If {@code authOn} is {@code true}, the method checks if the SSL session associated
+ * with the given session ID is still alive. If the SSL session persists beyond the
+ * specified timeout period, an {@link AssertionError} is thrown.
+ *
If {@code authOn} is {@code false}, the method checks if there are any peer certificates
+ * associated with the SSL session. If peer certificates are found, an {@link AssertionError}
+ * is thrown, indicating that the session was authenticated.
+ *
+ *
+ * @param sessionID the session ID to check for authentication status
+ * @param authOn a flag indicating whether authentication is currently enabled
+ * @throws AssertionError if the session is still authenticated after the timeout period
+ * (when {@code authOn} is {@code true}) or if peer certificates are found
+ * (when {@code authOn} is {@code false})
+ */
+ public void assertNotAuthenticated(SessionID sessionID, boolean authOn) {
+ Session session = findSession(sessionID);
+ SSLSession sslSession = SSLUtil.findSSLSession(session);
+
+ if (sslSession == null) {
+ return;
+ }
+
+ if (authOn) {
+ // when authentication is on, the SSL session maybe still be alive (invalid) for some time
+ long startTime = System.nanoTime();
+
+ while (SSLUtil.findSSLSession(session) != null) {
+ try {
+ Thread.sleep(100);
+ } catch (InterruptedException e) {
+ Thread.currentThread().interrupt();
+ throw new RuntimeException("Thread was interrupted", e);
+ }
+
+ if (TimeUnit.NANOSECONDS.toSeconds(System.nanoTime() - startTime) >= TIMEOUT_SECONDS) {
+ throw new AssertionError("SSL session still exists for session: " + sessionID);
+ }
+ }
+ } else {
+ // when authentication is off, there must be no peer certificates
+ Certificate[] peerCertificates = SSLUtil.getPeerCertificates(sslSession);
+
+ if (peerCertificates != null && peerCertificates.length > 0) {
+ throw new AssertionError("Certificate was authenticated");
+ }
+ }
+ }
+
+ public void assertLoggedOn(SessionID sessionID) {
+ Session session = findSession(sessionID);
+
+ if (session == null) {
+ throw new AssertionError("No session found: " + sessionID);
+ }
+
+ if (!session.isLoggedOn()) {
+ throw new AssertionError("Session is not logged on: " + session);
+ }
+ }
+
+ public void assertNotLoggedOn(SessionID sessionID) {
+ Session session = findSession(sessionID);
+
+ if (session == null) {
+ throw new AssertionError("No session found: " + sessionID);
+ }
+
+ if (session.isLoggedOn()) {
+ throw new AssertionError("Session is logged on: " + session);
+ }
+ }
+
+ public void assertSslExceptionThrown() throws Exception {
+ assertSslExceptionThrown(null, null);
+ }
+
+ public void assertSslExceptionThrown(String expectedErrorMessage, Class expectedErrorType) throws Exception {
+ boolean reachedZero = exceptionThrownLatch.await(TIMEOUT_SECONDS, TimeUnit.SECONDS);
+
+ if (!reachedZero) {
+ throw new AssertionError("No SSL exception thrown");
+ }
+
+ Throwable throwable = exception.get();
+
+ if (expectedErrorMessage != null) {
+ String thrownErrorMessage = throwable.getMessage();
+ assertTrue("Thrown error message: " + thrownErrorMessage + " does not contain: " + expectedErrorMessage,
+ thrownErrorMessage != null && thrownErrorMessage.contains(expectedErrorMessage));
+ }
+
+ if (expectedErrorType != null) {
+ assertSame(expectedErrorType, throwable.getClass());
+ }
+ }
+
+ public void assertNoSslExceptionThrown() throws Exception {
+ boolean reachedZero = exceptionThrownLatch.await(TIMEOUT_SECONDS, TimeUnit.SECONDS);
+
+ if (reachedZero) {
+ throw new AssertionError("SSL exception thrown");
+ }
+ }
+
+ public void assertSNIHostName(SessionID sessionID, String expectedSniHostName) {
+ Session session = findSession(sessionID);
+ SSLSession sslSession = SSLUtil.findSSLSession(session);
+
+ if (sslSession == null) {
