javax.net.ssl.TrustManagerFactory;
 
 /**
  * Convenience factory class to facilitate opening a {@link Connection} to a RabbitMQ node.
@@ -348,8 +352,7 @@ public void setVirtualHost(String virtualHost) {
    *
    * @param uri is the AMQP URI containing the data
    */
-  public void setUri(URI uri)
-      throws URISyntaxException, NoSuchAlgorithmException, KeyManagementException {
+  public void setUri(URI uri) throws NoSuchAlgorithmException, KeyManagementException {
     if ("amqp".equals(uri.getScheme().toLowerCase())) {
       setPort(DEFAULT_AMQP_PORT);
     } else if ("amqps".equals(uri.getScheme().toLowerCase())) {
@@ -807,12 +810,11 @@ public boolean isSSL() {
   }
 
   /**
-   * Convenience method for configuring TLS using the default set of TLS protocols and a trusting
-   * TrustManager. This setup is <strong>only suitable for development and QA environments</strong>.
-   * The trust manager will <strong>trust every server certificate presented</strong> to it, this is
-   * convenient for local development but <strong>not recommended to use in production</strong> as
-   * it provides no protection against man-in-the-middle attacks. Prefer {@link
-   * #useSslProtocol(SSLContext)}.
+   * Convenience method for configuring TLS using the JVM default trust store and with hostname
+   * verification enabled. This is the recommended method for enabling TLS in production
+   * environments.
+   *
+   * <p>Use {@link #useSslProtocol(SSLContext)} for more control over the {@link SSLContext}.
    *
    * <p>Note this method has NO effect when using Netty, use {@link
    * com.rabbitmq.client.ConnectionFactory.NettyConfiguration#sslContext(io.netty.handler.ssl.SslContext)}
@@ -822,19 +824,16 @@ public void useSslProtocol() throws NoSuchAlgorithmException, KeyManagementExcep
     useSslProtocol(
         computeDefaultTlsProtocol(
             SSLContext.getDefault().getSupportedSSLParameters().getProtocols()));
+    useSslProtocol(SSLContext.getDefault());
   }
 
   /**
-   * Convenience method for configuring TLS using the supplied protocol and a very trusting
-   * TrustManager. This setup is <strong>only suitable for development and QA environments</strong>.
-   * The trust manager <strong>will trust every server certificate presented</strong> to it, this is
-   * convenient for local development but not recommended to use in production as it
-   * <strong>provides no protection against man-in-the-middle attacks</strong>.
+   * Convenience method for configuring TLS using the supplied protocol, the JVM default trust
+   * store, and with hostname verification enabled.
    *
-   * <p>Use {@link #useSslProtocol(SSLContext)} in production environments. The produced {@link
-   * SSLContext} instance will be shared by all the connections created by this connection factory.
-   *
-   * <p>Use {@link #setSslContextFactory(SslContextFactory)} for more flexibility.
+   * <p>The produced {@link SSLContext} instance will be shared by all the connections created by
+   * this connection factory. Use {@link #setSslContextFactory(SslContextFactory)} for more
+   * flexibility.
    *
    * <p>Note this method has NO effect when using Netty, use {@link
    * com.rabbitmq.client.ConnectionFactory.NettyConfiguration#sslContext(io.netty.handler.ssl.SslContext)}
@@ -844,7 +843,16 @@ public void useSslProtocol() throws NoSuchAlgorithmException, KeyManagementExcep
    */
   public void useSslProtocol(String protocol)
       throws NoSuchAlgorithmException, KeyManagementException {
-    useSslProtocol(protocol, new TrustEverythingTrustManager());
+    try {
+      TrustManagerFactory tmf =
+          TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+      tmf.init((KeyStore) null);
+      SSLContext c = SSLContext.getInstance(protocol);
+      c.init(null, tmf.getTrustManagers(), null);
+      this.useSslProtocol(c);
+    } catch (KeyStoreException e) {
+      throw new KeyManagementException("Failed to initialize default trust manager", e);
+    }
   }
 
