Details
-
Bug
-
Resolution: Won't Fix
-
P3
-
None
-
11, 12
-
b20
-
generic
-
generic
Description
ADDITIONAL SYSTEM INFORMATION :
Mac OS 10.11.6
A DESCRIPTION OF THE PROBLEM :
I have a simple program which creates an SSL-protected connection between a client thread and a server thread. The program succeeds on Java 9 and earlier. However, the program fails with the following error when run on Java 11:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
REGRESSION : Last worked in version 10
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
To reproduce the issue, download the sslHandshake.tar file attached to https://issues.apache.org/jira/browse/DERBY-6998, unpack the tarball, and follow the instructions in its README file.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
[java] Startup args = [startServer, startClient]
[java] ServerThread starting...
[java] Host address = localhost/127.0.0.1
[java] ClientThread starting...
[java] Host address = localhost/127.0.0.1
[java] ServerThread successfully accepted connection request 0
[java] ClientThread initiating handshake...
[java] Hooray! Successfully shook the server's hand!
[java] ClientThread exiting...
[java] ServerThread read 'Hello, world!' from the socket!
[java] ServerThread exiting...
ACTUAL -
[java] Startup args = [startServer, startClient]
[java] ServerThread starting...
[java] Host address = localhost/127.0.0.1
[java] ClientThread starting...
[java] Host address = localhost/127.0.0.1
[java] ServerThread successfully accepted connection request 0
[java] ClientThread initiating handshake...
[java] Oops! Handshake failed!
[java] Oops! Socket failed!javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
[java]
[java] ClientThread exiting...
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
[java] ServerThread exiting...
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
[java] at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:279)
[java] at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:181)
[java] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
[java] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152)
[java] at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063)
[java] at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402)
[java] at tests.Test$ClientThread.run(Test.java:141)
[java] javax.net.ssl.SSLHandshakeException: No available authentication scheme
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:255)
[java] at java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.onProduceCertificate(CertificateMessage.java:945)
[java] at java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.produce(CertificateMessage.java:934)
[java] at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:436)
[java] at java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1189)
[java] at java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1125)
[java] at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:831)
[java] at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:792)
[java] at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
[java] at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
[java] at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
[java] at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:178)
[java] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
[java] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152)
[java] at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063)
[java] at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402)
[java] at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:716)
[java] at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:799)
[java] at tests.Test$ServerThread.run(Test.java:105)
---------- BEGIN SOURCE ----------
package tests;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Properties;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import javax.net.SocketFactory;
import java.net.UnknownHostException;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.net.ServerSocketFactory;
import javax.net.SocketFactory;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.util.Arrays;
import java.util.concurrent.atomic.AtomicBoolean;
public class Test
{
public static final String SSL_KEYSTORE = "javax.net.ssl.keyStore";
public static final String KEYSTORE_LOCATION = "keystore/SSLTestServerKey.key";
public static final String SSL_KEYSTORE_PASSWORD = "javax.net.ssl.keyStorePassword";
public static final String KEYSTORE_PASSWORD = "qwerty";
public static final String HOST_NAME = "localhost";
public static final int PORT_NUMBER = 8246;
public static final long SLEEP_TIME = 1000L;
public static final int SOCKET_TIMEOUT = 20_000; // 20 seconds
public static final long TRACE_WAIT = 2000L;
public static final int MAX_CONNECTIONS = 1;
private static final byte[] HELLO_WORLD = "Hello, world!".getBytes();
public static final int READ_BUFFER_SIZE = HELLO_WORLD.length;
private static AtomicBoolean _serverIsRunning = new AtomicBoolean();
public static void main(String... args) throws Exception
