author | chegar |
Thu, 17 Oct 2019 20:54:25 +0100 | |
branch | datagramsocketimpl-branch |
changeset 58679 | 9c3209ff7550 |
parent 58678 | 9cf78a70fa4f |
parent 57485 | af4b0fc25bc4 |
permissions | -rw-r--r-- |
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
1 |
/* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
2 |
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
4 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
5 |
* This code is free software; you can redistribute it and/or modify it |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
7 |
* published by the Free Software Foundation. Oracle designates this |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
8 |
* particular file as subject to the "Classpath" exception as provided |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
9 |
* by Oracle in the LICENSE file that accompanied this code. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
10 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
15 |
* accompanied this code). |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
16 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
17 |
* You should have received a copy of the GNU General Public License version |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
20 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
22 |
* or visit www.oracle.com if you need additional information or have any |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
23 |
* questions. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
24 |
*/ |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
25 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
26 |
package sun.security.ssl; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
27 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
28 |
import sun.security.action.GetPropertyAction; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
29 |
import sun.security.ssl.SSLExtension.ExtensionConsumer; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
30 |
import sun.security.ssl.SSLExtension.SSLExtensionSpec; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
31 |
import sun.security.ssl.SSLHandshake.HandshakeMessage; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
32 |
import sun.security.ssl.SupportedGroupsExtension.SupportedGroups; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
33 |
import sun.security.util.HexDumpEncoder; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
34 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
35 |
import javax.crypto.Cipher; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
36 |
import javax.crypto.KeyGenerator; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
37 |
import javax.crypto.SecretKey; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
38 |
import javax.crypto.spec.GCMParameterSpec; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
39 |
import javax.net.ssl.SSLProtocolException; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
40 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
41 |
import static sun.security.ssl.SSLExtension.CH_SESSION_TICKET; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
42 |
import static sun.security.ssl.SSLExtension.SH_SESSION_TICKET; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
43 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
44 |
import java.io.IOException; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
45 |
import java.nio.ByteBuffer; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
46 |
import java.security.NoSuchAlgorithmException; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
47 |
import java.security.SecureRandom; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
48 |
import java.text.MessageFormat; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
49 |
import java.util.Locale; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
50 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
51 |
/** |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
52 |
* SessionTicketExtension is an implementation of RFC 5077 with some internals |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
53 |
* that are used for stateless operation in TLS 1.3. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
54 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
55 |
* {@systemProperty jdk.tls.server.statelessKeyTimeout} can override the default |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
56 |
* amount of time, in seconds, for how long a randomly-generated key and |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
57 |
* parameters can be used before being regenerated. The key material is used |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
58 |
* to encrypt the stateless session ticket that is sent to the client that will |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
59 |
* be used during resumption. Default is 3600 seconds (1 hour) |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
60 |
* |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
61 |
*/ |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
62 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
63 |
final class SessionTicketExtension { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
64 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
65 |
static final HandshakeProducer chNetworkProducer = |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
66 |
new T12CHSessionTicketProducer(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
67 |
static final ExtensionConsumer chOnLoadConsumer = |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
68 |
new T12CHSessionTicketConsumer(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
69 |
static final HandshakeProducer shNetworkProducer = |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
70 |
new T12SHSessionTicketProducer(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
71 |
static final ExtensionConsumer shOnLoadConsumer = |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
72 |
new T12SHSessionTicketConsumer(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
73 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
74 |
static final SSLStringizer steStringizer = new SessionTicketStringizer(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
75 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
76 |
// Time in milliseconds until key is changed for encrypting session state |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
77 |
private static final int TIMEOUT_DEFAULT = 3600 * 1000; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
78 |
private static final int keyTimeout; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
79 |
private static int currentKeyID = new SecureRandom().nextInt(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
80 |
private static final int KEYLEN = 256; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
81 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
82 |
static { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
83 |
String s = GetPropertyAction.privilegedGetProperty( |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
84 |
"jdk.tls.server.statelessKeyTimeout"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
85 |
if (s != null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
86 |
int kt; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
87 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
88 |
kt = Integer.parseInt(s) * 1000; // change to ms |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
89 |
if (kt < 0 || |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
90 |
kt > NewSessionTicket.MAX_TICKET_LIFETIME) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
91 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
92 |
SSLLogger.warning("Invalid timeout for " + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
93 |
"jdk.tls.server.statelessKeyTimeout: " + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
94 |
kt + ". Set to default value " + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
95 |
TIMEOUT_DEFAULT + "sec"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
96 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
97 |
kt = TIMEOUT_DEFAULT; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
98 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
99 |
} catch (NumberFormatException e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
100 |
kt = TIMEOUT_DEFAULT; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
101 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
102 |
SSLLogger.warning("Invalid timeout for " + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
103 |
