Examples with SSLPeerUnverifiedException javax.net.ssl.SSLPeerUnverifiedException used on opensource projects

Example 1 with SSLPeerUnverifiedException

use of javax.net.ssl.SSLPeerUnverifiedException in project vert.x by eclipse.

the class NetTest method testTLS.

void testTLS(boolean clientCert, boolean clientTrust, boolean serverCert, boolean serverTrust, boolean requireClientAuth, boolean clientTrustAll, boolean shouldPass, boolean startTLS, String[] enabledCipherSuites, String[] enabledSecureTransportProtocols) throws Exception {
    server.close();
    NetServerOptions options = new NetServerOptions();
    if (!startTLS) {
        options.setSsl(true);
    }
    if (serverTrust) {
        options.setTrustStoreOptions(new JksOptions().setPath("tls/server-truststore.jks").setPassword("wibble"));
    }
    if (serverCert) {
        options.setKeyStoreOptions(new JksOptions().setPath("tls/server-keystore.jks").setPassword("wibble"));
    }
    if (requireClientAuth) {
        options.setClientAuth(ClientAuth.REQUIRED);
    }
    for (String suite : enabledCipherSuites) {
        options.addEnabledCipherSuite(suite);
    }
    for (String protocol : enabledSecureTransportProtocols) {
        options.addEnabledSecureTransportProtocol(protocol);
    }
    Consumer<NetSocket> certificateChainChecker = socket -> {
        try {
            X509Certificate[] certs = socket.peerCertificateChain();
            if (clientCert) {
                assertNotNull(certs);
                assertEquals(1, certs.length);
            } else {
                assertNull(certs);
            }
        } catch (SSLPeerUnverifiedException e) {
            assertTrue(clientTrust || clientTrustAll);
        }
    };
    options.setPort(4043);
    server = vertx.createNetServer(options);
    Handler<NetSocket> serverHandler = socket -> {
        if (socket.isSsl()) {
            certificateChainChecker.accept(socket);
        }
        AtomicBoolean upgradedServer = new AtomicBoolean();
        AtomicInteger upgradedServerCount = new AtomicInteger();
        socket.handler(buff -> {
            socket.write(buff);
            if (startTLS) {
                if (upgradedServer.compareAndSet(false, true)) {
                    assertFalse(socket.isSsl());
                    socket.upgradeToSsl(v -> {
                        certificateChainChecker.accept(socket);
                        upgradedServerCount.incrementAndGet();
                        assertTrue(socket.isSsl());
                    });
                } else {
                    assertTrue(socket.isSsl());
                    assertEquals(1, upgradedServerCount.get());
                }
            } else {
                assertTrue(socket.isSsl());
            }
        });
    };
    server.connectHandler(serverHandler).listen(ar -> {
        client.close();
        NetClientOptions clientOptions = new NetClientOptions();
        if (!startTLS) {
            clientOptions.setSsl(true);
        }
        if (clientTrustAll) {
            clientOptions.setTrustAll(true);
        }
        if (clientTrust) {
            clientOptions.setTrustStoreOptions(new JksOptions().setPath("tls/client-truststore.jks").setPassword("wibble"));
        }
        if (clientCert) {
            clientOptions.setKeyStoreOptions(new JksOptions().setPath("tls/client-keystore.jks").setPassword("wibble"));
        }
        for (String suite : enabledCipherSuites) {
            clientOptions.addEnabledCipherSuite(suite);
        }
        for (String protocol : enabledSecureTransportProtocols) {
            clientOptions.addEnabledSecureTransportProtocol(protocol);
        }
        client = vertx.createNetClient(clientOptions);
        client.connect(4043, "localhost", ar2 -> {
            if (ar2.succeeded()) {
                if (!shouldPass) {
                    fail("Should not connect");
                    return;
                }
                final int numChunks = 100;
                final int chunkSize = 100;
                final List<Buffer> toSend = new ArrayList<>();
                final Buffer expected = Buffer.buffer();
                for (int i = 0; i < numChunks; i++) {
                    Buffer chunk = TestUtils.randomBuffer(chunkSize);
                    toSend.add(chunk);
                    expected.appendBuffer(chunk);
                }
                final Buffer received = Buffer.buffer();
                final NetSocket socket = ar2.result();
                final AtomicBoolean upgradedClient = new AtomicBoolean();
                socket.handler(buffer -> {
                    received.appendBuffer(buffer);
                    if (received.length() == expected.length()) {
                        assertEquals(expected, received);
                        testComplete();
                    }
                    if (startTLS && !upgradedClient.get()) {
                        upgradedClient.set(true);
                        assertFalse(socket.isSsl());
                        socket.upgradeToSsl(v -> {
                            assertTrue(socket.isSsl());
                            for (int i = 1; i < numChunks; i++) {
                                socket.write(toSend.get(i));
                            }
                        });
                    } else {
                        assertTrue(socket.isSsl());
                    }
                });
                int numToSend = startTLS ? 1 : numChunks;
                for (int i = 0; i < numToSend; i++) {
                    socket.write(toSend.get(i));
                }
            } else {
                if (shouldPass) {
                    fail("Should not fail to connect");
                } else {
                    testComplete();
                }
            }
        });
    });
    await();
}