{
String rawArg0 = args[0].toLowerCase();
String rawArg1 = args[1].toLowerCase();
println("Startup args = " + stringify(args));
boolean startServer = rawArg0.equals("startserver");
boolean startClient = rawArg1.equals("startclient");
Thread serverThread = startServer ? new ServerThread() : null;
Thread clientThread = startClient ? new ClientThread() : null;
if (startServer)
{
serverThread.start();
while(!_serverIsRunning.get()) { Thread.sleep(SLEEP_TIME); }
}
if (startClient)
{
clientThread.start();
clientThread.join();
}
if (startServer) { serverThread.join(); }
Thread.sleep(TRACE_WAIT);
}
public static class ServerThread extends Thread
{
public String name() { return "ServerThread"; }
public void run()
{
println(name() + " starting...");
try
{
SSLServerSocket serverSocket = createServerSocket();
serverSocket.setSoTimeout(SOCKET_TIMEOUT);
_serverIsRunning.set(true);
for (int connectionCount = 0; connectionCount < MAX_CONNECTIONS; connectionCount++)
{
SSLSocket clientSocket = (SSLSocket) serverSocket.accept();
println
(
name() + " successfully accepted connection request " + connectionCount
);
InputStream socketInputStream = clientSocket.getInputStream();
byte[] readBuffer = new byte[READ_BUFFER_SIZE];
int bytesRead = socketInputStream.read(readBuffer, 0, READ_BUFFER_SIZE);
println(name() + " read '" + (new String(readBuffer)) + "' from the socket!");
}
}
catch (Exception ex)
{
println("Oops! Socket failed!");
ex.printStackTrace();
}
println(name() + " exiting...");
}
}
public static class ClientThread extends Thread
{
public String name() { return "ClientThread"; }
public void run()
{
println(name() + " starting...");
try
{
Properties sslProperties = getSSLProperties();
SSLSocket s1 = (SSLSocket) NaiveTrustManager
.getSocketFactory(sslProperties)
.createSocket(host(), PORT_NUMBER);
String[] removeTwoProtocols = removeSSLv3andSSLv2Hello(s1.getEnabledProtocols());
s1.setEnabledProtocols(removeTwoProtocols);
Thread.sleep(SLEEP_TIME);
println(name() + " initiating handshake...");
s1.setSoTimeout(SOCKET_TIMEOUT);
s1.startHandshake();
println("Hooray! Successfully shook the server's hand!");
s1.getOutputStream().write(HELLO_WORLD);
}
catch (Exception ex)
{
println("Oops! Handshake failed!");
ex.printStackTrace();
}
println(name() + " exiting...");
}
}
public static class NaiveTrustManager
implements X509TrustManager
{
/**
* We don't want more than one instence of this TrustManager
*/
private NaiveTrustManager()
{
}
static private TrustManager[] thisManager = null;
/**
* Generate a socket factory with this trust manager. Derby
* Utility routine which is not part of the X509TrustManager
* interface.
*
* @param sslProperties Configuration settings for the socket factory
*
* @return a socket factory
*
* @throws java.security.NoSuchAlgorithmException on error
* @throws java.security.KeyManagementException on error
* @throws java.security.NoSuchProviderException on error
* @throws java.security.KeyStoreException on error
* @throws java.security.UnrecoverableKeyException on error
* @throws java.security.cert.CertificateException on error
* @throws java.io.IOException on error
**/
public static SocketFactory getSocketFactory(Properties sslProperties)
throws java.security.NoSuchAlgorithmException,
java.security.KeyManagementException,
java.security.NoSuchProviderException,
java.security.KeyStoreException,
java.security.UnrecoverableKeyException,
java.security.cert.CertificateException,
java.io.IOException
{
if (thisManager == null)
{
thisManager = new TrustManager [] {new NaiveTrustManager()};
}
SSLContext ctx = SSLContext.getInstance("TLS");
String keyStore = sslProperties.getProperty(SSL_KEYSTORE);
String keyStorePassword = sslProperties.getProperty(SSL_KEYSTORE_PASSWORD);
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream(keyStore), keyStorePassword.toCharArray());
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509", "SunJSSE");
kmf.init(ks, keyStorePassword.toCharArray());
ctx.init(kmf.getKeyManagers(), thisManager, null); // Use default random source
return ctx.getSocketFactory();
}
/**
* Checks whether the we trust the client. Since this trust manager
* is just for the Derby clients, this routine is actually never
* called, but need to be here when we implement X509TrustManager.
* @param chain The client's certificate chain
* @param authType authorization type (e.g. "RSA" or "DHE_DSS")
**/
public void checkClientTrusted(X509Certificate[] chain,
String authType)
throws CertificateException
{
// Reject all attemtpts to trust a client. We should never end
// up here.
throw new CertificateException();
}
/**
* Checks wether the we trust the server, which we allways will.
* @param chain The server's certificate chain
* @param authType authorization type (e.g. "RSA" or "DHE_DSS")
**/
public void checkServerTrusted(X509Certificate[] chain,
String authType)
throws CertificateException
{
// Do nothing. We trust everyone.
}
/**
* Return an array of certificate authority certificates which are
* trusted for authenticating peers. Not relevant for this trust
* manager.
