Add SNI Support based on Host header Signed-off-by: jansupol <jan.supol@oracle.com>
diff --git a/connectors/apache-connector/src/main/java/org/glassfish/jersey/apache/connector/ApacheConnector.java b/connectors/apache-connector/src/main/java/org/glassfish/jersey/apache/connector/ApacheConnector.java index 60c5e83..37183d7 100644 --- a/connectors/apache-connector/src/main/java/org/glassfish/jersey/apache/connector/ApacheConnector.java +++ b/connectors/apache-connector/src/main/java/org/glassfish/jersey/apache/connector/ApacheConnector.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2022 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -24,6 +24,7 @@ import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; +import java.net.Socket; import java.net.URI; import java.util.ArrayList; import java.util.LinkedList; @@ -37,6 +38,7 @@ import java.util.logging.Logger; import java.util.stream.Collectors; +import javax.net.ssl.SSLSocket; import javax.ws.rs.ProcessingException; import javax.ws.rs.client.Client; import javax.ws.rs.core.Configuration; @@ -53,6 +55,7 @@ import org.glassfish.jersey.client.ClientResponse; import org.glassfish.jersey.client.RequestEntityProcessing; import org.glassfish.jersey.client.innate.ClientProxy; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.glassfish.jersey.client.spi.AsyncConnectorCallback; import org.glassfish.jersey.client.spi.Connector; import org.glassfish.jersey.internal.util.PropertiesHelper; @@ -103,6 +106,7 @@ import org.apache.http.impl.conn.PoolingHttpClientConnectionManager; import org.apache.http.impl.io.ChunkedOutputStream; import org.apache.http.io.SessionOutputBuffer; +import org.apache.http.protocol.HttpContext; import org.apache.http.util.TextUtils; import org.apache.http.util.VersionInfo; @@ -180,6 +184,7 @@ class ApacheConnector implements Connector { private static final Logger LOGGER = Logger.getLogger(ApacheConnector.class.getName()); + private static final String JERSEY_REQUEST_ATTR_NAME = "JerseyRequestAttribute"; private static final VersionInfo vi; private static final String release; @@ -381,15 +386,15 @@ final LayeredConnectionSocketFactory sslSocketFactory; if (sslContext != null) { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifier); } else { if (useSystemProperties) { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( (SSLSocketFactory) SSLSocketFactory.getDefault(), supportedProtocols, supportedCipherSuites, hostnameVerifier); } else { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( SSLContexts.createDefault(), hostnameVerifier); } @@ -450,14 +455,16 @@ public ClientResponse apply(final ClientRequest clientRequest) throws ProcessingException { final HttpUriRequest request = getUriHttpRequest(clientRequest); final Map<String, String> clientHeadersSnapshot = writeOutBoundHeaders(clientRequest, request); + final HttpHost httpHost = getHost(request); try { final CloseableHttpResponse response; final HttpClientContext context = HttpClientContext.create(); + if (preemptiveBasicAuth) { final AuthCache authCache = new BasicAuthCache(); final BasicScheme basicScheme = new BasicScheme(); - authCache.put(getHost(request), basicScheme); + authCache.put(httpHost, basicScheme); context.setAuthCache(authCache); } @@ -468,7 +475,8 @@ context.setCredentialsProvider(credentialsProvider); } - response = client.execute(getHost(request), request, context); + context.setAttribute(JERSEY_REQUEST_ATTR_NAME, clientRequest); + response = client.execute(httpHost, request, context); HeaderUtils.checkHeaderChanges(clientHeadersSnapshot, clientRequest.getHeaders(), this.getClass().getName(), clientRequest.getConfiguration()); @@ -821,4 +829,56 @@ return super.createOutputStream(len, outbuffer); } } + + private static final class SniSSLConnectionSocketFactory extends SSLConnectionSocketFactory { + + private final ThreadLocal<HttpContext> httpContexts = new ThreadLocal<>(); + + public SniSSLConnectionSocketFactory(final SSLContext sslContext, + final String[] supportedProtocols, + final String[] supportedCipherSuites, + final HostnameVerifier hostnameVerifier) { + super(sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifier); + } + + public SniSSLConnectionSocketFactory(final javax.net.ssl.SSLSocketFactory socketFactory, + final String[] supportedProtocols, + final String[] supportedCipherSuites, + final HostnameVerifier hostnameVerifier) { + super(socketFactory, supportedProtocols, supportedCipherSuites, hostnameVerifier); + } + + public SniSSLConnectionSocketFactory( + final SSLContext sslContext, final HostnameVerifier hostnameVerifier) { + super(sslContext, hostnameVerifier); + } + + @Override + public Socket createLayeredSocket( + final Socket socket, + final String target, + final int port, + final HttpContext context) throws IOException { + httpContexts.set(context); + try { + return super.createLayeredSocket(socket, target, port, context); + } finally { + httpContexts.remove(); + } + } + + @Override + protected void prepareSocket(SSLSocket socket) throws IOException { + HttpContext context = httpContexts.get(); + + if (context != null) { + Object objectRequest = context.getAttribute(JERSEY_REQUEST_ATTR_NAME); + if (objectRequest != null) { + ClientRequest clientRequest = (ClientRequest) objectRequest; + SSLParamConfigurator sniConfig = SSLParamConfigurator.builder().request(clientRequest).build(); + sniConfig.setSNIServerName(socket); + } + } + } + } }
diff --git a/connectors/apache5-connector/src/main/java/org/glassfish/jersey/apache5/connector/Apache5Connector.java b/connectors/apache5-connector/src/main/java/org/glassfish/jersey/apache5/connector/Apache5Connector.java index da7ccdd..eb36bdf 100644 --- a/connectors/apache5-connector/src/main/java/org/glassfish/jersey/apache5/connector/Apache5Connector.java +++ b/connectors/apache5-connector/src/main/java/org/glassfish/jersey/apache5/connector/Apache5Connector.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2022, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -24,6 +24,7 @@ import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; +import java.net.Socket; import java.net.URI; import java.net.URISyntaxException; import java.util.ArrayList; @@ -37,6 +38,7 @@ import java.util.logging.Logger; import java.util.stream.Collectors; +import javax.net.ssl.SSLSocket; import javax.ws.rs.ProcessingException; import javax.ws.rs.client.Client; import javax.ws.rs.core.Configuration; @@ -48,6 +50,7 @@ import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocketFactory; +import org.apache.hc.client5.http.AuthenticationStrategy; import org.apache.hc.client5.http.ConnectionKeepAliveStrategy; import org.apache.hc.client5.http.HttpRequestRetryStrategy; import org.apache.hc.client5.http.auth.AuthCache; @@ -65,6 +68,7 @@ import org.apache.hc.client5.http.impl.auth.BasicAuthCache; import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider; import org.apache.hc.client5.http.impl.auth.BasicScheme; +import org.apache.hc.client5.http.impl.classic.BasicHttpClientResponseHandler; import org.apache.hc.client5.http.impl.classic.CloseableHttpClient; import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse; import org.apache.hc.client5.http.impl.classic.HttpClientBuilder; @@ -86,6 +90,7 @@ import org.apache.hc.core5.http.impl.DefaultContentLengthStrategy; import org.apache.hc.core5.http.io.entity.AbstractHttpEntity; import org.apache.hc.core5.http.io.entity.BufferedHttpEntity; +import org.apache.hc.core5.http.protocol.HttpContext; import org.apache.hc.core5.ssl.SSLContexts; import org.apache.hc.core5.util.TextUtils; import org.apache.hc.core5.util.Timeout; @@ -95,6 +100,7 @@ import org.glassfish.jersey.client.ClientResponse; import org.glassfish.jersey.client.RequestEntityProcessing; import org.glassfish.jersey.client.innate.ClientProxy; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.glassfish.jersey.client.spi.AsyncConnectorCallback; import org.glassfish.jersey.client.spi.Connector; import org.glassfish.jersey.internal.util.PropertiesHelper; @@ -176,6 +182,7 @@ class Apache5Connector implements Connector { private static final Logger LOGGER = Logger.getLogger(Apache5Connector.class.getName()); + private static final String JERSEY_REQUEST_ATTR_NAME = "JerseyRequestAttribute"; private static final VersionInfo vi; private static final String release; @@ -385,15 +392,15 @@ final LayeredConnectionSocketFactory sslSocketFactory; if (sslContext != null) { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifier); } else { if (useSystemProperties) { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( (SSLSocketFactory) SSLSocketFactory.getDefault(), supportedProtocols, supportedCipherSuites, hostnameVerifier); } else { - sslSocketFactory = new SSLConnectionSocketFactory( + sslSocketFactory = new SniSSLConnectionSocketFactory( SSLContexts.createDefault(), hostnameVerifier); } @@ -458,12 +465,7 @@ try { final CloseableHttpResponse response; final HttpClientContext context = HttpClientContext.create(); - if (preemptiveBasicAuth) { - final AuthCache authCache = new BasicAuthCache(); - final BasicScheme basicScheme = new BasicScheme(); - authCache.put(getHost(request), basicScheme); - context.setAuthCache(authCache); - } + final HttpHost httpHost = getHost(request); // If a request-specific CredentialsProvider exists, use it instead of the default one CredentialsProvider credentialsProvider = @@ -472,7 +474,18 @@ context.setCredentialsProvider(credentialsProvider); } - response = client.execute(getHost(request), request, context); + if (preemptiveBasicAuth) { + final AuthCache authCache = new BasicAuthCache(); + final BasicScheme basicScheme = new BasicScheme(); + final AuthScope authScope = new AuthScope(httpHost); + basicScheme.initPreemptive(credentialsProvider.getCredentials(authScope, context)); + context.resetAuthExchange(httpHost, basicScheme); + authCache.put(httpHost, basicScheme); // must