1 /* 2 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. 8 * 9 * This code is distributed in the hope that it will be useful, but WITHOUT 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 12 * version 2 for more details (a copy is included in the LICENSE file that 13 * accompanied this code). 14 * 15 * You should have received a copy of the GNU General Public License version 16 * 2 along with this work; if not, write to the Free Software Foundation, 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 18 * 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 20 * or visit www.oracle.com if you need additional information or have any 21 * questions. 22 */ 23 24 /* 25 * @test 26 * @bug 8226374 27 * @library /javax/net/ssl/templates 28 * @summary Restrict signature algorithms and named groups 29 * @run main/othervm RestrictNamedGroup x25519 30 * @run main/othervm RestrictNamedGroup x448 31 * @run main/othervm RestrictNamedGroup secp256r1 32 * @run main/othervm RestrictNamedGroup secp384r1 33 * @run main/othervm RestrictNamedGroup secp521r1 34 * @run main/othervm RestrictNamedGroup ffdhe2048 35 * @run main/othervm RestrictNamedGroup ffdhe3072 36 * @run main/othervm RestrictNamedGroup ffdhe4096 37 * @run main/othervm RestrictNamedGroup ffdhe6144 38 * @run main/othervm RestrictNamedGroup ffdhe8192 39 */ 40 41 import java.security.Security; 42 import java.util.Arrays; 43 import javax.net.ssl.SSLSocket; 44 import javax.net.ssl.SSLServerSocket; 45 import javax.net.ssl.SSLException; 46 47 public class RestrictNamedGroup extends SSLSocketTemplate { 48 49 private static volatile int index; 50 private static final String[][][] protocols = { 51 {{"TLSv1.3"}, {"TLSv1.3"}}, 52 {{"TLSv1.3", "TLSv1.2"}, {"TLSv1.2"}}, 53 {{"TLSv1.3", "TLSv1.2"}, {"TLSv1.2"}}, 54 {{"TLSv1.2"}, {"TLSv1.3", "TLSv1.2"}}, 55 {{"TLSv1.2"}, {"TLSv1.2"}} 56 }; 57 58 // Servers are configured before clients, increment test case after. 59 @Override 60 protected void configureClientSocket(SSLSocket socket) { 61 String[] ps = protocols[index][0]; 62 63 System.out.print("Setting client protocol(s): "); 64 Arrays.stream(ps).forEachOrdered(System.out::print); 65 System.out.println(); 66 67 socket.setEnabledProtocols(ps); 68 socket.setEnabledCipherSuites(new String[] { 69 "TLS_AES_128_GCM_SHA256", 70 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}); 71 } 72 73 @Override 74 protected void configureServerSocket(SSLServerSocket serverSocket) { 75 String[] ps = protocols[index][1]; 76 77 System.out.print("Setting server protocol(s): "); 78 Arrays.stream(ps).forEachOrdered(System.out::print); 79 System.out.println(); 80 81 serverSocket.setEnabledProtocols(ps); 82 serverSocket.setEnabledCipherSuites(new String[] { 83 "TLS_AES_128_GCM_SHA256", 84 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}); 85 } 86 87 /* 88 * Run the test case. 89 */ 90 public static void main(String[] args) throws Exception { 91 Security.setProperty("jdk.tls.disabledAlgorithms", args[0]); 92 System.setProperty("jdk.tls.namedGroups", args[0]); 93 94 for (index = 0; index < protocols.length; index++) { 95 try { 96 (new RestrictNamedGroup()).run(); 97 } catch (SSLException | IllegalStateException ssle) { 98 // The named group should be restricted. 99 continue; 100 } 101 102 throw new Exception("The test case should be disabled"); 103 } 104 } 105 }