TLS: Updates from bc-java

Author: peterdettman

tls/src/main/java/org/bouncycastle/tls/CertificateStatus.java

@@ -147,15 +147,15 @@ public static CertificateStatus parse(TlsContext context, InputStream input) thr
         {
         case CertificateStatusType.ocsp:
         {
-            requireStatusRequestVersion(1, statusRequestVersion);
+            checkStatusType(status_type, 1, statusRequestVersion);
 
             byte[] derEncoding = TlsUtils.readOpaque24(input, 1);
             response = parseOCSPResponse(derEncoding);
             break;
         }
         case CertificateStatusType.ocsp_multi:
         {
-            requireStatusRequestVersion(2, statusRequestVersion);
+            checkStatusType(status_type, 2, statusRequestVersion);
 
             byte[] ocsp_response_list = TlsUtils.readOpaque24(input, 1);
             ByteArrayInputStream buf = new ByteArrayInputStream(ocsp_response_list);
@@ -235,6 +235,17 @@ protected static OCSPResponse parseOCSPResponse(byte[] derEncoding) throws IOExc
         return ocspResponse;
     }
 
+    protected static void checkStatusType(short status_type, int minVersion, int statusRequestVersion)
+        throws IOException
+    {
+        if (statusRequestVersion < minVersion)
+        {
+            throw new TlsFatalAlert(AlertDescription.decode_error,
+                "Invalid status_type " + CertificateStatusType.getText(status_type));
+        }
+    }
+
+    /** @deprecated Use {@link #checkStatusType(short, int, int)} instead. */
     protected static void requireStatusRequestVersion(int minVersion, int statusRequestVersion)
         throws IOException
     {

tls/src/main/java/org/bouncycastle/tls/CertificateStatusType.java

@@ -11,4 +11,22 @@ public class CertificateStatusType
      *  RFC 6961
      */
     public static final short ocsp_multi = 2;
+
+    public static String getName(short certificateStatusType)
+    {
+        switch (certificateStatusType)
+        {
+        case ocsp:
+            return "ocsp";
+        case ocsp_multi:
+            return "ocsp_multi";
+        default:
+            return "UNKNOWN";
+        }
+    }
+
+    public static String getText(short certificateStatusType)
+    {
+        return getName(certificateStatusType) + "(" + certificateStatusType + ")";
+    }
 }

tls/src/main/java/org/bouncycastle/tls/DTLSClientProtocol.java

@@ -302,7 +302,7 @@ protected DTLSTransport clientHandshake(ClientHandshakeState state)
         }
         else
         {
-            state.keyExchange.processClientCredentials(clientAuthCredentials);                    
+            state.keyExchange.processClientCredentials(clientAuthCredentials);
         }
 
         Vector clientSupplementalData = client.getClientSupplementalData();
@@ -547,8 +547,7 @@ protected byte[] generateClientHello(ClientHandshakeState state)
              * TLS_EMPTY_RENEGOTIATION_INFO_SCSV signaling cipher suite value in the ClientHello.
              * Including both is NOT RECOMMENDED.
              */
-            boolean noRenegExt = (null == TlsUtils.getExtensionData(state.clientExtensions,
-                TlsProtocol.EXT_RenegotiationInfo));
+            boolean noRenegExt = !TlsUtils.hasExtension(state.clientExtensions, TlsProtocol.EXT_RenegotiationInfo);
             boolean noRenegSCSV = !Arrays.contains(state.offeredCipherSuites,
                 CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
 
@@ -852,7 +851,6 @@ protected void processServerHello(ClientHandshakeState state, byte[] body)
         }
 
