@Test public void testAdjustTLSContextWithUnparsableCertificate() { for (ProtocolVersion version : new ProtocolVersion[] { ProtocolVersion.SSL3, ProtocolVersion.TLS10, ProtocolVersion.TLS11, ProtocolVersion.TLS12 }) { context.setTalkingConnectionEndType(ConnectionEndType.CLIENT); context.setSelectedProtocolVersion(version); CertificateMessage message = new CertificateMessage(); message.setCertificatesListBytes(new byte[] { 0, 1, 2, 3, 4 }); message.setCertificatesListLength(5); handler.adjustTLSContext(message); assertNull(context.getClientCertificate()); assertNull(context.getServerCertificate()); context.setTalkingConnectionEndType(ConnectionEndType.SERVER); context.setSelectedProtocolVersion(version); message.setCertificatesListBytes(new byte[] { 0, 1, 2, 3, 4 }); handler.adjustTLSContext(message); assertNull(context.getClientCertificate()); assertNull(context.getServerCertificate()); } }
@Override public void adjustTLSContext(CertificateMessage message) { switch (selectTypeInternally()) { case OPEN_PGP: throw new UnsupportedOperationException("We do not support OpenPGP keys"); case RAW_PUBLIC_KEY: LOGGER.debug("Adjusting context for RAW PUBLIC KEY ceritifate message"); try { ASN1InputStream asn1Stream = new ASN1InputStream(message.getCertificatesListBytes().getValue()); DLSequence dlSeq = (DLSequence) asn1Stream.readObject(); DLSequence identifier = (DLSequence) dlSeq.getObjectAt(0); NamedGroup group = null; ASN1ObjectIdentifier keyType = (ASN1ObjectIdentifier) identifier.getObjectAt(0); if (keyType.getId().equals("1.2.840.10045.2.1")) { ASN1ObjectIdentifier curveType = (ASN1ObjectIdentifier) identifier.getObjectAt(1); if (curveType.getId().equals("1.2.840.10045.3.1.7")) { group = NamedGroup.SECP256R1; } else { throw new UnsupportedOperationException( "We currently do only support secp256r1 public keys. Sorry..."); } DERBitString publicKey = (DERBitString) dlSeq.getObjectAt(1); byte[] pointBytes = publicKey.getBytes(); Point publicKeyPoint = PointFormatter.formatFromByteArray(group, pointBytes); if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.SERVER) { tlsContext.setServerEcPublicKey(publicKeyPoint); } else { tlsContext.setClientEcPublicKey(publicKeyPoint); } } else { throw new UnsupportedOperationException( "We currently do only support EC raw public keys. Sorry..."); } asn1Stream.close(); } catch (Exception E) { LOGGER.warn("Could read RAW PublicKey. Not adjusting context", E); } break; case X509: LOGGER.debug("Adjusting context for x509 ceritifate message"); Certificate cert; if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { ByteArrayOutputStream stream = new ByteArrayOutputStream(); int certificatesLength = 0; try { for (CertificatePair pair : message.getCertificatesList()) { stream.write(ArrayConverter.intToBytes(pair.getCertificateLength().getValue(), HandshakeByteLength.CERTIFICATE_LENGTH)); stream.write(pair.getCertificate().getValue()); certificatesLength += pair.getCertificateLength().getValue() + HandshakeByteLength.CERTIFICATE_LENGTH; } } catch (IOException ex) { throw new AdjustmentException("Could not concatenate certificates bytes", ex); } cert = parseCertificate(certificatesLength, stream.toByteArray()); } else { cert = parseCertificate(message.getCertificatesListLength().getValue(), message .getCertificatesListBytes().getValue()); } if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.CLIENT) { LOGGER.debug("Setting ClientCertificate in Context"); tlsContext.setClientCertificate(cert); } else { LOGGER.debug("Setting ServerCertificate in Context"); tlsContext.setServerCertificate(cert); } if (message.getCertificateKeyPair() != null) { LOGGER.debug("Found a certificate key pair. Adjusting in context"); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } else if (cert != null) { if (cert.isEmpty()) { LOGGER.debug("Certificate is empty - no adjustments"); } else { LOGGER.debug("No CertificatekeyPair found, creating new one"); CertificateKeyPair pair = new CertificateKeyPair(cert); message.setCertificateKeyPair(pair); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } } else { LOGGER.debug("Ceritificate not parseable - no adjustments"); } if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { adjustExtensions(message); } break; default: throw new UnsupportedOperationException("Unsupported CertificateType!"); } }
