1 /*

     2  * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 import javax.net.ssl.*;

    25 import javax.net.ssl.SSLEngineResult.*;

    26 import java.io.*;

    27 import java.nio.*;

    28 import java.security.KeyStore;

    29 import java.security.PrivateKey;

    30 import java.security.KeyFactory;

    31 import java.security.cert.Certificate;

    32 import java.security.cert.CertificateFactory;

    33 import java.security.spec.*;

    34 import java.util.Base64;

    35 

    36 public abstract class ClientHelloInterOp {

    37 

    38     /*

    39      * Certificates and keys used in the test.

    40      */

    41     // Trusted certificates.

    42     private final static String[] trustedCertStrs = {

    43         // SHA256withECDSA, curve prime256v1

    44         // Validity

    45         //     Not Before: Nov  9 03:24:05 2016 GMT

    46         //     Not After : Oct 20 03:24:05 2037 GMT

    47         "-----BEGIN CERTIFICATE-----\n" +

    48         "MIICHDCCAcGgAwIBAgIJAM83C/MVp9F5MAoGCCqGSM49BAMCMDsxCzAJBgNVBAYT\n" +

    49         "AlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

    50         "ZTAeFw0xNjExMDkwMzI0MDVaFw0zNzEwMjAwMzI0MDVaMDsxCzAJBgNVBAYTAlVT\n" +

    51         "MQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZjZTBZ\n" +

    52         "MBMGByqGSM49AgEGCCqGSM49AwEHA0IABGeQXwyeNyU4UAATfwUbMO5zaREI21Wh\n" +

    53         "bds6WDu+PmfK8SWsTgsgpYxBRui+fZtYqSmbdjkurvAQ3j2fvN++BtWjga0wgaow\n" +

    54         "HQYDVR0OBBYEFDF/OeJ82qBSRkAm1rdZUPbWfDzyMGsGA1UdIwRkMGKAFDF/OeJ8\n" +

    55         "2qBSRkAm1rdZUPbWfDzyoT+kPTA7MQswCQYDVQQGEwJVUzENMAsGA1UEChMESmF2\n" +

    56         "YTEdMBsGA1UECxMUU3VuSlNTRSBUZXN0IFNlcml2Y2WCCQDPNwvzFafReTAPBgNV\n" +

    57         "HRMBAf8EBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNJADBGAiEAlHQY\n" +

    58         "QFPlODOsjLVQYSxgeSUvYzMp0vP8naeVB9bfFG8CIQCFfrKZvhq9z3bOtlYKxs2a\n" +

    59         "EWUjUZ82a1JTqkP+lgHY5A==\n" +

    60         "-----END CERTIFICATE-----",

    61 

    62         // SHA256withRSA, 2048 bits

    63         // Validity

    64         //     Not Before: Nov  9 03:24:16 2016 GMT

    65         //     Not After : Oct 20 03:24:16 2037 GMT

    66         "-----BEGIN CERTIFICATE-----\n" +

    67         "MIIDpzCCAo+gAwIBAgIJAJAYpR2aIlA1MA0GCSqGSIb3DQEBCwUAMDsxCzAJBgNV\n" +

    68         "BAYTAlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2Vy\n" +

    69         "aXZjZTAeFw0xNjExMDkwMzI0MTZaFw0zNzEwMjAwMzI0MTZaMDsxCzAJBgNVBAYT\n" +

    70         "AlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

    71         "ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+F/FTPODYzsU0Pakfp\n" +

    72         "lsh88YoQWZPjABhCU+HPsCTMYc8UBkaiduUzregwwVBW3D7kmec2K408krGQsxdy\n" +

    73         "oKJA12GL/XX1YgzDEsyBRk/gvex5lPaBIZiJ5IZlUfjLuRDGxPjtRelBTpZ7SUet\n" +

    74         "PJVZz6zV6hMPGO6kQzCtbzzET515EE0okIS40LkAmtWoOmVm3gRldomaZTrZ0V2L\n" +

    75         "MMaJGzrXYqk0SX+PYul8v+2EEHeMuaXG/XpK5xsg9gZvzpKqFQcBOdENoJHB07go\n" +

    76         "jCmRC328ALqr+bMyktKAuYfB+mhjmN2AU8TQx72WPpvNTXxFDYcwo+8254cCAVKB\n" +