         /*
-         * 
          * RFC 3546 2.2 Note that the extended server hello message is only sent in response to an
          * extended client hello message. However, see RFC 5746 exception below. We always include
          * the SCSV, so an Extended Server Hello is always allowed.
@@ -884,7 +882,7 @@ protected void processServerHello(ClientHandshakeState state, byte[] body)
                  * associated ClientHello, it MUST abort the handshake with an unsupported_extension
                  * fatal alert.
                  */
-                if (null == TlsUtils.getExtensionData(state.clientExtensions, extType))
+                if (!TlsUtils.hasExtension(state.clientExtensions, extType))
                 {
                     throw new TlsFatalAlert(AlertDescription.unsupported_extension,
                         "Unrequested extension in ServerHello: " + ExtensionType.getText(extType.intValue()));

tls/src/main/java/org/bouncycastle/tls/DTLSServerProtocol.java

@@ -324,7 +324,7 @@ protected DTLSTransport serverHandshake(ServerHandshakeState state, DTLSRequest
                     /*
                      * RFC 5246 If no suitable certificate is available, the client MUST send a
                      * certificate message containing no certificates.
-                     * 
+                     *
                      * NOTE: In previous RFCs, this was SHOULD instead of MUST.
                      */
                     throw new TlsFatalAlert(AlertDescription.unexpected_message);
@@ -612,9 +612,8 @@ else if (resumedSession)
              */
             if (securityParameters.isSecureRenegotiation())
             {
-                byte[] serverRenegExtData = TlsUtils.getExtensionData(state.serverExtensions,
+                boolean noRenegExt = !TlsUtils.hasExtension(state.serverExtensions,
                     TlsProtocol.EXT_RenegotiationInfo);
-                boolean noRenegExt = (null == serverRenegExtData);
 
                 if (noRenegExt)
                 {
@@ -904,7 +903,7 @@ protected void processClientHello(ServerHandshakeState state, ClientHello client
         server.notifyOfferedCipherSuites(offeredCipherSuites);
 
         /*
-         * TODO[resumption] Check RFC 7627 5.4. for required behaviour 
+         * TODO[resumption] Check RFC 7627 5.4. for required behaviour
          */
 
         byte[] clientRenegExtData = TlsUtils.getExtensionData(clientHelloExtensions,

tls/src/main/java/org/bouncycastle/tls/ExtensionType.java

@@ -284,6 +284,13 @@ public static boolean isRecognized(int extensionType)
         case key_share:
         case connection_id:
         case renegotiation_info:
+
+        /*
+         * WARNING: When adding a new "recognized" extension type, also register with
+         * TlsUtils.isPermittedExtensionType13 the TLS 1.3 messages it may appear in (if any). A recognized
+         * type not registered there is rejected with illegal_parameter in any TLS 1.3 message that is checked.
+         */
+
             return true;
         default:
             return false;

tls/src/main/java/org/bouncycastle/tls/TlsClientProtocol.java

@@ -624,7 +624,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
                 }
                 else
                 {
-                    keyExchange.processClientCredentials(clientAuthCredentials);                    
+                    keyExchange.processClientCredentials(clientAuthCredentials);
                 }
 
                 Vector clientSupplementalData = tlsClient.getClientSupplementalData();
@@ -637,7 +637,7 @@ protected void handleHandshakeMessage(short type, HandshakeMessageInput buf)
                 if (certificateRequest != null)
                 {
                     sendCertificateMessage(clientAuthCertificate, null);
-                    this.connection_state = CS_CLIENT_CERTIFICATE;                    
+                    this.connection_state = CS_CLIENT_CERTIFICATE;
                 }
 
                 sendClientKeyExchange();
@@ -879,7 +879,7 @@ protected void process13HelloRetryRequest(ServerHello helloRetryRequest)
                     continue;
                 }
 
-                if (null == TlsUtils.getExtensionData(clientExtensions, extType))
+                if (!TlsUtils.hasExtension(clientExtensions, extType))
                 {
                     throw new TlsFatalAlert(AlertDescription.unsupported_extension,
                         "Unrequested extension in HelloRetryRequest: " + ExtensionType.getText(extensionType));
@@ -1252,7 +1252,7 @@ protected void processServerHello(ServerHello serverHello)
         /*
          * RFC 3546 2.2 Note that the extended server hello message is only sent in response to an
          * extended client hello message.
-         * 
+         *
          * However, see RFC 5746 exception below. We always include the SCSV, so an Extended Server
          * Hello is always allowed.
          */
@@ -1283,7 +1283,7 @@ protected void processServerHello(ServerHello serverHello)
                  * associated ClientHello, it MUST abort the handshake with an unsupported_extension
                  * fatal alert.
                  */
-                if (null == TlsUtils.getExtensionData(clientHelloExtensions, extType))
+                if (!TlsUtils.hasExtension(clientHelloExtensions, extType))
                 {
                     throw new TlsFatalAlert(AlertDescription.unsupported_extension,
                         "Unrequested extension in ServerHello: " + ExtensionType.getText(extType.intValue()));
@@ -1508,7 +1508,7 @@ protected void receive13CertificateRequest(ByteArrayInputStream buf, boolean pos
             throw new TlsFatalAlert(AlertDescription.internal_error);
         }
 
