You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mina.apache.org by el...@apache.org on 2016/09/19 10:24:23 UTC
mina git commit: o Closed the session if we get an SSL exception
during the Handshake,
to avoid having a valid session being usable but with data being exchanged in
plain text... o Added the test case provided by Thomas Papke (DIRMINA-1044)
Repository: mina
Updated Branches:
refs/heads/2.0 3d5ac4143 -> f7b334472
o Closed the session if we get an SSL exception during the Handshake, to
avoid having a valid session being usable but with data being exchanged
in plain text...
o Added the test case provided by Thomas Papke (DIRMINA-1044)
Project: http://git-wip-us.apache.org/repos/asf/mina/repo
Commit: http://git-wip-us.apache.org/repos/asf/mina/commit/f7b33447
Tree: http://git-wip-us.apache.org/repos/asf/mina/tree/f7b33447
Diff: http://git-wip-us.apache.org/repos/asf/mina/diff/f7b33447
Branch: refs/heads/2.0
Commit: f7b334472c6a2a545bf007014a29a8e69e6d224f
Parents: 3d5ac41
Author: Emmanuel L�charny <el...@symas.com>
Authored: Mon Sep 19 12:24:00 2016 +0200
Committer: Emmanuel L�charny <el...@symas.com>
Committed: Mon Sep 19 12:24:00 2016 +0200
----------------------------------------------------------------------
.../org/apache/mina/filter/ssl/SslFilter.java | 3 +
.../org/apache/mina/filter/ssl/SslTest.java | 107 ++++++++++++++++---
2 files changed, 96 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mina/blob/f7b33447/mina-core/src/main/java/org/apache/mina/filter/ssl/SslFilter.java
----------------------------------------------------------------------
diff --git a/mina-core/src/main/java/org/apache/mina/filter/ssl/SslFilter.java b/mina-core/src/main/java/org/apache/mina/filter/ssl/SslFilter.java
index e91ab6b..7acb123 100644
--- a/mina-core/src/main/java/org/apache/mina/filter/ssl/SslFilter.java
+++ b/mina-core/src/main/java/org/apache/mina/filter/ssl/SslFilter.java
@@ -519,6 +519,9 @@ public class SslFilter extends IoFilterAdapter {
SSLException newSsle = new SSLHandshakeException("SSL handshake failed.");
newSsle.initCause(ssle);
ssle = newSsle;
+
+ // Close the session immediately, the handshake has failed
+ session.closeNow();
} else {
// Free the SSL Handler buffers
sslHandler.release();
http://git-wip-us.apache.org/repos/asf/mina/blob/f7b33447/mina-core/src/test/java/org/apache/mina/filter/ssl/SslTest.java
----------------------------------------------------------------------
diff --git a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslTest.java b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslTest.java
index 840ea4e..23d7fd8 100644
--- a/mina-core/src/test/java/org/apache/mina/filter/ssl/SslTest.java
+++ b/mina-core/src/test/java/org/apache/mina/filter/ssl/SslTest.java
@@ -24,6 +24,7 @@ import java.io.InputStreamReader;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.Socket;
+import java.net.SocketTimeoutException;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.Security;
@@ -57,6 +58,8 @@ public class SslTest {
private static InetAddress address;
private static SSLSocketFactory factory;
+
+ private static NioSocketAcceptor acceptor;
/** A JVM independant KEY_MANAGER_FACTORY algorithm */
private static final String KEY_MANAGER_FACTORY_ALGORITHM;
@@ -96,7 +99,7 @@ public class SslTest {
* protocol codec filter
*/
private static void startServer() throws Exception {
- NioSocketAcceptor acceptor = new NioSocketAcceptor();
+ acceptor = new NioSocketAcceptor();
acceptor.setReuseAddress(true);
DefaultIoFilterChainBuilder filters = acceptor.getFilterChain();
@@ -104,6 +107,7 @@ public class SslTest {
// Inject the SSL filter
SslFilter sslFilter = new SslFilter(createSSLContext());
filters.addLast("sslFilter", sslFilter);
+ sslFilter.setNeedClientAuth(true);
// Inject the TestLine codec filter
filters.addLast("text", new ProtocolCodecFilter(new TextLineCodecFactory()));
@@ -111,6 +115,10 @@ public class SslTest {
acceptor.setHandler(new TestHandler());
acceptor.bind(new InetSocketAddress(port));
}
+
+ private static void stopServer() {
+ acceptor.dispose();
+ }
/**
* Starts a client which will connect twice using SSL
@@ -169,20 +177,91 @@ public class SslTest {
@Test
public void testSSL() throws Exception {
- startServer();
-
- Thread t = new Thread() {
- public void run() {
- try {
- startClient();
- } catch (Exception e) {
- clientError = e;
+ try {
+ startServer();
+
+ Thread t = new Thread() {
+ public void run() {
+ try {
+ startClient();
+ } catch (Exception e) {
+ clientError = e;
+ }
}
+ };
+ t.start();
+ t.join();
+
+ if (clientError != null) {
+ throw clientError;
}
- };
- t.start();
- t.join();
- if (clientError != null)
- throw clientError;
+ } finally {
+ stopServer();
+ }
+ }
+
+
+ @Test
+ public void unsecureClientTryToConnectoToSecureServer() throws Exception {
+ try {
+ startServer(); // Start Server with SSLFilter
+
+ //Now start a client without any SSL
+ Thread t = new Thread() {
+ @Override
+ public void run() {
+ try {
+ address = InetAddress.getByName("localhost");
+
+ Socket socket = new Socket(address, port);
+ socket.setSoTimeout(10000);
+
+ String response = null;
+
+ while (response == null) {
+ try {
+ System.out.println(socket.isConnected());
+ // System.out.println("Client sending: hello");
+ socket.getOutputStream().write("hello \n".getBytes());
+ socket.getOutputStream().flush();
+ socket.setSoTimeout(1000);
+
+ // System.out.println("Client sending: send");
+ socket.getOutputStream().write("send\n".getBytes());
+ socket.getOutputStream().flush();
+
+ BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
+ String line = "";
+
+ while ((line = in.readLine()) != null) {
+ response = response + line;
+ }
+ } catch (SocketTimeoutException timeout) {
+ // donothing
+ timeout.printStackTrace();
+ }
+ }
+
+ if (response.contains("AAAAAAA")){
+ throw new IllegalStateException("getting response:" + response);
+ }
+
+ // System.out.println("Client got: " + line);
+ socket.close();
+ } catch (Exception e) {
+ clientError = e;
+ }
+ }
+ };
+
+ t.start();
+ t.join();
+
+ if (clientError != null) {
+ throw clientError;
+ }
+ } finally {
+ stopServer();
+ }
}
}