    77         "e98CAwEAAaOBrTCBqjAdBgNVHQ4EFgQUlJQlQTbi8YIyiNf+SqF7LtH+gicwawYD\n" +

    78         "VR0jBGQwYoAUlJQlQTbi8YIyiNf+SqF7LtH+giehP6Q9MDsxCzAJBgNVBAYTAlVT\n" +

    79         "MQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZjZYIJ\n" +

    80         "AJAYpR2aIlA1MA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3\n" +

    81         "DQEBCwUAA4IBAQAI0lTY0YAKQ2VdoIQ6dnqolphLVWdNGiC9drHEYSn7+hmAD2r2\n" +

    82         "v1U/9m752TkcT74a65xKbEVuVtleD/w6i+QjALW2PYt6ivjOnnY0a9Y9a9UCa00j\n" +

    83         "C9415sCw84Tp9VoKtuYqzhN87bBUeABOw5dsW3z32C2N/YhprkqeF/vdx4JxulPr\n" +

    84         "PKze5BREXnKLA1ISoDioCPphvNMKrSpkAofb1rTCwtgt5V/WFls283L52ORmpRGO\n" +

    85         "Ja88ztXOz00ZGu0RQLwlmpN7m8tNgA/5MPrldyYIwegP4RSkkJlF/8+hxvvqfJhK\n" +

    86         "FFDa0HHQSJfR2b9628Iniw1UHOMMT6qx5EHr\n" +

    87         "-----END CERTIFICATE-----"

    88         };

    89 

    90     // End entity certificate.

    91     private final static String[] endEntityCertStrs = {

    92         // SHA256withECDSA, curve prime256v1

    93         // Validity

    94         //     Not Before: Nov  9 03:24:05 2016 GMT

    95         //     Not After : Jul 27 03:24:05 2036 GMT

    96         "-----BEGIN CERTIFICATE-----\n" +

    97         "MIIB1DCCAXmgAwIBAgIJAKVa+4dIUjaLMAoGCCqGSM49BAMCMDsxCzAJBgNVBAYT\n" +

    98         "AlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

    99         "ZTAeFw0xNjExMDkwMzI0MDVaFw0zNjA3MjcwMzI0MDVaMFIxCzAJBgNVBAYTAlVT\n" +

   100         "MQ0wCwYDVQQKDARKYXZhMR0wGwYDVQQLDBRTdW5KU1NFIFRlc3QgU2VyaXZjZTEV\n" +

   101         "MBMGA1UEAwwMSW50ZXJPcCBUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n" +

   102         "h4vXNUJzULq4e7fAOvF0WiWU6cllOAMus1GqTFvcnRPOChl8suZsvksO0CpZqL3h\n" +

   103         "jXmVX9dp1FV/rUBGLo1aG6NPME0wCwYDVR0PBAQDAgPoMB0GA1UdDgQWBBSO8V5+\n" +

   104         "bj0ik0T9BtJc4jLJt7m6wjAfBgNVHSMEGDAWgBQxfznifNqgUkZAJta3WVD21nw8\n" +

   105         "8jAKBggqhkjOPQQDAgNJADBGAiEAk7MF+L9bFRwUsbPsBCbCqH9DMdzBQR+kFDNf\n" +

   106         "lfn8Rs4CIQD9qWvBXd+EJqwraxiX6cftaFchn+T2HpvMboy+irMFow==\n" +

   107         "-----END CERTIFICATE-----",

   108 

   109         // SHA256withRSA, 2048 bits

   110         // Validity

   111         //     Not Before: Nov  9 03:24:16 2016 GMT

   112         //     Not After : Jul 27 03:24:16 2036 GMT

   113         "-----BEGIN CERTIFICATE-----\n" +

   114         "MIIDczCCAlugAwIBAgIJAPhM2oUKx0aJMA0GCSqGSIb3DQEBCwUAMDsxCzAJBgNV\n" +

   115         "BAYTAlVTMQ0wCwYDVQQKEwRKYXZhMR0wGwYDVQQLExRTdW5KU1NFIFRlc3QgU2Vy\n" +

   116         "aXZjZTAeFw0xNjExMDkwMzI0MTZaFw0zNjA3MjcwMzI0MTZaMFIxCzAJBgNVBAYT\n" +

