OF-2611: Ensure that strict-certificate setting always prevents dialback

Depending on the exception that causes TLS to fail, dialback could still happen. With this change, Dialback won't happen if TLS failed.
igniterealtime · Jul 12, 2023 · 2773f15 · 2773f15
1 parent 08bc4ae
commit 2773f15
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 7 deletions.
diff --git a/xmppserver/src/main/java/org/jivesoftware/openfire/session/LocalOutgoingServerSession.java b/xmppserver/src/main/java/org/jivesoftware/openfire/session/LocalOutgoingServerSession.java
@@ -415,11 +415,6 @@ else if (ServerDialback.isEnabled() && features.element("dialback") != null) {
             if (connection != null) {
                 connection.forceClose();
             }
-
-            if (JiveGlobals.getBooleanProperty(ConnectionSettings.Server.STRICT_CERTIFICATE_VALIDATION, true)) {
-                log.warn( "Aborting attempt to create outgoing session as TLS handshake failed, and strictCertificateValidation is enabled." );
-                return null;
-            }
         }
         catch (Exception e)
         {
@@ -431,6 +426,11 @@ else if (ServerDialback.isEnabled() && features.element("dialback") != null) {
             }
         }
 
+        if (JiveGlobals.getBooleanProperty(ConnectionSettings.Server.STRICT_CERTIFICATE_VALIDATION, true)) {
+            log.warn( "Aborting attempt to create outgoing session as TLS handshake failed, and strictCertificateValidation is enabled." );
+            return null;
+        }
+
         if (ServerDialback.isEnabled())
         {
             log.debug( "Unable to create a new session. Going to try connecting using server dialback as a fallback." );

diff --git a/...erver/src/test/java/org/jivesoftware/openfire/session/LocalIncomingServerSessionTest.java b/...erver/src/test/java/org/jivesoftware/openfire/session/LocalIncomingServerSessionTest.java
@@ -181,7 +181,7 @@ public void tearDown() throws Exception
     public void incomingTest(final ServerSettings localServerSettings, final ServerSettings remoteServerSettings)
         throws Exception
     {
-        System.out.println("Executing test:\n - Local Server Settings: " + localServerSettings + "\n - Rmote Server Settings: " + remoteServerSettings);
+        System.out.println("Executing test:\n - Local Server (Openfire, System under test) Settings: " + localServerSettings + "\n - Remote Server (dummy/mock server) Settings: " + remoteServerSettings);
 
         JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
         final TrustStore trustStore = XMPPServer.getInstance().getCertificateStoreManager().getTrustStore(ConnectionType.SOCKET_S2S);

diff --git a/...erver/src/test/java/org/jivesoftware/openfire/session/LocalOutgoingServerSessionTest.java b/...erver/src/test/java/org/jivesoftware/openfire/session/LocalOutgoingServerSessionTest.java
@@ -172,7 +172,7 @@ public void tearDown() throws Exception
     public void outgoingTest(final ServerSettings localServerSettings, final ServerSettings remoteServerSettings)
         throws Exception
     {
-        System.out.println("Executing test:\n - Local Server Settings: " + localServerSettings + "\n - Rmote Server Settings: " + remoteServerSettings);
+        System.out.println("Executing test:\n - Local Server (Openfire, System under test) Settings: " + localServerSettings + "\n - Remote Server (dummy/mock server) Settings: " + remoteServerSettings);
 
         JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
         final TrustStore trustStore = XMPPServer.getInstance().getCertificateStoreManager().getTrustStore(ConnectionType.SOCKET_S2S);