| 29e51335337132ebe338b61c7ff16ec4005285c9 |
|
08-Oct-2012 |
Brian Carlstrom <bdc@google.com> |
NativeCryptoTest#test_SSL_do_handshake_clientCertificateRequested_throws_after_renegotiate
Depending on the timing of the two threads, SocketTimeoutException or SSLProtocolException can be thrown.
Bug: 6964910
Change-Id: Ia921f0dc61d1f2eb39a8d41c4ff6d551c924977e
|
| 51de62cf77a070e2a45ae397c391832b9a781d91 |
|
30-Sep-2012 |
Brian Carlstrom <bdc@google.com> |
Fix flaky NativeCryptoTest.test_SSL_do_handshake_client_timeout
Fix similar issue in test_SSL_do_handshake_server_timeout
Bug: 6229479
Change-Id: If2cf7d7dfe468843285a531f4b8b42941996a3ed
|
| db611c5813f623ee0403aedd156bb15780ed6e69 |
|
30-Sep-2012 |
Brian Carlstrom <bdc@google.com> |
NativeCryptoTest#test_SSL_do_handshake_clientCertificateRequested_throws_after_renegotiate failure
Bug: 6964910
Change-Id: I13bed4e5ed104241025fbb1d5e28427ec16d7a80
|
| 8205bc491d7e9167aa190fca584b30cb1599ab51 |
|
23-Sep-2012 |
Brian Carlstrom <bdc@google.com> |
Add write timeout argument to SSL_write calls NativeCryptoTest
Bug: 6693087
Change-Id: Ie18b227580682ff1d1cc8221de1b89677d446b66
|
| c44b3f5d857d0d3f4d3668de905cdac5080ede3b |
|
01-Sep-2012 |
Kenny Root <kroot@google.com> |
Better OpenSSL key comparison
Use native code to compare OpenSSL keys instead of converting them to
Java BigIntegers first.
Change-Id: If795c9c26e41174755cdab34ff70e01c7487c9bd
|
| 8b43d6de8df989711dd0779d689e1a1c1f9df68e |
|
31-Aug-2012 |
Brian Carlstrom <bdc@google.com> |
Fix NativeCrypto.d2i_SSL_SESSION to initialize SSL_SESSION's cipher field
Bug: 7091840
Change-Id: I9dee0e39bae6aba28c7ea768242e64c9443d9e49
|
| 7695a9b3261bfee3a810e0829bd8082fe1fcb6a4 |
|
30-Aug-2012 |
Brian Carlstrom <bdc@google.com> |
Disable SSL compression
Bug: 7079965
Change-Id: I8e060a827613e212bbcced66507fbf124bb04543
|
| 783004cceef470884b3ee6946cbbfc4af0f28ae7 |
|
20-Aug-2012 |
Brian Carlstrom <bdc@google.com> |
Restore ability for SSLSocket.close() to interrupt reads and writes
SSLSocketTest.test_SSLSocket_interrupt didn't catch this regression so
added new test_SSLSocket_interrupt_read to cover this case
specifically. Also cleanup SSLSocketTest to use Executors like
NativeCryptoTest instead of Threads for better error checking.
Bug: 7014266
Change-Id: I1160cd283310a0c6197cd3271a25830e0e2b1524
|
| 46aabcb28b0e3b807f6db8c33173962d6f2cb71f |
|
12-Jun-2012 |
Kenny Root <kroot@google.com> |
Add OpenSSL provider for SHA1PRNG
(cherry-pick of 4718b07e482ccb083ce3dfff228d0615b96a8dd2 and 84fb77d814b0ad04d70addb04847797925acf805.)
Change-Id: Ib45c646a8596bf5ea0629408d6057d3828a1ac94
|
| 4718b07e482ccb083ce3dfff228d0615b96a8dd2 |
|
12-Jun-2012 |
Kenny Root <kroot@google.com> |
Add OpenSSL provider for SHA1PRNG
Change-Id: I45a3c1c0089aa439629e4645f15b16bd35aa6f55
|
| 679ac55c3c037887edfc6ce6f42a23cd7c11cd12 |
|
12-May-2012 |
Jesse Wilson <jessewilson@google.com> |
Only use SSL CUTTHROUGH (False Start) if the server supports NPN.
We enable cutthrough on the client if the server supports NPN.
We never enable cutthrough on the server because most relevant
protocols (ie. HTTP) are client-speaks-first and those don't
benefit from cutthrough on the server.
I verified this by enabling NPN on both client and server and
checking that the client's Application Data was sent before the
server's Change Cipher Spec. To increase the likelihood of this
otherwise racy situation I put the server in SSL debug mode
after it receiving next_protos_advertised_callback. OpenSSL's
debug mode adds a 1-second sleep before each read and write.
