changeset 59501:b9d1ce20dd4b

8236039: JSSE Client does not accept status_request extension in CertificateRequest messages for TLS 1.3 Reviewed-by: xuelei
author jnimeh
date Sun, 05 Jan 2020 21:04:39 -0800
parents 3782f2958116
children d8fbcf86ce72
files src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java src/java.base/share/classes/sun/security/ssl/SSLExtension.java src/java.base/share/classes/sun/security/ssl/SSLExtensions.java
diffstat 3 files changed, 55 insertions(+), 43 deletions(-) [+]
line wrap: on
line diff
--- a/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java	Mon Jan 06 11:29:38 2020 +0800
+++ b/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java	Sun Jan 05 21:04:39 2020 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -39,11 +39,7 @@
 import javax.net.ssl.SSLProtocolException;
 import sun.security.provider.certpath.OCSPResponse;
 import sun.security.provider.certpath.ResponderId;
-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST;
-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST_V2;
 import sun.security.ssl.SSLExtension.ExtensionConsumer;
-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST;
-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST_V2;
 import sun.security.ssl.SSLExtension.SSLExtensionSpec;
 import sun.security.ssl.SSLHandshake.HandshakeMessage;
 import sun.security.util.DerInputStream;
@@ -434,8 +430,9 @@
                     } else {
                         extBuilder.append(",\n");
                     }
-                    extBuilder.append(
-                            "{\n" + Utilities.indent(ext.toString()) + "}");
+                    extBuilder.append("{\n").
+                            append(Utilities.indent(ext.toString())).
+                            append("}");
                 }
 
                 extsStr = extBuilder.toString();
@@ -552,11 +549,11 @@
                 return null;
             }
 
-            if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {
+            if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
                     SSLLogger.fine(
                         "Ignore unavailable extension: " +
-                        CH_STATUS_REQUEST.name);
+                        SSLExtension.CH_STATUS_REQUEST.name);
                 }
                 return null;
             }
@@ -568,8 +565,8 @@
             byte[] extData = new byte[] {0x01, 0x00, 0x00, 0x00, 0x00};
 
             // Update the context.
-            chc.handshakeExtensions.put(
-                    CH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
+            chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST,
+                    CertStatusRequestSpec.DEFAULT);
 
             return extData;
         }
@@ -593,10 +590,10 @@
             // The consuming happens in server side only.
             ServerHandshakeContext shc = (ServerHandshakeContext)context;
 
-            if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {
+            if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
                     SSLLogger.fine("Ignore unavailable extension: " +
-                        CH_STATUS_REQUEST.name);
+                        SSLExtension.CH_STATUS_REQUEST.name);
                 }
                 return;     // ignore the extension
             }
@@ -610,7 +607,7 @@
             }
 
             // Update the context.
-            shc.handshakeExtensions.put(CH_STATUS_REQUEST, spec);
+            shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST, spec);
             if (!shc.isResumption &&
                     !shc.negotiatedProtocol.useTLS13PlusSpec()) {
                 shc.handshakeProducers.put(SSLHandshake.CERTIFICATE_STATUS.id,
@@ -654,13 +651,12 @@
 
             // In response to "status_request" extension request only.
             CertStatusRequestSpec spec = (CertStatusRequestSpec)
-                    shc.handshakeExtensions.get(CH_STATUS_REQUEST);
+                    shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);
             if (spec == null) {
                 // Ignore, no status_request extension requested.
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
-                    SSLLogger.finest(
-                        "Ignore unavailable extension: " +
-                        CH_STATUS_REQUEST.name);
+                    SSLLogger.finest("Ignore unavailable extension: " +
+                        SSLExtension.CH_STATUS_REQUEST.name);
                 }
 
                 return null;        // ignore the extension
@@ -681,8 +677,8 @@
             byte[] extData = new byte[0];
 
             // Update the context.
-            shc.handshakeExtensions.put(
-                    SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
+            shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,
+                    CertStatusRequestSpec.DEFAULT);
 
             return extData;
         }
@@ -708,7 +704,7 @@
 
             // In response to "status_request" extension request only.
             CertStatusRequestSpec requestedCsr = (CertStatusRequestSpec)
-                    chc.handshakeExtensions.get(CH_STATUS_REQUEST);
+                    chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);
             if (requestedCsr == null) {
                 throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
                     "Unexpected status_request extension in ServerHello");
@@ -722,8 +718,8 @@
             }
 
             // Update the context.
-            chc.handshakeExtensions.put(
-                    SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);
+            chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,
+                    CertStatusRequestSpec.DEFAULT);
 
             // Since we've received a legitimate status_request in the
             // ServerHello, stapling is active if it's been enabled.
@@ -909,7 +905,7 @@
                 return null;
             }
 
-            if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {
+            if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
                     SSLLogger.finest(
                         "Ignore unavailable status_request_v2 extension");
@@ -926,8 +922,8 @@
                 0x00, 0x07, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00};
 
