Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#CCCCFF
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;

public class EchoServer {
  public static void main(String[] args) {
    try {
      SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
            
      String inputLine; 
            
      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
	out.println(inputLine); 
      } 
			
      out.close(); 
      in.close(); 
      sslsocket.close(); 
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

public class EchoClient {
  public static void main(String[] args) {
    try {
      SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
            
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      sslsocket.close();		
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Note that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish a connection through a port that uses SSL.

Risk assesment

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

SEC12-J

medium

likely

high

P4

L3

...

SEC36-EX1: Because of all the mechanisms that SSLSockets provides provide to ensure the secure transfer of packets, significant performance overhead can be incurred. If no sensitive information is being transmitted, or the channel used is not prone to attacks, the implementation of regular Sockets should be sufficient. SEC36-EX2: Notice that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish a connection through a port that uses SSL is sufficient.

References

Wiki Markup
\[[API 06|AA. Java References#API 06]\] 
\[[Ware 08|AA. Java References#Ware 08]\]