Examples with SSLEngine javax.net.ssl.SSLEngine used on opensource projects

Example 56 with SSLEngine

use of javax.net.ssl.SSLEngine in project netty by netty.

the class SSLEngineTest method testCloseNotifySequence.

@Test
public void testCloseNotifySequence() throws Exception {
    SelfSignedCertificate cert = new SelfSignedCertificate();
    clientSslCtx = SslContextBuilder.forClient().trustManager(cert.cert()).sslProvider(sslClientProvider()).build();
    SSLEngine client = clientSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    serverSslCtx = SslContextBuilder.forServer(cert.certificate(), cert.privateKey()).sslProvider(sslServerProvider()).build();
    SSLEngine server = serverSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    try {
        ByteBuffer plainClientOut = allocateBuffer(client.getSession().getApplicationBufferSize());
        ByteBuffer plainServerOut = allocateBuffer(server.getSession().getApplicationBufferSize());
        ByteBuffer encryptedClientToServer = allocateBuffer(client.getSession().getPacketBufferSize());
        ByteBuffer encryptedServerToClient = allocateBuffer(server.getSession().getPacketBufferSize());
        ByteBuffer empty = allocateBuffer(0);
        handshake(client, server);
        // This will produce a close_notify
        client.closeOutbound();
        // Something still pending in the outbound buffer.
        assertFalse(client.isOutboundDone());
        assertFalse(client.isInboundDone());
        // Now wrap and so drain the outbound buffer.
        SSLEngineResult result = client.wrap(empty, encryptedClientToServer);
        encryptedClientToServer.flip();
        assertEquals(SSLEngineResult.Status.CLOSED, result.getStatus());
        // Need an UNWRAP to read the response of the close_notify
        assertEquals(SSLEngineResult.HandshakeStatus.NEED_UNWRAP, result.getHandshakeStatus());
        int produced = result.bytesProduced();
        int consumed = result.bytesConsumed();
        int closeNotifyLen = produced;
        assertTrue(produced > 0);
        assertEquals(0, consumed);
        assertEquals(produced, encryptedClientToServer.remaining());
        // Outbound buffer should be drained now.
        assertTrue(client.isOutboundDone());
        assertFalse(client.isInboundDone());
        assertFalse(server.isOutboundDone());
        assertFalse(server.isInboundDone());
        result = server.unwrap(encryptedClientToServer, plainServerOut);
        plainServerOut.flip();
        assertEquals(SSLEngineResult.Status.CLOSED, result.getStatus());
        // Need a WRAP to respond to the close_notify
        assertEquals(SSLEngineResult.HandshakeStatus.NEED_WRAP, result.getHandshakeStatus());
        produced = result.bytesProduced();
        consumed = result.bytesConsumed();
        assertEquals(closeNotifyLen, consumed);
        assertEquals(0, produced);
        // Should have consumed the complete close_notify
        assertEquals(0, encryptedClientToServer.remaining());
        assertEquals(0, plainServerOut.remaining());
        assertFalse(server.isOutboundDone());
        assertTrue(server.isInboundDone());
        result = server.wrap(empty, encryptedServerToClient);
        encryptedServerToClient.flip();
        assertEquals(SSLEngineResult.Status.CLOSED, result.getStatus());
        // UNWRAP/WRAP are not expected after this point
        assertEquals(SSLEngineResult.HandshakeStatus.NOT_HANDSHAKING, result.getHandshakeStatus());
        produced = result.bytesProduced();
        consumed = result.bytesConsumed();
        assertEquals(closeNotifyLen, produced);
        assertEquals(0, consumed);
        assertEquals(produced, encryptedServerToClient.remaining());
        assertTrue(server.isOutboundDone());
        assertTrue(server.isInboundDone());
        result = client.unwrap(encryptedServerToClient, plainClientOut);
        plainClientOut.flip();
        assertEquals(SSLEngineResult.Status.CLOSED, result.getStatus());
        // UNWRAP/WRAP are not expected after this point
        assertEquals(SSLEngineResult.HandshakeStatus.NOT_HANDSHAKING, result.getHandshakeStatus());
        produced = result.bytesProduced();
        consumed = result.bytesConsumed();
        assertEquals(closeNotifyLen, consumed);
        assertEquals(0, produced);
        assertEquals(0, encryptedServerToClient.remaining());
        assertTrue(client.isOutboundDone());
        assertTrue(client.isInboundDone());
        // Ensure that calling wrap or unwrap again will not produce a SSLException
        encryptedServerToClient.clear();
        plainServerOut.clear();
        result = server.wrap(plainServerOut, encryptedServerToClient);
        assertEngineRemainsClosed(result);
        encryptedClientToServer.clear();
        plainServerOut.clear();
        result = server.unwrap(encryptedClientToServer, plainServerOut);
        assertEngineRemainsClosed(result);
        encryptedClientToServer.clear();
        plainClientOut.clear();
        result = client.wrap(plainClientOut, encryptedClientToServer);
        assertEngineRemainsClosed(result);
        encryptedServerToClient.clear();
        plainClientOut.clear();
        result = client.unwrap(encryptedServerToClient, plainClientOut);
        assertEngineRemainsClosed(result);
    } finally {
        cert.delete();
        cleanupClientSslEngine(client);
        cleanupServerSslEngine(server);
    }
}