   117         "AlVTMQ0wCwYDVQQKDARKYXZhMR0wGwYDVQQLDBRTdW5KU1NFIFRlc3QgU2VyaXZj\n" +

   118         "ZTEVMBMGA1UEAwwMSW50ZXJPcCBUZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\n" +

   119         "MIIBCgKCAQEA36tJaXfJ2B/AFvES+tnueyQPSNABVu9nfMdU+NEPamJ+FH7cEF8Z\n" +

   120         "1Spr1vlQgNzCpDUVrfnmT75rCapgz5ldA9+y+3hdfUyHjZBzzfx+6GHXLB4u6eU2\n" +

   121         "NATa7vqSLNbcLcfZ7/QmkFqg4JRJbX4F42kKkRJrWdKZ8UoCYC8WXWvDaZ3nUs05\n" +

   122         "XHe+mBJ8qMNPTbYST1jpzXPyH5CljlFGYi2mKJDTImDhwht7mu2+zvwvbJ81Gj2X\n" +

   123         "JUSTSf9fu0zxFcCk6RmJPw9nSVqePVlOwtNNBodfKN+k4yr+gOz1v8NmMtmEtklV\n" +

   124         "Sulr/J4QxI+E2Zar/C+4XjxkvstIS+PNKQIDAQABo2MwYTALBgNVHQ8EBAMCA+gw\n" +

   125         "HQYDVR0OBBYEFHt19CItAz0VOF0WKGWwaT4DtEsSMB8GA1UdIwQYMBaAFJSUJUE2\n" +

   126         "4vGCMojX/kqhey7R/oInMBIGA1UdEQEB/wQIMAaHBH8AAAEwDQYJKoZIhvcNAQEL\n" +

   127         "BQADggEBACKYZWvo9B9IEpCCdBba2sNo4X1NI/VEY3fyUx1lkw+Kna+1d2Ab+RCZ\n" +

   128         "cf3Y85fcwv03hNE///wNBp+Nde4NQRDK/oiQARzWwWslfinm5d83eQwzC3cpSzt+\n" +

   129         "7ts6M5UlOblGsLXZI7THWO1tkgoEra9p+zezxLMmf/2MpNyZMZlVoJPM2YGxU9cN\n" +

   130         "ws0AyeY1gpBEdT21vjsBPdxxj6qklXVMnzS3zF8YwXyOndDYQWdjmFEknRK/qmQ2\n" +

   131         "gkLHrzpSpyCziecna5mGuDRdCU2dpsWiq1npEPXTq+PQGwWYcoaFTtXF8DDqhfPC\n" +

   132         "4Abe8gPm6MfzerdmS3RFTj9b/DIIENM=\n" +

   133         "-----END CERTIFICATE-----"

   134         };

   135 

   136     // Private key in the format of PKCS#8.

   137     private final static String[] endEntityPrivateKeys = {

   138         //

   139         // EC private key related to cert endEntityCertStrs[0].

   140         //

   141         "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgA3pmS+OrIjGyUv2F\n" +

   142         "K/PkyayJIePM2RTFYxNoQqmJGnihRANCAASHi9c1QnNQurh7t8A68XRaJZTpyWU4\n" +

   143         "Ay6zUapMW9ydE84KGXyy5my+Sw7QKlmoveGNeZVf12nUVX+tQEYujVob",

   144 

   145         //

   146         // RSA private key related to cert endEntityCertStrs[1].

   147         //

   148         "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDfq0lpd8nYH8AW\n" +

   149         "8RL62e57JA9I0AFW72d8x1T40Q9qYn4UftwQXxnVKmvW+VCA3MKkNRWt+eZPvmsJ\n" +

   150         "qmDPmV0D37L7eF19TIeNkHPN/H7oYdcsHi7p5TY0BNru+pIs1twtx9nv9CaQWqDg\n" +

   151         "lEltfgXjaQqREmtZ0pnxSgJgLxZda8NpnedSzTlcd76YEnyow09NthJPWOnNc/If\n" +

   152         "kKWOUUZiLaYokNMiYOHCG3ua7b7O/C9snzUaPZclRJNJ/1+7TPEVwKTpGYk/D2dJ\n" +