Bug: http://b/6331035
Change-Id: I879b5fb26dc237392a36fe0585c8a6519c0e5220
|
| 0afb10f667ef9c19aa2ea4797af6ba0bc328f148 |
|
01-May-2012 |
Brian Carlstrom <bdc@google.com> |
Avoid session reuse to fix test_SSL_do_handshake_clientCertificateRequested_throws_after_renegotiate for OpenSSL 1.0.1
Bug: 6229570
Change-Id: I891d10db104fda9978310b8be3420e1729971b27
|
| ebe87d125b8cc83238914f84f5f7aa799c0d83bd |
|
15-Apr-2012 |
Brian Carlstrom <bdc@google.com> |
Use SSL_CTX_set_session_id_context in ServerSessionContext
Without this, OpenSSL with fail when SSLSessions are reused on an
SSLServerSocket when client certificates are requested.
Bug: 6329719
Change-Id: I9b14b32cccee1e5aba1215cebf81eb05a788d63b
|
| 600dc4949de6bf5608e5f5a5214cde59299b683a |
|
26-Mar-2012 |
Jesse Wilson <jessewilson@google.com> |
Don't use the SSL_CTX prefix for a method that takes an SSL.
The implementation is asymmetric: enabling NPN is per-context, but
actually looking up the negotiated protocol is per-SSL. This caused
me to screw up in following the SSL_CTX naming scheme; I applied it
in too many places.
Change-Id: I5bd1be334d513f220086c901527d0b8416f2ba3f
|
| 25977e422febea04dac9fb9c35d7271d55d3b6b8 |
|
23-Mar-2012 |
Jesse Wilson <jessewilson@google.com> |
Expose NPN in OpenSSL.
This is derived from costin's change Ib18da136cb628515d6909c438cd0809452d7058a.
It moves the protocols data to the AppData's callbacks so the memory can be
released when the handshake completes.
Change-Id: Id61feaa6f28250e393f5c8093688b099e92dce9c
|
| 3e6dd45baa0d7f9b4fa06f4ade76e088b59cc7bf |
|
16-Mar-2012 |
Brian Carlstrom <bdc@google.com> |
Tracking openssl-1.0.1
Bug: 6168278
Change-Id: I240d2cbc91f616fd486efc5203e2221c9896d90f
|
| 41e34229c07e8d05090560ff80558fa222623769 |
|
09-Mar-2012 |
Kenny Root <kroot@google.com> |
Add support for OpenSSL engines
This allows OpenSSL ENGINE to be used for RSA and DSA private key
operations.
Also add in support for directly passing an OpenSSLKey to the
OpenSSLSocketImpl in case we are using ENGINEs.
Change-Id: Ia31735109052a13e421900b69ba5de13bbce0f6f
|
| 638000042da777f6d628d88dadde957c52597710 |
|
29-Jun-2011 |
Brian Carlstrom <bdc@google.com> |
Add ExceptionCheck after all places we setCallbackState
Also remove byte versions of SSL_read and SSL_write matching rest of
libcore to avoid making the change in even more places.
Note that testing this change required improving SSL_renegotiate which
is only used for testing.
Change-Id: If425764da3a36508a6c65d90eb3d36c5a018fd18
|
| 003f7a4d100cd1527d94bac81a4a3c5a8216c6ee |
|
04-Jun-2011 |
Brian Carlstrom <bdc@google.com> |
Make test initialization lazy
Bug: 4311645
Change-Id: I4280d7ddb2a78f0e33564f3b40cfeb5c671e134a
|
| 1b3c5388d0fffde4392007eb1b0be011a5dfae82 |
|
12-May-2011 |
Brian Carlstrom <bdc@google.com> |
Make CertInstaller installed CA certs trusted by applications via default TrustManager (2 of 6)
frameworks/base
Adding IKeyChainService APIs for CertInstaller and Settings use
keystore/java/android/security/IKeyChainService.aidl
libcore
Improve exceptions to include more information
luni/src/main/java/javax/security/auth/x500/X500Principal.java
Move guts of RootKeyStoreSpi to TrustedCertificateStore, leaving only KeyStoreSpi methods.
Added support for adding user CAs in a separate directory for system.
Added support for removing system CAs by placing a copy in a sytem directory
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/RootKeyStoreSpi.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustedCertificateStore.java
Formerly static methods on RootKeyStoreSpi are now instance methods on TrustedCertificateStore
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
Added test for NativeCrypto.X509_NAME_hash_old and X509_NAME_hash
to make sure the implementing algorithms doe not change since
TrustedCertificateStore depend on X509_NAME_hash_old (OpenSSL
changed the algorithm from MD5 to SHA1 when moving from 0.9.8 to
1.0.0)
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Extensive test of new TrustedCertificateStore behavior
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/TrustedCertificateStoreTest.java
TestKeyStore improvements
- Refactored TestKeyStore to provide simpler createCA method (and
internal createCertificate)
- Cleaned up to remove use of BouncyCastle specific X509Principal
in the TestKeyStore API when the public X500Principal would do.
