infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-07-28 03:43:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

8366454: TLS1.3 server fails with bad_record_mac when receiving encrypted records with empty body

Browse Source 
Co-authored-by: Daniel Jeliński <djelinski@openjdk.org>
Reviewed-by: djelinski
This commit is contained in:
Alice Pellegrini 2025-09-25 08:44:14 +00:00 committed by Daniel Jeliński
parent 847b107df8
commit ba44656b97
4 changed files with 23 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/java.base/share/classes/sun/security/ssl/Alert.java
View File

@ -181,6 +181,16 @@ public enum Alert {
AlertMessage(TransportContext context,
ByteBuffer m) throws IOException {
// From RFC 8446 "Implementations
// MUST NOT send Handshake and Alert records that have a zero-length
// TLSInnerPlaintext.content; if such a message is received, the
// receiving implementation MUST terminate the connection with an
// "unexpected_message" alert."
if (m.remaining() == 0) {
throw context.fatal(Alert.UNEXPECTED_MESSAGE,
"Alert fragments must not be zero length.");
}
// struct {
// AlertLevel level;
// AlertDescription description;

13
src/java.base/share/classes/sun/security/ssl/SSLCipher.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -1923,9 +1923,9 @@ enum SSLCipher {
// remove inner plaintext padding
int i = pt.limit() - 1;
for (; i > 0 && pt.get(i) == 0; i--);
for (; i >= pos && pt.get(i) == 0; i--);
if (i < (pos + 1)) {
if (i < pos) {
throw new BadPaddingException(
"Incorrect inner plaintext: no content type");
}
@ -2441,10 +2441,9 @@ enum SSLCipher {
// remove inner plaintext padding
int i = pt.limit() - 1;
for (; i > 0 && pt.get(i) == 0; i--) {
// blank
}
if (i < (pos + 1)) {
for (; i >= pos && pt.get(i) == 0; i--);
if (i < pos) {
throw new BadPaddingException(
"Incorrect inner plaintext: no content type");
}

6
test/jdk/sun/security/ssl/SSLEngineImpl/SSLEngineEmptyFragments.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2023, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -103,7 +103,7 @@ public class SSLEngineEmptyFragments extends SSLContextTemplate {
try {
unwrap(serverEngine, alert, serverIn);
throw new RuntimeException("Expected exception was not thrown.");
} catch (SSLHandshakeException exc) {
} catch (SSLProtocolException exc) {
log("Got the exception I wanted.");
}
}
@ -133,7 +133,7 @@ public class SSLEngineEmptyFragments extends SSLContextTemplate {
unwrap(serverEngine, alert, serverIn);
log("Server unwrap was successful when it should have failed.");
throw new RuntimeException("Expected exception was not thrown.");
} catch (SSLHandshakeException exc) {
} catch (SSLProtocolException exc) {
log("Got the exception I wanted.");
}
}

8
test/jdk/sun/security/ssl/SSLSocketImpl/SSLSocketEmptyFragments.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2023, 2025, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -351,9 +351,9 @@ public class SSLSocketEmptyFragments extends SSLContextTemplate {
tests.executeTest(
tests::testEmptyHandshakeRecord, SSLProtocolException.class);
tests.executeTest(
tests::testEmptyAlertNotHandshaking, SSLHandshakeException.class);
tests::testEmptyAlertNotHandshaking, SSLProtocolException.class);
tests.executeTest(
tests::testEmptyAlertDuringHandshake, SSLHandshakeException.class);
tests::testEmptyAlertDuringHandshake, SSLProtocolException.class);
tests.executeTest(
tests::testEmptyChangeCipherSpecMessage, SSLProtocolException.class);
@ -361,6 +361,6 @@ public class SSLSocketEmptyFragments extends SSLContextTemplate {
tests.executeTest(
tests::testEmptyHandshakeRecord, SSLProtocolException.class);
tests.executeTest(
tests::testEmptyAlertNotHandshaking, SSLHandshakeException.class);
tests::testEmptyAlertNotHandshaking, SSLProtocolException.class);
}
}