...
| Code Block | ||
|---|---|---|
| ||
import java.net.ServerSocket;
import java.net.Socket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
ServerSocket serverSocket = new ServerSocket(10007);
Socket socket = serverSocket.accept();
PrintWriter out = new PrintWriter( socket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
This ?? compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocols.
...
Noncompliant code example
This is a similar the insecure code for the corresponding client application.
| Code Block | ||
|---|---|---|
| ||
import java.io.*;
import java.net.*;
public class EchoClient {
public static void main(String[] args) {
try {
Socket socket = new Socket("localhost", 9999);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
String userInput;
while ((userInput = stdIn.readLine()) != null) {
out.println(userInput);
System.out.println(in.readLine());
}
out.close();
in.close();
stdIn.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
This is the a client application making use of SSLSocketsthat uses SSLSockets for increased security.
| Code Block | ||
|---|---|---|
| ||
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;
public class EchoClient {
public static void main(String[] args) {
try {
SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);
PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
String userInput;
while ((userInput = stdIn.readLine()) != null) {
out.println(userInput);
System.out.println(in.readLine());
}
out.close();
in.close();
stdIn.close();
sslsocket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
...
SEC36-EX2: Notice that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish a connection with through a port using that uses SSL.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] \[[Ware 08|AA. Java References#Ware 08]\] |