be after initPreemptive + context.setAuthCache(authCache); + } + + context.setAttribute(JERSEY_REQUEST_ATTR_NAME, clientRequest); + response = client.execute(httpHost, request, context); HeaderUtils.checkHeaderChanges(clientHeadersSnapshot, clientRequest.getHeaders(), this.getClass().getName(), clientRequest.getConfiguration()); @@ -798,4 +811,77 @@ ); } } + + private static final class SniSSLConnectionSocketFactory extends SSLConnectionSocketFactory { + + private final ThreadLocal<HttpContext> httpContexts = new ThreadLocal<>(); + + public SniSSLConnectionSocketFactory(final SSLContext sslContext, + final String[] supportedProtocols, + final String[] supportedCipherSuites, + final HostnameVerifier hostnameVerifier) { + super(sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifier); + } + + public SniSSLConnectionSocketFactory(final javax.net.ssl.SSLSocketFactory socketFactory, + final String[] supportedProtocols, + final String[] supportedCipherSuites, + final HostnameVerifier hostnameVerifier) { + super(socketFactory, supportedProtocols, supportedCipherSuites, hostnameVerifier); + } + + public SniSSLConnectionSocketFactory( + final SSLContext sslContext, final HostnameVerifier hostnameVerifier) { + super(sslContext, hostnameVerifier); + } + + /* Pre 5.2 */ + @Override + public Socket createLayeredSocket( + final Socket socket, + final String target, + final int port, + final HttpContext context) throws IOException { + httpContexts.set(context); + try { + return super.createLayeredSocket(socket, target, port, context); + } finally { + httpContexts.remove(); + } + } + + /* Post 5.2 */ + public Socket createLayeredSocket( + final Socket socket, + final String target, + final int port, + final Object attachment, + final HttpContext context) throws IOException { + httpContexts.set(context); + try { + return super.createLayeredSocket(socket, target, port, attachment, context); + } finally { + httpContexts.remove(); + } + } + + @Override + protected void prepareSocket(SSLSocket socket) throws IOException { + HttpContext context = httpContexts.get(); + + if (context != null) { + Object objectRequest = context.getAttribute(JERSEY_REQUEST_ATTR_NAME); + if (objectRequest != null) { + ClientRequest clientRequest = (ClientRequest) objectRequest; + SSLParamConfigurator sniConfig = SSLParamConfigurator.builder().request(clientRequest).build(); + sniConfig.setSNIServerName(socket); + + final int socketTimeout = ((ClientRequest) objectRequest).resolveProperty(ClientProperties.READ_TIMEOUT, -1); + if (socketTimeout >= 0) { + socket.setSoTimeout(socketTimeout); + } + } + } + } + } }
diff --git a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/ConnectorConfiguration.java b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/ConnectorConfiguration.java index 612d540..afb0c6c 100644 --- a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/ConnectorConfiguration.java +++ b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/ConnectorConfiguration.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, 2019 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2015, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -19,6 +19,7 @@ import java.net.CookiePolicy; import java.net.URI; import java.util.Map; +import java.util.concurrent.atomic.AtomicReference; import java.util.logging.Level; import java.util.logging.Logger; @@ -30,6 +31,7 @@ import org.glassfish.jersey.SslConfigurator; import org.glassfish.jersey.client.ClientProperties; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.glassfish.jersey.jdk.connector.JdkConnectorProperties; /** @@ -57,6 +59,7 @@ private final int responseTimeout; private final int connectTimeout; private final ProxyConfiguration proxyConfiguration; + private final AtomicReference<SSLParamConfigurator> sniConfigs = new AtomicReference<>(null); ConnectorConfiguration(Client client, Configuration config) { final Map<String, Object> properties = config.getProperties(); @@ -170,6 +173,14 @@ return proxyConfiguration; } + void setSniConfig(SSLParamConfigurator sniConfig) { + this.sniConfigs.compareAndSet(null, sniConfig); + } + + SSLParamConfigurator getSniConfig() { + return sniConfigs.get(); + } + @Override public String toString() { return "ConnectorConfiguration{"
diff --git a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnection.java b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnection.java index 2330dd4..d9ea76e 100644 --- a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnection.java +++ b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnection.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, 2019 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2015, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -199,7 +199,8 @@ } - socket = new SslFilter(transportFilter, sslContext, uri.getHost(), configuration.getHostnameVerifier()); + socket = new SslFilter(transportFilter, sslContext, uri.getHost(), + configuration.getHostnameVerifier(), configuration.getSniConfig()); } else { socket = new TransportFilter(INPUT_BUFFER_SIZE, configuration.getThreadPoolConfig(), configuration.getContainerIdleTimeout());
diff --git a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnectionPool.java b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnectionPool.java index 28c7500..b20f00c 100644 --- a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnectionPool.java +++ b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/HttpConnectionPool.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, 2019 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2015, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -16,7 +16,11 @@ package org.glassfish.jersey.jdk.connector.internal; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; + import java.net.CookieManager; +import java.util.HashMap; +import java.util.List; import java.util.Map; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.Executors; @@ -45,10 +49,16 @@ } void send(HttpRequest httpRequest, CompletionHandler<HttpResponse> completionHandler) { + final Map<String, List<Object>> headers = new HashMap<>(); + httpRequest.getHeaders().forEach((k, v) -> headers.put(k, (List) v)); + final SSLParamConfigurator sniConfig = SSLParamConfigurator.builder().uri(httpRequest.getUri()).headers(headers).build(); + connectorConfiguration.setSniConfig(sniConfig); + final DestinationConnectionPool.DestinationKey destinationKey = new DestinationConnectionPool.DestinationKey( - httpRequest.getUri()); + sniConfig.getSNIUri()); DestinationConnectionPool destinationConnectionPool = destinationPools.get(destinationKey); + if (destinationConnectionPool == null) { synchronized (this) { // check again while holding the lock
diff --git a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/SslFilter.java b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/SslFilter.java index 85f4541..979a9ce 100644 --- a/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/SslFilter.java +++ b/connectors/jdk-connector/src/main/java/org/glassfish/jersey/jdk/connector/internal/SslFilter.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, 2020 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2015, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -16,6 +16,8 @@ package org.glassfish.jersey.jdk.connector.internal; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; + import java.nio.ByteBuffer; import java.nio.Buffer; import java.util.LinkedList; @@ -26,7 +28,6 @@ import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLEngineResult; import javax.net.ssl.SSLException; -import javax.net.ssl.SSLParameters; /** @@ -87,7 +88,8 @@ SslFilter(Filter<ByteBuffer, ByteBuffer, ?, ?> downstreamFilter, SSLContext sslContext, String serverHost, - HostnameVerifier customHostnameVerifier) { + HostnameVerifier customHostnameVerifier, + SSLParamConfigurator sniConfig) { super(downstreamFilter); this.serverHost = serverHost; sslEngine = sslContext.createSSLEngine(serverHost, -1); @@ -100,11 +102,11 @@ * when {@link SslEngineConfigurator} supports Java 7. */ if (customHostnameVerifier == null) { - SSLParameters sslParameters = sslEngine.getSSLParameters(); - sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); - sslEngine.setSSLParameters(sslParameters); + sniConfig.setEndpointIdentificationAlgorithm(sslEngine); } + sniConfig.setSNIServerName(sslEngine); + applicationInputBuffer = ByteBuffer.allocate(sslEngine.getSession().getApplicationBufferSize()); networkOutputBuffer = ByteBuffer.allocate(sslEngine.getSession().getPacketBufferSize()); }
diff --git a/connectors/jdk-connector/src/test/java/org/glassfish/jersey/jdk/connector/internal/SslFilterTest.java b/connectors/jdk-connector/src/test/java/org/glassfish/jersey/jdk/connector/internal/SslFilterTest.java index 5d205ce..ef13997 100644 --- a/connectors/jdk-connector/src/test/java/org/glassfish/jersey/jdk/connector/internal/SslFilterTest.java +++ b/connectors/jdk-connector/src/test/java/org/glassfish/jersey/jdk/connector/internal/SslFilterTest.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, 2022 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2015, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -23,10 +23,12 @@ import java.net.InetSocketAddress; import java.net.ServerSocket; import java.net.SocketException; +import java.net.URI; import java.nio.ByteBuffer; import java.security.KeyManagementException; import java.security.NoSuchAlgorithmException; import java.util.Arrays; +import java.util.Collections; import java.util.List; import java.util.concurrent.CountDownLatch; import java.util.concurrent.ExecutorService; @@ -41,7 +43,9 @@ import javax.net.ssl.SSLServerSocketFactory; import javax.net.ssl.SSLSession; import javax.net.ssl.SSLSocket; + import org.glassfish.jersey.SslConfigurator; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ConditionEvaluationResult; import org.junit.jupiter.api.extension.ExecutionCondition; @@ -391,7 +395,10 @@ .keyStorePassword("asdfgh"); TransportFilter transportFilter = new TransportFilter(17_000, ThreadPoolConfig.defaultConfig(), 100_000); - final SslFilter sslFilter = new SslFilter(transportFilter, sslConfig.createSSLContext(), host, customHostnameVerifier); + final SSLParamConfigurator sslParamConfigurator = SSLParamConfigurator.builder() + .uri(URI.create("Https://" + host)).headers(Collections.emptyMap()).build(); + final SslFilter sslFilter = new SslFilter( + transportFilter, sslConfig.createSSLContext(), host, customHostnameVerifier, sslParamConfigurator); // exceptions errors that occur before SSL handshake has finished are thrown from this method final AtomicReference<Throwable> exception = new AtomicReference<>();
