1 /* 2 * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. 8 * 9 * This code is distributed in the hope that it will be useful, but WITHOUT 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 12 * version 2 for more details (a copy is included in the LICENSE file that 13 * accompanied this code). 14 * 15 * You should have received a copy of the GNU General Public License version 16 * 2 along with this work; if not, write to the Free Software Foundation, 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 18 * 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 20 * or visit www.oracle.com if you need additional information or have any 21 * questions. 22 */ 23 24 /* 25 * @test 26 * @bug 8064546 27 * @summary Throw exceptions during reading but not closing of a 28 * CipherInputStream: 29 * - Make sure authenticated algorithms continue to throwing exceptions 30 * when the authentication tag fails verification. 31 * - Make sure other algorithms do not throw exceptions when the stream 32 * calls close() and only throw when read() errors. 33 */ 34 35 import java.io.ByteArrayInputStream; 36 import java.io.IOException; 37 import java.lang.Exception; 38 import java.lang.RuntimeException; 39 import java.lang.Throwable; 40 import java.security.AlgorithmParameters; 41 import javax.crypto.AEADBadTagException; 42 import javax.crypto.Cipher; 43 import javax.crypto.CipherInputStream; 44 import javax.crypto.IllegalBlockSizeException; 45 import javax.crypto.spec.IvParameterSpec; 46 import javax.crypto.spec.SecretKeySpec; 47 import javax.crypto.spec.GCMParameterSpec; 48 49 public class CipherInputStreamExceptions { 50 51 static SecretKeySpec key = new SecretKeySpec(new byte[16], "AES"); 52 static GCMParameterSpec gcmspec = new GCMParameterSpec(128, new byte[16]); 53 static IvParameterSpec iv = new IvParameterSpec(new byte[16]); 54 static boolean failure = false; 55 56 /* Full read stream, check that getMoreData() is throwing an exception 57 * This test 58 * 1) Encrypt 100 bytes with AES/GCM/PKCS5Padding 59 * 2) Changes the last byte to invalidate the authetication tag. 60 * 3) Fully reads CipherInputStream to decrypt the message and closes 61 */ 62 63 static void gcm_AEADBadTag() throws Exception { 64 Cipher c; 65 byte[] read = new byte[200]; 66 67 System.out.println("Running gcm_AEADBadTag"); 68 69 // Encrypt 100 bytes with AES/GCM/PKCS5Padding 70 byte[] ct = encryptedText("GCM", 100); 71 // Corrupt the encrypted message 72 ct = corruptGCM(ct); 73 // Create stream for decryption 74 CipherInputStream in = getStream("GCM", ct); 75 76 try { 77 int size = in.read(read); 78 throw new RuntimeException("Fail: CipherInputStream.read() " + 79 "returned " + size + " and didn't throw an exception."); 80 } catch (IOException e) { 81 Throwable ec = e.getCause(); 82 if (ec instanceof AEADBadTagException) { 83 System.out.println(" Pass."); 84 } else { 85 System.out.println(" Fail: " + ec.getMessage()); 86 throw new RuntimeException(ec); 87 } 88 } finally { 89 in.close(); 90 } 91 } 92 93 /* Short read stream, 94 * This test 95 * 1) Encrypt 100 bytes with AES/GCM/PKCS5Padding 96 * 2) Reads 100 bytes from stream to decrypt the message and closes 97 * 3) Make sure no value is returned by read() 98 * 4) Make sure no exception is thrown 99 */ 100 101 static void gcm_shortReadAEAD() throws Exception { 102 Cipher c; 103 byte[] read = new byte[100]; 104 105 System.out.println("Running gcm_shortReadAEAD"); 106 107 byte[] pt = new byte[600]; 108 pt[0] = 1; 109 // Encrypt provided 600 bytes with AES/GCM/PKCS5Padding 110 byte[] ct = encryptedText("GCM", pt); 111 // Create stream for decryption 112 CipherInputStream in = getStream("GCM", ct); 113 114 int size = 0; 115 try { 116 size = in.read(read); 117 in.close(); 118 if (read.length != 100) { 119 throw new RuntimeException("Fail: read size = " + read.length + 120 "should be 100."); 121 } 122 if (read[0] != 1) { 123 throw new RuntimeException("Fail: The decrypted text does " + 124 "not match the plaintext: '" + read[0] +"'"); 125 } 126 } catch (IOException e) { 127 System.out.println(" Fail: " + e.getMessage()); 128 throw new RuntimeException(e.getCause()); 129 } 130 System.out.println(" Pass."); 131 } 132 133 /* 134 * Verify doFinal() exception is suppressed when input stream is not 135 * read before it is closed. 