# HG changeset patch

# User jnimeh

# Date 1578287079 28800

#      Sun Jan 05 21:04:39 2020 -0800

# Node ID b9d1ce20dd4b2ce34e74c8fa2d784335231abcd1

# Parent  3782f295811625b65d57f1aef15daa10d82a58a7

8236039: JSSE Client does not accept status_request extension in CertificateRequest messages for TLS 1.3

Reviewed-by: xuelei

diff --git a/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java b/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java

--- a/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java

+++ b/src/java.base/share/classes/sun/security/ssl/CertStatusExtension.java

@@ -1,5 +1,5 @@

 /*

- * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.

+ * Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

@@ -39,11 +39,7 @@

 import javax.net.ssl.SSLProtocolException;

 import sun.security.provider.certpath.OCSPResponse;

 import sun.security.provider.certpath.ResponderId;

-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST;

-import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST_V2;

 import sun.security.ssl.SSLExtension.ExtensionConsumer;

-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST;

-import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST_V2;

 import sun.security.ssl.SSLExtension.SSLExtensionSpec;

 import sun.security.ssl.SSLHandshake.HandshakeMessage;

 import sun.security.util.DerInputStream;

@@ -434,8 +430,9 @@

                     } else {

                         extBuilder.append(",\n");

                     }

-                    extBuilder.append(

-                            "{\n" + Utilities.indent(ext.toString()) + "}");

+                    extBuilder.append("{\n").

+                            append(Utilities.indent(ext.toString())).

+                            append("}");

                 }

                 extsStr = extBuilder.toString();

@@ -552,11 +549,11 @@

                 return null;

             }

-            if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {

+            if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                     SSLLogger.fine(

                         "Ignore unavailable extension: " +

-                        CH_STATUS_REQUEST.name);

+                        SSLExtension.CH_STATUS_REQUEST.name);

                 }

                 return null;

             }

@@ -568,8 +565,8 @@

             byte[] extData = new byte[] {0x01, 0x00, 0x00, 0x00, 0x00};

             // Update the context.

-            chc.handshakeExtensions.put(

-                    CH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);

+            chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST,

+                    CertStatusRequestSpec.DEFAULT);

             return extData;

         }

@@ -593,10 +590,10 @@

             // The consuming happens in server side only.

             ServerHandshakeContext shc = (ServerHandshakeContext)context;

-            if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST)) {

+            if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST)) {

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                     SSLLogger.fine("Ignore unavailable extension: " +

-                        CH_STATUS_REQUEST.name);

+                        SSLExtension.CH_STATUS_REQUEST.name);

                 }

                 return;     // ignore the extension

             }

@@ -610,7 +607,7 @@

             }

             // Update the context.

-            shc.handshakeExtensions.put(CH_STATUS_REQUEST, spec);

+            shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST, spec);

             if (!shc.isResumption &&

                     !shc.negotiatedProtocol.useTLS13PlusSpec()) {

                 shc.handshakeProducers.put(SSLHandshake.CERTIFICATE_STATUS.id,

@@ -654,13 +651,12 @@

             // In response to "status_request" extension request only.

             CertStatusRequestSpec spec = (CertStatusRequestSpec)

-                    shc.handshakeExtensions.get(CH_STATUS_REQUEST);

+                    shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);

             if (spec == null) {

                 // Ignore, no status_request extension requested.

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

-                    SSLLogger.finest(

-                        "Ignore unavailable extension: " +

-                        CH_STATUS_REQUEST.name);

+                    SSLLogger.finest("Ignore unavailable extension: " +

+                        SSLExtension.CH_STATUS_REQUEST.name);

                 }

                 return null;        // ignore the extension

@@ -681,8 +677,8 @@

             byte[] extData = new byte[0];

             // Update the context.

-            shc.handshakeExtensions.put(

-                    SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);

+            shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,

+                    CertStatusRequestSpec.DEFAULT);

             return extData;

         }

@@ -708,7 +704,7 @@

             // In response to "status_request" extension request only.

             CertStatusRequestSpec requestedCsr = (CertStatusRequestSpec)

-                    chc.handshakeExtensions.get(CH_STATUS_REQUEST);

+                    chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST);

             if (requestedCsr == null) {

                 throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,

                     "Unexpected status_request extension in ServerHello");

@@ -722,8 +718,8 @@

             }

             // Update the context.

-            chc.handshakeExtensions.put(

-                    SH_STATUS_REQUEST, CertStatusRequestSpec.DEFAULT);

+            chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST,

+                    CertStatusRequestSpec.DEFAULT);

             // Since we've received a legitimate status_request in the

             // ServerHello, stapling is active if it's been enabled.

@@ -909,7 +905,7 @@

                 return null;

             }

-            if (!chc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {

+            if (!chc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                     SSLLogger.finest(

                         "Ignore unavailable status_request_v2 extension");

@@ -926,8 +922,8 @@

                 0x00, 0x07, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00};

             // Update the context.

-            chc.handshakeExtensions.put(

-                    CH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);

+            chc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,

+                    CertStatusRequestV2Spec.DEFAULT);

             return extData;

         }

@@ -951,7 +947,7 @@

             // The consuming happens in server side only.

