From 82f4b9a032f942fdc005e12a408c8e87c9ea0f36 Mon Sep 17 00:00:00 2001
From: Christina Fu <cfu@redhat.com>
Date: Thu, 28 Jun 2018 17:42:36 -0700
Subject: [PATCH] Ticket #4 Add support for TLS_*_SHA384 ciphers
This patch adds support for TLS_*_SHA384 ciphers.
Fixes https://pagure.io/jss/issue/4
---
org/mozilla/jss/ssl/SSLCipher.java | 7 +++++
org/mozilla/jss/ssl/SSLSocket.java | 7 +++++
org/mozilla/jss/tests/Constants.java | 11 ++++++--
org/mozilla/jss/tests/SSLClientAuth.java | 45 ++++++++++++++++++++++++++++++++
4 files changed, 68 insertions(+), 2 deletions(-)
diff --git a/org/mozilla/jss/ssl/SSLCipher.java b/org/mozilla/jss/ssl/SSLCipher.java
index 30acdd7..278126b 100644
--- a/jss/org/mozilla/jss/ssl/SSLCipher.java
+++ b/jss/org/mozilla/jss/ssl/SSLCipher.java
@@ -258,8 +258,11 @@ public enum SSLCipher {
TLS_RSA_WITH_SEED_CBC_SHA (0x0096),
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009C),
+ TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009D),
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009E),
+ TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009F),
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (0x00A2),
+ TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 (0x00A3),
TLS_ECDH_ECDSA_WITH_NULL_SHA (0xc001, true),
TLS_ECDH_ECDSA_WITH_RC4_128_SHA (0xc002, true),
@@ -292,11 +295,15 @@ public enum SSLCipher {
TLS_ECDH_anon_WITH_AES_256_CBC_SHA (0xc019, true),
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023, true),
+ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024, true),
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027, true),
+ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028, true),
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02B, true),
+ TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02C, true),
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02D, true),
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02F, true),
+ TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030, true),
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 (0xc031, true);
private int id;
diff --git a/org/mozilla/jss/ssl/SSLSocket.java b/org/mozilla/jss/ssl/SSLSocket.java
index 0dd39fd..e104d3c 100644
--- a/jss/org/mozilla/jss/ssl/SSLSocket.java
+++ b/jss/org/mozilla/jss/ssl/SSLSocket.java
@@ -268,8 +268,11 @@ public class SSLSocket extends java.net.Socket {
public final static int TLS_RSA_WITH_SEED_CBC_SHA = 0x0096;
public final static int TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C;
+ public final static int TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009D;
public final static int TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E;
+ public final static int TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x009F;
public final static int TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = 0x00A2;
+ public final static int TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = 0x00A3;
public final static int TLS_ECDH_ECDSA_WITH_NULL_SHA = 0xc001;
public final static int TLS_ECDH_ECDSA_WITH_RC4_128_SHA = 0xc002;
@@ -302,11 +305,15 @@ public class SSLSocket extends java.net.Socket {
public final static int TLS_ECDH_anon_WITH_AES_256_CBC_SHA = 0xc019;
public final static int TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xc023;
+ public final static int TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xc024;
public final static int TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xc027;
+ public final static int TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0xc028;
public final static int TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xc02B;
+ public final static int TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xc02C;
public final static int TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 = 0xc02D;
public final static int TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xc02F;
+ public final static int TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xc030;
public final static int TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 = 0xc031;
/*
diff --git a/org/mozilla/jss/tests/Constants.java b/org/mozilla/jss/tests/Constants.java
index e613034..d79ad72 100755
--- a/jss/org/mozilla/jss/tests/Constants.java
+++ b/jss/org/mozilla/jss/tests/Constants.java
@@ -142,8 +142,15 @@ public interface Constants {
/*77*/ new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"),
/*78*/ new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"),
/*79*/ new cipher(SSLSocket.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"),
-/*78*/ new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
-/*80*/ new cipher(SSLSocket.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256")
+/*80*/ new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
+/*81*/ new cipher(SSLSocket.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"),
+/*82*/ new cipher(SSLSocket.TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS_RSA_WITH_AES_256_GCM_SHA384"),
+/*83*/ new cipher(SSLSocket.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"),
+/*84*/ new cipher(SSLSocket.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"),
+/*85*/ new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"),
+/*86*/ new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"),
+/*87*/ new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"),
+/*88*/ new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
};
/** Cipher supported by JSSE (JDK 1.5.x) */
diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java
index e1c6163..b656b82 100644
--- a/jss/org/mozilla/jss/tests/SSLClientAuth.java
+++ b/jss/org/mozilla/jss/tests/SSLClientAuth.java
@@ -148,6 +148,8 @@ public class SSLClientAuth implements Runnable {
}
configureDefaultSSLoptions();
+
+ testSpecificCiphers();
useNickname = false;
testConnection();
@@ -265,6 +267,49 @@ public class SSLClientAuth implements Runnable {
System.exit(1);
}
}
+
+ // test one or more specific ciphers
+ // -- normally for newly added ciphers
+ private void testSpecificCiphers() {
+ try {
+ //Disable SSL2 and SSL3 ciphers
+ SSLSocket.enableSSL2Default(false);
+ SSLSocket.enableSSL3Default(false);
+ /* TLS is enabled by default */
+
+ /* Enable Session tickets by default */
+ SSLSocket.enableSessionTicketsDefault(true);
+
+ /*
+ * when testing specific ciphers:
+ * 1. flip this to true
+ * 2. change the ciphers comparison (the code below was from
+ * the latest test
+ */
+ if (false) {
+ System.out.println("testing new TLS_*SHA384 ciphers");
+ System.out.println("Enable ony two new ciphers.");
+ int ciphers[] =
+ org.mozilla.jss.ssl.SSLSocket.getImplementedCipherSuites();
+ for (int i = 0; i < ciphers.length; ++i) {
+ if (ciphers[i] == 157 || ciphers[i] == 159) {
+ System.out.println("enabling cipher: " + ciphers[i]);
+ /* enable a couple SHA384 ciphers */
+ SSLSocket.setCipherPreferenceDefault(ciphers[i], true);
+ } else {
+ System.out.println("disabling cipher: " + ciphers[i]);
+ /* disable the non SHA384 ciphers */
+ SSLSocket.setCipherPreferenceDefault(ciphers[i], false);
+ }
+ }
+ }
+
+ } catch (SocketException ex) {
+ System.out.println("Error configuring ciphers.");
+ ex.printStackTrace();
+ System.exit(1);
+ }
+ }
private void testConnection() throws Exception {
serverReady = false;
--
2.14.4