"jdk.tls.server.statelessKeyTimeout: " + s + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
104 |
". Set to default value " + TIMEOUT_DEFAULT + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
105 |
"sec"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
106 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
107 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
108 |
keyTimeout = kt; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
109 |
} else { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
110 |
keyTimeout = TIMEOUT_DEFAULT; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
111 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
112 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
113 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
114 |
// Crypto key context for session state. Used with stateless operation. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
115 |
final static class StatelessKey { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
116 |
final long timeout; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
117 |
final SecretKey key; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
118 |
final int num; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
119 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
120 |
StatelessKey(HandshakeContext hc, int newNum) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
121 |
SecretKey k = null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
122 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
123 |
KeyGenerator kg = KeyGenerator.getInstance("AES"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
124 |
kg.init(KEYLEN, hc.sslContext.getSecureRandom()); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
125 |
k = kg.generateKey(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
126 |
} catch (NoSuchAlgorithmException e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
127 |
// should not happen; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
128 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
129 |
key = k; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
130 |
timeout = System.currentTimeMillis() + keyTimeout; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
131 |
num = newNum; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
132 |
hc.sslContext.keyHashMap.put(Integer.valueOf(num), this); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
133 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
134 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
135 |
// Check if key needs to be changed |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
136 |
boolean isExpired() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
137 |
return ((System.currentTimeMillis()) > timeout); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
138 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
139 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
140 |
// Check if this key is ready for deletion. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
141 |
boolean isInvalid(long sessionTimeout) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
142 |
return ((System.currentTimeMillis()) > (timeout + sessionTimeout)); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
143 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
144 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
145 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
146 |
private static final class KeyState { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
147 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
148 |
// Get a key with a specific key number |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
149 |
static StatelessKey getKey(HandshakeContext hc, int num) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
150 |
StatelessKey ssk = hc.sslContext.keyHashMap.get(num); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
151 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
152 |
if (ssk == null || ssk.isInvalid(getSessionTimeout(hc))) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
153 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
154 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
155 |
return ssk; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
156 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
157 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
158 |
// Get the current valid key, this will generate a new key if needed |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
159 |
static StatelessKey getCurrentKey(HandshakeContext hc) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
160 |
StatelessKey ssk = hc.sslContext.keyHashMap.get(currentKeyID); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
161 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
162 |
if (ssk != null && !ssk.isExpired()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
163 |
return ssk; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
164 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
165 |
return nextKey(hc); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
166 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
167 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
168 |
// This method locks when the first getCurrentKey() finds it to be too |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
169 |
// old and create a new key to replace the current key. After the new |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
170 |
// key established, the lock can be released so following |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
171 |
// operations will start using the new key. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
172 |
// The first operation will take a longer code path by generating the |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
173 |
// next key and cleaning up old keys. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
174 |
private static StatelessKey nextKey(HandshakeContext hc) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
175 |
StatelessKey ssk; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
176 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
177 |
synchronized (hc.sslContext.keyHashMap) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
178 |
// If the current key is no longer expired, it was already |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
179 |
// updated by a previous operation and we can return. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
180 |
ssk = hc.sslContext.keyHashMap.get(currentKeyID); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
181 |
if (ssk != null && !ssk.isExpired()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
182 |
return ssk; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
183 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
184 |
int newNum; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
185 |
if (currentKeyID == Integer.MAX_VALUE) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
186 |
newNum = 0; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
187 |
} else { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
188 |
newNum = currentKeyID + 1; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
189 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
190 |
// Get new key |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
191 |
ssk = new StatelessKey(hc, newNum); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
192 |
currentKeyID = newNum; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
193 |
// Release lock since the new key is ready to be used. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
194 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
195 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
196 |
// Clean up any old keys, then return the current key |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
197 |
cleanup(hc); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
198 |
return ssk; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
199 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
200 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
201 |
// Deletes any invalid SessionStateKeys. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
202 |
static void cleanup(HandshakeContext hc) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
203 |
int sessionTimeout = getSessionTimeout(hc); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
204 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
205 |
StatelessKey ks; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
206 |
for (Object o : hc.sslContext.keyHashMap.keySet().toArray()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
207 |
