1 /*

     2  * Copyright (c) 2001, 2011, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 // SunJSSE does not support dynamic system properties, no way to re-use

    25 // system properties in samevm/agentvm mode.

    26 

    27 /*

    28  * @test

    29  * @bug 4329114

    30  * @summary Need better way of reflecting the reason when a chain is

    31  *      rejected as untrusted.

    32  * @modules java.base/com.sun.net.ssl

    33  * @ignore JSSE supports algorithm constraints with CR 6916074,

    34  *      need to update this test case in JDK 7 soon

    35  * @run main/othervm CheckMyTrustedKeystore

    36  *

    37  * @author Brad Wetmore

    38  */

    39 

    40 // This is a serious hack job!

    41 

    42 import java.io.*;

    43 import java.net.*;

    44 import java.security.*;

    45 import javax.net.ssl.*;

    46 import java.security.cert.*;

    47 

    48 public class CheckMyTrustedKeystore {

    49 

    50     /*

    51      * =============================================================

    52      * Set the various variables needed for the tests, then

    53      * specify what tests to run on each side.

    54      */

    55 

    56     /*

    57      * Should we run the client or server in a separate thread?

    58      * Both sides can throw exceptions, but do you have a preference

    59      * as to which side should be the main thread.

    60      */

    61     static boolean separateServerThread = true;

    62 

    63     /*

    64      * Where do we find the keystores?

    65      */

    66     final static String pathToStores = "../etc";

    67     final static String keyStoreFile = "keystore";

    68     final static String trustStoreFile = "truststore";

    69     final static String unknownStoreFile = "unknown_keystore";

    70     final static String passwd = "passphrase";

    71     final static char[] cpasswd = "passphrase".toCharArray();

    72 

    73     /*

    74      * Is the server ready to serve?

    75      */

    76     volatile static boolean serverReady = false;

    77 

    78     /*

    79      * Turn on SSL debugging?

    80      */

    81     final static boolean debug = false;

    82 

    83     /*

    84      * If the client or server is doing some kind of object creation

    85      * that the other side depends on, and that thread prematurely

    86      * exits, you may experience a hang.  The test harness will

    87      * terminate all hung threads after its timeout has expired,

    88      * currently 3 minutes by default, but you might try to be

    89      * smart about it....

    90      */

    91 

    92     /*

    93      * Define the server side of the test.

    94      *

    95      * If the server prematurely exits, serverReady will be set to true

    96      * to avoid infinite hangs.

    97      */

    98     void doServerSide() throws Exception {

    99         KeyStore ks = KeyStore.getInstance("JKS");

   100         com.sun.net.ssl.SSLContext ctx =

   101             com.sun.net.ssl.SSLContext.getInstance("TLS");

   102         com.sun.net.ssl.KeyManagerFactory kmf =

   103             com.sun.net.ssl.KeyManagerFactory.getInstance("SunX509");

   104 

   105         ks.load(new FileInputStream(keyFilename), cpasswd);

   106         kmf.init(ks, cpasswd);

   107 

   108         com.sun.net.ssl.TrustManager [] tms =

   109             new com.sun.net.ssl.TrustManager []

   110             { new MyComX509TrustManager() };

   111 

   112         ctx.init(kmf.getKeyManagers(), tms, null);

   113 

   114         SSLServerSocketFactory sslssf =

   115             (SSLServerSocketFactory) ctx.getServerSocketFactory();

   116 

   117         SSLServerSocket sslServerSocket =

   118             (SSLServerSocket) sslssf.createServerSocket(serverPort);

   119         serverPort = sslServerSocket.getLocalPort();

   120 

   121         sslServerSocket.setNeedClientAuth(true);

   122 

   123         /*

   124          * Create using the other type.

   125          */

   126         SSLContext ctx1 =

   127             SSLContext.getInstance("TLS");

   128         KeyManagerFactory kmf1 =

   129             KeyManagerFactory.getInstance("SunX509");

   130 

   131         TrustManager [] tms1 =

   132             new TrustManager []

   133             { new MyJavaxX509TrustManager() };

   134 

   135         kmf1.init(ks, cpasswd);

   136 

   137         ctx1.init(kmf1.getKeyManagers(), tms1, null);

   138 

   139         sslssf = (SSLServerSocketFactory) ctx1.getServerSocketFactory();

   140 

   141         SSLServerSocket sslServerSocket1 =

   142             (SSLServerSocket) sslssf.createServerSocket(serverPort1);

   143         serverPort1 = sslServerSocket1.getLocalPort();

   144         sslServerSocket1.setNeedClientAuth(true);

   145 

   146         /*

   147          * Signal Client, we're ready for his connect.

