Wiki MarkupAs suggested by \[[Ware|AA. Java References#Ware 08]\], instances from the class {{Programs must use the javax.net.ssl.SSLSocket}} should be created instead of normal Sockets when transferring objects over communication channels. {{SSLSockets}} provide a layer of security protocols such as SSL or TLS.

According to \[[Java API|AA. Java References#API 06]\] , the principal protections included in {{SSLSockets}} that are not provided by the {{Socket}} class are:

class rather than the java.net.Socket class when transferring sensitive data over insecure communication channels. The class SSLSocket provides security protocols such as Secure Sockets Layer/Transport Layer Security (SSL/TLS) to ensure that the channel is not vulnerable to eavesdropping and malicious tampering.

The principal protections included in SSLSocket that are not provided by the Socket class are [API 2014]:

• Integrity Protection: Integrity Protection. SSL protects against modification of messages by an active wiretapper.
• Authentication. : In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
• Confidentiality (Privacy Protectionprivacy protection). : In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data , so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.

It is also important to use SSL for secure remote method invocation (RMI) communications because RMI depends on object serialization, and serialized data must be safeguarded in transit. Gong, Ellison, and Dageforde [Gong 2003] describe how to secure RMI communications using SSLSocket.

Note that this rule lacks any assumptions about the integrity of the data being sent down a socket. For information about ensuring data integrity, see SER02-J. Sign then seal objects before sending them outside a trust boundary.

Noncompliant

...

Code Example

This noncompliant code example shows the use of regular Sockets sockets for a server application . Using this kind of Sockets does not that fails to protect sensitive information while being in transit. The insecure code for the corresponding client application follows the server's code.

import java.net.ServerSocket;
import java.net.Socket;
import java.io.*; 

public   
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) throws IOException {
    ServerSocket serverSocket = null;
    try { 
      ServerSocket serverSocket = new ServerSocket(100079999); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter( socket.getOutputStream(), true); 
      BufferedReader in = new BufferedReader(
          new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      }
   

 } finally {
      if out.close(); (serverSocket != null) {
      in.close();   try {
      socket    serverSocket.close();
  
    }
  }  catch (ExceptionIOException ex) {
  
        //* Handle exception*/error
        }
   
   }
}

Compliant solution

This is a better solution to the previous example, making use of SSLSockets. By doing so, packets are protected with SSL and TLS security protocols.

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;

public class EchoServer    }
  }
}

class EchoClient {
  public static void main(String[] args) {
    try {
                   SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
  throws UnknownHostException, IOException {
    SSLServerSocketSocket sslserversocketsocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999)null;
    try {
  SSLSocket    sslsocketsocket = (SSLSocket) sslserversocket.accept();
new Socket("localhost", 9999);
      PrintWriter out = new PrintWriter( sslsocketsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
          new InputStreamReader( sslsocketsocket.getInputStream()));
      BufferedReader stdIn = new   BufferedReader(
      String inputLine; 
  new InputStreamReader(System.in));
      String   userInput;
      while ((inputLineuserInput = instdIn.readLine()) != null) { 
        System.out.println (inputLineuserInput); 
	
        System.out.println(inputLinein.readLine()); 
      } 
			    } finally {
      out.close(); 
if (socket != null) {
       in.close(); 
 try {
        sslsocket  socket.close(); 
    } 
   } catch (ExceptionIOException ex) {
   
       //* Handle exception*/
error
        }
      }
    }
  }

Noncompliant code example

}

Note that the sockets are properly closed in accordance with ERR05-J. Do not let checked exceptions escape from a finally block.

Compliant Solution

This compliant solution uses SSLSocket to protect packets using the SSL/TLS security protocols:This is a similar insecure code for the client application.

// Exception handling has been omitted for the sake of brevity
class EchoServer
import java.io.*;
import java.net.*;

public class EchoClient {
  public static void main(String[] args) throws IOException {
    SSLServerSocket sslServerSocket = null;
    try {
      SocketSSLServerSocketFactory socketsslServerSocketFactory = new Socket("localhost", 9999);
						
          (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      sslServerSocket = (SSLServerSocket) sslServerSocketFactory.
                        createServerSocket(9999);
      SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept();
      PrintWriter out = new PrintWriter(socketsslSocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(new InputStreamReader(SystemsslSocket.ingetInputStream()));
			
      String userInputinputLine;

      while ((userInputinputLine = stdInin.readLine()) != null) { 
        System.out.println(userInputinputLine);
	System. 
        out.println(in.readLine()inputLine); 
      } 

    }  out.close();finally {
      in.close();if (sslServerSocket != null) {
      stdIn.close();
  try {
          socketsslServerSocket.close();
     }
   } catch (ExceptionIOException ex) {
    
      /*/ Handle exception*/
error
        }
   
   }
}

Compliant solution

This is the client application making use of SSLSockets.

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

public     }
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException {
    SSLSocket sslSocket = null;
    try {
      SSLSocketFactory sslsocketfactorysslSocketFactory =
          (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket =sslSocket = 
          (SSLSocket) sslsocketfactorysslSocketFactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocketsslSocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(
          new InputStreamReader(sslsocketsslSocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
            new InputStreamReader(System.in));
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	        System.out.println(in.readLine());
      }

    }  out.close();
finally {
      if in.close();
(sslSocket != null) {
        stdIn.close();
try {
        sslsocket  sslSocket.close();		
    } 
   } catch (ExceptionIOException ex) {
    
      /*/ Handle exception*/
error
        }
      }
    }
  }

Risk assesment

Exceptions

}

Programs that use SSLSocket will block indefinitely if they attempt to connect to a port that is not using SSL. Similarly, a program that does not use SSLSocket will block when attempting to establish a connection through a port that does use SSL.

Note that SSLSocket does not validate host names, so providing an arbitrary host name to an SSLSocket is still vulnerable to a man-in-the-middle attack. Host names should be validated separately. The HttpsURLConnection class validates host names and is a suitable solution for secure web sockets.

Exceptions

MSC00-J-EX0: Because of the mechanisms that SSLSocket provides SEC36-EX1: Due to all the mechanisms that SSLSockets provide to ensure the secure transfer of packets, a significant decay in performance could be perceived. If no sensitive information is being transmitted, or the channel used is not prone to attacks, the implementation of regular Sockets should be sufficient.

SEC36-EX2: Notice that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish connection with a port using SSL.

References

performance overhead may result. Regular sockets are sufficient under the following circumstances:

• The data being sent over the socket is not sensitive.
• The data is sensitive but properly encrypted (see SER02-J. Sign then seal objects before sending them outside a trust boundary for more information).
• The network path of the socket never crosses a trust boundary. This could happen when, for example, the two endpoints of the socket are within the same local network and the entire network is trusted.

Risk Assessment

Use of plain sockets fails to provide any guarantee of the confidentiality and integrity of data transmitted over those sockets.

Automated Detection

The general case of automated detection appears to be infeasible because determining which specific data may be passed through the socket is not statically computable. An approach that introduces a custom API for passing sensitive data via secure sockets may be feasible. User tagging of sensitive data is a necessary requirement for such an approach.

Related Guidelines

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[API 06|AA. Java References#API 06]\] \[[Ware 08|AA. Java References#Ware 08]\]