   153         "Wp49WU7C000Gh18o36TjKv6A7PW/w2Yy2YS2SVVK6Wv8nhDEj4TZlqv8L7hePGS+\n" +

   154         "y0hL480pAgMBAAECggEBAJyP1zk+IkloIBtu7+wrdCU6HoDHKMjjlzrehHoOTI4Z\n" +

   155         "F0vdaMkE6J4vrYCyz0kEPjKW/e/jxvT2wxHm8xEdtuApS61+mWJFmXTcMlNzdJnR\n" +

   156         "Mr6s+gW67fAHngA94OgGFeTtyX2PFxdgeM/6vFMqLZD7S+w0SnR7WEpvla4iB7On\n" +

   157         "lXqhJKVQeVc+IpByg/S4MmJb91jck73GltCaCL/b6BTrsz+zc/AY5tb8JInxjMZ9\n" +

   158         "jmjmA+s6l7tnBrFQfJHlF9a374lxCOtZTxyxVJjD7tQcGpsUpSHXZGdpDcT34qYT\n" +

   159         "UGh0yp2Mc/1PfWni5gS/6UGLrYmT57RRCn5YJBJTEkkCgYEA/XPCNehFaOMSxOZh\n" +

   160         "OGBVhQ+eRAmdpJfMhSUsDdEdQLZyWGmZsMTHjZZrwevBX/D0dxQYDv/sAl0GZomJ\n" +

   161         "d6iRCHlscycwx5Q0U/EpacsgRlYHz1nMRzXqS3Ry+8O8qQlliqCLUM7SfVgzdI5/\n" +

   162         "ll9JMrng9NnRl8ccjEdOGK8g/MMCgYEA4eriKMfRslGY4uOQoTPbuEJSMMwQ2X4k\n" +

   163         "lPj1p+xSQfU9QBaWJake67oBj3vpCxqN7/VkvCIeC6LCjhLpWHCn4EkdGiqkEdWz\n" +

   164         "m5CHzpzVIgznzWnbt0rCVL2KdL+ihgY8KPDdsZ6tZrABHuYhsWkAu10wyvuQYM88\n" +

   165         "3u6yOIQn36MCgYEAk5qR1UEzAxWTPbaJkgKQa5Cf9DHBbDS3eCcg098f8SsPxquh\n" +

   166         "RRAkwzGCCgqZsJ0sUhkStdGXifzRGHAq7dPuuwe0ABAn2WNXYjeFjcYtQqkhnUFH\n" +

   167         "tYURsOXdfQAOZEdDqos691GrxjHSraO7bECL6Y3VE+Oyq3jbCFsSgU+kn28CgYBT\n" +

   168         "mrXZO6FJqVK33FlAns1YEgsSjeJKapklHEDkxNroF9Zz6ifkhgKwX6SGMefbORd/\n" +

   169         "zsNZsBKIYdI3+52pIf+uS8BeV5tiEkCmeEUZ3AYv1LDP3rX1zc++xmn/rI97o8EN\n" +

   170         "sZ2JRtyK3OV9RtL/MYmYzPLqm1Ah02+GXLVNnvKWmwKBgE8Ble8CzrXYuuPdGxXz\n" +

   171         "BZU6HnXQrmTUcgeze0tj8SDHzCfsGsaG6pHrVNkT7CKsRuCHTZLM0kXmUijLFKuP\n" +

   172         "5xyE257z4IbbEbs+tcbB3p28n4/47MzZkSR3kt8+FrsEMZq5oOHbFTGzgp9dhZCC\n" +

   173         "dKUqlw5BPHdbxoWB/JpSHGCV"

   174         };

   175 

   176     // Private key names of endEntityPrivateKeys.

   177     private final static String[] endEntityPrivateKeyNames = {

   178         "EC",

   179         "RSA"

   180         };

   181 

   182     /*

   183      * Run the test case.

   184      */

   185     public void run() throws Exception {

   186         SSLEngine serverEngine = createServerEngine();

   187 

   188         //

   189         // Create and size the buffers appropriately.

   190         //

   191         SSLSession session = serverEngine.getSession();

   192         ByteBuffer serverAppInbound =

   193             ByteBuffer.allocate(session.getApplicationBufferSize());

   194         ByteBuffer clientHello =

   195             ByteBuffer.allocate(session.getPacketBufferSize());

   196 

   197         //

   198         // Generate a ClientHello message, and check if the server

   199         // engine can read it or not.

