Skip to content

Commit addec14

Browse files
GoeLinGoeLin
committed
8288209: SSL debug message wrong about unsupported authentication scheme
Backport-of: 19017358b1b3c63fdddc1eecb2fe52f7b7d4b6e3
1 parent 4b2d777 commit addec14

File tree

5 files changed

+47
-95
lines changed

5 files changed

+47
-95
lines changed

‎src/java.base/share/classes/sun/security/ssl/CertificateMessage.java‎

Lines changed: 14 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1042,46 +1042,22 @@ private static SSLPossession choosePossession(
10421042
return null;
10431043
}
10441044

1045-
Collection<String> checkedKeyTypes = new HashSet<>();
1046-
List<String> supportedKeyTypes = new ArrayList<>();
1047-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
1048-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
1049-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1050-
SSLLogger.warning(
1051-
"Unsupported authentication scheme: " + ss.name);
1052-
}
1053-
continue;
1054-
}
1055-
checkedKeyTypes.add(ss.keyAlgorithm);
1056-
1057-
// Don't select a signature scheme unless we will be able to
1058-
// produce a CertificateVerify message later
1059-
if (SignatureScheme.getPreferableAlgorithm(
1060-
hc.algorithmConstraints,
1061-
hc.peerRequestedSignatureSchemes,
1062-
ss, hc.negotiatedProtocol) == null) {
1063-
1064-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1065-
SSLLogger.warning(
1066-
"Unable to produce CertificateVerify for " +
1067-
"signature scheme: " + ss.name);
1068-
}
1069-
continue;
1070-
}
1071-
1072-
X509Authentication ka = X509Authentication.valueOf(ss);
1073-
if (ka == null) {
1074-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1075-
SSLLogger.warning(
1076-
"Unsupported authentication scheme: " + ss.name);
1077-
}
1078-
continue;
1079-
}
1080-
supportedKeyTypes.add(ss.keyAlgorithm);
1081-
}
1045+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
1046+
.stream()
1047+
.map(ss -> ss.keyAlgorithm)
1048+
.distinct()
1049+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
1050+
hc.algorithmConstraints, // we will be able to produce
1051+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
1052+
ka, hc.negotiatedProtocol) != null
1053+
|| SSLLogger.logWarning("ssl,handshake",
1054+
"Unable to produce CertificateVerify for key algorithm: " + ka))
1055+
.filter(ka -> X509Authentication.valueOfKeyAlgorithm(ka) != null
1056+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka))
1057+
.toArray(String[]::new);
10821058

10831059
SSLPossession pos = X509Authentication
1084-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
1060+
.createPossession(hc, supportedKeyTypes);
10851061
if (pos == null) {
10861062
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
10871063
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/CertificateRequest.java‎

Lines changed: 20 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,7 @@
3232
import java.text.MessageFormat;
3333
import java.util.ArrayList;
3434
import java.util.Arrays;
35-
import java.util.Collection;
3635
import java.util.Collections;
37-
import java.util.HashSet;
3836
import java.util.LinkedList;
3937
import java.util.List;
4038
import java.util.Locale;
@@ -760,59 +758,28 @@ private static SSLPossession choosePossession(HandshakeContext hc,
760758
crKeyTypes.add("RSASSA-PSS");
761759
}
762760

