jdk-sandbox: comparison jdk/src/java.base/share/classes/sun/security/ssl/ServerHandshaker.java

equal deleted inserted replaced

-:ec0224270f90
+:bba6fefdd660
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
 import javax.net.ssl.*;
-import javax.security.auth.Subject;
 import sun.security.util.KeyUtil;
 import sun.security.action.GetPropertyAction;
 import sun.security.ssl.HandshakeMessage.*;
 import sun.security.ssl.CipherSuite.*;
 import sun.security.ssl.SignatureAndHashAlgorithm.*;
 protocolVersion, clientRequestedVersion,
 sslContext.getSecureRandom(), input,
 message_len, privateKey);
 handshakeState.update(pms, resumingSession);
 preMasterSecret = this.clientKeyExchange(pms);
-break;
-case K_KRB5:
-case K_KRB5_EXPORT:
-KerberosClientKeyExchange kke =
-new KerberosClientKeyExchange(protocolVersion,
-clientRequestedVersion,
-sslContext.getSecureRandom(),
-input,
-this.getAccSE(),
-serviceCreds);
-handshakeState.update(kke, resumingSession);
-preMasterSecret = this.clientKeyExchange(kke);
 break;
 case K_DHE_RSA:
 case K_DHE_DSS:
 case K_DH_ANON:
 /*
 new ECDHClientKeyExchange(input);
 handshakeState.update(ecdhcke, resumingSession);
 preMasterSecret = this.clientKeyExchange(ecdhcke);
 break;
 default:
-throw new SSLProtocolException
+ClientKeyExchangeService p =
-("Unrecognized key exchange: " + keyExchange);
+ClientKeyExchangeService.find(keyExchange.name);
+if (p == null) {
+throw new SSLProtocolException
+("Unrecognized key exchange: " + keyExchange);
+}
+byte[] encodedTicket = input.getBytes16();
+input.getBytes16();
+byte[] secret = input.getBytes16();
+ClientKeyExchange cke = p.createServerExchange(protocolVersion,
+clientRequestedVersion,
+sslContext.getSecureRandom(),
+encodedTicket,
+secret,
+this.getAccSE(), serviceCreds);
+handshakeState.update(cke, resumingSession);
+preMasterSecret = this.clientKeyExchange(cke);
+break;
 }
 //
 // All keys are calculated from the premaster secret
 // and the exchanged nonces in the same way.
 }
 // validate subject identity
 if (resumingSession) {
 CipherSuite suite = previous.getSuite();
-if (suite.keyExchange == K_KRB5 ||
+ClientKeyExchangeService p =
-suite.keyExchange == K_KRB5_EXPORT) {
+ClientKeyExchangeService.find(suite.keyExchange.name);
+if (p != null) {
 Principal localPrincipal = previous.getLocalPrincipal();
-Subject subject = null;
+if (p.isRelated(
-try {
+false, getAccSE(), localPrincipal)) {
-subject = AccessController.doPrivileged(
+if (debug != null && Debug.isOn("session"))
-new PrivilegedExceptionAction<Subject>() {
+System.out.println("Subject can" +
-@Override
+" provide creds for princ");
-public Subject run() throws Exception {
-return
-Krb5Helper.getServerSubject(getAccSE());
-}});
-} catch (PrivilegedActionException e) {
-subject = null;
-if (debug != null && Debug.isOn("session")) {
-System.out.println("Attempt to obtain" +
-" subject failed!");
-}
-}
-if (subject != null) {
-// Eliminate dependency on KerberosPrincipal
-if (Krb5Helper.isRelated(subject, localPrincipal)) {
-if (debug != null && Debug.isOn("session"))
-System.out.println("Subject can" +
-" provide creds for princ");
-} else {
-resumingSession = false;
-if (debug != null && Debug.isOn("session"))
-System.out.println("Subject cannot" +
-" provide creds for princ");
-}
 } else {
 resumingSession = false;
 if (debug != null && Debug.isOn("session"))
-System.out.println("Kerberos credentials are" +
+System.out.println("Subject cannot" +
-" not present in the current Subject;" +
+" provide creds for princ");
-" check if " +
-" javax.security.auth.useSubjectAsCreds" +
-" system property has been set to false");
 }
 }
 }
 if (resumingSession) {
 * NOTE:  while an "anonymous RSA" mode is explicitly allowed by
 * the protocol, we can't support it since all of the SSL flavors
 * defined in the protocol spec are explicitly stated to require
 * using RSA certificates.
