Examples with SSLEngine javax.net.ssl.SSLEngine used on opensource projects

Example 66 with SSLEngine

use of javax.net.ssl.SSLEngine in project camel by apache.

the class SSLContextParametersTest method testCipherSuitesFilter.

public void testCipherSuitesFilter() throws Exception {
    SSLContext controlContext = SSLContext.getInstance("TLS");
    controlContext.init(null, null, null);
    SSLEngine controlEngine = controlContext.createSSLEngine();
    SSLSocket controlSocket = (SSLSocket) controlContext.getSocketFactory().createSocket();
    SSLServerSocket controlServerSocket = (SSLServerSocket) controlContext.getServerSocketFactory().createServerSocket();
    // default
    SSLContextParameters scp = new SSLContextParameters();
    SSLContext context = scp.createSSLContext();
    CipherSuitesParameters csp = new CipherSuitesParameters();
    scp.setCipherSuites(csp);
    SSLEngine engine = context.createSSLEngine();
    SSLSocket socket = (SSLSocket) context.getSocketFactory().createSocket();
    SSLServerSocket serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    assertTrue(Arrays.equals(controlEngine.getEnabledCipherSuites(), engine.getEnabledCipherSuites()));
    assertTrue(Arrays.equals(controlSocket.getEnabledCipherSuites(), socket.getEnabledCipherSuites()));
    assertTrue(Arrays.equals(this.getDefaultCipherSuiteIncludes(controlServerSocket.getSupportedCipherSuites()), serverSocket.getEnabledCipherSuites()));
    // empty filter
    FilterParameters filter = new FilterParameters();
    scp.setCipherSuitesFilter(filter);
    context = scp.createSSLContext();
    engine = context.createSSLEngine();
    socket = (SSLSocket) context.getSocketFactory().createSocket();
    serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    assertEquals(0, engine.getEnabledCipherSuites().length);
    assertEquals(0, socket.getEnabledCipherSuites().length);
    assertEquals(0, serverSocket.getEnabledCipherSuites().length);
    // explicit filter
    filter.getInclude().add(".*");
    context = scp.createSSLContext();
    engine = context.createSSLEngine();
    socket = (SSLSocket) context.getSocketFactory().createSocket();
    serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    assertEquals(0, engine.getEnabledCipherSuites().length);
    assertEquals(0, socket.getEnabledCipherSuites().length);
    assertEquals(0, serverSocket.getEnabledCipherSuites().length);
    // explicit filter with excludes (excludes overrides)
    filter.getExclude().add(".*");
    context = scp.createSSLContext();
    engine = context.createSSLEngine();
    socket = (SSLSocket) context.getSocketFactory().createSocket();
    serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    assertEquals(0, engine.getEnabledCipherSuites().length);
    assertEquals(0, socket.getEnabledCipherSuites().length);
    assertEquals(0, serverSocket.getEnabledCipherSuites().length);
    // explicit filter single include
    filter.getInclude().clear();
    filter.getExclude().clear();
    csp.setCipherSuite(Collections.singletonList("TLS_RSA_WITH_AES_128_CBC_SHA"));
    filter.getInclude().add("TLS.*");
    context = scp.createSSLContext();
    engine = context.createSSLEngine();
    socket = (SSLSocket) context.getSocketFactory().createSocket();
    serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    // not all platforms/JDKs have these cipher suites
    if (!isPlatform("aix")) {
        assertTrue(engine.getEnabledCipherSuites().length >= 1);
        assertStartsWith(engine.getEnabledCipherSuites(), "TLS");
        assertTrue(socket.getEnabledCipherSuites().length >= 1);
        assertStartsWith(socket.getEnabledCipherSuites(), "TLS");
        assertTrue(serverSocket.getEnabledCipherSuites().length >= 1);
        assertStartsWith(serverSocket.getEnabledCipherSuites(), "TLS");
    }
}

Example 67 with SSLEngine

use of javax.net.ssl.SSLEngine in project camel by apache.

the class SSLContextParametersTest method testSecureSocketProtocol.

