1 /*

     2  * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 //

    25 // SunJSSE does not support dynamic system properties, no way to re-use

    26 // system properties in samevm/agentvm mode.

    27 //

    28 

    29 /**

    30  * @test

    31  * @bug 7068321

    32  * @summary Support TLS Server Name Indication (SNI) Extension in JSSE Server

    33  * @run main/othervm SSLSocketConsistentSNI

    34  */

    35 

    36 import java.io.*;

    37 import java.nio.*;

    38 import java.nio.channels.*;

    39 import java.util.*;

    40 import java.net.*;

    41 import javax.net.ssl.*;

    42 

    43 public class SSLSocketConsistentSNI {

    44 

    45     /*

    46      * =============================================================

    47      * Set the various variables needed for the tests, then

    48      * specify what tests to run on each side.

    49      */

    50 

    51     /*

    52      * Should we run the client or server in a separate thread?

    53      * Both sides can throw exceptions, but do you have a preference

    54      * as to which side should be the main thread.

    55      */

    56     static boolean separateServerThread = true;

    57 

    58     /*

    59      * Where do we find the keystores?

    60      */

    61     static String pathToStores = "../etc";

    62     static String keyStoreFile = "keystore";

    63     static String trustStoreFile = "truststore";

    64     static String passwd = "passphrase";

    65 

    66     /*

    67      * Is the server ready to serve?

    68      */

    69     volatile static boolean serverReady = false;

    70 

    71     /*

    72      * Turn on SSL debugging?

    73      */

    74     static boolean debug = false;

    75 

    76     /*

    77      * If the client or server is doing some kind of object creation

    78      * that the other side depends on, and that thread prematurely

    79      * exits, you may experience a hang.  The test harness will

    80      * terminate all hung threads after its timeout has expired,

    81      * currently 3 minutes by default, but you might try to be

    82      * smart about it....

    83      */

    84 

    85     /*

    86      * Define the server side of the test.

    87      *

    88      * If the server prematurely exits, serverReady will be set to true

    89      * to avoid infinite hangs.

    90      */

    91     void doServerSide() throws Exception {

    92         SSLServerSocketFactory sslssf =

    93             (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();

    94         SSLServerSocket sslServerSocket =

    95             (SSLServerSocket) sslssf.createServerSocket(serverPort);

    96 

    97         SNIMatcher matcher = SNIHostName.createSNIMatcher(

    98                                                 serverAcceptableHostname);

    99         Collection<SNIMatcher> matchers = new ArrayList<>(1);

   100         matchers.add(matcher);

   101         SSLParameters params = sslServerSocket.getSSLParameters();

   102         params.setSNIMatchers(matchers);

   103         sslServerSocket.setSSLParameters(params);

   104 

   105         serverPort = sslServerSocket.getLocalPort();

   106 

   107         /*

   108          * Signal Client, we're ready for his connect.

   109          */

   110         serverReady = true;

   111 

   112         SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();

   113         try {

   114             InputStream sslIS = sslSocket.getInputStream();

   115             OutputStream sslOS = sslSocket.getOutputStream();

   116 

   117             sslIS.read();

   118             sslOS.write(85);

   119             sslOS.flush();

   120 

   121             ExtendedSSLSession session =

   122                     (ExtendedSSLSession)sslSocket.getSession();

   123             checkSNIInSession(session);

   124         } finally {

   125             sslSocket.close();

   126             sslServerSocket.close();

   127         }

   128     }

   129 

   130 

   131     /*

   132      * Define the client side of the test.

   133      *

   134      * If the server prematurely exits, serverReady will be set to true

   135      * to avoid infinite hangs.

   136      */

   137     void doClientSide() throws Exception {

   138 

   139         /*

   140          * Wait for server to get started.

   141          */

   142         while (!serverReady) {

   143             Thread.sleep(50);

   144         }

   145 

   146         SSLSocketFactory sslsf =

   147             (SSLSocketFactory) SSLSocketFactory.getDefault();

   148         SSLSocket sslSocket = (SSLSocket)

   149             sslsf.createSocket("localhost", serverPort);

   150 

   151         SNIHostName serverName = new SNIHostName(clientRequestedHostname);

   152         List<SNIServerName> serverNames = new ArrayList<>(1);

   153         serverNames.add(serverName);

   154         SSLParameters params = sslSocket.getSSLParameters();

   155         params.setServerNames(serverNames);

   156         sslSocket.setSSLParameters(params);

   157 

   158         try {

   159             InputStream sslIS = sslSocket.getInputStream();

   160             OutputStream sslOS = sslSocket.getOutputStream();

   161 

   162             sslOS.write(280);

   163             sslOS.flush();

   164             sslIS.read();

   165 

   166             ExtendedSSLSession session =

   167                     (ExtendedSSLSession)sslSocket.getSession();

   168             checkSNIInSession(session);

   169         } finally {

   170             sslSocket.close();

   171         }

   172     }

   173 

   174     private static String clientRequestedHostname = "www.example.com";

   175     private static String serverAcceptableHostname = "www\\.example\\.com";