136 * This test: 137 * 1) Encrypt 100 bytes with AES/GCM/PKCS5Padding 138 * 2) Changes the last byte to invalidate the authetication tag. 139 * 3) Opens a CipherInputStream and the closes it. Never reads from it. 140 * 141 * There should be no exception thrown. 142 */ 143 static void gcm_suppressUnreadCorrupt() throws Exception { 144 Cipher c; 145 byte[] read = new byte[200]; 146 147 System.out.println("Running supressUnreadCorrupt test"); 148 149 // Encrypt 100 bytes with AES/GCM/PKCS5Padding 150 byte[] ct = encryptedText("GCM", 100); 151 // Corrupt the encrypted message 152 ct = corruptGCM(ct); 153 // Create stream for decryption 154 CipherInputStream in = getStream("GCM", ct); 155 156 try { 157 in.close(); 158 System.out.println(" Pass."); 159 } catch (IOException e) { 160 System.out.println(" Fail: " + e.getMessage()); 161 throw new RuntimeException(e.getCause()); 162 } 163 } 164 165 /* 166 * Verify noexception thrown when 1 byte is read from a GCM stream 167 * and then closed 168 * This test: 169 * 1) Encrypt 100 bytes with AES/GCM/PKCS5Padding 170 * 2) Read one byte from the stream, expect no exception thrown. 171 * 4) Close stream,expect no exception thrown. 172 */ 173 static void gcm_oneReadByte() throws Exception { 174 175 System.out.println("Running gcm_oneReadByte test"); 176 177 // Encrypt 100 bytes with AES/GCM/PKCS5Padding 178 byte[] ct = encryptedText("GCM", 100); 179 // Create stream for decryption 180 CipherInputStream in = getStream("GCM", ct); 181 182 try { 183 in.read(); 184 System.out.println(" Pass."); 185 } catch (Exception e) { 186 System.out.println(" Fail: " + e.getMessage()); 187 throw new RuntimeException(e.getCause()); 188 } 189 } 190 191 /* 192 * Verify exception thrown when 1 byte is read from a corrupted GCM stream 193 * and then closed 194 * This test: 195 * 1) Encrypt 100 bytes with AES/GCM/PKCS5Padding 196 * 2) Changes the last byte to invalidate the authetication tag. 197 * 3) Read one byte from the stream, expect exception thrown. 198 * 4) Close stream,expect no exception thrown. 199 */ 200 static void gcm_oneReadByteCorrupt() throws Exception { 201 202 System.out.println("Running gcm_oneReadByteCorrupt test"); 203 204 // Encrypt 100 bytes with AES/GCM/PKCS5Padding 205 byte[] ct = encryptedText("GCM", 100); 206 // Corrupt the encrypted message 207 ct = corruptGCM(ct); 208 // Create stream for decryption 209 CipherInputStream in = getStream("GCM", ct); 210 211 try { 212 in.read(); 213 System.out.println(" Fail. No exception thrown."); 214 } catch (IOException e) { 215 Throwable ec = e.getCause(); 216 if (ec instanceof AEADBadTagException) { 217 System.out.println(" Pass."); 218 } else { 219 System.out.println(" Fail: " + ec.getMessage()); 220 throw new RuntimeException(ec); 221 } 222 } 223 } 224 225 /* Check that close() does not throw an exception with full message in 226 * CipherInputStream's ibuffer. 227 * This test: 228 * 1) Encrypts a 97 byte message with AES/CBC/PKCS5Padding 229 * 2) Create a stream that sends 96 bytes. 230 * 3) Read stream once, 231 * 4) Close and expect no exception 232 */ 233 234 static void cbc_shortStream() throws Exception { 235 Cipher c; 236 AlgorithmParameters params; 237 byte[] read = new byte[200]; 238 239 System.out.println("Running cbc_shortStream"); 240 241 // Encrypt 97 byte with AES/CBC/PKCS5Padding 242 byte[] ct = encryptedText("CBC", 97); 243 // Create stream with only 96 bytes of encrypted data 244 CipherInputStream in = getStream("CBC", ct, 96); 245 246 try { 247 int size = in.read(read); 248 in.close(); 249 if (size != 80) { 250 throw new RuntimeException("Fail: CipherInputStream.read() " + 251 "returned " + size + ". Should have been 80"); 252 } 253 System.out.println(" Pass."); 254 } catch (IOException e) { 255 System.out.println(" Fail: " + e.getMessage()); 256 throw new RuntimeException(e.getCause()); 257 } 258 } 259 260 /* Check that close() does not throw an exception when the whole message is 261 * inside the internal buffer (ibuffer) in CipherInputStream and we read 262 * one byte and close the stream. 