Examples with SSLEngine javax.net.ssl.SSLEngine used on opensource projects

Example 91 with SSLEngine

use of javax.net.ssl.SSLEngine in project incubator-servicecomb-java-chassis by apache.

the class SSLManager method createSSLEngine.

public static SSLEngine createSSLEngine(SSLOption option, SSLCustom custom) {
    SSLContext context = createSSLContext(option, custom);
    SSLEngine engine = context.createSSLEngine();
    engine.setEnabledProtocols(option.getProtocols().split(","));
    String[] supported = engine.getSupportedCipherSuites();
    String[] eanbled = option.getCiphers().split(",");
    engine.setEnabledCipherSuites(getEnabledCiphers(supported, eanbled));
    engine.setNeedClientAuth(option.isAuthPeer());
    return engine;
}

Example 92 with SSLEngine

use of javax.net.ssl.SSLEngine in project incubator-servicecomb-java-chassis by apache.

the class TrustManagerExtTest method testCheckClientTrustedExecption.

@Test
public void testCheckClientTrustedExecption(@Mocked CertificateUtil certificateUtil) {
    MyX509Certificate myX509Certificate1 = new MyX509Certificate();
    MyX509Certificate myX509Certificate2 = new MyX509Certificate();
    MyX509Certificate[] MyX509CertificateArray = new MyX509Certificate[2];
    MyX509CertificateArray[0] = myX509Certificate1;
    MyX509CertificateArray[1] = myX509Certificate2;
    new Expectations() {

        {
            CertificateUtil.findOwner((X509Certificate[]) any);
            result = any;
            CertificateUtil.getCN((X509Certificate) any);
            result = "10.67.147.115";
        }
    };
    MyX509ExtendedTrustManager myX509ExtendedTrustManager = new MyX509ExtendedTrustManager();
    TrustManagerExt trustManagerExt = new TrustManagerExt(myX509ExtendedTrustManager, option, custom);
    Socket socket = null;
    SSLEngine sslengine = null;
    new MockUp<InputStreamReader>() {

        @Mock
        public int read(char[] cbuf) throws IOException {
            throw new IOException();
        }
    };
    boolean validAssert = true;
    try {
        trustManagerExt.checkClientTrusted(MyX509CertificateArray, "pks", socket);
        trustManagerExt.checkClientTrusted(MyX509CertificateArray, "pks", sslengine);
        trustManagerExt.checkServerTrusted(MyX509CertificateArray, "pks", socket);
        trustManagerExt.checkServerTrusted(MyX509CertificateArray, "pks", sslengine);
    } catch (Exception e) {
        Assert.assertEquals("java.security.cert.CertificateException", e.getClass().getName());
        validAssert = false;
    }
    Assert.assertFalse(validAssert);
}

Example 93 with SSLEngine

use of javax.net.ssl.SSLEngine in project incubator-servicecomb-java-chassis by apache.

the class TrustManagerExtTest method testCheckClientTrusted.

@Test
public void testCheckClientTrusted(@Mocked CertificateUtil certificateUtil) {
    MyX509Certificate myX509Certificate1 = new MyX509Certificate();
    MyX509Certificate myX509Certificate2 = new MyX509Certificate();
    MyX509Certificate[] MyX509CertificateArray = new MyX509Certificate[2];
    MyX509CertificateArray[0] = myX509Certificate1;
    MyX509CertificateArray[1] = myX509Certificate2;
    new Expectations() {

        {
            CertificateUtil.findOwner((X509Certificate[]) any);
            result = any;
            CertificateUtil.getCN((X509Certificate) any);
            result = "10.67.147.115";
        }
    };
    MyX509ExtendedTrustManager myX509ExtendedTrustManager = new MyX509ExtendedTrustManager();
    TrustManagerExt trustManagerExt = new TrustManagerExt(myX509ExtendedTrustManager, option, custom);
    Socket socket = null;
    SSLEngine sslengine = null;
    boolean validAssert = true;
    try {
        trustManagerExt.checkClientTrusted(MyX509CertificateArray, "pks", socket);
        trustManagerExt.checkClientTrusted(MyX509CertificateArray, "pks", sslengine);
        trustManagerExt.checkServerTrusted(MyX509CertificateArray, "pks", socket);
        trustManagerExt.checkServerTrusted(MyX509CertificateArray, "pks", sslengine);
    } catch (Exception e) {
        validAssert = false;
    }
    Assert.assertTrue(validAssert);
}

