getRationales()
+ {
+ return rationales;
+ }
+
+ public boolean isInconclusive()
+ {
+ return connectionState == null;
+ }
+
+ /**
+ * Given the configuration of the initiating and receiving server, returns the expected outcome of an outbound
+ * server-to-server connection attempt.
+ *
+ * @param initiatingServer Configuration of the local server
+ * @param receivingServer Configuration of the remote server
+ * @return the expected outcome
+ */
+ public static ExpectedOutcome generateExpectedOutcome(final ServerSettings initiatingServer, final ServerSettings receivingServer) {
+ final ExpectedOutcome expectedOutcome = new ExpectedOutcome();
+
+ switch (initiatingServer.encryptionPolicy) {
+ case disabled: // <-- Initiating server's encryption policy.
+ switch (receivingServer.encryptionPolicy) {
+ case disabled: // Intended fall-through: if one peer disables TLS, it won't be used in any circumstances.
+ case optional:
+ // The certificate status of both peers is irrelevant, as TLS won't happen.
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(NON_ENCRYPTED_WITH_DIALBACK_AUTH, "although TLS is not available (so it cannot be used for encryption or authentication), Dialback is available, which allows the Initiating Entity to be authenticated by the Receiving Entity.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "TLS and Dialback aren't available, making it impossible for the Initiating Entity to be authenticated by the Receiving Entity.");
+ }
+ break;
+ case required:
+ expectedOutcome.set(NO_CONNECTION, "one peer requires encryption while the other disables encryption. This cannot work.");
+ break;
+ }
+ break;
+
+ case optional: // <-- Initiating server's encryption policy.
+ switch (receivingServer.encryptionPolicy) {
+ case disabled:
+ // The certificate status of both peers is irrelevant, as TLS won't happen.
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(NON_ENCRYPTED_WITH_DIALBACK_AUTH, "TLS is not available, so it cannot be used for encryption or authentication. Dialback is available, which allows the Initiating Entity to be authenticated by the Receiving Entity.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "TLS and Dialback aren't available, making it impossible for the Initiating Entity to be authenticated by the Receiving Entity.");
+ }
+ break;
+ case optional:
+ switch (receivingServer.certificateState) {
+ case MISSING:
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ // TODO: should we take into account a manual configuration of an ANON cypher suite, so that encryption-without-authentication can occur via TLS, followed by a Dialback-based authentication?
+ expectedOutcome.set(NON_ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity does not provides a TLS certificate. As ANON cypher suites are expected to be unavailable, Initiating Entity cannot negotiate TLS, so that cannot be used for encryption or authentication. Dialback is available, so authentication can occur.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity does not provides a TLS certificate, Initiating Entity cannot negotiate TLS. With TLS and Dialback unavailable, authentication cannot occur (even if usage of an ANON cypher suite would make TLS-for-encryption possible)");
+ }
+ break;
+ case INVALID:
+ if (initiatingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate, which should cause Initiating Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Initiating Entity may choose to ignore Receiving Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ switch (initiatingServer.certificateState) {
+ case MISSING:
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity, but Dialback is available for that purpose.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity. As Dialback is also not available, authentication cannot occur.");
+ }
+ break;
+ case INVALID:
+ if (receivingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate, which should cause Receiving Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity may choose to ignore Initiating Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ // valid certs all around. Dialback is not needed.
+ expectedOutcome.set(ENCRYPTED_WITH_SASLEXTERNAL_AUTH, "TLS is usable for both encryption and authentication.");
+ break;
+ }
+ break;
+ }
+ break;
+ case required:
+ switch (receivingServer.certificateState) {
+ case MISSING:
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity requires encryption, but it does not provide a TLS certificate. As ANON cypher suites are expected to be unavailable, the Initiating Entity cannot negotiate TLS and therefor the required encrypted connection cannot be established.");
+ // TODO: should we take into account a manual configuration of an ANON cypher suite, so that encryption-without-authentication can occur via TLS, followed by a Dialback-based authentication?
+ break;
+ case INVALID:
+ if (initiatingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate, which should cause Initiating Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Initiating Entity may choose to ignore Receiving Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ switch (initiatingServer.certificateState) {
+ case MISSING:
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity, but Dialback is available for that purpose.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity. As Dialback is also not available, authentication cannot occur.");
+ }
+ break;
+ case INVALID:
+ if (receivingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate, which should cause Receiving Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity may choose to ignore Initiating Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ // valid certs all around. Dialback is not needed.
+ expectedOutcome.set(ENCRYPTED_WITH_SASLEXTERNAL_AUTH, "TLS is usable for both encryption and authentication.");
+ break;
+ }
+ break;
+ }
+ break;
+ }
+ break;
+
+ case required: // <-- Initiating server's encryption policy.
+ switch (receivingServer.encryptionPolicy) {
+ case disabled:
+ expectedOutcome.set(NO_CONNECTION, "one peer requires encryption, the other disables encryption. This cannot work.");
+ break;
+ case optional:
+ switch (receivingServer.certificateState) {
+ case MISSING:
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity does not provide a TLS certificate. As ANON cypher suites are expected to be unavailable, the Initiating Entity cannot negotiate TLS and therefor the required encrypted connection cannot be established.");
+ // TODO: should we take into account a manual configuration of an ANON cypher suite, so that encryption-without-authentication can occur via TLS, followed by a Dialback-based authentication?
+ break;
+ case INVALID:
+ if (initiatingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate, which should cause Initiating Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Initiating Entity may choose to ignore Receiving Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ switch (initiatingServer.certificateState) {
+ case MISSING:
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity, but Dialback is available for that purpose.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides a valid TLS certificate allowing Initiating Entity to be able to establish TLS for encryption. Initiating Entity but does not provide a certificate itself, so SASL EXTERNAL is not available for Receiving Entity to authenticate Initiating Entity. As Dialback is also not available, authentication cannot occur.");
+ }
+ break;
+ case INVALID:
+ if (receivingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate, which should cause Receiving Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity may choose to ignore Initiating Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ // valid certs all around. Dialback is not needed.
+ expectedOutcome.set(ENCRYPTED_WITH_SASLEXTERNAL_AUTH, "TLS is usable for both encryption and authentication.");
+ break;
+ }
+ break;
+ }
+ break;
+ case required:
+ switch (receivingServer.certificateState) {
+ case MISSING:
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity does not provide a TLS certificate. As ANON cypher suites are expected to be unavailable, the Initiating Entity cannot negotiate TLS and therefor the required encrypted connection cannot be established.");
+ // TODO: should we take into account a manual configuration of an ANON cypher suite, so that encryption-without-authentication can occur via TLS, followed by a Dialback-based authentication?
+ break;
+ case INVALID:
+ if (initiatingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate, which should cause Initiating Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Initiating Entity may choose to ignore Receiving Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Receiving Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ switch (initiatingServer.certificateState) {
+ case MISSING:
+ if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Initiating Entity can negotiate encryption, but does not provide a certificate. SASL EXTERNAL cannot be used, but Dialback is available, so authentication can occur.");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity can negotiate encryption, but does not provide a certificate. As Dialback is not available, authentication cannot occur. Connection cannot be established.");
+ }
+ break;
+ case INVALID:
+ if (receivingServer.strictCertificateValidation) {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate, which should cause Receiving Entity to abort TLS (as per RFC 6120 section 13.7.2).");
+ } else if (initiatingServer.dialbackSupported && receivingServer.dialbackSupported) {
+ expectedOutcome.set(ENCRYPTED_WITH_DIALBACK_AUTH, "Receiving Entity may choose to ignore Initiating Entities invalid certificate (for encryption purposes only) and choose to authenticate with Server Dialback (per RFC 7590 Section 3.4)");
+ } else {
+ expectedOutcome.set(NO_CONNECTION, "Initiating Entity provides an invalid TLS certificate. As Server Dialback is not available, authentication cannot occur.");
+ }
+ break;
+ case VALID:
+ expectedOutcome.set(ENCRYPTED_WITH_SASLEXTERNAL_AUTH, "Initiating Entity can establish encryption and authenticate using TLS.");
+ break;
+ }
+ break;
+ }
+ break;
+ }
+ break;
+ }
+
+ // FIXME: add support for the DirectTLS TLS policy.
+ return expectedOutcome;
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalIncomingServerSessionTest.java b/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalIncomingServerSessionTest.java
new file mode 100644
index 0000000000..31cdf2004c
--- /dev/null
+++ b/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalIncomingServerSessionTest.java
@@ -0,0 +1,338 @@
+/*
+ * Copyright (C) 2023 Ignite Realtime Foundation. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jivesoftware.openfire.session;
+
+import org.jivesoftware.Fixtures;
+import org.jivesoftware.openfire.Connection;
+import org.jivesoftware.openfire.ConnectionManager;
+import org.jivesoftware.openfire.SessionManager;
+import org.jivesoftware.openfire.XMPPServer;
+import org.jivesoftware.openfire.keystore.*;
+import org.jivesoftware.openfire.net.BlockingAcceptingMode;
+import org.jivesoftware.openfire.net.DNSUtil;
+import org.jivesoftware.openfire.net.SocketAcceptThread;
+import org.jivesoftware.openfire.net.SocketReader;
+import org.jivesoftware.openfire.spi.ConnectionConfiguration;
+import org.jivesoftware.openfire.spi.ConnectionListener;
+import org.jivesoftware.openfire.spi.ConnectionType;
+import org.jivesoftware.util.JiveGlobals;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.stubbing.Answer;
+
+import java.io.File;
+import java.security.cert.X509Certificate;
+import java.util.*;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/**
+ * Unit tests that verify if an inbound server-to-server socket connection can be created (and where applicable:
+ * encrypted and authenticated), verifying the implementation of {@link LocalIncomingServerSession}
+ *
+ * These tests assume the following constants:
+ * - TLS certificate validation is implemented correctly.
+ * - The domain name in the certificate matches that of the server.
+ *
+ * This implementation uses instances of {@link RemoteInitiatingServerDummy} to represent the remote server that
+ * initiates a server-to-server connection.
+ *
+ * @author Guus der Kinderen, guus@goodbytes.nl
+ * @author Alex Gidman, alex.gidman@surevine.com
+ */
+@ExtendWith(MockitoExtension.class)
+public class LocalIncomingServerSessionTest
+{
+ private RemoteInitiatingServerDummy remoteInitiatingServerDummy;
+ private File tmpIdentityStoreFile;
+ private IdentityStore identityStore;
+ private File tmpTrustStoreFile;
+ private TrustStore trustStore;
+
+ /**
+ * Prepares the local server for operation. This mostly involves preparing the test fixture by mocking parts of the
+ * API that {@link LocalOutgoingServerSession#createOutgoingSession(DomainPair, int)} uses when establishing a
+ * connection.
