Skip to content

Commit 131c83b

Browse files
juergwmiguelaranda0
juergw
and
miguelaranda0
authored
Project import generated by Copybara. (#1521)
PiperOrigin-RevId: 944437907 Co-authored-by: Miguel Aranda <miguelaranda@google.com>
1 parent e4c1bf6 commit 131c83b

7 files changed

Lines changed: 327 additions & 37 deletions

File tree

‎common/src/main/java/org/conscrypt/NativeSsl.java‎

Lines changed: 47 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -396,14 +396,14 @@ void initialize(String hostname, OpenSSLKey channelIdPrivateKey) throws IOExcept
396396
NativeCrypto.SSL_set1_groups(ssl, this, toBoringSslGroups(paramsNamedGroups));
397397
} else {
398398
// Use default named group.
399-
String namedGroupsProperty = System.getProperty("jdk.tls.namedGroups");
400-
if (namedGroupsProperty == null || namedGroupsProperty.isEmpty()) {
401-
// If the property is not set or empty, use the default named groups. See:
399+
int[] parsedNamedGroups = getParsedTlsNamedGroupsPropertyOrNull();
400+
if (parsedNamedGroups == null) {
401+
// The jdk.tls.namedGroups property has not been set or is empty. We have to use the
402+
// default named groups. See:
402403
// https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html
403404
setDefaultNamedGroups(ssl, this);
404405
} else {
405-
int[] groups = parseNamedGroupsProperty(namedGroupsProperty);
406-
NativeCrypto.SSL_set1_groups(ssl, this, groups);
406+
NativeCrypto.SSL_set1_groups(ssl, this, parsedNamedGroups);
407407
}
408408
}
409409

@@ -798,4 +798,46 @@ void close() {
798798
}
799799
}
800800
}
801+
802+
/**
803+
* Returns the parsed value of the "jdk.tls.namedGroups" property.
804+
*
805+
* <p>Is null if the property is not set or empty.
806+
*/
807+
static synchronized int[] getParsedTlsNamedGroupsPropertyOrNull() {
808+
try {
809+
parseTlsNamedGroupsProperty();
810+
} catch (IllegalArgumentException e) {
811+
// This may happen if the user set the property to an invalid value.
812+
// Since the last time the property was parsed successfully. We ignore it
813+
// and return the previously parsed value.
814+
}
815+
return parsedTlsNamedGroupsProperty;
816+
}
817+
818+
private static int[] parsedTlsNamedGroupsProperty = null;
819+
private static String unparsedTlsNamedGroupsProperty = "";
820+
821+
/**
822+
* Parses the "jdk.tls.namedGroups" property and stores the result in {@code
823+
* parsedTlsNamedGroupsProperty}.
824+
*
825+
* <p>May throw an {@link IllegalArgumentException} if the property contains invalid values.
826+
*/
827+
static synchronized void parseTlsNamedGroupsProperty() {
828+
String property = System.getProperty("jdk.tls.namedGroups");
829+
if (property == null || property.isEmpty()) {
830+
parsedTlsNamedGroupsProperty = null;
831+
unparsedTlsNamedGroupsProperty = "";
832+
} else {
833+
if (!property.equals(unparsedTlsNamedGroupsProperty)) {
834+
unparsedTlsNamedGroupsProperty = property;
835+
parsedTlsNamedGroupsProperty = parseNamedGroupsProperty(property);
836+
}
837+
}
838+
}
839+
840+
static {
841+
parseTlsNamedGroupsProperty();
842+
}
801843
}

‎common/src/main/java/org/conscrypt/OpenSSLRSAPrivateCrtKey.java‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -217,26 +217,26 @@ public boolean equals(Object o) {
217217
RSAPrivateCrtKey other = (RSAPrivateCrtKey) o;
218218

