Read jdk.tls.maxHandshakeMessageSize system property every SSLContext init

Author: peterdettman

tls/src/main/java/org/bouncycastle/jsse/provider/ContextData.java

@@ -36,6 +36,7 @@ final class ContextData
     private final ProvSSLSessionContext serverSessionContext;
     private final NamedGroupInfo.PerContext namedGroups;
     private final SignatureSchemeInfo.PerContext signatureSchemes;
+    private final int maxHandshakeMessageSize;
 
     ContextData(boolean fipsMode, JcaTlsCrypto crypto, BCX509ExtendedKeyManager x509KeyManager,
         BCX509ExtendedTrustManager x509TrustManager, Map<String, CipherSuiteInfo> supportedCipherSuites,
@@ -56,6 +57,8 @@ final class ContextData
         this.serverSessionContext = new ProvSSLSessionContext(this);
         this.namedGroups = NamedGroupInfo.createPerContext(fipsMode, crypto);
         this.signatureSchemes = SignatureSchemeInfo.createPerContext(fipsMode, crypto, namedGroups);
+        this.maxHandshakeMessageSize = PropertyUtils.getIntegerSystemProperty(
+            "jdk.tls.maxHandshakeMessageSize", 32768, 1024, Integer.MAX_VALUE);
     }
 
     int[] getActiveCipherSuites(JcaTlsCrypto crypto, ProvSSLParameters sslParameters,
@@ -191,9 +194,9 @@ ProvSSLParameters getDefaultSSLParameters(boolean isClient)
         return new ProvSSLParameters(this, implGetDefaultCipherSuites(isClient), implGetDefaultProtocols(isClient));
     }
 
-    ProvSSLParameters getSupportedSSLParameters(boolean isClient)
+    int getMaxHandshakeMessageSize()
     {
-        return new ProvSSLParameters(this, getSupportedCipherSuites(), getSupportedProtocols());
+        return maxHandshakeMessageSize;
     }
 
     NamedGroupInfo.PerConnection getNamedGroupsClient(ProvSSLParameters sslParameters,
@@ -213,6 +216,11 @@ ProvSSLSessionContext getServerSessionContext()
         return serverSessionContext;
     }
 
+    List<SignatureSchemeInfo> getSignatureSchemes(Vector<SignatureAndHashAlgorithm> sigAndHashAlgs)
+    {
+        return SignatureSchemeInfo.getSignatureSchemes(signatureSchemes, sigAndHashAlgs);
+    }
+
     SignatureSchemeInfo.PerConnection getSignatureSchemesClient(ProvSSLParameters sslParameters,
         ProtocolVersion[] activeProtocolVersions, NamedGroupInfo.PerConnection namedGroups)
     {
@@ -227,11 +235,6 @@ SignatureSchemeInfo.PerConnection getSignatureSchemesServer(ProvSSLParameters ss
             namedGroups);
     }
 
-    List<SignatureSchemeInfo> getSignatureSchemes(Vector<SignatureAndHashAlgorithm> sigAndHashAlgs)
-    {
-        return SignatureSchemeInfo.getSignatureSchemes(signatureSchemes, sigAndHashAlgs);
-    }
-
     String[] getSupportedCipherSuites()
     {
         return JsseUtils.getKeysArray(supportedCipherSuites);
@@ -267,6 +270,11 @@ String[] getSupportedProtocols()
         return JsseUtils.getKeysArray(supportedProtocols);
     }
 
+    ProvSSLParameters getSupportedSSLParameters(boolean isClient)
+    {
+        return new ProvSSLParameters(this, getSupportedCipherSuites(), getSupportedProtocols());
+    }
+
     BCX509ExtendedKeyManager getX509KeyManager()
     {
         return x509KeyManager;

tls/src/main/java/org/bouncycastle/jsse/provider/JsseUtils.java

@@ -72,8 +72,6 @@ abstract class JsseUtils
         PropertyUtils.getBooleanSystemProperty("jdk.tls.allowLegacyMasterSecret", true);
     private static final boolean provTlsAllowLegacyResumption =
         PropertyUtils.getBooleanSystemProperty("jdk.tls.allowLegacyResumption", false);
-    private static final int provTlsMaxHandshakeMessageSize =
-        PropertyUtils.getIntegerSystemProperty("jdk.tls.maxHandshakeMessageSize", 32768, 1024, Integer.MAX_VALUE);
     private static final boolean provTlsRequireCloseNotify =
         PropertyUtils.getBooleanSystemProperty("com.sun.net.ssl.requireCloseNotify", true);
     private static final boolean provTlsUseCompatibilityMode =
@@ -290,11 +288,6 @@ static boolean equals(Object a, Object b)
         return a == b || (null != a && null != b && a.equals(b));
     }
 
-    static int getMaxHandshakeMessageSize()
-    {
-        return provTlsMaxHandshakeMessageSize;
-    }
-
     static int getMaxInboundCertChainLenClient()
     {
         return provTlsClientMaxInboundCertChainLen;

tls/src/main/java/org/bouncycastle/jsse/provider/ProvTlsClient.java

@@ -402,7 +402,7 @@ public int getMaxCertificateChainLength()
     @Override
     public int getMaxHandshakeMessageSize()
     {
-        return JsseUtils.getMaxHandshakeMessageSize();
+        return manager.getContextData().getMaxHandshakeMessageSize();
     }
 
     @Override

tls/src/main/java/org/bouncycastle/jsse/provider/ProvTlsServer.java

@@ -452,7 +452,7 @@ public int getMaxCertificateChainLength()
     @Override
     public int getMaxHandshakeMessageSize()
     {
-        return JsseUtils.getMaxHandshakeMessageSize();
+        return manager.getContextData().getMaxHandshakeMessageSize();
     }
 
     public synchronized boolean isHandshakeComplete()