-        /* 
+        /*
          * RFC 8446 4.3.2. A server which is authenticating with a certificate MAY optionally
          * request a certificate from the client.
          */
@@ -1554,7 +1554,7 @@ protected void receive13EncryptedExtensions(ByteArrayInputStream buf)
             {
                 Integer extType = (Integer)e.nextElement();
 
-                if (null == TlsUtils.getExtensionData(clientExtensions, extType))
+                if (!TlsUtils.hasExtension(clientExtensions, extType))
                 {
                     throw new TlsFatalAlert(AlertDescription.unsupported_extension,
                         "Unrequested extension in EncryptedExtensions: " + ExtensionType.getText(extType.intValue()));
@@ -1918,7 +1918,7 @@ protected void sendClientHello()
         this.clientBinders = TlsUtils.addPreSharedKeyToClientHello(tlsClientContext, tlsClient, clientExtensions,
             offeredCipherSuites);
 
-        // TODO[tls13-psk] Perhaps don't add key_share if external PSK(s) offered and 'psk_dhe_ke' not offered  
+        // TODO[tls13-psk] Perhaps don't add key_share if external PSK(s) offered and 'psk_dhe_ke' not offered
         this.clientAgreements = TlsUtils.addKeyShareToClientHello(tlsClientContext, tlsClient, clientExtensions);
 
         if (shouldUseEMS && TlsUtils.isExtendedMasterSecretOptional(supportedVersions))
@@ -1967,7 +1967,7 @@ else if (offeringTLSv12Minus)
              * TLS_EMPTY_RENEGOTIATION_INFO_SCSV signaling cipher suite value in the ClientHello.
              * Including both is NOT RECOMMENDED.
              */
-            boolean noRenegExt = (null == TlsUtils.getExtensionData(clientExtensions, EXT_RenegotiationInfo));
+            boolean noRenegExt = !TlsUtils.hasExtension(clientExtensions, EXT_RenegotiationInfo);
             boolean noRenegSCSV = !Arrays.contains(offeredCipherSuites, CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV);
 
             if (noRenegExt && noRenegSCSV)

tls/src/main/java/org/bouncycastle/tls/TlsServerProtocol.java

@@ -202,7 +202,7 @@ protected ServerHello generate13ServerHello(ClientHello clientHello, HandshakeMe
 
             /*
              * TODO[tls13] Confirm fields in the ClientHello haven't changed
-             * 
+             *
              * RFC 8446 4.1.2 [..] when the server has responded to its ClientHello with a
              * HelloRetryRequest [..] the client MUST send the same ClientHello without
              * modification, except as follows: [key_share, early_data, cookie, pre_shared_key,
@@ -259,7 +259,7 @@ protected ServerHello generate13ServerHello(ClientHello clientHello, HandshakeMe
 
             /*
              * NOTE: Currently no server support for session resumption
-             * 
+             *
              * If adding support, ensure securityParameters.tlsUnique is set to the localVerifyData, but
              * ONLY when extended_master_secret has been negotiated (otherwise NULL).
              */
@@ -448,7 +448,7 @@ protected ServerHello generateServerHello(ClientHello clientHello, HandshakeMess
         this.offeredCipherSuites = clientHello.getCipherSuites();
 
 
- 
+
         SecurityParameters securityParameters = tlsServerContext.getSecurityParametersHandshake();
 
         tlsServerContext.setClientSupportedVersions(
@@ -469,7 +469,7 @@ protected ServerHello generateServerHello(ClientHello clientHello, HandshakeMess
             clientVersion = ProtocolVersion.getLatestTLS(tlsServerContext.getClientSupportedVersions());
         }
 