+ */
+ @BeforeEach
+ public void setUpClass() throws Exception {
+ Fixtures.reconfigureOpenfireHome();
+ JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
+ final XMPPServer xmppServer = Fixtures.mockXMPPServer();
+ XMPPServer.setInstance(xmppServer);
+
+ final File tmpDir = new File(System.getProperty("java.io.tmpdir"));
+
+ // Use a temporary file to hold the identity store that is used by the tests.
+ final CertificateStoreManager certificateStoreManager = mock(CertificateStoreManager.class, withSettings().lenient());
+ tmpIdentityStoreFile = new File(tmpDir, "unittest-identitystore-" + System.currentTimeMillis() + ".jks");
+ tmpIdentityStoreFile.deleteOnExit();
+ final CertificateStoreConfiguration identityStoreConfig = new CertificateStoreConfiguration("jks", tmpIdentityStoreFile, "secret".toCharArray(), tmpDir);
+ identityStore = new IdentityStore(identityStoreConfig, true);
+ doReturn(identityStore).when(certificateStoreManager).getIdentityStore(any());
+
+ // Use a temporary file to hold the trust store that is used by the tests.
+ tmpTrustStoreFile = new File(tmpDir, "unittest-truststore-" + System.currentTimeMillis() + ".jks");
+ tmpTrustStoreFile.deleteOnExit();
+ final CertificateStoreConfiguration trustStoreConfig = new CertificateStoreConfiguration("jks", tmpTrustStoreFile, "secret".toCharArray(), tmpDir);
+ trustStore = new TrustStore(trustStoreConfig, true);
+ doReturn(trustStore).when(certificateStoreManager).getTrustStore(any());
+
+ // Mock the connection configuration.
+ doReturn(certificateStoreManager).when(xmppServer).getCertificateStoreManager();
+
+ final SessionManager sessionManager = new SessionManager(); // This is the system under test. We do not want to use a mock for this test!
+ sessionManager.initialize(xmppServer);
+ doReturn(sessionManager).when(xmppServer).getSessionManager();
+
+ final ConnectionManager connectionManager = Fixtures.mockConnectionManager();
+ final ConnectionListener connectionListener = Fixtures.mockConnectionListener();
+ doAnswer(new ConnectionConfigurationAnswer(identityStoreConfig, trustStoreConfig)).when(connectionListener).generateConnectionConfiguration();
+ doReturn(Set.of(connectionListener)).when(connectionManager).getListeners(any(ConnectionType.class));
+ doReturn(connectionListener).when(connectionManager).getListener(any(ConnectionType.class), anyBoolean());
+ doReturn(connectionManager).when(xmppServer).getConnectionManager();
+ setUp();
+ }
+
+ /**
+ * Dynamically generate a ConnectionConfiguration answer, as used by the Mock ConnectionListener.
+ *
+ * A dynamic answer is needed, as the value of the ConnectionSettings.Server.TLS_POLICY property needs to be
+ * evaluated at run-time (this value is changed in the setup of many of the unit tests in this file).
+ *
+ */
+ private static class ConnectionConfigurationAnswer implements Answer {
+
+ private CertificateStoreConfiguration identityStoreConfig;
+ private CertificateStoreConfiguration trustStoreConfig;
+
+ private ConnectionConfigurationAnswer(CertificateStoreConfiguration identityStoreConfig, CertificateStoreConfiguration trustStoreConfig)
+ {
+ this.identityStoreConfig = identityStoreConfig;
+ this.trustStoreConfig = trustStoreConfig;
+ }
+
+ @Override
+ public Object answer(InvocationOnMock invocation) throws Throwable
+ {
+ final Connection.TLSPolicy tlsPolicy = Connection.TLSPolicy.valueOf(JiveGlobals.getProperty(ConnectionSettings.Server.TLS_POLICY, Connection.TLSPolicy.optional.toString()));
+ final Set suites = Set.of("TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_DHE_DSS_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_DSS_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_DHE_RSA_WITH_AES_256_CBC_SHA256","TLS_DHE_DSS_WITH_AES_256_CBC_SHA256","TLS_DHE_RSA_WITH_AES_128_CBC_SHA256","TLS_DHE_DSS_WITH_AES_128_CBC_SHA256","TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_RSA_WITH_AES_256_CBC_SHA","TLS_DHE_DSS_WITH_AES_256_CBC_SHA","TLS_DHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_DSS_WITH_AES_128_CBC_SHA","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
+ final Set protocols = Set.of("TLSv1.2");
+ return new ConnectionConfiguration(ConnectionType.SOCKET_S2S, true, 10, -1, Connection.ClientAuth.wanted, null, 9999, tlsPolicy, identityStoreConfig, trustStoreConfig, true, true, protocols, suites, Connection.CompressionPolicy.optional, true );
+ }
+ }
+
+ public void setUp() throws Exception
+ {
+ remoteInitiatingServerDummy = new RemoteInitiatingServerDummy(Fixtures.XMPP_DOMAIN);
+ }
+
+ @AfterEach
+ public void tearDown() throws Exception
+ {
+ tmpIdentityStoreFile.delete();
+ tmpTrustStoreFile.delete();
+ identityStore = null;
+ trustStore = null;
+ DNSUtil.setDnsOverride(null);
+
+ if (remoteInitiatingServerDummy != null) {
+ remoteInitiatingServerDummy.disconnect();
+ remoteInitiatingServerDummy = null;
+ }
+
+ Fixtures.clearExistingProperties();
+ }
+
+ /**
+ * Unit test in which Openfire reacts to an inbound server-to-server connection attempt.
+ *
+ * This test is parameterized, meaning that the configuration of both the local server and the remote mock server is
+ * passed as an argument to this method. These configurations are used to both initialize and execute the test, but
+ * also to calculate the expected outcome of the test, given the provided configuration. This expected outcome is
+ * asserted by the test implementation
+ *
+ * @param localServerSettings Server settings for the system under test (the 'local' server).
+ * @param remoteServerSettings Server settings for the mock server that is used as a peer in this test.
+ */
+ @ParameterizedTest
+ @MethodSource("arguments")
+ public void incomingTest(final ServerSettings localServerSettings, final ServerSettings remoteServerSettings)
+ throws Exception
+ {
+ final ExpectedOutcome expected = ExpectedOutcome.generateExpectedOutcome(remoteServerSettings, localServerSettings);
+ if (RemoteInitiatingServerDummy.doLog) System.out.println("Executing test:\n - Local Server, Recipient, System Under Test Settings: " + localServerSettings + "\n - Remote Server, Initiator, dummy/mock server Settings: " + remoteServerSettings + "\nExpected outcome: " + expected.getConnectionState());
+
+ JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
+ final TrustStore trustStore = XMPPServer.getInstance().getCertificateStoreManager().getTrustStore(ConnectionType.SOCKET_S2S);
+ final IdentityStore identityStore = XMPPServer.getInstance().getCertificateStoreManager().getIdentityStore(ConnectionType.SOCKET_S2S);
+ try {
+ // Setup test fixture.
+
+ // Remote server TLS policy.
+ remoteInitiatingServerDummy.setEncryptionPolicy(remoteServerSettings.encryptionPolicy);
+
+ // Remote server dialback
+ remoteInitiatingServerDummy.setDisableDialback(!remoteServerSettings.dialbackSupported);
+
+ // Remote server certificate state
+ switch (remoteServerSettings.certificateState) {
+ case INVALID:
+ remoteInitiatingServerDummy.setUseExpiredEndEntityCertificate(true);
+ // Intended fall-through
+ case VALID:
+ remoteInitiatingServerDummy.preparePKIX();
+
+ // Install in local server's truststore.
+ final X509Certificate[] chain = remoteInitiatingServerDummy.getGeneratedPKIX().getCertificateChain();
+ final X509Certificate caCert = chain[chain.length-1];
+ trustStore.installCertificate("unit-test", KeystoreTestUtils.toPemFormat(caCert));
+ break;
+ case MISSING:
+ break;
+ default:
+ throw new IllegalStateException("Unsupported remote certificate state");
+ }
+
+ // Local server TLS policy.
+ JiveGlobals.setProperty(ConnectionSettings.Server.TLS_POLICY, localServerSettings.encryptionPolicy.toString());
+
+ // Local server dialback.
+ JiveGlobals.setProperty(ConnectionSettings.Server.DIALBACK_ENABLED, localServerSettings.dialbackSupported ? "true" : "false");
+
+ // Local server certificate state
+ switch (localServerSettings.certificateState) {
+ case MISSING:
+ // Do not install domain certificate.
+ break;
+ case INVALID:
+ // Insert an expired certificate into the identity store
+ identityStore.installCertificate(Fixtures.expiredX509Certificate, Fixtures.privateKeyForExpiredCert, "");
+ break;
+ case VALID:
+ // Generate a valid certificate and insert into identity store
+ identityStore.ensureDomainCertificate();
+ break;
+ }
+
+ remoteInitiatingServerDummy.init();
+ if (remoteInitiatingServerDummy.getDialbackAuthoritativeServerPort() > 0) {
+ DNSUtil.setDnsOverride(Map.of(RemoteInitiatingServerDummy.XMPP_DOMAIN, new DNSUtil.HostAddress("localhost", remoteInitiatingServerDummy.getDialbackAuthoritativeServerPort(), false)));
+ }
+
+ // execute system under test.
+ final SocketAcceptThread socketAcceptThread = new SocketAcceptThread(0, null, false);
+ socketAcceptThread.setDaemon(true);
+ socketAcceptThread.setPriority(Thread.MAX_PRIORITY);
+ socketAcceptThread.start();
+
+ // now, make the remote server connect.
+ remoteInitiatingServerDummy.connect(socketAcceptThread.getPort());
+ remoteInitiatingServerDummy.blockUntilDone(1, TimeUnit.MINUTES);
+
+ // get the incoming server session object.
+ final LocalIncomingServerSession result;
+ BlockingAcceptingMode mode = ((BlockingAcceptingMode) socketAcceptThread.getAcceptingMode());
+ final SocketReader socketReader = mode == null ? null : mode.getLastReader();
+ result = socketReader == null ? null : (LocalIncomingServerSession) socketReader.getSession();
+
+ // Verify results
+ if (RemoteInitiatingServerDummy.doLog) System.out.println("Expect: " + expected.getConnectionState() + ", Result: " + result);
+ switch (expected.getConnectionState())
+ {
+ case NO_CONNECTION:
+ if (result == null) {
+ assertNull(result); // Yes, this is silly.
