jdk-sandbox: comparison test/jdk/javax/net/ssl/Stapling/SSLEngineWithStapling.java

equal deleted inserted replaced

-:356eaea05bf0
+:68fa3d4026ea
 /*
-* Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
+* Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.
 *
 * This gives a lot of low-level information about operations underway,
 * including specific handshake messages, and might be best examined
 * after gaining some familiarity with this application.
 */
-private static final boolean debug = false;
+private static final boolean debug = true;
 private SSLEngine clientEngine;     // client Engine
 private ByteBuffer clientOut;       // write side of clientEngine
 private ByteBuffer clientIn;        // read side of clientEngine
 static SimpleOCSPServer rootOcsp;       // Root CA OCSP Responder
 static int rootOcspPort;                // Port number for root OCSP
 static SimpleOCSPServer intOcsp;        // Intermediate CA OCSP Responder
 static int intOcspPort;                 // Port number for intermed. OCSP
+// Extra configuration parameters and constants
+static final String[] TLS13ONLY = new String[] { "TLSv1.3" };
+static final String[] TLS12MAX =
+new String[] { "TLSv1.2", "TLSv1.1", "TLSv1" };
 /*
 * Main entry point for this test.
 */
 public static void main(String args[]) throws Exception {
 if (debug) {
-System.setProperty("javax.net.debug", "ssl");
+System.setProperty("javax.net.debug", "ssl:handshake");
 }
 // Create the PKI we will use for the test and start the OCSP servers
 createPKI();
 SimpleOCSPServer.CertStatus.CERT_STATUS_REVOKED,
 new Date(System.currentTimeMillis() -
 TimeUnit.HOURS.toMillis(8))));
 intOcsp.updateStatusDb(revInfo);
-SSLEngineWithStapling test = new SSLEngineWithStapling();
+// Create a list of TLS protocol configurations we can use to
-try {
+// drive tests with different handshaking models.
-test.runTest();
+List<String[]> allowedProtList = List.of(TLS12MAX, TLS13ONLY);
-throw new RuntimeException("Expected failure due to revocation " +
-"did not occur");
+for (String[] protocols : allowedProtList) {
-} catch (Exception e) {
+SSLEngineWithStapling test = new SSLEngineWithStapling();
-if (!checkClientValidationFailure(e,
+try {
-CertPathValidatorException.BasicReason.REVOKED)) {
+test.runTest(protocols);
-System.out.println("*** Didn't find the exception we wanted");
+throw new RuntimeException("Expected failure due to " +
-throw e;
+"revocation did not occur");
+} catch (Exception e) {
+if (!checkClientValidationFailure(e,
+CertPathValidatorException.BasicReason.REVOKED)) {
+System.out.println(
+"*** Didn't find the exception we wanted");
+throw e;
+}
 }
 }
 System.out.println("Test Passed.");
 }
 *     engine closing
 *
 * One could easily separate these phases into separate
 * sections of code.
 */
-private void runTest() throws Exception {
+private void runTest(String[] protocols) throws Exception {
 boolean dataDone = false;
-createSSLEngines();
+createSSLEngines(protocols);
 createBuffers();
 SSLEngineResult clientResult;   // results from client's last operation
 SSLEngineResult serverResult;   // results from server's last operation
 /*
 * Using the SSLContext created during object creation,
 * create/configure the SSLEngines we'll use for this test.
 */
-private void createSSLEngines() throws Exception {
+private void createSSLEngines(String[] protocols) throws Exception {
 // Initialize the KeyManager and TrustManager for the server
 KeyManagerFactory servKmf = KeyManagerFactory.getInstance("PKIX");
 servKmf.init(serverKeystore, passwd.toCharArray());
 TrustManagerFactory servTmf =
 TrustManagerFactory.getInstance("PKIX");
 /*
 * Configure the serverEngine to act as a server in the SSL/TLS
 * handshake.
 */
 serverEngine = servCtx.createSSLEngine();
+serverEngine.setEnabledProtocols(protocols);
 serverEngine.setUseClientMode(false);
 serverEngine.setNeedClientAuth(false);
 /*
 * Similar to above, but using client mode instead.
 */
 clientEngine = cliCtx.createSSLEngine("client", 80);
+clientEngine.setEnabledProtocols(protocols);
 clientEngine.setUseClientMode(true);
 }
 /*
 * Create and size the buffers appropriately.
 }
 /**
 * Checks a validation failure to see if it failed for the reason we think
 * it should.  This comes in as an SSLException of some sort, but it
-* encapsulates a ValidatorException which in turn encapsulates the
+* encapsulates a CertPathValidatorException at some point in the
-* CertPathValidatorException we are interested in.
+* exception stack.
 *
 * @param e the exception thrown at the top level
 * @param reason the underlying CertPathValidatorException BasicReason
 * we are expecting it to have.
 *
 */
 static boolean checkClientValidationFailure(Exception e,
 CertPathValidatorException.BasicReason reason) {
 boolean result = false;
-if (e instanceof SSLException) {
+// Locate the CertPathValidatorException.  If one
-Throwable sslhe = e.getCause();
+// Does not exist, then it's an automatic failure of
-if (sslhe instanceof SSLHandshakeException) {
+// the test.
-Throwable valExc = sslhe.getCause();
+Throwable curExc = e;
-if (valExc instanceof sun.security.validator.ValidatorException) {
+CertPathValidatorException cpve = null;
-Throwable cause = valExc.getCause();
+while (curExc != null) {
-if (cause instanceof CertPathValidatorException) {
+if (curExc instanceof CertPathValidatorException) {
-CertPathValidatorException cpve =
+cpve = (CertPathValidatorException)curExc;
-(CertPathValidatorException)cause;
-if (cpve.getReason() == reason) {
-result = true;
-}
-}
-}
 }
-}
+curExc = curExc.getCause();
+}
+// If we get through the loop and cpve is null then we
+// we didn't find CPVE and this is a failure
+if (cpve != null) {
+if (cpve.getReason() == reason) {
+result = true;
+} else {
+System.out.println("CPVE Reason Mismatch: Expected = " +
+reason + ", Actual = " + cpve.getReason());
+}
+} else {
+System.out.println("Failed to find an expected CPVE");
+}
 return result;
 }
 }

changeset 50768	68fa3d4026ea
parent 47216	71c04702a3d5