Skip to content

Commit 3939807

Browse files
mpdonovaXueleiFan
mpdonova
authored and
XueleiFan
committedApr 11, 2023
8182621: JSSE should reject empty TLS plaintexts
Reviewed-by: xuelei
1 parent 1375130 commit 3939807

File tree

4 files changed

+648
-2
lines changed

4 files changed

+648
-2
lines changed
 

‎src/java.base/share/classes/sun/security/ssl/SSLEngineInputRecord.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -263,6 +263,12 @@ private Plaintext[] decodeInputRecord(ByteBuffer packet)
263263
// parse handshake messages
264264
//
265265
if (contentType == ContentType.HANDSHAKE.id) {
266+
if (contentLen == 0) {
267+
// From RFC 8446: "Implementations MUST NOT send zero-length fragments
268+
// of Handshake types, even if those fragments contain padding."
269+
throw new SSLProtocolException("Handshake packets must not be zero-length");
270+
}
271+
266272
ByteBuffer handshakeFrag = fragment;
267273
if ((handshakeBuffer != null) &&
268274
(handshakeBuffer.remaining() != 0)) {

‎src/java.base/share/classes/sun/security/ssl/SSLSocketInputRecord.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved.
33
* Copyright (c) 2020, Azul Systems, Inc. All rights reserved.
44
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
55
*
@@ -284,6 +284,12 @@ private Plaintext[] decodeInputRecord() throws IOException, BadPaddingException
284284
//
285285
if (contentType == ContentType.HANDSHAKE.id) {
286286
ByteBuffer handshakeFrag = fragment;
287+
if (contentLen == 0) {
288+
// From RFC 8446: "Implementations MUST NOT send zero-length fragments
289+
// of Handshake types, even if those fragments contain padding."
290+
throw new SSLProtocolException("Handshake fragments must not be zero length.");
291+
}
292+
287293
if ((handshakeBuffer != null) &&
288294
(handshakeBuffer.remaining() != 0)) {
289295
ByteBuffer bb = ByteBuffer.wrap(new byte[