diff --git a/connectors/netty-connector/src/main/java/org/glassfish/jersey/netty/connector/NettyConnector.java b/connectors/netty-connector/src/main/java/org/glassfish/jersey/netty/connector/NettyConnector.java index 8bb117a..9406b51 100644 --- a/connectors/netty-connector/src/main/java/org/glassfish/jersey/netty/connector/NettyConnector.java +++ b/connectors/netty-connector/src/main/java/org/glassfish/jersey/netty/connector/NettyConnector.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2016, 2022 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2016, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -36,9 +36,6 @@ import java.util.concurrent.Future; import java.util.concurrent.TimeUnit; -import javax.net.ssl.SSLEngine; -import javax.net.ssl.SSLParameters; - import javax.ws.rs.ProcessingException; import javax.ws.rs.client.Client; import javax.ws.rs.core.Configuration; @@ -83,6 +80,7 @@ import org.glassfish.jersey.client.ClientRequest; import org.glassfish.jersey.client.ClientResponse; import org.glassfish.jersey.client.innate.ClientProxy; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.glassfish.jersey.client.spi.AsyncConnectorCallback; import org.glassfish.jersey.client.spi.Connector; import org.glassfish.jersey.message.internal.OutboundMessageContext; @@ -278,17 +276,20 @@ (String[]) null, /* enable default protocols */ false /* true if the first write request shouldn't be encrypted */ ); - int port = requestUri.getPort(); - SslHandler sslHandler = jdkSslContext.newHandler(ch.alloc(), requestUri.getHost(), - port <= 0 ? 443 : port, executorService); + + final int port = requestUri.getPort(); + final SSLParamConfigurator sslConfig = SSLParamConfigurator.builder() + .request(jerseyRequest).setSNIAlways(true).build(); + final SslHandler sslHandler = jdkSslContext.newHandler( + ch.alloc(), sslConfig.getSNIHostName(), port <= 0 ? 443 : port, executorService + ); if (ClientProperties.getValue(config.getProperties(), NettyClientProperties.ENABLE_SSL_HOSTNAME_VERIFICATION, true)) { - SSLEngine sslEngine = sslHandler.engine(); - SSLParameters sslParameters = sslEngine.getSSLParameters(); - sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); - sslEngine.setSSLParameters(sslParameters); + sslConfig.setEndpointIdentificationAlgorithm(sslHandler.engine()); } + sslConfig.setSNIServerName(sslHandler.engine()); + p.addLast(sslHandler); } @@ -374,7 +375,9 @@ setHeaders(jerseyRequest, nettyRequest.headers()); // host header - http 1.1 - nettyRequest.headers().add(HttpHeaderNames.HOST, jerseyRequest.getUri().getHost()); + if (!nettyRequest.headers().contains(HttpHeaderNames.HOST)) { + nettyRequest.headers().add(HttpHeaderNames.HOST, jerseyRequest.getUri().getHost()); + } if (jerseyRequest.hasEntity()) { // guard against prematurely closed channel
diff --git a/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SSLParamConfigurator.java b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SSLParamConfigurator.java new file mode 100644 index 0000000..edfe29b --- /dev/null +++ b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SSLParamConfigurator.java
@@ -0,0 +1,190 @@ +/* + * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License v. 2.0, which is available at + * http://www.eclipse.org/legal/epl-2.0. + * + * This Source Code may also be made available under the following Secondary + * Licenses when the conditions for such availability set forth in the + * Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + * version 2 with the GNU Classpath Exception, which is available at + * https://www.gnu.org/software/classpath/license.html. + * + * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + */ + +package org.glassfish.jersey.client.innate.http; + +import org.glassfish.jersey.client.ClientRequest; + +import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLParameters; +import javax.net.ssl.SSLSocket; +import javax.ws.rs.core.UriBuilder; +import java.net.InetAddress; +import java.net.URI; +import java.net.UnknownHostException; +import java.util.List; +import java.util.Map; +import java.util.Optional; + +/** + * A unified routines to configure {@link SSLParameters}. + * To be reused in connectors. + */ +public final class SSLParamConfigurator { + private final URI uri; + private final Map<String, List<Object>> httpHeaders; + private final Optional<SniConfigurator> sniConfigurator; + + /** + * Builder of the {@link SSLParamConfigurator} instance. + */ + public static final class Builder { + private ClientRequest clientRequest; + private URI uri; + private Map<String, List<Object>> httpHeaders; + private boolean setAlways = false; + + /** + * Sets the {@link ClientRequest} instance. + * @param clientRequest the {@link ClientRequest} + * @return the builder instance + */ + public Builder request(ClientRequest clientRequest) { + this.clientRequest = clientRequest; + this.httpHeaders = null; + this.uri = null; + return this; + } + + /** + * Sets the HTTP request {@link URI} instance. + * @param uri The request uri + * @return the builder instance + */ + public Builder uri(URI uri) { + this.clientRequest = null; + this.uri = uri; + return this; + } + + /** + * Sets the HTTP request headers + * @param httpHeaders the http request headers + * @return the builder instance + */ + public Builder headers(Map<String, List<Object>> httpHeaders) { + this.clientRequest = null; + this.httpHeaders = httpHeaders; + return this; + } + + /** + * Sets SNI only when {@link javax.ws.rs.core.HttpHeaders#HOST} differs from the request host name if set to + * {@code false}. Default is {@code false}. + * @param setAlways set SNI always (default) + * @return the builder instance + */ + public Builder setSNIAlways(boolean setAlways) { + this.setAlways = setAlways; + return this; + } + + /** + * Builds the {@link SSLParamConfigurator} instance. + * @return the configured {@link SSLParamConfigurator} instance. + */ + public SSLParamConfigurator build() { + return new SSLParamConfigurator(this); + } + } + + private SSLParamConfigurator(SSLParamConfigurator.Builder builder) { + this.uri = builder.clientRequest != null ? builder.clientRequest.getUri() : builder.uri; + this.httpHeaders = builder.clientRequest != null ? builder.clientRequest.getHeaders() : builder.httpHeaders; + sniConfigurator = SniConfigurator.createWhenHostHeader(uri, httpHeaders, builder.setAlways); + } + + /** + * Create a new instance of TlsSupport class + **/ + public static SSLParamConfigurator.Builder builder() { + return new SSLParamConfigurator.Builder(); + } + + /** + * Get the host name either set by the request URI or by + * {@link javax.ws.rs.core.HttpHeaders#HOST} header if it differs from HTTP request host name. + * @return the hostName the {@link SSLEngine} is to use. + */ + public String getSNIHostName() { + return sniConfigurator.isPresent() ? sniConfigurator.get().getHostName() : uri.getHost(); + } + + /** + * Replaces hostname within the {@link ClientRequest} uri with a resolved IP address. Should the hostname be not known, + * the original request URI is returned. The purpose of this method is to replace the host with the IP so that + * {code HttpUrlConnection} does not replace user defined {@link javax.net.ssl.SNIHostName} with the host from the request + * uri. + * @return the request uri with ip address of the resolved host. + */ + public URI toIPRequestUri() { + String host = uri.getHost(); + try { + InetAddress ip = InetAddress.getByName(host); + return UriBuilder.fromUri(uri).host(ip.getHostAddress()).build(); + } catch (UnknownHostException e) { + return uri; + } + } + + /** + * Return true iff SNI is to be set, i.e. + * {@link javax.ws.rs.core.HttpHeaders#HOST} header if it differs from HTTP request host name. + * @return Return {@code true} when {@link javax.net.ssl.SNIHostName} is to be set. + */ + public boolean isSNIRequired() { + return sniConfigurator.isPresent(); + } + + /** + * Get the request URI or altered by {@link javax.ws.rs.core.HttpHeaders#HOST} header. + * @return The possibly altered request URI. + * @see #getSNIHostName() + */ + public URI getSNIUri() { + return sniConfigurator.isPresent() ? UriBuilder.fromUri(uri).host(getSNIHostName()).build() : uri; + } + + /** + * Set {@link javax.net.ssl.SNIServerName} for the {@link SSLParameters} when SNI should be used + * (i.e. {@link javax.ws.rs.core.HttpHeaders#HOST} differs from HTTP request host name) + * @param sslEngine the {@link SSLEngine} the {@link SSLParameters} are set for. + */ + public void setSNIServerName(SSLEngine sslEngine) { + sniConfigurator.ifPresent(sni -> sni.setServerNames(sslEngine)); + } + + + /** + * Set {@link javax.net.ssl.SNIServerName} for the {@link SSLParameters} when SNI should be used + * (i.e. {@link javax.ws.rs.core.HttpHeaders#HOST} differs from HTTP request host name) + * @param sslSocket the {@link SSLSocket} the {@link SSLParameters} are set for. + */ + public void setSNIServerName(SSLSocket sslSocket) { + sniConfigurator.ifPresent(sni -> sni.setServerNames(sslSocket)); + } + + /** + * Set setEndpointIdentificationAlgorithm to HTTPS. This is to prevent man-in-the-middle attacks. + * @param sslEngine the {@link SSLEngine} the algorithm is set for. + * @see SSLParameters#setEndpointIdentificationAlgorithm(String) + */ + public void setEndpointIdentificationAlgorithm(SSLEngine sslEngine) { + SSLParameters sslParameters = sslEngine.getSSLParameters(); + sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); + sslEngine.setSSLParameters(sslParameters); + } +}