- Cleaned up TestKeyStore support methods to not throw Exception
to remove need for static blocks for catch clauses in tests.
support/src/test/java/libcore/java/security/TestKeyStore.java
luni/src/test/java/libcore/java/security/KeyStoreTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Added private PKIXParameters contructor for use by
IndexedPKIXParameters to avoid wart of having to lookup and pass
a TrustAnchor to satisfy the super-class sanity check.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/IndexedPKIXParameters.java
luni/src/main/java/java/security/cert/PKIXParameters.java
packages/apps/CertInstaller
Change CertInstaller to call IKeyChainService.installCertificate
for CA certs to pass them to the KeyChainServiceTest which will
make them available to all apps through the
TrustedCertificateStore. Change PKCS12 extraction to use AsyncTask.
src/com/android/certinstaller/CertInstaller.java
Added installCaCertsToKeyChain and hasCaCerts accessor for use by
CertInstaller. Use hasUserCertificate() internally. Cleanup coding
style.
src/com/android/certinstaller/CredentialHelper.java
packages/apps/KeyChain
Added MANAGE_ACCOUNTS so that IKeyChainService.reset
implementation can remove KeyChain accounts.
AndroidManifest.xml
Implement new IKeyChainService methods:
- Added IKeyChainService.installCaCertificate to install certs
provided by CertInstaller using the TrustedCertificateStore.
- Added IKeyChainService.reset to allow Settings to remove the
KeyChain accounts so that any app granted access to keystore
credentials are revoked when the keystore is reset.
src/com/android/keychain/KeyChainService.java
packages/apps/Settings
Changed com.android.credentials.RESET credential reset action to
also call IKeyChainService.reset to remove any installed user CAs
and remove KeyChain accounts to have AccountManager revoke
credential granted to private keys removed during the RESET.
src/com/android/settings/CredentialStorage.java
Added toast text value for failure case
res/values/strings.xml
system/core
Have init create world readable /data/misc/keychain to allow apps
to access user added CA certificates installed by the CertInstaller.
rootdir/init.rc
Change-Id: Ief57672eea38b3eece23b14c94dedb9ea4713744
|
| 5d3f5200f3511c9a7107bcc0a996c7afa1b39aaf |
|
01-Apr-2011 |
Elliott Hughes <enh@google.com> |
Don't cache the underlying Socket's underlying SocketImpl's underlying FileDescriptor in OpenSSLSocketImpl.
(OpenSSLSocketImpl, of course, being a Socket, not a SocketImpl.)
Bug: 4192414
git cherry-pick dc33f53f38600943c84146320c748e3c46fd2e7b
Change-Id: I8f481e0fe217aac782ad9d9e9053681ad69e62ef
|
| dc33f53f38600943c84146320c748e3c46fd2e7b |
|
01-Apr-2011 |
Elliott Hughes <enh@google.com> |
Don't cache the underlying Socket's underlying SocketImpl's underlying FileDescriptor in OpenSSLSocketImpl.
(OpenSSLSocketImpl, of course, being a Socket, not a SocketImpl.)
Bug: 4192414
Change-Id: I3c7d0fed70b1b98dc8fcc73f35b3feb0e1eeb2f9
|
| 6a75005c0547634e5179829c61eb03209197ceda |
|
01-Feb-2011 |
Jesse Wilson <jessewilson@google.com> |
Fix some tests to cope with new TestKeyStore exceptions.
Change-Id: I2ac1a81f2907ee35e293192e6beb00c69520ae09
|
| 4ae3fd787741bfe1b808f447dcb0785250024119 |
|
19-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
Elliptic Crypto support for OpenSSLSocketImpl
Summary:
- Enable Elliptic Crypto support for OpenSSL based SSLSocket instances
- More RI compliant usage of key types, client auth types, and server auth types
- Steps toward TLS_EMPTY_RENEGOTIATION_INFO_SCSV support, currently test updates
Details:
Elliptic Curve changes
CipherSuite updates for EC
- Adding KEY_EXCHANGE_EC* and corresponding CipherSuites Updated
isAnonymous, getKeyType (now renamed getServerKeyType) to handle
new EC cases. Added new getAuthType for use by
checkServerTrusted callers.
- Restructured code to handle two SUITES_BY_CODE_* arrays
- Remove KEY_EXCHANGE_DH_* definitions which unused because the
corresponding CipherSuites were previously disabled.
- Changed AES CipherSuites definitions to use "_CBC" to match other definitions.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
openssl EC
- NativeCrypto now registers TLS_EC_* cipher suites and has update default list
- Improved auth type arguments to checkClientTrusted/checkServerTrusted
- NativeCrypto support for emphemeral EC keys
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/native/NativeCrypto.cpp
non-openssl SSL/TLS cleanups
- cleanup around code trying to cope with DiffieHellman vs DH since either should work.
