undefect. CWE-407 — 63 sites patched across 27 ecosystems
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
This commit is contained in:
commit
0a580b313d
70422 changed files with 17213626 additions and 0 deletions
|
|
@ -0,0 +1,275 @@
|
|||
/*
|
||||
* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
// SunJSSE does not support dynamic system properties, no way to re-use
|
||||
// system properties in samevm/agentvm mode.
|
||||
|
||||
/*
|
||||
* @test
|
||||
* @bug 8162362
|
||||
* @summary Cannot enable previously default enabled cipher suites
|
||||
* @run main/othervm
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.client.cipherSuites="unknown"
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.client.cipherSuites=""
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.client.cipherSuites="TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.server.cipherSuites="TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default false
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.client.cipherSuites="TLS_RSA_WITH_AES_128_CBC_SHA,unknown,TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* ""
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.server.cipherSuites="TLS_RSA_WITH_AES_128_CBC_SHA,unknown,TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default false
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* ""
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.server.cipherSuites="TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default true
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
* @run main/othervm
|
||||
* -Djdk.tls.client.cipherSuites="TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
|
||||
* CustomizedCipherSuites Default false
|
||||
* TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
* TLS_ECDH_anon_WITH_AES_128_CBC_SHA
|
||||
*/
|
||||
|
||||
import java.security.Security;
|
||||
import javax.net.ssl.*;
|
||||
|
||||
/**
|
||||
* Test the customized default cipher suites.
|
||||
*
|
||||
* This test is based on the behavior that TLS_ECDH_anon_WITH_AES_128_CBC_SHA is
|
||||
* disabled by default, and TLS_RSA_WITH_AES_128_CBC_SHA is enabled by
|
||||
* default in JDK. If the behavior is changed in the future, please
|
||||
* update the test cases above accordingly.
|
||||
*/
|
||||
public class CustomizedCipherSuites {
|
||||
|
||||
private static String contextProtocol;
|
||||
private static boolean isClientMode;
|
||||
|
||||
private static String enabledCipherSuite;
|
||||
private static String notEnabledCipherSuite;
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
// reset the security property to make sure the cipher suites
|
||||
// used in this test are not disabled
|
||||
Security.setProperty("jdk.tls.disabledAlgorithms", "");
|
||||
|
||||
contextProtocol = trimQuotes(args[0]);
|
||||
isClientMode = Boolean.parseBoolean(args[1]);
|
||||
enabledCipherSuite = trimQuotes(args[2]);
|
||||
notEnabledCipherSuite = trimQuotes(args[3]);
|
||||
|
||||
//
|
||||
// Create instance of SSLContext with the specified protocol.
|
||||
//
|
||||
SSLContext context = SSLContext.getInstance(contextProtocol);
|
||||
|
||||
// Default SSLContext is initialized automatically.
|
||||
if (!contextProtocol.equals("Default")) {
|
||||
// Use default TK, KM and random.
|
||||
context.init((KeyManager[])null, (TrustManager[])null, null);
|
||||
}
|
||||
|
||||
// SSLContext default parameters is client mode in JDK.
|
||||
if (isClientMode) {
|
||||
//
|
||||
// Check default parameters of the specified SSLContext protocol
|
||||
//
|
||||
SSLParameters parameters = context.getDefaultSSLParameters();
|
||||
System.out.println("Checking SSLContext default parameters ...");
|
||||
checkEnabledCiphers(parameters.getCipherSuites());
|
||||
}
|
||||
|
||||
//
|
||||
// Check supported parameters of the specified SSLContext protocol
|
||||
//
|
||||
SSLParameters parameters = context.getSupportedSSLParameters();
|
||||
System.out.println("Checking SSLContext suppport parameters ...");
|
||||
checkSupportedCiphers(parameters.getCipherSuites());
|
||||
|
||||
|
||||
//
|
||||
// Check the default cipher suites of SSLEngine.
|
||||
//
|
||||
SSLEngine engine = context.createSSLEngine();
|
||||
engine.setUseClientMode(isClientMode);
|
||||
|
||||
System.out.println("Checking SSLEngine default cipher suites ...");
|
||||
checkEnabledCiphers(engine.getEnabledCipherSuites());
|
||||
|
||||
//
|
||||
// Check the supported cipher suites of SSLEngine.
|
||||
//
|
||||
System.out.println("Checking SSLEngine supported cipher suites ...");
|
||||
checkSupportedCiphers(engine.getSupportedCipherSuites());
|
||||
|
||||
if (isClientMode) {
|
||||
SSLSocketFactory factory = context.getSocketFactory();
|
||||
// Use an unconnected socket.
|
||||
try (SSLSocket socket = (SSLSocket)factory.createSocket()) {
|
||||
//
|
||||
// Check the default cipher suites of SSLSocket.