public void testSecureSocketProtocol() throws Exception {
    SSLContextParameters scp = new SSLContextParameters();
    scp.setSecureSocketProtocol("SSLv3");
    SSLContext context = scp.createSSLContext();
    assertEquals("SSLv3", context.getProtocol());
    SSLEngine engine = context.createSSLEngine();
    SSLSocket socket = (SSLSocket) context.getSocketFactory().createSocket();
    SSLServerSocket serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    // default disable the SSL* protocols
    assertStartsWith(engine.getEnabledProtocols(), "TLS");
    assertStartsWith(socket.getEnabledProtocols(), "TLS");
    assertStartsWith(serverSocket.getEnabledProtocols(), "TLS");
    // allow SSL* protocols by explicitly asking for them
    final SecureSocketProtocolsParameters protocols = new SecureSocketProtocolsParameters();
    protocols.setSecureSocketProtocol(Collections.singletonList("SSLv3"));
    scp.setSecureSocketProtocols(protocols);
    context = scp.createSSLContext();
    engine = context.createSSLEngine();
    socket = (SSLSocket) context.getSocketFactory().createSocket();
    serverSocket = (SSLServerSocket) context.getServerSocketFactory().createServerSocket();
    assertEquals(engine.getEnabledProtocols().length, 1);
    assertEquals(engine.getEnabledProtocols()[0], "SSLv3");
    assertEquals(socket.getEnabledProtocols().length, 1);
    assertEquals(socket.getEnabledProtocols()[0], "SSLv3");
    assertEquals(serverSocket.getEnabledProtocols().length, 1);
    assertEquals(serverSocket.getEnabledProtocols()[0], "SSLv3");
}

Example 68 with SSLEngine

use of javax.net.ssl.SSLEngine in project camel by apache.

the class BaseSSLContextParameters method getSSLEngineConfigurers.

/**
     * Returns the list of configurers to apply to an {@link SSLEngine} in order
     * to fully configure it in compliance with the provided configuration options.
     * The configurers are to be applied in the order in which they appear in the list.
     *
     * @param context the context that serves as the factory for {@code SSLEngine} instances
     * 
     * @return the needed configurers
     */
protected List<Configurer<SSLEngine>> getSSLEngineConfigurers(SSLContext context) {
    final List<String> enabledCipherSuites = this.getCipherSuites() == null ? null : this.parsePropertyValues(this.getCipherSuites().getCipherSuite());
    final Patterns enabledCipherSuitePatterns;
    final Patterns defaultEnabledCipherSuitePatterns = this.getDefaultCipherSuitesFilter().getPatterns();
    if (this.getCipherSuitesFilter() != null) {
        enabledCipherSuitePatterns = this.getCipherSuitesFilter().getPatterns();
    } else {
        enabledCipherSuitePatterns = null;
    }
    ///
    final List<String> enabledSecureSocketProtocols = this.getSecureSocketProtocols() == null ? null : this.parsePropertyValues(this.getSecureSocketProtocols().getSecureSocketProtocol());
    final Patterns enabledSecureSocketProtocolsPatterns;
    final Patterns defaultEnabledSecureSocketProtocolsPatterns = this.getDefaultSecureSocketProcotolFilter().getPatterns();
    if (this.getSecureSocketProtocolsFilter() != null) {
        enabledSecureSocketProtocolsPatterns = this.getSecureSocketProtocolsFilter().getPatterns();
    } else {
        enabledSecureSocketProtocolsPatterns = null;
    }
    //
    final boolean allowPassthrough = getAllowPassthrough();
    //////
    Configurer<SSLEngine> sslEngineConfigurer = new Configurer<SSLEngine>() {

