Skip to content

Commit a05312a

Browse files
dghgitdghgit
committed
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
2 parents 03e8aeb + bba445e commit a05312a

File tree

16 files changed

+106
-28
lines changed

16 files changed

+106
-28
lines changed

‎tls/src/main/java/org/bouncycastle/tls/DTLSClientProtocol.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,8 @@ protected DTLSTransport clientHandshake(ClientHandshakeState state)
322322
securityParameters.sessionHash = TlsUtils.getCurrentPRFHash(handshake.getHandshakeHash());
323323

324324
TlsProtocol.establishMasterSecret(clientContext, state.keyExchange);
325+
state.keyExchange = null;
326+
325327
recordLayer.initPendingEpoch(TlsUtils.initCipher(clientContext));
326328

327329
if (clientAuthSigner != null)
@@ -875,7 +877,8 @@ protected void processServerHello(ClientHandshakeState state, byte[] body)
875877
*/
876878
if (null == TlsUtils.getExtensionData(state.clientExtensions, extType))
877879
{
878-
throw new TlsFatalAlert(AlertDescription.unsupported_extension);
880+
throw new TlsFatalAlert(AlertDescription.unsupported_extension,
881+
"Unrequested extension in ServerHello: " + ExtensionType.getText(extType.intValue()));
879882
}
880883

881884
/*

‎tls/src/main/java/org/bouncycastle/tls/DTLSServerProtocol.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,8 @@ protected DTLSTransport serverHandshake(ServerHandshakeState state, DTLSRequest
345345
securityParameters.sessionHash = TlsUtils.getCurrentPRFHash(handshake.getHandshakeHash());
346346

347347
TlsProtocol.establishMasterSecret(serverContext, state.keyExchange);
348+
state.keyExchange = null;
349+
348350
recordLayer.initPendingEpoch(TlsUtils.initCipher(serverContext));
349351

350352
/*

tls/src/main/java/org/bouncycastle/jsse/provider/ReflectionUtil.java renamed to tls/src/main/java/org/bouncycastle/tls/ReflectionUtil.java

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package org.bouncycastle.jsse.provider;
1+
package org.bouncycastle.tls;
22

33
import java.lang.reflect.Constructor;
44
import java.lang.reflect.Field;
@@ -7,9 +7,9 @@
77
import java.security.AccessController;
88
import java.security.PrivilegedAction;
99

10-
class ReflectionUtil
10+
public abstract class ReflectionUtil
1111
{
12-
static Method findMethod(Method[] methods, String name)
12+
public static Method findMethod(Method[] methods, String name)
1313
{
1414
if (methods != null)
1515
{
@@ -24,13 +24,12 @@ static Method findMethod(Method[] methods, String name)
2424
return null;
2525
}
2626

27-
static boolean hasMethod(Method[] methods, String name)
27+
public static boolean hasMethod(Method[] methods, String name)
2828
{
2929
return null != findMethod(methods, name);
3030
}
3131

32-
33-
static Class<?> getClass(final String className)
32+
public static Class<?> getClass(final String className)
3433
{
3534
if (null == className)
3635
{
@@ -58,7 +57,7 @@ public Class<?> run()
5857
});
5958
}
6059

61-
static <T> Constructor<T> getDeclaredConstructor(final String className, final Class<?>... parameterTypes)
60+
public static <T> Constructor<T> getDeclaredConstructor(final String className, final Class<?>... parameterTypes)
6261
{
6362
if (null == className)
6463
{
@@ -90,7 +89,7 @@ public Constructor<T> run()
9089
});
9190
}
9291

93-
static Method getMethod(final String className, final String methodName, final Class<?>... parameterTypes)
92+
public static Method getMethod(final String className, final String methodName, final Class<?>... parameterTypes)
9493
{
9594
if (null == className || null == methodName)
9695
{
@@ -122,7 +121,7 @@ public Method run()
122121
});
123122
}
124123

125-
static Method[] getMethods(final String className)
124+
public static Method[] getMethods(final String className)
126125
{
127126
if (null == className)
128127
{
@@ -154,7 +153,7 @@ public Method[] run()
154153
});
155154
}
156155

157-
static Integer getStaticInt(final String className, final String fieldName)
156+
public static Integer getStaticInt(final String className, final String fieldName)
158157
{
159158
return AccessController.doPrivileged(new PrivilegedAction<Integer>()
160159
{
@@ -189,18 +188,18 @@ public Integer run()
189188
});
190189
}
191190

192-
static Integer getStaticIntOrDefault(final String className, final String fieldName, int defaultValue)
191+
public static Integer getStaticIntOrDefault(final String className, final String fieldName, int defaultValue)
193192
{
194193
Integer value = getStaticInt(className, fieldName);
195194
return null == value ? defaultValue : value.intValue();
196195
}
197196