Example 57 with SSLEngine

use of javax.net.ssl.SSLEngine in project netty by netty.

the class SSLEngineTest method testProtocol.

private void testProtocol(String[] clientProtocols, String[] serverProtocols) throws Exception {
    SelfSignedCertificate cert = new SelfSignedCertificate();
    clientSslCtx = SslContextBuilder.forClient().trustManager(cert.cert()).sslProvider(sslClientProvider()).protocols(clientProtocols).build();
    SSLEngine client = clientSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    serverSslCtx = SslContextBuilder.forServer(cert.certificate(), cert.privateKey()).sslProvider(sslServerProvider()).protocols(serverProtocols).build();
    SSLEngine server = serverSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    try {
        handshake(client, server);
    } finally {
        cleanupClientSslEngine(client);
        cleanupServerSslEngine(server);
        cert.delete();
    }
}

Example 58 with SSLEngine

use of javax.net.ssl.SSLEngine in project netty by netty.

the class SSLEngineTest method testSSLEngineUnwrapNoSslRecord.

@Test
public void testSSLEngineUnwrapNoSslRecord() throws Exception {
    clientSslCtx = SslContextBuilder.forClient().sslProvider(sslClientProvider()).build();
    SSLEngine client = clientSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    try {
        ByteBuffer src = allocateBuffer(client.getSession().getApplicationBufferSize());
        ByteBuffer dst = allocateBuffer(client.getSession().getPacketBufferSize());
        ByteBuffer empty = allocateBuffer(0);
        SSLEngineResult clientResult = client.wrap(empty, dst);
        assertEquals(SSLEngineResult.Status.OK, clientResult.getStatus());
        assertEquals(SSLEngineResult.HandshakeStatus.NEED_UNWRAP, clientResult.getHandshakeStatus());
        try {
            client.unwrap(src, dst);
            fail();
        } catch (SSLException expected) {
        // expected
        }
    } finally {
        cleanupClientSslEngine(client);
    }
}

Example 59 with SSLEngine

use of javax.net.ssl.SSLEngine in project netty by netty.

the class SSLEngineTest method testBufferUnderFlow.