CertificateMessageHandler extends HandshakeMessageHandler<CertificateMessage> { @Override public void adjustTLSContext(CertificateMessage message) { switch (selectTypeInternally()) { case OPEN_PGP: throw new UnsupportedOperationException("We do not support OpenPGP keys"); case RAW_PUBLIC_KEY: LOGGER.debug("Adjusting context for RAW PUBLIC KEY ceritifate message"); try { ASN1InputStream asn1Stream = new ASN1InputStream(message.getCertificatesListBytes().getValue()); DLSequence dlSeq = (DLSequence) asn1Stream.readObject(); DLSequence identifier = (DLSequence) dlSeq.getObjectAt(0); NamedGroup group = null; ASN1ObjectIdentifier keyType = (ASN1ObjectIdentifier) identifier.getObjectAt(0); if (keyType.getId().equals("1.2.840.10045.2.1")) { ASN1ObjectIdentifier curveType = (ASN1ObjectIdentifier) identifier.getObjectAt(1); if (curveType.getId().equals("1.2.840.10045.3.1.7")) { group = NamedGroup.SECP256R1; } else { throw new UnsupportedOperationException( "We currently do only support secp256r1 public keys. Sorry..."); } DERBitString publicKey = (DERBitString) dlSeq.getObjectAt(1); byte[] pointBytes = publicKey.getBytes(); Point publicKeyPoint = PointFormatter.formatFromByteArray(group, pointBytes); if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.SERVER) { tlsContext.setServerEcPublicKey(publicKeyPoint); } else { tlsContext.setClientEcPublicKey(publicKeyPoint); } } else { throw new UnsupportedOperationException( "We currently do only support EC raw public keys. Sorry..."); } asn1Stream.close(); } catch (Exception E) { LOGGER.warn("Could read RAW PublicKey. Not adjusting context", E); } break; case X509: LOGGER.debug("Adjusting context for x509 ceritifate message"); Certificate cert; if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { ByteArrayOutputStream stream = new ByteArrayOutputStream(); int certificatesLength = 0; try { for (CertificatePair pair : message.getCertificatesList()) { stream.write(ArrayConverter.intToBytes(pair.getCertificateLength().getValue(), HandshakeByteLength.CERTIFICATE_LENGTH)); stream.write(pair.getCertificate().getValue()); certificatesLength += pair.getCertificateLength().getValue() + HandshakeByteLength.CERTIFICATE_LENGTH; } } catch (IOException ex) { throw new AdjustmentException("Could not concatenate certificates bytes", ex); } cert = parseCertificate(certificatesLength, stream.toByteArray()); } else { cert = parseCertificate(message.getCertificatesListLength().getValue(), message .getCertificatesListBytes().getValue()); } if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.CLIENT) { LOGGER.debug("Setting ClientCertificate in Context"); tlsContext.setClientCertificate(cert); } else { LOGGER.debug("Setting ServerCertificate in Context"); tlsContext.setServerCertificate(cert); } if (message.getCertificateKeyPair() != null) { LOGGER.debug("Found a certificate key pair. Adjusting in context"); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } else if (cert != null) { if (cert.isEmpty()) { LOGGER.debug("Certificate is empty - no adjustments"); } else { LOGGER.debug("No CertificatekeyPair found, creating new one"); CertificateKeyPair pair = new CertificateKeyPair(cert); message.setCertificateKeyPair(pair); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } } else { LOGGER.debug("Ceritificate not parseable - no adjustments"); } if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { adjustExtensions(message); } break; default: throw new UnsupportedOperationException("Unsupported CertificateType!"); } } }