- changed client to use new CipherSuite.getAuthType shared with NativeCrypto implementation
- changed server to use CipherSuite.getKeyType
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ClientHandshakeImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/HandshakeProtocol.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/KeyManagerImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ServerHandshakeImpl.java
Consolidate CertificateRequestType code into CipherSuite so that its
shared between java and openssl implementations. This includes the
KEY_TYPE_ string constants, TLS_CT_* byte constants and the 'String
keyType(byte)' (now renamed getClientKeyType) code that depends on them.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CertificateRequest.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ClientHandshakeImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ServerHandshakeImpl.java
Tests
Differentiate between supported list of cipher suites openssl-based
SSLSocket and SSLEngine based, since the SSLEngine code does not support EC.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
Added testing for expected default cipher suites. Before we just ensured the values were valid.
luni/src/test/java/libcore/javax/net/ssl/SSLSocketFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Updated to handle new EC cipher suites codes. Added test for new getClientKeyType.
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
Better use of "standard names" particularly to correctly deal with
the subtle differences between key types, client auth types, and
server auth types. TestKeyManager and TestTrustManager now verify
the values they are passed are acceptable.
support/src/test/java/libcore/java/security/StandardNames.java
support/src/test/java/libcore/javax/net/ssl/TestKeyManager.java
support/src/test/java/libcore/javax/net/ssl/TestTrustManager.java
Changed to timeout after 30 seconds and to log to reveal both client and server issues.
support/src/test/java/libcore/javax/net/ssl/TestSSLSocketPair.java
Bug: 3058375
Change-Id: I14d1d0285d591c99cc211324f3595a5be682cab1
|
| 6c78b7b94c232063ec559436b48b33751373ecf1 |
|
19-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
Toward EC TLS support
Summary:
- javax.net.ssl tests are now working on the RI
- KeyManager can now handle EC_EC and EC_RSA
- OpenSSLSocketImpl.startHandshake now works if KeyManager contains EC certificates
Details:
Add CipherSuite.getKeyType to provide X509KeyManager key type strings,
refactored from OpenSSLServerSocketImpl.checkEnabledCipherSuites.
getKeyType is now also used in OpenSSLSocketImpl.startHandshake to
avoid calling setCertificate for unnecessary key types.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
New CipherSuiteTest to cover new getKeyType as well as existing functionality
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/CipherSuiteTest.java
Add support to KeyManager implementation for key types of the form
EC_EC and EC_RSA. The first part implies the KeyPair algorithm (EC in
these new key types) with a potentially different signature algorithm
(EC vs RSA in these)
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/KeyManagerImpl.java
Update NativeCrypto.keyType to support EC_EC and EC_RSA in addition to
EC which was added earlier. Change from array of KEY_TYPES to named
KEY_TYPE_* constants.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
Overhauled KeyManagerFactoryTest to cover EC, EC_EC, EC_RSA cases
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Changed TestKeyStore.createKeyStore from always using BKS to now use
JKS on the RI between BC EC Keys and RI X509 certificates. Because JKS
requires a password, we now default "password" on the RI.
support/src/test/java/libcore/java/security/TestKeyStore.java
luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java
support/src/test/java/libcore/java/security/StandardNames.java
TestKeyStore.create now accepts key types like EC_RSA. Changed
TestKeyStore.createKeys to allow a PrivateKeyEntry to be specified for
signing to enable creation of EC_RSA test certificate. Added
getRootCertificate/rootCertificate to allow lookup of PrivateKeyEntry
for signing. Changed TestKeyStore.getPrivateKey to take explicit
signature algorithm to retrieve EC_EC vs EC_RSA entries.
support/src/test/java/libcore/java/security/TestKeyStore.java
luni/src/test/java/libcore/java/security/KeyStoreTest.java
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
luni/src/test/java/libcore/java/security/cert/PKIXParametersTest.java
luni/src/test/java/libcore/javax/net/ssl/TrustManagerFactoryTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Added support for EC cipher suites on the RI. Also test with and
without new TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite which is
used to specify the new TLS secure renegotiation.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
support/src/test/java/libcore/java/security/StandardNames.java
New TestKeyManager and additional logging in TestTrustManager. Logging
in both is disabled by default using DevNullPrintStream.
support/src/test/java/libcore/javax/net/ssl/TestKeyManager.java
support/src/test/java/libcore/javax/net/ssl/TestTrustManager.java
support/src/test/java/libcore/java/io/DevNullPrintStream.java
Bug: 3058375
Change-Id: Ia5e2a00a025858e10d1076b900886994b481e05a
|
| a5c608e59f9d574ea4bc65e9dff44aae2f34fd26 |
|
01-Nov-2010 |
Brian Carlstrom <bdc@google.com> |
TrustManager improvements
Overhaul of TrustManagerImpl
- PKIXParameters can now be final in TrustManagerImpl because we
always immediately create an IndexedPKIXParameters instead of only
doing it in SSLParametersImpl.createDefaultTrustManager.
