org.bouncycastle.crypto.tls.test.TlsTestServerImpl Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of bcprov-ext-jdk14 Show documentation
Show all versions of bcprov-ext-jdk14 Show documentation
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.4. Note: this package includes the NTRU encryption algorithms.
package org.bouncycastle.crypto.tls.test;
import java.io.IOException;
import java.io.PrintStream;
import java.util.Vector;
import org.bouncycastle.asn1.x509.Certificate;
import org.bouncycastle.crypto.tls.AlertDescription;
import org.bouncycastle.crypto.tls.AlertLevel;
import org.bouncycastle.crypto.tls.CertificateRequest;
import org.bouncycastle.crypto.tls.ClientCertificateType;
import org.bouncycastle.crypto.tls.ConnectionEnd;
import org.bouncycastle.crypto.tls.DefaultTlsServer;
import org.bouncycastle.crypto.tls.HashAlgorithm;
import org.bouncycastle.crypto.tls.ProtocolVersion;
import org.bouncycastle.crypto.tls.SignatureAlgorithm;
import org.bouncycastle.crypto.tls.SignatureAndHashAlgorithm;
import org.bouncycastle.crypto.tls.TlsEncryptionCredentials;
import org.bouncycastle.crypto.tls.TlsFatalAlert;
import org.bouncycastle.crypto.tls.TlsSignerCredentials;
import org.bouncycastle.crypto.tls.TlsUtils;
class TlsTestServerImpl
extends DefaultTlsServer
{
protected final TlsTestConfig config;
protected int firstFatalAlertConnectionEnd = -1;
protected short firstFatalAlertDescription = -1;
TlsTestServerImpl(TlsTestConfig config)
{
this.config = config;
}
int getFirstFatalAlertConnectionEnd()
{
return firstFatalAlertConnectionEnd;
}
short getFirstFatalAlertDescription()
{
return firstFatalAlertDescription;
}
protected ProtocolVersion getMaximumVersion()
{
if (config.serverMaximumVersion != null)
{
return config.serverMaximumVersion;
}
return super.getMaximumVersion();
}
protected ProtocolVersion getMinimumVersion()
{
if (config.serverMinimumVersion != null)
{
return config.serverMinimumVersion;
}
return super.getMinimumVersion();
}
public void notifyAlertRaised(short alertLevel, short alertDescription, String message, Exception cause)
{
if (alertLevel == AlertLevel.fatal && firstFatalAlertConnectionEnd == -1)
{
firstFatalAlertConnectionEnd = ConnectionEnd.server;
firstFatalAlertDescription = alertDescription;
}
if (TlsTestConfig.DEBUG)
{
PrintStream out = (alertLevel == AlertLevel.fatal) ? System.err : System.out;
out.println("TLS server raised alert (AlertLevel." + alertLevel + ", AlertDescription." + alertDescription
+ ")");
if (message != null)
{
out.println("> " + message);
}
if (cause != null)
{
cause.printStackTrace(out);
}
}
}
public void notifyAlertReceived(short alertLevel, short alertDescription)
{
if (alertLevel == AlertLevel.fatal && firstFatalAlertConnectionEnd == -1)
{
firstFatalAlertConnectionEnd = ConnectionEnd.client;
firstFatalAlertDescription = alertDescription;
}
if (TlsTestConfig.DEBUG)
{
PrintStream out = (alertLevel == AlertLevel.fatal) ? System.err : System.out;
out.println("TLS server received alert (AlertLevel." + alertLevel + ", AlertDescription."
+ alertDescription + ")");
}
}
public ProtocolVersion getServerVersion() throws IOException
{
ProtocolVersion serverVersion = super.getServerVersion();
if (TlsTestConfig.DEBUG)
{
System.out.println("TLS server negotiated " + serverVersion);
}
return serverVersion;
}
public CertificateRequest getCertificateRequest() throws IOException
{
if (config.serverCertReq == TlsTestConfig.SERVER_CERT_REQ_NONE)
{
return null;
}
Vector serverSigAlgs = null;
if (TlsUtils.isSignatureAlgorithmsExtensionAllowed(serverVersion))
{
short[] hashAlgorithms = new short[]{ HashAlgorithm.sha512, HashAlgorithm.sha384, HashAlgorithm.sha256,
HashAlgorithm.sha224, HashAlgorithm.sha1 };
short[] signatureAlgorithms = new short[]{ SignatureAlgorithm.rsa };
serverSigAlgs = new Vector();
for (int i = 0; i < hashAlgorithms.length; ++i)
{
for (int j = 0; j < signatureAlgorithms.length; ++j)
{
serverSigAlgs.addElement(new SignatureAndHashAlgorithm(hashAlgorithms[i],
signatureAlgorithms[j]));
}
}
}
Vector certificateAuthorities = new Vector();
certificateAuthorities.add(TlsTestUtils.loadCertificateResource("x509-ca.pem").getSubject());
return new CertificateRequest(new short[]{ ClientCertificateType.rsa_sign }, serverSigAlgs, certificateAuthorities);
}
public void notifyClientCertificate(org.bouncycastle.crypto.tls.Certificate clientCertificate)
throws IOException
{
boolean isEmpty = (clientCertificate == null || clientCertificate.isEmpty());
if (isEmpty != (config.clientAuth == TlsTestConfig.CLIENT_AUTH_NONE))
{
throw new IllegalStateException();
}
if (isEmpty && (config.serverCertReq == TlsTestConfig.SERVER_CERT_REQ_MANDATORY))
{
throw new TlsFatalAlert(AlertDescription.handshake_failure);
}
Certificate[] chain = clientCertificate.getCertificateList();
if (!isEmpty && !chain[0].equals(TlsTestUtils.loadCertificateResource("x509-client.pem")))
{
throw new TlsFatalAlert(AlertDescription.bad_certificate);
}
if (TlsTestConfig.DEBUG)
{
System.out.println("TLS server received client certificate chain of length " + chain.length);
for (int i = 0; i != chain.length; i++)
{
Certificate entry = chain[i];
// TODO Create fingerprint based on certificate signature algorithm digest
System.out.println(" fingerprint:SHA-256 " + TlsTestUtils.fingerprint(entry) + " ("
+ entry.getSubject() + ")");
}
}
}
protected TlsEncryptionCredentials getRSAEncryptionCredentials()
throws IOException
{
return TlsTestUtils.loadEncryptionCredentials(context, new String[]{"x509-server.pem", "x509-ca.pem"},
"x509-server-key.pem");
}
protected TlsSignerCredentials getRSASignerCredentials()
throws IOException
{
/*
* TODO Note that this code fails to provide default value for the client supported
* algorithms if it wasn't sent.
*/
SignatureAndHashAlgorithm signatureAndHashAlgorithm = null;
Vector sigAlgs = supportedSignatureAlgorithms;
if (sigAlgs != null)
{
for (int i = 0; i < sigAlgs.size(); ++i)
{
SignatureAndHashAlgorithm sigAlg = (SignatureAndHashAlgorithm)
sigAlgs.elementAt(i);
if (sigAlg.getSignature() == SignatureAlgorithm.rsa)
{
signatureAndHashAlgorithm = sigAlg;
break;
}
}
if (signatureAndHashAlgorithm == null)
{
return null;
}
}
return TlsTestUtils.loadSignerCredentials(context, new String[]{"x509-server.pem", "x509-ca.pem"},
"x509-server-key.pem", signatureAndHashAlgorithm);
}
}