ClientHandshake.java (RSAGen.implRun): check keyEncipherment bit of the certificate...

2007-03-28  Casey Marshall  <csm@gnu.org>

	* gnu/javax/net/ssl/provider/ClientHandshake.java (RSAGen.implRun):
	check keyEncipherment bit of the certificate, and just pass the public
	key to the cipher.

From-SVN: r123307

diff --git a/libjava/classpath/ChangeLog b/libjava/classpath/ChangeLog
index 376c072852dfc2bacc25437cd5be6e41263190e3..caa611a55cd8366c6c3688725db66cd30d11c154 100644 (file)
--- a/libjava/classpath/ChangeLog
+++ b/libjava/classpath/ChangeLog
@@ -1,3 +1,9 @@
+2007-03-28  Casey Marshall  <csm@gnu.org>
+
+       * gnu/javax/net/ssl/provider/ClientHandshake.java (RSAGen.implRun):
+       check keyEncipherment bit of the certificate, and just pass the public
+       key to the cipher.
+
 2007-03-27  Casey Marshall  <csm@gnu.org>
 
        PR classpath/31302:

diff --git a/libjava/classpath/gnu/javax/net/ssl/provider/ClientHandshake.java b/libjava/classpath/gnu/javax/net/ssl/provider/ClientHandshake.java
index 059b165a67d801a0a6de684a0ebceee7d8e584fe..a8780084508c1c5b88e0225ecf26a6e6923cc19e 100644 (file)
--- a/libjava/classpath/gnu/javax/net/ssl/provider/ClientHandshake.java
+++ b/libjava/classpath/gnu/javax/net/ssl/provider/ClientHandshake.java
@@ -1082,7 +1082,13 @@ outer_loop:
       Cipher rsa = Cipher.getInstance("RSA");
       java.security.cert.Certificate cert
         = engine.session().getPeerCertificates()[0];
-      rsa.init(Cipher.ENCRYPT_MODE, cert);
+      if (cert instanceof X509Certificate)
+        {
+          boolean[] keyUsage = ((X509Certificate) cert).getKeyUsage();
+          if (keyUsage != null && !keyUsage[2])
+            throw new InvalidKeyException("certificate's keyUsage does not permit keyEncipherment");
+        }
+      rsa.init(Cipher.ENCRYPT_MODE, cert.getPublicKey());
       encryptedPreMasterSecret = rsa.doFinal(preMasterSecret);
       
       // Generate our session keys, because we can.

diff --git a/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$GenCertVerify.class b/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$GenCertVerify.class
index 51a1a2b9508b9485178006cc90e8cb8026aaa38e..c614ed58477223762e42fd638c17940d6c814afb 100644 (file)
Binary files a/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$GenCertVerify.class and b/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$GenCertVerify.class differ

diff --git a/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$RSAGen.class b/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$RSAGen.class
index c7a8f8760dbaedb3b158172c3bb4ce05c62cdbc2..6d99e3e3b8ab3945c67881931c05d1f85bef1a3d 100644 (file)
Binary files a/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$RSAGen.class and b/libjava/classpath/lib/gnu/javax/net/ssl/provider/ClientHandshake$RSAGen.class differ