+ throw new AssertionError("No SSL session found: " + sessionID);
+ }
+
+ String sniHostName = SSLUtil.getSniHostName(sslSession);
+
+ if (sniHostName == null) {
+ throw new AssertionError("SNIHostName not found: " + sessionID);
+ }
+
+ assertEquals("Expected SNIHostName: " + expectedSniHostName + " does not match actual: " + sniHostName, expectedSniHostName, sniHostName);
+ }
+
+ public void assertNoSNIHostName(SessionID sessionID) {
+ Session session = findSession(sessionID);
+ SSLSession sslSession = SSLUtil.findSSLSession(session);
+
+ if (sslSession == null) {
+ throw new AssertionError("No SSL session found: " + sessionID);
+ }
+
+ String sniHostName = SSLUtil.getSniHostName(sslSession);
+
+ if (sniHostName != null) {
+ throw new AssertionError("SNIHostName found: " + sniHostName);
+ }
+ }
+
+ public void start() throws RuntimeError, ConfigError {
+ connector.start();
+ }
+
+ public void stop() {
+ try {
+ logSSLInfo();
+ } catch (Exception e) {
+ LOGGER.error("Failed to log SSL info", e);
+ }
+
+ connector.stop();
+ }
+
+ private void logSSLInfo() {
+ List sessionsIDs = connector.getSessions();
+ LOGGER.info("All session IDs: {}", sessionsIDs);
+
+ for (SessionID sessionID : sessionsIDs) {
+ Session session = findSession(sessionID);
+
+ if (session == null) {
+ LOGGER.info("No session found for ID: {}", sessionID);
+ continue;
+ }
+
+ SSLSession sslSession = SSLUtil.findSSLSession(session);
+
+ if (sslSession == null) {
+ LOGGER.info("No SSL session found for session: {}", session);
+ continue;
+ }
+
+ Throwable exception = this.exception.get();
+ String exceptionMessage = exception != null ? exception.getMessage() : null;
+ Class exceptionType = exception != null ? exception.getClass() : null;
+ Certificate[] peerCertificates = SSLUtil.getPeerCertificates(sslSession);
+ Principal peerPrincipal = SSLUtil.getPeerPrincipal(sslSession);
+ SSLEngine sslEngine = SSLUtil.getSSLEngine(session);
+ SSLEngineResult.HandshakeStatus handshakeStatus = sslEngine != null ? sslEngine.getHandshakeStatus() : null;
+
+ LOGGER.info("SSL session info [sessionID={},isLoggedOn={},sslSession={},sslSession.valid={},peerCertificates={},peerPrincipal={},exceptionMessage={},exceptionType={},handshakeStatus={}]",
+ sessionID, session.isLoggedOn(), sslSession, sslSession.isValid(), peerCertificates, peerPrincipal, exceptionMessage, exceptionType, handshakeStatus);
+ }
+ }
+ }
+
+ static class TestAcceptor extends TestConnector {
+ private static final Logger LOGGER = LoggerFactory.getLogger(TestAcceptor.class);
+
+ public TestAcceptor(SessionSettings sessionSettings) throws ConfigError {
+ super(sessionSettings);
+ }
+
+ @Override
+ public SessionConnector createConnector(SessionSettings sessionSettings) throws ConfigError {
+ LOGGER.info("Creating acceptor: {}", sessionSettings);
+
+ MessageStoreFactory messageStoreFactory = new MemoryStoreFactory();
+ MessageFactory messageFactory = new DefaultMessageFactory();
+
+ return new ThreadedSocketAcceptor(new ApplicationAdapter(),
+ messageStoreFactory, sessionSettings, messageFactory);
+ }
+ }
+
+ static class TestInitiator extends TestConnector {
+ private static final Logger LOGGER = LoggerFactory.getLogger(TestInitiator.class);
+
+ public TestInitiator(SessionSettings sessionSettings) throws ConfigError {
+ super(sessionSettings);
+ }
+
+ @Override
+ public SessionConnector createConnector(SessionSettings sessionSettings) throws ConfigError {
+ LOGGER.info("Creating initiator: {}", sessionSettings);
+
+ MessageStoreFactory messageStoreFactory = new MemoryStoreFactory();
+ MessageFactory messageFactory = new DefaultMessageFactory();
+
+ return new ThreadedSocketInitiator(new ApplicationAdapter(),
+ messageStoreFactory, sessionSettings, messageFactory);
+ }
+ }
+
+ /**
+ * Creates acceptor settings that contains two sessions. One with SSL support, one without.
