|
 |
82be3f |
# HG changeset patch
|
|
|
82be3f |
# User jnimeh
|
|
|
82be3f |
# Date 1578287079 28800
|
|
|
82be3f |
# Sun Jan 05 21:04:39 2020 -0800
|
|
|
82be3f |
# Node ID b9d1ce20dd4b2ce34e74c8fa2d784335231abcd1
|
|
|
82be3f |
# Parent 3782f295811625b65d57f1aef15daa10d82a58a7
|
|
|
82be3f |
8236039: JSSE Client does not accept status_request extension in CertificateRequest messages for TLS 1.3
|
|
|
82be3f |
Reviewed-by: xuelei
|
|
|
82be3f |
|
|
|
82be3f |
diff --git a/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java b/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java
|
|
|
82be3f |
--- a/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java
|
|
|
82be3f |
+++ b/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java
|
|
|
82be3f |
@@ -1,5 +1,5 @@
|
|
|
82be3f |
/*
|
|
|
82be3f |
- * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
+ * Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
82be3f |
*
|
|
|
82be3f |
* This code is free software; you can redistribute it and/or modify it
|
|
|
82be3f |
@@ -39,11 +39,7 @@
|
|
|
82be3f |
import javax.net.ssl.SSLProtocolException;
|
|
|
82be3f |
import sun.security.provider.certpath.OCSPResponse;
|
|
|
82be3f |
import sun.security.provider.certpath.ResponderId;
|
|
|
82be3f |
-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST;
|
|
|
82be3f |
-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST_V2;
|
|
|
82be3f |
import sun.security.ssl.SSLExtension.ExtensionConsumer;
|
|
|
82be3f |
-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST;
|
|
|
82be3f |
-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST_V2;
|
|
|
82be3f |
import sun.security.ssl.SSLExtension.SSLExtensionSpec;
|
|
|
82be3f |
import sun.security.ssl.SSLHandshake.HandshakeMessage;
|
|
|
82be3f |
import sun.security.util.DerInputStream;
|
|
|
82be3f |
@@ -434,8 +430,9 @@
|
|
|
82be3f |
} else {
|
|
|
82be3f |
extBuilder.append(",\n");
|
|
|
82be3f |
}
|
|
|
82be3f |
- extBuilder.append(
|
|
|
82be3f |
- "{\n" + Utilities.indent(ext.toString()) + "}");
|
|
|
82be3f |
+ extBuilder.append("{\n").
|
|
|
82be3f |
+ append(Utilities.indent(ext.toString())).
|
|
|
82be3f |
+ append("}");
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
extsStr = extBuilder.toString();
|
|
|
82be3f |
@@ -552,11 +549,11 @@
|
|
|
82be3f |
return null;
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
- if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {
|
|
|
82be3f |
+ if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
SSLLogger.fine(
|
|
|
82be3f |
"Ignore unavailable extension: " +
|
|
|
82be3f |
- CH_STATUS_REQUEST.name);
|
|
|
82be3f |
+ SSLExtension.CH_STATUS_REQUEST.name);
|
|
|
82be3f |
}
|
|
|
82be3f |
return null;
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -568,8 +565,8 @@
|
|
|
82be3f |
byte[] extData = new byte[] {0x01, 0x00, 0x00, 0x00, 0x00};
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- chc.handshakeExtensions.put(
|
|
|
82be3f |
- CH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
+ chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST,
|
|
|
82be3f |
+ CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
return extData;
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -593,10 +590,10 @@
|
|
|
82be3f |
// The consuming happens in server side only.