- Use new KeyStore constructor for IndexedPKIXParameters to remove
duplicate logic for creating set of TrustAnchors from a KeyStore.
- Improved checkTrusted/cleanupCertChain to remove special cases for
directly trusting the end cert or pruning only self signed certs. To
support b/2530852, we need to stop prune the chain as soon as we
find any trust anchor (using newly improved
TrustManagerImpl.isTrustAnchor), which could be at the beginning,
middle, or end. That means cleanupCertChain can return an empty
chain if everything was trusted directly. (and we don't need to do
extra checks on exception cases to see if the problem was just that
the trust anchor was in the chain)
- isDirectlyTrusted -> isTrustAnchor here as well, using new
IndexedPKIXParameters.isTrustAnchor APIs
- Fix incorrect assumption in getAcceptedIssuers that all TrustAnchor
instances have non-null results for getTrustedCert.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/TrustManagerImpl.java
Removed indexing in createDefaultTrustManager since we always index now
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLParametersImpl.java
Overhaul of IndexedPKIXParameters
- Single map from subject X500Principal to TrustAnchors
instead of two different X500Principal keyed maps to check
- Removed map based on encoded cert. For b/2530852, we want to treat
certs as equal if they have the same name and public key, not
byte-for-byte equality, which can be done with the remaining map.
Revamped isDirectlyTrusted into isTrustAnchor(cert) to perform this
new name/key based comparison.
- Added helper isTrustAnchor(cert, anchors) to reuse code in
non-IndexedPKIXParameters case in TrustManagerImpl.
- Added constructor from KeyStore
- Moved anchor indexing code to index() from old constructor
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/IndexedPKIXParameters.java
TestKeyStore.getPrivateKey allowed some existing test simplification.
luni/src/test/java/libcore/java/security/KeyStoreTest.java
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
support/src/test/java/libcore/java/security/TestKeyStore.java
Added missing "fail()" before catching expected exceptions.
luni/src/test/java/libcore/java/security/KeyStoreTest.java
Expanded KeyManagerFactoryTest to excercise ManagerFactoryParameters b/1628001
luni/src/test/java/libcore/javax/net/ssl/KeyManagerFactoryTest.java
Added KeyStoreBuilderParametersTest because I thought I saw a bug in
KeyStoreBuilderParameters, but this convinced me otherwise.
luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java
New TrustManagerFactory test modeled on expanded KeyManagerFactoryTest.
test_TrustManagerFactory_intermediate specifically is targeting the
new functionality of b/2530852 to handling trust anchors within the
chain.
luni/src/test/java/libcore/javax/net/ssl/TrustManagerFactoryTest.java
support/src/test/java/libcore/java/security/StandardNames.java
Some initial on tests for Elliptic Curve (b/3058375) after the RI
started reporting it was supported. Removed old @KnownFailure
tags. Skipped a test on the RI that it can't handle. Improved some
assert messages.
luni/src/test/java/libcore/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
support/src/test/java/libcore/java/security/StandardNames.java
support/src/test/java/libcore/java/security/TestKeyStore.java
Removed unneeded bytes->javax->bytes->java case of which can just go bytes->java directly.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Removed super()
luni/src/main/java/javax/net/ssl/KeyStoreBuilderParameters.java
Made Security.secprops final
luni/src/main/java/java/security/Security.java
Pulled SamplingProfiler fix from dalvik-dev branch
git cherry-pick --no-commit f9dc3450e8f23cab91efc9df99bb860221ac3d6c
dalvik/src/main/java/dalvik/system/SamplingProfiler.java
Bug: 2530852
Change-Id: I95e0c7ee6a2f66b6986b3a9da9583d1ae52f94dd
|
| df9c090e85c4d052cdd17b5f981819be86a56737 |
|
01-Oct-2010 |
Brian Carlstrom <bdc@google.com> |
SSL* AppData should not hold onto JNI global references
Summary:
NativeCrypto.SSL_do_handshake stored JNI global references in its
AppData instance for use in upcalls from OpenSSL that invoke Java
callbacks. However, one of the references was to the
SSLHandshakeCallbacks which in the common case of OpenSSLSocketImpl is
the OpenSSLSocketImpl instance itself. This meant that if code dropped
the OpenSSLSocketImpl without closing (such as Apache HTTP Client),
the instances would never be collected, and perhaps more importantly,
file descriptors would not be closed.
The fix is to pass in the objects required during a callback in all
downcalls to SSL_* methods that could result in a callback and clear
them on return. The existing code already did this for the JNIEnv*, so
that code was expanded to handle setting the jobjects as well.