|
||||
//
|
||||
System.out.println(
|
||||
"Checking SSLSocket default cipher suites ...");
|
||||
checkEnabledCiphers(socket.getEnabledCipherSuites());
|
||||
|
||||
//
|
||||
// Check the supported cipher suites of SSLSocket.
|
||||
//
|
||||
System.out.println(
|
||||
"Checking SSLSocket supported cipher suites ...");
|
||||
checkSupportedCiphers(socket.getSupportedCipherSuites());
|
||||
}
|
||||
} else {
|
||||
SSLServerSocketFactory factory = context.getServerSocketFactory();
|
||||
// Use an unbound server socket.
|
||||
try (SSLServerSocket socket =
|
||||
(SSLServerSocket)factory.createServerSocket()) {
|
||||
//
|
||||
// Check the default cipher suites of SSLServerSocket.
|
||||
//
|
||||
System.out.println(
|
||||
"Checking SSLServerSocket default cipher suites ...");
|
||||
checkEnabledCiphers(socket.getEnabledCipherSuites());
|
||||
|
||||
//
|
||||
// Check the supported cipher suites of SSLServerSocket.
|
||||
//
|
||||
System.out.println(
|
||||
"Checking SSLServerSocket supported cipher suites ...");
|
||||
checkSupportedCiphers(socket.getSupportedCipherSuites());
|
||||
}
|
||||
}
|
||||
|
||||
System.out.println("\t... Success");
|
||||
}
|
||||
|
||||
private static void checkEnabledCiphers(
|
||||
String[] ciphers) throws Exception {
|
||||
|
||||
if (ciphers.length == 0) {
|
||||
throw new Exception("No default cipher suites");
|
||||
}
|
||||
|
||||
boolean isMatch = false;
|
||||
if (enabledCipherSuite.isEmpty()) {
|
||||
// Don't check if not specify the expected cipher suite.
|
||||
isMatch = true;
|
||||
}
|
||||
|
||||
boolean isBroken = false;
|
||||
for (String cipher : ciphers) {
|
||||
System.out.println("\tdefault cipher suite " + cipher);
|
||||
if (!enabledCipherSuite.isEmpty() &&
|
||||
cipher.equals(enabledCipherSuite)) {
|
||||
isMatch = true;
|
||||
}
|
||||
|
||||
if (!notEnabledCipherSuite.isEmpty() &&
|
||||
cipher.equals(notEnabledCipherSuite)) {
|
||||
isBroken = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!isMatch) {
|
||||
throw new Exception(
|
||||
"Cipher suite " + enabledCipherSuite + " should be enabled");
|
||||
}
|
||||
|
||||
if (isBroken) {
|
||||
throw new Exception(
|
||||
"Cipher suite " + notEnabledCipherSuite + " should not be enabled");
|
||||
}
|
||||
}
|
||||
|
||||
private static void checkSupportedCiphers(
|
||||
String[] ciphers) throws Exception {
|
||||
|
||||
if (ciphers.length == 0) {
|
||||
throw new Exception("No supported cipher suites");
|
||||
}
|
||||
|
||||
boolean hasEnabledCipherSuite = enabledCipherSuite.isEmpty();
|
||||
boolean hasNotEnabledCipherSuite = notEnabledCipherSuite.isEmpty();
|
||||
for (String cipher : ciphers) {
|
||||
System.out.println("\tsupported cipher suite " + cipher);
|
||||
if (!enabledCipherSuite.isEmpty() &&
|
||||
cipher.equals(enabledCipherSuite)) {
|
||||
hasEnabledCipherSuite = true;
|
||||
}
|
||||
|
||||
if (!notEnabledCipherSuite.isEmpty() &&
|
||||
cipher.equals(notEnabledCipherSuite)) {
|
||||
hasNotEnabledCipherSuite = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!hasEnabledCipherSuite) {
|
||||
throw new Exception(
|
||||
"Cipher suite " + enabledCipherSuite + " should be supported");
|
||||
}
|
||||
|
||||
if (!hasNotEnabledCipherSuite) {
|
||||
throw new Exception(
|
||||
"Cipher suite " + notEnabledCipherSuite + " should not be enabled");
|
||||
}
|
||||
}
|
||||
|
||||
private static String trimQuotes(String candidate) {
|
||||
if (candidate != null && candidate.length() != 0) {
|
||||
// Remove double quote marks from beginning/end of the string.
|
||||
if (candidate.length() > 1 && candidate.charAt(0) == '"' &&
|
||||
candidate.charAt(candidate.length() - 1) == '"') {
|
||||
return candidate.substring(1, candidate.length() - 1);
|
||||
}
|
||||
}
|
||||
|
||||
return candidate;
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue