Skip to content

Commit 4c55d1e

Browse files
JeremiahM37JeremiahM37
committed
wolfJSSE fixes for FIPS test coverage
1 parent 13cb353 commit 4c55d1e

17 files changed

Lines changed: 1293 additions & 205 deletions

‎src/java/com/wolfssl/WolfSSLCertManager.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,8 @@ public synchronized int CertManagerLoadCAKeyStore(KeyStore ks)
179179
cert = (X509Certificate) ks.getCertificate(name);
180180
}
181181

182-
if (cert != null && cert.getBasicConstraints() >= 0) {
182+
if (cert != null && (cert.getBasicConstraints() >= 0 ||
183+
WolfSSL.trustPeerCertEnabled())) {
183184
ret = CertManagerLoadCABuffer(cert.getEncoded(),
184185
cert.getEncoded().length,
185186
WolfSSL.SSL_FILETYPE_ASN1);

‎src/java/com/wolfssl/provider/jsse/WolfSSLAuthStore.java‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,9 @@ protected WolfSSLImplementSSLSession getSession(
331331
return null;
332332
}
333333

334-
/* Return new session if in server mode, or if host is null */
335-
if (!clientMode || host == null) {
334+
/* Return new session if in server mode, host is null, or port is
335+
* unknown (-1). Netty uses SSLEngine(host, -1) as a valid JSSE hint. */
336+
if (!clientMode || host == null || port < 0) {
336337
return this.getSession(ssl, clientMode, host, port);
337338
}
338339

@@ -762,10 +763,16 @@ protected void updateTimeouts(int in, int side) {
762763

763764
}
764765

765-
if (in > 0 && diff > in) {
766+
if (in > 0 && diff >= in) {
767+
current.invalidate();
768+
}
769+
try {
770+
current.setNativeTimeout(in);
771+
} catch (IllegalStateException e) {
772+
/* Native WolfSSLSession has been freed,
773+
* invalidate this session entry */
766774
current.invalidate();
767775
}
768-
current.setNativeTimeout(in);
769776
}
770777
}
771778
}
@@ -803,4 +810,3 @@ protected synchronized void finalize() throws Throwable {
803810
super.finalize();
804811
}
805812
}
806-

‎src/java/com/wolfssl/provider/jsse/WolfSSLContext.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -488,7 +488,7 @@ protected SSLEngine engineCreateSSLEngine()
488488
try {
489489
return new WolfSSLEngine(this.ctx, this.authStore, this.params);
490490
} catch (WolfSSLException ex) {
491-
throw new IllegalStateException("Unable to create engine");
491+
throw new IllegalStateException("Unable to create engine", ex);
492492
}
493493
}
494494

@@ -516,7 +516,7 @@ protected SSLEngine engineCreateSSLEngine(String host, int port)
516516
return new WolfSSLEngine(this.ctx, this.authStore, this.params,
517517
host, port);
518518
} catch (WolfSSLException ex) {
519-
throw new IllegalStateException("Unable to create engine");
519+
throw new IllegalStateException("Unable to create engine", ex);
520520
}
521521
}
522522

‎src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java‎

Lines changed: 239 additions & 95 deletions
Large diffs are not rendered by default.

‎src/java/com/wolfssl/provider/jsse/WolfSSLEngineHelper.java‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,9 @@ protected WolfSSLEngineHelper(WolfSSLSession ssl, WolfSSLAuthStore store,
161161
WolfSSLParameters params, int port, String hostname)
162162
throws WolfSSLException {
163163

164-
if (params == null || ssl == null || store == null || port < 0) {
164+
/* SSLEngine(host, -1) is valid in JSSE/Netty and uses -1 as an
165+
* unknown port hint. Only reject ports below -1. */
166+
if (params == null || ssl == null || store == null || port < -1) {
165167
throw new WolfSSLException("Bad argument");
166168
}
167169

@@ -192,7 +194,7 @@ protected WolfSSLEngineHelper(WolfSSLSession ssl, WolfSSLAuthStore store,
192194
throws WolfSSLException {
193195

194196
if (params == null || ssl == null || store == null ||
195-
peerAddr == null || port < 0) {
197+
peerAddr == null || port < -1) {
196198
throw new WolfSSLException("Bad argument");
197199
}
198200

@@ -475,6 +477,19 @@ protected synchronized WolfSSLImplementSSLSession getSession() {
475477
return this.session;
476478
}
477479

480+
/**
481+
* Get the last exception from TrustManager certificate verification.
482+
* Delegates to the internal verify callback if available.
483+
*
484+
* @return Exception from last failed verification, or null
485+
*/
486+
protected synchronized Exception getLastVerifyException() {
487+
if (this.wicb != null) {
488+
return this.wicb.getVerifyException();
489+
}
490+
return null;
491+
}
492+
478493
/**
479494
* Get all supported cipher suites in native wolfSSL library, which
480495
* are also allowed by "wolfjsse.enabledCipherSuites" system Security
@@ -870,7 +885,7 @@ private void setLocalAuth(SSLSocket socket, SSLEngine engine) {
870885
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
871886
() -> "Using checkClientTrusted/ServerTrusted() " +
872887
"for verification");
873-
this.verifyMask = WolfSSL.SSL_VERIFY_PEER;
888+
this.verifyMask = mask;
874889
}
875890

876891
this.ssl.setVerify(this.verifyMask, wicb);
@@ -916,7 +931,7 @@ private static boolean checkBooleanProperty(String prop,
916931
* name depending on what createSocket() API the user has called and with
917932
* what String.
918933
*/
919-
private void setLocalServerNames() {
934+
private void setLocalServerNames(SSLEngine engine) {
920935
boolean autoSNI = this.wolfjsseAutoSni;
921936

