The Programs must use the javax.net.ssl.SSLSocket class must be used instead of rather than the java.net.Socket class when transferring sensitive data over insecure communication channels. The class SSLSockets SSLSocket provides security protocols such as Secure Sockets Layer/Transport Layer Security (SSL/TLS) to ensure that the channel is not vulnerable to eavesdropping and malicious tampering.

The principal protections included in {{SSLSocketsSSLSocket}} that are not provided by the {{Socket}} class are \[[Java API|AA. Bibliography#API 06]\]:

• Integrity Protection. : SSL protects against modification of messages by an active wiretapper.
• Authentication. : In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
• Confidentiality (Privacy Protectionprivacy protection). : In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data , so that passive wiretappers won't see cannot observe sensitive data such as financial information or personal information of many kinds.

It is also important to use SSL for secure remote method invocation (RMI) communications because RMI depends on object serialization, and serialized data must be safeguarded in transit. Gong, et al.Ellison, and Dageforde \[[Gong 2003|AA. Bibliography#Gong 03]\] describe how to secure RMI communications using {{SSLSocketsSSLSocket}}.

Note that this rule makes no lacks any assumptions about the integrity of the data being sent down a socket. For information about ensuring data integrity, see rule SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary.

Noncompliant Code Example

This noncompliant code example shows the use of regular sockets for a server application that does not fails to protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code.

  
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) throws IOException {
    ServerSocket serverSocket = null;
    try {
      serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true); 
      BufferedReader in = new BufferedReader(
                  new InputStreamReader(socket.getInputStream())); 
      String inputLine; 
      while ((inputLine = in.readLine()) != null) { 
        System.out.println(inputLine); 
        out.println(inputLine); 
      }
    } finally {
      if (serverSocket != null) {
        try {
          serverSocket.close();
        } catch (IOException x) {
          // handle error
        }
      }
    }
  }
}

class EchoClient {
  public static void main(String[] args) 
                          throws UnknownHostException, IOException {
    Socket socket = null;
    try {
      socket = new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
                  new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(
                   new InputStreamReader(System.in));
			
      String userInput;
      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
        System.out.println(in.readLine());
      } 

    } finally {
      if (socket != null) {
        try {
          socket.close();
        } catch (IOException x) {
          // handle error
        }
      }
    }
  }
}

Note that the sockets are properly closed in accordance with rule ERR05-J. Do not let checked exceptions escape from a finally block. While merely Although simply printing close out exceptions is frowned uponthrown while closing a socket is poor practice, the exceptions may be suppressed as per exception ERR00-EX0 of ERR00-J. Do not suppress or ignore checked exceptions.

Compliant Solution

This compliant solution makes use of SSLSockets uses SSLSocket to protect packets using the SSL/TLS security protocols.

// Exception handling has been omitted for the sake of brevity
class EchoServer {
  public static void main(String[] args) throws IOException {
    SSLServerSocket sslServerSocket = null;
    try {
      SSLServerSocketFactory sslServerSocketFactory =
          (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      sslServerSocket = 
          (SSLServerSocket) sslServerSocketFactory.createServerSocket(9999);
      SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();

      PrintWriter out = new PrintWriter(sslSocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(
                  new InputStreamReader(sslSocket.getInputStream()));
      
      String inputLine;       
      while ((inputLine = in.readLine()) != null) { 
        System.out.println(inputLine); 
        out.println(inputLine); 
      } 

    } finally {
      if (sslServerSocket != null) {
        try {
          sslServerSocket.close();
        } catch (IOException x) {
          // handle error
        }
      }
    }
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException {
    SSLSocket sslSocket = null;
    try {
      SSLSocketFactory sslSocketFactory =
          (SSLSocketFactory) SSLSocketFactory.getDefault();
      sslSocket = 
          (SSLSocket) sslSocketFactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslSocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
                  new InputStreamReader(sslSocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(
                   new InputStreamReader(System.in));
      
      String userInput;
      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
        System.out.println(in.readLine());
      }
    } finally {
      } finallyif (sslSocket != null) {
        try {
          sslSocket.close();
        } catch (IOException x) {
          // handle error
        }
      }
    }
  }
}

Programs that use SSLSocket Note that a program that makes use of SSLSockets will block indefinitely if it tries they attempt to connect to a port that is not using SSL. Similarly, a program that does not use SSLSockets SSLSocket will block when trying attempting to establish a connection through a port that uses does use SSL.

Exceptions

MSC00-EX0: Because of the mechanisms that SSLSockets SSLSocket provide to ensure the secure transfer of packets, significant performance overhead may result. Regular sockets are sufficient ifwhen

• the data being sent over the socket is not sensitive.
• the data is sensitive, but properly encrypted. See rule SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary for more information.
• the network path of the socket never crosses a trust boundary. This could happen ifwhen, for example, the two endpoings endpoints of the socket are within a the same local network and the entire network is trusted.

Risk Assessment

Using Use of plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not guaranteedfails to provide any guarantee of the confidentiality and integrity of data transmitted over those sockets.

...

Related Guidelines

Bibliography

...