‎test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineEmptyFragments.java

+268
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,268 @@
1+
/*
2+
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
/*
25+
* @test
26+
* @bug 8182621
27+
* @summary Verify the SSLEngine rejects empty Handshake, Alert, and ChangeCipherSpec messages.
28+
* @library /javax/net/ssl/templates
29+
* @run main SSLEngineEmptyFragments
30+
*/
31+
import java.nio.ByteBuffer;
32+
import java.security.NoSuchAlgorithmException;
33+
import javax.net.ssl.*;
34+
35+
public class SSLEngineEmptyFragments extends SSLContextTemplate {
36+
private static final byte HANDSHAKE_TYPE = 22;
37+
private static final byte ALERT_TYPE = 21;
38+
private static final byte CHANGE_CIPHERSPEC_TYPE = 20;
39+
private static final String TLSv12 = "TLSv1.2";
40+
private static final String TLSv13 = "TLSv1.3";
41+
42+
private SSLEngine serverEngine;
43+
private SSLEngine clientEngine;
44+
private ByteBuffer clientIn;
45+
private ByteBuffer serverIn;
46+
private ByteBuffer clientToServer;
47+
private ByteBuffer serverToClient;
48+
private ByteBuffer clientOut;
49+
private ByteBuffer serverOut;
50+
51+
private final String protocol;
52+
53+
public SSLEngineEmptyFragments(String protocol) {
54+
this.protocol = protocol;
55+
}
56+
57+
private void initialize() throws Exception {
58+
initialize(null);
59+
}
60+
61+
private void initialize(String [] protocols) throws Exception {
62+
serverEngine = createServerSSLContext().createSSLEngine();
63+
clientEngine = createClientSSLContext().createSSLEngine();
64+
65+
serverEngine.setUseClientMode(false);
66+
clientEngine.setUseClientMode(true);
67+
68+
if (protocols != null) {
69+
clientEngine.setEnabledProtocols(protocols);
70+
serverEngine.setEnabledProtocols(protocols);
71+
}
72+
73+
// do one legitimate handshake packet, then send a zero-length alert.
74+
SSLSession session = clientEngine.getSession();
75+
int appBufferMax = session.getApplicationBufferSize();
76+
int netBufferMax = session.getPacketBufferSize();
77+
78+
// We'll make the input buffers a bit bigger than the max needed
79+
// size, so that unwrap()s following a successful data transfer
80+
// won't generate BUFFER_OVERFLOWS.
81+
//
82+
// We'll use a mix of direct and indirect ByteBuffers for
83+
// tutorial purposes only. In reality, only use direct
84+
// ByteBuffers when they give a clear performance enhancement.
85+
clientIn = ByteBuffer.allocate(appBufferMax + 50);
86+
serverIn = ByteBuffer.allocate(appBufferMax + 50);
87+
88+
clientToServer = ByteBuffer.allocateDirect(netBufferMax);
89+
serverToClient = ByteBuffer.allocateDirect(netBufferMax);
90+
91+
clientOut = ByteBuffer.wrap("Hi Server, I'm Client".getBytes());
92+
serverOut = ByteBuffer.wrap("Hello Client, I'm Server".getBytes());
93+
}
94+
95+
private void testAlertPacketNotHandshaking() throws Exception {
96+
log("**** Empty alert packet/not handshaking");
97+
initialize();
98+
99+
ByteBuffer alert = ByteBuffer.allocate(5);
100+
alert.put(new byte[]{ALERT_TYPE, 3, 3, 0, 0});
101+
alert.flip();
102+
103+
try {
104+
unwrap(serverEngine, alert, serverIn);
105+
throw new RuntimeException("Expected exception was not thrown.");
106+
} catch (SSLHandshakeException exc) {
107+
log("Got the exception I wanted.");
108+
}
109+
}
110+
111+
private void testAlertPacketMidHandshake() throws Exception {
112+
log("**** Empty alert packet during handshake.");
113+
initialize(new String[]{protocol});
114+
115+
wrap(clientEngine, clientOut, clientToServer);
116+
runDelegatedTasks(clientEngine);
117+
clientToServer.flip();
118+
119+
unwrap(serverEngine, clientToServer, serverIn);
120+
runDelegatedTasks(serverEngine);
121+
122+
while(serverEngine.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_WRAP) {
123+
wrap(serverEngine, serverOut, serverToClient);
124+
runDelegatedTasks(serverEngine);
125+
serverToClient.flip();
126+
}
127+
128+
ByteBuffer alert = ByteBuffer.allocate(5);
129+
alert.put(new byte[]{ALERT_TYPE, 3, 3, 0, 0});
130+
alert.flip();
131+
132+
try {
133+
unwrap(serverEngine, alert, serverIn);
134+
log("Server unwrap was successful when it should have failed.");
135+
throw new RuntimeException("Expected exception was not thrown.");
136+
} catch (SSLHandshakeException exc) {
137+
log("Got the exception I wanted.");
138+
}
139+
}
140+
141+
private void testHandshakePacket() throws NoSuchAlgorithmException, SSLException {
142+
log("**** Empty handshake package.");
143+