+ */
+ private SessionSettings createMixedSessionAcceptorSettings(int sslPort, int nonSslPort, String keyStoreName) {
+ HashMap defaults = new HashMap<>();
+ defaults.put(SessionFactory.SETTING_CONNECTION_TYPE, "acceptor");
+ defaults.put(Session.SETTING_START_TIME, "00:00:00");
+ defaults.put(Session.SETTING_END_TIME, "00:00:00");
+ defaults.put(Session.SETTING_HEARTBTINT, "30");
+
+ SessionSettings sessionSettings = new SessionSettings();
+ sessionSettings.set(defaults);
+
+ SessionID sslSession = new SessionID(FixVersions.BEGINSTRING_FIX44, "ALFA_SSL", "ZULU_SSL");
+ sessionSettings.setString(sslSession, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(sslSession, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(sslSession, "TargetCompID", "ZULU_SSL");
+ sessionSettings.setString(sslSession, "SenderCompID", "ALFA_SSL");
+ sessionSettings.setString(sslSession, SSLSupport.SETTING_USE_SSL, "Y");
+ sessionSettings.setString(sslSession, SSLSupport.SETTING_KEY_STORE_NAME, keyStoreName);
+ sessionSettings.setString(sslSession, SSLSupport.SETTING_KEY_STORE_PWD, "password");
+ sessionSettings.setString(sslSession, SSLSupport.SETTING_NEED_CLIENT_AUTH, "N");
+ sessionSettings.setString(sslSession, "SocketAcceptPort", Integer.toString(sslPort));
+
+ SessionID nonSslSession = new SessionID(FixVersions.BEGINSTRING_FIX44, "ALFA_NON_SSL", "ZULU_NON_SSL");
+ sessionSettings.setString(nonSslSession, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(nonSslSession, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(nonSslSession, "TargetCompID", "ZULU_NON_SSL");
+ sessionSettings.setString(nonSslSession, "SenderCompID", "ALFA_NON_SSL");
+ sessionSettings.setString(nonSslSession, "SocketAcceptPort", Integer.toString(nonSslPort));
+
+ return sessionSettings;
+ }
+
+ private SessionSettings createMultiSessionAcceptorSettings(String keyStoreName, boolean needClientAuth,
+ String[] trustStoreNames, String cipherSuites, String protocols) {
+ HashMap defaults = new HashMap<>();
+ defaults.put(SessionFactory.SETTING_CONNECTION_TYPE, "acceptor");
+ defaults.put(SSLSupport.SETTING_USE_SSL, "Y");
+ defaults.put(SSLSupport.SETTING_KEY_STORE_NAME, keyStoreName);
+ defaults.put(SSLSupport.SETTING_KEY_STORE_PWD, "password");
+ defaults.put(SSLSupport.SETTING_NEED_CLIENT_AUTH, needClientAuth ? "Y" : "N");
+ defaults.put(Session.SETTING_START_TIME, "00:00:00");
+ defaults.put(Session.SETTING_END_TIME, "00:00:00");
+ defaults.put(Session.SETTING_HEARTBTINT, "30");
+
+ if (cipherSuites != null) {
+ defaults.put(SSLSupport.SETTING_CIPHER_SUITES, cipherSuites);
+ }
+
+ if (protocols != null) {
+ defaults.put(SSLSupport.SETTING_ENABLED_PROTOCOLS, protocols);
+ }
+
+ SessionSettings sessionSettings = new SessionSettings();
+ sessionSettings.set(defaults);
+
+ for (int i = 0; i < trustStoreNames.length; i++) {
+ SessionID sessionID = new SessionID(FixVersions.BEGINSTRING_FIX44, "ALFA" + i, "ZULU" + i);
+ sessionSettings.setString(sessionID, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(sessionID, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(sessionID, "TargetCompID", "ZULU" + i);
+ sessionSettings.setString(sessionID, "SenderCompID", "ALFA" + i);
+ sessionSettings.setString(sessionID, SSLSupport.SETTING_TRUST_STORE_NAME, trustStoreNames[i]);
+ sessionSettings.setString(sessionID, SSLSupport.SETTING_TRUST_STORE_PWD, "password");
+ sessionSettings.setString(sessionID, "SocketAcceptPort", "1234" + i);
+ }
+
+ return sessionSettings;
