From 1970d6bf47e4ce3a43de370ada5c3e882d7a7cb0 Mon Sep 17 00:00:00 2001
From: Christina Fu <cfu@redhat.com>
Date: Fri, 29 Jun 2018 15:04:43 -0700
Subject: [PATCH] Ticket #11 Add support for TLS_*_SHA384 ciphers

This patch adds support for TLS_*_SHA384 ciphers which NSS now supports.

fixes: https://pagure.io/tomcatjss/issue/11
---
 .../tomcat/util/net/jss/JSSSocketFactory.java      | 43 +++++++++++++++++++++-
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java b/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java
index f974a89..b38b091 100644
--- a/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java
+++ b/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java
@@ -290,6 +290,22 @@ public class JSSSocketFactory implements
                 SSLSocket.TLS_ECDH_RSA_WITH_AES_128_CBC_SHA);
         cipherMap.put("TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
                 SSLSocket.TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA);
+
+        // TLS_*_SHA384
+        cipherMap.put("TLS_RSA_WITH_AES_256_GCM_SHA384",
+                SSLSocket.TLS_RSA_WITH_AES_256_GCM_SHA384);
+        cipherMap.put("TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
+                SSLSocket.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384);
+        cipherMap.put("TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
+                SSLSocket.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384);
+        cipherMap.put("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
+                SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384);
+        cipherMap.put("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384);
+        cipherMap.put("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384);
+        cipherMap.put("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384);
     }
 
     private static HashMap<Integer, String> eccCipherMap = new HashMap<Integer, String>();
@@ -338,6 +354,22 @@ public class JSSSocketFactory implements
         eccCipherMap.put(SSLSocket.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
                 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256");
 */
+
+        // TLS_*_SHA384
+        eccCipherMap.put(SSLSocket.TLS_RSA_WITH_AES_256_GCM_SHA384,
+                "TLS_RSA_WITH_AES_256_GCM_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+                "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384");
+        eccCipherMap.put(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");
     }
 
     private AbstractEndpoint endpoint;
@@ -429,23 +461,30 @@ public class JSSSocketFactory implements
             }
             if (cipherid != 0) {
                 try {
-                    debugWrite("JSSSocketFactory setSSLCiphers:  " + cipherstr
+                    debugWrite("JSSSocketFactory setSSLCiphers: setting: " + cipherstr
                             + ": 0x" + Integer.toHexString(cipherid) + "\n");
                     SSLSocket.setCipherPreferenceDefault(cipherid, state);
+                    debugWrite("JSSSocketFactory setSSLCiphers: done setting: " + cipherstr
+                            + ": 0x" + Integer.toHexString(cipherid) + "\n");
                 } catch (Exception e) {
-                    System.err.println("SSLSocket.setCipherPreferenceDefault exception:" +e);
+                    String errMsg = "SSLSocket.setCipherPreferenceDefault exception on: " + cipherstr + " : " +e;
+                    System.err.println(errMsg);
+                    debugWrite("JSSSocketFactory setSSLCiphers: " + errMsg);
                     if (eccCipherMap.containsKey(cipherid)) {
+                        debugWrite("JSSSocketFactory setSSLCiphers: Warning: cipher exists in eccCipherMap");
                         System.err
                                 .println("Warning: SSL ECC cipher \""
                                         + text
                                         + "\" unsupported by NSS. "
                                         + "This is probably O.K. unless ECC support has been installed.");
                     } else {
+                        debugWrite("JSSSocketFactory setSSLCiphers: Error: cipher does not exist in eccCipherMap");
                         System.err.println("Error: SSL cipher \"" + text
                                 + "\" unsupported by NSS");
                     }
                 }
             } else {
+                debugWrite("JSSSocketFactory setSSLCiphers: Error: cipher not recognized by tomcatjss");
                 System.err.println("Error: SSL cipher \"" + text
                         + "\" not recognized by tomcatjss");
             }
-- 
2.14.4