   200         //

   201         clientHello.put(createClientHelloMessage());

   202         clientHello.flip();

   203 

   204         SSLEngineResult serverResult =

   205                 serverEngine.unwrap(clientHello, serverAppInbound);

   206         log("Server unwrap: ", serverResult);

   207         runDelegatedTasks(serverResult, serverEngine);

   208 

   209         //

   210         // Generate server responses to the ClientHello request.

   211         //

   212         ByteBuffer clientNetInbound =

   213             ByteBuffer.allocate(session.getPacketBufferSize());

   214         ByteBuffer clientAppInbound =

   215             ByteBuffer.wrap("Hello Client, I'm Server".getBytes());

   216 

   217         serverResult = serverEngine.wrap(clientAppInbound, clientNetInbound);

   218         log("Server wrap: ", serverResult);

   219         runDelegatedTasks(serverResult, serverEngine);

   220     }

   221 

   222     /*

   223      * Create a ClientHello message.

   224      */

   225     abstract protected byte[] createClientHelloMessage();

   226 

   227     /*

   228      * Create an instance of SSLContext for client use.

   229      */

   230     protected SSLContext createClientSSLContext() throws Exception {

   231         return createSSLContext(trustedCertStrs, null, null, null);

   232     }

   233 

   234     /*

   235      * Create an instance of SSLContext for server use.

   236      */

   237     protected SSLContext createServerSSLContext() throws Exception {

   238         return createSSLContext(null,

   239                 endEntityCertStrs, endEntityPrivateKeys,

   240                 endEntityPrivateKeyNames);

   241     }

   242 

   243     /*

   244      * Create an instance of SSLContext with the specified trust/key materials.

   245      */

   246     protected SSLContext createSSLContext(

   247             String[] trustedMaterials,

   248             String[] keyMaterialCerts,

   249             String[] keyMaterialKeys,

   250             String[] keyMaterialKeyAlgs) throws Exception {

   251 

   252         KeyStore ts = null;     // trust store

   253         KeyStore ks = null;     // key store

   254         char passphrase[] = "passphrase".toCharArray();

   255 

   256         // Generate certificate from cert string.

   257         CertificateFactory cf = CertificateFactory.getInstance("X.509");

   258 

   259         // Import the trused certs.

   260         ByteArrayInputStream is;

   261         if (trustedMaterials != null && trustedMaterials.length != 0) {

   262             ts = KeyStore.getInstance("JKS");

   263             ts.load(null, null);

   264 

   265             Certificate[] trustedCert =

   266                     new Certificate[trustedMaterials.length];

   267             for (int i = 0; i < trustedMaterials.length; i++) {

   268                 String trustedCertStr = trustedMaterials[i];

   269 

   270                 is = new ByteArrayInputStream(trustedCertStr.getBytes());

   271                 try {

   272                     trustedCert[i] = cf.generateCertificate(is);

   273                 } finally {

   274                     is.close();

   275                 }

   276 

   277                 ts.setCertificateEntry("trusted-cert-" + i, trustedCert[i]);

   278             }

   279         }

   280 

   281         // Import the key materials.

   282         //

   283         // Note that certification pathes bigger than one are not supported yet.

   284         boolean hasKeyMaterials =

   285             (keyMaterialCerts != null) && (keyMaterialCerts.length != 0) &&

   286             (keyMaterialKeys != null) && (keyMaterialKeys.length != 0) &&

   287             (keyMaterialKeyAlgs != null) && (keyMaterialKeyAlgs.length != 0) &&

   288             (keyMaterialCerts.length == keyMaterialKeys.length) &&

   289             (keyMaterialCerts.length == keyMaterialKeyAlgs.length);

   290         if (hasKeyMaterials) {

   291             ks = KeyStore.getInstance("JKS");

   292             ks.load(null, null);

   293 

   294             for (int i = 0; i < keyMaterialCerts.length; i++) {

   295                 String keyCertStr = keyMaterialCerts[i];

   296 

   297                 // generate the private key.