+ }
+
+ private SessionSettings createAcceptorSettings(String keyStoreName, boolean needClientAuth, String trustStoreName,
+ String cipherSuites, String protocols, String keyStoreType, String trustStoreType, int port) {
+ HashMap defaults = new HashMap<>();
+ defaults.put(SessionFactory.SETTING_CONNECTION_TYPE, "acceptor");
+ defaults.put(SSLSupport.SETTING_USE_SSL, "Y");
+ defaults.put(SSLSupport.SETTING_KEY_STORE_NAME, keyStoreName);
+ defaults.put(SSLSupport.SETTING_KEY_STORE_PWD, "password");
+
+ if (keyStoreType != null) {
+ defaults.put(SSLSupport.SETTING_KEY_STORE_TYPE, keyStoreType);
+ }
+
+ if (trustStoreName != null) {
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_NAME, trustStoreName);
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_PWD, "password");
+
+ if (trustStoreType != null) {
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_TYPE, trustStoreType);
+ }
+ }
+
+ defaults.put(SSLSupport.SETTING_NEED_CLIENT_AUTH, needClientAuth ? "Y" : "N");
+ defaults.put(Acceptor.SETTING_SOCKET_ACCEPT_PORT, Integer.toString(port));
+ defaults.put(Session.SETTING_START_TIME, "00:00:00");
+ defaults.put(Session.SETTING_END_TIME, "00:00:00");
+ defaults.put(Session.SETTING_HEARTBTINT, "30");
+
+ if (cipherSuites != null) {
+ defaults.put(SSLSupport.SETTING_CIPHER_SUITES, cipherSuites);
+ }
+
+ if (protocols != null) {
+ defaults.put(SSLSupport.SETTING_ENABLED_PROTOCOLS, protocols);
+ }
+
+ SessionID sessionID = new SessionID(FixVersions.BEGINSTRING_FIX44, "ALFA", "ZULU");
+
+ SessionSettings sessionSettings = new SessionSettings();
+ sessionSettings.set(defaults);
+ sessionSettings.setString(sessionID, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(sessionID, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(sessionID, "SenderCompID", "ALFA");
+ sessionSettings.setString(sessionID, "TargetCompID", "ZULU");
+
+ return sessionSettings;
+ }
+
+ private SessionSettings createInitiatorSettings(String keyStoreName, String trustStoreName, String cipherSuites,
+ String protocols, String senderId, String targetId, String port, String keyStoreType,
+ String trustStoreType) {
+ return createInitiatorSettings(keyStoreName, trustStoreName, cipherSuites, protocols, senderId, targetId, port,keyStoreType, trustStoreType, null);
+ }
+
+ private SessionSettings createInitiatorSettings(String keyStoreName, String trustStoreName, String cipherSuites,
+ String protocols, String senderId, String targetId, String port, String keyStoreType,
+ String trustStoreType, String endpointIdentificationAlgorithm) {
+ return createInitiatorSettings(keyStoreName, trustStoreName, cipherSuites, protocols, senderId, targetId, port,keyStoreType, trustStoreType, endpointIdentificationAlgorithm, null, -1, false, null);
+ }
+
+ private SessionSettings createInitiatorSettings(String keyStoreName, String trustStoreName, String cipherSuites,
+ String protocols, String senderId, String targetId, String port, String keyStoreType,
+ String trustStoreType, String endpointIdentificationAlgorithm,
+ String proxyHost, int proxyPort,
+ boolean useSni, String sniHostName) {
+
+ HashMap defaults = new HashMap<>();
+ defaults.put(SessionFactory.SETTING_CONNECTION_TYPE, "initiator");
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_PROTOCOL, ProtocolFactory.getTypeString(ProtocolFactory.SOCKET));
+ defaults.put(SSLSupport.SETTING_USE_SSL, "Y");
+ defaults.put(SSLSupport.SETTING_KEY_STORE_NAME, keyStoreName);
+ defaults.put(SSLSupport.SETTING_KEY_STORE_PWD, "password");
