Skip to content

Commit 1901735

Browse files
wangweijwangweij
committedJun 21, 2022
8288209: SSL debug message wrong about unsupported authentication scheme
Reviewed-by: djelinski, jnimeh
·
jdk-21+2121-genzgc+1-8
1 parent 0f801fe commit 1901735

File tree

5 files changed

+49
-97
lines changed

5 files changed

+49
-97
lines changed
 

‎src/java.base/share/classes/sun/security/ssl/CertificateMessage.java

+15-39
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2015, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -1042,46 +1042,22 @@ private static SSLPossession choosePossession(
10421042
return null;
10431043
}
10441044

1045-
Collection<String> checkedKeyTypes = new HashSet<>();
1046-
List<String> supportedKeyTypes = new ArrayList<>();
1047-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
1048-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
1049-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1050-
SSLLogger.warning(
1051-
"Unsupported authentication scheme: " + ss.name);
1052-
}
1053-
continue;
1054-
}
1055-
checkedKeyTypes.add(ss.keyAlgorithm);
1056-
1057-
// Don't select a signature scheme unless we will be able to
1058-
// produce a CertificateVerify message later
1059-
if (SignatureScheme.getPreferableAlgorithm(
1060-
hc.algorithmConstraints,
1061-
hc.peerRequestedSignatureSchemes,
1062-
ss, hc.negotiatedProtocol) == null) {
1063-
1064-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1065-
SSLLogger.warning(
1066-
"Unable to produce CertificateVerify for " +
1067-
"signature scheme: " + ss.name);
1068-
}
1069-
continue;
1070-
}
1071-
1072-
X509Authentication ka = X509Authentication.valueOf(ss);
1073-
if (ka == null) {
1074-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
1075-
SSLLogger.warning(
1076-
"Unsupported authentication scheme: " + ss.name);
1077-
}
1078-
continue;
1079-
}
1080-
supportedKeyTypes.add(ss.keyAlgorithm);
1081-
}
1045+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
1046+
.stream()
1047+
.map(ss -> ss.keyAlgorithm)
1048+
.distinct()
1049+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
1050+
hc.algorithmConstraints, // we will be able to produce
1051+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
1052+
ka, hc.negotiatedProtocol) != null
1053+
|| SSLLogger.logWarning("ssl,handshake",
1054+
"Unable to produce CertificateVerify for key algorithm: " + ka))
1055+
.filter(ka -> X509Authentication.valueOfKeyAlgorithm(ka) != null
1056+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka))
1057+
.toArray(String[]::new);
10821058

10831059
SSLPossession pos = X509Authentication
1084-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
1060+
.createPossession(hc, supportedKeyTypes);
10851061
if (pos == null) {
10861062
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
10871063
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/CertificateRequest.java

+20-53
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,7 @@
3232
import java.text.MessageFormat;
3333
import java.util.ArrayList;
3434
import java.util.Arrays;
35-
import java.util.Collection;
3635
import java.util.Collections;
37-
import java.util.HashSet;
3836
import java.util.LinkedList;
3937
import java.util.List;
4038
import java.util.Locale;
@@ -760,59 +758,28 @@ private static SSLPossession choosePossession(HandshakeContext hc,
760758
crKeyTypes.add("RSASSA-PSS");
761759
}
762760