Example 2 with SSLPeerUnverifiedException

use of javax.net.ssl.SSLPeerUnverifiedException in project jetty.project by eclipse.

the class SslContextFactory method getCertChain.

public static X509Certificate[] getCertChain(SSLSession sslSession) {
    try {
        Certificate[] javaxCerts = sslSession.getPeerCertificates();
        if (javaxCerts == null || javaxCerts.length == 0)
            return null;
        int length = javaxCerts.length;
        X509Certificate[] javaCerts = new X509Certificate[length];
        java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509");
        for (int i = 0; i < length; i++) {
            byte[] bytes = javaxCerts[i].getEncoded();
            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
            javaCerts[i] = (X509Certificate) cf.generateCertificate(stream);
        }
        return javaCerts;
    } catch (SSLPeerUnverifiedException pue) {
        return null;
    } catch (Exception e) {
        LOG.warn(Log.EXCEPTION, e);
        return null;
    }
}

Example 3 with SSLPeerUnverifiedException

use of javax.net.ssl.SSLPeerUnverifiedException in project android_frameworks_base by ParanoidAndroid.

the class SSLCertificateSocketFactory method verifyHostname.

/**
     * Verify the hostname of the certificate used by the other end of a
     * connected socket.  You MUST call this if you did not supply a hostname
     * to {@link #createSocket()}.  It is harmless to call this method
     * redundantly if the hostname has already been verified.
     *
     * <p>Wildcard certificates are allowed to verify any matching hostname,
     * so "foo.bar.example.com" is verified if the peer has a certificate
     * for "*.example.com".
     *
     * @param socket An SSL socket which has been connected to a server
     * @param hostname The expected hostname of the remote server
     * @throws IOException if something goes wrong handshaking with the server
     * @throws SSLPeerUnverifiedException if the server cannot prove its identity
     *
     * @hide
     */
public static void verifyHostname(Socket socket, String hostname) throws IOException {
    if (!(socket instanceof SSLSocket)) {
        throw new IllegalArgumentException("Attempt to verify non-SSL socket");
    }
    if (!isSslCheckRelaxed()) {
        // The code at the start of OpenSSLSocketImpl.startHandshake()
        // ensures that the call is idempotent, so we can safely call it.
        SSLSocket ssl = (SSLSocket) socket;
        ssl.startHandshake();
        SSLSession session = ssl.getSession();
        if (session == null) {
            throw new SSLException("Cannot verify SSL socket without session");
        }
        if (!HttpsURLConnection.getDefaultHostnameVerifier().verify(hostname, session)) {
            throw new SSLPeerUnverifiedException("Cannot verify hostname: " + hostname);
        }
    }
}

Example 4 with SSLPeerUnverifiedException

use of javax.net.ssl.SSLPeerUnverifiedException in project azure-sdk-for-java by Azure.

the class HostnameSslTests method canBindHostnameAndSsl.