diff --git a/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SniConfigurator.java b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SniConfigurator.java new file mode 100644 index 0000000..fc5d057 --- /dev/null +++ b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/SniConfigurator.java
@@ -0,0 +1,110 @@ +/* + * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License v. 2.0, which is available at + * http://www.eclipse.org/legal/epl-2.0. + * + * This Source Code may also be made available under the following Secondary + * Licenses when the conditions for such availability set forth in the + * Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + * version 2 with the GNU Classpath Exception, which is available at + * https://www.gnu.org/software/classpath/license.html. + * + * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + */ + +package org.glassfish.jersey.client.innate.http; + +import javax.net.ssl.SNIHostName; +import javax.net.ssl.SNIServerName; +import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLParameters; +import javax.net.ssl.SSLSocket; +import javax.ws.rs.core.HttpHeaders; +import java.net.URI; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; +import java.util.Optional; + +/** + * A unified routines to set {@link SNIHostName} for the {@link javax.net.ssl.SSLContext}. + * To be reused in connectors. + */ +final class SniConfigurator { + private final String hostName; + private SniConfigurator(String hostName) { + this.hostName = hostName; + } + + /** + * Get the hostName from the {@link HttpHeaders#HOST} header. + * @return + */ + String getHostName() { + return hostName; + } + + /** + * Create ClientSNI when {@link HttpHeaders#HOST} is set different from the request URI host (or {@code whenDiffer}.is false). + * @param hostUri the Uri of the HTTP request + * @param headers the HttpHeaders + * @param whenDiffer create {@SniConfigurator only when different from the request URI host} + * @return ClientSNI or empty when {@link HttpHeaders#HOST} + */ + static Optional<SniConfigurator> createWhenHostHeader(URI hostUri, Map<String, List<Object>> headers, boolean whenDiffer) { + List<Object> hostHeaders = headers.get(HttpHeaders.HOST); + if (hostHeaders == null || hostHeaders.get(0) == null) { + return Optional.empty(); + } + + final String hostHeader = hostHeaders.get(0).toString(); + final String trimmedHeader; + if (hostHeader != null) { + int index = hostHeader.indexOf(':'); // RFC 7230 Host = uri-host [ ":" port ] ; + final String trimmedHeader0 = index != -1 ? hostHeader.substring(0, index).trim() : hostHeader.trim(); + trimmedHeader = trimmedHeader0.isEmpty() ? hostHeader : trimmedHeader0; + } else { + return Optional.empty(); + } + + final String hostUriString = hostUri.getHost(); + if (!whenDiffer && hostUriString.equals(trimmedHeader)) { + return Optional.empty(); + } + + return Optional.of(new SniConfigurator(trimmedHeader)); + } + + /** + * Set {@link SNIServerName} for the given {@link SSLEngine} SSLParameters. + * @param sslEngine + */ + void setServerNames(SSLEngine sslEngine) { + SSLParameters sslParameters = sslEngine.getSSLParameters(); + updateSSLParameters(sslParameters); + sslEngine.setSSLParameters(sslParameters); + } + + /** + * Set {@link SNIServerName} for the given {@link SSLSocket} SSLParameters. + * @param sslSocket + */ + void setServerNames(SSLSocket sslSocket) { + SSLParameters sslParameters = sslSocket.getSSLParameters(); + updateSSLParameters(sslParameters); + sslSocket.setSSLParameters(sslParameters); + } + + private SSLParameters updateSSLParameters(SSLParameters sslParameters) { + SNIHostName serverName = new SNIHostName(hostName); + List<SNIServerName> serverNames = new LinkedList<>(); + serverNames.add(serverName); + + sslParameters.setServerNames(serverNames); + + return sslParameters; + } + +}
diff --git a/core-client/src/main/java/org/glassfish/jersey/client/innate/http/package-info.java b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/package-info.java new file mode 100644 index 0000000..bbedce0 --- /dev/null +++ b/core-client/src/main/java/org/glassfish/jersey/client/innate/http/package-info.java
@@ -0,0 +1,21 @@ +/* + * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License v. 2.0, which is available at + * http://www.eclipse.org/legal/epl-2.0. + * + * This Source Code may also be made available under the following Secondary + * Licenses when the conditions for such availability set forth in the + * Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + * version 2 with the GNU Classpath Exception, which is available at + * https://www.gnu.org/software/classpath/license.html. + * + * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + */ + +/** + * Jersey client MOST INTERNAL http related classes/interfaces. + * Shall not be used outside of Jersey. The module shall not be exported to outside of Jersey. + */ +package org.glassfish.jersey.client.innate.http; \ No newline at end of file
diff --git a/core-client/src/main/java/org/glassfish/jersey/client/internal/HttpUrlConnector.java b/core-client/src/main/java/org/glassfish/jersey/client/internal/HttpUrlConnector.java index dc8af25..212dac0 100644 --- a/core-client/src/main/java/org/glassfish/jersey/client/internal/HttpUrlConnector.java +++ b/core-client/src/main/java/org/glassfish/jersey/client/internal/HttpUrlConnector.java
@@ -1,5 +1,5 @@ /* - * Copyright (c) 2011, 2022 Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2011, 2023 Oracle and/or its affiliates. All rights reserved. * * This program and the accompanying materials are made available under the * terms of the Eclipse Public License v. 2.0, which is available at @@ -21,10 +21,13 @@ import java.io.InputStream; import java.lang.reflect.Field; import java.net.HttpURLConnection; +import java.net.InetAddress; import java.net.ProtocolException; +import java.net.Socket; import java.net.SocketTimeoutException; import java.net.URI; import java.net.URISyntaxException; +import java.net.UnknownHostException; import java.security.AccessController; import java.security.PrivilegedActionException; import java.security.PrivilegedExceptionAction; @@ -42,6 +45,7 @@ import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; +import javax.net.ssl.SSLSocket; import javax.net.ssl.SSLSocketFactory; import javax.ws.rs.ProcessingException; import javax.ws.rs.client.Client; @@ -55,6 +59,7 @@ import org.glassfish.jersey.client.JerseyClient; import org.glassfish.jersey.client.RequestEntityProcessing; import org.glassfish.jersey.client.innate.ClientProxy; +import org.glassfish.jersey.client.innate.http.SSLParamConfigurator; import org.glassfish.jersey.client.spi.AsyncConnectorCallback; import org.glassfish.jersey.client.spi.Connector; import org.glassfish.jersey.internal.util.PropertiesHelper; @@ -315,11 +320,35 @@ } } + /** + * Secure connection if necessary. + * <p/> + * Provided implementation sets {@link HostnameVerifier} and {@link SSLSocketFactory} to give connection, if that + * is an instance of {@link HttpsURLConnection}. + * + * @param clientRequest the actual client request. + * @param uc http connection to be secured. + */ + private void secureConnection( + final ClientRequest clientRequest, final HttpURLConnection uc, final SSLParamConfigurator sniConfig) { + secureConnection(clientRequest.getClient(), uc); // keep this for compatibility + + if (sniConfig.isSNIRequired() && uc instanceof HttpsURLConnection) { // set SNI + HttpsURLConnection suc = (HttpsURLConnection) uc; + SniSSLSocketFactory socketFactory = new SniSSLSocketFactory(suc.getSSLSocketFactory()); + socketFactory.setSniConfig(sniConfig); + suc.setSSLSocketFactory(socketFactory); + } + } + private ClientResponse _apply(final ClientRequest request) throws IOException { final HttpURLConnection uc; - Optional<ClientProxy> proxy = ClientProxy.proxyFromRequest(request); + final Optional<ClientProxy> proxy = ClientProxy.proxyFromRequest(request); + final SSLParamConfigurator sniConfig = SSLParamConfigurator.builder().request(request).build(); + final URI sniUri = sniConfig.isSNIRequired() ? sniConfig.toIPRequestUri() : request.getUri(); + proxy.ifPresent(clientProxy -> ClientProxy.setBasicAuthorizationHeader(request.getHeaders(), proxy.get())); - uc = this.connectionFactory.getConnection(request.getUri().toURL(), proxy.isPresent() ? proxy.get().proxy() : null); + uc = this.connectionFactory.getConnection(sniUri.toURL(), proxy.isPresent() ? proxy.get().proxy() : null); uc.setDoInput(true); final String httpMethod = request.getMethod(); @@ -335,7 +364,7 @@ uc.setReadTimeout(request.resolveProperty(ClientProperties.READ_TIMEOUT, uc.getReadTimeout())); - secureConnection(request.getClient(), uc); + secureConnection(request, uc, sniConfig); final Object entity = request.getEntity(); Exception storedException = null; @@ -559,4 +588,84 @@ public String getName() { return "HttpUrlConnection " + AccessController.doPrivileged(PropertiesHelper.getSystemProperty("java.version")); } + + private static class SniSSLSocketFactory extends SSLSocketFactory { + private final SSLSocketFactory socketFactory; + private ThreadLocal<SSLParamConfigurator> sniConfigs = new ThreadLocal<>(); + + public void setSniConfig(SSLParamConfigurator sniConfigs) { + this.sniConfigs.set(sniConfigs); + } + + private SniSSLSocketFactory(SSLSocketFactory socketFactory) { + this.socketFactory = socketFactory; + } + + @Override + public String[] getDefaultCipherSuites() { + return socketFactory.getDefaultCipherSuites(); + } + + @Override + public String[] getSupportedCipherSuites() { + return socketFactory.getSupportedCipherSuites(); + } + + @Override + public Socket createSocket(Socket socket, String s, int i, boolean b) throws IOException { + Socket superSocket = socketFactory.createSocket(socket, s, i, b); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket(String s, int i) throws IOException, UnknownHostException { + Socket superSocket = socketFactory.createSocket(s, i); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket(String s, int i, InetAddress inetAddress, int i1) throws IOException, UnknownHostException { + Socket superSocket = socketFactory.createSocket(s, i, inetAddress, i1); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket(InetAddress inetAddress, int i) throws IOException { + Socket superSocket = socketFactory.createSocket(inetAddress, i); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket(InetAddress inetAddress, int i, InetAddress inetAddress1, int i1) throws IOException { + Socket superSocket = socketFactory.createSocket(inetAddress, i, inetAddress1, i1); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket(Socket s, InputStream consumed, boolean autoClose) throws IOException { + Socket superSocket = socketFactory.createSocket(s, consumed, autoClose); + setSNIServerName(superSocket); + return superSocket; + } + + @Override + public Socket createSocket() throws IOException { + Socket superSocket = socketFactory.createSocket(); + setSNIServerName(superSocket); + return superSocket; + } + + private void setSNIServerName(Socket superSocket) { + SSLParamConfigurator sniConfig = this.sniConfigs.get(); + if (null != sniConfig && SSLSocket.class.isInstance(superSocket)) { + sniConfig.setSNIServerName((SSLSocket) superSocket); + } + this.sniConfigs.remove(); + } + } }
diff --git a/docs/src/main/docbook/client.xml b/docs/src/main/docbook/client.xml index a4e40d7..d9719b6 100644 --- a/docs/src/main/docbook/client.xml +++ b/docs/src/main/docbook/client.xml
@@ -1088,8 +1088,22 @@ <para> See javadoc of the &jersey.client.HttpAuthenticationFeature; for more details. </para> - </section> + </section> + <section> + <title><anchor xml:id="SNI"/>Server Name Indication (SNI) Support</title> + <para> + When using SSL/TLS protocols for the connection, <literal>SNIHostName</literal> is set automatically + based on the host name in the HTTPS request. + </para> + <para> + There might be use-cases where the <literal>SNIHostName</literal> is required to be set for other host + than the host specified in the HTTPS request. For those cases, when the HTTP header <literal>Host</literal> + is set, the <literal>SNIHostName</literal> is set for the host specified in the <literal>Host</literal> header. + Note that only <literal>Apache Connector, JDK Connector, Netty connector</literal>, and the default + <literal>HttpUrlConnector</literal> do support this feature. + </para> + </section> </section>
diff --git a/etc/config/copyright-exclude b/etc/config/copyright-exclude index 987175b..9577477 100644 --- a/etc/config/copyright-exclude +++ b/etc/config/copyright-exclude
@@ -69,6 +69,7 @@ /tests/e2e/server/mvc/MvcEncodingTest/MustacheResource.mustache /test/resources/org/glassfish/jersey/server/config/jaxrs-components /tests/e2e-entity/src/test/resources/org/glassfish/jersey/tests/e2e/entity/xxe.txt +/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer /core-server/src/main/java/com/sun/research/ws/wadl /core-common/src/main/java/org/glassfish/jersey/internal/jsr166 /core-common/src/main/jsr166/org/glassfish/jersey/internal/jsr166
diff --git a/pom.xml b/pom.xml index 3df2d34..95c5f35 100644 --- a/pom.xml +++ b/pom.xml
@@ -2213,7 +2213,7 @@ <helidon.version>1.4.9</helidon.version> <xmlunit.version>2.9.0</xmlunit.version> <httpclient.version>4.5.13</httpclient.version> - <httpclient5.version>5.1.3</httpclient5.version> + <httpclient5.version>5.2.1</httpclient5.version> <jackson.version>2.14.1</jackson.version> <jackson1.version>1.9.13</jackson1.version> <javassist.version>3.29.0-GA</javassist.version>
diff --git a/tests/e2e-tls/pom.xml b/tests/e2e-tls/pom.xml new file mode 100644 index 0000000..2f26262 --- /dev/null +++ b/tests/e2e-tls/pom.xml
@@ -0,0 +1,140 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- + + Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + + This program and the accompanying materials are made available under the + terms of the Eclipse Public License v. 2.0, which is available at + http://www.eclipse.org/legal/epl-2.0. + + This Source Code may also be made available under the following Secondary + Licenses when the conditions for such availability set forth in the + Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + version 2 with the GNU Classpath Exception, which is available at + https://www.gnu.org/software/classpath/license.html. + + SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + +--> + +<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + <modelVersion>4.0.0</modelVersion> + + <parent> + <groupId>org.glassfish.jersey.tests</groupId> + <artifactId>project</artifactId> + <version>2.39-SNAPSHOT</version> + </parent> + + <artifactId>e2e-tls</artifactId> + <name>jersey-tests-e2e-tls</name> + <packaging>jar</packaging> + + <description>Jersey E2E SSL/TLS tests</description> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.plugins</groupId> + <artifactId>maven-surefire-plugin</artifactId> + <configuration> + <forkCount>1</forkCount> + <reuseForks>false</reuseForks> + <enableAssertions>false</enableAssertions> + <skipTests>${skip.e2e}</skipTests> + <systemPropertyVariables> + <sun.net.http.allowRestrictedHeaders>true</sun.net.http.allowRestrictedHeaders> + <property> + <name>ssl.debug</name> + <value>true</value> + </property> + </systemPropertyVariables> + </configuration> + </plugin> + </plugins> + </build> + + <dependencies> + <dependency> + <groupId>org.glassfish.jersey.test-framework.providers</groupId> + <artifactId>jersey-test-framework-provider-bundle</artifactId> + <type>pom</type> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.test-framework</groupId> + <artifactId>jersey-test-framework-util</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.hamcrest</groupId> + <artifactId>hamcrest</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.junit.platform</groupId> + <artifactId>junit-platform-suite</artifactId> + <version>${junit-platform-suite.version}</version> + <scope>test</scope> + </dependency> + <dependency> + <groupId>io.specto</groupId> + <artifactId>hoverfly-java-junit5</artifactId> + <version>0.14.0</version> + <scope>test</scope> + </dependency> + + <dependency> + <groupId>org.glassfish.jersey.connectors</groupId> + <artifactId>jersey-apache-connector</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.connectors</groupId> + <artifactId>jersey-apache5-connector</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.connectors</groupId> + <artifactId>jersey-grizzly-connector</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.connectors</groupId> + <artifactId>jersey-jetty-connector</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.connectors</groupId> + <artifactId>jersey-jdk-connector</artifactId> + <scope>test</scope> + </dependency> + <dependency> + <groupId>org.glassfish.jersey.security</groupId> + <artifactId>oauth1-signature</artifactId> + <version>${project.version}</version> + <scope>test</scope> + </dependency> + </dependencies> + + <profiles> + <profile> + <id>jdk11+</id> + <activation> + <jdk>[11,)</jdk> + </activation> + <dependencies> + <dependency> + <groupId>com.sun.xml.bind</groupId> + <artifactId>jaxb-osgi</artifactId> + <scope>test</scope> + </dependency> + </dependencies> + <properties> + <!-- https://bugs.openjdk.java.net/browse/JDK-8211426 --> + <surefire.security.argline>-Djdk.tls.server.protocols=TLSv1.2</surefire.security.argline> + </properties> + </profile> + </profiles> + +</project>
diff --git a/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/ClientHelloTestServer.java b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/ClientHelloTestServer.java new file mode 100644 index 0000000..703d1c8 --- /dev/null +++ b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/ClientHelloTestServer.java
@@ -0,0 +1,147 @@ +/* + * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License v. 2.0, which is available at + * http://www.eclipse.org/legal/epl-2.0. + * + * This Source Code may also be made available under the following Secondary + * Licenses when the conditions for such availability set forth in the + * Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + * version 2 with the GNU Classpath Exception, which is available at + * https://www.gnu.org/software/classpath/license.html. + * + * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + */ + +package org.glassfish.jersey.tests.e2e.tls; + +import org.glassfish.jersey.tests.e2e.tls.explorer.SSLCapabilities; +import org.glassfish.jersey.tests.e2e.tls.explorer.SSLExplorer; + +import javax.net.ServerSocketFactory; +import javax.net.ssl.SNIHostName; +import javax.net.ssl.SNIMatcher; +import javax.net.ssl.SSLParameters; +import javax.net.ssl.SSLServerSocket; +import javax.net.ssl.SSLServerSocketFactory; +import javax.net.ssl.SSLSession; +import javax.net.ssl.SSLSocket; +import java.io.BufferedReader; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.net.ServerSocket; +import java.net.Socket; +import java.net.SocketException; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.Collection; + +public class ClientHelloTestServer { + private ServerSocket serverSocket; + private Thread serverThread; + private volatile State state = State.NONE; + + private enum State { + NONE, + INIT, + STARTED, + STOPPED + } + + protected ServerSocketFactory getServerSocketFactory() { + return ServerSocketFactory.getDefault(); + } + + protected void afterHandshake(Socket socket, SSLCapabilities capabilities) { + + } + + public void init(int port) { + ServerSocketFactory factory = getServerSocketFactory(); + try { + serverSocket = factory.createServerSocket(port); + + state = State.INIT; + } catch (IOException e) { + e.printStackTrace(); + } + } + + public void start() { + if (state != State.INIT) { + System.out.println("Server has not been initialized"); + } + Thread thread = new Thread(() -> { + while (state == State.INIT) { + Socket socket = null; + try { + socket = serverSocket.accept(); + + inspect(socket); + } catch (SocketException e) { + if (!e.getMessage().equals("Interrupted function call: accept failed")) { + e.printStackTrace(); + } + } catch (IOException e) { + e.printStackTrace(); + } + } + }); + serverThread = thread; + thread.start(); + } + + public void stop() { + try { + state = State.STOPPED; + serverSocket.close(); + serverThread.join(); + } catch (Exception e) { + e.printStackTrace(); + } + } + + public void inspect(Socket socket) throws IOException { + InputStream ins = socket.getInputStream(); + + byte[] buffer = new byte[0xFF]; + int position = 0; + SSLCapabilities capabilities = null; + +// Read the header of TLS record + while (position < SSLExplorer.RECORD_HEADER_SIZE) { + int count = SSLExplorer.RECORD_HEADER_SIZE - position; + int n = ins.read(buffer, position, count); + if (n < 0) { + throw new IOException("unexpected end of stream!"); + } + position += n; + } + +// Get the required size to explore the SSL capabilities + int recordLength = SSLExplorer.getRequiredSize(buffer, 0, position); + if (buffer.length < recordLength) { + buffer = Arrays.copyOf(buffer, recordLength); + } + + while (position < recordLength) { + int count = recordLength - position; + int n = ins.read(buffer, position, count); + if (n < 0) { + throw new IOException("unexpected end of stream!"); + } + position += n; + } + +// Explore + capabilities = SSLExplorer.explore(buffer, 0, recordLength); + if (capabilities != null) { + System.out.println("Record version: " + capabilities.getRecordVersion()); + System.out.println("Hello version: " + capabilities.getHelloVersion()); + } + + afterHandshake(socket, capabilities); + } +}
diff --git a/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/SniTest.java b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/SniTest.java new file mode 100644 index 0000000..1504d44 --- /dev/null +++ b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/SniTest.java
@@ -0,0 +1,151 @@ +/* + * Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License v. 2.0, which is available at + * http://www.eclipse.org/legal/epl-2.0. + * + * This Source Code may also be made available under the following Secondary + * Licenses when the conditions for such availability set forth in the + * Eclipse Public License v. 2.0 are satisfied: GNU General Public License, + * version 2 with the GNU Classpath Exception, which is available at + * https://www.gnu.org/software/classpath/license.html. + * + * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + */ + +package org.glassfish.jersey.tests.e2e.tls; + +import org.glassfish.jersey.apache.connector.ApacheConnectorProvider; +import org.glassfish.jersey.apache5.connector.Apache5ConnectorProvider; +import org.glassfish.jersey.client.ClientConfig; +import org.glassfish.jersey.client.ClientProperties; +import org.glassfish.jersey.client.HttpUrlConnectorProvider; +import org.glassfish.jersey.client.spi.ConnectorProvider; +import org.glassfish.jersey.jdk.connector.JdkConnectorProvider; +import org.glassfish.jersey.netty.connector.NettyConnectorProvider; +import org.glassfish.jersey.tests.e2e.tls.explorer.SSLCapabilities; +import org.junit.jupiter.api.Assertions; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.MethodSource; + +import javax.net.ssl.SNIServerName; +import javax.ws.rs.client.ClientBuilder; +import javax.ws.rs.client.ClientRequestContext; +import javax.ws.rs.client.ClientRequestFilter; +import javax.ws.rs.core.HttpHeaders; +import javax.ws.rs.core.Response; +import java.io.IOException; +import java.net.InetAddress; +import java.net.Socket; +import java.net.SocketTimeoutException; +import java.net.URI; +import java.net.UnknownHostException; +import java.nio.charset.StandardCharsets; +import java.util.LinkedList; +import java.util.List; +import java.util.concurrent.CountDownLatch; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.TimeoutException; + +public class SniTest { + private static final int PORT = 8443; + private static final String LOCALHOST = "127.0.0.1"; + + + static { + // JDK specific settings + System.setProperty("jdk.net.hosts.file", SniTest.class.getResource("/hosts").getPath()); + } + + public static ConnectorProvider[] getConnectors() { + return new ConnectorProvider[] { + new NettyConnectorProvider(), + new ApacheConnectorProvider(), + new Apache5ConnectorProvider(), + new JdkConnectorProvider(), + new HttpUrlConnectorProvider() + }; + } + + @ParameterizedTest + @MethodSource("getConnectors") + public void server1Test(ConnectorProvider provider) { + ClientConfig clientConfig = new ClientConfig(); + clientConfig.connectorProvider(provider); + serverTest(clientConfig, "www.host1.com"); + } + + public void serverTest(ClientConfig clientConfig, String hostName) { + String newHostName = replaceWhenHostNotKnown(hostName); + final List<SNIServerName> serverNames = new LinkedList<>(); + final String[] requestHostName = new String[1]; + ClientHelloTestServer server = new ClientHelloTestServer() { + @Override + protected void afterHandshake(Socket socket, SSLCapabilities capabilities) { + serverNames.addAll(capabilities.getServerNames()); + } + }; + server.init(PORT); + server.start(); + + clientConfig.property(ClientProperties.READ_TIMEOUT, 2000); + clientConfig.property(ClientProperties.CONNECT_TIMEOUT, 2000); + try (Response r = ClientBuilder.newClient(clientConfig) + .register(new ClientRequestFilter() { + @Override + public void filter(ClientRequestContext requestContext) throws IOException { + requestHostName[0] = requestContext.getUri().getHost(); + } + }) + .target("https://" + (newHostName.equals(LOCALHOST) ? LOCALHOST : "www.host0.com") + ":" + PORT) + .path("host") + .request() + .header(HttpHeaders.HOST, hostName + ":8080") + .get()) { + // empty + } catch (Exception e) { + Throwable cause = e; + while (cause != null + && !SocketTimeoutException.class.isInstance(cause) + && TimeoutException.class.isInstance(cause)) { + cause = cause.getCause(); + } + if (cause == null && /*IOE*/ !e.getMessage().contains("Stream closed")) { + throw e; + } + } + + server.stop(); + + if (serverNames.isEmpty()) { + throw new IllegalStateException("ServerNames are empty"); + } + + String clientSniName = new String(serverNames.get(0).getEncoded()); + if (!hostName.equals(clientSniName)) { + throw new IllegalStateException("Unexpected client SNI name " + clientSniName); + } + + if (!LOCALHOST.equals(newHostName) && requestHostName[0].equals(hostName)) { + throw new IllegalStateException("The HTTP Request is made with the same"); + } + + System.out.append("Found expected Client SNI ").println(serverNames.get(0)); + } + + /* + * The method checks whether the JDK-dependent property "jdk.net.hosts.file" works. + * If it does, the request is made with the hostname, so that the 3rd party client has + * the request with the hostname. If a real address is returned or UnknownHostException + * is thrown, the property did not work and the request needs to use 127.0.0.1. + */ + private static String replaceWhenHostNotKnown(String hostName) { + try { + InetAddress inetAddress = InetAddress.getByName(hostName); + return LOCALHOST.equals(inetAddress.getHostAddress()) ? hostName : LOCALHOST; + } catch (UnknownHostException e) { + return LOCALHOST; + } + } +}
diff --git a/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLCapabilities.java b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLCapabilities.java new file mode 100644 index 0000000..e21b86a --- /dev/null +++ b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLCapabilities.java
@@ -0,0 +1,79 @@ +/* + * Copyright (c) 2013, 2023 Oracle and/or its affiliates. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of Oracle or the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +package org.glassfish.jersey.tests.e2e.tls.explorer; + +import java.nio.ByteBuffer; +import java.util.List; +import javax.net.ssl.SNIServerName; + +/** + * Encapsulates the security capabilities of an SSL/TLS connection. + * <P> + * The security capabilities are the list of ciphersuites to be accepted in + * an SSL/TLS handshake, the record version, the hello version, and server + * name indication, etc., of an SSL/TLS connection. + * <P> + * <code>SSLCapabilities</code> can be retrieved by exploring the network + * data of an SSL/TLS connection via {@link SSLExplorer#explore(ByteBuffer)} + * or {@link SSLExplorer#explore(byte[], int, int)}. + * + * @see SSLExplorer + */ +public abstract class SSLCapabilities { + + /** + * Returns the record version of an SSL/TLS connection + * + * @return a non-null record version + */ + public abstract String getRecordVersion(); + + /** + * Returns the hello version of an SSL/TLS connection + * + * @return a non-null hello version + */ + public abstract String getHelloVersion(); + + /** + * Returns a <code>List</code> containing all {@link SNIServerName}s + * of the server name indication. + * + * @return a non-null immutable list of {@link SNIServerName}s + * of the server name indication parameter, may be empty + * if no server name indication. + * + * @see SNIServerName + */ + public abstract List<SNIServerName> getServerNames(); +} +