        @Override
        public SSLEngine configure(SSLEngine engine) {
            Collection<String> filteredCipherSuites = BaseSSLContextParameters.this.filter(enabledCipherSuites, Arrays.asList(engine.getSSLParameters().getCipherSuites()), Arrays.asList(engine.getEnabledCipherSuites()), enabledCipherSuitePatterns, defaultEnabledCipherSuitePatterns, !allowPassthrough);
            if (LOG.isDebugEnabled()) {
                LOG.debug(SSL_ENGINE_CIPHER_SUITE_LOG_MSG, new Object[] { engine, enabledCipherSuites, enabledCipherSuitePatterns, engine.getSSLParameters().getCipherSuites(), engine.getEnabledCipherSuites(), defaultEnabledCipherSuitePatterns, filteredCipherSuites });
            }
            engine.setEnabledCipherSuites(filteredCipherSuites.toArray(new String[filteredCipherSuites.size()]));
            Collection<String> filteredSecureSocketProtocols = BaseSSLContextParameters.this.filter(enabledSecureSocketProtocols, Arrays.asList(engine.getSSLParameters().getProtocols()), Arrays.asList(engine.getEnabledProtocols()), enabledSecureSocketProtocolsPatterns, defaultEnabledSecureSocketProtocolsPatterns, !allowPassthrough);
            if (LOG.isDebugEnabled()) {
                LOG.debug(SSL_ENGINE_PROTOCOL_LOG_MSG, new Object[] { engine, enabledSecureSocketProtocols, enabledSecureSocketProtocolsPatterns, engine.getSSLParameters().getProtocols(), engine.getEnabledProtocols(), defaultEnabledSecureSocketProtocolsPatterns, filteredSecureSocketProtocols });
            }
            engine.setEnabledProtocols(filteredSecureSocketProtocols.toArray(new String[filteredSecureSocketProtocols.size()]));
            return engine;
        }
    };
    List<Configurer<SSLEngine>> sslEngineConfigurers = new LinkedList<Configurer<SSLEngine>>();
    sslEngineConfigurers.add(sslEngineConfigurer);
    return sslEngineConfigurers;
}

Example 69 with SSLEngine

use of javax.net.ssl.SSLEngine in project qpid-broker-j by apache.

the class HttpManagement method getSslContextFactory.

private SslContextFactory getSslContextFactory(final HttpPort<?> port) {
    KeyStore keyStore = port.getKeyStore();
    if (keyStore == null) {
        throw new IllegalConfigurationException("Key store is not configured. Cannot start management on HTTPS port without keystore");
    }
    boolean needClientCert = port.getNeedClientAuth() || port.getWantClientAuth();
    Collection<TrustStore> trustStores = port.getTrustStores();
    if (needClientCert && trustStores.isEmpty()) {
        throw new IllegalConfigurationException(String.format("Client certificate authentication is enabled on HTTPS port '%s' but no trust store defined", this.getName()));
    }
    SSLContext sslContext = SSLUtil.createSslContext(keyStore, trustStores, port.getName());
    SSLSessionContext serverSessionContext = sslContext.getServerSessionContext();
    if (port.getTLSSessionCacheSize() > 0) {
        serverSessionContext.setSessionCacheSize(port.getTLSSessionCacheSize());
    }
    if (port.getTLSSessionTimeout() > 0) {
        serverSessionContext.setSessionTimeout(port.getTLSSessionTimeout());
    }
    SslContextFactory factory = new SslContextFactory() {

        @Override
        public void customize(final SSLEngine sslEngine) {
            super.customize(sslEngine);
            if (port.getTlsCipherSuiteWhiteList() != null && !port.getTlsCipherSuiteWhiteList().isEmpty()) {
                SSLParameters sslParameters = sslEngine.getSSLParameters();
                sslParameters.setUseCipherSuitesOrder(true);
                sslEngine.setSSLParameters(sslParameters);
            }
            SSLUtil.updateEnabledCipherSuites(sslEngine, port.getTlsCipherSuiteWhiteList(), port.getTlsCipherSuiteBlackList());
            SSLUtil.updateEnabledTlsProtocols(sslEngine, port.getTlsProtocolWhiteList(), port.getTlsProtocolBlackList());
        }
    };
    factory.setSslContext(sslContext);
    if (port.getNeedClientAuth()) {
        factory.setNeedClientAuth(true);
    } else if (port.getWantClientAuth()) {
        factory.setWantClientAuth(true);
    }
    return factory;
}

Example 70 with SSLEngine

use of javax.net.ssl.SSLEngine in project qpid-broker-j by apache.

the class HttpManagement method createConnector.