@Test
@Ignore("Need a domain and a certificate")
public void canBindHostnameAndSsl() throws Exception {
    // hostname binding
    appServiceManager.webApps().define(WEBAPP_NAME).withRegion(Region.US_WEST).withNewResourceGroup(RG_NAME).withNewWindowsPlan(PricingTier.BASIC_B1).defineHostnameBinding().withAzureManagedDomain(domain).withSubDomain(WEBAPP_NAME).withDnsRecordType(CustomHostNameDnsRecordType.CNAME).attach().create();
    WebApp webApp = appServiceManager.webApps().getByResourceGroup(RG_NAME, WEBAPP_NAME);
    Assert.assertNotNull(webApp);
    if (!IS_MOCKED) {
        Response response = curl("http://" + WEBAPP_NAME + "." + DOMAIN);
        Assert.assertEquals(200, response.code());
        Assert.assertNotNull(response.body().string());
    }
    // hostname binding shortcut
    webApp.update().withManagedHostnameBindings(domain, WEBAPP_NAME + "-1", WEBAPP_NAME + "-2").apply();
    if (!IS_MOCKED) {
        Response response = curl("http://" + WEBAPP_NAME + "-1." + DOMAIN);
        Assert.assertEquals(200, response.code());
        Assert.assertNotNull(response.body().string());
        response = curl("http://" + WEBAPP_NAME + "-2." + DOMAIN);
        Assert.assertEquals(200, response.code());
        Assert.assertNotNull(response.body().string());
    }
    // SSL binding
    webApp.update().defineSslBinding().forHostname(WEBAPP_NAME + "." + DOMAIN).withExistingAppServiceCertificateOrder(certificateOrder).withSniBasedSsl().attach().apply();
    if (!IS_MOCKED) {
        Response response = null;
        int retryCount = 3;
        while (response == null && retryCount > 0) {
            try {
                response = curl("https://" + WEBAPP_NAME + "." + DOMAIN);
            } catch (SSLPeerUnverifiedException e) {
                retryCount--;
                Thread.sleep(5000);
            }
        }
        if (retryCount == 0) {
            fail();
        }
        Assert.assertEquals(200, response.code());
        Assert.assertNotNull(response.body().string());
    }
}

Example 5 with SSLPeerUnverifiedException

use of javax.net.ssl.SSLPeerUnverifiedException in project wildfly by wildfly.

the class RemotingLoginModule method login.

@SuppressWarnings("unchecked")
@Override
public boolean login() throws LoginException {
    if (super.login() == true) {
        log.debug("super.login()==true");
        return true;
    }
    Object credential = getCredential();
    if (credential instanceof RemotingConnectionCredential) {
        Connection con = ((RemotingConnectionCredential) credential).getConnection();
        Principal up = null;
        SecurityIdentity localIdentity = con.getLocalIdentity();
        if (localIdentity != null) {
            up = new RealmUser(localIdentity.getPrincipal().getName());
        }
        // If we found a principal from the connection then authentication succeeded.
        if (up != null) {
            identity = up;
            if (getUseFirstPass()) {
                String userName = identity.getName();
                log.debugf("Storing username '%s'", userName);
                // Add the username to the shared state map
                sharedState.put("javax.security.auth.login.name", identity);
                if (useNewClientCert) {
                    SSLSession session = con.getSslSession();
                    if (session != null) {
                        try {
                            credential = session.getPeerCertificates()[0];
                            log.debug("Using new certificate as credential.");
                        } catch (SSLPeerUnverifiedException e) {
                            log.debugf("No peer certificate available for '%s'", userName);
                        }
                    }
                } else if (useClientCert) {
                    SSLSession session = con.getSslSession();
                    if (session != null) {
                        try {
                            credential = session.getPeerCertificateChain()[0];
                            log.debug("Using certificate as credential.");
                        } catch (SSLPeerUnverifiedException e) {
                            log.debugf("No peer certificate available for '%s'", userName);
                        }
                    }
                }
                sharedState.put("javax.security.auth.login.password", credential);
            }
            loginOk = true;
            return true;
        }
    }
    // username and password has been supplied to a web auth.
    return false;
}