+ } else {
+ assertFalse(result.isAuthenticated());
+ }
+ break;
+ case NON_ENCRYPTED_WITH_DIALBACK_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertFalse(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.DIALBACK, result.getAuthenticationMethod());
+ break;
+ case ENCRYPTED_WITH_DIALBACK_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertTrue(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.DIALBACK, result.getAuthenticationMethod());
+ break;
+ case ENCRYPTED_WITH_SASLEXTERNAL_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertTrue(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.SASL_EXTERNAL, result.getAuthenticationMethod());
+ break;
+ }
+ if (RemoteInitiatingServerDummy.doLog) System.out.println("Expectation met.");
+ } finally {
+ // Teardown test fixture.
+ trustStore.delete("unit-test");
+ }
+ }
+
+ /**
+ * Provides the arguments for the method that implements the unit test.
+ * @return Unit test arguments
+ */
+ private static Iterable arguments() {
+ final Collection result = new LinkedList<>();
+
+ final Set localServerSettings = new LinkedHashSet<>();
+ final Set remoteServerSettings = new LinkedHashSet<>();
+
+ for (final ServerSettings.CertificateState certificateState : ServerSettings.CertificateState.values()) {
+ for (final boolean dialbackSupported : List.of(true, false)) {
+ for (final Connection.TLSPolicy tlsPolicy : Connection.TLSPolicy.values()) {
+ if (tlsPolicy == Connection.TLSPolicy.legacyMode) {
+ continue; // TODO add support for DirectTLS in this unit test!
+ }
+ final ServerSettings serverSettings = new ServerSettings(tlsPolicy, certificateState,true, dialbackSupported); // TODO add support for both strict certificate validation settings.
+ localServerSettings.add(serverSettings);
+ remoteServerSettings.add(serverSettings);
+ }
+ }
+ }
+
+ for (final ServerSettings local : localServerSettings) {
+ for (final ServerSettings remote : remoteServerSettings) {
+ result.add(Arguments.arguments(local, remote));
+ }
+ }
+
+ // Not all test-runners easily identify the parameters that are used to run each test iteration. Those that do
+ // not, typically show a number. By outputting the numbered arguments, they can be cross-referenced with any
+ // failed test case.
+ int i = 1;
+ for (Arguments arguments : result) {
+ System.out.println("Test [" + i++ + "]: " + arguments.get()[0] + ", " + arguments.get()[1]);
+ }
+ return result;
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalOutgoingServerSessionTest.java b/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalOutgoingServerSessionTest.java
new file mode 100644
index 0000000000..947ad9989c
--- /dev/null
+++ b/xmppserver/src/test/java/org/jivesoftware/openfire/session/LocalOutgoingServerSessionTest.java
@@ -0,0 +1,319 @@
+/*
+ * Copyright (C) 2023 Ignite Realtime Foundation. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jivesoftware.openfire.session;
+
+import org.jivesoftware.Fixtures;
+import org.jivesoftware.openfire.*;
+import org.jivesoftware.openfire.keystore.*;
+import org.jivesoftware.openfire.net.*;
+import org.jivesoftware.openfire.spi.ConnectionConfiguration;
+import org.jivesoftware.openfire.spi.ConnectionListener;
+import org.jivesoftware.openfire.spi.ConnectionType;
+import org.jivesoftware.util.JiveGlobals;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.mockito.invocation.InvocationOnMock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.stubbing.Answer;
+
+import java.io.File;
+import java.security.cert.X509Certificate;
+import java.util.*;
+
+import static org.jivesoftware.openfire.session.ExpectedOutcome.ConnectionState.NON_ENCRYPTED_WITH_DIALBACK_AUTH;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/**
+ * Unit tests that verify if an outbound server-to-server socket connection can be created (and where applicable:
+ * encrypted and authenticated), verifying the implementation of {@link LocalOutgoingServerSession#createOutgoingSession(DomainPair, int)}
+ *
+ * These tests assume the following constants:
+ * - TLS certificate validation is implemented correctly.
+ * - The domain name in the certificate matches that of the server.
+ *
+ * This implementation uses instances of {@link RemoteReceivingServerDummy} to represent the remote server to which a connection
+ * is being made.
+ *
+ * @author Guus der Kinderen, guus@goodbytes.nl
+ * @author Alex Gidman, alex.gidman@surevine.com
+ */
+@ExtendWith(MockitoExtension.class)
+public class LocalOutgoingServerSessionTest
+{
+ private RemoteReceivingServerDummy remoteReceivingServerDummy;
+ private File tmpIdentityStoreFile;
+ private IdentityStore identityStore;
+ private File tmpTrustStoreFile;
+ private TrustStore trustStore;
+
+ /**
+ * Prepares the local server for operation. This mostly involves preparing the test fixture by mocking parts of the
+ * API that {@link LocalOutgoingServerSession#createOutgoingSession(DomainPair, int)} uses when establishing a
+ * connection.
+ */
+ @BeforeEach
+ public void setUpClass() throws Exception {
+ Fixtures.reconfigureOpenfireHome();
+ JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
+ final XMPPServer xmppServer = Fixtures.mockXMPPServer();
+ XMPPServer.setInstance(xmppServer);
+
+ final File tmpDir = new File(System.getProperty("java.io.tmpdir"));
+
+ // Use a temporary file to hold the identity store that is used by the tests.
+ final CertificateStoreManager certificateStoreManager = mock(CertificateStoreManager.class, withSettings().lenient());
+ tmpIdentityStoreFile = new File(tmpDir, "unittest-identitystore-" + System.currentTimeMillis() + ".jks");
+ tmpIdentityStoreFile.deleteOnExit();
+ final CertificateStoreConfiguration identityStoreConfig = new CertificateStoreConfiguration("jks", tmpIdentityStoreFile, "secret".toCharArray(), tmpDir);
+ identityStore = new IdentityStore(identityStoreConfig, true);
+ doReturn(identityStore).when(certificateStoreManager).getIdentityStore(any());
+
+ // Use a temporary file to hold the trust store that is used by the tests.
+ tmpTrustStoreFile = new File(tmpDir, "unittest-truststore-" + System.currentTimeMillis() + ".jks");
+ tmpTrustStoreFile.deleteOnExit();
+ final CertificateStoreConfiguration trustStoreConfig = new CertificateStoreConfiguration("jks", tmpTrustStoreFile, "secret".toCharArray(), tmpDir);
+ trustStore = new TrustStore(trustStoreConfig, true);
+ doReturn(trustStore).when(certificateStoreManager).getTrustStore(any());
+
+ // Mock the connection configuration.
+ doReturn(certificateStoreManager).when(xmppServer).getCertificateStoreManager();
+
+ final ConnectionManager connectionManager = Fixtures.mockConnectionManager();
+ final ConnectionListener connectionListener = Fixtures.mockConnectionListener();
+ doAnswer(new ConnectionConfigurationAnswer(identityStoreConfig, trustStoreConfig)).when(connectionListener).generateConnectionConfiguration();
+ doReturn(Set.of(connectionListener)).when(connectionManager).getListeners(any(ConnectionType.class));
+ doReturn(connectionListener).when(connectionManager).getListener(any(ConnectionType.class), anyBoolean());
+ doReturn(connectionManager).when(xmppServer).getConnectionManager();
+ setUp();
+ }
+
+ /**
+ * Dynamically generate a ConnectionConfiguration answer, as used by the Mock ConnectionListener.
+ *
+ * A dynamic answer is needed, as the value of the ConnectionSettings.Server.TLS_POLICY property needs to be
+ * evaluated at run-time (this value is changed in the setup of many of the unit tests in this file).
+ *
+ */
+ private static class ConnectionConfigurationAnswer implements Answer {
+
+ private CertificateStoreConfiguration identityStoreConfig;
+ private CertificateStoreConfiguration trustStoreConfig;
+
+ private ConnectionConfigurationAnswer(CertificateStoreConfiguration identityStoreConfig, CertificateStoreConfiguration trustStoreConfig)
+ {
+ this.identityStoreConfig = identityStoreConfig;
+ this.trustStoreConfig = trustStoreConfig;
+ }
+
+ @Override
+ public Object answer(InvocationOnMock invocation) throws Throwable
+ {
+ final Connection.TLSPolicy tlsPolicy = Connection.TLSPolicy.valueOf(JiveGlobals.getProperty(ConnectionSettings.Server.TLS_POLICY, Connection.TLSPolicy.optional.toString()));
+ final Set suites = Set.of("TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_DHE_DSS_WITH_AES_256_GCM_SHA384","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","TLS_DHE_DSS_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","TLS_DHE_RSA_WITH_AES_256_CBC_SHA256","TLS_DHE_DSS_WITH_AES_256_CBC_SHA256","TLS_DHE_RSA_WITH_AES_128_CBC_SHA256","TLS_DHE_DSS_WITH_AES_128_CBC_SHA256","TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_RSA_WITH_AES_256_CBC_SHA","TLS_DHE_DSS_WITH_AES_256_CBC_SHA","TLS_DHE_RSA_WITH_AES_128_CBC_SHA","TLS_DHE_DSS_WITH_AES_128_CBC_SHA","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
+ final Set protocols = Set.of("TLSv1.2");
+ return new ConnectionConfiguration(ConnectionType.SOCKET_S2S, true, 10, -1, Connection.ClientAuth.wanted, null, 9999, tlsPolicy, identityStoreConfig, trustStoreConfig, true, true, protocols, suites, Connection.CompressionPolicy.optional, true );
+ }
+ }
+
+ public void setUp() throws Exception
+ {
+ remoteReceivingServerDummy = new RemoteReceivingServerDummy();
+ remoteReceivingServerDummy.open();
+ DNSUtil.setDnsOverride(Map.of(RemoteReceivingServerDummy.XMPP_DOMAIN, new DNSUtil.HostAddress("localhost", remoteReceivingServerDummy.getPort(), false)));
+ }
+
+ @AfterEach
+ public void tearDown() throws Exception
+ {
+ tmpIdentityStoreFile.delete();
+ tmpTrustStoreFile.delete();
+ identityStore = null;
+ trustStore = null;
+ DNSUtil.setDnsOverride(null);
+
+ if (remoteReceivingServerDummy != null) {
+ remoteReceivingServerDummy.close();
+ remoteReceivingServerDummy = null;
+ }
+
+ Fixtures.clearExistingProperties();
+ }
+
+ /**
+ * Unit test in which Openfire initiates an outgoing server-to-server connection.