 */
-if (keyExchange == K_KRB5 || keyExchange == K_KRB5_EXPORT) {
+if (ClientKeyExchangeService.find(cipherSuite.keyExchange.name) != null) {
-// Server certificates are omitted for Kerberos ciphers
+// No external key exchange provider needs a cert now.
 } else if ((keyExchange != K_DH_ANON) && (keyExchange != K_ECDH_ANON)) {
 if (certs == null) {
 throw new RuntimeException("no certificates");
 }
 */
 ServerKeyExchange m3;
 switch (keyExchange) {
 case K_RSA:
-case K_KRB5:
+// no server key exchange for RSA ciphersuites
-case K_KRB5_EXPORT:
-// no server key exchange for RSA or KRB5 ciphersuites
 m3 = null;
 break;
 case K_RSA_EXPORT:
 if (JsseJce.getRSAKeyLength(certs[0].getPublicKey()) > 512) {
 try {
 case K_ECDH_ECDSA:
 // ServerKeyExchange not used for fixed ECDH
 m3 = null;
 break;
 default:
+ClientKeyExchangeService p =
+ClientKeyExchangeService.find(keyExchange.name);
+if (p != null) {
+// No external key exchange provider needs a cert now.
+m3 = null;
+break;
+}
 throw new RuntimeException("internal error: " + keyExchange);
 }
 if (m3 != null) {
 if (debug != null && Debug.isOn("handshake")) {
 m3.print(System.out);
 // algorithms.
 //
 // Needed only if server requires client to authenticate self.
 // Illegal for anonymous flavors, so we need to check that.
 //
-// CertificateRequest is omitted for Kerberos ciphers
+// No external key exchange provider needs a cert now.
 if (doClientAuth != ClientAuthType.CLIENT_AUTH_NONE &&
 keyExchange != K_DH_ANON && keyExchange != K_ECDH_ANON &&
-keyExchange != K_KRB5 && keyExchange != K_KRB5_EXPORT) {
+ClientKeyExchangeService.find(keyExchange.name) == null) {
 CertificateRequest m4;
 X509Certificate caCerts[];
 Collection<SignatureAndHashAlgorithm> localSignAlgs = null;
 if (setupPrivateKeyAndChain("EC_EC") == false) {
 return false;
 }
 setupStaticECDHKeys();
 break;
-case K_KRB5:
-case K_KRB5_EXPORT:
-// need Kerberos Key
-if (!setupKerberosKeys()) {
-return false;
-}
-break;
 case K_DH_ANON:
 // no certs needed for anonymous
 setupEphemeralDHKeys(suite.exportable, null);
 break;
 case K_ECDH_ANON:
 if (setupEphemeralECDHKeys() == false) {
 return false;
 }
 break;
 default:
-// internal error, unknown key exchange
+ClientKeyExchangeService p =
-throw new RuntimeException("Unrecognized cipherSuite: " + suite);
+ClientKeyExchangeService.find(keyExchange.name);
+if (p == null) {
+// internal error, unknown key exchange
+throw new RuntimeException("Unrecognized cipherSuite: " + suite);
+}
+// need service creds
+if (serviceCreds == null) {
+AccessControlContext acc = getAccSE();
+serviceCreds = p.getServiceCreds(acc);
+if (serviceCreds != null) {
+if (debug != null && Debug.isOn("handshake")) {
+System.out.println("Using serviceCreds");
+}
+}
+if (serviceCreds == null) {
+return false;
+}
+}
+break;
 }
 setCipherSuite(suite);
 // set the peer implicit supported signature algorithms
 if (protocolVersion.useTLS12PlusSpec()) {
 this.privateKey = tempPrivateKey;
 this.certs = tempCerts;
 return true;
 }
-/**
-* Retrieve the Kerberos key for the specified server principal
-* from the JAAS configuration file.
