TLS support

CHANGELOG

@@ -0,0 +1,3 @@
+v0.2.0 [in development]
+
+  * Added support for connecting over TLS

build.gradle.kts

@@ -23,6 +23,7 @@ dependencies {
     implementation(kotlin("stdlib-jdk8", "1.3.20"))
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.1.1")
     implementation("io.ktor:ktor-network:1.1.2")
+    implementation("io.ktor:ktor-network-tls:1.1.2")
 
     testImplementation("com.nhaarman.mockitokotlin2:mockito-kotlin:2.1.0")
     testImplementation("org.junit.jupiter:junit-jupiter-api:5.3.1")

src/main/kotlin/com/dmdirc/ktirc/IrcClient.kt

@@ -33,7 +33,7 @@ interface IrcClient {
 // TODO: Should there be a default profile?
 class IrcClientImpl(private val server: Server, private val profile: Profile) : IrcClient {
 
-    var socketFactory: (String, Int) -> LineBufferedSocket = ::KtorLineBufferedSocket
+    var socketFactory: (String, Int, Boolean) -> LineBufferedSocket = ::KtorLineBufferedSocket
 
     override val serverState = ServerState(profile.initialNick)
     override val channelState = ChannelStateMap { caseMapping }
@@ -59,7 +59,7 @@ class IrcClientImpl(private val server: Server, private val profile: Profile) :
         // TODO: Concurrency!
         check(socket == null)
         coroutineScope {
-            with(socketFactory(server.host, server.port)) {
+            with(socketFactory(server.host, server.port, server.tls)) {
                 socket = this
                 connect()
                 sendLine("CAP LS 302")

src/main/kotlin/com/dmdirc/ktirc/io/LineBufferedSocket.kt

@@ -6,13 +6,17 @@ import io.ktor.network.sockets.Socket
 import io.ktor.network.sockets.aSocket
 import io.ktor.network.sockets.openReadChannel
 import io.ktor.network.sockets.openWriteChannel
+import io.ktor.network.tls.tls
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.channels.ReceiveChannel
 import kotlinx.coroutines.channels.produce
 import kotlinx.coroutines.io.ByteReadChannel
 import kotlinx.coroutines.io.ByteWriteChannel
 import java.net.InetSocketAddress
+import java.security.SecureRandom
+import javax.net.ssl.X509TrustManager
 
 interface LineBufferedSocket {
 
@@ -29,14 +33,16 @@ interface LineBufferedSocket {
 /**
  * Asynchronous socket that buffers incoming data and emits individual lines.
  */
-// TODO: TLS options
-class KtorLineBufferedSocket(private val host: String, private val port: Int): LineBufferedSocket {
+// TODO: Expose advanced TLS options
+class KtorLineBufferedSocket(private val host: String, private val port: Int, private val tls: Boolean = false): LineBufferedSocket {
 
     companion object {
         const val CARRIAGE_RETURN = '\r'.toByte()
         const val LINE_FEED = '\n'.toByte()
     }
 
+    public var tlsTrustManager: X509TrustManager? = null
+
     private val log by logger()
 
     private lateinit var socket: Socket
@@ -47,6 +53,10 @@ class KtorLineBufferedSocket(private val host: String, private val port: Int): L
     override suspend fun connect() {
         log.info { "Connecting..." }
         socket = aSocket(ActorSelectorManager(Dispatchers.IO)).tcp().connect(InetSocketAddress(host, port))
+        if (tls) {
+            // TODO: Figure out how exactly scopes work...
+            socket = socket.tls(GlobalScope.coroutineContext, randomAlgorithm = SecureRandom.getInstanceStrong().algorithm, trustManager = tlsTrustManager)
+        }
         readChannel = socket.openReadChannel()
         writeChannel = socket.openWriteChannel()
     }

src/main/kotlin/com/dmdirc/ktirc/model/Server.kt

@@ -1,3 +1,3 @@
 package com.dmdirc.ktirc.model
 
-data class Server(val host: String, val port: Int, val ssl: Boolean = false, val password: String? = null)
+data class Server(val host: String, val port: Int, val tls: Boolean = false, val password: String? = null)

src/test/kotlin/com/dmdirc/ktirc/IrcClientTest.kt

@@ -31,8 +31,8 @@ internal class IrcClientImplTest {
         on { readLines(any()) } doReturn readLineChannel
     }
 
-    private val mockSocketFactory = mock<(String, Int) -> LineBufferedSocket> {
-        on { invoke(HOST, PORT) } doReturn mockSocket
+    private val mockSocketFactory = mock<(String, Int, Boolean) -> LineBufferedSocket> {
+        on { invoke(eq(HOST), eq(PORT), any()) } doReturn mockSocket
     }
 
     private val mockEventHandler = mock<EventHandler>()
@@ -51,7 +51,20 @@ internal class IrcClientImplTest {
 
             client.connect()
 
