archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 23:34:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8215711: Missing key_share extension for (EC)DHE key exchange should alert missing_extension

Browse source 
Reviewed-by: ascarpino
This commit is contained in:
Xue-Lei Andrew Fan 2020-04-05 20:17:08 -07:00
parent a6b990f74a
commit ed00873148
4 changed files with 103 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

32
src/java.base/share/classes/sun/security/ssl/KeyShareExtension.java
View file

@ -51,6 +51,8 @@ final class KeyShareExtension {
new CHKeyShareProducer();
static final ExtensionConsumer chOnLoadConsumer =
new CHKeyShareConsumer();
static final HandshakeAbsence chOnTradAbsence =
new CHKeyShareOnTradeAbsence();
static final SSLStringizer chStringizer =
new CHKeyShareStringizer();
@ -372,6 +374,36 @@ final class KeyShareExtension {
}
}
/**
* The absence processing if the extension is not present in
* a ClientHello handshake message.
*/
private static final class CHKeyShareOnTradeAbsence
implements HandshakeAbsence {
@Override
public void absent(ConnectionContext context,
HandshakeMessage message) throws IOException {
// The producing happens in server side only.
ServerHandshakeContext shc = (ServerHandshakeContext)context;
// A client is considered to be attempting to negotiate using this
// specification if the ClientHello contains a "supported_versions"
// extension with 0x0304 contained in its body. Such a ClientHello
// message MUST meet the following requirements:
// - If containing a "supported_groups" extension, it MUST also
// contain a "key_share" extension, and vice versa. An empty
// KeyShare.client_shares vector is permitted.
if (shc.negotiatedProtocol.useTLS13PlusSpec() &&
shc.handshakeExtensions.containsKey(
SSLExtension.CH_SUPPORTED_GROUPS)) {
throw shc.conContext.fatal(Alert.MISSING_EXTENSION,
"No key_share extension to work with " +
"the supported_groups extension");
}
}
}
/**
* The key share entry used in ServerHello "key_share" extensions.
*/