+ *
+ * This test is parameterized, meaning that the configuration of both the local server and the remote mock server is
+ * passed as an argument to this method. These configurations are used to both initialize and execute the test, but
+ * also to calculate the expected outcome of the test, given the provided configuration. This expected outcome is
+ * asserted by the test implementation
+ *
+ * @param localServerSettings Server settings for the system under test (the 'local' server).
+ * @param remoteServerSettings Server settings for the mock server that is used as a peer in this test.
+ */
+ @ParameterizedTest
+ @MethodSource("arguments")
+ public void outgoingTest(final ServerSettings localServerSettings, final ServerSettings remoteServerSettings)
+ throws Exception
+ {
+ final ExpectedOutcome expected;
+ if (localServerSettings.encryptionPolicy == Connection.TLSPolicy.optional && localServerSettings.certificateState == ServerSettings.CertificateState.INVALID && localServerSettings.dialbackSupported &&
+ remoteServerSettings.encryptionPolicy == Connection.TLSPolicy.optional && remoteServerSettings.certificateState == ServerSettings.CertificateState.VALID && remoteServerSettings.dialbackSupported) {
+ // TODO: can we improve on this test to explicitly verify the outcome if the first connection?
+ expected = new ExpectedOutcome();
+ expected.set(NON_ENCRYPTED_WITH_DIALBACK_AUTH, "For this very specific configuration, the expected outcome is 'NO_CONNECTION'. However, Openfire will (and should) immediately make a new connection attempt (without TLS), that SHOULD succeed.");
+ } else {
+ expected = ExpectedOutcome.generateExpectedOutcome(localServerSettings, remoteServerSettings);
+ }
+ if (RemoteReceivingServerDummy.doLog) System.out.println("Executing test:\n - Local Server (Openfire, System under test) Settings: " + localServerSettings + "\n - Remote Server (dummy/mock server) Settings: " + remoteServerSettings + "\nExpected outcome: " + expected.getConnectionState());
+
+ JiveGlobals.setProperty("xmpp.domain", Fixtures.XMPP_DOMAIN);
+ final TrustStore trustStore = XMPPServer.getInstance().getCertificateStoreManager().getTrustStore(ConnectionType.SOCKET_S2S);
+ final IdentityStore identityStore = XMPPServer.getInstance().getCertificateStoreManager().getIdentityStore(ConnectionType.SOCKET_S2S);
+
+ try {
+ // Setup test fixture.
+
+ // Remote server TLS policy.
+ remoteReceivingServerDummy.setEncryptionPolicy(remoteServerSettings.encryptionPolicy);
+
+ // Remote server dialback
+ remoteReceivingServerDummy.setDisableDialback(!remoteServerSettings.dialbackSupported);
+
+ // Remote server certificate state
+ switch (remoteServerSettings.certificateState) {
+ case INVALID:
+ remoteReceivingServerDummy.setUseExpiredEndEntityCertificate(true);
+ // Intended fall-through
+ case VALID:
+ remoteReceivingServerDummy.preparePKIX();
+
+ // Install in local server's truststore.
+ final X509Certificate[] chain = remoteReceivingServerDummy.getGeneratedPKIX().getCertificateChain();
+ final X509Certificate caCert = chain[chain.length-1];
+ trustStore.installCertificate("unit-test", KeystoreTestUtils.toPemFormat(caCert));
+ break;
+ case MISSING:
+ break;
+ default:
+ throw new IllegalStateException("Unsupported remote certificate state");
+ }
+
+ // Local server TLS policy.
+ JiveGlobals.setProperty(ConnectionSettings.Server.TLS_POLICY, localServerSettings.encryptionPolicy.toString());
+
+ // Local server dialback.
+ JiveGlobals.setProperty(ConnectionSettings.Server.DIALBACK_ENABLED, localServerSettings.dialbackSupported ? "true" : "false");
+
+ // Local server certificate state
+ switch (localServerSettings.certificateState) {
+ case MISSING:
+ // Do not install domain certificate.
+ break;
+ case INVALID:
+ // Insert an expired certificate into the identity store
+ identityStore.installCertificate(Fixtures.expiredX509Certificate, Fixtures.privateKeyForExpiredCert, "");
+ break;
+ case VALID:
+ // Generate a valid certificate and insert into identity store
+ identityStore.ensureDomainCertificate();
+ break;
+ }
+
+ final DomainPair domainPair = new DomainPair(Fixtures.XMPP_DOMAIN, RemoteReceivingServerDummy.XMPP_DOMAIN);
+ final int port = remoteReceivingServerDummy.getPort();
+
+ // Execute system under test.
+ final LocalOutgoingServerSession result = LocalOutgoingServerSession.createOutgoingSession(domainPair, port);
+
+ // Verify results
+ if (RemoteReceivingServerDummy.doLog) System.out.println("Expect: " + expected.getConnectionState() + ", Result: " + result);
+ switch (expected.getConnectionState())
+ {
+ case NO_CONNECTION:
+ assertNull(result);
+ break;
+ case NON_ENCRYPTED_WITH_DIALBACK_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertFalse(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.DIALBACK, result.getAuthenticationMethod());
+ break;
+ case ENCRYPTED_WITH_DIALBACK_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertTrue(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.DIALBACK, result.getAuthenticationMethod());
+ break;
+ case ENCRYPTED_WITH_SASLEXTERNAL_AUTH:
+ assertNotNull(result);
+ assertFalse(result.isClosed());
+ assertTrue(result.isEncrypted());
+ assertTrue(result.isAuthenticated());
+ assertEquals(ServerSession.AuthenticationMethod.SASL_EXTERNAL, result.getAuthenticationMethod());
+ break;
+ }
+ } finally {
+ // Teardown test fixture.
+ trustStore.delete("unit-test");
+ }
+ }
+
+ /**
+ * Provides the arguments for the method that implements the unit test.
+ * @return Unit test arguments
+ */
+ private static Iterable arguments() {
+ final Collection result = new LinkedList<>();
+
+ final Set localServerSettings = new LinkedHashSet<>();
+ final Set remoteServerSettings = new LinkedHashSet<>();
+
+ for (final ServerSettings.CertificateState certificateState : ServerSettings.CertificateState.values()) {
+ for (final boolean dialbackSupported : List.of(true, false)) {
+ for (final Connection.TLSPolicy tlsPolicy : Connection.TLSPolicy.values()) {
+ if (tlsPolicy == Connection.TLSPolicy.legacyMode) {
+ continue; // TODO add support for DirectTLS in this unit test!
+ }
+ final ServerSettings serverSettings = new ServerSettings(tlsPolicy, certificateState, true, dialbackSupported); // TODO add support for both strict certificate validation settings.
+ localServerSettings.add(serverSettings);
+ remoteServerSettings.add(serverSettings);
+ }
+ }
+ }
+
+ for (final ServerSettings local : localServerSettings) {
+ for (final ServerSettings remote : remoteServerSettings) {
+ result.add(Arguments.arguments(local, remote));
+ }
+ }
+
+ // Not all test-runners easily identify the parameters that are used to run each test iteration. Those that do
+ // not, typically show a number. By outputting the numbered arguments, they can be cross-referenced with any
+ // failed test case.
+ int i = 1;
+ for (Arguments arguments : result) {
+ System.out.println("Test [" + i++ + "]: " + arguments.get()[0] + ", " + arguments.get()[1]);
+ }
+ return result;
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteInitiatingServerDummy.java b/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteInitiatingServerDummy.java
new file mode 100644
index 0000000000..7614839b0b
--- /dev/null
+++ b/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteInitiatingServerDummy.java
@@ -0,0 +1,555 @@
+package org.jivesoftware.openfire.session;
+
+import org.dom4j.*;
+import org.jivesoftware.openfire.Connection;
+import org.jivesoftware.util.Base64;
+
+import javax.net.ssl.*;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InterruptedIOException;
+import java.io.OutputStream;
+import java.net.*;
+import java.security.KeyManagementException;
+import java.security.KeyPair;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.concurrent.*;
+
+public class RemoteInitiatingServerDummy extends AbstractRemoteServerDummy
+{
+ /**
+ * When switched to 'true', most XMPP interaction will be printed to standard-out.
+ */
+ public static final boolean doLog = false;
+
+ private ServerSocket dialbackAuthoritativeServer;
+ private Thread dialbackAcceptThread;
+ private DialbackAcceptor dialbackAcceptor = new DialbackAcceptor();
+
+ private final String connectTo;
+ boolean attemptedEncryptionNegotiation = false;
+ boolean alreadyTriedSaslExternal = false;
+ boolean peerSupportsDialback;
+ private ExecutorService processingService;
+
+ /**
+ * A monitor that is used to flag when this dummy has finished trying to set up a connection to Openfire. This is to
+ * help the unit test know when it can start verifying the test outcome.
