Skip to content

Commit 282a93a

Browse files
Jamil Nimehslowhog
Jamil Nimeh
authored and
slowhog
committedJul 18, 2023
8300285: Enhance TLS data handling
Reviewed-by: ahgross, ascarpino, rhalade
1 parent af5bf81 commit 282a93a

File tree

3 files changed

+58
-25
lines changed

3 files changed

+58
-25
lines changed
 

‎src/java.base/share/conf/security/java.security

+2-1
Original file line numberDiff line numberDiff line change
@@ -912,7 +912,8 @@ jdk.tls.legacyAlgorithms=NULL, anon, RC4, DES, 3DES_EDE_CBC
912912
# Note: This property is currently used by OpenJDK's JSSE implementation. It
913913
# is not guaranteed to be examined and used by other implementations.
914914
#
915-
jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37
915+
jdk.tls.keyLimits=AES/GCM/NoPadding KeyUpdate 2^37, \
916+
ChaCha20-Poly1305 KeyUpdate 2^37
916917

917918
#
918919
# Cryptographic Jurisdiction Policy defaults

‎test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineKeyLimit.java

+24-10
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,25 @@
2323

2424
/*
2525
* @test
26-
* @bug 8164879
26+
* @bug 8164879 8300285
2727
* @library ../../
2828
* /test/lib
2929
* /javax/net/ssl/templates
30-
* @summary Verify AES/GCM's limits set in the jdk.tls.keyLimits property
30+
* @summary Verify AEAD TLS cipher suite limits set in the jdk.tls.keyLimits
31+
* property
3132
* start a new handshake sequence to renegotiate the symmetric key with an
3233
* SSLSocket connection. This test verifies the handshake method was called
3334
* via debugging info. It does not verify the renegotiation was successful
3435
* as that is very hard.
3536
*
36-
* @run main SSLEngineKeyLimit 0 server AES/GCM/NoPadding keyupdate 1050000
37-
* @run main SSLEngineKeyLimit 1 client AES/GCM/NoPadding keyupdate 2^22
37+
* @run main SSLEngineKeyLimit 0 server TLS_AES_256_GCM_SHA384
38+
* AES/GCM/NoPadding keyupdate 1050000
39+
* @run main SSLEngineKeyLimit 1 client TLS_AES_256_GCM_SHA384
40+
* AES/GCM/NoPadding keyupdate 2^22
41+
* @run main SSLEngineKeyLimit 0 server TLS_CHACHA20_POLY1305_SHA256
42+
* AES/GCM/NoPadding keyupdate 1050000, ChaCha20-Poly1305 KeyUpdate 1050000
43+
* @run main SSLEngineKeyLimit 1 client TLS_CHACHA20_POLY1305_SHA256
44+
* AES/GCM/NoPadding keyupdate 2^22, ChaCha20-Poly1305 KeyUpdate 2^22
3845
*/
3946

4047
/*
@@ -78,7 +85,7 @@ public class SSLEngineKeyLimit extends SSLContextTemplate {
7885
}
7986

8087
/**
81-
* args should have two values: server|client, <limit size>
88+
* args should have two values: server|client, cipher suite, <limit size>
8289
* Prepending 'p' is for internal use only.
8390
*/
8491
public static void main(String args[]) throws Exception {
@@ -97,7 +104,7 @@ public static void main(String args[]) throws Exception {
97104
File f = new File("keyusage."+ System.nanoTime());
98105
PrintWriter p = new PrintWriter(f);
99106
p.write("jdk.tls.keyLimits=");
100-
for (int i = 2; i < args.length; i++) {
107+
for (int i = 3; i < args.length; i++) {
101108
p.write(" "+ args[i]);
102109
}
103110
p.close();
@@ -112,10 +119,13 @@ public static void main(String args[]) throws Exception {
112119
System.getProperty("test.java.opts"));
113120

