jdk-sandbox: comparison jdk/src/share/classes/sun/security/ssl/SSLSocketImpl.java

equal deleted inserted replaced

-:6cc48540fcd7
+:a6f4d1626ad9
 private InputRecord         inrec;
 /*
 * Crypto state that's reinitialized when the session changes.
 */
-private MAC                 readMAC, writeMAC;
+private Authenticator       readAuthenticator, writeAuthenticator;
 private CipherBox           readCipher, writeCipher;
 // NOTE: compression state would be saved here
 /*
 * security parameters for secure renegotiation.
 * default read and write side cipher and MAC support
 *
 * Note:  compression support would go here too
 */
 readCipher = CipherBox.NULL;
-readMAC = MAC.NULL;
+readAuthenticator = MAC.NULL;
 writeCipher = CipherBox.NULL;
-writeMAC = MAC.NULL;
+writeAuthenticator = MAC.NULL;
 // initial security parameters for secure renegotiation
 secureRenegotiation = false;
 clientVerifyData = new byte[0];
 serverVerifyData = new byte[0];
 private void writeRecordInternal(OutputRecord r,
 boolean holdRecord) throws IOException {
 // r.compress(c);
-r.addMAC(writeMAC);
+r.encrypt(writeAuthenticator, writeCipher);
-r.encrypt(writeCipher);
 if (holdRecord) {
 // If we were requested to delay the record due to possibility
 // of Nagle's being active when finally got to writing, and
 // it's actually not, we don't really need to delay it.
 * when there is enough sequence number space left to
 * handle a few more records, so the sequence number
 * of the last record cannot be wrapped.
 */
 if (connectionState < cs_ERROR) {
-checkSequenceNumber(writeMAC, r.contentType());
+checkSequenceNumber(writeAuthenticator, r.contentType());
 }
 // turn off the flag of the first application record
 if (isFirstAppOutputRecord &&
 r.contentType() == Record.ct_application_data) {
 * encryption for privacy, and an integrity check ensuring
 * data origin authentication.  We do them both here, and
 * throw a fatal alert if the integrity check fails.
 */
 try {
-r.decrypt(readMAC, readCipher);
+r.decrypt(readAuthenticator, readCipher);
 } catch (BadPaddingException e) {
 byte alertType = (r.contentType() == Record.ct_handshake)
 ? Alerts.alert_handshake_failure
 : Alerts.alert_bad_record_mac;
 fatal(alertType, e.getMessage(), e);
 * when there is enough sequence number space left to
 * handle a few more records, so the sequence number
 * of the last record cannot be wrapped.
 */
 if (connectionState < cs_ERROR) {
-checkSequenceNumber(readMAC, r.contentType());
+checkSequenceNumber(readAuthenticator, r.contentType());
 }
 return;
 } // synchronized (this)
 }
 * RFC 4346 states that, "Sequence numbers are of type uint64 and
 * may not exceed 2^64-1.  Sequence numbers do not wrap. If a TLS
 * implementation would need to wrap a sequence number, it must
 * renegotiate instead."
 */
-private void checkSequenceNumber(MAC mac, byte type)
+private void checkSequenceNumber(Authenticator authenticator, byte type)
 throws IOException {
 /*
 * Don't bother to check the sequence number for error or
 * closed connections, or NULL MAC.
 */
-if (connectionState >= cs_ERROR || mac == MAC.NULL) {
+if (connectionState >= cs_ERROR || authenticator == MAC.NULL) {
 return;
 }
 /*
 * Conservatively, close the connection immediately when the
 * sequence number is close to overflow
 */
-if (mac.seqNumOverflow()) {
+if (authenticator.seqNumOverflow()) {
 /*
 * TLS protocols do not define a error alert for sequence
 * number overflow. We use handshake_failure error alert
 * for handshaking and bad_record_mac for other records.
 */
 * Ask for renegotiation when need to renew sequence number.
 *
 * Don't bother to kickstart the renegotiation when the local is
 * asking for it.
 */
-if ((type != Record.ct_handshake) && mac.seqNumIsHuge()) {
+if ((type != Record.ct_handshake) && authenticator.seqNumIsHuge()) {
 if (debug != null && Debug.isOn("ssl")) {
 System.out.println(Thread.currentThread().getName() +
 ", request renegotiation " +
 "to avoid sequence number overflow");
 }
 CipherBox oldCipher = readCipher;
 try {
 readCipher = handshaker.newReadCipher();
-readMAC = handshaker.newReadMAC();
+readAuthenticator = handshaker.newReadAuthenticator();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }
 CipherBox oldCipher = writeCipher;
 try {
 writeCipher = handshaker.newWriteCipher();
-writeMAC = handshaker.newWriteMAC();
+writeAuthenticator = handshaker.newWriteAuthenticator();
 } catch (GeneralSecurityException e) {
 // "can't happen"
 throw new SSLException("Algorithm missing:  ", e);
 }

changeset 16913	a6f4d1626ad9
parent 16126	aad71cf676d7
child 19223	e27cda06fe6a