CertificateMessageHandler extends HandshakeMessageHandler<CertificateMessage> { @Override public void adjustTLSContext(CertificateMessage message) { switch (selectTypeInternally()) { case OPEN_PGP: throw new UnsupportedOperationException("We do not support OpenPGP keys"); case RAW_PUBLIC_KEY: LOGGER.debug("Adjusting context for RAW PUBLIC KEY ceritifate message"); try { ASN1InputStream asn1Stream = new ASN1InputStream(message.getCertificatesListBytes().getValue()); DLSequence dlSeq = (DLSequence) asn1Stream.readObject(); DLSequence identifier = (DLSequence) dlSeq.getObjectAt(0); NamedGroup group = null; ASN1ObjectIdentifier keyType = (ASN1ObjectIdentifier) identifier.getObjectAt(0); if (keyType.getId().equals("1.2.840.10045.2.1")) { ASN1ObjectIdentifier curveType = (ASN1ObjectIdentifier) identifier.getObjectAt(1); if (curveType.getId().equals("1.2.840.10045.3.1.7")) { group = NamedGroup.SECP256R1; } else { throw new UnsupportedOperationException( "We currently do only support secp256r1 public keys. Sorry..."); } DERBitString publicKey = (DERBitString) dlSeq.getObjectAt(1); byte[] pointBytes = publicKey.getBytes(); Point publicKeyPoint = PointFormatter.formatFromByteArray(group, pointBytes); if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.SERVER) { tlsContext.setServerEcPublicKey(publicKeyPoint); } else { tlsContext.setClientEcPublicKey(publicKeyPoint); } } else { throw new UnsupportedOperationException( "We currently do only support EC raw public keys. Sorry..."); } asn1Stream.close(); } catch (Exception E) { LOGGER.warn("Could read RAW PublicKey. Not adjusting context", E); } break; case X509: LOGGER.debug("Adjusting context for x509 ceritifate message"); Certificate cert; if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { ByteArrayOutputStream stream = new ByteArrayOutputStream(); int certificatesLength = 0; try { for (CertificatePair pair : message.getCertificatesList()) { stream.write(ArrayConverter.intToBytes(pair.getCertificateLength().getValue(), HandshakeByteLength.CERTIFICATE_LENGTH)); stream.write(pair.getCertificate().getValue()); certificatesLength += pair.getCertificateLength().getValue() + HandshakeByteLength.CERTIFICATE_LENGTH; } } catch (IOException ex) { throw new AdjustmentException("Could not concatenate certificates bytes", ex); } cert = parseCertificate(certificatesLength, stream.toByteArray()); } else { cert = parseCertificate(message.getCertificatesListLength().getValue(), message .getCertificatesListBytes().getValue()); } if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.CLIENT) { LOGGER.debug("Setting ClientCertificate in Context"); tlsContext.setClientCertificate(cert); } else { LOGGER.debug("Setting ServerCertificate in Context"); tlsContext.setServerCertificate(cert); } if (message.getCertificateKeyPair() != null) { LOGGER.debug("Found a certificate key pair. Adjusting in context"); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } else if (cert != null) { if (cert.isEmpty()) { LOGGER.debug("Certificate is empty - no adjustments"); } else { LOGGER.debug("No CertificatekeyPair found, creating new one"); CertificateKeyPair pair = new CertificateKeyPair(cert); message.setCertificateKeyPair(pair); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } } else { LOGGER.debug("Ceritificate not parseable - no adjustments"); } if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { adjustExtensions(message); } break; default: throw new UnsupportedOperationException("Unsupported CertificateType!"); } } CertificateMessageHandler(TlsContext tlsContext); }