Integer i = (Integer)o; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
208 |
ks = hc.sslContext.keyHashMap.get(i); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
209 |
if (ks.isInvalid(sessionTimeout)) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
210 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
211 |
ks.key.destroy(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
212 |
} catch (Exception e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
213 |
// Suppress |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
214 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
215 |
hc.sslContext.keyHashMap.remove(i); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
216 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
217 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
218 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
219 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
220 |
static int getSessionTimeout(HandshakeContext hc) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
221 |
return hc.sslContext.engineGetServerSessionContext(). |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
222 |
getSessionTimeout() * 1000; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
223 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
224 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
225 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
226 |
/** |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
227 |
* This class contains the session state that is in the session ticket. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
228 |
* Using the key associated with the ticket, the class encrypts and |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
229 |
* decrypts the data, but does not interpret the data. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
230 |
*/ |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
231 |
static final class SessionTicketSpec implements SSLExtensionSpec { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
232 |
private static final int GCM_TAG_LEN = 128; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
233 |
ByteBuffer data; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
234 |
static final ByteBuffer zero = ByteBuffer.wrap(new byte[0]); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
235 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
236 |
SessionTicketSpec() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
237 |
data = zero; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
238 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
239 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
240 |
SessionTicketSpec(byte[] b) throws IOException { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
241 |
this(ByteBuffer.wrap(b)); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
242 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
243 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
244 |
SessionTicketSpec(ByteBuffer buf) throws IOException { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
245 |
if (buf == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
246 |
throw new SSLProtocolException( |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
247 |
"SessionTicket buffer too small"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
248 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
249 |
if (buf.remaining() > 65536) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
250 |
throw new SSLProtocolException( |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
251 |
"SessionTicket buffer too large. " + buf.remaining()); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
252 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
253 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
254 |
data = buf; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
255 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
256 |
|
57485 | 257 |
public byte[] encrypt(HandshakeContext hc, SSLSessionImpl session) { |
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
258 |
byte[] encrypted; |
57485 | 259 |
|
260 |
if (!hc.handshakeSession.isStatelessable(hc)) { |
|
261 |
return new byte[0]; |
|
262 |
} |
|
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
263 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
264 |
try { |
57485 | 265 |
StatelessKey key = KeyState.getCurrentKey(hc); |
266 |
byte[] iv = new byte[16]; |
|
267 |
||
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
268 |
SecureRandom random = hc.sslContext.getSecureRandom(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
269 |
random.nextBytes(iv); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
270 |
Cipher c = Cipher.getInstance("AES/GCM/NoPadding"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
271 |
c.init(Cipher.ENCRYPT_MODE, key.key, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
272 |
new GCMParameterSpec(GCM_TAG_LEN, iv)); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
273 |
c.updateAAD(new byte[] { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
274 |
(byte)(key.num >>> 24), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
275 |
(byte)(key.num >>> 16), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
276 |
(byte)(key.num >>> 8), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
277 |
(byte)(key.num)} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
278 |
); |
57485 | 279 |
byte[] data = session.write(); |
280 |
if (data.length == 0) { |
|
281 |
return data; |
|
282 |
} |
|
283 |
encrypted = c.doFinal(data); |
|
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
284 |
byte[] result = new byte[encrypted.length + Integer.BYTES + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
285 |
iv.length]; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
286 |
result[0] = (byte)(key.num >>> 24); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
287 |
result[1] = (byte)(key.num >>> 16); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
288 |
result[2] = (byte)(key.num >>> 8); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
289 |
result[3] = (byte)(key.num); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
290 |
System.arraycopy(iv, 0, result, Integer.BYTES, iv.length); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
291 |
System.arraycopy(encrypted, 0, result, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
292 |
Integer.BYTES + iv.length, encrypted.length); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
293 |
return result; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
294 |
} catch (Exception e) { |
57485 | 295 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
296 |
SSLLogger.fine("Encryption failed." + e); |
|
297 |
} |
|
298 |
return new byte[0]; |
|
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
299 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
300 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
301 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
302 |
ByteBuffer decrypt(HandshakeContext hc) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
303 |
int keyID; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
304 |
byte[] iv; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
305 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
306 |
keyID = data.getInt(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
307 |
StatelessKey key = KeyState.getKey(hc, keyID); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
308 |
if (key == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
309 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
310 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
311 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
312 |
iv = new byte[16]; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
313 |
data.get(iv); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
314 |
Cipher c = Cipher.getInstance("AES/GCM/NoPadding"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
315 |
c.init(Cipher.DECRYPT_MODE, key.key, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
316 |
new GCMParameterSpec(GCM_TAG_LEN, iv)); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
317 |
c.updateAAD(new byte[] { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
318 |
(byte)(keyID >>> 24), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
319 |
(byte)(keyID >>> 16), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
320 |
(byte)(keyID >>> 8), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
321 |
(byte)(keyID)} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
322 |
); |
57485 | 323 |
|
55336
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
324 |
ByteBuffer out; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