198-
static Object invokeGetter(final Object obj, final Method method)
197+
public static Object invokeGetter(final Object obj, final Method method)
199198
{
200199
return invokeMethod(obj, method);
201200
}
202201

203-
static Object invokeMethod(final Object obj, final Method method, final Object... args)
202+
public static Object invokeMethod(final Object obj, final Method method, final Object... args)
204203
{
205204
return AccessController.doPrivileged(new PrivilegedAction<Object>()
206205
{
@@ -222,7 +221,7 @@ public Object run()
222221
});
223222
}
224223

225-
static void invokeSetter(final Object obj, final Method method, final Object arg)
224+
public static void invokeSetter(final Object obj, final Method method, final Object arg)
226225
{
227226
invokeMethod(obj, method, arg);
228227
}

‎tls/src/main/java/org/bouncycastle/tls/TlsClientProtocol.java‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -551,7 +551,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
551551
handleServerCertificate();
552552

553553
// There was no server key exchange message; check it's OK
554-
this.keyExchange.skipServerKeyExchange();
554+
keyExchange.skipServerKeyExchange();
555555

556556
// NB: Fall through to next case label
557557
}
@@ -645,6 +645,8 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
645645
establishMasterSecret(tlsClientContext, keyExchange);
646646
}
647647

648+
this.keyExchange = null;
649+
648650
recordStream.setPendingCipher(TlsUtils.initCipher(tlsClientContext));
649651

650652
if (clientAuthSigner != null)
@@ -688,7 +690,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
688690
{
689691
handleServerCertificate();
690692

691-
this.keyExchange.processServerKeyExchange(buf);
693+
keyExchange.processServerKeyExchange(buf);
692694

693695
assertEmpty(buf);
694696
break;
@@ -710,7 +712,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
710712
handleServerCertificate();
711713

712714
// There was no server key exchange message; check it's OK
713-
this.keyExchange.skipServerKeyExchange();
715+
keyExchange.skipServerKeyExchange();
714716

715717
// NB: Fall through to next case label
716718
}
@@ -867,7 +869,7 @@ protected void process13HelloRetryRequest(ServerHello helloRetryRequest)
867869
if (null == TlsUtils.getExtensionData(clientExtensions, extType))
868870
{
869871
throw new TlsFatalAlert(AlertDescription.unsupported_extension,
870-
"received unrequested extension response: " + ExtensionType.getText(extensionType));
872+
"Unrequested extension in HelloRetryRequest: " + ExtensionType.getText(extensionType));
871873
}
872874
}
873875
}
@@ -1527,7 +1529,8 @@ protected void receive13EncryptedExtensions(ByteArrayInputStream buf)
15271529

15281530
if (null == TlsUtils.getExtensionData(clientExtensions, extType))
15291531
{
1530-
throw new TlsFatalAlert(AlertDescription.unsupported_extension);
1532+
throw new TlsFatalAlert(AlertDescription.unsupported_extension,
1533+
"Unrequested extension in EncryptedExtensions: " + ExtensionType.getText(extType.intValue()));
15311534
}
15321535
}
15331536
}
@@ -1910,6 +1913,8 @@ protected void sendClientHello()
19101913
this.clientExtensions.remove(TlsExtensionsUtils.EXT_extended_master_secret);
19111914
}
19121915

1916+
boolean hasRenegSCSV = Arrays.contains(offeredCipherSuites, CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
1917+
19131918
if (securityParameters.isRenegotiating())
19141919
{
19151920
/*
@@ -1919,13 +1924,19 @@ protected void sendClientHello()
19191924
*/
19201925
if (!securityParameters.isSecureRenegotiation())
19211926
{
1922-
throw new TlsFatalAlert(AlertDescription.internal_error);
1927+
throw new TlsFatalAlert(AlertDescription.internal_error, "Renegotiation requires secure_renegotiation");
19231928
}
19241929

19251930
/*
19261931
* The client MUST include the "renegotiation_info" extension in the ClientHello,
19271932
* containing the saved client_verify_data. The SCSV MUST NOT be included.
19281933
*/
1934+
if (hasRenegSCSV)
1935+
{
1936+
throw new TlsFatalAlert(AlertDescription.internal_error,
1937+
"Renegotiation cannot use TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
1938+
}
1939+
19291940
SecurityParameters saved = tlsClientContext.getSecurityParametersConnection();
19301941

