[fix] conjure-java-runtime now again supports CN based cert verification

Author: tpetracca

.baseline/checkstyle/checkstyle-suppressions.xml

@@ -30,4 +30,6 @@
 
     <suppress files=".*AsyncSerializableErrorCallAdapterFactory\.java" checks="RegexpHeader" />
     <suppress files=".*BlockingLimiter\.java" checks="RegexpHeader" />
+    <suppress files=".*DistinguishedNameParser\.java" checks="." />
+    <suppress files=".*Okhttp39HostnameVerifier\.java" checks="." />
 </suppressions>

.gitignore

@@ -11,6 +11,7 @@ build/
 .project
 .settings
 bin/
+generated/
 
 # Idea
 *.iml

client-config/src/main/java/com/palantir/conjure/java/client/config/ClientConfiguration.java

@@ -58,6 +58,12 @@ public interface ClientConfiguration {
     /** See {@link com.palantir.conjure.java.api.config.service.PartialServiceConfiguration#enableGcmCipherSuites}. */
     boolean enableGcmCipherSuites();
 
+    /**
+     * See {@link
+     * com.palantir.conjure.java.api.config.service.PartialServiceConfiguration#fallbackToCommonNameVerification}.
+     */
+    boolean fallbackToCommonNameVerification();
+
     /** The proxy to use for the HTTP connection. */
     ProxySelector proxy();
 

client-config/src/main/java/com/palantir/conjure/java/client/config/ClientConfigurations.java

@@ -43,6 +43,7 @@ public final class ClientConfigurations {
     private static final Duration DEFAULT_BACKOFF_SLOT_SIZE = Duration.ofMillis(250);
     private static final Duration DEFAULT_FAILED_URL_COOLDOWN = Duration.ZERO;
     private static final boolean DEFAULT_ENABLE_GCM_CIPHERS = false;
+    private static final boolean DEFAULT_FALLBACK_TO_COMMON_NAME_VERIFICATION = false;
     private static final NodeSelectionStrategy DEFAULT_NODE_SELECTION_STRATEGY = NodeSelectionStrategy.PIN_UNTIL_ERROR;
     private static final int DEFAULT_MAX_NUM_RETRIES = 4;
 
@@ -61,6 +62,8 @@ public static ClientConfiguration of(ServiceConfiguration config) {
                 .readTimeout(config.readTimeout().orElse(DEFAULT_READ_TIMEOUT))
                 .writeTimeout(config.writeTimeout().orElse(DEFAULT_WRITE_TIMEOUT))
                 .enableGcmCipherSuites(config.enableGcmCipherSuites().orElse(DEFAULT_ENABLE_GCM_CIPHERS))
+                .fallbackToCommonNameVerification(config.fallbackToCommonNameVerification()
+                        .orElse(DEFAULT_FALLBACK_TO_COMMON_NAME_VERIFICATION))
                 .proxy(config.proxy().map(ClientConfigurations::createProxySelector).orElse(ProxySelector.getDefault()))
                 .proxyCredentials(config.proxy().flatMap(ProxyConfiguration::credentials))
                 .meshProxy(meshProxy(config.proxy()))
@@ -85,6 +88,7 @@ public static ClientConfiguration of(
                 .readTimeout(DEFAULT_READ_TIMEOUT)
                 .writeTimeout(DEFAULT_WRITE_TIMEOUT)
                 .enableGcmCipherSuites(DEFAULT_ENABLE_GCM_CIPHERS)
+                .fallbackToCommonNameVerification(DEFAULT_FALLBACK_TO_COMMON_NAME_VERIFICATION)
                 .proxy(ProxySelector.getDefault())
                 .proxyCredentials(Optional.empty())
                 .maxNumRetries(DEFAULT_MAX_NUM_RETRIES)

client-config/src/test/java/com/palantir/conjure/java/client/config/ClientConfigurationsTest.java

@@ -54,6 +54,7 @@ public void testFromServiceConfig_fillsInDefaults() {
         assertThat(actual.readTimeout()).isEqualTo(Duration.ofMinutes(10));
         assertThat(actual.writeTimeout()).isEqualTo(Duration.ofMinutes(10));
         assertThat(actual.enableGcmCipherSuites()).isFalse();
+        assertThat(actual.fallbackToCommonNameVerification()).isFalse();
         assertThat(actual.proxy().select(URI.create("https://foo"))).containsExactly(Proxy.NO_PROXY);
     }
 
@@ -70,6 +71,7 @@ public void testFromParameters_fillsInDefaults() {
         assertThat(actual.readTimeout()).isEqualTo(Duration.ofMinutes(10));
         assertThat(actual.writeTimeout()).isEqualTo(Duration.ofMinutes(10));
         assertThat(actual.enableGcmCipherSuites()).isFalse();
+        assertThat(actual.fallbackToCommonNameVerification()).isFalse();
         assertThat(actual.proxy().select(URI.create("https://foo"))).containsExactly(Proxy.NO_PROXY);
     }