   148          */

   149         serverReady = true;

   150 

   151         SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();

   152         sslServerSocket.close();

   153         serverReady = false;

   154 

   155         InputStream sslIS = sslSocket.getInputStream();

   156         OutputStream sslOS = sslSocket.getOutputStream();

   157 

   158         sslIS.read();

   159         sslOS.write(85);

   160         sslOS.flush();

   161         sslSocket.close();

   162 

   163         sslSocket = (SSLSocket) sslServerSocket1.accept();

   164         sslIS = sslSocket.getInputStream();

   165         sslOS = sslSocket.getOutputStream();

   166 

   167         sslIS.read();

   168         sslOS.write(85);

   169         sslOS.flush();

   170         sslSocket.close();

   171 

   172         System.out.println("Server exiting!");

   173         System.out.flush();

   174     }

   175 

   176     void doTest(SSLSocket sslSocket) throws Exception {

   177         InputStream sslIS = sslSocket.getInputStream();

   178         OutputStream sslOS = sslSocket.getOutputStream();

   179 

   180         System.out.println("  Writing");

   181         sslOS.write(280);

   182         sslOS.flush();

   183         System.out.println("  Reading");

   184         sslIS.read();

   185 

   186         sslSocket.close();

   187     }

   188 

   189     /*

   190      * Define the client side of the test.

   191      *

   192      * If the server prematurely exits, serverReady will be set to true

   193      * to avoid infinite hangs.

   194      */

   195     void doClientSide() throws Exception {

   196 

   197         /*

   198          * Wait for server to get started.

   199          */

   200         while (!serverReady) {

   201             Thread.sleep(50);

   202         }

   203 

   204         /*

   205          * See if an unknown keystore actually gets checked ok.

   206          */

   207         System.out.println("==============");

   208         System.out.println("Starting test0");

   209         KeyStore uks = KeyStore.getInstance("JKS");

   210         SSLContext ctx =

   211             SSLContext.getInstance("TLS");

   212         KeyManagerFactory kmf =

   213             KeyManagerFactory.getInstance("SunX509");

   214 

   215         uks.load(new FileInputStream(unknownFilename), cpasswd);

   216         kmf.init(uks, cpasswd);

   217 

   218         TrustManager [] tms = new TrustManager []

   219             { new MyJavaxX509TrustManager() };

   220 

   221         ctx.init(kmf.getKeyManagers(), tms, null);

   222 

   223         SSLSocketFactory sslsf =

   224             (SSLSocketFactory) ctx.getSocketFactory();

   225 

   226         System.out.println("Trying first socket " + serverPort);

   227         SSLSocket sslSocket = (SSLSocket)

   228             sslsf.createSocket("localhost", serverPort);

   229 

   230         doTest(sslSocket);

   231 

   232         /*

   233          * Now try the other way.

   234          */

   235         com.sun.net.ssl.SSLContext ctx1 =

   236             com.sun.net.ssl.SSLContext.getInstance("TLS");

   237         com.sun.net.ssl.KeyManagerFactory kmf1 =

   238             com.sun.net.ssl.KeyManagerFactory.getInstance("SunX509");

   239         kmf1.init(uks, cpasswd);

   240 

   241         com.sun.net.ssl.TrustManager [] tms1 =

   242             new com.sun.net.ssl.TrustManager []

   243             { new MyComX509TrustManager() };

   244 

   245         ctx1.init(kmf1.getKeyManagers(), tms1, null);

   246 

   247         sslsf = (SSLSocketFactory) ctx1.getSocketFactory();

   248 

   249         System.out.println("Trying second socket " + serverPort1);

   250         sslSocket = (SSLSocket) sslsf.createSocket("localhost",

   251             serverPort1);

   252 

   253         doTest(sslSocket);