19311942
this.clientExtensions.put(EXT_RenegotiationInfo, createRenegotiationInfo(saved.getLocalVerifyData()));
@@ -1942,7 +1953,7 @@ protected void sendClientHello()
19421953
* Including both is NOT RECOMMENDED.
19431954
*/
19441955
boolean noRenegExt = (null == TlsUtils.getExtensionData(clientExtensions, EXT_RenegotiationInfo));
1945-
boolean noRenegSCSV = !Arrays.contains(offeredCipherSuites, CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
1956+
boolean noRenegSCSV = !hasRenegSCSV;
19461957

19471958
if (noRenegExt && noRenegSCSV)
19481959
{
@@ -1993,7 +2004,7 @@ protected void sendClientKeyExchange()
19932004
throws IOException
19942005
{
19952006
HandshakeMessageOutput message = new HandshakeMessageOutput(HandshakeType.client_key_exchange);
1996-
this.keyExchange.generateClientKeyExchange(message);
2007+
keyExchange.generateClientKeyExchange(message);
19972008
message.send(this);
19982009
}
19992010

‎tls/src/main/java/org/bouncycastle/tls/TlsServerProtocol.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1121,11 +1121,11 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
11211121
ByteArrayOutputStream endPointHash = new ByteArrayOutputStream();
11221122
if (null == serverCredentials)
11231123
{
1124-
this.keyExchange.skipServerCredentials();
1124+
keyExchange.skipServerCredentials();
11251125
}
11261126
else
11271127
{
1128-
this.keyExchange.processServerCredentials(serverCredentials);
1128+
keyExchange.processServerCredentials(serverCredentials);
11291129

11301130
serverCertificate = serverCredentials.getCertificate();
11311131
sendCertificateMessage(serverCertificate, endPointHash);
@@ -1151,7 +1151,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
11511151
}
11521152
}
11531153

1154-
byte[] serverKeyExchange = this.keyExchange.generateServerKeyExchange();
1154+
byte[] serverKeyExchange = keyExchange.generateServerKeyExchange();
11551155
if (serverKeyExchange != null)
11561156
{
11571157
sendServerKeyExchangeMessage(serverKeyExchange);
@@ -1181,7 +1181,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
11811181
throw new TlsFatalAlert(AlertDescription.internal_error);
11821182
}
11831183

1184-
this.certificateRequest = TlsUtils.validateCertificateRequest(this.certificateRequest, this.keyExchange);
1184+
this.certificateRequest = TlsUtils.validateCertificateRequest(certificateRequest, keyExchange);
11851185

11861186
TlsUtils.establishServerSigAlgs(securityParameters, certificateRequest);
11871187

@@ -1270,7 +1270,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
12701270
{
12711271
if (null == certificateRequest)
12721272
{
1273-
this.keyExchange.skipClientCredentials();
1273+
keyExchange.skipClientCredentials();
12741274
}
12751275
else if (TlsUtils.isTLSv12(tlsServerContext))
12761276
{
@@ -1536,6 +1536,8 @@ protected void receiveClientKeyExchangeMessage(ByteArrayInputStream buf)
15361536
establishMasterSecret(tlsServerContext, keyExchange);
15371537
}
15381538

1539+
this.keyExchange = null;
1540+
15391541
recordStream.setPendingCipher(TlsUtils.initCipher(tlsServerContext));
15401542

15411543
if (!expectCertificateVerifyMessage())

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/IDNUtil.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
import java.lang.reflect.Method;
44

5+
import org.bouncycastle.tls.ReflectionUtil;
6+
57
public class IDNUtil
68
{
79
public static final int ALLOW_UNASSIGNED;

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/KeyStoreUtil.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
import java.security.NoSuchAlgorithmException;
88
import java.security.UnrecoverableKeyException;
99

10+
import org.bouncycastle.tls.ReflectionUtil;
11+
1012
abstract class KeyStoreUtil
1113
{
1214
private static final Method getProtectionAlgorithm;

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/PKIXUtil.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
import java.security.cert.X509Certificate;
66
import java.util.Map;
77

8+
import org.bouncycastle.tls.ReflectionUtil;
9+
810
abstract class PKIXUtil
911
{
1012
private static final Class<?> pkixRevocationCheckerClass;

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/SSLEngineUtil.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import org.bouncycastle.jsse.BCExtendedSSLSession;
1010
import org.bouncycastle.jsse.BCSSLEngine;
1111
import org.bouncycastle.jsse.BCSSLParameters;
12+
import org.bouncycastle.tls.ReflectionUtil;
1213

1314
abstract class SSLEngineUtil
1415
{

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/SSLParametersUtil.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import org.bouncycastle.jsse.BCSNIServerName;
1111
import org.bouncycastle.jsse.BCSSLParameters;
1212
import org.bouncycastle.jsse.java.security.BCAlgorithmConstraints;
13+
import org.bouncycastle.tls.ReflectionUtil;
1314

1415
abstract class SSLParametersUtil
1516
{

0 commit comments

Comments
 (0)