219219
if (getOpenSSLKey().isHardwareBacked()) {
220-
return getModulus().equals(other.getModulus())
221-
&& publicExponent.equals(other.getPublicExponent());
220+
return equalsBigInteger(getModulus(), other.getModulus())
221+
&& equalsBigInteger(publicExponent, other.getPublicExponent());
222222
} else {
223-
return getModulus().equals(other.getModulus())
224-
&& publicExponent.equals(other.getPublicExponent())
225-
&& getPrivateExponent().equals(other.getPrivateExponent())
226-
&& primeP.equals(other.getPrimeP()) && primeQ.equals(other.getPrimeQ())
227-
&& primeExponentP.equals(other.getPrimeExponentP())
228-
&& primeExponentQ.equals(other.getPrimeExponentQ())
229-
&& crtCoefficient.equals(other.getCrtCoefficient());
223+
return equalsBigInteger(getModulus(), other.getModulus())
224+
&& equalsBigInteger(publicExponent, other.getPublicExponent())
225+
&& equalsBigInteger(getPrivateExponent(), other.getPrivateExponent())
226+
&& equalsBigInteger(primeP, other.getPrimeP()) && equalsBigInteger(primeQ, other.getPrimeQ())
227+
&& equalsBigInteger(primeExponentP, other.getPrimeExponentP())
228+
&& equalsBigInteger(primeExponentQ, other.getPrimeExponentQ())
229+
&& equalsBigInteger(crtCoefficient, other.getCrtCoefficient());
230230
}
231231
} else if (o instanceof RSAPrivateKey) {
232232
ensureReadParams();
233233
RSAPrivateKey other = (RSAPrivateKey) o;
234234

235235
if (getOpenSSLKey().isHardwareBacked()) {
236-
return getModulus().equals(other.getModulus());
236+
return equalsBigInteger(getModulus(), other.getModulus());
237237
} else {
238-
return getModulus().equals(other.getModulus())
239-
&& getPrivateExponent().equals(other.getPrivateExponent());
238+
return equalsBigInteger(getModulus(), other.getModulus())
239+
&& equalsBigInteger(getPrivateExponent(), other.getPrivateExponent());
240240
}
241241
}
242242

‎common/src/main/java/org/conscrypt/OpenSSLRSAPrivateKey.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
import java.io.ObjectOutputStream;
2323
import java.math.BigInteger;
2424
import java.security.InvalidKeyException;
25+
import java.security.MessageDigest;
2526
import java.security.PrivateKey;
2627
import java.security.PublicKey;
2728
import java.security.interfaces.RSAKey;
@@ -203,6 +204,10 @@ public final String getAlgorithm() {
203204
return "RSA";
204205
}
205206

207+
boolean equalsBigInteger(BigInteger a, BigInteger b) {
208+
return MessageDigest.isEqual(a.toByteArray(), b.toByteArray());
209+
}
210+
206211
@Override
207212
public boolean equals(Object o) {
208213
if (o == this) {
@@ -218,8 +223,8 @@ public boolean equals(Object o) {
218223
ensureReadParams();
219224
RSAPrivateKey other = (RSAPrivateKey) o;
220225

221-
return modulus.equals(other.getModulus())
222-
&& privateExponent.equals(other.getPrivateExponent());
226+
return equalsBigInteger(modulus, other.getModulus())
227+
&& equalsBigInteger(privateExponent, other.getPrivateExponent());
223228
}
224229

225230
return false;

‎common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java‎

Lines changed: 48 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1319,26 +1319,56 @@ public void handshake_namedGroupsDontIntersect_throwsException() throws Exceptio
13191319
}
13201320

13211321
@Test
1322-
public void handshake_namedGroupsProperty_failsIfAllValuesAreInvalid() throws Exception {
1322+
public void setNamedGroupsProperty_invalidValue_isIgnored() throws Exception {
1323+
// Set the property to a valid value.
1324+
System.setProperty("jdk.tls.namedGroups", "MLKEM1024");
1325+
1326+
{
1327+
TestSSLContext context = TestSSLContext.create();
1328+
final SSLSocket client = (SSLSocket) context.clientContext.getSocketFactory().createSocket(
1329+
context.host, context.port);
1330+
final SSLSocket server = (SSLSocket) context.serverSocket.accept();
1331+
Future<Void> s = runAsync(() -> {
1332+
server.startHandshake();
1333+
return null;
1334+
});
1335+
Future<Void> c = runAsync(() -> {
1336+
client.startHandshake();
1337+
return null;
1338+
});
1339+
s.get();
1340+
c.get();
1341+
assertEquals("MLKEM1024", getCurveName(client));
1342+
assertEquals("MLKEM1024", getCurveName(server));
1343+
client.close();
1344+
server.close();
1345+
context.close();
1346+
}
1347+
1348+
// Now, set the property to an invalid value.
13231349
System.setProperty("jdk.tls.namedGroups", "invalid,invalid2");
13241350