763-
Collection<String> checkedKeyTypes = new HashSet<>();
764-
List<String> supportedKeyTypes = new ArrayList<>();
765-
for (SignatureScheme ss : hc.peerRequestedCertSignSchemes) {
766-
if (checkedKeyTypes.contains(ss.keyAlgorithm)) {
767-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
768-
SSLLogger.warning(
769-
"Unsupported authentication scheme: " + ss.name);
770-
}
771-
continue;
772-
}
773-
checkedKeyTypes.add(ss.keyAlgorithm);
774-
775-
// Don't select a signature scheme unless we will be able to
776-
// produce a CertificateVerify message later
777-
if (SignatureScheme.getPreferableAlgorithm(
778-
hc.algorithmConstraints,
779-
hc.peerRequestedSignatureSchemes,
780-
ss, hc.negotiatedProtocol) == null) {
781-
782-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
783-
SSLLogger.warning(
784-
"Unable to produce CertificateVerify for " +
785-
"signature scheme: " + ss.name);
786-
}
787-
continue;
788-
}
789-
790-
X509Authentication ka = X509Authentication.valueOf(ss);
791-
if (ka == null) {
792-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
793-
SSLLogger.warning(
794-
"Unsupported authentication scheme: " + ss.name);
795-
}
796-
continue;
797-
} else {
798-
// Any auth object will have a set of allowed key types.
799-
// This set should share at least one common algorithm with
800-
// the CR's allowed key types.
801-
if (Collections.disjoint(crKeyTypes,
802-
Arrays.asList(ka.keyTypes))) {
803-
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
804-
SSLLogger.warning(
805-
"Unsupported authentication scheme: " +
806-
ss.name);
807-
}
808-
continue;
809-
}
810-
}
811-
supportedKeyTypes.add(ss.keyAlgorithm);
812-
}
761+
String[] supportedKeyTypes = hc.peerRequestedCertSignSchemes
762+
.stream()
763+
.map(ss -> ss.keyAlgorithm)
764+
.distinct()
765+
.filter(ka -> SignatureScheme.getPreferableAlgorithm( // Don't select a signature scheme unless
766+
hc.algorithmConstraints, // we will be able to produce
767+
hc.peerRequestedSignatureSchemes, // a CertificateVerify message later
768+
ka, hc.negotiatedProtocol) != null
769+
|| SSLLogger.logWarning("ssl,handshake",
770+
"Unable to produce CertificateVerify for key algorithm: " + ka))
771+
.filter(ka -> {
772+
var xa = X509Authentication.valueOfKeyAlgorithm(ka);
773+
// Any auth object will have a set of allowed key types.
774+
// This set should share at least one common algorithm with
775+
// the CR's allowed key types.
776+
return xa != null && !Collections.disjoint(crKeyTypes, Arrays.asList(xa.keyTypes))
777+
|| SSLLogger.logWarning("ssl,handshake", "Unsupported key algorithm: " + ka);
778+
})
779+
.toArray(String[]::new);
813780

814781
SSLPossession pos = X509Authentication
815-
.createPossession(hc, supportedKeyTypes.toArray(String[]::new));
782+
.createPossession(hc, supportedKeyTypes);
816783
if (pos == null) {
817784
if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {
818785
SSLLogger.warning("No available authentication scheme");

‎src/java.base/share/classes/sun/security/ssl/SSLLogger.java

+9
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,15 @@ static String toString(Object... params) {
207207
}
208208
}
209209

210+
// Logs a warning message and always returns false. This method
211+
// can be used as an OR Predicate to add a log in a stream filter.
212+
public static boolean logWarning(String option, String s) {
213+
if (SSLLogger.isOn && SSLLogger.isOn(option)) {
214+
SSLLogger.warning(s);
215+
}
216+
return false;
217+
}
218+
210219
private static class SSLConsoleLogger implements Logger {
211220
private final String loggerName;
212221
private final boolean useCompactFormat;

‎src/java.base/share/classes/sun/security/ssl/SignatureScheme.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -450,13 +450,13 @@ static List<SignatureScheme> getSupportedAlgorithms(
450450
static SignatureScheme getPreferableAlgorithm(
451451
AlgorithmConstraints constraints,
452452
List<SignatureScheme> schemes,
453-
SignatureScheme certScheme,
453+
String keyAlgorithm,
454454
ProtocolVersion version) {
455455

456456
for (SignatureScheme ss : schemes) {
457457
if (ss.isAvailable &&
458458
ss.handshakeSupportedProtocols.contains(version) &&
459-
certScheme.keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
459+
keyAlgorithm.equalsIgnoreCase(ss.keyAlgorithm) &&
460460
ss.isPermitted(constraints)) {
461461
return ss;
462462
}

‎src/java.base/share/classes/sun/security/ssl/X509Authentication.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -72,9 +72,9 @@ private X509Authentication(String keyAlgorithm,
7272
this.keyTypes = keyTypes;
7373
}
7474

75-
static X509Authentication valueOf(SignatureScheme signatureScheme) {
75+
static X509Authentication valueOfKeyAlgorithm(String keyAlgorithm) {
7676
for (X509Authentication au : X509Authentication.values()) {
77-
if (au.keyAlgorithm.equals(signatureScheme.keyAlgorithm)) {
77+
if (au.keyAlgorithm.equals(keyAlgorithm)) {
7878
return au;
7979
}
8080
}

0 commit comments

Comments
 (0)
Please sign in to comment.