archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 14:54:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8331682: Slow networks/Impatient clients can potentially send unencrypted TLSv1.3 alerts that won't parse on the server

Browse source 
Reviewed-by: wetmore, djelinski, xuelei
This commit is contained in:
Artur Barashev 2024-11-04 18:46:38 +00:00
parent 0668e181c8
commit 8b4749713c
4 changed files with 470 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/java.base/share/classes/sun/security/ssl/SSLCipher.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -1859,10 +1859,20 @@ enum SSLCipher {
}
if (bb.remaining() <= tagSize) {
throw new BadPaddingException(
"Insufficient buffer remaining for AEAD cipher " +
"fragment (" + bb.remaining() + "). Needs to be " +
"more than tag size (" + tagSize + ")");
// Check for unexpected plaintext alert.
if (contentType == ContentType.ALERT.id
&& bb.remaining() == 2) {
throw new GeneralSecurityException(String.format(
"Unexpected plaintext alert received: " +
"Level: %s; Alert: %s",
Alert.Level.nameOf(bb.get(bb.position())),
Alert.nameOf(bb.get(bb.position() + 1))));
} else {
throw new BadPaddingException(
"Insufficient buffer remaining for AEAD cipher " +
"fragment (" + bb.remaining() + "). Needs to be " +
"more than tag size (" + tagSize + ")");
}
}
byte[] sn = sequence;