CoCalc -- CheckCipherSuites.java

GitHub Repository: PojavLauncherTeam/mobile
Path: blob/master/test/jdk/javax/net/ssl/sanity/ciphersuites/CheckCipherSuites.java
⁴¹¹⁵⁵ views
1
/*
2
 * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4
 *
5
 * This code is free software; you can redistribute it and/or modify it
6
 * under the terms of the GNU General Public License version 2 only, as
7
 * published by the Free Software Foundation.
8
 *
9
 * This code is distributed in the hope that it will be useful, but WITHOUT
10
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12
 * version 2 for more details (a copy is included in the LICENSE file that
13
 * accompanied this code).
14
 *
15
 * You should have received a copy of the GNU General Public License version
16
 * 2 along with this work; if not, write to the Free Software Foundation,
17
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18
 *
19
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20
 * or visit www.oracle.com if you need additional information or have any
21
 * questions.
22
 */
23

24
/*
25
 * @test
26
 * @bug 4750141 4895631 8217579 8163326
27
 * @summary Check enabled and supported ciphersuites are correct
28
 * @run main/othervm CheckCipherSuites default
29
 * @run main/othervm CheckCipherSuites limited
30
 */
31

32
import java.util.*;
33
import java.security.Security;
34
import javax.net.ssl.*;
35

36
public class CheckCipherSuites {
37

38
    // List of enabled cipher suites when the "crypto.policy" security
39
    // property is set to "unlimited" (the default value).
40
    private final static String[] ENABLED_DEFAULT = {
41
        // TLS 1.3 cipher suites
42
        "TLS_AES_256_GCM_SHA384",
43
        "TLS_AES_128_GCM_SHA256",
44
        "TLS_CHACHA20_POLY1305_SHA256",
45

46
        // Suite B compliant cipher suites
47
        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
48
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
49

50
        // Not suite B, but we want it to position the suite early
51
        "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
52

53
        // AES_256(GCM) - ECDHE - forward screcy
54
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
55
        "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
56

57
        // AES_128(GCM) - ECDHE - forward screcy
58
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
59

60
        // AES_256(GCM) - DHE - forward screcy
61
        "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
62
        "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
63
        "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
64

65
        // AES_128(GCM) - DHE - forward screcy
66
        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
67
        "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
68

69
        // AES_256(CBC) - ECDHE - forward screcy
70
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
71
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
72

73
        // AES_256(CBC) - ECDHE - forward screcy
74
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
75
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
76

77
        // AES_256(CBC) - DHE - forward screcy
78
        "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
79
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
80

81
        // AES_128(CBC) - DHE - forward screcy
82
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
83
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
84

85
        // AES_256(GCM) - not forward screcy
86
        "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
87
        "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
88

89
        // AES_128(GCM) - not forward screcy
90
        "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
91
        "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
92

93
        // AES_256(CBC) - not forward screcy
94
        "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
95
        "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
96

97
        // AES_128(CBC) - not forward screcy
98
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
99
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
100

101
        // AES_256(CBC) - ECDHE - using SHA
102
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
103
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
104

105
        // AES_128(CBC) - ECDHE - using SHA
106
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
107
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
108

109
        // AES_256(CBC) - DHE - using SHA
110
        "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
111
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
112

113
        // AES_128(CBC) - DHE - using SHA
114
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
115
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
116

117
        // AES_256(CBC) - using SHA, not forward screcy
118
        "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
119
        "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
120

121
        // AES_128(CBC) - using SHA, not forward screcy
122
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
123
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
124

125
        // deprecated
126
        "TLS_RSA_WITH_AES_256_GCM_SHA384",
127
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
128
        "TLS_RSA_WITH_AES_256_CBC_SHA256",
129
        "TLS_RSA_WITH_AES_128_CBC_SHA256",
130
        "TLS_RSA_WITH_AES_256_CBC_SHA",
131
        "TLS_RSA_WITH_AES_128_CBC_SHA",
132
        "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
133
    };
134

135
    // List of enabled cipher suites when the "crypto.policy" security
136
    // property is set to "limited".
137
    private final static String[] ENABLED_LIMITED = {
138
        "TLS_AES_128_GCM_SHA256",
139
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
140
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
141
        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
142
        "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
143
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
144
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
145
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
146
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
147
        "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
148
        "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
149
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
150
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
151
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
152
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
153
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
154
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
155
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
156
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
157
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
158
        "TLS_RSA_WITH_AES_128_CBC_SHA256",
159
        "TLS_RSA_WITH_AES_128_CBC_SHA",
160
        "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
161
    };
162

163
    // List of supported cipher suites when the "crypto.policy" security
164
    // property is set to "unlimited" (the default value).
165
    private final static String[] SUPPORTED_DEFAULT = {
166
        // TLS 1.3 cipher suites
167
        "TLS_AES_256_GCM_SHA384",
168
        "TLS_AES_128_GCM_SHA256",
169
        "TLS_CHACHA20_POLY1305_SHA256",
170

171
        // Suite B compliant cipher suites
172
        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
173
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
174