325 |
out = ByteBuffer.allocate(data.remaining() - GCM_TAG_LEN / 8); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
326 |
c.doFinal(data, out); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
327 |
out.flip(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
328 |
return out; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
329 |
} catch (Exception e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
330 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
331 |
SSLLogger.fine("Decryption failed." + e.getMessage()); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
332 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
333 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
334 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
335 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
336 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
337 |
byte[] getEncoded() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
338 |
byte[] out = new byte[data.capacity()]; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
339 |
data.duplicate().get(out); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
340 |
return out; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
341 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
342 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
343 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
344 |
public String toString() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
345 |
if (data == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
346 |
return "<null>"; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
347 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
348 |
if (data.capacity() == 0) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
349 |
return "<empty>"; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
350 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
351 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
352 |
MessageFormat messageFormat = new MessageFormat( |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
353 |
" \"ticket\" : '{'\n" + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
354 |
"{0}\n" + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
355 |
" '}'", |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
356 |
Locale.ENGLISH); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
357 |
HexDumpEncoder hexEncoder = new HexDumpEncoder(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
358 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
359 |
Object[] messageFields = { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
360 |
Utilities.indent(hexEncoder.encode(data.duplicate()), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
361 |
" "), |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
362 |
}; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
363 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
364 |
return messageFormat.format(messageFields); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
365 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
366 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
367 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
368 |
static final class SessionTicketStringizer implements SSLStringizer { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
369 |
SessionTicketStringizer() {} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
370 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
371 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
372 |
public String toString(ByteBuffer buffer) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
373 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
374 |
return new SessionTicketSpec(buffer).toString(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
375 |
} catch (IOException e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
376 |
return e.getMessage(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
377 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
378 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
379 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
380 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
381 |
private static final class T12CHSessionTicketProducer |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
382 |
extends SupportedGroups implements HandshakeProducer { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
383 |
T12CHSessionTicketProducer() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
384 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
385 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
386 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
387 |
public byte[] produce(ConnectionContext context, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
388 |
HandshakeMessage message) throws IOException { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
389 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
390 |
ClientHandshakeContext chc = (ClientHandshakeContext)context; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
391 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
392 |
// If the context does not allow stateless tickets, exit |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
393 |
if (!((SSLSessionContextImpl)chc.sslContext. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
394 |
engineGetClientSessionContext()).statelessEnabled()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
395 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
396 |
SSLLogger.fine("Stateless resumption not supported"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
397 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
398 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
399 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
400 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
401 |
chc.statelessResumption = true; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
402 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
403 |
// If resumption is not in progress, return an empty value |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
404 |
if (!chc.isResumption || chc.resumingSession == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
405 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
406 |
SSLLogger.fine("Stateless resumption supported"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
407 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
408 |
return new SessionTicketSpec().getEncoded(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
409 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
410 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
411 |
if (chc.localSupportedSignAlgs == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
412 |
chc.localSupportedSignAlgs = |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
413 |
SignatureScheme.getSupportedAlgorithms( |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
414 |
chc.algorithmConstraints, chc.activeProtocols); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
415 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
416 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
417 |
return chc.resumingSession.getPskIdentity(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
418 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
419 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
420 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
421 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
422 |
private static final class T12CHSessionTicketConsumer |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
423 |
implements ExtensionConsumer { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
424 |
T12CHSessionTicketConsumer() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
425 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
426 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
427 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
428 |
public void consume(ConnectionContext context, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
429 |
HandshakeMessage message, ByteBuffer buffer) |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
430 |
throws IOException { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
431 |
ServerHandshakeContext shc = (ServerHandshakeContext) context; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
432 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
433 |
// Skip if extension is not provided |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
434 |
if (!shc.sslConfig.isAvailable(CH_SESSION_TICKET)) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
435 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
