changeset 11284:791e4813f3fc

8057555: Less cryptic cipher suite management Reviewed-by: xuelei, igerasim, mullan, asmotrak Contributed-by: jamil.j.nimeh@oracle.com
author ascarpino
date Thu, 02 Oct 2014 11:20:48 -0700
parents fdae04f62a7d
children 1b3f1830b467
files src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java src/java.base/share/classes/sun/security/ssl/Handshaker.java src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java src/java.base/share/classes/sun/security/ssl/ServerHandshaker.java
diffstat 5 files changed, 38 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java	Fri Sep 12 16:11:40 2014 +0100
+++ b/src/java.base/share/classes/sun/security/ssl/ClientHandshaker.java	Thu Oct 02 11:20:48 2014 -0700
@@ -345,6 +345,13 @@
             break;
 
         case HandshakeMessage.ht_finished:
+            // A ChangeCipherSpec record must have been received prior to
+            // reception of the Finished message (RFC 5246, 7.4.9).
+            if (!receivedChangeCipherSpec()) {
+                fatalSE(Alerts.alert_handshake_failure,
+                    "Received Finished message before ChangeCipherSpec");
+            }
+
             this.serverFinished(
                 new Finished(protocolVersion, input, cipherSuite));
             break;
--- a/src/java.base/share/classes/sun/security/ssl/Handshaker.java	Fri Sep 12 16:11:40 2014 +0100
+++ b/src/java.base/share/classes/sun/security/ssl/Handshaker.java	Thu Oct 02 11:20:48 2014 -0700
@@ -360,6 +360,14 @@
         }
     }
 
+    final boolean receivedChangeCipherSpec() {
+        if (conn != null) {
+            return conn.receivedChangeCipherSpec();
+        } else {
+            return engine.receivedChangeCipherSpec();
+        }
+    }
+
     String getEndpointIdentificationAlgorithmSE() {
         SSLParameters paras;
         if (conn != null) {
--- a/src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java	Fri Sep 12 16:11:40 2014 +0100
+++ b/src/java.base/share/classes/sun/security/ssl/SSLEngineImpl.java	Thu Oct 02 11:20:48 2014 -0700
@@ -2141,6 +2141,14 @@
     }
 
     /**
+     * Returns a boolean indicating whether the ChangeCipherSpec message
+     * has been received for this handshake.
+     */
+    boolean receivedChangeCipherSpec() {
+        return receivedCCS;
+    }
+
+    /**
      * Returns a printable representation of this end of the connection.
      */
     @Override
--- a/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java	Fri Sep 12 16:11:40 2014 +0100
+++ b/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java	Thu Oct 02 11:20:48 2014 -0700
@@ -2610,6 +2610,14 @@
     }
 
     /**
+     * Returns a boolean indicating whether the ChangeCipherSpec message
+     * has been received for this handshake.
+     */
+    boolean receivedChangeCipherSpec() {
+        return receivedCCS;
+    }
+
+    /**
      * Returns a printable representation of this end of the connection.
      */
     @Override
--- a/src/java.base/share/classes/sun/security/ssl/ServerHandshaker.java	Fri Sep 12 16:11:40 2014 +0100
+++ b/src/java.base/share/classes/sun/security/ssl/ServerHandshaker.java	Thu Oct 02 11:20:48 2014 -0700
@@ -287,6 +287,13 @@
                 break;
 
             case HandshakeMessage.ht_finished:
+                // A ChangeCipherSpec record must have been received prior to
+                // reception of the Finished message (RFC 5246, 7.4.9).
+                if (!receivedChangeCipherSpec()) {
+                    fatalSE(Alerts.alert_handshake_failure,
+                        "Received Finished message before ChangeCipherSpec");
+                }
+
                 this.clientFinished(
                     new Finished(protocolVersion, input, cipherSuite));
                 break;