   298                 PKCS8EncodedKeySpec priKeySpec = new PKCS8EncodedKeySpec(

   299                     Base64.getMimeDecoder().decode(keyMaterialKeys[i]));

   300                 KeyFactory kf =

   301                     KeyFactory.getInstance(keyMaterialKeyAlgs[i]);

   302                 PrivateKey priKey = kf.generatePrivate(priKeySpec);

   303 

   304                 // generate certificate chain

   305                 is = new ByteArrayInputStream(keyCertStr.getBytes());

   306                 Certificate keyCert = null;

   307                 try {

   308                     keyCert = cf.generateCertificate(is);

   309                 } finally {

   310                     is.close();

   311                 }

   312 

   313                 Certificate[] chain = new Certificate[] { keyCert };

   314 

   315                 // import the key entry.

   316                 ks.setKeyEntry("cert-" + i, priKey, passphrase, chain);

   317             }

   318         }

   319 

   320         // Create an SSLContext object.

   321         TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");

   322         tmf.init(ts);

   323 

   324         SSLContext context = SSLContext.getInstance("TLS");

   325         if (hasKeyMaterials && ks != null) {

   326             KeyManagerFactory kmf = KeyManagerFactory.getInstance("NewSunX509");

   327             kmf.init(ks, passphrase);

   328 

   329             context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

   330         } else {

   331             context.init(null, tmf.getTrustManagers(), null);

   332         }

   333 

   334         return context;

   335     }

   336 

   337     /*

   338      * Create an instance of SSLEngine in client mode.

   339      */

   340     protected SSLEngine createClientEngine() throws Exception {

   341         return createClientEngine(createClientSSLContext());

   342     }

   343 

   344     /*

   345      * Create an instance of SSLEngine in client mode with the

   346      * specified SSLContext object.

   347      */

   348     protected SSLEngine createClientEngine(

   349         SSLContext context) throws Exception {

   350 

   351         SSLEngine engine = context.createSSLEngine();

   352         engine.setUseClientMode(true);

   353 

   354         /*

   355          * Customize the SSLEngine object.

   356          */

   357         // blank

   358 

   359         return engine;

   360     }

   361 

   362     /*

   363      * Create an instance of SSLEngine in server mode.

   364      */

   365     protected SSLEngine createServerEngine() throws Exception {

   366         return createServerEngine(createServerSSLContext());

   367     }

   368 

   369     /*

   370      * Create an instance of SSLEngine in server mode with the

   371      * specified SSLContext object.

   372      */

   373     protected SSLEngine createServerEngine(

   374         SSLContext context) throws Exception {

   375 

   376         SSLEngine engine = context.createSSLEngine();

   377         engine.setUseClientMode(false);

   378 

   379         /*

   380          * Customize the SSLEngine object.

   381          */

   382         engine.setNeedClientAuth(false);

   383 

   384         return engine;

   385     }

   386 

   387     /*

   388      * Run the delagayed tasks if any.

   389      *

   390      * If the result indicates that we have outstanding tasks to do,

   391      * go ahead and run them in this thread.

   392      */

   393     protected static void runDelegatedTasks(SSLEngineResult result,

   394             SSLEngine engine) throws Exception {

   395 

   396         if (result.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {

   397             Runnable runnable;

   398             while ((runnable = engine.getDelegatedTask()) != null) {

   399                 log("\trunning delegated task...");

   400                 runnable.run();

   401             }

   402             HandshakeStatus hsStatus = engine.getHandshakeStatus();

   403             if (hsStatus == HandshakeStatus.NEED_TASK) {

   404                 throw new Exception(

   405                     "handshake shouldn't need additional tasks");

   406             }

   407             log("\tnew HandshakeStatus: " + hsStatus);

   408         }

   409     }

   410 

   411     /*

   412      * Logging the specificated message and the SSLEngine operation result.

   413      */

   414     protected static void log(String str, SSLEngineResult result) {

   415         HandshakeStatus hsStatus = result.getHandshakeStatus();

   416         log(str +

   417             result.getStatus() + "/" + hsStatus + ", consumed: " +

   418             result.bytesConsumed() + "/produced: " + result.bytesProduced() +

   419             " bytes");

   420 

   421         if (hsStatus == HandshakeStatus.FINISHED) {

   422             log("\t...ready for application data");

   423         }

   424     }

   425 

   426     /*

   427      * Logging the specificated message.

   428      */

   429     protected static void log(String str) {

   430         System.out.println(str);

   431     }

   432 }