SSLContext ctx = SSLContext.getDefault();
144+
SSLEngine engine = ctx.createSSLEngine();
145+
engine.setUseClientMode(false);
146+
147+
try {
148+
ByteBuffer bb = ByteBuffer.allocate(5);
149+
bb.put(new byte[]{HANDSHAKE_TYPE, 3, 3, 0, 0});
150+
bb.flip();
151+
ByteBuffer out = ByteBuffer.allocate(engine.getSession().getPacketBufferSize());
152+
engine.unwrap(bb, out);
153+
throw new RuntimeException("SSLEngine did not throw an exception for a zero-length fragment.");
154+
} catch (SSLProtocolException exc) {
155+
log("Received expected exception");
156+
}
157+
}
158+
159+
private void testEmptyChangeCipherSpec() throws Exception {
160+
initialize(new String[]{protocol});
161+
162+
boolean foundCipherSpecMsg = false;
163+
do {
164+
log("Client wrap");
165+
wrap(clientEngine, clientOut, clientToServer);
166+
runDelegatedTasks(clientEngine);
167+
168+
if(clientToServer.get(0) == CHANGE_CIPHERSPEC_TYPE) {
169+
foundCipherSpecMsg = true;
170+
break;
171+
}
172+
173+
log("server wrap");
174+
wrap(serverEngine, serverOut, serverToClient);
175+
runDelegatedTasks(serverEngine);
176+
177+
clientToServer.flip();
178+
serverToClient.flip();
179+
180+
log("client unwrap");
181+
unwrap(clientEngine, serverToClient, clientIn);
182+
runDelegatedTasks(clientEngine);
183+
184+
log("server unwrap");
185+
unwrap(serverEngine, clientToServer, serverIn);
186+
runDelegatedTasks(serverEngine);
187+
188+
clientToServer.compact();
189+
serverToClient.compact();
190+
} while(clientEngine.getHandshakeStatus() != SSLEngineResult.HandshakeStatus.FINISHED
191+
&& serverEngine.getHandshakeStatus() != SSLEngineResult.HandshakeStatus.FINISHED);
192+
193+
if (!foundCipherSpecMsg) {
194+
// performed TLS handshaking but didn't catch change-cipherspec message.
195+
throw new RuntimeException("Did not intercept ChangeCipherSpec message.");
196+
}
197+
198+
ByteBuffer changeCipher = ByteBuffer.allocate(5);
199+
changeCipher.put(new byte[]{CHANGE_CIPHERSPEC_TYPE, 3, 3, 0, 0});
200+
changeCipher.flip();
201+
try {
202+
unwrap(serverEngine, changeCipher, serverIn);
203+
throw new RuntimeException("Didn't get the expected SSL exception");
204+
} catch (SSLProtocolException exc) {
205+
log("Received expected exception.");
206+
}
207+
}
208+
209+
private SSLEngineResult wrap(SSLEngine engine, ByteBuffer src, ByteBuffer dst) throws SSLException {
210+
SSLEngineResult result = engine.wrap(src, dst);
211+
logEngineStatus(engine, result);
212+
return result;
213+
}
214+
215+
private SSLEngineResult unwrap(SSLEngine engine, ByteBuffer src, ByteBuffer dst) throws SSLException {
216+
SSLEngineResult result = engine.unwrap(src, dst);
217+
logEngineStatus(engine, result);
218+
return result;
219+
}
220+
221+
protected void runDelegatedTasks(SSLEngine engine) throws Exception {
222+
if (engine.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_TASK) {
223+
Runnable runnable;
224+
while ((runnable = engine.getDelegatedTask()) != null) {
225+
log(" running delegated task...");
226+
runnable.run();
227+
}
228+
SSLEngineResult.HandshakeStatus hsStatus = engine.getHandshakeStatus();
229+
if (hsStatus == SSLEngineResult.HandshakeStatus.NEED_TASK) {
230+
throw new Exception(
231+
"handshake shouldn't need additional tasks");
232+
}
233+
logEngineStatus(engine);
234+
}
235+
}
236+
237+
private void logEngineStatus(SSLEngine engine) {
238+
log("\tCurrent HS State: " + engine.getHandshakeStatus());
239+
log("\tisInboundDone() : " + engine.isInboundDone());
240+
log("\tisOutboundDone(): " + engine.isOutboundDone());
241+
}
242+
243+
private void logEngineStatus(
244+
SSLEngine engine, SSLEngineResult result) {
245+
log("\tResult Status : " + result.getStatus());
246+
log("\tResult HS Status : " + result.getHandshakeStatus());
247+
log("\tEngine HS Status : " + engine.getHandshakeStatus());
248+
log("\tisInboundDone() : " + engine.isInboundDone());
249+
log("\tisOutboundDone() : " + engine.isOutboundDone());
250+
log("\tMore Result : " + result);
251+
}
252+
253+
private void log(String message) {
254+
System.err.println(message);
255+
}
256+
257+
public static void main(String [] args) throws Exception {
258+
SSLEngineEmptyFragments tests = new SSLEngineEmptyFragments(TLSv12);
259+
tests.testHandshakePacket();
260+
tests.testAlertPacketNotHandshaking();
261+
tests.testAlertPacketMidHandshake();
262+
tests.testEmptyChangeCipherSpec();
263+
264+
tests = new SSLEngineEmptyFragments(TLSv13);
265+
tests.testHandshakePacket();
266+
tests.testAlertPacketNotHandshaking();
267+
}
268+
}