-        // Set the legacy_record_version to use for early alerts 
+        // Set the legacy_record_version to use for early alerts
         recordStream.setWriteVersion(clientVersion);
 
         if (!ProtocolVersion.SERVER_EARLIEST_SUPPORTED_TLS.isEqualOrEarlierVersionOf(clientVersion))
@@ -784,8 +784,7 @@ else if (resumedSession)
              */
             if (securityParameters.isSecureRenegotiation())
             {
-                byte[] serverRenegExtData = TlsUtils.getExtensionData(this.serverExtensions, EXT_RenegotiationInfo);
-                boolean noRenegExt = (null == serverRenegExtData);
+                boolean noRenegExt = !TlsUtils.hasExtension(this.serverExtensions, EXT_RenegotiationInfo);
 
                 if (noRenegExt)
                 {
@@ -882,7 +881,7 @@ protected void handle13HandshakeMessage(short type, HandshakeMessageInput buf)
 
         /*
          * TODO[tls13] Abbreviated handshakes (PSK resumption)
-         * 
+         *
          * NOTE: No CertificateRequest, Certificate, CertificateVerify messages, but client
          * might now send EndOfEarlyData after receiving server Finished message.
          */
@@ -1292,7 +1291,7 @@ else if (TlsUtils.isTLSv12(tlsServerContext))
                     /*
                      * RFC 5246 If no suitable certificate is available, the client MUST send a
                      * certificate message containing no certificates.
-                     * 
+                     *
                      * NOTE: In previous RFCs, this was SHOULD instead of MUST.
                      */
                     throw new TlsFatalAlert(AlertDescription.unexpected_message);

tls/src/main/java/org/bouncycastle/tls/TlsUtils.java

@@ -1298,6 +1298,11 @@ public static byte[] getExtensionData(Hashtable extensions, Integer extensionTyp
         return extensions == null ? null : (byte[])extensions.get(extensionType);
     }
 
+    public static boolean hasExtension(Hashtable extensions, Integer extensionType)
+    {
+        return extensions != null && extensions.containsKey(extensionType);
+    }
+
     public static boolean hasExpectedEmptyExtensionData(Hashtable extensions, Integer extensionType,
         short alertDescription) throws IOException
     {
@@ -5870,8 +5875,8 @@ static Certificate add13CertificateStatus(Certificate certificate, CertificateSt
                 ?   (OCSPResponse)ocspResponseList.elementAt(i)
                 :   null;
 
-            if (null != ocspResponse
-                && null == TlsUtils.getExtensionData(extensions, TlsExtensionsUtils.EXT_status_request))
+            if (null != ocspResponse &&
+                !TlsUtils.hasExtension(extensions, TlsExtensionsUtils.EXT_status_request))
             {
                 byte[] extensionData = TlsExtensionsUtils.createStatusRequestExtension13(
                     new CertificateStatus(CertificateStatusType.ocsp, ocspResponse));
@@ -6152,13 +6157,26 @@ static boolean isPermittedExtensionType13(int handshakeType, int extensionType)
         switch (extensionType)
         {
         case ExtensionType.server_name:
+        {
+            switch (handshakeType)
+            {
+            case HandshakeType.client_hello:
+            case HandshakeType.encrypted_extensions:
+            case HandshakeType.certificate_request:
+                return true;
+            default:
+                return false;
+            }
+        }
         case ExtensionType.max_fragment_length:
         case ExtensionType.supported_groups:
         case ExtensionType.use_srtp:
         case ExtensionType.heartbeat:
         case ExtensionType.application_layer_protocol_negotiation:
         case ExtensionType.client_certificate_type:
         case ExtensionType.server_certificate_type:
+        case ExtensionType.cached_info:
+        case ExtensionType.record_size_limit:
         {
             switch (handshakeType)
             {
@@ -6222,6 +6240,8 @@ static boolean isPermittedExtensionType13(int handshakeType, int extensionType)
             }
         }
         case ExtensionType.pre_shared_key:
+        // TODO DTLS 1.3 differences
+        // case ExtensionType.connection_id:
         {
             switch (handshakeType)
             {