+ */
+ private final Phaser phaser = new Phaser(0);
+
+ public RemoteInitiatingServerDummy(final String connectTo)
+ {
+ this.connectTo = connectTo;
+ }
+
+ public void init() throws IOException
+ {
+ if (!disableDialback) {
+ dialbackAuthoritativeServer = new ServerSocket(0);
+ }
+ }
+
+ public void connect(int port) throws IOException, InterruptedException
+ {
+ if (doLog) System.out.println("connect");
+ processingService = Executors.newCachedThreadPool();
+
+ if (dialbackAuthoritativeServer != null) {
+ dialbackAcceptThread = new Thread(dialbackAcceptor);
+ dialbackAcceptThread.start();
+ }
+
+ phaser.register();
+
+ final SocketProcessor socketProcessor = new SocketProcessor(port);
+ processingService.submit(socketProcessor);
+ }
+
+ public void blockUntilDone(final long timeout, final TimeUnit unit) {
+ try {
+ phaser.awaitAdvanceInterruptibly(0, timeout, unit);
+ } catch (InterruptedException | TimeoutException e) {
+ throw new RuntimeException("Test scenario never reached 'done' state");
+ }
+ }
+
+ protected void done() {
+ phaser.arriveAndDeregister();
+ }
+
+ public void disconnect() throws InterruptedException, IOException
+ {
+ if (doLog) System.out.println("disconnect");
+ stopProcessingService();
+ stopDialbackAcceptThread();
+ if (dialbackAuthoritativeServer != null) {
+ dialbackAuthoritativeServer.close();
+ dialbackAuthoritativeServer = null;
+ }
+ }
+
+ public synchronized void stopProcessingService() throws InterruptedException
+ {
+ processingService.shutdown();
+ final Instant end = Instant.now().plus(SO_TIMEOUT.multipliedBy(20));
+ while (Instant.now().isBefore(end) && !processingService.isTerminated()) {
+ Thread.sleep(Math.max(100, SO_TIMEOUT.dividedBy(50).toMillis()));
+ }
+ if (!processingService.isTerminated()) {
+ processingService.shutdownNow();
+ }
+ }
+
+ public synchronized void stopDialbackAcceptThread() throws InterruptedException
+ {
+ if (dialbackAcceptThread == null) {
+ return;
+ }
+ dialbackAcceptor.stop();
+ dialbackAcceptThread.interrupt();
+ final Instant end = Instant.now().plus(SO_TIMEOUT.multipliedBy(20));
+ while (Instant.now().isBefore(end) && dialbackAcceptThread.getState() != Thread.State.TERMINATED) {
+ Thread.sleep(Math.max(10, SO_TIMEOUT.dividedBy(50).toMillis()));
+ }
+ final Thread.State finalState = dialbackAcceptThread.getState();
+ if (finalState != Thread.State.TERMINATED) {
+ if (doLog) System.err.println("Dialback Accept thread not terminating after it was stopped. Current state: " + finalState);
+ if (doLog) Arrays.stream(dialbackAcceptThread.getStackTrace()).forEach(System.err::println);
+ dialbackAcceptThread.stop();
+ }
+ dialbackAcceptThread = null;
+ }
+
+ public int getDialbackAuthoritativeServerPort()
+ {
+ return dialbackAuthoritativeServer != null ? dialbackAuthoritativeServer.getLocalPort() : -1;
+ }
+
+ private class DialbackAcceptor implements Runnable
+ {
+ boolean shouldStop = false;
+
+ void stop() {
+ shouldStop = true;
+ }
+
+ @Override
+ public void run()
+ {
+ if (doLog) System.out.println("Start accepting socket connections (as Server Dialback Authoritative Server).");
+ while (!shouldStop) {
+ try {
+ dialbackAuthoritativeServer.setSoTimeout((int)SO_TIMEOUT.multipliedBy(10).toMillis());
+ final Socket socket = dialbackAuthoritativeServer.accept();
+ final InputStream is = socket.getInputStream();
+ final OutputStream os = socket.getOutputStream();
+ if (doLog) System.out.println("DIALBACK AUTH SERVER: Accepted new socket connection.");
+
+ Thread.sleep(100);
+ final byte[] buffer = new byte[1024 * 16];
+ int count;
+ while ((count = is.read(buffer)) > 0) {
+ String read = new String(buffer, 0, count);
+ if (doLog) System.out.println("# DIALBACK AUTH SERVER recv");
+ if (doLog) System.out.println(read);
+ if (doLog) System.out.println();
+
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Namespace dialbackNamespace = new Namespace("db", "jabber:server:dialback");
+ final Element stream = outbound.addElement(QName.get("stream", namespace));
+ stream.add(Namespace.get("jabber:server"));
+ stream.add(dialbackNamespace);
+ stream.addAttribute("from", XMPP_DOMAIN);
+ stream.addAttribute("to", connectTo);
+ stream.addAttribute("version", "1.0");
+
+ String response = null;
+ if (read.startsWith(""));
+ } else if (read.startsWith("")) {
+ response = "";
+ } else {
+ if (doLog) System.out.println("I don't know how to process this data.");
+ }
+
+ if (response != null) {
+ if (doLog) System.out.println("# DIALBACK AUTH SERVER send to Openfire");
+ if (doLog) System.out.println(response);
+ if (doLog) System.out.println();
+ os.write(response.getBytes());
+ os.flush();
+
+ if (response.equals("")) {
+ socket.close();
+ break;
+ }
+ }
+ }
+ } catch (Throwable t) {
+ // Log exception only when not cleanly closed.
+ if (dialbackAcceptThread != null && !dialbackAcceptThread.isInterrupted()) {
+ if (!(t instanceof SocketTimeoutException) && !shouldStop) {
+ t.printStackTrace();
+ }
+ } else {
+ break;
+ }
+ }
+ }
+ if (doLog) System.out.println("Stopped accepting socket connections (as Server Dialback Authoritative Server).");
+ }
+ }
+
+ private class SocketProcessor implements Runnable
+ {
+ private Socket socket;
+ private OutputStream os;
+ private InputStream is;
+ boolean peerAdvertisedDialbackNamespace = false;
+
+ /**
+ * To speed up the test execution, SO_TIMEOUT (the socket read timeout) has been set to a low value. When negotiating Server Dialback, a second
+ * socket connection is used. XMPP session establishment on the first socket connection is paused while the Server Dialback negotiation takes
+ * place. This can easily cause the SO_TIMEOUT to run out. To prevent issues, this implementation allows for reads of the first socket connection
+ * to time out for a certain number of times, before treating this as a terminal exception.
+ */
+ private int allowableSocketTimeouts = 0;
+
+ private SocketProcessor(int port) throws IOException
+ {
+ socket = new Socket();
+ final InetSocketAddress socketAddress = new InetSocketAddress(InetAddress.getLoopbackAddress(), port);
+ if (doLog) System.out.println("Creating new socket to " + socketAddress);
+ socket.connect(socketAddress, (int) SO_TIMEOUT.toMillis());
+ os = socket.getOutputStream();
+ is = socket.getInputStream();
+ }
+
+ private SocketProcessor(Socket socket) throws IOException
+ {
+ if (doLog) System.out.println("New session on socket");
+
+ this.socket = socket;
+ os = socket.getOutputStream();
+ is = socket.getInputStream();
+ }
+
+ public synchronized void send(final String data) throws IOException
+ {
+ if (doLog) System.out.println("# send from remote to Openfire" + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ if (doLog) System.out.println(data);
+ if (doLog) System.out.println();
+ os.write(data.getBytes());
+ os.flush();
+ }
+
+ @Override
+ public void run()
+ {
+ if (doLog) System.out.println("Start reading from socket" + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ try {
+ sendStreamHeader();
+
+ do {
+ try {
+ final byte[] buffer = new byte[1024 * 16];
+ int count;
+ while (!processingService.isShutdown() && (count = is.read(buffer)) > 0) {
+ String read = new String(buffer, 0, count);
+ if (read.startsWith("") + 2;
+ read = read.substring(endProlog);
+ }
+ if (read.startsWith("", " xmlns:stream=\"http://etherx.jabber.org/streams\">");
+ if (doLog) System.out.println("# recv (Hacked inbound stanza to include stream namespace declaration)" + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ } else if (read.startsWith("")) {
+ Element inbound = parse(read);
+ if (inbound.getName().equals("stream")) {
+ // This is expected to be the response stream header. No need to act on this, but if it contains a dialback namespace, then this suggests that the peer supports dialback.
+ peerAdvertisedDialbackNamespace = inbound.declaredNamespaces().stream().anyMatch(namespace -> "jabber:server:dialback".equals(namespace.getURI()));
+ switch (inbound.elements().size()) {
+ case 0:
+ // Done processing the input. Iterate, to try to read more.
+ continue;
+ case 1:
+ // There are child elements to process!
+ inbound = inbound.elements().get(0);
+ break;
+ default:
+ // More than one child element. This test implementation can't currently handle that.
+ throw new IllegalStateException("Unable to process more than one child element.");
+ }
+ }
+ switch (inbound.getName()) {
+ case "features":
+ negotiateFeatures(inbound);
+ break;
+ case "result":
+ processDialbackResult(inbound);
+ break;
+ case "proceed":
+ processStartTLSProceed(inbound);
+ return; // stop reading more from this inputstream.
+ case "success": // intended fall-through
+ case "failure":
+ if (inbound.getNamespaceURI().equals("urn:ietf:params:xml:ns:xmpp-sasl")) {
+ if (processSaslResponse(inbound)) {
+ if (doLog) System.out.println("Successfully authenticated using SASL! We're done setting up a connection.");
+ return;
+ } else if (peerSupportsDialback && !disableDialback) {
+ if (doLog) System.out.println("Unable to authenticate using SASL! Dialback seems to be available. Trying that...");
+ startDialbackAuth();
+ break;
+ } else {
+ throw new InterruptedIOException("Unable to authenticate");
+ }
+ } else if (inbound.getNamespaceURI().equals("urn:ietf:params:xml:ns:xmpp-tls")) {
+ throw new InterruptedIOException("Received StartTLS failure from Openfire. Aborting connection");
+ }
+ // intended fall-through
+ default:
+ if (doLog) System.out.println("Received stanza '" + inbound.getName() + "' that I don't know how to respond to." + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ }
+ } else {
+ // received an end of stream: if the peer closes the connection, then we're done trying.
+ break;
+ }
+ }
+ } catch (SocketTimeoutException e) {
+ allowableSocketTimeouts--;
+ if (allowableSocketTimeouts <= 0) {
+ throw e;
+ }
+ }
+ } while (!processingService.isShutdown() && allowableSocketTimeouts > 0);
+ if (doLog) System.out.println("Ending read loop.");
+ } catch (Throwable t) {
+ // Log exception only when not cleanly closed.
+ if (doLog && !processingService.isShutdown()) {
+ t.printStackTrace();
+ }
+ } finally {
+ if (doLog) System.out.println("Stopped reading from socket");
+ done();
+ }
+ }
+
+ private synchronized void sendStreamHeader() throws IOException
+ {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+
+ if (!disableDialback) {
+ root.add(new Namespace("db", "jabber:server:dialback"));
+ }
+ root.addAttribute("from", XMPP_DOMAIN);
+ root.addAttribute("to", connectTo);
+ root.addAttribute("version", "1.0");
+
+ send(root.asXML().substring(0, root.asXML().indexOf("")));
+ }
+
+ private void negotiateFeatures(final Element features) throws IOException
+ {
+ if (!attemptedEncryptionNegotiation) {
+ attemptedEncryptionNegotiation = true;
+ if (negotiateEncryption(features)) {
+ return;
+ }
+ }
+ negotiateAuthentication(features);
+ }
+
+ /**
+ * Returns 'true' if negotiation was started, false if no negotiation was started.