   176 

   177     void checkSNIInSession(ExtendedSSLSession session) throws Exception {

   178         List<SNIServerName> sessionSNI = session.getRequestedServerNames();

   179         if (sessionSNI.isEmpty()) {

   180             throw new Exception(

   181                     "unexpected empty request server name indication");

   182         }

   183 

   184         if (sessionSNI.size() != 1) {

   185             throw new Exception(

   186                     "unexpected request server name indication");

   187         }

   188 

   189         SNIServerName serverName = sessionSNI.get(0);

   190         if (!(serverName instanceof SNIHostName)) {

   191             throw new Exception(

   192                     "unexpected instance of request server name indication");

   193         }

   194 

   195         String hostname = ((SNIHostName)serverName).getAsciiName();

   196         if (!clientRequestedHostname.equalsIgnoreCase(hostname)) {

   197             throw new Exception(

   198                     "unexpected request server name indication value");

   199         }

   200     }

   201 

   202     /*

   203      * =============================================================

   204      * The remainder is just support stuff

   205      */

   206 

   207     // use any free port by default

   208     volatile int serverPort = 0;

   209 

   210     volatile Exception serverException = null;

   211     volatile Exception clientException = null;

   212 

   213     public static void main(String[] args) throws Exception {

   214         String keyFilename =

   215             System.getProperty("test.src", ".") + "/" + pathToStores +

   216                 "/" + keyStoreFile;

   217         String trustFilename =

   218             System.getProperty("test.src", ".") + "/" + pathToStores +

   219                 "/" + trustStoreFile;

   220 

   221         System.setProperty("javax.net.ssl.keyStore", keyFilename);

   222         System.setProperty("javax.net.ssl.keyStorePassword", passwd);

   223         System.setProperty("javax.net.ssl.trustStore", trustFilename);

   224         System.setProperty("javax.net.ssl.trustStorePassword", passwd);

   225 

   226         if (debug)

   227             System.setProperty("javax.net.debug", "all");

   228 

   229         /*

   230          * Start the tests.

   231          */

   232         new SSLSocketConsistentSNI();

   233     }

   234 

   235     Thread clientThread = null;

   236     Thread serverThread = null;

   237 

   238     /*

   239      * Primary constructor, used to drive remainder of the test.

   240      *

   241      * Fork off the other side, then do your work.

   242      */

   243     SSLSocketConsistentSNI() throws Exception {

   244         try {

   245             if (separateServerThread) {

   246                 startServer(true);

   247                 startClient(false);

   248             } else {

   249                 startClient(true);

   250                 startServer(false);

   251             }

   252         } catch (Exception e) {

   253             // swallow for now.  Show later

   254         }

   255 

   256         /*

   257          * Wait for other side to close down.

   258          */

   259         if (separateServerThread) {

   260             serverThread.join();

   261         } else {

   262             clientThread.join();

   263         }

   264 

   265         /*

   266          * When we get here, the test is pretty much over.

   267          * Which side threw the error?

   268          */

   269         Exception local;

   270         Exception remote;

   271         String whichRemote;

   272 

   273         if (separateServerThread) {

   274             remote = serverException;

   275             local = clientException;

   276             whichRemote = "server";

   277         } else {

   278             remote = clientException;

   279             local = serverException;

   280             whichRemote = "client";

   281         }

   282 

   283         /*

   284          * If both failed, return the curthread's exception, but also

   285          * print the remote side Exception

   286          */

   287         if ((local != null) && (remote != null)) {

   288             System.out.println(whichRemote + " also threw:");

   289             remote.printStackTrace();

   290             System.out.println();

   291             throw local;

   292         }

   293 

   294         if (remote != null) {

   295             throw remote;

   296         }

   297 

   298         if (local != null) {

   299             throw local;

   300         }

   301     }

   302 

   303     void startServer(boolean newThread) throws Exception {

   304         if (newThread) {

   305             serverThread = new Thread() {

   306                 public void run() {

   307                     try {

   308                         doServerSide();

   309                     } catch (Exception e) {

   310                         /*

   311                          * Our server thread just died.

   312                          *

   313                          * Release the client, if not active already...

   314                          */

   315                         System.err.println("Server died...");

   316                         serverReady = true;

   317                         serverException = e;

   318                     }

   319                 }

   320             };

   321             serverThread.start();

   322         } else {

   323             try {

   324                 doServerSide();

   325             } catch (Exception e) {

   326                 serverException = e;

   327             } finally {

   328                 serverReady = true;

   329             }

   330         }

   331     }

   332 

   333     void startClient(boolean newThread) throws Exception {

   334         if (newThread) {

   335             clientThread = new Thread() {

   336                 public void run() {

   337                     try {

   338                         doClientSide();

   339                     } catch (Exception e) {

   340                         /*

   341                          * Our client thread just died.

   342                          */

   343                         System.err.println("Client died...");

   344                         clientException = e;

   345                     }

   346                 }

   347             };

   348             clientThread.start();

   349         } else {

   350             try {

   351                 doClientSide();

   352             } catch (Exception e) {

   353                 clientException = e;

   354             }

   355         }

   356     }

   357 }