1berry/openjdk
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

8355779: When no "signature_algorithms_cert" extension is present we do not apply certificate scope constraints to algorithms in "signature_algorithms" extension

Browse Source 
Reviewed-by: mullan
This commit is contained in:
Artur Barashev 2025-05-01 13:09:14 +00:00 committed by Sean Mullan
parent 7b31762375
commit 34807df762
1 changed files with 51 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
src/java.base/share/classes/sun/security/ssl/SignatureAlgorithmsExtension.java
View File

@ -25,6 +25,7 @@
package sun.security.ssl;
import static sun.security.ssl.SignatureScheme.CERTIFICATE_SCOPE;
import static sun.security.ssl.SignatureScheme.HANDSHAKE_SCOPE;
import java.io.IOException;
@ -33,6 +34,7 @@ import java.text.MessageFormat;
import java.util.Arrays;
import java.util.List;
import java.util.Locale;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLProtocolException;
import sun.security.ssl.SSLExtension.ExtensionConsumer;
import sun.security.ssl.SSLExtension.SSLExtensionSpec;
@ -270,30 +272,8 @@ final class SignatureAlgorithmsExtension {
return;
}
// update the context
List<SignatureScheme> sss =
SignatureScheme.getSupportedAlgorithms(
shc.sslConfig,
shc.algorithmConstraints, shc.negotiatedProtocol,
spec.signatureSchemes,
HANDSHAKE_SCOPE);
if (sss == null || sss.isEmpty()) {
throw shc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
shc.peerRequestedSignatureSchemes = sss;
// If no "signature_algorithms_cert" extension is present, then
// the "signature_algorithms" extension also applies to
// signatures appearing in certificates.
SignatureSchemesSpec certSpec =
(SignatureSchemesSpec)shc.handshakeExtensions.get(
SSLExtension.CH_SIGNATURE_ALGORITHMS_CERT);
if (certSpec == null) {
shc.peerRequestedCertSignSchemes = sss;
shc.handshakeSession.setPeerSupportedSignatureAlgorithms(sss);
}
updateHandshakeContext(shc, spec.signatureSchemes,
SSLExtension.CH_SIGNATURE_ALGORITHMS_CERT);
if (!shc.isResumption &&
shc.negotiatedProtocol.useTLS13PlusSpec()) {
@ -497,30 +477,8 @@ final class SignatureAlgorithmsExtension {
return;
}
// update the context
List<SignatureScheme> sss =
SignatureScheme.getSupportedAlgorithms(
chc.sslConfig,
chc.algorithmConstraints, chc.negotiatedProtocol,
spec.signatureSchemes,
HANDSHAKE_SCOPE);
if (sss == null || sss.isEmpty()) {
throw chc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
chc.peerRequestedSignatureSchemes = sss;
// If no "signature_algorithms_cert" extension is present, then
// the "signature_algorithms" extension also applies to
// signatures appearing in certificates.
SignatureSchemesSpec certSpec =
(SignatureSchemesSpec)chc.handshakeExtensions.get(
SSLExtension.CR_SIGNATURE_ALGORITHMS_CERT);
if (certSpec == null) {
chc.peerRequestedCertSignSchemes = sss;
chc.handshakeSession.setPeerSupportedSignatureAlgorithms(sss);
}
updateHandshakeContext(chc, spec.signatureSchemes,
SSLExtension.CR_SIGNATURE_ALGORITHMS_CERT);
}
}
@ -543,4 +501,49 @@ final class SignatureAlgorithmsExtension {
"received CertificateRequest handshake message");
}
}
// Updates given HandshakeContext with peer signature schemes.
private static void updateHandshakeContext(HandshakeContext hc,
int[] signatureSchemes, SSLExtension signatureAlgorithmsCertExt)
throws SSLException {
List<SignatureScheme> handshakeSS =
SignatureScheme.getSupportedAlgorithms(
hc.sslConfig,
hc.algorithmConstraints,
hc.negotiatedProtocol,
signatureSchemes,
HANDSHAKE_SCOPE);
if (handshakeSS.isEmpty()) {
throw hc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
hc.peerRequestedSignatureSchemes = handshakeSS;
// If no "signature_algorithms_cert" extension is present, then
// the "signature_algorithms" extension also applies to
// signatures appearing in certificates.
SignatureSchemesSpec certSpec =
(SignatureSchemesSpec) hc.handshakeExtensions.get(
signatureAlgorithmsCertExt);
if (certSpec == null) {
List<SignatureScheme> certSS =
SignatureScheme.getSupportedAlgorithms(
hc.sslConfig,
hc.algorithmConstraints,
hc.negotiatedProtocol,
signatureSchemes,
CERTIFICATE_SCOPE);
if (certSS.isEmpty()) {
throw hc.conContext.fatal(Alert.HANDSHAKE_FAILURE,
"No supported signature algorithm");
}
hc.peerRequestedCertSignSchemes = certSS;
hc.handshakeSession.setPeerSupportedSignatureAlgorithms(certSS);
}
}
}