1325-
TestSSLContext context = TestSSLContext.create();
1326-
final SSLSocket client = (SSLSocket) context.clientContext.getSocketFactory().createSocket(
1327-
context.host, context.port);
1328-
final SSLSocket server = (SSLSocket) context.serverSocket.accept();
1329-
Future<Void> s = runAsync(() -> {
1330-
server.startHandshake();
1331-
return null;
1332-
});
1333-
Future<Void> c = runAsync(() -> {
1334-
client.startHandshake();
1335-
return null;
1336-
});
1337-
assertThrows(ExecutionException.class, s::get);
1338-
assertThrows(ExecutionException.class, c::get);
1339-
client.close();
1340-
server.close();
1341-
context.close();
1351+
{
1352+
TestSSLContext context = TestSSLContext.create();
1353+
final SSLSocket client = (SSLSocket) context.clientContext.getSocketFactory().createSocket(
1354+
context.host, context.port);
1355+
final SSLSocket server = (SSLSocket) context.serverSocket.accept();
1356+
Future<Void> s = runAsync(() -> {
1357+
server.startHandshake();
1358+
return null;
1359+
});
1360+
Future<Void> c = runAsync(() -> {
1361+
client.startHandshake();
1362+
return null;
1363+
});
1364+
s.get();
1365+
c.get();
1366+
assertEquals("MLKEM1024", getCurveName(client));
1367+
assertEquals("MLKEM1024", getCurveName(server));
1368+
client.close();
1369+
server.close();
1370+
context.close();
1371+
}
13421372
}
13431373

13441374
@Test

‎openjdk/src/test/java/org/conscrypt/ConscryptAndroidSuite.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,14 @@
5656
import org.conscrypt.javax.net.ssl.KeyManagerFactoryTest;
5757
import org.conscrypt.javax.net.ssl.KeyStoreBuilderParametersTest;
5858
import org.conscrypt.javax.net.ssl.SNIHostNameTest;
59+
import org.conscrypt.javax.net.ssl.SSLContextTest;
60+
import org.conscrypt.javax.net.ssl.SSLEngineTest;
61+
import org.conscrypt.javax.net.ssl.SSLEngineVersionCompatibilityTest;
5962
import org.conscrypt.javax.net.ssl.SSLParametersTest;
63+
import org.conscrypt.javax.net.ssl.SSLServerSocketTest;
64+
import org.conscrypt.javax.net.ssl.SSLSessionContextTest;
65+
import org.conscrypt.javax.net.ssl.SSLSessionTest;
66+
import org.conscrypt.javax.net.ssl.SSLSocketTest;
6067
import org.conscrypt.javax.net.ssl.X509KeyManagerTest;
6168
import org.conscrypt.metrics.CipherSuiteTest;
6269
import org.conscrypt.metrics.OptionalMethodTest;
@@ -150,7 +157,14 @@
150157
ProtocolTest.class,
151158
ScryptTest.class,
152159
SNIHostNameTest.class,
160+
SSLContextTest.class,
161+
SSLEngineTest.class,
162+
SSLEngineVersionCompatibilityTest.class,
153163
SSLParametersTest.class,
164+
SSLServerSocketTest.class,
165+
SSLSessionContextTest.class,
166+
SSLSessionTest.class,
167+
SSLSocketTest.class,
154168
VeryBasicHttpServerTest.class,
155169
X509KeyManagerTest.class,
156170
})

0 commit comments

Comments
 (0)