114121
ProcessBuilder pb = ProcessTools.createTestJvm(
115-
Utils.addTestJavaOpts("SSLEngineKeyLimit", "p", args[1]));
122+
Utils.addTestJavaOpts("SSLEngineKeyLimit", "p", args[1],
123+
args[2]));
116124

117125
OutputAnalyzer output = ProcessTools.executeProcess(pb);
118126
try {
127+
output.shouldContain(String.format(
128+
"\"cipher suite\" : \"%s", args[2]));
119129
if (expectedFail) {
120130
output.shouldNotContain("KeyUpdate: write key updated");
121131
output.shouldNotContain("KeyUpdate: read key updated");
@@ -156,9 +166,10 @@ public static void main(String args[]) throws Exception {
156166
cTos.clear();
157167
sToc.clear();
158168

159-
Thread ts = new Thread(serverwrite ? new Client() : new Server());
169+
Thread ts = new Thread(serverwrite ? new Client() :
170+
new Server(args[2]));
160171
ts.start();
161-
(serverwrite ? new Server() : new Client()).run();
172+
(serverwrite ? new Server(args[2]) : new Client()).run();
162173
ts.interrupt();
163174
ts.join();
164175
}
@@ -395,11 +406,14 @@ protected ContextParameters getServerContextParameters() {
395406
}
396407

397408
static class Server extends SSLEngineKeyLimit implements Runnable {
398-
Server() throws Exception {
409+
Server(String cipherSuite) throws Exception {
399410
super();
400411
eng = initContext().createSSLEngine();
401412
eng.setUseClientMode(false);
402413
eng.setNeedClientAuth(true);
414+
if (cipherSuite != null && cipherSuite.length() > 0) {
415+
eng.setEnabledCipherSuites(new String[] { cipherSuite });
416+
}
403417
}
404418

405419
public void run() {

‎test/jdk/sun/security/ssl/SSLSocketImpl/SSLSocketKeyLimit.java

+32-14
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,14 +23,24 @@
2323

2424
/*
2525
* @test
26-
* @bug 8164879
26+
* @bug 8164879 8300285
2727
* @library ../../
2828
* @library /test/lib
2929
* @modules java.base/sun.security.util
30-
* @summary Verify AES/GCM's limits set in the jdk.tls.keyLimits property
31-
* @run main SSLSocketKeyLimit 0 server AES/GCM/NoPadding keyupdate 1000000
32-
* @run main SSLSocketKeyLimit 0 client AES/GCM/NoPadding keyupdate 1000000
33-
* @run main SSLSocketKeyLimit 1 client AES/GCM/NoPadding keyupdate 2^22
30+
* @summary Verify AEAD TLS cipher suite limits set in the jdk.tls.keyLimits
31+
* property
32+
* @run main SSLSocketKeyLimit 0 server TLS_AES_256_GCM_SHA384
33+
* AES/GCM/NoPadding keyupdate 1000000
34+
* @run main SSLSocketKeyLimit 0 client TLS_AES_256_GCM_SHA384
35+
* AES/GCM/NoPadding keyupdate 1000000
36+
* @run main SSLSocketKeyLimit 1 client TLS_AES_256_GCM_SHA384
37+
* AES/GCM/NoPadding keyupdate 2^22
38+
* @run main SSLSocketKeyLimit 0 server TLS_CHACHA20_POLY1305_SHA256
39+
* AES/GCM/NoPadding keyupdate 1000000, ChaCha20-Poly1305 KeyUpdate 1000000
40+
* @run main SSLSocketKeyLimit 0 client TLS_CHACHA20_POLY1305_SHA256
41+
* AES/GCM/NoPadding keyupdate 1000000, ChaCha20-Poly1305 KeyUpdate 1000000
42+
* @run main SSLSocketKeyLimit 1 client TLS_CHACHA20_POLY1305_SHA256
43+
* AES/GCM/NoPadding keyupdate 2^22, ChaCha20-Poly1305 KeyUpdate 2^22
3444
*/
3545