*/
public X509Certificate[] getAcceptedIssuers()
{
return new X509Certificate[0];
}
}
private static SSLServerSocket createServerSocket()
throws IOException
{
SSLServerSocketFactory ssf =
(SSLServerSocketFactory)SSLServerSocketFactory.getDefault();
SSLServerSocket sss1=
(SSLServerSocket)ssf.createServerSocket(PORT_NUMBER, 0, host());
String[] removeTwoProtocols = removeSSLv3andSSLv2Hello(sss1.getEnabledProtocols());
sss1.setEnabledProtocols(removeTwoProtocols);
return sss1;
}
private static Properties getSSLProperties()
{
Properties retval = new Properties();
retval.setProperty(SSL_KEYSTORE, System.getProperty("user.dir") + "/" + KEYSTORE_LOCATION);
retval.setProperty(SSL_KEYSTORE_PASSWORD, KEYSTORE_PASSWORD);
return retval;
}
private static InetAddress host()
throws UnknownHostException
{
InetAddress retval = InetAddress.getByName(HOST_NAME);
println("Host address = " + retval);
return retval;
}
//Remove SSLv3 and SSLv2Hello protocols from list of enabled protocols
private static String[] removeSSLv3andSSLv2Hello(String[] enabledProtocols) {
//If SSLv3 and SSLv2Hello are one of the enabled protocols, then
// remove them from the list of enabled protocols because of the
// possible security breach.
String[] supportedProtocols = new String[enabledProtocols.length];
int supportedProtocolsCount = 0;
for ( int i = 0; i < enabledProtocols.length; i++ )
{
if (!(enabledProtocols[i].toUpperCase().contains("SSLV3") ||
enabledProtocols[i].toUpperCase().contains("SSLV2HELLO"))) {
supportedProtocols[supportedProtocolsCount] = enabledProtocols[i];
supportedProtocolsCount++;
}
}
if(supportedProtocolsCount < enabledProtocols.length) {
//We found SSLv3 and/or SSLv2Hello as one of the enabled
// protocols for this jvm. Following code will remove them from
// enabled list.
String[] newEnabledProtocolsList = null;
newEnabledProtocolsList =
new String[supportedProtocolsCount];
System.arraycopy(supportedProtocols, 0,
newEnabledProtocolsList, 0,
supportedProtocolsCount);
return(newEnabledProtocolsList);
} else
return(enabledProtocols);
}
private static String stringify(String[] array) { return Arrays.toString(array); }
private static void println(String text) { System.out.println(text); }
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
None.
FREQUENCY : always
Mac OS 10.11.6
A DESCRIPTION OF THE PROBLEM :
I have a simple program which creates an SSL-protected connection between a client thread and a server thread. The program succeeds on Java 9 and earlier. However, the program fails with the following error when run on Java 11:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
REGRESSION : Last worked in version 10
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
To reproduce the issue, download the sslHandshake.tar file attached to https://issues.apache.org/jira/browse/DERBY-6998, unpack the tarball, and follow the instructions in its README file.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
[java] Startup args = [startServer, startClient]
[java] ServerThread starting...
[java] Host address = localhost/127.0.0.1
[java] ClientThread starting...
[java] Host address = localhost/127.0.0.1
[java] ServerThread successfully accepted connection request 0
[java] ClientThread initiating handshake...
[java] Hooray! Successfully shook the server's hand!
[java] ClientThread exiting...
[java] ServerThread read 'Hello, world!' from the socket!
[java] ServerThread exiting...
ACTUAL -
[java] Startup args = [startServer, startClient]
[java] ServerThread starting...
[java] Host address = localhost/127.0.0.1
[java] ClientThread starting...
[java] Host address = localhost/127.0.0.1
[java] ServerThread successfully accepted connection request 0
[java] ClientThread initiating handshake...
[java] Oops! Handshake failed!
[java] Oops! Socket failed!javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
[java]
[java] ClientThread exiting...
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
[java] ServerThread exiting...
