From ff7ab57fd580d07e996a549b83c34951238bf404 Mon Sep 17 00:00:00 2001 From: James Bottomley Date: Tue, 1 Oct 2019 10:27:12 -0700 Subject: [PATCH 1/2] jsse: Add TLSv1.1 and TLSv1.2 This adds the TLS negotiation, it does not enhance the possible ciphers to negotiate. Change-Id: I3871296d24bbc1cd173699002491f7a75b7d805b Signed-off-by: James Bottomley --- .../harmony/xnet/provider/jsse/NativeCrypto.java | 22 +++++++++++++++++++--- .../xnet/provider/jsse/OpenSSLProvider.java | 2 ++ 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java b/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java index ee2b33a75..c76a8d59f 100644 --- a/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java +++ b/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java @@ -147,6 +147,8 @@ public final class NativeCrypto { private static final String SUPPORTED_PROTOCOL_SSLV3 = "SSLv3"; private static final String SUPPORTED_PROTOCOL_TLSV1 = "TLSv1"; + private static final String SUPPORTED_PROTOCOL_TLSV1_1 = "TLSv1.1"; + private static final String SUPPORTED_PROTOCOL_TLSV1_2 = "TLSv1.2"; public static final Map OPENSSL_TO_STANDARD_CIPHER_SUITES = new HashMap(); @@ -258,6 +260,8 @@ public final class NativeCrypto { public static long SSL_OP_NO_COMPRESSION = 0x00020000L; public static long SSL_OP_NO_SSLv3 = 0x02000000L; public static long SSL_OP_NO_TLSv1 = 0x04000000L; + public static long SSL_OP_NO_TLSv1_1 = 0x10000000L; + public static long SSL_OP_NO_TLSv1_2 = 0x08000000L; public static native int SSL_CTX_new(); @@ -353,7 +357,11 @@ public final class NativeCrypto { public static native long SSL_clear_options(int ssl, long options); public static String[] getSupportedProtocols() { - return new String[] { SUPPORTED_PROTOCOL_SSLV3, SUPPORTED_PROTOCOL_TLSV1 }; + return new String[] { SUPPORTED_PROTOCOL_SSLV3, + SUPPORTED_PROTOCOL_TLSV1, + SUPPORTED_PROTOCOL_TLSV1_1, + SUPPORTED_PROTOCOL_TLSV1_2, + }; } public static void setEnabledProtocols(int ssl, String[] protocols) { @@ -361,7 +369,7 @@ public final class NativeCrypto { // openssl uses negative logic letting you disable protocols. // so first, assume we need to set all (disable all) and clear none (enable none). // in the loop, selectively move bits from set to clear (from disable to enable) - long optionsToSet = (SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1); + long optionsToSet = (SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2); long optionsToClear = 0; for (int i = 0; i < protocols.length; i++) { String protocol = protocols[i]; @@ -371,6 +379,12 @@ public final class NativeCrypto { } else if (protocol.equals(SUPPORTED_PROTOCOL_TLSV1)) { optionsToSet &= ~SSL_OP_NO_TLSv1; optionsToClear |= SSL_OP_NO_TLSv1; + } else if (protocol.equals(SUPPORTED_PROTOCOL_TLSV1_1)) { + optionsToSet &= ~SSL_OP_NO_TLSv1_1; + optionsToClear |= SSL_OP_NO_TLSv1_1; + } else if (protocol.equals(SUPPORTED_PROTOCOL_TLSV1_2)) { + optionsToSet &= ~SSL_OP_NO_TLSv1_2; + optionsToClear |= SSL_OP_NO_TLSv1_2; } else { // error checked by checkEnabledProtocols throw new IllegalStateException(); @@ -391,7 +405,9 @@ public final class NativeCrypto { throw new IllegalArgumentException("protocols[" + i + "] == null"); } if ((!protocol.equals(SUPPORTED_PROTOCOL_SSLV3)) - && (!protocol.equals(SUPPORTED_PROTOCOL_TLSV1))) { + && (!protocol.equals(SUPPORTED_PROTOCOL_TLSV1)) + && (!protocol.equals(SUPPORTED_PROTOCOL_TLSV1_1)) + && (!protocol.equals(SUPPORTED_PROTOCOL_TLSV1_2))) { throw new IllegalArgumentException("protocol " + protocol + " is not supported"); } diff --git a/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLProvider.java b/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLProvider.java index 4c8ad3aaf..ef0ebceeb 100644 --- a/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLProvider.java +++ b/luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLProvider.java @@ -27,6 +27,8 @@ public final class OpenSSLProvider extends Provider { put("SSLContext.SSLv3", OpenSSLContextImpl.class.getName()); put("SSLContext.TLS", OpenSSLContextImpl.class.getName()); put("SSLContext.TLSv1", OpenSSLContextImpl.class.getName()); + put("SSLContext.TLSv1.1", OpenSSLContextImpl.class.getName()); + put("SSLContext.TLSv1.2", OpenSSLContextImpl.class.getName()); put("SSLContext.Default", DefaultSSLContextImpl.class.getName()); put("MessageDigest.SHA-1", -- 2.16.4