             // Update the context.
-            chc.handshakeExtensions.put(
-                    CH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
+            chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,
+                    CertStatusRequestV2Spec.DEFAULT);
 
             return extData;
         }
@@ -951,7 +947,7 @@
             // The consuming happens in server side only.
             ServerHandshakeContext shc = (ServerHandshakeContext)context;
 
-            if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {
+            if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
                     SSLLogger.finest(
                         "Ignore unavailable status_request_v2 extension");
@@ -969,7 +965,8 @@
             }
 
             // Update the context.
-            shc.handshakeExtensions.put(CH_STATUS_REQUEST_V2, spec);
+            shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,
+                    spec);
             if (!shc.isResumption) {
                 shc.handshakeProducers.putIfAbsent(
                         SSLHandshake.CERTIFICATE_STATUS.id,
@@ -1013,7 +1010,7 @@
 
             // In response to "status_request_v2" extension request only
             CertStatusRequestV2Spec spec = (CertStatusRequestV2Spec)
-                    shc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);
+                shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);
             if (spec == null) {
                 // Ignore, no status_request_v2 extension requested.
                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
@@ -1038,8 +1035,8 @@
             byte[] extData = new byte[0];
 
             // Update the context.
-            shc.handshakeExtensions.put(
-                    SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
+            shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,
+                    CertStatusRequestV2Spec.DEFAULT);
 
             return extData;
         }
@@ -1065,7 +1062,7 @@
 
             // In response to "status_request" extension request only
             CertStatusRequestV2Spec requestedCsr = (CertStatusRequestV2Spec)
-                    chc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);
+                chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);
             if (requestedCsr == null) {
                 throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,
                     "Unexpected status_request_v2 extension in ServerHello");
@@ -1079,8 +1076,8 @@
             }
 
             // Update the context.
-            chc.handshakeExtensions.put(
-                    SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);
+            chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,
+                    CertStatusRequestV2Spec.DEFAULT);
 
             // Since we've received a legitimate status_request in the
             // ServerHello, stapling is active if it's been enabled.  If it
--- a/src/java.base/share/classes/sun/security/ssl/SSLExtension.java	Mon Jan 06 11:29:38 2020 +0800
+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtension.java	Sun Jan 05 21:04:39 2020 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -113,7 +113,6 @@
                                 null,
                                 null,
                                 CertStatusExtension.certStatusReqStringizer),
-
     CR_STATUS_REQUEST       (0x0005, "status_request"),
     CT_STATUS_REQUEST       (0x0005, "status_request",
                                 SSLHandshake.CERTIFICATE,
@@ -124,6 +123,7 @@
                                 null,
                                 null,
                                 CertStatusExtension.certStatusRespStringizer),
+
     // extensions defined in RFC 4681
     USER_MAPPING            (0x0006, "user_mapping"),
 
@@ -554,6 +554,16 @@
         return null;
     }
 
+    static String nameOf(int extensionType) {
+        for (SSLExtension ext : SSLExtension.values()) {
+            if (ext.id == extensionType) {
+                return ext.name;
+            }
+        }
+
+        return "unknown extension";
+    }
+
     static boolean isConsumable(int extensionType) {
         for (SSLExtension ext : SSLExtension.values()) {
             if (ext.id == extensionType &&
--- a/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java	Mon Jan 06 11:29:38 2020 +0800
+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java	Sun Jan 05 21:04:39 2020 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2018, 2020 Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -86,11 +86,14 @@
                                 "Received buggy supported_groups extension " +
                                 "in the ServerHello handshake message");
                     }
+                } else if (handshakeType == SSLHandshake.SERVER_HELLO) {
+                    throw hm.handshakeContext.conContext.fatal(
+                            Alert.UNSUPPORTED_EXTENSION, "extension (" +
+                                    extId + ") should not be presented in " +
+                                    handshakeType.name);
                 } else {
-                    throw hm.handshakeContext.conContext.fatal(
-                        Alert.UNSUPPORTED_EXTENSION,
-                        "extension (" + extId +
-                        ") should not be presented in " + handshakeType.name);
+                    isSupported = false;
+                    // debug log to ignore unknown extension for handshakeType
                 }
             }
 
@@ -365,9 +368,10 @@
     }
 
     private static String toString(int extId, byte[] extData) {
+        String extName = SSLExtension.nameOf(extId);
         MessageFormat messageFormat = new MessageFormat(
-            "\"unknown extension ({0})\": '{'\n" +
-            "{1}\n" +
+            "\"{0} ({1})\": '{'\n" +
+            "{2}\n" +
             "'}'",
             Locale.ENGLISH);
 
@@ -375,6 +379,7 @@
         String encoded = hexEncoder.encodeBuffer(extData);
 
         Object[] messageFields = {
+            extName,
             extId,
             Utilities.indent(encoded)
         };