Skip to content

Commit da49073

Browse files
peterdettmanpeterdettman
committed
BCJSSE: optionally prefer server's supported_groups order
- see BCSSLParameters.useNamedGroupsOrder property
1 parent 62bd4d4 commit da49073

File tree

9 files changed

+84
-8
lines changed

9 files changed

+84
-8
lines changed

‎tls/src/main/java/org/bouncycastle/jsse/BCSSLParameters.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ private static <T> List<T> copyList(Collection<T> list)
3737
private List<BCSNIServerName> serverNames;
3838
private List<BCSNIMatcher> sniMatchers;
3939
private boolean useCipherSuitesOrder;
40+
private boolean useNamedGroupsOrder;
4041
private boolean enableRetransmissions = true;
4142
private int maximumPacketSize = 0;
4243
private String[] applicationProtocols = TlsUtils.EMPTY_STRINGS;
@@ -189,6 +190,16 @@ public void setUseCipherSuitesOrder(boolean useCipherSuitesOrder)
189190
this.useCipherSuitesOrder = useCipherSuitesOrder;
190191
}
191192

193+
public boolean getUseNamedGroupsOrder()
194+
{
195+
return useNamedGroupsOrder;
196+
}
197+
198+
public void setUseNamedGroupsOrder(boolean useNamedGroupsOrder)
199+
{
200+
this.useNamedGroupsOrder = useNamedGroupsOrder;
201+
}
202+
192203
public boolean getEnableRetransmissions()
193204
{
194205
return enableRetransmissions;

‎tls/src/main/java/org/bouncycastle/jsse/provider/ProvSSLParameters.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ private static <T> List<T> copyList(Collection<T> list)
4040
private List<BCSNIServerName> sniServerNames;
4141
private List<BCSNIMatcher> sniMatchers;
4242
private boolean useCipherSuitesOrder = false;
43+
private boolean useNamedGroupsOrder = false;
4344
private boolean enableRetransmissions = true;
4445
private int maximumPacketSize = 0;
4546
private String[] applicationProtocols = TlsUtils.EMPTY_STRINGS;
@@ -69,6 +70,7 @@ ProvSSLParameters copy()
6970
p.sniServerNames = sniServerNames;
7071
p.sniMatchers = sniMatchers;
7172
p.useCipherSuitesOrder = useCipherSuitesOrder;
73+
p.useNamedGroupsOrder = useNamedGroupsOrder;
7274
p.enableRetransmissions = enableRetransmissions;
7375
p.maximumPacketSize = maximumPacketSize;
7476
p.applicationProtocols = applicationProtocols;
@@ -214,6 +216,16 @@ public void setUseCipherSuitesOrder(boolean useCipherSuitesOrder)
214216
this.useCipherSuitesOrder = useCipherSuitesOrder;
215217
}
216218

219+
public boolean getUseNamedGroupsOrder()
220+
{
221+
return useNamedGroupsOrder;
222+
}
223+
224+
public void setUseNamedGroupsOrder(boolean useNamedGroupsOrder)
225+
{
226+
this.useNamedGroupsOrder = useNamedGroupsOrder;
227+
}
228+
217229
public boolean getEnableRetransmissions()
218230
{
219231
return enableRetransmissions;

‎tls/src/main/java/org/bouncycastle/jsse/provider/ProvTlsServer.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,12 @@ protected boolean preferLocalCipherSuites()
313313
return sslParameters.getUseCipherSuitesOrder();
314314
}
315315

316+
@Override
317+
public boolean preferLocalSupportedGroups()
318+
{
319+
return sslParameters.getUseNamedGroupsOrder();
320+
}
321+
316322
@Override
317323
protected boolean selectCipherSuite(int cipherSuite) throws IOException
318324
{

‎tls/src/main/java/org/bouncycastle/tls/AbstractTlsServer.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,11 @@ protected boolean preferLocalCipherSuites()
155155
return false;
156156
}
157157

158+
public boolean preferLocalSupportedGroups()
159+
{
160+
return false;
161+
}
162+
158163
protected boolean selectCipherSuite(int cipherSuite) throws IOException
159164
{
160165
this.selectedCipherSuite = cipherSuite;