263 * This test: 264 * 1) Encrypts a 400 byte message with AES/CBC/PKCS5Padding 265 * 2) Read one byte from the stream 266 * 3) Close and expect no exception 267 */ 268 269 static void cbc_shortRead400() throws Exception { 270 System.out.println("Running cbc_shortRead400"); 271 272 // Encrypt 400 byte with AES/CBC/PKCS5Padding 273 byte[] ct = encryptedText("CBC", 400); 274 // Create stream with encrypted data 275 CipherInputStream in = getStream("CBC", ct); 276 277 try { 278 in.read(); 279 in.close(); 280 System.out.println(" Pass."); 281 } catch (IOException e) { 282 System.out.println(" Fail: " + e.getMessage()); 283 throw new RuntimeException(e.getCause()); 284 } 285 } 286 287 /* Check that close() does not throw an exception when the inside the 288 * internal buffer (ibuffer) in CipherInputStream does not contain the 289 * whole message. 290 * This test: 291 * 1) Encrypts a 600 byte message with AES/CBC/PKCS5Padding 292 * 2) Read one byte from the stream 293 * 3) Close and expect no exception 294 */ 295 296 static void cbc_shortRead600() throws Exception { 297 System.out.println("Running cbc_shortRead600"); 298 299 // Encrypt 600 byte with AES/CBC/PKCS5Padding 300 byte[] ct = encryptedText("CBC", 600); 301 // Create stream with encrypted data 302 CipherInputStream in = getStream("CBC", ct); 303 304 try { 305 in.read(); 306 in.close(); 307 System.out.println(" Pass."); 308 } catch (IOException e) { 309 System.out.println(" Fail: " + e.getMessage()); 310 throw new RuntimeException(e.getCause()); 311 } 312 } 313 314 /* Check that exception is thrown when message is fully read 315 * This test: 316 * 1) Encrypts a 96 byte message with AES/CBC/PKCS5Padding 317 * 2) Create a stream that sends 95 bytes. 318 * 3) Read stream to the end 319 * 4) Expect IllegalBlockSizeException thrown 320 */ 321 322 static void cbc_readAllIllegalBlockSize() throws Exception { 323 byte[] read = new byte[200]; 324 325 System.out.println("Running cbc_readAllIllegalBlockSize test"); 326 327 // Encrypt 96 byte with AES/CBC/PKCS5Padding 328 byte[] ct = encryptedText("CBC", 96); 329 // Create a stream with only 95 bytes of encrypted data 330 CipherInputStream in = getStream("CBC", ct, 95); 331 332 try { 333 int s, size = 0; 334 while ((s = in.read(read)) != -1) { 335 size += s; 336 } 337 throw new RuntimeException("Fail: No IllegalBlockSizeException. " + 338 "CipherInputStream.read() returned " + size); 339 340 } catch (IOException e) { 341 Throwable ec = e.getCause(); 342 if (ec instanceof IllegalBlockSizeException) { 343 System.out.println(" Pass."); 344 } else { 345 System.out.println(" Fail: " + ec.getMessage()); 346 throw new RuntimeException(ec); 347 } 348 } 349 } 350 351 /* Generic method to create encrypted text */ 352 static byte[] encryptedText(String mode, int length) throws Exception{ 353 return encryptedText(mode, new byte[length]); 354 } 355 356 /* Generic method to create encrypted text */ 357 static byte[] encryptedText(String mode, byte[] pt) throws Exception{ 358 Cipher c; 359 if (mode.compareTo("GCM") == 0) { 360 c = Cipher.getInstance("AES/GCM/PKCS5Padding", "SunJCE"); 361 c.init(Cipher.ENCRYPT_MODE, key, gcmspec); 362 } else if (mode.compareTo("CBC") == 0) { 363 c = Cipher.getInstance("AES/CBC/PKCS5Padding", "SunJCE"); 364 c.init(Cipher.ENCRYPT_MODE, key, iv); 365 } else { 366 return null; 367 } 368 369 return c.doFinal(pt); 370 } 371 372 /* Generic method to get a properly setup CipherInputStream */ 373 static CipherInputStream getStream(String mode, byte[] ct) throws Exception { 374 return getStream(mode, ct, ct.length); 375 } 376 377 /* Generic method to get a properly setup CipherInputStream */ 378 static CipherInputStream getStream(String mode, byte[] ct, int length) 379 throws Exception { 380 Cipher c; 381 382 if (mode.compareTo("GCM") == 0) { 383 c = Cipher.getInstance("AES/GCM/PKCS5Padding", "SunJCE"); 384 c.init(Cipher.DECRYPT_MODE, key, gcmspec); 385 } else if (mode.compareTo("CBC") == 0) { 386 c = Cipher.getInstance("AES/CBC/PKCS5Padding", "SunJCE"); 387 c.init(Cipher.DECRYPT_MODE, key, iv); 388 } else { 389 return null; 390 } 391 392 return new CipherInputStream(new ByteArrayInputStream(ct, 0, length), c); 393 394 } 395 396 /* Generic method for corrupting a GCM message. Change the last 397 * byte on of the authentication tag 398 */ 399 static byte[] corruptGCM(byte[] ct) { 400 ct[ct.length - 1] = (byte) (ct[ct.length - 1] + 1); 401 return ct; 402 } 403 404 public static void main(String[] args) throws Exception { 405 gcm_AEADBadTag(); 406 gcm_shortReadAEAD(); 407 gcm_suppressUnreadCorrupt(); 408 gcm_oneReadByte(); 409 gcm_oneReadByteCorrupt(); 410 cbc_shortStream(); 411 cbc_shortRead400(); 412 cbc_shortRead600(); 413 cbc_readAllIllegalBlockSize(); 414 } 415 }