jdk-sandbox: comparison jdk/src/share/classes/sun/security/ssl/SSLEngineImpl.java

equal deleted inserted replaced

-:b9fb0d9c58ec
+:36055e4b5305
 private ProtocolVersion     protocolVersion = ProtocolVersion.DEFAULT;
 /*
 * Crypto state that's reinitialized when the session changes.
 */
-private Authenticator       readAuthenticator, writeAuthenticator;
+private MAC                 readMAC, writeMAC;
 private CipherBox           readCipher, writeCipher;
 // NOTE: compression state would be saved here
 /*
 * security parameters for secure renegotiation.
 * default read and write side cipher and MAC support
 *
 * Note:  compression support would go here too
 */
 readCipher = CipherBox.NULL;
-readAuthenticator = MAC.NULL;
+readMAC = MAC.NULL;
 writeCipher = CipherBox.NULL;
-writeAuthenticator = MAC.NULL;
+writeMAC = MAC.NULL;
 // default security parameters for secure renegotiation
 secureRenegotiation = false;
 clientVerifyData = new byte[0];
 serverVerifyData = new byte[0];
 CipherBox oldCipher = readCipher;
 try {
 readCipher = handshaker.newReadCipher();
-readAuthenticator = handshaker.newReadAuthenticator();
+readMAC = handshaker.newReadMAC();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }
 CipherBox oldCipher = writeCipher;
 try {
 writeCipher = handshaker.newWriteCipher();
-writeAuthenticator = handshaker.newWriteAuthenticator();
+writeMAC = handshaker.newWriteMAC();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }
 * encryption for privacy, and an integrity check ensuring
 * data origin authentication.  We do them both here, and
 * throw a fatal alert if the integrity check fails.
 */
 try {
-decryptedBB = inputRecord.decrypt(
+decryptedBB = inputRecord.decrypt(readCipher, readBB);
-readAuthenticator, readCipher, readBB);
 } catch (BadPaddingException e) {
+// RFC 2246 states that decryption_failed should be used
+// for this purpose. However, that allows certain attacks,
+// so we just send bad record MAC. We also need to make
+// sure to always check the MAC to avoid a timing attack
+// for the same issue. See paper by Vaudenay et al.
+//
+// rewind the BB if necessary.
+readBB.rewind();
+inputRecord.checkMAC(readMAC, readBB);
 // use the same alert types as for MAC failure below
 byte alertType = (inputRecord.contentType() ==
 Record.ct_handshake) ?
 Alerts.alert_handshake_failure :
 Alerts.alert_bad_record_mac;
-fatal(alertType, e.getMessage(), e);
+fatal(alertType, "Invalid padding", e);
+}
+if (!inputRecord.checkMAC(readMAC, decryptedBB)) {
+if (inputRecord.contentType() == Record.ct_handshake) {
+fatal(Alerts.alert_handshake_failure,
+"bad handshake record MAC");
+} else {
+fatal(Alerts.alert_bad_record_mac, "bad record MAC");
+}
 }
 // if (!inputRecord.decompress(c))
 //     fatal(Alerts.alert_decompression_failure,
 //     "decompression failure");
 * of the last record cannot be wrapped.
 */
 hsStatus = getHSStatus(hsStatus);
 if (connectionState < cs_ERROR && !isInboundDone() &&
 (hsStatus == HandshakeStatus.NOT_HANDSHAKING)) {
-if (checkSequenceNumber(readAuthenticator,
+if (checkSequenceNumber(readMAC,
 inputRecord.contentType())) {
 hsStatus = getHSStatus(null);
 }
 }
 } // synchronized (this)
 private HandshakeStatus writeRecord(EngineOutputRecord eor,
 EngineArgs ea) throws IOException {
 // eventually compress as well.
 HandshakeStatus hsStatus =
-writer.writeRecord(eor, ea, writeAuthenticator, writeCipher);
+writer.writeRecord(eor, ea, writeMAC, writeCipher);
 /*
 * We only need to check the sequence number state for
 * non-handshaking record.
 *
 * of the last record cannot be wrapped.
 */
 hsStatus = getHSStatus(hsStatus);
 if (connectionState < cs_ERROR && !isOutboundDone() &&
 (hsStatus == HandshakeStatus.NOT_HANDSHAKING)) {
-if (checkSequenceNumber(writeAuthenticator, eor.contentType())) {
+if (checkSequenceNumber(writeMAC, eor.contentType())) {
 hsStatus = getHSStatus(null);
 }
 }
 /*
 /*
 * Non-application OutputRecords go through here.
 */
 void writeRecord(EngineOutputRecord eor) throws IOException {
 // eventually compress as well.
-writer.writeRecord(eor, writeAuthenticator, writeCipher);
+writer.writeRecord(eor, writeMAC, writeCipher);
 /*
 * Check the sequence number state
 *
 * Note that in order to maintain the connection I/O
 * when there is enough sequence number space left to
 * handle a few more records, so the sequence number
 * of the last record cannot be wrapped.
 */
 if ((connectionState < cs_ERROR) && !isOutboundDone()) {
-checkSequenceNumber(writeAuthenticator, eor.contentType());
+checkSequenceNumber(writeMAC, eor.contentType());
 }
 }
 //
 // Close code
 * implementation would need to wrap a sequence number, it must
 * renegotiate instead."
 *
 * Return true if the handshake status may be changed.
 */
-private boolean checkSequenceNumber(Authenticator authenticator, byte type)
+private boolean checkSequenceNumber(MAC mac, byte type)
 throws IOException {
 /*
 * Don't bother to check the sequence number for error or
 * closed connections, or NULL MAC
 */
-if (connectionState >= cs_ERROR || authenticator == MAC.NULL) {
+if (connectionState >= cs_ERROR || mac == MAC.NULL) {
 return false;
 }
 /*
 * Conservatively, close the connection immediately when the
 * sequence number is close to overflow
 */
-if (authenticator.seqNumOverflow()) {
+if (mac.seqNumOverflow()) {
 /*
 * TLS protocols do not define a error alert for sequence
 * number overflow. We use handshake_failure error alert
 * for handshaking and bad_record_mac for other records.
 */
 * Ask for renegotiation when need to renew sequence number.
 *
 * Don't bother to kickstart the renegotiation when the local is
 * asking for it.
 */
-if ((type != Record.ct_handshake) && authenticator.seqNumIsHuge()) {
+if ((type != Record.ct_handshake) && mac.seqNumIsHuge()) {
 if (debug != null && Debug.isOn("ssl")) {
 System.out.println(Thread.currentThread().getName() +
 ", request renegotiation " +
 "to avoid sequence number overflow");
 }

changeset 16067	36055e4b5305
parent 16045	9d08c3b9a6a0
child 16126	aad71cf676d7