922937
/* Detect HttpsURLConnection usage by checking:
@@ -931,9 +946,16 @@ private void setLocalServerNames() {
931946
this.peerAddr != null &&
932947
this.params.getServerNames() == null;
933948

934-
/* Enable SNI if explicitly requested via property or if
935-
* HttpsURLConnection is detected */
936-
autoSNI = autoSNI || isHttpsConnection;
949+
/* SSLEngine(host, port) should send SNI by default if no explicit
950+
* server names were configured and SNI extension is enabled. */
951+
boolean isEngineConnectionWithHost = this.clientMode &&
952+
engine != null &&
953+
this.hostname != null &&
954+
this.params.getServerNames() == null;
955+
956+
/* Enable SNI if explicitly requested via property, if
957+
* HttpsURLConnection is detected, or for SSLEngine(host, port). */
958+
autoSNI = autoSNI || isHttpsConnection || isEngineConnectionWithHost;
937959

938960
if (!this.jsseEnableSniExtension) {
939961
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
@@ -1256,7 +1278,7 @@ private void setLocalParams(SSLSocket socket, SSLEngine engine)
12561278
WolfSSLUtil.sanitizeProtocols(
12571279
this.params.getProtocols(), WolfSSL.TLS_VERSION.INVALID));
12581280
this.setLocalAuth(socket, engine);
1259-
this.setLocalServerNames();
1281+
this.setLocalServerNames(engine);
12601282
this.setLocalSessionTicket();
12611283
this.setLocalAlpnProtocols();
12621284
this.setLocalSecureRenegotiation();
@@ -1450,11 +1472,11 @@ protected synchronized int doHandshake(int isSSLEngine, int timeout)
14501472
* try to use IP address:port instead. If both are null, skip
14511473
* setting serverID. Setting newSession to 1 for setServerID since
14521474
* we are controlling get/set session from Java */
1453-
if (hostname != null) {
1475+
if (this.port >= 0 && hostname != null) {
14541476
serverId = this.hostname.concat(
14551477
Integer.toString(this.port)).getBytes();
14561478
}
1457-
else if (peerAddr != null) {
1479+
else if (this.port >= 0 && peerAddr != null) {
14581480
hostAddress = this.peerAddr.getHostAddress();
14591481
if (hostAddress != null) {
14601482
serverId = hostAddress.concat(
@@ -1708,4 +1730,3 @@ protected synchronized void finalize() throws Throwable {
17081730
super.finalize();
17091731
}
17101732
}
1711-

‎src/java/com/wolfssl/provider/jsse/WolfSSLImplementSSLSession.java‎

Lines changed: 13 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -281,8 +281,12 @@ public WolfSSLImplementSSLSession (WolfSSLImplementSSLSession orig) {
281281
this.sesPtr = orig.sesPtr;
282282
this.sesPtrUpdatedAfterTable = false;
283283

284-
/* Not copying binding, not needed */
285-
this.binding = null;
284+
/* Copy binding HashMap so session values are preserved */
285+
if (orig.binding != null) {
286+
this.binding = new HashMap<String, Object>(orig.binding);
287+
} else {
288+
this.binding = new HashMap<String, Object>();
289+
}
286290

287291
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
288292
() -> "created new session (WolfSSLImplementSSLSession)");
@@ -669,52 +673,14 @@ public Certificate[] getLocalCertificates() {
669673
public synchronized Principal getPeerPrincipal()
670674
throws SSLPeerUnverifiedException {
671675

672-
long peerX509 = 0;
673-
Principal peerPrincipal = null;
674-
WolfSSLX509 x509 = null;
675-
676-
if (ssl == null) {
677-
throw new SSLPeerUnverifiedException("handshake not done");
678-
}
679-
680-
/* Throw if server side with no client auth requested */
681-
if (this.side == WolfSSL.WOLFSSL_SERVER_END &&
682-
!this.clientAuthRequested) {
683-
throw new SSLPeerUnverifiedException(
684-
"peer not authenticated (no client auth requested)");
685-
}
686-
687-
try {
688-
peerX509 = this.ssl.getPeerCertificate();
689-
if (peerX509 == 0) {
690-
throw new SSLPeerUnverifiedException("No peer certificate");
691-
}
692-
693-
/* wolfSSL starting with 5.3.0 returns a new WOLFSSL_X509
694-
* structure from wolfSSL_get_peer_certificate(). In that case,
695-
* we need to free the pointer when finished. Prior to 5.3.0,
696-
* this memory was freed internally by wolfSSL since the API
697-
* only returned a pointer to internal memory */
698-
if (WolfSSL.getLibVersionHex() >= 0x05003000) {
699-
x509 = new WolfSSLX509(peerX509, true);
700-
}
701-
else {
702-
x509 = new WolfSSLX509(peerX509, false);
703-
}
704-
705-
if (x509 != null) {
706-
peerPrincipal = x509.getSubjectDN();
707-
x509.free();
708-
}
709-
710-
return peerPrincipal;
711-
712-
} catch (IllegalStateException | WolfSSLJNIException |
713-
WolfSSLException ex) {
714-
WolfSSLDebug.log(getClass(), WolfSSLDebug.INFO,
715-
() -> "Error getting peer principal: " + ex.getMessage());
676+
/* Use standard Java X509Certificate.getSubjectDN()
677+
* for X500Name equals() compatibility */
678+
Certificate[] certs = getPeerCertificates();
679+
if (certs != null && certs.length > 0 &&
680+
certs[0] instanceof X509Certificate) {
681+
return ((X509Certificate) certs[0]).getSubjectDN();
716682
}
717-
return null;
683+
throw new SSLPeerUnverifiedException("No peer certificate");
718684
}
719685

720686
@Override

0 commit comments

Comments
 (0)