Skip to content

Commit d668844

Browse files
author
Andrew Lu
committed
8298873: Update IllegalRecordVersion.java for changes to TLS implementation
8301189: validate-source fails after JDK-8298873 Backport-of: 28adafcb524a043eca0fc6e7f9a1bb2a5490d723
1 parent 95c0b97 commit d668844

File tree

3 files changed

+236
-78
lines changed

3 files changed

+236
-78
lines changed

‎test/jdk/ProblemList.txt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -609,7 +609,6 @@ sun/security/pkcs11/KeyStore/ClientAuth.sh 8254806 solaris-
609609
sun/security/pkcs11/sslecc/ClientJSSEServerJSSE.java 8161536 generic-all
610610

611611
javax/net/ssl/SSLEngine/TestAllSuites.java 8298874 generic-all
612-
javax/net/ssl/SSLEngine/IllegalRecordVersion.java 8298873 generic-all
613612
javax/net/ssl/SSLEngine/EngineCloseOnAlert.java 8298868 generic-all
614613
javax/net/ssl/SSLEngine/ConnectionTest.java 8298869 generic-all
615614
javax/net/ssl/SSLEngine/CheckStatus.java 8298872 generic-all

‎test/jdk/javax/net/ssl/SSLEngine/HandshakeWithInvalidRecordVersion.java

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
/*
2+
* Copyright (c) 2014, 2023, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
/*
25+
* @test
26+
* @bug 8042449 8299870
27+
* @library /javax/net/ssl/templates
28+
* @summary Verify successful handshake ignores invalid record version
29+
*
30+
* @run main/timeout=300 HandshakeWithInvalidRecordVersion
31+
*/
32+
33+
import javax.net.ssl.*;
34+
import javax.net.ssl.SSLEngineResult.*;
35+
import java.io.*;
36+
import java.security.*;
37+
import java.nio.*;
38+
import java.util.Arrays;
39+
40+
public class HandshakeWithInvalidRecordVersion implements SSLContextTemplate {
41+
private static final boolean DEBUG = Boolean.getBoolean("test.debug");
42+
43+
private static final String PATH_TO_STORES = "../etc";
44+
private static final String KEYSTORE_FILE = "keystore";
45+
private static final String TRUSTSTORE_FILE = "truststore";
46+
47+
private static final String KEYSTORE_PATH =
48+
System.getProperty("test.src", "./") + "/" + PATH_TO_STORES +
49+
"/" + KEYSTORE_FILE;
50+
private static final String TRUSTSTORE_PATH =
51+
System.getProperty("test.src", "./") + "/" + PATH_TO_STORES +
52+
"/" + TRUSTSTORE_FILE;
53+
54+
public static void main(String [] args) throws Exception {
55+
var runner = new HandshakeWithInvalidRecordVersion();
56+
runner.executeTest("TLSv1.2",
57+
new String[]{"TLSv1.2"}, new String[]{"TLSv1.3", "TLSv1.2"});
58+
59+
runner.executeTest("TLSv1.2",
60+
new String[]{"TLSv1.3", "TLSv1.2"}, new String[]{"TLSv1.2"});
61+
62+
runner.executeTest("TLSv1.3",
63+
new String[]{"TLSv1.2", "TLSv1.3"}, new String[]{"TLSv1.3"});
64+
65+
runner.executeTest("TLSv1.3",
66+
new String[]{"TLSv1.3"}, new String[]{"TLSv1.2", "TLSv1.3"});
67+
}
68+
69+
70+
private void executeTest(String expectedProtocol, String[] clientProtocols,
71+
String[] serverProtocols) throws Exception {
72+
System.out.printf("Executing test%n"
73+
+ "Client protocols: %s%nServer protocols: %s%nExpected negotiated: %s%n",
74+
Arrays.toString(clientProtocols), Arrays.toString(serverProtocols),
75+
expectedProtocol);
76+
77+
SSLEngine cliEngine = createClientSSLContext().createSSLEngine();
78+
cliEngine.setUseClientMode(true);
79+
cliEngine.setEnabledProtocols(clientProtocols);
80+
SSLEngine srvEngine = createServerSSLContext().createSSLEngine();
81+
srvEngine.setUseClientMode(false);
82+
srvEngine.setEnabledProtocols(serverProtocols);
83+
84+
SSLSession session = cliEngine.getSession();
85+
int netBufferMax = session.getPacketBufferSize();
86+
int appBufferMax = session.getApplicationBufferSize();
87+
88+
ByteBuffer cliToSrv = ByteBuffer.allocateDirect(netBufferMax);
89+
ByteBuffer srvIBuff = ByteBuffer.allocateDirect(appBufferMax + 50);
90+
ByteBuffer cliOBuff = ByteBuffer.wrap("I'm client".getBytes());
91+
92+
93+
System.out.println("Generating ClientHello");
94+
SSLEngineResult cliRes = cliEngine.wrap(cliOBuff, cliToSrv);
95+
checkResult(cliRes, HandshakeStatus.NEED_UNWRAP);
96+
log("Client wrap result: " + cliRes);
97+
cliToSrv.flip();
98+
if (cliToSrv.limit() > 5) {
99+
System.out.println("Setting record version to (0xa9, 0xa2)");
100+
cliToSrv.put(1, (byte)0xa9);
101+
cliToSrv.put(2, (byte)0xa2);
102+
} else {
103+
throw new RuntimeException("ClientHello message is only "
104+