Details:
In the native code used to extract the FileDescriptor object from a
Socket on the call to NativeCrypto.SSL_do_handshake. However, since we
need this for every read and write operations, we now do this in Java
to avoid the repeated overhead. NativeCrypto.SSL_do_handshake now
takes a FileDescriptor, which it extracted from the Socket the
convenience function using NativeCrypto.getFileDescriptor(Socket)
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
In addition to tracking changes to pass FileDescriptor and
SSLHandshakeCallbacks, removed final uses of getFieldId since the
code no longer needs to extract FileDescriptors itself
luni/src/main/native/NativeCrypto.cpp
The Socket field used to be non-null in the wrapper case and null in
the non-wrapper case. To simplify things a bit, "socket == this" in
the non-wrapper case. The socket field is now also final and joined by
a final FileDescriptor field.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Updated NativeCryptoTest to track FileDescriptor and
SSLHandshakeCallbacks by expanding the Hooks.afterHandshake to provide
them. Also changed to add a 5 second timeout to many test cases.
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Bug: 2989218
Change-Id: Iccef92b59475f3c1929e990893579493ece9d442
|
| df349b3eaf4d1fa0643ab722173bc3bf20a266f5 |
|
14-Sep-2010 |
Brian Carlstrom <bdc@google.com> |
Fix HttpsURLConnectionTest failures
Focusing on HttpsURLConnectionTest.test_doOutput found a number of
unrelated issues, all of which are addressed by this change:
- {HttpURLConnection,HttpsURLConnection}.connect not ignored on subsequent calls
- OpenSSLSessionImpl.{getPeerCertificates,getPeerCertificateChain} did not include client certificate
- OpenSSLSocketImpl.getSession did not skip handshake when SSLSession was already available
- Fix 3 test issues in HttpsURLConnectionTest
- Fix 2 test issues in NativeCryptoTest
Details:
HttpsURLConnectionTest tests (such as test_doOutput) that
tried to call URLConnection.connect() at the end of the test
were raising exception. The RI URLConnection.connect
documentation says calls on connected URLConnections should be ignored.
Use "connected" instead of "connection != null" as reason to ignore "connect"
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/http/HttpURLConnectionImpl.java
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/https/HttpsURLConnectionImpl.java
Converted one caller of getPeerCertificateChain to
getPeerCertificates which is the new fast path. Track
OpenSSLSessionImpl change to take "java" vs "javax" certificates.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/AbstractSessionContext.java
Move SSL_SESSION_get_peer_cert_chain to be SSL_get_peer_cert_chain
(similar to SSL_get_certificate). The problem was that
SSL_SESSION_get_peer_cert_chain used SSL_get_peer_cert_chain which
in the server case did not include the client cert itself, which
required a call to SSL_get_peer_certificate, which needed the
SSL instance pointer.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/native/NativeCrypto.cpp
Improved NativeCrypto_SSL_set_verify tracing
luni/src/main/native/NativeCrypto.cpp
As a side effect of the move to
NativeCrypto.SSL_get_peer_certificate, it no longer made sense to
lazily create the peer certificate chain since the SSLSession
should not depend on a particular SSL instance. The peer chain is
now passed in as part of the constructor and the peerCertifcates
in the OpenSSLSession can be final (also made localCertificates
final). Since peerCertifcates is the newew (java not javax) API
and more commonly used, it is what is created from the native
code, and peerCertificateChain is not derived from peerCertifcates
instead of vice versa.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSessionImpl.java
Factored out code to used to create local certificate chain to
from array of DER byte arrays into createCertChain so it can be
reused to create peer certificate chain.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Fix OpenSSLSocketImpl.getSession to check for existing sslSession
to and skip handshake, which was causing an exception if the
connection had already been closed.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Fix test issues: Removed PrintStream wrapper of System.out which
was causing vogar to lose output. Added null check in closeSocket,
which can happen in timeout case. Removed use of
InputStream.available which in OpenSSLSocket case returned 0,
causing test to fail incorrectly.
luni/src/test/java/org/apache/harmony/luni/tests/internal/net/www/protocol/https/HttpsURLConnectionTest.java
Updating to track change to SSL_get_peer_cert_chain. Also fixed
some other unrelated test failures caused by IOException on
shutdown and false start (aka SSL_MODE_HANDSHAKE_CUTTHROUGH)
causing clientCallback.handshakeCompleted to be false.
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Bug: b/2981767
Change-Id: Id083beb6496558296c2f74f51ab0970e158b23a9
|
| 4557728efb66c455a52b7669a8eefef7a9e54854 |
|
11-Aug-2010 |
Jesse Wilson <jessewilson@google.com> |
Moving tests to be under the libcore.* package.
This is indended to make it easier to run on VMs that restrict the packages
from which application classes can be loaded. For example, on the RI you need
to use the bootclasspath to load these tests.