|
|
|
82be3f |
ServerHandshakeContext shc = (ServerHandshakeContext)context;
|
|
|
82be3f |
|
|
|
82be3f |
- if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {
|
|
|
82be3f |
+ if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
SSLLogger.fine("Ignore unavailable extension: " +
|
|
|
82be3f |
- CH_STATUS_REQUEST.name);
|
|
|
82be3f |
+ SSLExtension.CH_STATUS_REQUEST.name);
|
|
|
82be3f |
}
|
|
|
82be3f |
return; // ignore the extension
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -610,7 +607,7 @@
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- shc.handshakeExtensions.put(CH_STATUS_REQUEST, spec);
|
|
|
82be3f |
+ shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST, spec);
|
|
|
82be3f |
if (!shc.isResumption &&
|
|
|
82be3f |
!shc.negotiatedProtocol.useTLS13PlusSpec()) {
|
|
|
82be3f |
shc.handshakeProducers.put(SSLHandshake.CERTIFICATE_STATUS.id,
|
|
|
82be3f |
@@ -654,13 +651,12 @@
|
|
|
82be3f |
|
|
|
82be3f |
// In response to "status_request" extension request only.
|
|
|
82be3f |
CertStatusRequestSpec spec = (CertStatusRequestSpec)
|
|
|
82be3f |
- shc.handshakeExtensions.get(CH_STATUS_REQUEST);
|
|
|
82be3f |
+ shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);
|
|
|
82be3f |
if (spec == null) {
|
|
|
82be3f |
// Ignore, no status_request extension requested.
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
- SSLLogger.finest(
|
|
|
82be3f |
- "Ignore unavailable extension: " +
|
|
|
82be3f |
- CH_STATUS_REQUEST.name);
|
|
|
82be3f |
+ SSLLogger.finest("Ignore unavailable extension: " +
|
|
|
82be3f |
+ SSLExtension.CH_STATUS_REQUEST.name);
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
return null; // ignore the extension
|
|
|
82be3f |
@@ -681,8 +677,8 @@
|
|
|
82be3f |
byte[] extData = new byte[0];
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- shc.handshakeExtensions.put(
|
|
|
82be3f |
- SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
+ shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,
|
|
|
82be3f |
+ CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
return extData;
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -708,7 +704,7 @@
|
|
|
82be3f |
|
|
|
82be3f |
// In response to "status_request" extension request only.
|
|
|
82be3f |
CertStatusRequestSpec requestedCsr = (CertStatusRequestSpec)
|
|
|
82be3f |
- chc.handshakeExtensions.get(CH_STATUS_REQUEST);
|
|
|
82be3f |
+ chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);
|
|
|
82be3f |
if (requestedCsr == null) {
|
|
|
82be3f |
throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
|
|
|
82be3f |
"Unexpected status_request extension in ServerHello");
|
|
|
82be3f |
@@ -722,8 +718,8 @@
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- chc.handshakeExtensions.put(
|
|
|
82be3f |
- SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
+ chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,
|
|
|
82be3f |
+ CertStatusRequestSpec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
// Since we've received a legitimate status_request in the
|
|
|
82be3f |
// ServerHello, stapling is active if it's been enabled.
|
|
|
82be3f |
@@ -909,7 +905,7 @@
|
|
|
82be3f |
return null;
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
- if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {
|
|
|
82be3f |
+ if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
SSLLogger.finest(
|
|
|
82be3f |
"Ignore unavailable status_request_v2 extension");
|
|
|
82be3f |
@@ -926,8 +922,8 @@
|
|
|
82be3f |
0x00, 0x07, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00};
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- chc.handshakeExtensions.put(
|
|
|
82be3f |
- CH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
+ chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,
|
|
|
82be3f |
+ CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
return extData;
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -951,7 +947,7 @@
|
|
|
82be3f |
// The consuming happens in server side only.