+ */
+ private boolean negotiateEncryption(final Element features) throws IOException
+ {
+ if (doLog) System.out.println("Negotiating encryption...");
+ final Element startTLSel = features.element(QName.get("starttls", "urn:ietf:params:xml:ns:xmpp-tls"));
+ final boolean peerSupportsStartTLS = startTLSel != null;
+ final boolean peerRequiresStartTLS = peerSupportsStartTLS && startTLSel.element("required") != null;
+ if (doLog) System.out.println("Openfire " + (peerRequiresStartTLS ? "requires" : (peerSupportsStartTLS ? "supports" : "does not support" )) + " StartTLS. Our own policy: " + encryptionPolicy + ".");
+
+ switch (encryptionPolicy) {
+ case disabled:
+ if (peerRequiresStartTLS) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+ final Element error = root.addElement(QName.get("error", "stream", "http://etherx.jabber.org/streams"));
+ error.addElement(QName.get("undefined-condition", "urn:ietf:params:xml:ns:xmpp-streams"));
+
+ send(root.asXML().substring(root.asXML().indexOf(">")+1));
+ throw new InterruptedIOException("Openfire requires TLS, we disabled it.");
+ }
+ return false;
+ case optional:
+ if (peerSupportsStartTLS) {
+ initiateTLS();
+ return true;
+ }
+ return false;
+ case required:
+ if (!peerSupportsStartTLS) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+ final Element error = root.addElement(QName.get("error", "stream", "http://etherx.jabber.org/streams"));
+ error.addElement(QName.get("undefined-condition", "urn:ietf:params:xml:ns:xmpp-streams"));
+
+ send(root.asXML().substring(root.asXML().indexOf(">")+1));
+ throw new InterruptedIOException("Openfire disabled TLS, we require it.");
+ }
+ else
+ {
+ initiateTLS();
+ return true;
+ }
+ default:
+ throw new IllegalStateException("This implementation does not supported encryption policy: " + encryptionPolicy);
+ }
+ }
+
+ private void initiateTLS() throws IOException {
+ if (doLog) System.out.println("Initiating TLS...");
+ final Document outbound = DocumentHelper.createDocument();
+ final Element startTls = outbound.addElement(QName.get("starttls", "urn:ietf:params:xml:ns:xmpp-tls"));
+ send(startTls.asXML());
+ }
+
+ private void processStartTLSProceed(Element proceed) throws IOException, NoSuchAlgorithmException, KeyManagementException
+ {
+ if (doLog) System.out.println("Received StartTLS proceed.");
+ if (doLog) System.out.println("Replace the socket with one that will do TLS on the next inbound and outbound data");
+
+ final SSLContext sc = SSLContext.getInstance("TLSv1.2");
+
+ TrustManager[] tm = createTrustManagerThatTrustsAll();
+ SecureRandom random = new SecureRandom();
+
+
+ KeyManager[] km = createKeyManager(new KeyPair(null, null), new X509Certificate[0]);
+ if (generatedPKIX != null) {
+ KeyPair keyPair = generatedPKIX.getKeyPair();
+ X509Certificate[] certificateChain = generatedPKIX.getCertificateChain();
+ km = createKeyManager(keyPair, certificateChain);
+ }
+
+ sc.init(km, tm , random);
+ SSLContext.setDefault(sc);
+
+ final SSLSocket sslSocket = (SSLSocket) ((SSLSocketFactory) SSLSocketFactory.getDefault()).createSocket(socket, null, socket.getPort(), true);
+ sslSocket.setSoTimeout((int) SO_TIMEOUT.toMillis());
+ sslSocket.addHandshakeCompletedListener(event -> { if (doLog) System.out.println("SSL handshake completed: " + event); });
+ sslSocket.startHandshake();
+
+ // Just indicate that we would like to authenticate the client but if client
+ // certificates are self-signed or have no certificate chain then we are still
+ // good
+ //sslSocket.setWantClientAuth(true); // DO WE NEED TO BRING THIS INTO OUR LocalOutgoingServerSessionTest MATRIX?
+ phaser.register();
+
+ final SocketProcessor sslSocketProcessor = new SocketProcessor(sslSocket);
+ processingService.submit(sslSocketProcessor);
+ }
+
+ private void negotiateAuthentication(final Element features) throws IOException {
+ if (doLog) System.out.println("Negotiating authentication...");
+ final Element mechanismsEl = features.element(QName.get("mechanisms", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ final boolean peerSupportsSASLExternal = mechanismsEl != null && mechanismsEl.elements().stream().anyMatch(element -> "mechanism".equals(element.getName()) && "EXTERNAL".equals(element.getTextTrim()));
+ peerSupportsDialback = peerAdvertisedDialbackNamespace || features.element(QName.get("dialback", "urn:xmpp:features:dialback")) != null;
+ if (doLog) System.out.println("Openfire " + (peerSupportsSASLExternal ? "offers" : "does not offer") + " SASL EXTERNAL, " + (peerSupportsDialback ? "supports" : "does not support") + " Server Dialback. Our own policy: SASL EXTERNAL " + (encryptionPolicy != Connection.TLSPolicy.disabled ? "available" : "not available") + ", Dialback: " + (!disableDialback ? "supported" : "not supported") + ".");
+
+ if (peerSupportsSASLExternal && encryptionPolicy != Connection.TLSPolicy.disabled && !alreadyTriedSaslExternal) {
+ authenticateUsingSaslExternal();
+ } else if (peerSupportsDialback && !disableDialback) {
+ startDialbackAuth();
+ } else {
+ if (doLog) System.out.println("Unable to do authentication.");
+ throw new InterruptedIOException("Unable to do authentication.");
+ }
+ }
+
+ private void authenticateUsingSaslExternal() throws IOException {
+ if (doLog) System.out.println("Authenticating using SASL EXTERNAL");
+ alreadyTriedSaslExternal = true;
+ final Document outbound = DocumentHelper.createDocument();
+ final Element root = outbound.addElement(QName.get("auth", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ root.addAttribute("mechanism", "EXTERNAL");
+ root.setText(Base64.encodeBytes(XMPP_DOMAIN.getBytes()));
+ send(root.asXML());
+ }
+
+ private void startDialbackAuth() throws IOException {
+ if (doLog) System.out.println("Authenticating using Server Dialback");
+ allowableSocketTimeouts = 10;
+ final String key = "UNITTESTDIALBACKKEY";
+
+ final Document outbound = DocumentHelper.createDocument();
+ final Element root = outbound.addElement(QName.get("result", "db", "urn:xmpp:features:dialback"));
+ root.addAttribute("from", XMPP_DOMAIN);
+ root.addAttribute("to", connectTo);
+ root.setText(key);
+
+ send(root.asXML().replace(" xmlns:db=\"urn:xmpp:features:dialback\"",""));
+ }
+
+ private void processDialbackResult(final Element result) throws IOException {
+ final String type = result.attributeValue("type");
+ if (doLog) System.out.println("Openfire reports Server Dialback result of type " + type);
+ if (!"valid".equals(type)) {
+ throw new InterruptedIOException("Server Dialback failed");
+ }
+
+ if (doLog) System.out.println("Successfully authenticated using Server Dialback! We're done setting up a connection.");
+ done();
+ }
+
+ private boolean processSaslResponse(final Element result) throws IOException {
+ final String name = result.getName();
+ if (doLog) System.out.println("Openfire reports SASL result of type " + name);
+ return "success".equals(name);
+ }
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteReceivingServerDummy.java b/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteReceivingServerDummy.java
new file mode 100644
index 0000000000..75f357e5d2
--- /dev/null
+++ b/xmppserver/src/test/java/org/jivesoftware/openfire/session/RemoteReceivingServerDummy.java
@@ -0,0 +1,472 @@
+/*
+ * Copyright (C) 2023 Ignite Realtime Foundation. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jivesoftware.openfire.session;
+
+import org.dom4j.*;
+import org.jivesoftware.openfire.Connection;
+import org.jivesoftware.openfire.keystore.KeystoreTestUtils;
+import org.jivesoftware.util.StringUtils;
+
+import javax.net.ssl.*;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InterruptedIOException;
+import java.io.OutputStream;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.net.SocketTimeoutException;
+import java.security.KeyPair;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.cert.*;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Provides a network entity that mimics the behavior of a remote XMPP server, when accepting a socket connection.
+ *
+ * @author Guus der Kinderen, guus@goodbytes.nl
+ */
+public class RemoteReceivingServerDummy extends AbstractRemoteServerDummy implements AutoCloseable
+{
+ /**
+ * When switched to 'true', most XMPP interaction will be printed to standard-out.
+ */
+ public static final boolean doLog = false;
+
+ private ServerSocket server;
+
+ private Thread acceptThread;
+ private Acceptor acceptor = new Acceptor();
+
+ private ExecutorService processingService;
+
+ /**
+ * Start accepting socket connections.
+ *
+ * The port on which socket connections are accepted is automatically allocated. Use {@link #getPort()} to obtain it.
+ */
+ public void open() throws Exception
+ {
+ if (server != null) {
+ throw new IllegalStateException("Server already open.");
+ }
+
+ server = new ServerSocket(0);
+
+ processingService = Executors.newCachedThreadPool();
+
+ acceptThread = new Thread(acceptor);
+ acceptThread.start();
+ }
+
+ /**
+ * Stops accepting socket connections and halts processing of data.
+ */
+ @Override
+ public void close() throws Exception
+ {
+ stopAcceptThread();
+
+ stopProcessingService();
+
+ if (server != null) {
+ server.close();
+ server = null;
+ }
+ }
+
+ /**
+ * Get the port on which this instance is accepting sockets.
+ *
+ * @return a port number.
+ */
+ public int getPort() throws IOException
+ {
+ if (server == null) {
+ throw new IllegalStateException("Server not yet running. Did you call 'open()'?");
+ }
+ return server.getLocalPort();
+ }
+
+ public void stopAcceptThread() throws InterruptedException
+ {
+ acceptor.stop();
+ acceptThread.interrupt();
+ final Instant end = Instant.now().plus(SO_TIMEOUT.multipliedBy(20));
+ while (Instant.now().isBefore(end) && acceptThread.getState() != Thread.State.TERMINATED) {
+ Thread.sleep(SO_TIMEOUT.dividedBy(10).toMillis());
+ }
+ final Thread.State finalState = acceptThread.getState();
+ if (finalState != Thread.State.TERMINATED) {
+ if (doLog) System.err.println("Accept thread not terminating after it was stopped. Current state: " + finalState);
+ if (doLog) Arrays.stream(acceptThread.getStackTrace()).forEach(System.err::println);
+ acceptThread.stop();
+ }
+ acceptThread = null;
+ }
+
+ public synchronized void stopProcessingService() throws InterruptedException
+ {
+ processingService.shutdown();
+ final Instant end = Instant.now().plus(SO_TIMEOUT.multipliedBy(20));
+ while (Instant.now().isBefore(end) && !processingService.isTerminated()) {
+ Thread.sleep(SO_TIMEOUT.dividedBy(10).toMillis());
+ }
+ if (!processingService.isTerminated()) {
+ processingService.shutdownNow();
+ }
+ }
+
+ private class Acceptor implements Runnable
+ {
+ boolean shouldStop = false;
+
+ void stop() {
+ shouldStop = true;
+ }
+
+ @Override
+ public void run()
+ {
+ if (doLog) System.out.println("Start accepting socket connections.");
+ while (!shouldStop) {
+ try {
+ server.setSoTimeout((int)SO_TIMEOUT.multipliedBy(10).toMillis());
+ final Socket socket = server.accept();
+ if (doLog) System.out.println("Accepted new socket connection.");
+
+ processingService.submit(new SocketProcessor(socket));
+ } catch (Throwable t) {
+ // Log exception only when not cleanly closed.
