How SSLContext.getInstance() method works?

Question

Entire code is quire complicated so I am directly coming to the point. Code is as follows

SSLContext ctx = SSLContext.getInstance("TLS");

If you read docs for getInstance(String protocol) method it says

This method traverses the list of registered security Providers, starting
with the most preferred Provider. A new SSLContext object encapsulating
the SSLContextSpi implementation from the first Provider that supports the
specified protocol is returned.

Note that the list of registered providers may be retrieved via the
Security.getProviders() method.

For me Security.getProviders() method gives following providers

Now I have verified that "TLS" protocol is in com.sun.net.ssl.internal.ssl.Provider (index 2 ) and is always selected.

But the corresponding SSLContextSpi object is coming different in Java 6 and Java 7. In java 6 I am getting com.sun.net.ssl.internal.ssl.SSLContextImpl@7bbf68a9 and in java 7 I am getting sun.security.ssl.SSLContextImpl$TLS10Context@615ece16. This is having very bad effect as when later I am creating SSL socket they are of different class.

So why is this happening? Is there a work around? I want the same com.sun.net.ssl.internal.ssl.SSLContextImpl@7bbf68a9 SSLContextSpi object encapsulated in com.sun.net.ssl.internal.ssl.Provider context(which is same in both cases).

Answer 1

This is having very bad effect as when later I am creating SSL socket they are of different class.

This is not a bad effect. Which actual class you get from the factories in the public API is at the discretion of the JRE implementation: these concrete classes are not part of the public API.

The fact that you get different classes between Java 6 and Java 7 doesn't really matter. Even if they had the same name, if wouldn't make sense to compare them to one another.

EDIT:

public int read(byte[] b) function reads only 1 bytes when I give it a byte array of length 4 and also i have confirmed that there are 4 bytes in the stream.

SSLSocket in Java 7 is behaving correctly when you get this. In fact, it's probably behaving better, since this initial 1-byte read is due to the BEAST-prevention measure. I'll copy and paste my own answer to that question, since you're making exactly the same mistake.

---

The assumption you're making about reading the byte[] exactly as you write them on the other end is a classic TCP mistake. It's not actually specific to SSL/TLS, but could also happen with a TCP connection.

There is no guarantee in TCP (and in SSL/TLS) that the reader's buffer will be filled with the exact same packet length as the packets in the writer's buffer. All TCP guarantees is in-order delivery, so you'll eventually get all your data, but you have to treat it as a stream.

This is why protocols that use TCP rely on indicators and delimiters to tell the other end when to stop reading certain messages.

For example, HTTP 1.1 uses a blank line to indicate when the headers end, and it uses the Content-Length header to tell the recipient what entity length to expect (or chunked transfer encoding). SMTP also uses line returns and . at the end of a message.

If you're designing your own protocol, you need to define a way for the recipient to know when what you define as meaningful units of data are delimited. When you read the data, read such indicators, and fill in your read buffer until you get the amount of bytes you expect or until you find the delimiter that you've defined.