CertificateMessageHandler extends HandshakeMessageHandler<CertificateMessage> { @Override public void adjustTLSContext(CertificateMessage message) { switch (selectTypeInternally()) { case OPEN_PGP: throw new UnsupportedOperationException("We do not support OpenPGP keys"); case RAW_PUBLIC_KEY: LOGGER.debug("Adjusting context for RAW PUBLIC KEY ceritifate message"); try { ASN1InputStream asn1Stream = new ASN1InputStream(message.getCertificatesListBytes().getValue()); DLSequence dlSeq = (DLSequence) asn1Stream.readObject(); DLSequence identifier = (DLSequence) dlSeq.getObjectAt(0); NamedGroup group = null; ASN1ObjectIdentifier keyType = (ASN1ObjectIdentifier) identifier.getObjectAt(0); if (keyType.getId().equals("1.2.840.10045.2.1")) { ASN1ObjectIdentifier curveType = (ASN1ObjectIdentifier) identifier.getObjectAt(1); if (curveType.getId().equals("1.2.840.10045.3.1.7")) { group = NamedGroup.SECP256R1; } else { throw new UnsupportedOperationException( "We currently do only support secp256r1 public keys. Sorry..."); } DERBitString publicKey = (DERBitString) dlSeq.getObjectAt(1); byte[] pointBytes = publicKey.getBytes(); Point publicKeyPoint = PointFormatter.formatFromByteArray(group, pointBytes); if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.SERVER) { tlsContext.setServerEcPublicKey(publicKeyPoint); } else { tlsContext.setClientEcPublicKey(publicKeyPoint); } } else { throw new UnsupportedOperationException( "We currently do only support EC raw public keys. Sorry..."); } asn1Stream.close(); } catch (Exception E) { LOGGER.warn("Could read RAW PublicKey. Not adjusting context", E); } break; case X509: LOGGER.debug("Adjusting context for x509 ceritifate message"); Certificate cert; if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { ByteArrayOutputStream stream = new ByteArrayOutputStream(); int certificatesLength = 0; try { for (CertificatePair pair : message.getCertificatesList()) { stream.write(ArrayConverter.intToBytes(pair.getCertificateLength().getValue(), HandshakeByteLength.CERTIFICATE_LENGTH)); stream.write(pair.getCertificate().getValue()); certificatesLength += pair.getCertificateLength().getValue() + HandshakeByteLength.CERTIFICATE_LENGTH; } } catch (IOException ex) { throw new AdjustmentException("Could not concatenate certificates bytes", ex); } cert = parseCertificate(certificatesLength, stream.toByteArray()); } else { cert = parseCertificate(message.getCertificatesListLength().getValue(), message .getCertificatesListBytes().getValue()); } if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.CLIENT) { LOGGER.debug("Setting ClientCertificate in Context"); tlsContext.setClientCertificate(cert); } else { LOGGER.debug("Setting ServerCertificate in Context"); tlsContext.setServerCertificate(cert); } if (message.getCertificateKeyPair() != null) { LOGGER.debug("Found a certificate key pair. Adjusting in context"); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } else if (cert != null) { if (cert.isEmpty()) { LOGGER.debug("Certificate is empty - no adjustments"); } else { LOGGER.debug("No CertificatekeyPair found, creating new one"); CertificateKeyPair pair = new CertificateKeyPair(cert); message.setCertificateKeyPair(pair); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } } else { LOGGER.debug("Ceritificate not parseable - no adjustments"); } if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { adjustExtensions(message); } break; default: throw new UnsupportedOperationException("Unsupported CertificateType!"); } } CertificateMessageHandler(TlsContext tlsContext); @Override CertificateMessageParser getParser(byte[] message, int pointer); @Override CertificateMessagePreparator getPreparator(CertificateMessage message); @Override CertificateMessageSerializer getSerializer(CertificateMessage message); @Override void adjustTLSContext(CertificateMessage message); }