   /**
@@ -889,6 +897,26 @@ public void useSslProtocol(String protocol, TrustManager trustManager)
   public void useSslProtocol(SSLContext context) {
     this.sslContextFactory = name -> context;
     setSocketFactory(context.getSocketFactory());
+    this.enableHostnameVerification();
+  }
+
+  /**
+   * Configure TLS without any certificate or hostname verification.
+   *
+   * <p><strong>DO NOT USE IN PRODUCTION.</strong> This disables all server authentication and
+   * provides no protection against man-in-the-middle attacks. Use only in local development or CI
+   * environments where the broker identity is not sensitive.
+   *
+   * <p>Note this method has NO effect when using Netty, use {@link
+   * com.rabbitmq.client.ConnectionFactory.NettyConfiguration#useTlsWithNoVerification()} instead.
+   */
+  public void useTlsWithNoVerification()
+      throws NoSuchAlgorithmException, KeyManagementException {
+    logTlsNoVerificationWarning();
+    this.useSslProtocol(
+        computeDefaultTlsProtocol(
+            SSLContext.getDefault().getSupportedSSLParameters().getProtocols()),
+        new TrustEverythingTrustManager());
   }
 
   /**
@@ -1569,6 +1597,22 @@ public ConnectionFactory connectionFactory() {
       return this.cf;
     }
 
+    /**
+     * Configure TLS without any certificate or hostname verification.
+     *
+     * <p><strong>DO NOT USE IN PRODUCTION.</strong> This disables all server authentication and
+     * provides no protection against man-in-the-middle attacks. Use only in local development or CI
+     * environments where the broker identity is not sensitive.
+     */
+    public NettyConfiguration useTlsWithNoVerification() throws Exception {
+      logTlsNoVerificationWarning();
+      return sslContext(
+          SslContextBuilder.forClient()
+              .trustManager(new TrustEverythingTrustManager())
+              .endpointIdentificationAlgorithm(null)
+              .build());
+    }
+
     private boolean isTls() {
       return this.sslContextFactory != null;
     }
@@ -1874,6 +1918,7 @@ public int getChannelRpcTimeout() {
    */
   public void setSslContextFactory(SslContextFactory sslContextFactory) {
     this.sslContextFactory = sslContextFactory;
+    this.enableHostnameVerification();
   }
 
   /**
@@ -1986,4 +2031,13 @@ public static int ensureUnsignedShort(int value) {
       return value;
     }
   }
+
+  static void logTlsNoVerificationWarning() {
+    LoggerFactory.getLogger("com.rabbitmq.client.security").warn(
+        "SECURITY ALERT: this mode trusts every certificate, effectively disabling peer verification, " +
+        "and disables hostname verification. " +
+        "This is convenient for local development but offers no protection against man-in-the-middle attacks. " +
+        "Please see https://www.rabbitmq.com/ssl.html to learn more about peer certificate verification."
+    );
+  }
 }

src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java

@@ -396,9 +396,10 @@ private static void setUpBasicSsl(ConnectionFactory cf, boolean validateServerCe
             useDefaultTrustStore(cf, sslAlgorithm, verifyHostname);
         } else {
             if (sslAlgorithm == null) {
-                cf.useSslProtocol();
+                cf.useTlsWithNoVerification();
             } else {
-                cf.useSslProtocol(sslAlgorithm);
+                ConnectionFactory.logTlsNoVerificationWarning();
+                cf.useSslProtocol(sslAlgorithm, new TrustEverythingTrustManager());
             }
         }
     }

src/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java

@@ -13,51 +13,21 @@
 // If you have any questions regarding licensing, please contact us at
 // info@rabbitmq.com.
 