             ServerHandshakeContext shc = (ServerHandshakeContext)context;

-            if (!shc.sslConfig.isAvailable(CH_STATUS_REQUEST_V2)) {

+            if (!shc.sslConfig.isAvailable(SSLExtension.CH_STATUS_REQUEST_V2)) {

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                     SSLLogger.finest(

                         "Ignore unavailable status_request_v2 extension");

@@ -969,7 +965,8 @@

             }

             // Update the context.

-            shc.handshakeExtensions.put(CH_STATUS_REQUEST_V2, spec);

+            shc.handshakeExtensions.put(SSLExtension.CH_STATUS_REQUEST_V2,

+                    spec);

             if (!shc.isResumption) {

                 shc.handshakeProducers.putIfAbsent(

                         SSLHandshake.CERTIFICATE_STATUS.id,

@@ -1013,7 +1010,7 @@

             // In response to "status_request_v2" extension request only

             CertStatusRequestV2Spec spec = (CertStatusRequestV2Spec)

-                    shc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);

+                shc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);

             if (spec == null) {

                 // Ignore, no status_request_v2 extension requested.

                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

@@ -1038,8 +1035,8 @@

             byte[] extData = new byte[0];

             // Update the context.

-            shc.handshakeExtensions.put(

-                    SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);

+            shc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,

+                    CertStatusRequestV2Spec.DEFAULT);

             return extData;

         }

@@ -1065,7 +1062,7 @@

             // In response to "status_request" extension request only

             CertStatusRequestV2Spec requestedCsr = (CertStatusRequestV2Spec)

-                    chc.handshakeExtensions.get(CH_STATUS_REQUEST_V2);

+                chc.handshakeExtensions.get(SSLExtension.CH_STATUS_REQUEST_V2);

             if (requestedCsr == null) {

                 throw chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,

                     "Unexpected status_request_v2 extension in ServerHello");

@@ -1079,8 +1076,8 @@

             }

             // Update the context.

-            chc.handshakeExtensions.put(

-                    SH_STATUS_REQUEST_V2, CertStatusRequestV2Spec.DEFAULT);

+            chc.handshakeExtensions.put(SSLExtension.SH_STATUS_REQUEST_V2,

+                    CertStatusRequestV2Spec.DEFAULT);

             // Since we've received a legitimate status_request in the

             // ServerHello, stapling is active if it's been enabled.  If it

diff --git a/src/java.base/share/classes/sun/security/ssl/SSLExtension.java b/src/java.base/share/classes/sun/security/ssl/SSLExtension.java

--- a/src/java.base/share/classes/sun/security/ssl/SSLExtension.java

+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtension.java

@@ -1,5 +1,5 @@

 /*

- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

+ * Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

@@ -113,7 +113,6 @@

                                 null,

                                 null,

                                 CertStatusExtension.certStatusReqStringizer),

-

     CR_STATUS_REQUEST       (0x0005, "status_request"),

     CT_STATUS_REQUEST       (0x0005, "status_request",

                                 SSLHandshake.CERTIFICATE,

@@ -124,6 +123,7 @@

                                 null,

                                 null,

                                 CertStatusExtension.certStatusRespStringizer),

+

     // extensions defined in RFC 4681

     USER_MAPPING            (0x0006, "user_mapping"),

@@ -515,6 +515,16 @@

         return null;

     }

+    static String nameOf(int extensionType) {

+        for (SSLExtension ext : SSLExtension.values()) {

+            if (ext.id == extensionType) {

+                return ext.name;

+            }

+        }

+

+        return "unknown extension";

+    }

+

     static boolean isConsumable(int extensionType) {

         for (SSLExtension ext : SSLExtension.values()) {

             if (ext.id == extensionType &&

diff --git a/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java b/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java

--- a/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java

+++ b/src/java.base/share/classes/sun/security/ssl/SSLExtensions.java

@@ -1,5 +1,5 @@

 /*

- * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

+ * Copyright (c) 2018, 2020 Oracle and/or its affiliates. All rights reserved.

  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

  *

  * This code is free software; you can redistribute it and/or modify it

@@ -86,11 +86,14 @@

                                 "Received buggy supported_groups extension " +

                                 "in the ServerHello handshake message");

                     }

-                } else {

+                } else if (handshakeType == SSLHandshake.SERVER_HELLO) {

                     throw hm.handshakeContext.conContext.fatal(

-                        Alert.UNSUPPORTED_EXTENSION,

-                        "extension (" + extId +

-                        ") should not be presented in " + handshakeType.name);

+                            Alert.UNSUPPORTED_EXTENSION, "extension (" +

+                                    extId + ") should not be presented in " +

+                                    handshakeType.name);

+                } else {

+                    isSupported = false;

+                    // debug log to ignore unknown extension for handshakeType

                 }

             }

@@ -365,9 +368,10 @@

     }

     private static String toString(int extId, byte[] extData) {

+        String extName = SSLExtension.nameOf(extId);

         MessageFormat messageFormat = new MessageFormat(

-            "\"unknown extension ({0})\": '{'\n" +

-            "{1}\n" +

+            "\"{0} ({1})\": '{'\n" +

+            "{2}\n" +

             "'}'",

             Locale.ENGLISH);

@@ -375,6 +379,7 @@

         String encoded = hexEncoder.encodeBuffer(extData);

         Object[] messageFields = {

+            extName,

             extId,

             Utilities.indent(encoded)

         };