-*
-* @return true if successful, false if not available or invalid
-*/
-private boolean setupKerberosKeys() {
-if (serviceCreds != null) {
-return true;
-}
-try {
-final AccessControlContext acc = getAccSE();
-serviceCreds = AccessController.doPrivileged(
-// Eliminate dependency on KerberosKey
-new PrivilegedExceptionAction<Object>() {
-@Override
-public Object run() throws Exception {
-// get kerberos key for the default principal
-return Krb5Helper.getServiceCreds(acc);
-}});
-// check permission to access and use the secret key of the
-// Kerberized "host" service
-if (serviceCreds != null) {
-if (debug != null && Debug.isOn("handshake")) {
-System.out.println("Using Kerberos creds");
-}
-String serverPrincipal =
-Krb5Helper.getServerPrincipalName(serviceCreds);
-if (serverPrincipal != null) {
-// When service is bound, we check ASAP. Otherwise,
-// will check after client request is received
-// in Kerberos ClientKeyExchange
-SecurityManager sm = System.getSecurityManager();
-try {
-if (sm != null) {
-// Eliminate dependency on ServicePermission
-sm.checkPermission(Krb5Helper.getServicePermission(
-serverPrincipal, "accept"), acc);
-}
-} catch (SecurityException se) {
-serviceCreds = null;
-// Do not destroy keys. Will affect Subject
-if (debug != null && Debug.isOn("handshake")) {
-System.out.println("Permission to access Kerberos"
-+ " secret key denied");
-}
-return false;
-}
-}
-}
-return serviceCreds != null;
-} catch (PrivilegedActionException e) {
-// Likely exception here is LoginExceptin
-if (debug != null && Debug.isOn("handshake")) {
-System.out.println("Attempt to obtain Kerberos key failed: "
-+ e.toString());
-}
-return false;
-}
-}
 /*
-* For Kerberos ciphers, the premaster secret is encrypted using
+* Returns premaster secret for external key exchange services.
-* the session key. See RFC 2712.
+*/
-*/
+private SecretKey clientKeyExchange(ClientKeyExchange mesg)
-private SecretKey clientKeyExchange(KerberosClientKeyExchange mesg)
 throws IOException {
 if (debug != null && Debug.isOn("handshake")) {
 mesg.print(System.out);
 }
 // Record the principals involved in exchange
 session.setPeerPrincipal(mesg.getPeerPrincipal());
 session.setLocalPrincipal(mesg.getLocalPrincipal());
-byte[] b = mesg.getUnencryptedPreMasterSecret();
+return mesg.clientKeyExchange();
-return new SecretKeySpec(b, "TlsPremasterSecret");
 }
 /*
 * Diffie Hellman key exchange is used when the server presented
 * D-H parameters in its certificate (signed using RSA or DSS/DSA),
 * Verify if client did send the certificate when client
 * authentication was required, otherwise server should not proceed
 */
 if (doClientAuth == ClientAuthType.CLIENT_AUTH_REQUIRED) {
 // get X500Principal of the end-entity certificate for X509-based
-// ciphersuites, or Kerberos principal for Kerberos ciphersuites
+// ciphersuites, or Kerberos principal for Kerberos ciphersuites, etc
 session.getPeerPrincipal();
 }
 /*
 * Verify if client did send clientCertificateVerify message following

changeset 30905	bba6fefdd660
parent 30904	ec0224270f90
child 31538	0981099a3e54