+
+ if (proxyHost != null) {
+ defaults.put(Initiator.SETTING_PROXY_HOST, proxyHost);
+ defaults.put(Initiator.SETTING_PROXY_PORT, Integer.toString(proxyPort));
+ defaults.put(Initiator.SETTING_PROXY_TYPE, "socks");
+ defaults.put(Initiator.SETTING_PROXY_VERSION, "5");
+ defaults.put(Initiator.SETTING_PROXY_USER, "proxy-user");
+ defaults.put(Initiator.SETTING_PROXY_PASSWORD, "proxy-password");
+ }
+
+ if (keyStoreType != null) {
+ defaults.put(SSLSupport.SETTING_KEY_STORE_TYPE, keyStoreType);
+ }
+
+ if (trustStoreName != null) {
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_NAME, trustStoreName);
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_PWD, "password");
+
+ if (trustStoreType != null) {
+ defaults.put(SSLSupport.SETTING_TRUST_STORE_TYPE, trustStoreType);
+ }
+ }
+
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_HOST, "localhost");
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_PORT, port);
+ defaults.put(Initiator.SETTING_RECONNECT_INTERVAL, "2");
+ defaults.put(Session.SETTING_START_TIME, "00:00:00");
+ defaults.put(Session.SETTING_END_TIME, "00:00:00");
+ defaults.put(Session.SETTING_HEARTBTINT, "30");
+
+ if (cipherSuites != null) {
+ defaults.put(SSLSupport.SETTING_CIPHER_SUITES, cipherSuites);
+ }
+
+ if (protocols != null) {
+ defaults.put(SSLSupport.SETTING_ENABLED_PROTOCOLS, protocols);
+ }
+
+ if (endpointIdentificationAlgorithm != null) {
+ defaults.put(SSLSupport.SETTING_ENDPOINT_IDENTIFICATION_ALGORITHM, endpointIdentificationAlgorithm);
+ }
+
+ defaults.put(SSLSupport.SETTING_USE_SNI, useSni ? "Y" : "N");
+
+ if (sniHostName != null) {
+ defaults.put(SSLSupport.SETTING_SNI_HOST_NAME, sniHostName);
+ }
+
+ SessionID sessionID = new SessionID(FixVersions.BEGINSTRING_FIX44, senderId, targetId);
+
+ SessionSettings sessionSettings = new SessionSettings();
+ sessionSettings.set(defaults);
+ sessionSettings.setString(sessionID, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(sessionID, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(sessionID, "SenderCompID", senderId);
+ sessionSettings.setString(sessionID, "TargetCompID", targetId);
+
+ return sessionSettings;
+ }
+
+ private SessionSettings createInitiatorSettings(String senderId, String targetId, int port) {
+ HashMap defaults = createDefaults(port);
+
+ SessionID sessionID = new SessionID(FixVersions.BEGINSTRING_FIX44, senderId, targetId);
+
+ SessionSettings sessionSettings = new SessionSettings();
+ sessionSettings.set(defaults);
+ sessionSettings.setString(sessionID, "BeginString", FixVersions.BEGINSTRING_FIX44);
+ sessionSettings.setString(sessionID, "DataDictionary", "FIX44.xml");
+ sessionSettings.setString(sessionID, "SenderCompID", senderId);
+ sessionSettings.setString(sessionID, "TargetCompID", targetId);
+
+ return sessionSettings;
+ }
+
+ private static HashMap createDefaults(int port) {
+ HashMap defaults = new HashMap<>();
+ defaults.put(SessionFactory.SETTING_CONNECTION_TYPE, "initiator");
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_PROTOCOL, ProtocolFactory.getTypeString(ProtocolFactory.SOCKET));
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_HOST, "localhost");
+ defaults.put(Initiator.SETTING_SOCKET_CONNECT_PORT, Integer.toString(port));
+ defaults.put(Initiator.SETTING_RECONNECT_INTERVAL, "2");
+ defaults.put(Session.SETTING_START_TIME, "00:00:00");
+ defaults.put(Session.SETTING_END_TIME, "00:00:00");
+ defaults.put(Session.SETTING_HEARTBTINT, "30");