‎test/jdk/sun/security/ssl/SSLSocketImpl/SSLSocketEmptyFragments.java

+366
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,366 @@
1+
/*
2+
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
/*
25+
* @test
26+
* @bug 8182621
27+
* @summary Verify JSSE rejects empty Handshake, Alert, and ChangeCipherSpec messages.
28+
* @library /javax/net/ssl/templates
29+
* @run main SSLSocketEmptyFragments
30+
*/
31+
32+
import javax.net.ssl.*;
33+
import java.io.*;
34+
import java.net.InetAddress;
35+
import java.net.Socket;
36+
import java.nio.ByteBuffer;
37+
import java.util.concurrent.*;
38+
import java.util.function.Consumer;
39+
40+
public class SSLSocketEmptyFragments extends SSLContextTemplate {
41+
private static final boolean DEBUG = Boolean.getBoolean("test.debug");
42+
private static final byte HANDSHAKE_TYPE = 22;
43+
private static final byte ALERT_TYPE = 21;
44+
private static final byte CHANGE_CIPHERSPEC_TYPE = 20;
45+
46+
private static final byte[] INVALID_ALERT = {ALERT_TYPE, 3, 3, 0, 0};
47+
48+
private static final byte[] INVALID_HANDSHAKE = {HANDSHAKE_TYPE, 3, 3, 0, 0};
49+
private static final int SERVER_WAIT_SEC = 5;
50+
private static final String TLSv13 = "TLSv1.3";
51+
private static final String TLSv12 = "TLSv1.2";
52+
53+
private final String protocol;
54+
55+
public SSLSocketEmptyFragments(String protocol) {
56+
this.protocol = protocol;
57+
}
58+
59+
60+
private void testEmptyHandshakeRecord(Socket client) {
61+
log("Sending bad handshake packet to server...");
62+
63+
try {
64+
OutputStream os = client.getOutputStream();
65+
os.write(INVALID_HANDSHAKE);
66+
os.flush();
67+
} catch (IOException exc) {
68+
throw new RuntimeException("Unexpected IOException thrown by socket operations", exc);
69+
}
70+
}
71+
72+
73+
private void testEmptyAlertNotHandshaking(Socket client) {
74+
log("Sending empty alert packet before handshaking starts.");
75+
76+
try {
77+
OutputStream os = client.getOutputStream();
78+
os.write(INVALID_ALERT);
79+
os.flush();
80+
} catch (IOException exc) {
81+
throw new RuntimeException("Unexpected IOException thrown by socket operations.", exc);
82+
}
83+
}
84+
85+
/**
86+
* Runs a test where the server -- in a separate thread -- accepts a connection
87+
* and attempts to read from the remote side. Tests are successful if the
88+
* server thread returns true.
89+
*
90+
* @param clientConsumer Client-side test code that injects bad packets into the TLS handshake.
91+
* @param expectedException The exception that should be thrown by the server
92+
*/
93+
private void executeTest(Consumer<Socket> clientConsumer,
94+
final Class<?> expectedException) throws Exception {
95+
SSLContext serverContext = createServerSSLContext();
96+
SSLServerSocketFactory factory = serverContext.getServerSocketFactory();
97+
98+
try(ExecutorService threadPool = Executors.newFixedThreadPool(1);
99+
SSLServerSocket serverSocket = (SSLServerSocket) factory.createServerSocket()) {
100+
serverSocket.bind(null);
101+
int port = serverSocket.getLocalPort();
102+
InetAddress address = serverSocket.getInetAddress();
103+
104+
Future<Boolean> serverThread = threadPool.submit(() -> {
105+
try (SSLSocket socket = (SSLSocket) serverSocket.accept()) {
106+
log("Server reading data from client.");
107+
socket.getInputStream().read();
108+
log("The expected exception was not thrown.");
109+
return false;
110+
111+
} catch (Exception exc) {
112+
if (expectedException.isAssignableFrom(exc.getClass())) {
113+
log("Server thread received expected exception: " + expectedException.getName());
114+
return true;
115+
} else {
116+
log("Server thread threw an unexpected exception: " + exc);
117+
throw exc;
118+
}
119+
}
120+
});
121+
122+
try(Socket socket = new Socket(address, port)) {
123+
clientConsumer.accept(socket);
124+
log("waiting for server to exit.");
125+
126+
// wait for the server to exit, which should be quick if the test passes.
127+
if (!serverThread.get(SERVER_WAIT_SEC, TimeUnit.SECONDS)) {
128+
throw new RuntimeException(
129+
"The server side of the connection did not throw the expected exception");
130+
