1 /*

     2  * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 8226374

    27  * @library /javax/net/ssl/templates

    28  * @summary Restrict signature algorithms and named groups

    29  * @run main/othervm RestrictNamedGroup x25519

    30  * @run main/othervm RestrictNamedGroup x448

    31  * @run main/othervm RestrictNamedGroup secp256r1

    32  * @run main/othervm RestrictNamedGroup secp384r1

    33  * @run main/othervm RestrictNamedGroup secp521r1

    34  * @run main/othervm RestrictNamedGroup ffdhe2048

    35  * @run main/othervm RestrictNamedGroup ffdhe3072

    36  * @run main/othervm RestrictNamedGroup ffdhe4096

    37  * @run main/othervm RestrictNamedGroup ffdhe6144

    38  * @run main/othervm RestrictNamedGroup ffdhe8192

    39  */

    40 

    41 import java.security.Security;

    42 import java.util.Arrays;

    43 import javax.net.ssl.SSLSocket;

    44 import javax.net.ssl.SSLServerSocket;

    45 import javax.net.ssl.SSLException;

    46 

    47 public class RestrictNamedGroup extends SSLSocketTemplate {

    48 

    49     private static volatile int index;

    50     private static final String[][][] protocols = {

    51         {{"TLSv1.3"}, {"TLSv1.3"}},

    52         {{"TLSv1.3", "TLSv1.2"}, {"TLSv1.2"}},

    53         {{"TLSv1.3", "TLSv1.2"}, {"TLSv1.2"}},

    54         {{"TLSv1.2"}, {"TLSv1.3", "TLSv1.2"}},

    55         {{"TLSv1.2"}, {"TLSv1.2"}}

    56     };

    57 

    58     // Servers are configured before clients, increment test case after.

    59     @Override

    60     protected void configureClientSocket(SSLSocket socket) {

    61         String[] ps = protocols[index][0];

    62 

    63         System.out.print("Setting client protocol(s): ");

    64         Arrays.stream(ps).forEachOrdered(System.out::print);

    65         System.out.println();

    66 

    67         socket.setEnabledProtocols(ps);

    68         socket.setEnabledCipherSuites(new String[] {

    69             "TLS_AES_128_GCM_SHA256",

    70             "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"});

    71     }

    72 

    73     @Override

    74     protected void configureServerSocket(SSLServerSocket serverSocket) {

    75         String[] ps = protocols[index][1];

    76 

    77         System.out.print("Setting server protocol(s): ");

    78         Arrays.stream(ps).forEachOrdered(System.out::print);

    79         System.out.println();

    80 

    81         serverSocket.setEnabledProtocols(ps);

    82         serverSocket.setEnabledCipherSuites(new String[] {

    83             "TLS_AES_128_GCM_SHA256",

    84             "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"});

    85     }

    86 

    87     /*

    88      * Run the test case.

    89      */

    90     public static void main(String[] args) throws Exception {

    91         Security.setProperty("jdk.tls.disabledAlgorithms", args[0]);

    92         System.setProperty("jdk.tls.namedGroups", args[0]);

    93 

    94         for (index = 0; index < protocols.length; index++) {

    95             try {

    96                 (new RestrictNamedGroup()).run();

    97             } catch (SSLException | IllegalStateException ssle) {

    98                 // The named group should be restricted.

    99                 continue;

   100             }

   101 

   102             throw new Exception("The test case should be disabled");

   103         }

   104     }

   105 }