This is the mail archive of the
java-patches@gcc.gnu.org
mailing list for the Java project.
Patch: FYI: SSL fix from Casey
- From: Tom Tromey <tromey at redhat dot com>
- To: GCJ-patches <java-patches at gcc dot gnu dot org>
- Date: 28 Mar 2007 12:09:16 -0600
- Subject: Patch: FYI: SSL fix from Casey
- Reply-to: tromey at redhat dot com
I'm checking this in on the trunk and the RH 4.1 branch.
This is a small SSL fix from Casey that appeared to be both important
and low-risk.
Tom
Index: ChangeLog
from Casey Marshall <csm@gnu.org>
* gnu/javax/net/ssl/provider/ClientHandshake.java (RSAGen.implRun):
check keyEncipherment bit of the certificate, and just pass the public
key to the cipher.
Index: gnu/javax/net/ssl/provider/ClientHandshake.java
===================================================================
--- gnu/javax/net/ssl/provider/ClientHandshake.java (revision 123266)
+++ gnu/javax/net/ssl/provider/ClientHandshake.java (working copy)
@@ -1082,7 +1082,13 @@
Cipher rsa = Cipher.getInstance("RSA");
java.security.cert.Certificate cert
= engine.session().getPeerCertificates()[0];
- rsa.init(Cipher.ENCRYPT_MODE, cert);
+ if (cert instanceof X509Certificate)
+ {
+ boolean[] keyUsage = ((X509Certificate) cert).getKeyUsage();
+ if (keyUsage != null && !keyUsage[2])
+ throw new InvalidKeyException("certificate's keyUsage does not permit keyEncipherment");
+ }
+ rsa.init(Cipher.ENCRYPT_MODE, cert.getPublicKey());
encryptedPreMasterSecret = rsa.doFinal(preMasterSecret);
// Generate our session keys, because we can.