}
131+
}
132+
}
133+
}
134+
135+
/**
136+
* Performs the client side of the TLS handshake, sending and receiving
137+
* packets over the given socket.
138+
* @param socket Connected socket to the server side.
139+
* @throws IOException
140+
*/
141+
private void testEmptyAlertDuringHandshake(Socket socket) {
142+
log("**** Testing empty alert during handshake");
143+
144+
try {
145+
SSLEngine engine = createClientSSLContext().createSSLEngine();
146+
engine.setUseClientMode(true);
147+
SSLSession session = engine.getSession();
148+
149+
int appBufferMax = session.getApplicationBufferSize();
150+
int netBufferMax = session.getPacketBufferSize();
151+
152+
ByteBuffer clientIn = ByteBuffer.allocate(appBufferMax + 50);
153+
ByteBuffer clientToServer = ByteBuffer.allocate(appBufferMax + 50);
154+
ByteBuffer clientOut = ByteBuffer.wrap("Hi Server, I'm Client".getBytes());
155+
156+
wrap(engine, clientOut, clientToServer);
157+
runDelegatedTasks(engine);
158+
clientToServer.flip();
159+
160+
OutputStream socketOut = socket.getOutputStream();
161+
byte [] outbound = new byte[netBufferMax];
162+
clientToServer.get(outbound, 0, clientToServer.limit());
163+
socketOut.write(outbound, 0, clientToServer.limit());
164+
socketOut.flush();
165+
166+
processServerResponse(engine, clientIn, socket.getInputStream());
167+
168+
log("Sending invalid alert packet!");
169+
socketOut.write(new byte[]{ALERT_TYPE, 3, 3, 0, 0});
170+
socketOut.flush();
171+
172+
} catch (Exception exc){
173+
throw new RuntimeException("An error occurred running the test.", exc);
174+
}
175+
}
176+
177+
/**
178+
* Performs TLS handshake until the client (this method) needs to send the
179+
* ChangeCipherSpec message. Then we send a packet with a zero-length fragment.
180+
*/
181+
private void testEmptyChangeCipherSpecMessage(Socket socket) {
182+
log("**** Testing invalid ChangeCipherSpec message");
183+
184+
try {
185+
socket.setSoTimeout(500);
186+
SSLEngine engine = createClientSSLContext().createSSLEngine();
187+
engine.setUseClientMode(true);
188+
SSLSession session = engine.getSession();
189+
int appBufferMax = session.getApplicationBufferSize();
190+
191+
ByteBuffer clientIn = ByteBuffer.allocate(appBufferMax + 50);
192+
ByteBuffer clientToServer = ByteBuffer.allocate(appBufferMax + 50);
193+
194+
ByteBuffer clientOut = ByteBuffer.wrap("Hi Server, I'm Client".getBytes());
195+
196+
OutputStream outputStream = socket.getOutputStream();
197+
198+
boolean foundCipherSpecMsg = false;
199+
200+
byte[] outbound = new byte[8192];
201+
do {
202+
wrap(engine, clientOut, clientToServer);
203+
runDelegatedTasks(engine);
204+
clientToServer.flip();
205+
206+
if(clientToServer.get(0) == CHANGE_CIPHERSPEC_TYPE) {
207+
foundCipherSpecMsg = true;
208+
break;
209+
}
210+
clientToServer.get(outbound, 0, clientToServer.limit());
211+
debug("Writing " + clientToServer.limit() + " bytes to the server.");
212+
outputStream.write(outbound, 0, clientToServer.limit());
213+
outputStream.flush();
214+
215+
processServerResponse(engine, clientIn, socket.getInputStream());
216+
217+
clientToServer.clear();
218+
219+
} while(engine.getHandshakeStatus() != SSLEngineResult.HandshakeStatus.FINISHED);
220+
221+
if (!foundCipherSpecMsg) {
222+
throw new RuntimeException("Didn't intercept the ChangeCipherSpec message.");
223+
} else {
224+
log("Sending invalid ChangeCipherSpec message");
225+
outputStream.write(new byte[]{CHANGE_CIPHERSPEC_TYPE, 3, 3, 0, 0});
226+
outputStream.flush();
227+
}
228+
229+
} catch (Exception exc) {
230+
throw new RuntimeException("An error occurred running the test.", exc);
231+
}
232+
}
233+
234+
/**
235+
* Processes TLS handshake messages received from the server.
236+
*/
237+
private static void processServerResponse(SSLEngine engine, ByteBuffer clientIn,
238+
InputStream inputStream) throws IOException {
239+
byte [] inbound = new byte[8192];
240+
ByteBuffer serverToClient = ByteBuffer.allocate(
241+
engine.getSession().getApplicationBufferSize() + 50);
242+
243+
while(engine.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_UNWRAP) {
244+