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
[java] at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:279)
[java] at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:181)
[java] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
[java] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152)
[java] at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063)
[java] at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402)
[java] at tests.Test$ClientThread.run(Test.java:141)
[java] javax.net.ssl.SSLHandshakeException: No available authentication scheme
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:128)
[java] at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264)
[java] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:255)
[java] at java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.onProduceCertificate(CertificateMessage.java:945)
[java] at java.base/sun.security.ssl.CertificateMessage$T13CertificateProducer.produce(CertificateMessage.java:934)
[java] at java.base/sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:436)
[java] at java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1189)
[java] at java.base/sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1125)
[java] at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:831)
[java] at java.base/sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:792)
[java] at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
[java] at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
[java] at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
[java] at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:178)
[java] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
[java] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152)
[java] at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063)
[java] at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402)
[java] at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:716)
[java] at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:799)
[java] at tests.Test$ServerThread.run(Test.java:105)
---------- BEGIN SOURCE ----------
package tests;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Properties;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import javax.net.SocketFactory;
import java.net.UnknownHostException;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.net.ServerSocketFactory;
import javax.net.SocketFactory;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.util.Arrays;
import java.util.concurrent.atomic.AtomicBoolean;
public class Test
{
public static final String SSL_KEYSTORE = "javax.net.ssl.keyStore";
public static final String KEYSTORE_LOCATION = "keystore/SSLTestServerKey.key";
public static final String SSL_KEYSTORE_PASSWORD = "javax.net.ssl.keyStorePassword";
public static final String KEYSTORE_PASSWORD = "qwerty";
public static final String HOST_NAME = "localhost";
public static final int PORT_NUMBER = 8246;
public static final long SLEEP_TIME = 1000L;
public static final int SOCKET_TIMEOUT = 20_000; // 20 seconds
public static final long TRACE_WAIT = 2000L;
public static final int MAX_CONNECTIONS = 1;
private static final byte[] HELLO_WORLD = "Hello, world!".getBytes();
public static final int READ_BUFFER_SIZE = HELLO_WORLD.length;
private static AtomicBoolean _serverIsRunning = new AtomicBoolean();
public static void main(String... args) throws Exception
{
String rawArg0 = args[0].toLowerCase();
String rawArg1 = args[1].toLowerCase();
println("Startup args = " + stringify(args));
boolean startServer = rawArg0.equals("startserver");
boolean startClient = rawArg1.equals("startclient");
Thread serverThread = startServer ? new ServerThread() : null;
Thread clientThread = startClient ? new ClientThread() : null;
if (startServer)
{
serverThread.start();
while(!_serverIsRunning.get()) { Thread.sleep(SLEEP_TIME); }
}
if (startClient)
{
clientThread.start();
clientThread.join();
}
if (startServer) { serverThread.join(); }
Thread.sleep(TRACE_WAIT);
}
public static class ServerThread extends Thread
{
public String name() { return "ServerThread"; }
public void run()
{
println(name() + " starting...");
try
{
SSLServerSocket serverSocket = createServerSocket();
serverSocket.setSoTimeout(SOCKET_TIMEOUT);
_serverIsRunning.set(true);
for (int connectionCount = 0; connectionCount < MAX_CONNECTIONS; connectionCount++)
{
SSLSocket clientSocket = (SSLSocket) serverSocket.accept();
println
(
name() + " successfully accepted connection request " + connectionCount
);
InputStream socketInputStream = clientSocket.getInputStream();
byte[] readBuffer = new byte[READ_BUFFER_SIZE];
int bytesRead = socketInputStream.read(readBuffer, 0, READ_BUFFER_SIZE);
println(name() + " read '" + (new String(readBuffer)) + "' from the socket!");
}
}
catch (Exception ex)
{
println("Oops! Socket failed!");
ex.printStackTrace();
}
println(name() + " exiting...");
}
}
public static class ClientThread extends Thread
{
public String name() { return "ClientThread"; }
public void run()
{
println(name() + " starting...");
try
{
Properties sslProperties = getSSLProperties();
SSLSocket s1 = (SSLSocket) NaiveTrustManager
.getSocketFactory(sslProperties)
.createSocket(host(), PORT_NUMBER);
String[] removeTwoProtocols = removeSSLv3andSSLv2Hello(s1.getEnabledProtocols());
s1.setEnabledProtocols(removeTwoProtocols);
Thread.sleep(SLEEP_TIME);
println(name() + " initiating handshake...");
s1.setSoTimeout(SOCKET_TIMEOUT);
s1.startHandshake();
println("Hooray! Successfully shook the server's hand!");
s1.getOutputStream().write(HELLO_WORLD);
}
catch (Exception ex)
{
println("Oops! Handshake failed!");
ex.printStackTrace();
}
println(name() + " exiting...");
}
}
public static class NaiveTrustManager
implements X509TrustManager
{
/**
* We don't want more than one instence of this TrustManager
*/
private NaiveTrustManager()
{
}
static private TrustManager[] thisManager = null;
/**
* Generate a socket factory with this trust manager. Derby
* Utility routine which is not part of the X509TrustManager
* interface.