+ if (acceptThread != null && !acceptThread.isInterrupted()) {
+ if (!(t instanceof SocketTimeoutException)) {
+ t.printStackTrace();
+ }
+ } else {
+ break;
+ }
+ }
+ }
+ if (doLog) System.out.println("Stopped socket accepting connections.");
+ }
+ }
+
+ private class SocketProcessor implements Runnable
+ {
+ private Socket socket;
+ private OutputStream os;
+ private InputStream is;
+ private boolean isAuthenticated = false;
+
+ /**
+ * To speed up the test execution, SO_TIMEOUT (the socket read timeout) has been set to a low value. When negotiating Server Dialback, a second
+ * socket connection is used. XMPP session establishment on the first socket connection is paused while the Server Dialback negotiation takes
+ * place. This can easily cause the SO_TIMEOUT to run out. To prevent issues, this implementation allows for reads of the first socket connection
+ * to time out for a certain number of times, before treating this as a terminal exception.
+ */
+ private int allowableSocketTimeouts = 0;
+
+ private SocketProcessor(Socket socket) throws IOException
+ {
+ if (doLog) System.out.println("New session on socket.");
+
+ if (socket instanceof SSLSocket) {
+ allowableSocketTimeouts = 10; // A new TLS-connection has been observed to require some extra time (when Dialback-over-TLS is happening).
+ }
+ this.socket = socket;
+ os = socket.getOutputStream();
+ is = socket.getInputStream();
+ }
+
+ public synchronized void send(final String data) throws IOException
+ {
+ if (doLog) System.out.println("# send from remote to Openfire" + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ if (doLog) System.out.println(data);
+ if (doLog) System.out.println();
+ os.write(data.getBytes());
+ os.flush();
+ }
+
+ @Override
+ public void run()
+ {
+ if (doLog) System.out.println("Start reading from socket.");
+ try {
+ do {
+ try {
+ final byte[] buffer = new byte[1024 * 16];
+ int count;
+ while (!processingService.isShutdown() && (count = is.read(buffer)) > 0) {
+ String read = new String(buffer, 0, count);
+
+ // Ugly hack to get Dialback to work.
+ if (read.startsWith("")) {
+ if (doLog) System.out.println("Peer sends a stream error. Can't use this connection anymore.");
+ return;
+ }
+ if (!read.equals("")) {
+ final Element inbound = parse(read);
+ switch (inbound.getName()) {
+ case "stream":
+ sendStreamHeader(inbound);
+ sendStreamFeatures();
+ break;
+ case "starttls":
+ sendStartTlsProceed(inbound);
+ return; // Stop reading from this socket immediately, as it is replaced by a secure socket.
+ case "auth":
+ sendAuthResponse(inbound);
+ break;
+ case "result":
+ processDialback(inbound);
+ break;
+ default:
+ if (doLog) System.out.println("Received stanza '" + inbound.getName() + "' that I don't know how to respond to.");
+ }
+ }
+ }
+ } catch (SocketTimeoutException e) {
+ allowableSocketTimeouts--;
+ if (allowableSocketTimeouts <= 0) {
+ throw e;
+ }
+ }
+ } while (!processingService.isShutdown() && allowableSocketTimeouts > 0);
+ if (doLog) System.out.println("Ending read loop." + (socket instanceof SSLSocket ? " (encrypted)" : ""));
+ } catch (Throwable t) {
+ // Log exception only when not cleanly closed.
+ if (doLog && !processingService.isShutdown()) {
+ t.printStackTrace();
+ }
+ } finally {
+ if (doLog) System.out.println("Stopped reading from socket");
+ }
+ }
+
+ private synchronized void sendStreamHeader(Element inbound) throws IOException
+ {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+
+ if (!disableDialback) {
+ root.add(new Namespace("db", "jabber:server:dialback"));
+ }
+ root.addAttribute("from", XMPP_DOMAIN);
+ root.addAttribute("to", inbound.attributeValue("from", null));
+ root.addAttribute("version", "1.0");
+ root.addAttribute("id", StringUtils.randomString(5));
+
+ send(root.asXML().substring(0, root.asXML().indexOf("")));
+ }
+
+ private synchronized void sendStreamFeatures() throws IOException
+ {
+ final Document root = DocumentHelper.createDocument();
+ final Element features = root.addElement("features");
+ if (!(socket instanceof SSLSocket)) {
+ if (encryptionPolicy != Connection.TLSPolicy.disabled) {
+ final Element startTLS = features.addElement(QName.get("starttls", "urn:ietf:params:xml:ns:xmpp-tls"));
+ if (encryptionPolicy == Connection.TLSPolicy.required) {
+ startTLS.addElement("required");
+ }
+ }
+ if (!isAuthenticated) {
+ if (!disableDialback && encryptionPolicy != Connection.TLSPolicy.required) { // do not offer Dialback if we expect TLS first.
+ features.addElement(QName.get("dialback", "urn:xmpp:features:dialback"));
+ allowableSocketTimeouts = 10; // It's possible that the peer will start dialback. If that's happening, we need to be more forgiving in regard to socket timeouts.
+ }
+ }
+ } else if (!isAuthenticated) {
+ if (!disableDialback) {
+ features.addElement(QName.get("dialback", "urn:xmpp:features:dialback"));
+ allowableSocketTimeouts = 10; // It's possible that the peer will start dialback. If that's happening, we need to be more forgiving in regard to socket timeouts.
+ }
+ final Element mechanisms = features.addElement(QName.get("mechanisms", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ if (doLog) System.out.println(((SSLSocket) socket).getSession().getProtocol());
+ if (doLog) System.out.println(((SSLSocket) socket).getSession().getCipherSuite());
+
+ try {
+ // Throws an exception if the peer (local server) doesn't send a certificate
+ if (doLog) System.out.println(((SSLSocket) socket).getSession().getPeerPrincipal());
+ Certificate[] certificates = ((SSLSocket) socket).getSession().getPeerCertificates();
+ if (certificates != null && encryptionPolicy != Connection.TLSPolicy.disabled) {
+ try {
+ ((X509Certificate) certificates[0]).checkValidity(); // first peer certificate will belong to the local server
+ mechanisms.addElement("mechanism").addText("EXTERNAL");
+ } catch (CertificateExpiredException | CertificateNotYetValidException e) {
+ if (doLog) System.out.println("local certificate is invalid");
+ }
+ }
+ } catch (SSLPeerUnverifiedException e) {
+ if (doLog) System.out.println("local certificate is missing/unverified");
+ }
+ }
+
+ send(root.getRootElement().asXML());
+ }
+
+ private synchronized void sendStartTlsProceed(Element inbound) throws Exception
+ {
+ if (encryptionPolicy == Connection.TLSPolicy.disabled) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+ root.addElement(QName.get("failure", "urn:ietf:params:xml:ns:xmpp-tls"));
+
+ send(root.asXML().substring(root.asXML().indexOf(">")+1));
+ throw new InterruptedIOException("TLS Start received while feature is disabled. Kill the connection");
+ }
+
+ final Document outbound = DocumentHelper.createDocument();
+ outbound.addElement(QName.get("proceed", "urn:ietf:params:xml:ns:xmpp-tls"));
+
+ send(outbound.getRootElement().asXML());
+
+ if (doLog) System.out.println("Replace the socket with one that will do TLS on the next inbound and outbound data");
+
+ final SSLContext sc = SSLContext.getInstance("TLSv1.2");
+
+ sc.init(createKeyManager(generatedPKIX == null ? null : generatedPKIX.getKeyPair(), generatedPKIX == null ? null : generatedPKIX.getCertificateChain()), createTrustManagerThatTrustsAll(), new java.security.SecureRandom());
+ SSLContext.setDefault(sc);
+
+ final SSLSocket sslSocket = (SSLSocket) ((SSLSocketFactory) SSLSocketFactory.getDefault()).createSocket(socket, null, true);
+ sslSocket.setSoTimeout((int) SO_TIMEOUT.toMillis());
+
+ // Just indicate that we would like to authenticate the client but if client
+ // certificates are self-signed or have no certificate chain then we are still
+ // good
+ sslSocket.setWantClientAuth(true); // DO WE NEED TO BRING THIS INTO OUR LocalOutgoingServerSessionTest MATRIX?
+
+ processingService.submit(new SocketProcessor(sslSocket));
+ }
+
+ /**
+ * Responds to a SASL auth request with a SASL result indicating that authentication succeeded.
+ *
+ * Very basic verification is performed by this implementation: if the peer provides a certificate that's not expired, authentication is accepted.
+ *
+ * If TLS is disabled, this sends an authentication failure response.
+ *
+ * @param inbound The SASL request to authenticate.
+ */
+ private synchronized void sendAuthResponse(Element inbound) throws IOException
+ {
+ if (encryptionPolicy == Connection.TLSPolicy.disabled) {
+ isAuthenticated = false;
+
+ final Document outbound = DocumentHelper.createDocument();
+ final Element failure = outbound.addElement(QName.get("failure", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ failure.addElement(QName.get("not-authorized"));
+
+ send(failure.asXML());
+ }
+
+ if (!(socket instanceof SSLSocket)) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Element failure = outbound.addElement(QName.get("failure", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ failure.addElement(QName.get("encryption-required"));
+
+ send(failure.asXML());
+ }
+
+ final X509Certificate[] peerCertificates = (X509Certificate[]) ((SSLSocket) socket).getSession().getPeerCertificates();
+ if (peerCertificates == null || peerCertificates.length == 0 || Instant.now().isAfter(peerCertificates[0].getNotAfter().toInstant()) || Instant.now().isBefore(peerCertificates[0].getNotBefore().toInstant())) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Element failure = outbound.addElement(QName.get("failure", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ failure.addElement(QName.get("not-authorized"));
+
+ send(failure.asXML());
+ }
+
+
+ isAuthenticated = true;
+ final Document root = DocumentHelper.createDocument();
+ root.addElement(QName.get("success", "urn:ietf:params:xml:ns:xmpp-sasl"));
+ send(root.getRootElement().asXML());
+ }
+
+ /**
+ * Responds to a Dialback request with a Dialback result indicating that authentication succeeded.