763-
Collection<String> checkedKeyTypes = new HashSet<>();
764-
List<String> supportedKeyTypes = new ArrayList<>();
765-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
766-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
767-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
768-
SSLLogger.warning(
769-
"Unsupported authentication scheme: " + ss.name);
770-
}
771-
continue;
772-
}
773-
checkedKeyTypes.add(ss.keyAlgorithm);
774-
775-
// Don't select a signature scheme unless we will be able to
776-
// produce a CertificateVerify message later
777-
if (SignatureScheme.getPreferableAlgorithm(
778-
hc.algorithmConstraints,
779-
hc.peerRequestedSignatureSchemes,
780-
ss, hc.negotiatedProtocol) == null) {
781-
782-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
783-
SSLLogger.warning(
784-
"Unable to produce CertificateVerify for " +
785-
"signature scheme: " + ss.name);
786-
}
787-
continue;
788-
}
789-
790-
X509Authentication ka = X509Authentication.valueOf(ss);
791-
if (ka == null) {
792-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
793-
SSLLogger.warning(
794-
"Unsupported authentication scheme: " + ss.name);
795-
}
796-
continue;
797-
} else {
798-
// Any auth object will have a set of allowed key types.
799-
// This set should share at least one common algorithm with
800-
// the CR's allowed key types.
801-
if (Collections.disjoint(crKeyTypes,
802-
Arrays.asList(ka.keyTypes))) {
803-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
804-
SSLLogger.warning(
805-
"Unsupported authentication scheme: " +
806-
ss.name);
807-
}
808-
continue;
809-
}
810-
}
811-
supportedKeyTypes.add(ss.keyAlgorithm);
812-
}
761+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
762+
.stream()
763+
.map(ss -> ss.keyAlgorithm)
764+
.distinct()
765+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
766+
hc.algorithmConstraints, // we will be able to produce
767+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
768+
ka, hc.negotiatedProtocol) != null
769+
|| SSLLogger.logWarning("ssl,handshake",
770+
"Unable to produce CertificateVerify for key algorithm: " + ka))
771+
.filter(ka -> {
772+
var xa = X509Authentication.valueOfKeyAlgorithm(ka);
773+
// Any auth object will have a set of allowed key types.
774+
// This set should share at least one common algorithm with
775+
// the CR's allowed key types.
776+
return xa != null && !Collections.disjoint(crKeyTypes, Arrays.asList(xa.keyTypes))
777+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka);
778+
})
779+
.toArray(String[]::new);
813780

814781
SSLPossession pos = X509Authentication
815-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
782+
.createPossession(hc, supportedKeyTypes);
816783
if (pos == null) {
817784
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
818785
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/SSLLogger.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,15 @@ static String toString(Object... params) {
210210
}
211211
}
212212

213+
// Logs a warning message and always returns false. This method
214+
// can be used as an OR Predicate to add a log in a stream filter.
215+
public static boolean logWarning(String option, String s) {
216+
if (SSLLogger.isOn && SSLLogger.isOn(option)) {
217+
SSLLogger.warning(s);
218+
}
219+
return false;
220+
}
221+
213222
private static class SSLConsoleLogger implements Logger {
214223
private final String loggerName;
215224
private final boolean useCompactFormat;

‎src/java.base/share/classes/sun/security/ssl/SignatureScheme.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -455,13 +455,13 @@ static List<SignatureScheme> getSupportedAlgorithms(
455455
static SignatureScheme getPreferableAlgorithm(
456456
AlgorithmConstraints constraints,
457457
List<SignatureScheme> schemes,
458-
SignatureScheme certScheme,
458+
String keyAlgorithm,
459459
ProtocolVersion version) {
460460

461461
for (SignatureScheme ss : schemes) {
462462
if (ss.isAvailable &&
463463
ss.handshakeSupportedProtocols.contains(version) &&
464-
certScheme.keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
464+
keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
465465
ss.isPermitted(constraints)) {
466466
return ss;
467467
}

‎src/java.base/share/classes/sun/security/ssl/X509Authentication.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ private X509Authentication(String keyAlgorithm,
7272
this.keyTypes = keyTypes;
7373
}
7474

75-
static X509Authentication valueOf(SignatureScheme signatureScheme) {
75+
static X509Authentication valueOfKeyAlgorithm(String keyAlgorithm) {
7676
for (X509Authentication au : X509Authentication.values()) {
77-
if (au.keyAlgorithm.equals(signatureScheme.keyAlgorithm)) {
77+
if (au.keyAlgorithm.equals(keyAlgorithm)) {
7878
return au;
7979
}
8080
}

0 commit comments

Comments
 (0)