-
 package com.rabbitmq.client;
 
-import org.slf4j.LoggerFactory;
-
 import javax.net.ssl.X509TrustManager;
 import java.security.cert.X509Certificate;
 
-/**
- * Convenience class providing a default implementation of {@link javax.net.ssl.X509TrustManager}.
- * Trusts every single certificate presented to it. This implementation does not perform peer
- * verification and <strong>provides no protection against Man-in-the-Middle (MITM) attacks</strong> and therefore
- * <strong>only suitable for some development and QA environments</strong>.
- */
-public class TrustEverythingTrustManager implements X509TrustManager {
+final class TrustEverythingTrustManager implements X509TrustManager {
 
-    public TrustEverythingTrustManager() {
-        LoggerFactory.getLogger(TrustEverythingTrustManager.class).warn(
-            "SECURITY ALERT: this trust manager trusts every certificate, effectively disabling peer verification. " +
-            "This is convenient for local development but offers no protection against man-in-the-middle attacks. " +
-            "Please see https://www.rabbitmq.com/ssl.html to learn more about peer certificate verification."
-        );
-    }
+    TrustEverythingTrustManager() {}
 
-    /**
-     * Doesn't even bother looking at its arguments, simply returns,
-     * which makes the check succeed.
-     */
     @Override
-    public void checkClientTrusted(X509Certificate[] chain, String authType) {
-        // Do nothing.
-    }
+    public void checkClientTrusted(X509Certificate[] chain, String authType) {}
 
-    /**
-     * Doesn't even bother looking at its arguments, simply returns,
-     * which makes the check succeed.
-     */
     @Override
-    public void checkServerTrusted(X509Certificate[] chain, String authType) {
-        // Do nothing.
-    }
+    public void checkServerTrusted(X509Certificate[] chain, String authType) {}
 
-    /**
-     * Always returns an empty array of X509Certificates.
-     */
     @Override
     public X509Certificate[] getAcceptedIssuers() {
         return new X509Certificate[0];

src/main/java/com/rabbitmq/client/impl/OAuth2ClientCredentialsGrantCredentialsProvider.java

@@ -16,9 +16,10 @@
 package com.rabbitmq.client.impl;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.rabbitmq.client.TrustEverythingTrustManager;
+import org.slf4j.LoggerFactory;
 
 import java.net.*;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 import javax.net.ssl.*;
@@ -558,11 +559,16 @@ public TlsConfiguration sslContext(SSLContext sslContext) {
          * @return a TLS configuration that trusts all servers
          */
         public TlsConfiguration dev() {
+            logTlsNoVerificationWarning();
             try {
                 SSLContext sslContext = SSLContext.getInstance(computeDefaultTlsProtocol(
                         SSLContext.getDefault().getSupportedSSLParameters().getProtocols()
                 ));
-                sslContext.init(null, new TrustManager[]{new TrustEverythingTrustManager()}, null);
+                sslContext.init(null, new TrustManager[]{new X509TrustManager() {
+                    public void checkClientTrusted(X509Certificate[] chain, String authType) {}
+                    public void checkServerTrusted(X509Certificate[] chain, String authType) {}
+                    public java.security.cert.X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
+                }}, null);
                 this.sslContext = sslContext;
             } catch (NoSuchAlgorithmException | KeyManagementException e) {
                 throw new OAuthTokenManagementException("Error while creating TLS context for development configuration", e);
@@ -606,4 +612,13 @@ public Token apply(String response) {
             }
         }
     }
+
+    private static void logTlsNoVerificationWarning() {
+        LoggerFactory.getLogger("com.rabbitmq.client.security").warn(
+            "SECURITY ALERT: this mode trusts every certificate, effectively disabling peer verification, " +
+                "and disables hostname verification. " +
+                "This is convenient for local development but offers no protection against man-in-the-middle attacks. " +
+                "Please see https://www.rabbitmq.com/ssl.html to learn more about peer certificate verification."
+        );
+    }
 }