*
* @param sslProperties Configuration settings for the socket factory
*
* @return a socket factory
*
* @throws java.security.NoSuchAlgorithmException on error
* @throws java.security.KeyManagementException on error
* @throws java.security.NoSuchProviderException on error
* @throws java.security.KeyStoreException on error
* @throws java.security.UnrecoverableKeyException on error
* @throws java.security.cert.CertificateException on error
* @throws java.io.IOException on error
**/
public static SocketFactory getSocketFactory(Properties sslProperties)
throws java.security.NoSuchAlgorithmException,
java.security.KeyManagementException,
java.security.NoSuchProviderException,
java.security.KeyStoreException,
java.security.UnrecoverableKeyException,
java.security.cert.CertificateException,
java.io.IOException
{
if (thisManager == null)
{
thisManager = new TrustManager [] {new NaiveTrustManager()};
}
SSLContext ctx = SSLContext.getInstance("TLS");
String keyStore = sslProperties.getProperty(SSL_KEYSTORE);
String keyStorePassword = sslProperties.getProperty(SSL_KEYSTORE_PASSWORD);
KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream(keyStore), keyStorePassword.toCharArray());
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509", "SunJSSE");
kmf.init(ks, keyStorePassword.toCharArray());
ctx.init(kmf.getKeyManagers(), thisManager, null); // Use default random source
return ctx.getSocketFactory();
}
/**
* Checks whether the we trust the client. Since this trust manager
* is just for the Derby clients, this routine is actually never
* called, but need to be here when we implement X509TrustManager.
* @param chain The client's certificate chain
* @param authType authorization type (e.g. "RSA" or "DHE_DSS")
**/
public void checkClientTrusted(X509Certificate[] chain,
String authType)
throws CertificateException
{
// Reject all attemtpts to trust a client. We should never end
// up here.
throw new CertificateException();
}
/**
* Checks wether the we trust the server, which we allways will.
* @param chain The server's certificate chain
* @param authType authorization type (e.g. "RSA" or "DHE_DSS")
**/
public void checkServerTrusted(X509Certificate[] chain,
String authType)
throws CertificateException
{
// Do nothing. We trust everyone.
}
/**
* Return an array of certificate authority certificates which are
* trusted for authenticating peers. Not relevant for this trust
* manager.
*/
public X509Certificate[] getAcceptedIssuers()
{
return new X509Certificate[0];
}
}
private static SSLServerSocket createServerSocket()
throws IOException
{
SSLServerSocketFactory ssf =
(SSLServerSocketFactory)SSLServerSocketFactory.getDefault();
SSLServerSocket sss1=
(SSLServerSocket)ssf.createServerSocket(PORT_NUMBER, 0, host());
String[] removeTwoProtocols = removeSSLv3andSSLv2Hello(sss1.getEnabledProtocols());
sss1.setEnabledProtocols(removeTwoProtocols);
return sss1;
}
private static Properties getSSLProperties()
{
Properties retval = new Properties();
retval.setProperty(SSL_KEYSTORE, System.getProperty("user.dir") + "/" + KEYSTORE_LOCATION);
retval.setProperty(SSL_KEYSTORE_PASSWORD, KEYSTORE_PASSWORD);
return retval;
}
private static InetAddress host()
throws UnknownHostException
{
InetAddress retval = InetAddress.getByName(HOST_NAME);
println("Host address = " + retval);
return retval;
}
//Remove SSLv3 and SSLv2Hello protocols from list of enabled protocols
private static String[] removeSSLv3andSSLv2Hello(String[] enabledProtocols) {
//If SSLv3 and SSLv2Hello are one of the enabled protocols, then
// remove them from the list of enabled protocols because of the
// possible security breach.
String[] supportedProtocols = new String[enabledProtocols.length];
int supportedProtocolsCount = 0;
for ( int i = 0; i < enabledProtocols.length; i++ )
{
if (!(enabledProtocols[i].toUpperCase().contains("SSLV3") ||
enabledProtocols[i].toUpperCase().contains("SSLV2HELLO"))) {
supportedProtocols[supportedProtocolsCount] = enabledProtocols[i];
supportedProtocolsCount++;
}
}
if(supportedProtocolsCount < enabledProtocols.length) {
//We found SSLv3 and/or SSLv2Hello as one of the enabled
// protocols for this jvm. Following code will remove them from
// enabled list.
String[] newEnabledProtocolsList = null;
newEnabledProtocolsList =
new String[supportedProtocolsCount];
System.arraycopy(supportedProtocols, 0,
newEnabledProtocolsList, 0,
supportedProtocolsCount);
return(newEnabledProtocolsList);
} else
return(enabledProtocols);
}
private static String stringify(String[] array) { return Arrays.toString(array); }
private static void println(String text) { System.out.println(text); }
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
None.
FREQUENCY : always
Attachments
Issue Links
- relates to
-
JDK-8196584 TLS 1.3 Implementation
-
- Resolved
-