@Test
public void testBufferUnderFlow() throws Exception {
    SelfSignedCertificate cert = new SelfSignedCertificate();
    clientSslCtx = SslContextBuilder.forClient().trustManager(cert.cert()).sslProvider(sslClientProvider()).build();
    SSLEngine client = clientSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    serverSslCtx = SslContextBuilder.forServer(cert.certificate(), cert.privateKey()).sslProvider(sslServerProvider()).build();
    SSLEngine server = serverSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
    try {
        ByteBuffer plainClient = allocateBuffer(1024);
        plainClient.limit(plainClient.capacity());
        ByteBuffer encClientToServer = allocateBuffer(client.getSession().getPacketBufferSize());
        ByteBuffer plainServer = allocateBuffer(server.getSession().getApplicationBufferSize());
        handshake(client, server);
        SSLEngineResult result = client.wrap(plainClient, encClientToServer);
        assertEquals(SSLEngineResult.Status.OK, result.getStatus());
        assertEquals(result.bytesConsumed(), plainClient.capacity());
        // Flip so we can read it.
        encClientToServer.flip();
        int remaining = encClientToServer.remaining();
        // We limit the buffer so we have less then the header to read, this should result in an BUFFER_UNDERFLOW.
        encClientToServer.limit(SslUtils.SSL_RECORD_HEADER_LENGTH - 1);
        result = server.unwrap(encClientToServer, plainServer);
        assertResultIsBufferUnderflow(result);
        // We limit the buffer so we can read the header but not the rest, this should result in an
        // BUFFER_UNDERFLOW.
        encClientToServer.limit(SslUtils.SSL_RECORD_HEADER_LENGTH);
        result = server.unwrap(encClientToServer, plainServer);
        assertResultIsBufferUnderflow(result);
        // We limit the buffer so we can read the header and partly the rest, this should result in an
        // BUFFER_UNDERFLOW.
        encClientToServer.limit(SslUtils.SSL_RECORD_HEADER_LENGTH + remaining - 1 - SslUtils.SSL_RECORD_HEADER_LENGTH);
        result = server.unwrap(encClientToServer, plainServer);
        assertResultIsBufferUnderflow(result);
        // Reset limit so we can read the full record.
        encClientToServer.limit(remaining);
        result = server.unwrap(encClientToServer, plainServer);
        assertEquals(SSLEngineResult.Status.OK, result.getStatus());
        assertEquals(result.bytesConsumed(), remaining);
        assertTrue(result.bytesProduced() > 0);
    } finally {
        cert.delete();
        cleanupClientSslEngine(client);
        cleanupServerSslEngine(server);
    }
}

Example 60 with SSLEngine

use of javax.net.ssl.SSLEngine in project netty by netty.

the class SSLEngineTest method testEnablingAnAlreadyDisabledSslProtocol.

protected void testEnablingAnAlreadyDisabledSslProtocol(String[] protocols1, String[] protocols2) throws Exception {
    SSLEngine sslEngine = null;
    try {
        File serverKeyFile = new File(getClass().getResource("test_unencrypted.pem").getFile());
        File serverCrtFile = new File(getClass().getResource("test.crt").getFile());
        serverSslCtx = SslContextBuilder.forServer(serverCrtFile, serverKeyFile).sslProvider(sslServerProvider()).build();
        sslEngine = serverSslCtx.newEngine(UnpooledByteBufAllocator.DEFAULT);
        // Disable all protocols
        sslEngine.setEnabledProtocols(EmptyArrays.EMPTY_STRINGS);
        // The only protocol that should be enabled is SSLv2Hello
        String[] enabledProtocols = sslEngine.getEnabledProtocols();
        assertArrayEquals(protocols1, enabledProtocols);
        // Enable a protocol that is currently disabled
        sslEngine.setEnabledProtocols(new String[] { PROTOCOL_TLS_V1_2 });
        // The protocol that was just enabled should be returned
        enabledProtocols = sslEngine.getEnabledProtocols();
        assertEquals(protocols2.length, enabledProtocols.length);
        assertArrayEquals(protocols2, enabledProtocols);
    } finally {
        if (sslEngine != null) {
            sslEngine.closeInbound();
            sslEngine.closeOutbound();
            cleanupServerSslEngine(sslEngine);
        }
    }
}