3646
/**
@@ -96,7 +106,7 @@ SSLContext initContext() throws Exception {
96106
}
97107

98108
/**
99-
* args should have two values: server|client, <limit size>
109+
* args should have three values: server|client, cipher suite, <limit size>
100110
* Prepending 'p' is for internal use only.
101111
*/
102112
public static void main(String args[]) throws Exception {
@@ -110,7 +120,7 @@ public static void main(String args[]) throws Exception {
110120
File f = new File("keyusage."+ System.nanoTime());
111121
PrintWriter p = new PrintWriter(f);
112122
p.write("jdk.tls.keyLimits=");
113-
for (int i = 2; i < args.length; i++) {
123+
for (int i = 3; i < args.length; i++) {
114124
p.write(" "+ args[i]);
115125
}
116126
p.close();
@@ -125,10 +135,13 @@ public static void main(String args[]) throws Exception {
125135
System.getProperty("test.java.opts"));
126136

127137
ProcessBuilder pb = ProcessTools.createTestJvm(
128-
Utils.addTestJavaOpts("SSLSocketKeyLimit", "p", args[1]));
138+
Utils.addTestJavaOpts("SSLSocketKeyLimit", "p", args[1],
139+
args[2]));
129140

130141
OutputAnalyzer output = ProcessTools.executeProcess(pb);
131142
try {
143+
output.shouldContain(String.format(
144+
"\"cipher suite\" : \"%s", args[2]));
132145
if (expectedFail) {
133146
output.shouldNotContain("KeyUpdate: write key updated");
134147
output.shouldNotContain("KeyUpdate: read key updated");
@@ -150,7 +163,7 @@ public static void main(String args[]) throws Exception {
150163
return;
151164
}
152165

153-
if (args.length > 0 && args[0].compareToIgnoreCase("client") == 0) {
166+
if (args.length > 0 && args[1].compareToIgnoreCase("client") == 0) {
154167
serverwrite = false;
155168
}
156169

@@ -162,7 +175,7 @@ public static void main(String args[]) throws Exception {
162175
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
163176

164177
Arrays.fill(data, (byte)0x0A);
165-
Thread ts = new Thread(new Server());
178+
Thread ts = new Thread(new Server(args[2]));
166179

167180
ts.start();
168181
while (!serverReady) {
@@ -200,7 +213,8 @@ void read(SSLSocket s) throws Exception {
200213
int len;
201214
byte i = 0;
202215
try {
203-
System.out.println("Server: connected " + s.getSession().getCipherSuite());
216+
System.out.println("Server: connected " +
217+
s.getSession().getCipherSuite());
204218
in = s.getInputStream();
205219
out = s.getOutputStream();
206220
while (true) {
@@ -212,7 +226,8 @@ void read(SSLSocket s) throws Exception {
212226
if (b == 0x0A || b == 0x0D) {
213227
continue;
214228
}
215-
System.out.println("\nData invalid: " + HexPrinter.minimal().toString(buf));
229+
System.out.println("\nData invalid: " +
230+
HexPrinter.minimal().toString(buf));
216231
break;
217232
}
218233

@@ -237,11 +252,14 @@ void read(SSLSocket s) throws Exception {
237252
static class Server extends SSLSocketKeyLimit implements Runnable {
238253
private SSLServerSocketFactory ssf;
239254
private SSLServerSocket ss;
240-
Server() {
255+
Server(String cipherSuite) {
241256
super();
242257
try {
243258
ssf = initContext().getServerSocketFactory();
244259
ss = (SSLServerSocket) ssf.createServerSocket(serverPort);
260+
if (cipherSuite != null && cipherSuite.length() > 0) {
261+
ss.setEnabledCipherSuites(new String[] { cipherSuite });
262+
}
245263
serverPort = ss.getLocalPort();
246264
} catch (Exception e) {
247265
System.out.println("server: " + e.getMessage());

0 commit comments

Comments
 (0)
Please sign in to comment.