CertificateMessageHandler extends HandshakeMessageHandler<CertificateMessage> { @Override public void adjustTLSContext(CertificateMessage message) { switch (selectTypeInternally()) { case OPEN_PGP: throw new UnsupportedOperationException("We do not support OpenPGP keys"); case RAW_PUBLIC_KEY: LOGGER.debug("Adjusting context for RAW PUBLIC KEY ceritifate message"); try { ASN1InputStream asn1Stream = new ASN1InputStream(message.getCertificatesListBytes().getValue()); DLSequence dlSeq = (DLSequence) asn1Stream.readObject(); DLSequence identifier = (DLSequence) dlSeq.getObjectAt(0); NamedGroup group = null; ASN1ObjectIdentifier keyType = (ASN1ObjectIdentifier) identifier.getObjectAt(0); if (keyType.getId().equals("1.2.840.10045.2.1")) { ASN1ObjectIdentifier curveType = (ASN1ObjectIdentifier) identifier.getObjectAt(1); if (curveType.getId().equals("1.2.840.10045.3.1.7")) { group = NamedGroup.SECP256R1; } else { throw new UnsupportedOperationException( "We currently do only support secp256r1 public keys. Sorry..."); } DERBitString publicKey = (DERBitString) dlSeq.getObjectAt(1); byte[] pointBytes = publicKey.getBytes(); Point publicKeyPoint = PointFormatter.formatFromByteArray(group, pointBytes); if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.SERVER) { tlsContext.setServerEcPublicKey(publicKeyPoint); } else { tlsContext.setClientEcPublicKey(publicKeyPoint); } } else { throw new UnsupportedOperationException( "We currently do only support EC raw public keys. Sorry..."); } asn1Stream.close(); } catch (Exception E) { LOGGER.warn("Could read RAW PublicKey. Not adjusting context", E); } break; case X509: LOGGER.debug("Adjusting context for x509 ceritifate message"); Certificate cert; if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { ByteArrayOutputStream stream = new ByteArrayOutputStream(); int certificatesLength = 0; try { for (CertificatePair pair : message.getCertificatesList()) { stream.write(ArrayConverter.intToBytes(pair.getCertificateLength().getValue(), HandshakeByteLength.CERTIFICATE_LENGTH)); stream.write(pair.getCertificate().getValue()); certificatesLength += pair.getCertificateLength().getValue() + HandshakeByteLength.CERTIFICATE_LENGTH; } } catch (IOException ex) { throw new AdjustmentException("Could not concatenate certificates bytes", ex); } cert = parseCertificate(certificatesLength, stream.toByteArray()); } else { cert = parseCertificate(message.getCertificatesListLength().getValue(), message .getCertificatesListBytes().getValue()); } if (tlsContext.getTalkingConnectionEndType() == ConnectionEndType.CLIENT) { LOGGER.debug("Setting ClientCertificate in Context"); tlsContext.setClientCertificate(cert); } else { LOGGER.debug("Setting ServerCertificate in Context"); tlsContext.setServerCertificate(cert); } if (message.getCertificateKeyPair() != null) { LOGGER.debug("Found a certificate key pair. Adjusting in context"); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } else if (cert != null) { if (cert.isEmpty()) { LOGGER.debug("Certificate is empty - no adjustments"); } else { LOGGER.debug("No CertificatekeyPair found, creating new one"); CertificateKeyPair pair = new CertificateKeyPair(cert); message.setCertificateKeyPair(pair); message.getCertificateKeyPair().adjustInContext(tlsContext, tlsContext.getTalkingConnectionEndType()); } } else { LOGGER.debug("Ceritificate not parseable - no adjustments"); } if (tlsContext.getChooser().getSelectedProtocolVersion().isTLS13()) { adjustExtensions(message); } break; default: throw new UnsupportedOperationException("Unsupported CertificateType!"); } } CertificateMessageHandler(TlsContext tlsContext); @Override CertificateMessageParser getParser(byte[] message, int pointer); @Override CertificateMessagePreparator getPreparator(CertificateMessage message); @Override CertificateMessageSerializer getSerializer(CertificateMessage message); @Override void adjustTLSContext(CertificateMessage message);  }