‎tls/src/main/java/org/bouncycastle/tls/TlsServer.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
public interface TlsServer
1414
extends TlsPeer
1515
{
16+
boolean preferLocalSupportedGroups();
17+
1618
void init(TlsServerContext context);
1719

1820
/**

‎tls/src/main/java/org/bouncycastle/tls/TlsServerProtocol.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,10 @@ protected ServerHello generate13ServerHello(ClientHello clientHello, HandshakeMe
293293

294294
int[] clientSupportedGroups = securityParameters.getClientSupportedGroups();
295295
int[] serverSupportedGroups = securityParameters.getServerSupportedGroups();
296+
boolean useServerOrder = tlsServer.preferLocalSupportedGroups();
296297

297298
int selectedGroup = TlsUtils.selectKeyShareGroup(crypto, serverVersion, clientSupportedGroups,
298-
serverSupportedGroups);
299+
serverSupportedGroups, useServerOrder);
299300
if (selectedGroup < 0)
300301
{
301302
throw new TlsFatalAlert(AlertDescription.handshake_failure);

‎tls/src/main/java/org/bouncycastle/tls/TlsUtils.java‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5479,19 +5479,22 @@ static KeyShareEntry getRetryKeyShare(Vector clientShares, int keyShareGroup)
54795479
}
54805480

54815481
static int selectKeyShareGroup(TlsCrypto crypto, ProtocolVersion negotiatedVersion,
5482-
int[] clientSupportedGroups, int[] serverSupportedGroups)
5482+
int[] clientSupportedGroups, int[] serverSupportedGroups, boolean useServerOrder)
54835483
{
54845484
if (!isNullOrEmpty(clientSupportedGroups) && !isNullOrEmpty(serverSupportedGroups))
54855485
{
5486-
for (int i = 0; i < clientSupportedGroups.length; ++i)
5486+
int[] ordered = useServerOrder ? serverSupportedGroups : clientSupportedGroups;
5487+
int[] unordered = useServerOrder ? clientSupportedGroups : serverSupportedGroups;
5488+
5489+
for (int i = 0; i < ordered.length; ++i)
54875490
{
5488-
int group = clientSupportedGroups[i];
5491+
int candidate = ordered[i];
54895492

5490-
if (NamedGroup.canBeNegotiated(group, negotiatedVersion) &&
5491-
Arrays.contains(serverSupportedGroups, group) &&
5492-
supportsKeyShareGroup(crypto, group))
5493+
if (Arrays.contains(unordered, candidate) &&
5494+
NamedGroup.canBeNegotiated(candidate, negotiatedVersion) &&
5495+
supportsKeyShareGroup(crypto, candidate))
54935496
{
5494-
return group;
5497+
return candidate;
54955498
}
54965499
}
54975500
}

‎tls/src/main/jdk1.5/org/bouncycastle/jsse/provider/SSLParametersUtil.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ static BCSSLParameters getParameters(ProvSSLParameters prov)
7979
ssl.setServerNames(prov.getServerNames());
8080
ssl.setSNIMatchers(prov.getSNIMatchers());
8181
ssl.setUseCipherSuitesOrder(prov.getUseCipherSuitesOrder());
82+
ssl.setUseNamedGroupsOrder(prov.getUseNamedGroupsOrder());
8283
ssl.setApplicationProtocols(prov.getApplicationProtocols());
8384
ssl.setEnableRetransmissions(prov.getEnableRetransmissions());
8485
ssl.setMaximumPacketSize(prov.getMaximumPacketSize());
@@ -180,6 +181,11 @@ static SSLParameters getSSLParameters(ProvSSLParameters prov)
180181

181182
// Unsupported as of JDK 21
182183

184+
// if (null != setUseNamedGroupsOrder)
185+
// {
186+
// set(ssl, setUseNamedGroupsOrder, prov.getUseNamedGroupsOrder());
187+
// }
188+
183189
// if (null != setSignatureSchemesCert)
184190
// {
185191
// set(ssl, setSignatureSchemesCert, prov.getSignatureSchemesCert());
@@ -286,6 +292,11 @@ static BCSSLParameters importSSLParameters(SSLParameters ssl)
286292

