Skip to content

Commit b670cac

Browse files
Aleksei VoitylovRealCLanger
Aleksei Voitylov
authored and
RealCLanger
committed
8300285: Enhance TLS data handling
Reviewed-by: yan, mbalao Backport-of: 3d6dc4022049fb83b92ba94150ba2c073de88892
1 parent 2b764cd commit b670cac

File tree

3 files changed

+59
-26
lines changed

3 files changed

+59
-26
lines changed

‎src/java.base/share/conf/security/java.security‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -888,7 +888,8 @@ jdk.tls.legacyAlgorithms=NULL, anon, RC4, DES, 3DES_EDE_CBC
888888
# Note: This property is currently used by OpenJDK's JSSE implementation. It
889889
# is not guaranteed to be examined and used by other implementations.
890890
#
891-
jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37
891+
jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37, \
892+
ChaCha20-Poly1305 KeyUpdate 2^37
892893

893894
#
894895
# Cryptographic Jurisdiction Policy defaults

‎test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineKeyLimit.java‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,17 +23,24 @@
2323

2424
/*
2525
* @test
26-
* @bug 8164879
26+
* @bug 8164879 8300285
2727
* @library ../../
2828
* @library /test/lib
29-
* @summary Verify AES/GCM's limits set in the jdk.tls.keyLimits property
29+
* @summary Verify AEAD TLS cipher suite limits set in the jdk.tls.keyLimits
30+
* property
3031
* start a new handshake sequence to renegotiate the symmetric key with an
3132
* SSLSocket connection. This test verifies the handshake method was called
3233
* via debugging info. It does not verify the renegotiation was successful
3334
* as that is very hard.
3435
*
35-
* @run main SSLEngineKeyLimit 0 server AES/GCM/NoPadding keyupdate 1050000
36-
* @run main SSLEngineKeyLimit 1 client AES/GCM/NoPadding keyupdate 2^22
36+
* @run main SSLEngineKeyLimit 0 server TLS_AES_256_GCM_SHA384
37+
* AES/GCM/NoPadding keyupdate 1050000
38+
* @run main SSLEngineKeyLimit 1 client TLS_AES_256_GCM_SHA384
39+
* AES/GCM/NoPadding keyupdate 2^22
40+
* @run main SSLEngineKeyLimit 0 server TLS_CHACHA20_POLY1305_SHA256
41+
* AES/GCM/NoPadding keyupdate 1050000, ChaCha20-Poly1305 KeyUpdate 1050000
42+
* @run main SSLEngineKeyLimit 1 client TLS_CHACHA20_POLY1305_SHA256
43+
* AES/GCM/NoPadding keyupdate 2^22, ChaCha20-Poly1305 KeyUpdate 2^22
3744
*/
3845

3946
/*
@@ -86,7 +93,7 @@ public class SSLEngineKeyLimit {
8693
}
8794

8895
/**
89-
* args should have two values: server|client, <limit size>
96+
* args should have two values: server|client, cipher suite, <limit size>
9097
* Prepending 'p' is for internal use only.
9198
*/
9299
public static void main(String args[]) throws Exception {
@@ -105,7 +112,7 @@ public static void main(String args[]) throws Exception {
105112
File f = new File("keyusage."+ System.nanoTime());
106113
PrintWriter p = new PrintWriter(f);
107114
p.write("jdk.tls.keyLimits=");
108-
for (int i = 2; i < args.length; i++) {
115+
for (int i = 3; i < args.length; i++) {
109116
p.write(" "+ args[i]);
110117
}
111118
p.close();
@@ -120,10 +127,13 @@ public static void main(String args[]) throws Exception {
120127
System.getProperty("test.java.opts"));
121128

122129
ProcessBuilder pb = ProcessTools.createTestJvm(
123-
Utils.addTestJavaOpts("SSLEngineKeyLimit", "p", args[1]));
130+
Utils.addTestJavaOpts("SSLEngineKeyLimit", "p", args[1],
131+
args[2]));
124132

125133
OutputAnalyzer output = ProcessTools.executeProcess(pb);
126134
try {
135+
output.shouldContain(String.format(
136+
"\"cipher suite\" : \"%s", args[2]));
127137
if (expectedFail) {
128138
output.shouldNotContain("KeyUpdate: write key updated");
129139
output.shouldNotContain("KeyUpdate: read key updated");
@@ -171,9 +181,10 @@ public static void main(String args[]) throws Exception {
171181
cTos.clear();
172182
sToc.clear();
173183

174-
Thread ts = new Thread(serverwrite ? new Client() : new Server());
184+
Thread ts = new Thread(serverwrite ? new Client() :
185+
new Server(args[2]));
175186
ts.start();
176-
(serverwrite ? new Server() : new Client()).run();
187+
(serverwrite ? new Server(args[2]) : new Client()).run();
177188
ts.interrupt();
178189
ts.join();
179190
}
@@ -417,11 +428,14 @@ SSLContext initContext() throws Exception {
417428
}
418429

419430
static class Server extends SSLEngineKeyLimit implements Runnable {
420-
Server() throws Exception {
431+
Server(String cipherSuite) throws Exception {
421432
super();
422433
eng = initContext().createSSLEngine();
423434
eng.setUseClientMode(false);
424435
eng.setNeedClientAuth(true);
436+
if (cipherSuite != null && cipherSuite.length() > 0) {
437+
eng.setEnabledCipherSuites(new String[] { cipherSuite });
438+
}
425439
}
426440

427441
public void run() {

‎test/jdk/sun/security/ssl/SSLSocketImpl/SSLSocketKeyLimit.java‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,14 +23,24 @@
2323

