jdk-sandbox: comparison jdk/src/share/classes/sun/security/ssl/SSLSocketImpl.java

equal deleted inserted replaced

-:b9fb0d9c58ec
+:36055e4b5305
 private InputRecord         inrec;
 /*
 * Crypto state that's reinitialized when the session changes.
 */
-private Authenticator       readAuthenticator, writeAuthenticator;
+private MAC                 readMAC, writeMAC;
 private CipherBox           readCipher, writeCipher;
 // NOTE: compression state would be saved here
 /*
 * security parameters for secure renegotiation.
 * default read and write side cipher and MAC support
 *
 * Note:  compression support would go here too
 */
 readCipher = CipherBox.NULL;
-readAuthenticator = MAC.NULL;
+readMAC = MAC.NULL;
 writeCipher = CipherBox.NULL;
-writeAuthenticator = MAC.NULL;
+writeMAC = MAC.NULL;
 // initial security parameters for secure renegotiation
 secureRenegotiation = false;
 clientVerifyData = new byte[0];
 serverVerifyData = new byte[0];
 private void writeRecordInternal(OutputRecord r,
 boolean holdRecord) throws IOException {
 // r.compress(c);
-r.encrypt(writeAuthenticator, writeCipher);
+r.addMAC(writeMAC);
+r.encrypt(writeCipher);
 if (holdRecord) {
 // If we were requested to delay the record due to possibility
 // of Nagle's being active when finally got to writing, and
 // it's actually not, we don't really need to delay it.
 * when there is enough sequence number space left to
 * handle a few more records, so the sequence number
 * of the last record cannot be wrapped.
 */
 if (connectionState < cs_ERROR) {
-checkSequenceNumber(writeAuthenticator, r.contentType());
+checkSequenceNumber(writeMAC, r.contentType());
 }
 // turn off the flag of the first application record
 if (isFirstAppOutputRecord &&
 r.contentType() == Record.ct_application_data) {
 * encryption for privacy, and an integrity check ensuring
 * data origin authentication.  We do them both here, and
 * throw a fatal alert if the integrity check fails.
 */
 try {
-r.decrypt(readAuthenticator, readCipher);
+r.decrypt(readCipher);
 } catch (BadPaddingException e) {
+// RFC 2246 states that decryption_failed should be used
+// for this purpose. However, that allows certain attacks,
+// so we just send bad record MAC. We also need to make
+// sure to always check the MAC to avoid a timing attack
+// for the same issue. See paper by Vaudenay et al.
+r.checkMAC(readMAC);
 // use the same alert types as for MAC failure below
 byte alertType = (r.contentType() == Record.ct_handshake)
 ? Alerts.alert_handshake_failure
 : Alerts.alert_bad_record_mac;
-fatal(alertType, e.getMessage(), e);
+fatal(alertType, "Invalid padding", e);
 }
+if (!r.checkMAC(readMAC)) {
+if (r.contentType() == Record.ct_handshake) {
+fatal(Alerts.alert_handshake_failure,
+"bad handshake record MAC");
+} else {
+fatal(Alerts.alert_bad_record_mac, "bad record MAC");
+}
+}
 // if (!r.decompress(c))
 //     fatal(Alerts.alert_decompression_failure,
 //         "decompression failure");
 * when there is enough sequence number space left to
 * handle a few more records, so the sequence number
 * of the last record cannot be wrapped.
 */
 if (connectionState < cs_ERROR) {
-checkSequenceNumber(readAuthenticator, r.contentType());
+checkSequenceNumber(readMAC, r.contentType());
 }
 return;
 } // synchronized (this)
 }
 * RFC 4346 states that, "Sequence numbers are of type uint64 and
 * may not exceed 2^64-1.  Sequence numbers do not wrap. If a TLS
 * implementation would need to wrap a sequence number, it must
 * renegotiate instead."
 */
-private void checkSequenceNumber(Authenticator authenticator, byte type)
+private void checkSequenceNumber(MAC mac, byte type)
 throws IOException {
 /*
 * Don't bother to check the sequence number for error or
 * closed connections, or NULL MAC.
 */
-if (connectionState >= cs_ERROR || authenticator == MAC.NULL) {
+if (connectionState >= cs_ERROR || mac == MAC.NULL) {
 return;
 }
 /*
 * Conservatively, close the connection immediately when the
 * sequence number is close to overflow
 */
-if (authenticator.seqNumOverflow()) {
+if (mac.seqNumOverflow()) {
 /*
 * TLS protocols do not define a error alert for sequence
 * number overflow. We use handshake_failure error alert
 * for handshaking and bad_record_mac for other records.
 */
 * Ask for renegotiation when need to renew sequence number.
 *
 * Don't bother to kickstart the renegotiation when the local is
 * asking for it.
 */
-if ((type != Record.ct_handshake) && authenticator.seqNumIsHuge()) {
+if ((type != Record.ct_handshake) && mac.seqNumIsHuge()) {
 if (debug != null && Debug.isOn("ssl")) {
 System.out.println(Thread.currentThread().getName() +
 ", request renegotiation " +
 "to avoid sequence number overflow");
 }
 CipherBox oldCipher = readCipher;
 try {
 readCipher = handshaker.newReadCipher();
-readAuthenticator = handshaker.newReadAuthenticator();
+readMAC = handshaker.newReadMAC();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }
 CipherBox oldCipher = writeCipher;
 try {
 writeCipher = handshaker.newWriteCipher();
-writeAuthenticator = handshaker.newWriteAuthenticator();
+writeMAC = handshaker.newWriteMAC();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }

changeset 16067	36055e4b5305
parent 16045	9d08c3b9a6a0
child 16126	aad71cf676d7