+ *
+ * Proper Dialback should first verify with an Authoritive Server from the remote domain. This method skips that,
+ * and authenticates blindly.
+ *
+ * @param inbound The Dialback request to authenticate.
+ */
+ private synchronized void processDialback(Element inbound) throws IOException
+ {
+ allowableSocketTimeouts = 10;
+
+ if (disableDialback) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Namespace namespace = new Namespace("stream", "http://etherx.jabber.org/streams");
+ final Element root = outbound.addElement(QName.get("stream", namespace));
+ root.add(Namespace.get("jabber:server"));
+ final Element error = root.addElement(QName.get("error", "stream", "http://etherx.jabber.org/streams"));
+ error.addElement(QName.get("unsupported-stanza-type", "urn:ietf:params:xml:ns:xmpp-streams"));
+
+ send(root.asXML().substring(root.asXML().indexOf(">")+1));
+ throw new InterruptedIOException("Dialback received while feature is disabled. Kill the connection");
+ }
+
+ if (encryptionPolicy == Connection.TLSPolicy.required && !(socket instanceof SSLSocket)) {
+ final Document outbound = DocumentHelper.createDocument();
+ final Element result = outbound.addElement(QName.get("result", "db", "urn:xmpp:features:dialback"));
+ result.addAttribute("from", XMPP_DOMAIN);
+ result.addAttribute("to", inbound.attributeValue("from", null));
+ result.addAttribute("type", "error");
+ final Element error = result.addElement("error");
+ error.addAttribute("type", "cancel");
+ error.addElement("policy-violation", "urn:ietf:params:xml:ns:xmpp-stanzas");
+
+ send(outbound.getRootElement().asXML());
+ return; // spec says to not kill the connection.
+ }
+
+ if (inbound.getTextTrim().isEmpty()) {
+ throw new IllegalStateException("Not supporting processing anything but an initial dialback key submission.");
+ }
+
+ // Skip the check with an Authoritative Server (which is what Dialback _should_ do). Simply report a faked validation result.
+ final Document outbound = DocumentHelper.createDocument();
+ final Element result = outbound.addElement(QName.get("result", "db", "urn:xmpp:features:dialback"));
+ result.addAttribute("from", XMPP_DOMAIN);
+ result.addAttribute("to", inbound.attributeValue("from", null));
+ result.addAttribute("type", "valid");
+
+ send(outbound.getRootElement().asXML());
+ }
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/openfire/session/ServerSettings.java b/xmppserver/src/test/java/org/jivesoftware/openfire/session/ServerSettings.java
new file mode 100644
index 0000000000..4e08e230c0
--- /dev/null
+++ b/xmppserver/src/test/java/org/jivesoftware/openfire/session/ServerSettings.java
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2023 Ignite Realtime Foundation. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jivesoftware.openfire.session;
+
+import org.jivesoftware.openfire.Connection;
+
+/**
+ * Representation of a particular state of server configuration.
+ */
+public class ServerSettings
+{
+ public enum CertificateState
+ {
+ /**
+ * Server does not offer a TLS certificate.
+ */
+ MISSING,
+
+ /**
+ * Server offers a TLS certificate that is somehow not valid (it expired, is self-signed, uses a root CA that's not recognized by the peer, uses an incorrect identity, etc).
+ */
+ INVALID,
+
+ /**
+ * Server offers a TLS certificate that is valid.
+ */
+ VALID
+ }
+
+// public enum TlsMutualAuthenticationPolicy {
+// /** Local Server will not attempt to identify peer, using its TLS certificate. */
+// DISABLED,
+//
+// /** Local Server will attempt to identify peer, but only if it provides its TLS certificate. */
+// WANTED,
+//
+// /** Local Server will fail to establish a connection if it cannot verify peer's TLS certificate. */
+// NEEDED
+// }
+
+ /**
+ * Defines if this entity requires/disables or can use TLS for encryption (this does not mandate TLS-based authentication).
+ */
+ public final Connection.TLSPolicy encryptionPolicy;
+
+ /**
+ * Describes the certificate that's offered by this entity.
+ */
+ public final CertificateState certificateState;
+
+ /**
+ * When Dialback is allowed, unauthenticated TLS encryption is better than no encryption. This, however, breaks with
+ * a strict interpretation of RFC 6120 section 13.7.2 (while it appears allowable in RFC 7590 Section 3.4). Openfire
+ * con be configured either way, by setting the 'strict certificate validation' configuration. This field will take
+ * into account that setting.
+ */
+ public final boolean strictCertificateValidation;
+
+ /**
+ * Defines if this entity will support the Dialback authentication mechanism.
+ */
+ public final boolean dialbackSupported;
+
+// /**
+// * Defines if this entity will attempt/require/ignore to validate the peer's certificate
+// */
+// public final TlsMutualAuthenticationPolicy tlsMutualAuthenticationPolicy;
+
+ public ServerSettings(final Connection.TLSPolicy encryptionPolicy, final CertificateState certificateState, final boolean strictCertificateValidation, final boolean dialbackSupported)
+ {
+ this.encryptionPolicy = encryptionPolicy;
+ this.certificateState = certificateState;
+ this.strictCertificateValidation = strictCertificateValidation;
+ this.dialbackSupported = dialbackSupported;
+ }
+
+ @Override
+ public String toString()
+ {
+ return toString(5);
+ }
+
+ public String toString(int length)
+ {
+ if (length > 0) {
+ return "[encryption=" + encryptionPolicy.toString().substring(0, length) + ", certificate=" + certificateState.toString().substring(0, length) + ", strictCertValidation=" + strictCertificateValidation + ", dialback=" + (dialbackSupported ? "SUPPORTED" : "DISABLED").substring(0, length) + "]";
+ } else {
+ return "[encryption=" + encryptionPolicy.toString() + ", certificate=" + certificateState.toString() + ", strictCertValidation=" + strictCertificateValidation + ", dialback=" + (dialbackSupported ? "SUPPORTED" : "DISABLED") + "]";
+ }
+ }
+}
diff --git a/xmppserver/src/test/java/org/jivesoftware/util/CertificateManagerTest.java b/xmppserver/src/test/java/org/jivesoftware/util/CertificateManagerTest.java
index 1b35d4d829..300badd1fd 100644
--- a/xmppserver/src/test/java/org/jivesoftware/util/CertificateManagerTest.java
+++ b/xmppserver/src/test/java/org/jivesoftware/util/CertificateManagerTest.java
@@ -62,6 +62,10 @@ public class CertificateManagerTest
public static final ASN1ObjectIdentifier XMPP_ADDR_OID = new ASN1ObjectIdentifier( "1.3.6.1.5.5.7.8.5" );
public static final ASN1ObjectIdentifier DNS_SRV_OID = new ASN1ObjectIdentifier( "1.3.6.1.5.5.7.8.7" );
+ public static final int KEY_SIZE = 512;
+ public static final String KEY_ALGORITHM = "RSA";
+ public static final String SIGNATURE_ALGORITHM = "SHA1withRSA";
+
private static KeyPairGenerator keyPairGenerator;
private static KeyPair subjectKeyPair;
private static KeyPair issuerKeyPair;
@@ -70,12 +74,12 @@ public class CertificateManagerTest
@BeforeAll
public static void initialize() throws Exception
{
- keyPairGenerator = KeyPairGenerator.getInstance( "RSA" );
- keyPairGenerator.initialize( 512 );
+ keyPairGenerator = KeyPairGenerator.getInstance( KEY_ALGORITHM );
+ keyPairGenerator.initialize( KEY_SIZE );
subjectKeyPair = keyPairGenerator.generateKeyPair();
issuerKeyPair = keyPairGenerator.generateKeyPair();
- contentSigner = new JcaContentSignerBuilder( "SHA1withRSA" ).build( issuerKeyPair.getPrivate() );
+ contentSigner = new JcaContentSignerBuilder( SIGNATURE_ALGORITHM ).build( issuerKeyPair.getPrivate() );
}
/**
@@ -347,11 +351,10 @@ public void testGenerateCertificateDateValidity() throws Exception
final String issuerCommonName = "issuer common name";
final String subjectCommonName = "subject common name";
final String domain = "domain.example.org";
- final String signAlgoritm = "SHA256WITHRSAENCRYPTION";
final Set sanDnsNames = Stream.of( "alternative-a.example.org", "alternative-b.example.org" ).collect( Collectors.toSet() );
// Execute system under test.
- final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, signAlgoritm, sanDnsNames );
+ final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, SIGNATURE_ALGORITHM, sanDnsNames );
// Verify results.
assertNotNull( result );
@@ -374,11 +377,10 @@ public void testGenerateCertificateIssuer() throws Exception
final String issuerCommonName = "issuer common name";
final String subjectCommonName = "subject common name";
final String domain = "domain.example.org";
- final String signAlgoritm = "SHA256WITHRSAENCRYPTION";
final Set sanDnsNames = Stream.of( "alternative-a.example.org", "alternative-b.example.org" ).collect( Collectors.toSet() );
// Execute system under test.
- final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, signAlgoritm, sanDnsNames );
+ final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, SIGNATURE_ALGORITHM, sanDnsNames );
// Verify results.
assertNotNull( result );
@@ -400,11 +402,10 @@ public void testGenerateCertificateSubject() throws Exception
final String issuerCommonName = "issuer common name";
final String subjectCommonName = "subject common name";
final String domain = "domain.example.org";
- final String signAlgoritm = "SHA256WITHRSAENCRYPTION";
final Set sanDnsNames = Stream.of( "alternative-a.example.org", "alternative-b.example.org" ).collect( Collectors.toSet() );
// Execute system under test.
- final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, signAlgoritm, sanDnsNames );
+ final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, SIGNATURE_ALGORITHM, sanDnsNames );
// Verify results.
assertNotNull( result );
@@ -426,11 +427,10 @@ public void testGenerateCertificateSubjectAlternativeNames() throws Exception
final String issuerCommonName = "issuer common name";
final String subjectCommonName = "subject common name";
final String domain = "domain.example.org";
- final String signAlgoritm = "SHA256WITHRSAENCRYPTION";
final Set sanDnsNames = Stream.of( "alternative-a.example.org", "alternative-b.example.org" ).collect( Collectors.toSet() );
// Execute system under test.
- final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, signAlgoritm, sanDnsNames );
+ final X509Certificate result = CertificateManager.createX509V3Certificate( keyPair, days, issuerCommonName, subjectCommonName, domain, SIGNATURE_ALGORITHM, sanDnsNames );
// Verify results.
assertNotNull( result );