google / google/conscrypt

SSLSocket via another SSLSocket not working

Open
#104 22 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

It seems like creating an SSLSocket on top of another SSLSocket does not work using the Conscrypt SSL Provider.

When creating an SSLSocket over an existing SSLSocket via `SSLSocketFactory.createSocket()`, the call to `SSLSocket.startHandshake()` never returns.

The handshake for the underlying `SSLSocket` and the `SSLSocket` on top is done like shown in the following snippet. While it works fine for the first `SSLSocket` (where a normal tcp Socket is passed as socket parameter), it doesn’t return for the second `SSLSocket` (where the first `SSLSocket` is passed as socket parameter). Neither the line printing "Handshake finished" nor the catch block are reached.
The very same code works fine with the JRE default SSL Provider.

private Socket doSSLHandshake(Socket socket, String host, int port) throws IOException {
// For easier debugging purpose, trust all certificates
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager(){
public X509Certificate[] getAcceptedIssuers(){ return null; }
public void checkClientTrusted(X509Certificate[] certs, String authType) {}
public void checkServerTrusted(X509Certificate[] certs, String authType) {}
}
};

System.out.println("Doing SSL handshake with " + host + ":" + port);

try {
Provider provider = new OpenSSLProvider();
SSLContext sslContext = SSLContext.getInstance("TLS", provider);
sslContext.init(null, trustAllCerts, new SecureRandom());
SSLSocket sslSocket = (SSLSocket) sslContext.getSocketFactory().createSocket(socket, host, port, true);
sslSocket.startHandshake();
System.out.println("Handshake finished");

return sslSocket;
} catch (KeyManagementException | NoSuchAlgorithmException e) {
throw new IOException("Could not do SSL handshake: " + e);
}
}

**Configuration:**
- JRE 1.8.0_74-b02
- macOS Sierra 10.12.1
- As I could not find a pre-compiled jar of the newest version (the link in the description yields no results), I'm using a 1.0.0-Snapshot from late January I found here: https://oss.sonatype.org/content/repositories/snapshots/org/conscrypt/conscrypt-openjdk/1.0.0-SNAPSHOT/

**Steps to reproduce the problem:**
(Using a SocketFactory obtained from the Conscrypt Provider)
1. Create an SSLSocket over a normal TCP Socket (via `SSLSocketFactory.createSocket()`)
2. Over the newly created SSLSocket, create another SSLSocket (via `SSLSocketFactory.createSocket()`)
3. The second handshake will fail with the exception listed above

I have created a sample project that tries to connect to an HTTPS server via a Secure Web Proxy: https://github.com/FD-/SSLviaSSL/tree/conscrypt.

The issue might be related to [Android issue #234291](https://code.google.com/p/android/issues/detail?id=234291) (I actually came across the Conscrypt project by investigating this issue).
While the conscrypt branch in my repository contains details about the Conscrypt issue, the master branch describes the Android issue.

**Expected result:**
I'd expect creating an SSLSocket over an existing SSLSocket to work. The second handshake should return successfully.

Please let me know if you need further details on the issue!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.