Change-Id: I52193f35c5fcca18b5a3e1d280505b1e29b388af
|
| 4559b1d37edcb5d7f1da086cf2e3290388d74f46 |
|
23-Jul-2010 |
Brian Carlstrom <bdc@google.com> |
Support for TLS Extensions enabled SSLSockets with fallback to vanila SSL
See also b/1569612
Summary:
- OpenSSlSocket support for SNI, session tickets, compression
- URLConnection mimics Chrome behavior of trying connection with these enabled,
falling back to SSL w/o encryption on failure
Details:
libcore
URLConnection https retry
Change HttpConnection.getSecureSocket to enable non-standard features on first
connection attempt. On second attempt, we back off to SSLv3 from
TLSv1, mimicking Chrome's behavior.
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/http/HttpConnection.java
Change HttpsEngine.connect to implement SSL reconnect
luni/src/main/java/org/apache/harmony/luni/internal/net/www/protocol/https/HttpsURLConnectionImpl.java
OpenSSL SSLSocket implementation
OpenSSLSocketImpl and OpenSSLServerSocketImpl now have an array of
enabled compression methods interface and implementation to
parallel that of procotols and ciphersuites.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLServerSocketImpl.java
OpenSSLSessionImpl now has a cache of the native
compressionMethod. Also replaced "gives" javadoc working with
"returns".
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSessionImpl.java
OpenSSLSocketImpl session caching now needs to skip cached
sessions with mismatched compression requirements.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
OpenSSLSocketImpl.startHandshake now uses NativeCrypto to support
our non-standard extensions.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
NativeCrypto changes
- Added declaration of SSL options for tickets and compression.
- Added general "compression methods" interface
paralleling "cipher suites" and "protocols" interfaces.
- Added SSL_set_tlsext_host_name to set SNI (Server Name Indication) value
- Added SSL_get_servername to read SNI (Server Name Indication) value
- Added SSL_SESSION_compress_meth read negotiated compression method
- SSL_new makes sure to default compression to off for compatibility
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/native/NativeCrypto.cpp
Testing
Added URLConnectionTest.testConnectViaHttpsWithSSLFallback to make
sure we properly retry an https connection if the server
terminates unexpectedly. Fixed up
URLConnectionTest.testHttpsWithCustomTrustManager with new
expected certificate chain. Fixed a few mistaken
TestSSLContext.serverContext uses to clientContext
luni/src/test/java/java/net/URLConnectionTest.java
Added test_SSL_set_tlsext_host_name, test_SSL_get_servername,
test_SSL_SESSION_compress_meth. Added a number of missing fail()
calls in expected exception cases which caught one test with
mistaken expectations. Removed some unnecessary scopes. Fixed some
badly scoped catch blocks.
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Changed MockWebServer to support a new MockResponse propery of
disconnectAtStart, which immediately terminates the connection
support/src/test/java/tests/http/MockResponse.java
support/src/test/java/tests/http/MockWebServer.java
external/openssl
Restore -ZLIB to OpenSSL build. Note that NativeCrypto.SSL_new
disables compression by for default SSLSocket for compatibility.
android-config.mk
Force clean build with new CFLAGS
CleanSpec.mk
Change-Id: Iba6268f9096f2be43f0d30de151dd3fd0aea4a81
|
| 6882e31b7ce2d04ebbc91c7a55d7840e8fdce8a5 |
|
20-Jul-2010 |
Brian Carlstrom <bdc@google.com> |
Bring SSLSocketImpl and SSLEngine in line with OpenSSLSocketImpl's cipher suites
Wrote an interoperability test between our OpenSSL and SSLEngine
based SSLSocket implementations. Used it to flush out problems between
the implementations, which mostly were in the non-native implementation.
Filling out the SSLEngine (and therefore non-native SSLSocket) support
led to the list of supported and default cipher suites now being the
same as out OpenSSL SSLSocket. Most of the work was making the the
NULL, RC4, and AES ciphers work with SSLEngine as well as some minor
bug fixes in related code.