|
|
|
82be3f |
ServerHandshakeContext shc = (ServerHandshakeContext)context;
|
|
|
82be3f |
|
|
|
82be3f |
- if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {
|
|
|
82be3f |
+ if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
SSLLogger.finest(
|
|
|
82be3f |
"Ignore unavailable status_request_v2 extension");
|
|
|
82be3f |
@@ -969,7 +965,8 @@
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- shc.handshakeExtensions.put(CH_STATUS_REQUEST_V2, spec);
|
|
|
82be3f |
+ shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,
|
|
|
82be3f |
+ spec);
|
|
|
82be3f |
if (!shc.isResumption) {
|
|
|
82be3f |
shc.handshakeProducers.putIfAbsent(
|
|
|
82be3f |
SSLHandshake.CERTIFICATE_STATUS.id,
|
|
|
82be3f |
@@ -1013,7 +1010,7 @@
|
|
|
82be3f |
|
|
|
82be3f |
// In response to "status_request_v2" extension request only
|
|
|
82be3f |
CertStatusRequestV2Spec spec = (CertStatusRequestV2Spec)
|
|
|
82be3f |
- shc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);
|
|
|
82be3f |
+ shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);
|
|
|
82be3f |
if (spec == null) {
|
|
|
82be3f |
// Ignore, no status_request_v2 extension requested.
|
|
|
82be3f |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
|
|
|
82be3f |
@@ -1038,8 +1035,8 @@
|
|
|
82be3f |
byte[] extData = new byte[0];
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- shc.handshakeExtensions.put(
|
|
|
82be3f |
- SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
+ shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,
|
|
|
82be3f |
+ CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
return extData;
|
|
|
82be3f |
}
|
|
|
82be3f |
@@ -1065,7 +1062,7 @@
|
|
|
82be3f |
|
|
|
82be3f |
// In response to "status_request" extension request only
|
|
|
82be3f |
CertStatusRequestV2Spec requestedCsr = (CertStatusRequestV2Spec)
|
|
|
82be3f |
- chc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);
|
|
|
82be3f |
+ chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);
|
|
|
82be3f |
if (requestedCsr == null) {
|
|
|
82be3f |
throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
|
|
|
82be3f |
"Unexpected status_request_v2 extension in ServerHello");
|
|
|
82be3f |
@@ -1079,8 +1076,8 @@
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
// Update the context.
|
|
|
82be3f |
- chc.handshakeExtensions.put(
|
|
|
82be3f |
- SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
+ chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,
|
|
|
82be3f |
+ CertStatusRequestV2Spec.DEFAULT);
|
|
|
82be3f |
|
|
|
82be3f |
// Since we've received a legitimate status_request in the
|
|
|
82be3f |
// ServerHello, stapling is active if it's been enabled. If it
|
|
|
82be3f |
diff --git a/src/java.base/share/classes/sun/security/ssl/SSLExtension.java b/src/java.base/share/classes/sun/security/ssl/SSLExtension.java
|
|
|
82be3f |
--- a/src/java.base/share/classes/sun/security/ssl/SSLExtension.java
|
|
|
82be3f |
+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtension.java
|
|
|
82be3f |
@@ -1,5 +1,5 @@
|
|
|
82be3f |
/*
|
|
|
82be3f |
- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
+ * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
82be3f |
*
|
|
|
82be3f |
* This code is free software; you can redistribute it and/or modify it
|
|
|
82be3f |
@@ -113,7 +113,6 @@
|
|
|
82be3f |
null,
|
|
|
82be3f |
null,
|
|
|
82be3f |