Example 94 with SSLEngine

use of javax.net.ssl.SSLEngine in project java by wavefrontHQ.

the class SslSimpleBuilder method build.

public SslHandler build(ByteBufAllocator bufferAllocator) throws IOException, NoSuchAlgorithmException, CertificateException {
    SslContextBuilder builder = SslContextBuilder.forServer(sslCertificateFile, sslKeyFile, passPhrase);
    if (logger.isDebugEnabled())
        logger.debug("Ciphers:  " + ciphers.toString());
    builder.ciphers(Arrays.asList(ciphers));
    if (requireClientAuth()) {
        if (logger.isDebugEnabled())
            logger.debug("Certificate Authorities: " + certificateAuthorities.toString());
        builder.trustManager(loadCertificateCollection(certificateAuthorities));
    }
    SslContext context = builder.build();
    SslHandler sslHandler = context.newHandler(bufferAllocator);
    if (logger.isDebugEnabled())
        logger.debug("TLS: " + protocols.toString());
    SSLEngine engine = sslHandler.engine();
    engine.setEnabledProtocols(protocols);
    if (requireClientAuth()) {
        // server is doing the handshake
        engine.setUseClientMode(false);
        if (verifyMode == SslClientVerifyMode.FORCE_PEER) {
            // Explicitely require a client certificate
            engine.setNeedClientAuth(true);
        } else if (verifyMode == SslClientVerifyMode.VERIFY_PEER) {
            // If the client supply a client certificate we will verify it.
            engine.setWantClientAuth(true);
        }
    }
    sslHandler.setHandshakeTimeoutMillis(handshakeTimeoutMilliseconds);
    return sslHandler;
}

Example 95 with SSLEngine

use of javax.net.ssl.SSLEngine in project apache-kafka-on-k8s by banzaicloud.

the class SslTransportLayerTest method testClientEndpointNotValidated.

/**
 * According to RFC 2818:
 * <blockquote>Typically, the server has no external knowledge of what the client's
 * identity ought to be and so checks (other than that the client has a
 * certificate chain rooted in an appropriate CA) are not possible. If a
 * server has such knowledge (typically from some source external to
 * HTTP or TLS) it SHOULD check the identity as described above.</blockquote>
 *
 * However, Java SSL engine does not perform any endpoint validation for client IP address.
 * Hence it is safe to avoid reverse DNS lookup while creating the SSL engine. This test checks
 * that client validation does not fail even if the client certificate has an invalid hostname.
 * This test is to ensure that if client endpoint validation is added to Java in future, we can detect
 * and update Kafka SSL code to enable validation on the server-side and provide hostname if required.
 */
@Test
public void testClientEndpointNotValidated() throws Exception {
    String node = "0";
    // Create client certificate with an invalid hostname
    clientCertStores = new CertStores(false, "non-existent.com");
    serverCertStores = new CertStores(true, "localhost");
    sslServerConfigs = serverCertStores.getTrustingConfig(clientCertStores);
    sslClientConfigs = clientCertStores.getTrustingConfig(serverCertStores);
    // Create a server with endpoint validation enabled on the server SSL engine
    SslChannelBuilder serverChannelBuilder = new TestSslChannelBuilder(Mode.SERVER) {

        @Override
        protected TestSslTransportLayer newTransportLayer(String id, SelectionKey key, SSLEngine sslEngine) throws IOException {
            SSLParameters sslParams = sslEngine.getSSLParameters();
            sslParams.setEndpointIdentificationAlgorithm("HTTPS");
            sslEngine.setSSLParameters(sslParams);
            return super.newTransportLayer(id, key, sslEngine);
        }
    };
    serverChannelBuilder.configure(sslServerConfigs);
    server = new NioEchoServer(ListenerName.forSecurityProtocol(SecurityProtocol.SSL), SecurityProtocol.SSL, new TestSecurityConfig(sslServerConfigs), "localhost", serverChannelBuilder, null);
    server.start();
    createSelector(sslClientConfigs);
    InetSocketAddress addr = new InetSocketAddress("localhost", server.port());
    selector.connect(node, addr, BUFFER_SIZE, BUFFER_SIZE);
    NetworkTestUtils.checkClientConnection(selector, node, 100, 10);
}