Summary:
- changing test_SSLSocket_getSupportedCipherSuites_connect to try all
combinations of our two SSLContext/SSLSocket implementations
- fixed SSLEngine with *_WITH_NULL_* CipherSuites to use javax.crypto.NullCipher
- added *_AES_* cipher suites to SSLEngine (and therefore Java SSLSocketImpl)
- remove *_DH_* cipher suites which are not supported by the RI or our OpenSSL implementation
- fixed Java SSLSocket to not handshake on accept so will pass the basic SSLSocketTest
- added new KeyManagerFactoryTest while testing "DH_" cipher suite key types
This change depends on restoring bouncycastle's RC4 implementation (separate CL in external/bouncycastle)
Details:
Fixed SSLEngine with *_WITH_NULL_* CipherSuites by use javax.crypto.NullCipher
expectations/knownfailures.txt
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ConnectionStateSSLv3.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ConnectionStateTLS.java
Previously I had changed the string name of CipherSuites from
"TLS_..." to "SSL_..." where appropriate to match the RI. Since I was
doing maintenance on overall list, I renamed the CODE_TLS_... and
TLS_... static fields as well to match.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLSessionImpl.java
Removed IDEA and RC2 CipherSuites to make it clear they are not
supported. While technically this happened as a side effect of the
assignment "supported = false" if the CipherSuite failed to load, we
truly intend not to support these. Also removed SSH_DH_* suites which
don't work with DSA keys and aren't supported by the RI or our OpenSSL
implementation.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/CipherSuite.java
Old connection state code assumed that if a cipher was blocked, the
block size was 8 bytes. This is not true for the 16 byte AES ciphers.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ConnectionState.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ConnectionStateSSLv3.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/ConnectionStateTLS.java
No wonder our OpenSSL implementation incorrect did a startHandshake
when accepting the socket... it got it from the Java implementation.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/SSLServerSocketImpl.java
Test for KeyManagerFactory (and KeyManager). TestKeyStore now creates
KeyManagers and TrustManagers from the keystore as a convenience for
KeyManagerFactoryTest (instead of having the code in the
TestSSLContext where we didn't keep a pointer to the created values).
luni/src/test/java/javax/net/ssl/KeyManagerFactoryTest.java
support/src/test/java/java/security/StandardNames.java
support/src/test/java/java/security/TestKeyStore.java
support/src/test/java/javax/net/ssl/TestSSLContext.java
Remove CIPHER_SUITES_SSLENGINE now that its the same as CIPHER_SUITES
luni/src/test/java/javax/net/ssl/SSLEngineTest.java
support/src/test/java/java/security/StandardNames.java
test_SSLSocket_getSupportedCipherSuites_connect now does
interoperability testing not just between the default SSLContext's
SSLSockets but between the four combinations of our two SSLContext. It
also now sends some test data bi-directionally between the client and
server.
luni/src/test/java/javax/net/ssl/SSLSocketTest.java
Changed TestSSLContext.create to allow a different Provider for the
client and server SSLContexts.
luni/src/test/java/javax/net/ssl/SSLEngineTest.java
luni/src/test/java/javax/net/ssl/SSLSocketTest.java
support/src/test/java/javax/net/ssl/TestSSLContext.java
RC4 is now available in bouncycastle for the non-OpenSSL SSLContext to
use for parity with the OpenSSL implementation.
support/src/test/java/java/security/StandardNames.java
Changed TestSSLSocketPair to use Futures like NativeCryptoTest so its
easier to choose between client and server errors while debuging.
support/src/test/java/javax/net/ssl/TestSSLSocketPair.java
Removed bogus import
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Change-Id: I080c0343a3f86f27b7c191a7b80b585b9ca52d93
|
| ef628d1464e57552403ad43366e153c1ef50b926 |
|
19-Jul-2010 |
Brian Carlstrom <bdc@google.com> |
New NativeCryptoTest, NativeCrypto.{SSL_set_client_CA_list, SSL_renegotiate}, fixes for other minor bugs exposed by test
Summary:
- New NativeCryptoTest covering NativeCrypto SSL APIs
- Added SSL_set_client_CA_list for server to specify acceptable client cert issues
- Added SSL_renegotiate for renegoiation testing
- Removed unneeded d2i_SSL_SESSION argument
- Added OpenSSLSocketImpl read/write bounds checking
- Added NULL checks on AppData to avoid native crashes on use of SSL before handshake
Details:
Corrected NativeCrypto thrown exceptions based on
NativeCryptoTest. Of note, we now throw NullPointerException
instead of SSLException for simple null issues in NativeCrypto.cpp
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSessionImpl.java
luni/src/main/native/NativeCrypto.cpp
Created NativeCrypto.{encodeCertificates,encodeIssuerX509Principals} to
factor out some code out of OpenSSLSocketImpl that any user of
NativeCrypto.{SSL_use_certificate, SSL_set_client_CA_list} would
find useful.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Added SSL_set_client_CA_list to allow server to provide list of
issuers acceptable for client certifcates.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
luni/src/main/native/NativeCrypto.cpp
Added SSL_renegotiate to allow unit testing of SSL renegoiation.
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/native/NativeCrypto.cpp
Removed d2i_SSL_SESSION size argument since it should be same as length of other argument
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/NativeCrypto.java
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSessionImpl.java
luni/src/main/native/NativeCrypto.cpp
Added bounds checking to getInputStream.read(byte[], ...) and
getOutputStream().write(byte[], ...)
luni/src/main/java/org/apache/harmony/xnet/provider/jsse/OpenSSLSocketImpl.java
Added NULL checks on AppData to avoid native crashes.
luni/src/main/native/NativeCrypto.cpp
New test of NativeCrypto SSL APIs
luni/src/test/java/org/apache/harmony/xnet/provider/jsse/NativeCryptoTest.java
Change-Id: I2fb7a40761e66320f73b02880e6e43def9594497
|