+ return defaults;
+ }
+}
diff --git a/quickfixj-core/src/test/java/quickfix/mina/ssl/SSLSupportTest.java b/quickfixj-core/src/test/java/quickfix/mina/ssl/SSLSupportTest.java
index 517d0842ad..89bc8552cd 100644
--- a/quickfixj-core/src/test/java/quickfix/mina/ssl/SSLSupportTest.java
+++ b/quickfixj-core/src/test/java/quickfix/mina/ssl/SSLSupportTest.java
@@ -1,14 +1,17 @@
package quickfix.mina.ssl;
-import java.util.Arrays;
-
-import org.junit.Assert;
import org.junit.Test;
-
import quickfix.FixVersions;
import quickfix.SessionID;
import quickfix.SessionSettings;
+import java.util.Arrays;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
public class SSLSupportTest {
@Test
@@ -18,15 +21,18 @@ public void shouldLoadDefaultSslConfig() {
SSLConfig sslConfig = SSLSupport.getSslConfig(sessionSettings, sessionID);
- Assert.assertNull(sslConfig.getEnabledCipherSuites());
- Assert.assertNull(sslConfig.getEnabledProtocols());
- Assert.assertEquals("SunX509", sslConfig.getKeyManagerFactoryAlgorithm());
- Assert.assertEquals(SSLSupport.QUICKFIXJ_KEY_STORE, sslConfig.getKeyStoreName());
- Assert.assertTrue(Arrays.equals(SSLSupport.QUICKFIXJ_KEY_STORE_PWD.toCharArray(), sslConfig.getKeyStorePassword()));
- Assert.assertEquals("JKS", sslConfig.getKeyStoreType());
- Assert.assertEquals("PKIX", sslConfig.getTrustManagerFactoryAlgorithm());
- Assert.assertNull(sslConfig.getTrustStoreName());
- Assert.assertNull(sslConfig.getTrustStorePassword());
- Assert.assertEquals("JKS", sslConfig.getTrustStoreType());
+ assertNull(sslConfig.getEnabledCipherSuites());
+ assertNull(sslConfig.getEnabledProtocols());
+ assertEquals("SunX509", sslConfig.getKeyManagerFactoryAlgorithm());
+ assertEquals(SSLSupport.QUICKFIXJ_KEY_STORE, sslConfig.getKeyStoreName());
+ assertTrue(Arrays.equals(SSLSupport.QUICKFIXJ_KEY_STORE_PWD.toCharArray(), sslConfig.getKeyStorePassword()));
+ assertEquals("JKS", sslConfig.getKeyStoreType());
+ assertEquals("PKIX", sslConfig.getTrustManagerFactoryAlgorithm());
+ assertNull(sslConfig.getTrustStoreName());
+ assertNull(sslConfig.getTrustStorePassword());
+ assertEquals("JKS", sslConfig.getTrustStoreType());
+ assertNull(sslConfig.getEndpointIdentificationAlgorithm());
+ assertFalse(sslConfig.isUseSNI());
+ assertNull(sslConfig.getSniHostName());
}
}
diff --git a/quickfixj-core/src/test/java/quickfix/test/util/SSLUtil.java b/quickfixj-core/src/test/java/quickfix/test/util/SSLUtil.java
new file mode 100644
index 0000000000..bbc59537c6
--- /dev/null
+++ b/quickfixj-core/src/test/java/quickfix/test/util/SSLUtil.java
@@ -0,0 +1,203 @@
+package quickfix.test.util;
+
+import org.apache.mina.core.filterchain.IoFilterChain;
+import org.apache.mina.core.session.AttributeKey;
+import org.apache.mina.core.session.IoSession;
+import org.apache.mina.filter.ssl.SslFilter;
+import org.apache.mina.filter.ssl.SslHandler;
+import quickfix.Session;
+import quickfix.mina.IoSessionResponder;
+import quickfix.mina.ssl.SSLSupport;
+
+import javax.net.ssl.ExtendedSSLSession;
+import javax.net.ssl.SNIServerName;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.net.ssl.SSLSession;
+import java.lang.reflect.Field;
+import java.net.IDN;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.nio.charset.StandardCharsets;
+import java.security.Principal;
+import java.security.cert.Certificate;
+import java.util.List;
+
+/**
+ * A utility class for working with SSL/TLS sessions and retrieving SSL-related information from a {@link Session}.