diff --git a/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLExplorer.java b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLExplorer.java new file mode 100644 index 0000000..71c1f4e --- /dev/null +++ b/tests/e2e-tls/src/test/java/org/glassfish/jersey/tests/e2e/tls/explorer/SSLExplorer.java
@@ -0,0 +1,627 @@ +package org.glassfish.jersey.tests.e2e.tls.explorer; + +/* + * Copyright (c) 2013, 2023 Oracle and/or its affiliates. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of Oracle or the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +import javax.net.ssl.SNIHostName; +import javax.net.ssl.SNIServerName; +import javax.net.ssl.SSLException; +import javax.net.ssl.SSLProtocolException; +import javax.net.ssl.StandardConstants; +import java.nio.ByteBuffer; +import java.nio.BufferUnderflowException; +import java.io.IOException; +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashMap; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; + +/** + * Instances of this class acts as an explorer of the network data of an + * SSL/TLS connection. + */ +public final class SSLExplorer { + + // Private constructor prevents construction outside this class. + private SSLExplorer() { + } + + /** + * The header size of TLS/SSL records. + * <P> + * The value of this constant is {@value}. + */ + public static final int RECORD_HEADER_SIZE = 0x05; + + /** + * Returns the required number of bytes in the {@code source} + * {@link ByteBuffer} necessary to explore SSL/TLS connection. + * <P> + * This method tries to parse as few bytes as possible from + * {@code source} byte buffer to get the length of an + * SSL/TLS record. + * <P> + * This method accesses the {@code source} parameter in read-only + * mode, and does not update the buffer's properties such as capacity, + * limit, position, and mark values. + * + * @param source + * a {@link ByteBuffer} containing + * inbound or outbound network data for an SSL/TLS connection. + * @throws BufferUnderflowException if less than {@code RECORD_HEADER_SIZE} + * bytes remaining in {@code source} + * @return the required size in byte to explore an SSL/TLS connection + */ + public static int getRequiredSize(ByteBuffer source) { + + ByteBuffer input = source.duplicate(); + + // Do we have a complete header? + if (input.remaining() < RECORD_HEADER_SIZE) { + throw new BufferUnderflowException(); + } + + // Is it a handshake message? + byte firstByte = input.get(); + byte secondByte = input.get(); + byte thirdByte = input.get(); + if ((firstByte & 0x80) != 0 && thirdByte == 0x01) { + // looks like a V2ClientHello + // return (((firstByte & 0x7F) << 8) | (secondByte & 0xFF)) + 2; + return RECORD_HEADER_SIZE; // Only need the header fields + } else { + return (((input.get() & 0xFF) << 8) | (input.get() & 0xFF)) + 5; + } + } + + /** + * Returns the required number of bytes in the {@code source} byte array + * necessary to explore SSL/TLS connection. + * <P> + * This method tries to parse as few bytes as possible from + * {@code source} byte array to get the length of an + * SSL/TLS record. + * + * @param source + * a byte array containing inbound or outbound network data for + * an SSL/TLS connection. + * @param offset + * the start offset in array {@code source} at which the + * network data is read from. + * @param length + * the maximum number of bytes to read. + * + * @throws BufferUnderflowException if less than {@code RECORD_HEADER_SIZE} + * bytes remaining in {@code source} + * @return the required size in byte to explore an SSL/TLS connection + */ + public static int getRequiredSize(byte[] source, + int offset, int length) throws IOException { + + ByteBuffer byteBuffer = + ByteBuffer.wrap(source, offset, length).asReadOnlyBuffer(); + return getRequiredSize(byteBuffer); + } + + /** + * Launch and explore the security capabilities from byte buffer. + * <P> + * This method tries to parse as few records as possible from + * {@code source} byte buffer to get the {@link SSLCapabilities} + * of an SSL/TLS connection. + * <P> + * Please NOTE that this method must be called before any handshaking + * occurs. The behavior of this method is not defined in this release + * if the handshake has begun, or has completed. + * <P> + * This method accesses the {@code source} parameter in read-only + * mode, and does not update the buffer's properties such as capacity, + * limit, position, and mark values. + * + * @param source + * a {@link ByteBuffer} containing + * inbound or outbound network data for an SSL/TLS connection. + * + * @throws IOException on network data error + * @throws BufferUnderflowException if not enough source bytes available + * to make a complete exploration. + * + * @return the explored {@link SSLCapabilities} of the SSL/TLS + * connection + */ + public static SSLCapabilities explore(ByteBuffer source) + throws IOException { + + ByteBuffer input = source.duplicate(); + + // Do we have a complete header? + if (input.remaining() < RECORD_HEADER_SIZE) { + throw new BufferUnderflowException(); + } + + // Is it a handshake message? + byte firstByte = input.get(); + byte secondByte = input.get(); + byte thirdByte = input.get(); + if ((firstByte & 0x80) != 0 && thirdByte == 0x01) { + // looks like a V2ClientHello + return exploreV2HelloRecord(input, + firstByte, secondByte, thirdByte); + } else if (firstByte == 22) { // 22: handshake record + return exploreTLSRecord(input, + firstByte, secondByte, thirdByte); + } else { + throw new SSLException("Not handshake record"); + } + } + + /** + * Launch and explore the security capabilities from byte array. + * <P> + * Please NOTE that this method must be called before any handshaking + * occurs. The behavior of this method is not defined in this release + * if the handshake has begun, or has completed. Once handshake has + * begun, or has completed, the security capabilities can not and + * should not be launched with this method. + * + * @param source + * a byte array containing inbound or outbound network data for + * an SSL/TLS connection. + * @param offset + * the start offset in array {@code source} at which the + * network data is read from. + * @param length + * the maximum number of bytes to read. + * + * @throws IOException on network data error + * @throws BufferUnderflowException if not enough source bytes available + * to make a complete exploration. + * @return the explored {@link SSLCapabilities} of the SSL/TLS + * connection + * + * @see #explore(ByteBuffer) + */ + public static SSLCapabilities explore(byte[] source, + int offset, int length) throws IOException { + ByteBuffer byteBuffer = + ByteBuffer.wrap(source, offset, length).asReadOnlyBuffer(); + return explore(byteBuffer); + } + + /* + * uint8 V2CipherSpec[3]; + * struct { + * uint16 msg_length; // The highest bit MUST be 1; + * // the remaining bits contain the length + * // of the following data in bytes. + * uint8 msg_type; // MUST be 1 + * Version version; + * uint16 cipher_spec_length; // It cannot be zero and MUST be a + * // multiple of the V2CipherSpec length. + * uint16 session_id_length; // This field MUST be empty. + * uint16 challenge_length; // SHOULD use a 32-byte challenge + * V2CipherSpec cipher_specs[V2ClientHello.cipher_spec_length]; + * opaque session_id[V2ClientHello.session_id_length]; + * opaque challenge[V2ClientHello.challenge_length; + * } V2ClientHello; + */ + private static SSLCapabilities exploreV2HelloRecord( + ByteBuffer input, byte firstByte, byte secondByte, + byte thirdByte) throws IOException { + + // We only need the header. We have already had enough source bytes. + // int recordLength = (firstByte & 0x7F) << 8) | (secondByte & 0xFF); + try { + // Is it a V2ClientHello? + if (thirdByte != 0x01) { + throw new SSLException( + "Unsupported or Unrecognized SSL record"); + } + + // What's the hello version? + byte helloVersionMajor = input.get(); + byte helloVersionMinor = input.get(); + + // 0x00: major version of SSLv20 + // 0x02: minor version of SSLv20 + // + // SNIServerName is an extension, SSLv20 doesn't support extension. + return new SSLCapabilitiesImpl((byte) 0x00, (byte) 0x02, + helloVersionMajor, helloVersionMinor, + Collections.<SNIServerName>emptyList()); + } catch (BufferUnderflowException bufe) { + throw new SSLProtocolException( + "Invalid handshake record"); + } + } + + /* + * struct { + * uint8 major; + * uint8 minor; + * } ProtocolVersion; + * + * enum { + * change_cipher_spec(20), alert(21), handshake(22), + * application_data(23), (255) + * } ContentType; + * + * struct { + * ContentType type; + * ProtocolVersion version; + * uint16 length; + * opaque fragment[TLSPlaintext.length]; + * } TLSPlaintext; + */ + private static SSLCapabilities exploreTLSRecord( + ByteBuffer input, byte firstByte, byte secondByte, + byte thirdByte) throws IOException { + + // Is it a handshake message? + if (firstByte != 22) { // 22: handshake record + throw new SSLException("Not handshake record"); + } + + // We need the record version to construct SSLCapabilities. + byte recordMajorVersion = secondByte; + byte recordMinorVersion = thirdByte; + + // Is there enough data for a full record? + int recordLength = getInt16(input); + if (recordLength > input.remaining()) { + throw new BufferUnderflowException(); + } + + // We have already had enough source bytes. + try { + return exploreHandshake(input, + recordMajorVersion, recordMinorVersion, recordLength); + } catch (BufferUnderflowException bufe) { + throw new SSLProtocolException( + "Invalid handshake record"); + } + } + + /* + * enum { + * hello_request(0), client_hello(1), server_hello(2), + * certificate(11), server_key_exchange (12), + * certificate_request(13), server_hello_done(14), + * certificate_verify(15), client_key_exchange(16), + * finished(20) + * (255) + * } HandshakeType; + * + * struct { + * HandshakeType msg_type; + * uint24 length; + * select (HandshakeType) { + * case hello_request: HelloRequest; + * case client_hello: ClientHello; + * case server_hello: ServerHello; + * case certificate: Certificate; + * case server_key_exchange: ServerKeyExchange; + * case certificate_request: CertificateRequest; + * case server_hello_done: ServerHelloDone; + * case certificate_verify: CertificateVerify; + * case client_key_exchange: ClientKeyExchange; + * case finished: Finished; + * } body; + * } Handshake; + */ + private static SSLCapabilities exploreHandshake( + ByteBuffer input, byte recordMajorVersion, + byte recordMinorVersion, int recordLength) throws IOException { + + // What is the handshake type? + byte handshakeType = input.get(); + if (handshakeType != 0x01) { // 0x01: client_hello message + throw new IllegalStateException("Not initial handshaking"); + } + + // What is the handshake body length? + int handshakeLength = getInt24(input); + + // Theoretically, a single handshake message might span multiple + // records, but in practice this does not occur. + if (handshakeLength > (recordLength - 4)) { // 4: handshake header size + throw new SSLException("Handshake message spans multiple records"); + } + + input = input.duplicate(); + input.limit(handshakeLength + input.position()); + return exploreClientHello(input, + recordMajorVersion, recordMinorVersion); + } + + /* + * struct { + * uint32 gmt_unix_time; + * opaque random_bytes[28]; + * } Random; + * + * opaque SessionID<0..32>; + * + * uint8 CipherSuite[2]; + * + * enum { null(0), (255) } CompressionMethod; + * + * struct { + * ProtocolVersion client_version; + * Random random; + * SessionID session_id; + * CipherSuite cipher_suites<2..2^16-2>; + * CompressionMethod compression_methods<1..2^8-1>; + * select (extensions_present) { + * case false: + * struct {}; + * case true: + * Extension extensions<0..2^16-1>; + * }; + * } ClientHello; + */ + private static SSLCapabilities exploreClientHello( + ByteBuffer input, + byte recordMajorVersion, + byte recordMinorVersion) throws IOException { + + List<SNIServerName> snList = Collections.<SNIServerName>emptyList(); + + // client version + byte helloMajorVersion = input.get(); + byte helloMinorVersion = input.get(); + + // ignore random + int position = input.position(); + input.position(position + 32); // 32: the length of Random + + // ignore session id + ignoreByteVector8(input); + + // ignore cipher_suites + ignoreByteVector16(input); + + // ignore compression methods + ignoreByteVector8(input); + + if (input.remaining() > 0) { + snList = exploreExtensions(input); + } + + return new SSLCapabilitiesImpl( + recordMajorVersion, recordMinorVersion, + helloMajorVersion, helloMinorVersion, snList); + } + + /* + * struct { + * ExtensionType extension_type; + * opaque extension_data<0..2^16-1>; + * } Extension; + * + * enum { + * server_name(0), max_fragment_length(1), + * client_certificate_url(2), trusted_ca_keys(3), + * truncated_hmac(4), status_request(5), (65535) + * } ExtensionType; + */ + private static List<SNIServerName> exploreExtensions(ByteBuffer input) + throws IOException { + + int length = getInt16(input); // length of extensions + while (length > 0) { + int extType = getInt16(input); // extenson type + int extLen = getInt16(input); // length of extension data + + if (extType == 0x00) { // 0x00: type of server name indication + return exploreSNIExt(input, extLen); + } else { // ignore other extensions + ignoreByteVector(input, extLen); + } + + length -= extLen + 4; + } + + return Collections.<SNIServerName>emptyList(); + } + + /* + * struct { + * NameType name_type; + * select (name_type) { + * case host_name: HostName; + * } name; + * } ServerName; + * + * enum { + * host_name(0), (255) + * } NameType; + * + * opaque HostName<1..2^16-1>; + * + * struct { + * ServerName server_name_list<1..2^16-1> + * } ServerNameList; + */ + private static List<SNIServerName> exploreSNIExt(ByteBuffer input, + int extLen) throws IOException { + + Map<Integer, SNIServerName> sniMap = new LinkedHashMap<>(); + + int remains = extLen; + if (extLen >= 2) { // "server_name" extension in ClientHello + int listLen = getInt16(input); // length of server_name_list + if (listLen == 0 || listLen + 2 != extLen) { + throw new SSLProtocolException( + "Invalid server name indication extension"); + } + + remains -= 2; // 0x02: the length field of server_name_list + while (remains > 0) { + int code = getInt8(input); // name_type + int snLen = getInt16(input); // length field of server name + if (snLen > remains) { + throw new SSLProtocolException( + "Not enough data to fill declared vector size"); + } + byte[] encoded = new byte[snLen]; + input.get(encoded); + + SNIServerName serverName; + switch (code) { + case StandardConstants.SNI_HOST_NAME: + if (encoded.length == 0) { + throw new SSLProtocolException( + "Empty HostName in server name indication"); + } + serverName = new SNIHostName(encoded); + break; + default: + serverName = new UnknownServerName(code, encoded); + } + // check for duplicated server name type + if (sniMap.put(serverName.getType(), serverName) != null) { + throw new SSLProtocolException("Duplicated server name of type " + serverName.getType()); + } + + remains -= encoded.length + 3; // NameType: 1 byte + // HostName length: 2 bytes + } + } else if (extLen == 0) { // "server_name" extension in ServerHello + throw new SSLProtocolException( + "Not server name indication extension in client"); + } + + if (remains != 0) { + throw new SSLProtocolException( + "Invalid server name indication extension"); + } + + return Collections.<SNIServerName>unmodifiableList( + new ArrayList<>(sniMap.values())); + } + + private static int getInt8(ByteBuffer input) { + return input.get(); + } + + private static int getInt16(ByteBuffer input) { + return ((input.get() & 0xFF) << 8) | (input.get() & 0xFF); + } + + private static int getInt24(ByteBuffer input) { + return ((input.get() & 0xFF) << 16) | ((input.get() & 0xFF) << 8) | (input.get() & 0xFF); + } + + private static void ignoreByteVector8(ByteBuffer input) { + ignoreByteVector(input, getInt8(input)); + } + + private static void ignoreByteVector16(ByteBuffer input) { + ignoreByteVector(input, getInt16(input)); + } + + private static void ignoreByteVector24(ByteBuffer input) { + ignoreByteVector(input, getInt24(input)); + } + + private static void ignoreByteVector(ByteBuffer input, int length) { + if (length != 0) { + int position = input.position(); + input.position(position + length); + } + } + + private static class UnknownServerName extends SNIServerName { + UnknownServerName(int code, byte[] encoded) { + super(code, encoded); + } + } + + private static final class SSLCapabilitiesImpl extends SSLCapabilities { + private static final Map<Integer, String> versionMap = new HashMap<>(5); + + private final String recordVersion; + private final String helloVersion; + List<SNIServerName> sniNames; + + static { + versionMap.put(0x0002, "SSLv2Hello"); + versionMap.put(0x0300, "SSLv3"); + versionMap.put(0x0301, "TLSv1"); + versionMap.put(0x0302, "TLSv1.1"); + versionMap.put(0x0303, "TLSv1.2"); + } + + SSLCapabilitiesImpl(byte recordMajorVersion, byte recordMinorVersion, + byte helloMajorVersion, byte helloMinorVersion, + List<SNIServerName> sniNames) { + + int version = (recordMajorVersion << 8) | recordMinorVersion; + this.recordVersion = versionMap.get(version) != null + ? versionMap.get(version) + : unknownVersion(recordMajorVersion, recordMinorVersion); + + version = (helloMajorVersion << 8) | helloMinorVersion; + this.helloVersion = versionMap.get(version) != null + ? versionMap.get(version) + : unknownVersion(helloMajorVersion, helloMinorVersion); + + this.sniNames = sniNames; + } + + @Override + public String getRecordVersion() { + return recordVersion; + } + + @Override + public String getHelloVersion() { + return helloVersion; + } + + @Override + public List<SNIServerName> getServerNames() { + if (!sniNames.isEmpty()) { + return Collections.<SNIServerName>unmodifiableList(sniNames); + } + + return sniNames; + } + + private static String unknownVersion(byte major, byte minor) { + return "Unknown-" + ((int) major) + "." + ((int) minor); + } + } +} +
diff --git a/tests/e2e-tls/src/test/resources/hosts b/tests/e2e-tls/src/test/resources/hosts new file mode 100644 index 0000000..438ebb6 --- /dev/null +++ b/tests/e2e-tls/src/test/resources/hosts
@@ -0,0 +1,19 @@ +# +# Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved. +# +# This program and the accompanying materials are made available under the +# terms of the Eclipse Public License v. 2.0, which is available at +# http://www.eclipse.org/legal/epl-2.0. +# +# This Source Code may also be made available under the following Secondary +# Licenses when the conditions for such availability set forth in the +# Eclipse Public License v. 2.0 are satisfied: GNU General Public License, +# version 2 with the GNU Classpath Exception, which is available at +# https://www.gnu.org/software/classpath/license.html. +# +# SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 + +127.0.0.1 www.host0.com +127.0.0.1 www.host1.com +127.0.0.1 www.host2.com +127.0.0.1 www.host3.com \ No newline at end of file
diff --git a/tests/pom.xml b/tests/pom.xml index 3966d7d..a140de6 100644 --- a/tests/pom.xml +++ b/tests/pom.xml
@@ -1,7 +1,7 @@ <?xml version="1.0" encoding="UTF-8"?> <!-- - Copyright (c) 2011, 2022 Oracle and/or its affiliates. All rights reserved. + Copyright (c) 2011, 2023 Oracle and/or its affiliates. All rights reserved. This program and the accompanying materials are made available under the terms of the Eclipse Public License v. 2.0, which is available at @@ -44,6 +44,7 @@ <module>e2e-inject</module> <module>e2e-server</module> <module>e2e-testng</module> + <module>e2e-tls</module> <module>integration</module> <module>jmockit</module> <module>mem-leaks</module>