287293
// Unsupported as of JDK 21
288294

295+
// if (null != getUseNamedGroupsOrder)
296+
// {
297+
// bc.setUseNamedGroupsOrder((Boolean)get(ssl, getUseNamedGroupsOrder));
298+
// }
299+
289300
// if (null != getSignatureSchemesCert)
290301
// {
291302
// bc.setSignatureSchemesCert((String[])get(ssl, getSignatureSchemesCert));
@@ -344,6 +355,8 @@ static void setParameters(ProvSSLParameters prov, BCSSLParameters ssl)
344355

345356
prov.setUseCipherSuitesOrder(ssl.getUseCipherSuitesOrder());
346357

358+
prov.setUseNamedGroupsOrder(ssl.getUseNamedGroupsOrder());
359+
347360
String[] applicationProtocols = ssl.getApplicationProtocols();
348361
if (null != applicationProtocols)
349362
{
@@ -469,6 +482,11 @@ static void setSSLParameters(ProvSSLParameters prov, SSLParameters ssl)
469482

470483
// Unsupported as of JDK 21
471484

485+
// if (null != getUseNamedGroupsOrder)
486+
// {
487+
// prov.setUseNamedGroupsOrder((Boolean)get(ssl, getUseNamedGroupsOrder));
488+
// }
489+
472490
// if (null != getSignatureSchemesCert)
473491
// {
474492
// prov.setSignatureSchemesCert((String[])get(ssl, getSignatureSchemesCert));

‎tls/src/main/jdk1.9/org/bouncycastle/jsse/provider/SSLParametersUtil.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ static BCSSLParameters getParameters(ProvSSLParameters prov)
5050
ssl.setServerNames(prov.getServerNames());
5151
ssl.setSNIMatchers(prov.getSNIMatchers());
5252
ssl.setUseCipherSuitesOrder(prov.getUseCipherSuitesOrder());
53+
ssl.setUseNamedGroupsOrder(prov.getUseNamedGroupsOrder());
5354
ssl.setApplicationProtocols(prov.getApplicationProtocols());
5455
ssl.setEnableRetransmissions(prov.getEnableRetransmissions());
5556
ssl.setMaximumPacketSize(prov.getMaximumPacketSize());
@@ -132,6 +133,11 @@ static SSLParameters getSSLParameters(ProvSSLParameters prov)
132133

133134
// Unsupported as of JDK 21
134135

136+
// if (null != setUseNamedGroupsOrder)
137+
// {
138+
// set(ssl, setUseNamedGroupsOrder, prov.getUseNamedGroupsOrder());
139+
// }
140+
135141
// if (null != setSignatureSchemesCert)
136142
// {
137143
// set(ssl, setSignatureSchemesCert, prov.getSignatureSchemesCert());
@@ -224,6 +230,11 @@ static BCSSLParameters importSSLParameters(SSLParameters ssl)
224230

225231
// Unsupported as of JDK 21
226232

233+
// if (null != getUseNamedGroupsOrder)
234+
// {
235+
// bc.setUseNamedGroupsOrder((Boolean)get(ssl, getUseNamedGroupsOrder));
236+
// }
237+
227238
// if (null != getSignatureSchemesCert)
228239
// {
229240
// bc.setSignatureSchemesCert((String[])get(ssl, getSignatureSchemesCert));
@@ -282,6 +293,8 @@ static void setParameters(ProvSSLParameters prov, BCSSLParameters ssl)
282293

283294
prov.setUseCipherSuitesOrder(ssl.getUseCipherSuitesOrder());
284295

296+
prov.setUseNamedGroupsOrder(ssl.getUseNamedGroupsOrder());
297+
285298
String[] applicationProtocols = ssl.getApplicationProtocols();
286299
if (null != applicationProtocols)
287300
{
@@ -393,6 +406,11 @@ static void setSSLParameters(ProvSSLParameters prov, SSLParameters ssl)
393406

394407
// Unsupported as of JDK 21
395408

409+
// if (null != getUseNamedGroupsOrder)
410+
// {
411+
// prov.setUseNamedGroupsOrder((Boolean)get(ssl, getUseNamedGroupsOrder));
412+
// }
413+
396414
// if (null != getSignatureSchemesCert)
397415
// {
398416
// prov.setSignatureSchemesCert((String[])get(ssl, getSignatureSchemesCert));

0 commit comments

Comments
 (0)