+ * This class provides methods to find the underlying {@link SSLSession}, retrieve peer certificates, and get the peer principal etc.
+ */
+public final class SSLUtil {
+
+ private static final String IO_SESSION_FIELD_NAME = "ioSession";
+ private static final String SSL_ENGINE_FIELD_NAME = "mEngine";
+ private static final AttributeKey SSL_HANDLER_ATTRIBUTE_KEY = new AttributeKey(SslHandler.class, "handler");
+ private static final Field IO_SESSION_FIELD;
+ private static final Field SSL_ENGINE_FIELD;
+ private static final int SNI_HOST_NAME_TYPE = 0;
+
+ static {
+ try {
+ IO_SESSION_FIELD = IoSessionResponder.class.getDeclaredField(IO_SESSION_FIELD_NAME);
+ IO_SESSION_FIELD.setAccessible(true);
+ } catch (NoSuchFieldException e) {
+ throw new RuntimeException("Unable to get field: " + IO_SESSION_FIELD_NAME, e);
+ }
+
+ try {
+ SSL_ENGINE_FIELD = SslHandler.class.getDeclaredField(SSL_ENGINE_FIELD_NAME);
+ SSL_ENGINE_FIELD.setAccessible(true);
+ } catch (NoSuchFieldException e) {
+ throw new RuntimeException("Unable to get field: " + SSL_ENGINE_FIELD_NAME, e);
+ }
+ }
+
+ private SSLUtil() {
+ }
+
+ /**
+ * Retrieves the {@link SSLSession} associated with the given {@link Session}.
+ *
+ * @param session the session from which to retrieve the {@link SSLSession}.
+ * @return the {@link SSLSession} if found, or {@code null} if no SSL session is available.
+ */
+ public static SSLSession findSSLSession(Session session) {
+ IoSession ioSession = findIoSession(session);
+
+ if (ioSession == null) {
+ return null;
+ }
+
+ IoFilterChain filterChain = ioSession.getFilterChain();
+ SslFilter sslFilter = (SslFilter) filterChain.get(SSLSupport.FILTER_NAME);
+
+ if (sslFilter == null) {
+ return null;
+ }
+
+ return (SSLSession) ioSession.getAttribute(SslFilter.SSL_SECURED);
+ }
+
+ /**
+ * Retrieves the {@link IoSession} associated with the given {@link Session}.
+ *
+ * @param session the session from which to retrieve the {@link IoSession}.
+ * @return the {@link IoSession} if found, or {@code null} if no underlying session is available.
+ */
+ public static IoSession findIoSession(Session session) {
+ IoSessionResponder ioSessionResponder = (IoSessionResponder) session.getResponder();
+
+ if (ioSessionResponder == null) {
+ return null;
+ }
+
+ try {
+ return (IoSession) IO_SESSION_FIELD.get(ioSessionResponder);
+ } catch (IllegalAccessException e) {
+ throw new RuntimeException("Failed to get IO session field", e);
+ }
+ }
+
+ /**
+ * Retrieves the {@link SslHandler} associated with the given {@link Session}.