-            verify(mockSocketFactory).invoke(HOST, PORT)
+            verify(mockSocketFactory).invoke(HOST, PORT, false)
+        }
+    }
+
+    @Test
+    fun `IrcClientImpl uses socket factory to create a new tls on connect`() {
+        runBlocking {
+            val client = IrcClientImpl(Server(HOST, PORT, true), Profile(NICK, REAL_NAME, USER_NAME))
+            client.socketFactory = mockSocketFactory
+            readLineChannel.close()
+
+            client.connect()
+
+            verify(mockSocketFactory).invoke(HOST, PORT, true)
         }
     }
 

src/test/kotlin/com/dmdirc/ktirc/io/KtorLineBufferedSocketTest.kt

@@ -1,15 +1,22 @@
 package com.dmdirc.ktirc.io
 
+import io.ktor.network.tls.certificates.generateCertificate
 import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.async
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.runBlocking
-import org.junit.jupiter.api.Assertions.assertEquals
-import org.junit.jupiter.api.Assertions.assertNotNull
+import org.junit.jupiter.api.Assertions.*
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.parallel.Execution
 import org.junit.jupiter.api.parallel.ExecutionMode
+import sun.security.validator.ValidatorException
+import java.io.File
 import java.net.ServerSocket
+import java.security.KeyStore
+import java.security.cert.X509Certificate
+import javax.net.ssl.KeyManagerFactory
+import javax.net.ssl.SSLContext
+import javax.net.ssl.X509TrustManager
 
 @Execution(ExecutionMode.SAME_THREAD)
 internal class KtorLineBufferedSocketTest {
@@ -26,6 +33,22 @@ internal class KtorLineBufferedSocketTest {
         }
     }
 
+    @Test
+    fun `KtorLineBufferedSocket throws trying to connect to a server with a bad TLS cert`() = runBlocking {
+        tlsServerSocket(12321).use { serverSocket ->
+            try {
+                val socket = KtorLineBufferedSocket("localhost", 12321)
+                val clientSocketAsync = GlobalScope.async { serverSocket.accept() }
+
+                socket.connect()
+                assertNotNull(clientSocketAsync.await())
+                fail<Unit>()
+            } catch (ex : ValidatorException) {
+                // Expected
+            }
+        }
+    }
+
     @Test
     fun `KtorLineBufferedSocket can send a whole byte array to a server`() = runBlocking {
         ServerSocket(12321).use { serverSocket ->
@@ -64,6 +87,26 @@ internal class KtorLineBufferedSocketTest {
         }
     }
 
+    @Test
+    fun `KtorLineBufferedSocket can send a string to a server over TLS`() = runBlocking {
+        tlsServerSocket(12321).use { serverSocket ->
+            val socket = KtorLineBufferedSocket("localhost", 12321, true)
+            socket.tlsTrustManager = getTrustingManager()
+            val clientBytesAsync = GlobalScope.async {
+                ByteArray(13).apply {
+                    serverSocket.accept().getInputStream().read(this)
+                }
+            }
+
+            socket.connect()
+            socket.sendLine("Hello World")
+
+            val bytes = clientBytesAsync.await()
+            assertNotNull(bytes)
+            assertEquals("Hello World\r\n", String(bytes))
+        }
+    }
+
     @Test
     fun `KtorLineBufferedSocket can send a partial byte array to a server`() = runBlocking {
         ServerSocket(12321).use { serverSocket ->
@@ -175,4 +218,28 @@ internal class KtorLineBufferedSocketTest {
         }
     }
 
+    private fun tlsServerSocket(port: Int): ServerSocket {
+        val keyFile = File.createTempFile("selfsigned", "jks")
+        generateCertificate(keyFile)
+
+        val keyStore = KeyStore.getInstance("JKS")
+        keyStore.load(keyFile.inputStream(), "changeit".toCharArray())
+
+        val keyManagerFactory = KeyManagerFactory.getInstance("PKIX")
+        keyManagerFactory.init(keyStore, "changeit".toCharArray())
+
+        val sslContext = SSLContext.getInstance("TLSv1.2")
+        sslContext.init(keyManagerFactory.keyManagers, null, null)
+        return sslContext.serverSocketFactory.createServerSocket(port)
+    }
+
+    private fun getTrustingManager() = object : X509TrustManager {
+        override fun getAcceptedIssuers(): Array<X509Certificate>  = emptyArray()
+
+        override fun checkClientTrusted(certs: Array<X509Certificate>, authType: String) {}
+
+        override fun checkServerTrusted(certs: Array<X509Certificate>, authType: String) {}
+    }
+
+
 }