2424
/*
2525
* @test
26-
* @bug 8164879
26+
* @bug 8164879 8300285
2727
* @library ../../
2828
* @library /test/lib
2929
* @modules java.base/sun.security.util
30-
* @summary Verify AES/GCM's limits set in the jdk.tls.keyLimits property
31-
* @run main SSLSocketKeyLimit 0 server AES/GCM/NoPadding keyupdate 1000000
32-
* @run main SSLSocketKeyLimit 0 client AES/GCM/NoPadding keyupdate 1000000
33-
* @run main SSLSocketKeyLimit 1 client AES/GCM/NoPadding keyupdate 2^22
30+
* @summary Verify AEAD TLS cipher suite limits set in the jdk.tls.keyLimits
31+
* property
32+
* @run main SSLSocketKeyLimit 0 server TLS_AES_256_GCM_SHA384
33+
* AES/GCM/NoPadding keyupdate 1000000
34+
* @run main SSLSocketKeyLimit 0 client TLS_AES_256_GCM_SHA384
35+
* AES/GCM/NoPadding keyupdate 1000000
36+
* @run main SSLSocketKeyLimit 1 client TLS_AES_256_GCM_SHA384
37+
* AES/GCM/NoPadding keyupdate 2^22
38+
* @run main SSLSocketKeyLimit 0 server TLS_CHACHA20_POLY1305_SHA256
39+
* AES/GCM/NoPadding keyupdate 1000000, ChaCha20-Poly1305 KeyUpdate 1000000
40+
* @run main SSLSocketKeyLimit 0 client TLS_CHACHA20_POLY1305_SHA256
41+
* AES/GCM/NoPadding keyupdate 1000000, ChaCha20-Poly1305 KeyUpdate 1000000
42+
* @run main SSLSocketKeyLimit 1 client TLS_CHACHA20_POLY1305_SHA256
43+
* AES/GCM/NoPadding keyupdate 2^22, ChaCha20-Poly1305 KeyUpdate 2^22
3444
*/
3545

3646
/**
@@ -96,7 +106,7 @@ SSLContext initContext() throws Exception {
96106
}
97107

98108
/**
99-
* args should have two values: server|client, <limit size>
109+
* args should have three values: server|client, cipher suite, <limit size>
100110
* Prepending 'p' is for internal use only.
101111
*/
102112
public static void main(String args[]) throws Exception {
@@ -110,7 +120,7 @@ public static void main(String args[]) throws Exception {
110120
File f = new File("keyusage."+ System.nanoTime());
111121
PrintWriter p = new PrintWriter(f);
112122
p.write("jdk.tls.keyLimits=");
113-
for (int i = 2; i < args.length; i++) {
123+
for (int i = 3; i < args.length; i++) {
114124
p.write(" "+ args[i]);
115125
}
116126
p.close();
@@ -125,10 +135,13 @@ public static void main(String args[]) throws Exception {
125135
System.getProperty("test.java.opts"));
126136

127137
ProcessBuilder pb = ProcessTools.createTestJvm(
128-
Utils.addTestJavaOpts("SSLSocketKeyLimit", "p", args[1]));
138+
Utils.addTestJavaOpts("SSLSocketKeyLimit", "p", args[1],
139+
args[2]));
129140

130141
OutputAnalyzer output = ProcessTools.executeProcess(pb);
131142
try {
143+
output.shouldContain(String.format(
144+
"\"cipher suite\" : \"%s", args[2]));
132145
if (expectedFail) {
133146
output.shouldNotContain("KeyUpdate: write key updated");
134147
output.shouldNotContain("KeyUpdate: read key updated");
@@ -150,7 +163,7 @@ public static void main(String args[]) throws Exception {
150163
return;
151164
}
152165

153-
if (args.length > 0 && args[0].compareToIgnoreCase("client") == 0) {
166+
if (args.length > 0 && args[1].compareToIgnoreCase("client") == 0) {
154167
serverwrite = false;
155168
}
156169

@@ -162,7 +175,7 @@ public static void main(String args[]) throws Exception {
162175
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
163176

164177
Arrays.fill(data, (byte)0x0A);
165-
Thread ts = new Thread(new Server());
178+
Thread ts = new Thread(new Server(args[2]));
166179

167180
ts.start();
168181
while (!serverReady) {
@@ -200,7 +213,8 @@ void read(SSLSocket s) throws Exception {
200213
int len;
201214
byte i = 0;
202215
try {
203-
System.out.println("Server: connected " + s.getSession().getCipherSuite());
216+
System.out.println("Server: connected " +
217+
s.getSession().getCipherSuite());
204218
in = s.getInputStream();
205219
out = s.getOutputStream();
206220
while (true) {
@@ -212,7 +226,8 @@ void read(SSLSocket s) throws Exception {
212226
if (b == 0x0A || b == 0x0D) {
213227
continue;
214228
}
215-
System.out.println("\nData invalid: " + HexPrinter.minimal().toString(buf));
229+
System.out.println("\nData invalid: " +
230+
HexPrinter.minimal().toString(buf));
216231
break;
217232
}
218233

@@ -237,11 +252,14 @@ void read(SSLSocket s) throws Exception {
237252
static class Server extends SSLSocketKeyLimit implements Runnable {
238253
private SSLServerSocketFactory ssf;
239254
private SSLServerSocket ss;
240-
Server() {
255+
Server(String cipherSuite) {
241256
super();
242257
try {
243258
ssf = initContext().getServerSocketFactory();
244259
ss = (SSLServerSocket) ssf.createServerSocket(serverPort);
260+
if (cipherSuite != null && cipherSuite.length() > 0) {
261+
ss.setEnabledCipherSuites(new String[] { cipherSuite });
262+
}
245263
serverPort = ss.getLocalPort();
246264
} catch (Exception e) {
247265
System.out.println("server: " + e.getMessage());

0 commit comments

Comments
 (0)