+ * This method first finds the corresponding {@link IoSession} for the provided session,
+ * then retrieves the {@link SslFilter} from the session's filter chain.
+ * If the filter is found, it returns the {@link SslHandler} stored as an attribute in the {@link IoSession}.
+ *
+ * @param session The session for which to retrieve the {@link SslHandler}.
+ * @return The {@link SslHandler} associated with the session, or {@code null} if either
+ * the {@link IoSession} or the {@link SslFilter} is not found.
+ */
+ public static SslHandler getSSLHandler(Session session) {
+ IoSession ioSession = findIoSession(session);
+
+ if (ioSession == null) {
+ return null;
+ }
+
+ IoFilterChain filterChain = ioSession.getFilterChain();
+ SslFilter sslFilter = (SslFilter) filterChain.get(SSLSupport.FILTER_NAME);
+
+ if (sslFilter == null) {
+ return null;
+ }
+
+ return (SslHandler) ioSession.getAttribute(SSL_HANDLER_ATTRIBUTE_KEY);
+ }
+
+ /**
+ * Retrieves the {@link SSLEngine} associated with the given {@link Session}.
+ * This method first retrieves the {@link SslHandler} using {@link #getSSLHandler(Session)},
+ * and then attempts to access the {@link SSLEngine} stored within the {@link SslHandler}
+ * using reflection.
+ *
+ * @param session The session for which to retrieve the {@link SSLEngine}.
+ * @return The {@link SSLEngine} associated with the session, or {@code null} if the
+ * {@link SslHandler} is not found.
+ */
+ public static SSLEngine getSSLEngine(Session session) {
+ SslHandler sslHandler = getSSLHandler(session);
+
+ if (sslHandler == null) {
+ return null;
+ }
+
+ try {
+ return (SSLEngine) SSL_ENGINE_FIELD.get(sslHandler);
+ } catch (IllegalAccessException e) {
+ throw new RuntimeException("Failed to get SSL engine field", e);
+ }
+ }
+
+ /**
+ * Retrieves the peer certificates from the given {@link SSLSession}.
+ *
+ * @param sslSession the SSL session from which to retrieve the peer certificates.
+ * @return an array of {@link Certificate} objects representing the peer certificates, or {@code null} if the peer is unverified.
+ */
+ public static Certificate[] getPeerCertificates(SSLSession sslSession) {
+ try {
+ return sslSession.getPeerCertificates();
+ } catch (SSLPeerUnverifiedException e) {
+ return null;
+ }
+ }
+
+ /**
+ * Retrieves the peer principal from the given {@link SSLSession}.
+ *
+ * @param sslSession the SSL session from which to retrieve the peer principal.
+ * @return the {@link Principal} representing the peer, or {@code null} if the peer is unverified.
+ */
+ public static Principal getPeerPrincipal(SSLSession sslSession) {
+ try {
+ return sslSession.getPeerPrincipal();
+ } catch (SSLPeerUnverifiedException e) {
+ return null;
+ }
+ }
+
+ /**
+ * Retrieves the first SNI Server Name that is SNI Host Name (type=0) provided in ClientHello.
+ *
+ * @param sslSession the SSL session from which to retrieve SNI Host Name
+ * @return the SNI Host Name SSL extensions value, or {@code null} if extension neither compatible nor available
+ */
+ public static String getSniHostName(SSLSession sslSession) {
+ if (!(sslSession instanceof ExtendedSSLSession)) {
+ return null;
+ }
+
+ ExtendedSSLSession extendedSSLSession = (ExtendedSSLSession) sslSession;
+ List requestedServerNames = extendedSSLSession.getRequestedServerNames();
+
+ for (SNIServerName serverName : requestedServerNames) {
+ if (serverName.getType() == SNI_HOST_NAME_TYPE) {
+ String asciiServerName = new String(serverName.getEncoded(), StandardCharsets.US_ASCII);
+ return IDN.toUnicode(asciiServerName, IDN.USE_STD3_ASCII_RULES);
+ }
+ }
+
+ return null;
+ }
+}