Re: BCJSSE close notify problem

Hi Hwangfu,

TlsCloseNotifyException is thrown when the remote peer fails to send a
close_notify warning alert before closing the connection. When this
alert is missing, there is the possibility of a truncation attack (data
missing from the end). For some protocols (usually including HTTPS),
this may be tolerated if the application data still parses correctly.

So, in your example, if you see TlsCloseNotifyException, it means maybe
you didn't receive the whole response. You have to check the response
itself is e.g. correctly formatted HTML.

I want to mention that the TLS code you are using is our legacy API. I
would suggest you upgrade to BC 1.59 and use bctls-jdk15on-159.jar,
which contains a JSSE provider ("BCJSSE"). By registering the BCJSSE
provider, you can then use it via the javax.net.ssl classes. Also, if
you want to write an HTTPS client, you can then use a mature HTTPS
implementation (e.g. Apache HttpComponents) configured with BCJSSE.

You may find many code examples on the internet using
org.bounycastle.crypto.tls, but these are from before BCJSSE was
available, and BCJSSE is a much better choice for almost everybody now.

Regards,
Pete Dettman


On 17/5/18 9:46 am, Huangfu wrote:
> hello
>    we use
> https://github.com/fiorenzino/client16/blob/master/src/test/java/com/jpeppol/client16/MyTLSSocketSecureFactory.java
> to build  axis1.4 webservice client use SimpleTestHttp test link
> nnb.tbb.com.tw this code is:(nnb.tbb.com.tw is open)
> //
> import java.io.IOException;
> import java.io.BufferedReader;
> import java.io.InputStreamReader;
> import java.net.Socket;
> 
> import org.bouncycastle.crypto.tls.CertificateRequest;
> import org.bouncycastle.crypto.tls.DefaultTlsClient;
> import org.bouncycastle.crypto.tls.TlsAuthentication;
> import org.bouncycastle.crypto.tls.TlsClientProtocol;
> import org.bouncycastle.crypto.tls.TlsCredentials;
> 
> /**
>  * Created by fiorenzo on 10/06/16.
>  */
> public class SimpleTestHttp {
> 
> 
>     public static void main(String[] args) throws Exception {
>         java.security.SecureRandom secureRandom = new
> java.security.SecureRandom();
>         Socket socket = new
> Socket(java.net.InetAddress.getByName("nnb.tbb.com.tw"), 443);
>         TlsClientProtocol protocol = new
> TlsClientProtocol(socket.getInputStream(), socket.getOutputStream(),
> secureRandom);
>         DefaultTlsClient client = new DefaultTlsClient() {
>             public TlsAuthentication getAuthentication() throws IOException
> {
>                 TlsAuthentication auth = new TlsAuthentication() {
>                     // Capture the server certificate information!
>                     public void
> notifyServerCertificate(org.bouncycastle.crypto.tls.Certificate
> serverCertificate) throws IOException {
>                     }
> 
>                     public TlsCredentials
> getClientCredentials(CertificateRequest certificateRequest) throws
> IOException {
>                         return null;
>                     }
>                 };
>                 return auth;
>             }
>         };
>         protocol.connect(client);
> 
>         java.io.OutputStream output = protocol.getOutputStream();
>         output.write("GET / HTTP/1.1\r\n".getBytes("UTF-8"));
>         output.write("Host: ap-test.jpeppol.com\r\n".getBytes("UTF-8"));
>         output.write("Connection: close\r\n".getBytes("UTF-8")); // So the
> server will close socket immediately.
>         output.write("\r\n".getBytes("UTF-8")); // HTTP1.1 requirement: last
> line must be empty line.
>         output.flush();
> 
>         java.io.InputStream input = protocol.getInputStream();
>         BufferedReader reader = new BufferedReader(new
> InputStreamReader(input));
>         String line;
>         while ((line = reader.readLine()) != null) {
>             System.out.println(line);
>             //System.out.println("KKK");
>             
>         }
>     }
> }
> //
> is appear
> //
> HTTP/1.1 200 OK
> Date: Thu, 17 May 2018 02:33:00 GMT
> Last-Modified: Wed, 11 Feb 2009 05:48:21 GMT
> ETag: "2e267-e6-26bb3340"
> Accept-Ranges: bytes
> Content-Length: 230
> Connection: close
> Content-Type: text/html
> Set-Cookie:
> TS01db7c90=014dc385f0bf9942f4cb5c66f5ef66a5ad6e707db855d9d27378ae56f16a75190d1aec5a8a;
> Path=/
> 
> <html>
> Exception in thread "main"
> org.bouncycastle.crypto.tls.TlsNoCloseNotifyException: No close_notify alert
> received before connection closed
> 	at org.bouncycastle.crypto.tls.TlsProtocol.safeReadRecord(Unknown Source)
> 	at org.bouncycastle.crypto.tls.TlsProtocol.readApplicationData(Unknown
> Source)
> 	at org.bouncycastle.crypto.tls.TlsInputStream.read(Unknown Source)
> 	at sun.nio.cs.StreamDecoder$CharsetSD.readBytes(StreamDecoder.java:411)
> 	at sun.nio.cs.StreamDecoder$CharsetSD.implRead(StreamDecoder.java:453)
> 	at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:183)
> 	at java.io.InputStreamReader.read(InputStreamReader.java:167)
> 	at java.io.BufferedReader.fill(BufferedReader.java:136)
> 	at java.io.BufferedReader.readLine(BufferedReader.java:299)
> 	at java.io.BufferedReader.readLine(BufferedReader.java:362)
> 	at userstar.SimpleTestHttp.main(SimpleTestHttp.java:49)
> <head>
> <title>Web-Page-Redirect</title>
> 
> </head>
> <body onload="return URLRedirect();">
> </body>
> </html>
> ///
> is web service server error or web service client is error
> if  web service server error  How to fix?
> if  web service client Can avoid the exception? I can fix it ?  thanks
> 
> regards
> Hwangfu
> 
> 
> 
> 
> 
> 
> --
> Sent from: http://bouncy-castle.1462172.n4.nabble.com/Bouncy-Castle-Dev-f1462173.html
>