436 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
437 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
438 |
// Skip consumption if we are already in stateless resumption |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
439 |
if (shc.statelessResumption) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
440 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
441 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
442 |
// If the context does not allow stateless tickets, exit |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
443 |
SSLSessionContextImpl cache = (SSLSessionContextImpl)shc.sslContext |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
444 |
.engineGetServerSessionContext(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
445 |
if (!cache.statelessEnabled()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
446 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
447 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
448 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
449 |
if (buffer.remaining() == 0) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
450 |
shc.statelessResumption = true; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
451 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
452 |
SSLLogger.fine("Client accepts session tickets."); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
453 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
454 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
455 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
456 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
457 |
// Parse the extension. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
458 |
SessionTicketSpec spec; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
459 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
460 |
spec = new SessionTicketSpec(buffer); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
461 |
} catch (IOException | RuntimeException e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
462 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
463 |
SSLLogger.fine("SessionTicket data invalid. Doing full " + |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
464 |
"handshake."); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
465 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
466 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
467 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
468 |
ByteBuffer b = spec.decrypt(shc); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
469 |
if (b != null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
470 |
shc.resumingSession = new SSLSessionImpl(shc, b); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
471 |
shc.isResumption = true; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
472 |
shc.statelessResumption = true; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
473 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
474 |
SSLLogger.fine("Valid stateless session ticket found"); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
475 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
476 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
477 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
478 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
479 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
480 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
481 |
private static final class T12SHSessionTicketProducer |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
482 |
extends SupportedGroups implements HandshakeProducer { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
483 |
T12SHSessionTicketProducer() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
484 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
485 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
486 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
487 |
public byte[] produce(ConnectionContext context, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
488 |
HandshakeMessage message) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
489 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
490 |
ServerHandshakeContext shc = (ServerHandshakeContext)context; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
491 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
492 |
// If boolean is false, the CH did not have this extension |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
493 |
if (!shc.statelessResumption) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
494 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
495 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
496 |
// If the client has sent a SessionTicketExtension and stateless |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
497 |
// is enabled on the server, return an empty message. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
498 |
// If the context does not allow stateless tickets, exit |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
499 |
SSLSessionContextImpl cache = (SSLSessionContextImpl)shc.sslContext |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
500 |
.engineGetServerSessionContext(); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
501 |
if (cache.statelessEnabled()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
502 |
return new byte[0]; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
503 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
504 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
505 |
shc.statelessResumption = false; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
506 |
return null; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
507 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
508 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
509 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
510 |
private static final class T12SHSessionTicketConsumer |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
511 |
implements ExtensionConsumer { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
512 |
T12SHSessionTicketConsumer() { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
513 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
514 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
515 |
@Override |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
516 |
public void consume(ConnectionContext context, |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
517 |
HandshakeMessage message, ByteBuffer buffer) |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
518 |
throws IOException { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
519 |
ClientHandshakeContext chc = (ClientHandshakeContext) context; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
520 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
521 |
// Skip if extension is not provided |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
522 |
if (!chc.sslConfig.isAvailable(SH_SESSION_TICKET)) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
523 |
chc.statelessResumption = false; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
524 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
525 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
526 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
527 |
// If the context does not allow stateless tickets, exit |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
528 |
if (!((SSLSessionContextImpl)chc.sslContext. |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
529 |
engineGetClientSessionContext()).statelessEnabled()) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
530 |
chc.statelessResumption = false; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
531 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
532 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
533 |
|
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
534 |
try { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
535 |
if (new SessionTicketSpec(buffer) == null) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
536 |
return; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
537 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
538 |
chc.statelessResumption = true; |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
539 |
} catch (IOException e) { |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
540 |
throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, e); |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
541 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
542 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
543 |
} |
c2398053ee90
8211018: Session Resumption without Server-Side State
ascarpino
parents:
diff
changeset
|
544 |
} |