+ cliToSrv.limit() + "bytes. Expecting at least 6 bytes. ");
105+
}
106+
107+
System.out.println("Processing ClientHello");
108+
SSLEngineResult srv = srvEngine.unwrap(cliToSrv, srvIBuff);
109+
checkResult(srv, HandshakeStatus.NEED_TASK);
110+
runDelegatedTasks(srvEngine);
111+
112+
finishHandshake(cliEngine, srvEngine);
113+
114+
if (!cliEngine.getSession().getProtocol()
115+
.equals(srvEngine.getSession().getProtocol())
116+
|| !cliEngine.getSession().getProtocol().equals(expectedProtocol)) {
117+
throw new RuntimeException("Client and server did not negotiate protocol. "
118+
+ "Expected: " + expectedProtocol + ". Negotiated: "
119+
+ cliEngine.getSession().getProtocol());
120+
}
121+
}
122+
private boolean isHandshaking(SSLEngine e) {
123+
return (e.getHandshakeStatus() != HandshakeStatus.NOT_HANDSHAKING);
124+
}
125+
126+
private void finishHandshake(SSLEngine client, SSLEngine server) throws Exception {
127+
boolean clientDone = false;
128+
boolean serverDone = false;
129+
SSLEngineResult serverResult;
130+
SSLEngineResult clientResult;
131+
int capacity = client.getSession().getPacketBufferSize();
132+
ByteBuffer emptyBuffer = ByteBuffer.allocate(capacity);
133+
ByteBuffer serverToClient = ByteBuffer.allocate(capacity);
134+
ByteBuffer clientToServer = ByteBuffer.allocate(capacity);
135+
136+
System.out.println("Finishing handshake...");
137+
while (isHandshaking(client) ||
138+
isHandshaking(server)) {
139+
140+
log("================");
141+
142+
clientResult = client.wrap(emptyBuffer, clientToServer);
143+
serverResult = server.wrap(emptyBuffer, serverToClient);
144+
145+
if (clientResult.getHandshakeStatus() == HandshakeStatus.FINISHED) {
146+
clientDone = true;
147+
}
148+
149+
if (serverResult.getHandshakeStatus() == HandshakeStatus.FINISHED) {
150+
serverDone = true;
151+
}
152+
153+
log("wrap1 = " + clientResult);
154+
log("wrap2 = " + serverResult);
155+
156+
if (clientResult.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
157+
Runnable runnable;
158+
while ((runnable = client.getDelegatedTask()) != null) {
159+
runnable.run();
160+
}
161+
}
162+
163+
if (serverResult.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
164+
Runnable runnable;
165+
while ((runnable = server.getDelegatedTask()) != null) {
166+
runnable.run();
167+
}
168+
}
169+
170+
clientToServer.flip();
171+
serverToClient.flip();
172+
173+
log("----");
174+
175+
clientResult = client.unwrap(serverToClient, emptyBuffer);
176+
serverResult = server.unwrap(clientToServer, emptyBuffer);
177+
178+
if (clientResult.getHandshakeStatus() == HandshakeStatus.FINISHED) {
179+
clientDone = true;
180+
}
181+
182+
if (serverResult.getHandshakeStatus() == HandshakeStatus.FINISHED) {
183+
serverDone = true;
184+
}
185+
186+
log("unwrap1 = " + clientResult);
187+
log("unwrap2 = " + serverResult);
188+
189+
if (clientResult.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
190+
Runnable runnable;
191+
while ((runnable = client.getDelegatedTask()) != null) {
192+
runnable.run();
193+
}
194+
}
195+
196+
if (serverResult.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
197+
Runnable runnable;
198+
while ((runnable = server.getDelegatedTask()) != null) {
199+
runnable.run();
200+
}
201+
}
202+
203+
clientToServer.clear();
204+
serverToClient.clear();
205+
}
206+
207+
System.out.println("Handshake complete");
208+
209+
if (!clientDone || !serverDone) {
210+
throw new RuntimeException("Both should be true:\n" +
211+
" clientDone = " + clientDone + " serverDone = " + serverDone);
212+
}
213+
}
214+
215+
private static void runDelegatedTasks(SSLEngine engine) {
216+
Runnable runnable;
217+
while ((runnable = engine.getDelegatedTask()) != null) {
218+
log("\trunning delegated task...");
219+
runnable.run();
220+
}
221+
}
222+
223+
private static void checkResult(SSLEngineResult result, HandshakeStatus expectedStatus) {
224+
if(result.getHandshakeStatus() != expectedStatus) {
225+
throw new RuntimeException(String.format(
226+
"Handshake status %s does not match expected status of %s",
227+
result.getHandshakeStatus(), expectedStatus));
228+
}
229+
}
230+
231+
private static void log(Object msg) {
232+
if (DEBUG) {
233+
System.out.println(msg);
234+
}
235+
}
236+
}

‎test/jdk/javax/net/ssl/SSLEngine/IllegalRecordVersion.java

Lines changed: 0 additions & 77 deletions
This file was deleted.

0 commit comments

Comments
 (0)