   254         System.out.println("Completed test1");

   255     }

   256 

   257     /*

   258      * =============================================================

   259      * The remainder is just support stuff

   260      */

   261 

   262     int serverPort = 0;

   263     int serverPort1 = 0;

   264 

   265     volatile Exception serverException = null;

   266     volatile Exception clientException = null;

   267 

   268     final static String keyFilename =

   269         System.getProperty("test.src", "./") + "/" + pathToStores +

   270         "/" + keyStoreFile;

   271     final static String unknownFilename =

   272         System.getProperty("test.src", "./") + "/" + pathToStores +

   273         "/" + unknownStoreFile;

   274 

   275     public static void main(String[] args) throws Exception {

   276 

   277         if (debug)

   278             System.setProperty("javax.net.debug", "all");

   279 

   280         /*

   281          * Start the tests.

   282          */

   283         new CheckMyTrustedKeystore();

   284     }

   285 

   286     Thread clientThread = null;

   287     Thread serverThread = null;

   288 

   289     /*

   290      * Primary constructor, used to drive remainder of the test.

   291      *

   292      * Fork off the other side, then do your work.

   293      */

   294     CheckMyTrustedKeystore() throws Exception {

   295         if (separateServerThread) {

   296             startServer(true);

   297             startClient(false);

   298         } else {

   299             startClient(true);

   300             startServer(false);

   301         }

   302 

   303         /*

   304          * Wait for other side to close down.

   305          */

   306         if (separateServerThread) {

   307             serverThread.join();

   308         } else {

   309             clientThread.join();

   310         }

   311 

   312         /*

   313          * When we get here, the test is pretty much over.

   314          *

   315          * If the main thread excepted, that propagates back

   316          * immediately.  If the other thread threw an exception, we

   317          * should report back.

   318          */

   319         if (serverException != null) {

   320             System.out.print("Server Exception:");

   321             throw serverException;

   322         }

   323         if (clientException != null) {

   324             System.out.print("Client Exception:");

   325             throw clientException;

   326         }

   327     }

   328 

   329     void startServer(boolean newThread) throws Exception {

   330         if (newThread) {

   331             serverThread = new Thread() {

   332                 public void run() {

   333                     try {

   334                         doServerSide();

   335                     } catch (Exception e) {

   336                         /*

   337                          * Our server thread just died.

   338                          *

   339                          * Release the client, if not active already...

   340                          */

   341                         System.err.println("Server died...");

   342                         serverReady = true;

   343                         serverException = e;

   344                     }

   345                 }

   346             };

   347             serverThread.start();

   348         } else {

   349             doServerSide();

   350         }

   351     }

   352 

   353     void startClient(boolean newThread) throws Exception {

   354         if (newThread) {

   355             clientThread = new Thread() {

   356                 public void run() {

   357                     try {

   358                         doClientSide();

   359                     } catch (Exception e) {

   360                         /*

   361                          * Our client thread just died.

   362                          */

   363                         System.err.println("Client died...");

   364                         clientException = e;

   365                     }

   366                 }

   367             };

   368             clientThread.start();

   369         } else {

   370             doClientSide();

   371         }

   372     }

   373 }

   374 

   375 class MyComX509TrustManager implements com.sun.net.ssl.X509TrustManager {

   376 

   377     public X509Certificate[] getAcceptedIssuers() {

   378         return (new X509Certificate[0]);

   379     }

   380 

   381     public boolean isClientTrusted(X509Certificate[] chain) {

   382         System.out.println("    IsClientTrusted?");

   383         return true;

   384     }

   385 

   386     public boolean isServerTrusted(X509Certificate[] chain) {

   387         System.out.println("    IsServerTrusted?");

   388         return true;

   389     }

   390 }

   391 

   392 class MyJavaxX509TrustManager implements X509TrustManager {

   393 

   394     public X509Certificate[] getAcceptedIssuers() {

   395         return (new X509Certificate[0]);

   396     }

   397 

   398     public void checkClientTrusted(X509Certificate[] chain, String authType)

   399             throws CertificateException {

   400         System.out.println("    CheckClientTrusted(" + authType + ")?");

   401     }

   402 

   403     public void checkServerTrusted(X509Certificate[] chain, String authType)

   404             throws CertificateException {

   405         System.out.println("    CheckServerTrusted(" + authType + ")?");

   406     }

   407 }