175
        // Not suite B, but we want it to position the suite early
176
        "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
177

178
        // AES_256(GCM) - ECDHE - forward screcy
179
        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
180
        "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
181

182
        // AES_128(GCM) - ECDHE - forward screcy
183
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
184

185
        // AES_256(GCM) - DHE - forward screcy
186
        "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
187
        "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
188
        "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
189

190
        // AES_128(GCM) - DHE - forward screcy
191
        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
192
        "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
193

194
        // AES_256(CBC) - ECDHE - forward screcy
195
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
196
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
197

198
        // AES_256(CBC) - ECDHE - forward screcy
199
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
200
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
201

202
        // AES_256(CBC) - DHE - forward screcy
203
        "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
204
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
205

206
        // AES_128(CBC) - DHE - forward screcy
207
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
208
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
209

210
        // AES_256(GCM) - not forward screcy
211
        "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
212
        "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
213

214
        // AES_128(GCM) - not forward screcy
215
        "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
216
        "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
217

218
        // AES_256(CBC) - not forward screcy
219
        "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
220
        "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
221

222
        // AES_128(CBC) - not forward screcy
223
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
224
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
225

226
        // AES_256(CBC) - ECDHE - using SHA
227
        "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
228
        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
229

230
        // AES_128(CBC) - ECDHE - using SHA
231
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
232
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
233

234
        // AES_256(CBC) - DHE - using SHA
235
        "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
236
        "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
237

238
        // AES_128(CBC) - DHE - using SHA
239
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
240
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
241

242
        // AES_256(CBC) - using SHA, not forward screcy
243
        "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
244
        "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
245

246
        // AES_128(CBC) - using SHA, not forward screcy
247
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
248
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
249

250
        // deprecated
251
        "TLS_RSA_WITH_AES_256_GCM_SHA384",
252
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
253
        "TLS_RSA_WITH_AES_256_CBC_SHA256",
254
        "TLS_RSA_WITH_AES_128_CBC_SHA256",
255
        "TLS_RSA_WITH_AES_256_CBC_SHA",
256
        "TLS_RSA_WITH_AES_128_CBC_SHA",
257
        "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
258
    };
259

260
    // List of supported cipher suites when the "crypto.policy" security
261
    // property is set to "limited".
262
    private final static String[] SUPPORTED_LIMITED = {
263
        "TLS_AES_128_GCM_SHA256",
264
        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
265
        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
266
        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
267
        "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
268
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
269
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
270
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
271
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
272
        "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
273
        "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
274
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
275
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
276
        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
277
        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
278
        "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
279
        "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
280
        "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
281
        "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
282
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
283
        "TLS_RSA_WITH_AES_128_CBC_SHA256",
284
        "TLS_RSA_WITH_AES_128_CBC_SHA",
285
        "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
286
    };
287

288
    private static void showSuites(String[] suites) {
289
        if ((suites == null) || (suites.length == 0)) {
290
            System.out.println("<none>");
291
        }
292
        for (int i = 0; i < suites.length; i++) {
293
            System.out.println("  " + suites[i]);
294
        }
295
    }
296

297
    public static void main(String[] args) throws Exception {
298
        long start = System.currentTimeMillis();
299

300
        if (args.length != 1) {
301
            throw new Exception("One arg required");
302
        }
303

304
        String[] ENABLED;
305
        String[] SUPPORTED;
306
        if (args[0].equals("default")) {
307
            ENABLED = ENABLED_DEFAULT;
308
            SUPPORTED = SUPPORTED_DEFAULT;
309
        } else if (args[0].equals("limited")) {
310
            Security.setProperty("crypto.policy", "limited");
311
            ENABLED = ENABLED_LIMITED;
312
            SUPPORTED = SUPPORTED_LIMITED;
313
        } else {
314
            throw new Exception("Illegal argument");
315
        }
316

317
        SSLSocketFactory factory =
318
                (SSLSocketFactory)SSLSocketFactory.getDefault();
319
        SSLSocket socket = (SSLSocket)factory.createSocket();
320
        String[] enabled = socket.getEnabledCipherSuites();
321

322
        System.out.println("Default enabled ciphersuites:");
323
        showSuites(enabled);
324

325
        if (Arrays.equals(ENABLED, enabled) == false) {
326
            System.out.println("*** MISMATCH, should be ***");
327
            showSuites(ENABLED);
328
            throw new Exception("Enabled ciphersuite mismatch");
329
        }
330
        System.out.println("OK");
331
        System.out.println();
332

333
        String[] supported = socket.getSupportedCipherSuites();
334
        System.out.println("Supported ciphersuites:");
335
        showSuites(supported);
336

337
        if (Arrays.equals(SUPPORTED, supported) == false) {
338
            System.out.println("*** MISMATCH, should be ***");
339
            showSuites(SUPPORTED);
340
            throw new Exception("Supported ciphersuite mismatch");
341
        }
342
        System.out.println("OK");
343

344
        long end = System.currentTimeMillis();
345
        System.out.println("Done (" + (end - start) + " ms).");
346
    }
347
}
348

349
Product

Resources

Company
