archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 15:24:43 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8263188: JSSE should fail fast if there isn't supported signature algorithm

Browse source 
Reviewed-by: xuelei
This commit is contained in:
John Jiang 2021-03-29 05:53:05 +00:00
parent 6678b01c57
commit 99b4bab366
6 changed files with 494 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/java.base/share/classes/sun/security/ssl/CertificateRequest.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2015, 2021, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -689,13 +689,16 @@ final class CertificateRequest {
chc.handshakeProducers.put(SSLHandshake.CERTIFICATE.id,
SSLHandshake.CERTIFICATE);
List<SignatureScheme> sss = new LinkedList<>();
for (int id : crm.algorithmIds) {
SignatureScheme ss = SignatureScheme.valueOf(id);
if (ss != null) {
sss.add(ss);
}
List<SignatureScheme> sss =
SignatureScheme.getSupportedAlgorithms(
chc.sslConfig,
chc.algorithmConstraints, chc.negotiatedProtocol,
crm.algorithmIds);
if (sss == null || sss.isEmpty()) {
throw chc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
chc.peerRequestedSignatureSchemes = sss;
chc.peerRequestedCertSignSchemes = sss; // use the same schemes
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(sss);

10
src/java.base/share/classes/sun/security/ssl/SignatureAlgorithmsExtension.java
View file

@ -279,6 +279,10 @@ final class SignatureAlgorithmsExtension {
shc.sslConfig,
shc.algorithmConstraints, shc.negotiatedProtocol,
spec.signatureSchemes);
if (sss == null || sss.isEmpty()) {
throw shc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
shc.peerRequestedSignatureSchemes = sss;
// If no "signature_algorithms_cert" extension is present, then
@ -330,7 +334,7 @@ final class SignatureAlgorithmsExtension {
if (shc.negotiatedProtocol.useTLS13PlusSpec()) {
throw shc.conContext.fatal(Alert.MISSING_EXTENSION,
"No mandatory signature_algorithms extension in the " +
"received CertificateRequest handshake message");
"received ClientHello handshake message");
}
}
}
@ -503,6 +507,10 @@ final class SignatureAlgorithmsExtension {
chc.sslConfig,
chc.algorithmConstraints, chc.negotiatedProtocol,
spec.signatureSchemes);
if (sss == null || sss.isEmpty()) {
throw chc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
chc.peerRequestedSignatureSchemes = sss;
// If no "signature_algorithms_cert" extension is present, then