...
According to Java API 1.4.2, the principal protections included in SSLSockets that are not provided by the Socket class are: â¢
- Integrity Protection. SSL protects against modification of messages by an active wiretapper.
...
- Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
...
- Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.
Noncompliant code example
...
TODO
Compliant solution
...
Code for the server side, using Sockets.
| Code Block | ||
|---|---|---|
| ||
import java.net.ServerSocket;
import java.net.Socket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
ServerSocket serverSocket = new ServerSocket(10007);
Socket socket = serverSocket.accept();
PrintWriter out = new PrintWriter( socket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
Code for the server side, using SSLSockets.
| Code Block |
|---|
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();
PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
sslsocket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Noncompliant code example
Code for the client side, using Sockets.
| Code Block | ||
|---|---|---|
| ||
import java.io.*;
import java.net.*;
public class EchoClient {
public static void main(String[] args) {
try {
Socket socket = new Socket("localhost", 9999);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
String userInput;
while ((userInput = stdIn.readLine()) != null) {
out.println(userInput);
System.out.println(in.readLine());
}
out.close();
in.close();
stdIn.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
Code for the client side, using SSLSockets.
| Code Block |
|---|
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;
public class EchoClient {
public static void main(String[] args) {
try {
SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);
PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
String userInput;
while ((userInput = stdIn.readLine()) != null) {
out.println(userInput);
System.out.println(in.readLine());
}
out.close();
in.close();
stdIn.close();
sslsocket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
References
TODO