CertStatusExtension.certStatusReqStringizer),
|
|
|
82be3f |
-
|
|
|
82be3f |
CR_STATUS_REQUEST (0x0005, "status_request"),
|
|
|
82be3f |
CT_STATUS_REQUEST (0x0005, "status_request",
|
|
|
82be3f |
SSLHandshake.CERTIFICATE,
|
|
|
82be3f |
@@ -124,6 +123,7 @@
|
|
|
82be3f |
null,
|
|
|
82be3f |
null,
|
|
|
82be3f |
CertStatusExtension.certStatusRespStringizer),
|
|
|
82be3f |
+
|
|
|
82be3f |
// extensions defined in RFC 4681
|
|
|
82be3f |
USER_MAPPING (0x0006, "user_mapping"),
|
|
|
82be3f |
|
|
|
82be3f |
@@ -515,6 +515,16 @@
|
|
|
82be3f |
return null;
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
+ static String nameOf(int extensionType) {
|
|
|
82be3f |
+ for (SSLExtension ext : SSLExtension.values()) {
|
|
|
82be3f |
+ if (ext.id == extensionType) {
|
|
|
82be3f |
+ return ext.name;
|
|
|
82be3f |
+ }
|
|
|
82be3f |
+ }
|
|
|
82be3f |
+
|
|
|
82be3f |
+ return "unknown extension";
|
|
|
82be3f |
+ }
|
|
|
82be3f |
+
|
|
|
82be3f |
static boolean isConsumable(int extensionType) {
|
|
|
82be3f |
for (SSLExtension ext : SSLExtension.values()) {
|
|
|
82be3f |
if (ext.id == extensionType &&
|
|
|
82be3f |
diff --git a/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java b/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java
|
|
|
82be3f |
--- a/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java
|
|
|
82be3f |
+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java
|
|
|
82be3f |
@@ -1,5 +1,5 @@
|
|
|
82be3f |
/*
|
|
|
82be3f |
- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
+ * Copyright (c) 2018, 2020 Oracle and/or its affiliates. All rights reserved.
|
|
|
82be3f |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
|
82be3f |
*
|
|
|
82be3f |
* This code is free software; you can redistribute it and/or modify it
|
|
|
82be3f |
@@ -86,11 +86,14 @@
|
|
|
82be3f |
"Received buggy supported_groups extension " +
|
|
|
82be3f |
"in the ServerHello handshake message");
|
|
|
82be3f |
}
|
|
|
82be3f |
- } else {
|
|
|
82be3f |
+ } else if (handshakeType == SSLHandshake.SERVER_HELLO) {
|
|
|
82be3f |
throw hm.handshakeContext.conContext.fatal(
|
|
|
82be3f |
- Alert.UNSUPPORTED_EXTENSION,
|
|
|
82be3f |
- "extension (" + extId +
|
|
|
82be3f |
- ") should not be presented in " + handshakeType.name);
|
|
|
82be3f |
+ Alert.UNSUPPORTED_EXTENSION, "extension (" +
|
|
|
82be3f |
+ extId + ") should not be presented in " +
|
|
|
82be3f |
+ handshakeType.name);
|
|
|
82be3f |
+ } else {
|
|
|
82be3f |
+ isSupported = false;
|
|
|
82be3f |
+ // debug log to ignore unknown extension for handshakeType
|
|
|
82be3f |
}
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
@@ -365,9 +368,10 @@
|
|
|
82be3f |
}
|
|
|
82be3f |
|
|
|
82be3f |
private static String toString(int extId, byte[] extData) {
|
|
|
82be3f |
+ String extName = SSLExtension.nameOf(extId);
|
|
|
82be3f |
MessageFormat messageFormat = new MessageFormat(
|
|
|
82be3f |
- "\"unknown extension ({0})\": '{'\n" +
|
|
|
82be3f |
- "{1}\n" +
|
|
|
82be3f |
+ "\"{0} ({1})\": '{'\n" +
|
|
|
82be3f |
+ "{2}\n" +
|
|
|
82be3f |
"'}'",
|
|
|
82be3f |
Locale.ENGLISH);
|
|
|
82be3f |
|
|
|
82be3f |
@@ -375,6 +379,7 @@
|
|
|
82be3f |
String encoded = hexEncoder.encodeBuffer(extData);
|
|
|
82be3f |
|
|
|
82be3f |
Object[] messageFields = {
|
|
|
82be3f |
+ extName,
|
|
|
82be3f |
extId,
|
|
|
82be3f |
Utilities.indent(encoded)
|
|
|
82be3f |
};
|