private ServerConnector createConnector(final HttpPort<?> port, final Server server) {
    port.setPortManager(this);
    if (port.getState() != State.ACTIVE) {
        // TODO - RG - probably does nothing
        port.startAsync();
    }
    HttpConnectionFactory httpConnectionFactory = new HttpConnectionFactory();
    httpConnectionFactory.getHttpConfiguration().setSendServerVersion(false);
    httpConnectionFactory.getHttpConfiguration().setSendXPoweredBy(false);
    HttpConfiguration.Customizer requestAttributeCustomizer = (connector, httpConfiguration, request) -> HttpManagementUtil.getPortAttributeAction(port).performAction(request);
    httpConnectionFactory.getHttpConfiguration().addCustomizer(requestAttributeCustomizer);
    httpConnectionFactory.getHttpConfiguration().addCustomizer(new SecureRequestCustomizer());
    ConnectionFactory[] connectionFactories;
    Collection<Transport> transports = port.getTransports();
    if (!transports.contains(Transport.SSL)) {
        connectionFactories = new ConnectionFactory[] { httpConnectionFactory };
    } else if (transports.contains(Transport.SSL)) {
        SslContextFactory sslContextFactory = getSslContextFactory(port);
        ConnectionFactory sslConnectionFactory;
        if (port.getTransports().contains(Transport.TCP)) {
            sslConnectionFactory = new TlsOrPlainConnectionFactory(sslContextFactory, httpConnectionFactory.getProtocol());
        } else {
            sslConnectionFactory = new SslConnectionFactory(sslContextFactory, httpConnectionFactory.getProtocol());
        }
        connectionFactories = new ConnectionFactory[] { sslConnectionFactory, httpConnectionFactory };
    } else {
        throw new IllegalArgumentException("Unexpected transport on port " + port.getName() + ":" + transports);
    }
    ServerConnector connector = new ServerConnector(server, new QBBTrackingThreadPool(port.getThreadPoolMaximum(), port.getThreadPoolMinimum()), null, null, port.getDesiredNumberOfAcceptors(), port.getDesiredNumberOfSelectors(), connectionFactories) {

        @Override
        public void open() throws IOException {
            try {
                super.open();
            } catch (BindException e) {
                InetSocketAddress addr = getHost() == null ? new InetSocketAddress(getPort()) : new InetSocketAddress(getHost(), getPort());
                throw new PortBindFailureException(addr);
            }
        }
    };
    connector.setAcceptQueueSize(port.getAcceptBacklogSize());
    String bindingAddress = port.getBindingAddress();
    if (bindingAddress != null && !bindingAddress.trim().equals("") && !bindingAddress.trim().equals("*")) {
        connector.setHost(bindingAddress.trim());
    }
    connector.setPort(port.getPort());
    if (transports.contains(Transport.SSL)) {
        connector.addBean(new SslHandshakeListener() {

            @Override
            public void handshakeFailed(final Event event, final Throwable failure) {
                SSLEngine sslEngine = event.getSSLEngine();
                if (LOGGER.isDebugEnabled()) {
                    LOGGER.info("TLS handshake failed: host='{}', port={}", sslEngine.getPeerHost(), sslEngine.getPeerPort(), failure);
                } else {
                    LOGGER.info("TLS handshake failed: host='{}', port={}: {}", sslEngine.getPeerHost(), sslEngine.getPeerPort(), String.valueOf(failure));
                }
            }
        });
    }
    int acceptors = connector.getAcceptors();
    int selectors = connector.getSelectorManager().getSelectorCount();
    if (LOGGER.isDebugEnabled()) {
        LOGGER.debug("Created connector for http port {} with maxThreads={}, minThreads={}, acceptors={}, selectors={}, acceptBacklog={}", port.getName(), port.getThreadPoolMaximum(), port.getThreadPoolMinimum(), acceptors, selectors, port.getAcceptBacklogSize());
    }
    int requiredNumberOfConnections = acceptors + 2 * selectors + 1;
    if (port.getThreadPoolMaximum() < requiredNumberOfConnections) {
        throw new IllegalConfigurationException(String.format("Insufficient number of threads is configured on http port '%s': max=%d < needed(acceptors=%d + selectors=2*%d + request=1)", port.getName(), port.getThreadPoolMaximum(), acceptors, selectors));
    }
    return connector;
}