log("reading data from server.");
245+
int len = inputStream.read(inbound);
246+
if (len == -1) {
247+
throw new IOException("Could not read from server.");
248+
}
249+
250+
dumpBytes(inbound, len);
251+
252+
serverToClient.put(inbound, 0, len);
253+
serverToClient.flip();
254+
255+
// unwrap packets in a loop because we sometimes get multiple
256+
// TLS messages in one read() operation.
257+
do {
258+
unwrap(engine, serverToClient, clientIn);
259+
runDelegatedTasks(engine);
260+
log("Status after running tasks: " + engine.getHandshakeStatus());
261+
} while (serverToClient.hasRemaining());
262+
serverToClient.compact();
263+
}
264+
}
265+
266+
private static SSLEngineResult wrap(SSLEngine engine, ByteBuffer src, ByteBuffer dst) throws SSLException {
267+
debug("Wrapping...");
268+
SSLEngineResult result = engine.wrap(src, dst);
269+
logEngineStatus(engine, result);
270+
return result;
271+
}
272+
273+
private static SSLEngineResult unwrap(SSLEngine engine, ByteBuffer src, ByteBuffer dst) throws SSLException {
274+
debug("Unwrapping");
275+
SSLEngineResult result = engine.unwrap(src, dst);
276+
logEngineStatus(engine, result);
277+
return result;
278+
}
279+
280+
protected static void runDelegatedTasks(SSLEngine engine) {
281+
if (engine.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_TASK) {
282+
Runnable runnable;
283+
while ((runnable = engine.getDelegatedTask()) != null) {
284+
debug(" running delegated task...");
285+
runnable.run();
286+
}
287+
SSLEngineResult.HandshakeStatus hsStatus = engine.getHandshakeStatus();
288+
if (hsStatus == SSLEngineResult.HandshakeStatus.NEED_TASK) {
289+
throw new RuntimeException(
290+
"handshake shouldn't need additional tasks");
291+
}
292+
}
293+
}
294+
295+
296+
@Override
297+
protected ContextParameters getClientContextParameters() {
298+
return getContextParameters();
299+
}
300+
301+
@Override
302+
protected ContextParameters getServerContextParameters() {
303+
return getContextParameters();
304+
}
305+
306+
private ContextParameters getContextParameters() {
307+
return new ContextParameters(protocol, "PKIX", "NewSunX509");
308+
}
309+
310+
private static void log(String message) {
311+
System.out.println(message);
312+
System.out.flush();
313+
}
314+
315+
private static void dumpBytes(byte[] buffer, int length) {
316+
int totalLength = Math.min(buffer.length, length);
317+
StringBuffer sb = new StringBuffer();
318+
int counter = 0;
319+
for (int idx = 0; idx < totalLength ; ++idx) {
320+
sb.append(String.format("%02x ", buffer[idx]));
321+
if (++counter == 16) {
322+
sb.append("\n");
323+
counter = 0;
324+
}
325+
}
326+
debug(sb.toString());
327+
}
328+
329+
private static void debug(String message) {
330+
if (DEBUG) {
331+
log(message);
332+
}
333+
}
334+
335+
private static FileWriter fw;
336+
337+
private static void logEngineStatus(
338+
SSLEngine engine, SSLEngineResult result) {
339+
debug("\tResult Status : " + result.getStatus());
340+
debug("\tResult HS Status : " + result.getHandshakeStatus());
341+
debug("\tEngine HS Status : " + engine.getHandshakeStatus());
342+
debug("\tisInboundDone() : " + engine.isInboundDone());
343+
debug("\tisOutboundDone() : " + engine.isOutboundDone());
344+
debug("\tMore Result : " + result);
345+
}
346+
347+
348+
public static void main(String [] args) throws Exception {
349+
SSLSocketEmptyFragments tests = new SSLSocketEmptyFragments(TLSv12);
350+
351+
tests.executeTest(
352+
tests::testEmptyHandshakeRecord, SSLProtocolException.class);
353+
tests.executeTest(
354+
tests::testEmptyAlertNotHandshaking, SSLHandshakeException.class);
355+
tests.executeTest(
356+
tests::testEmptyAlertDuringHandshake, SSLHandshakeException.class);
357+
tests.executeTest(
358+
tests::testEmptyChangeCipherSpecMessage, SSLProtocolException.class);
359+
360+
tests = new SSLSocketEmptyFragments(TLSv13);
361+
tests.executeTest(
362+
tests::testEmptyHandshakeRecord, SSLProtocolException.class);
363+
tests.executeTest(
364+
tests::testEmptyAlertNotHandshaking, SSLHandshakeException.class);
365+
}
366+
}

0 commit comments

Comments
 (0)
Please sign in to comment.