Author: dehort Date: 2011-03-18 11:10:05 -0400 (Fri, 18 Mar 2011) New Revision: 1684 Modified: branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESupport.java branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/webapps/docs/changelog.xml Log: back porting patch for JBPAPP-6139 Modified: branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java =================================================================== --- branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java 2011-03-18 14:55:17 UTC (rev 1683) +++ branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java 2011-03-18 15:10:05 UTC (rev 1684) @@ -51,6 +51,7 @@ import javax.net.ssl.SSLException; import javax.net.ssl.SSLServerSocket; import javax.net.ssl.SSLServerSocketFactory; +import javax.net.ssl.SSLSession; import javax.net.ssl.SSLSessionContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.TrustManager; @@ -152,40 +153,24 @@ SSLSocket asock = null; try { asock = (SSLSocket)socket.accept(); - if (!allowUnsafeLegacyRenegotiation) { - asock.addHandshakeCompletedListener( - new DisableSslRenegotiation()); - } - configureClientAuth(asock); } catch (SSLException e){ throw new SocketException("SSL handshake error" + e.toString()); } return asock; } - private static class DisableSslRenegotiation - implements HandshakeCompletedListener { - private volatile boolean completed = false; + public void handshake(Socket sock) throws IOException { + // We do getSession instead of startHandshake() so we can call this multiple times + SSLSession session = ((SSLSocket)sock).getSession(); + if (session.getCipherSuite().equals("SSL_NULL_WITH_NULL_NULL")) + throw new IOException("SSL handshake failed. Ciper suite in SSL Session is SSL_NULL_WITH_NULL_NULL"); - public void handshakeCompleted(HandshakeCompletedEvent event) { - if (completed) { - try { - log.warn("SSL renegotiation is disabled, closing connection"); - event.getSession().invalidate(); - event.getSocket().close(); - } catch (IOException e) { - // ignore - } - } - completed = true; + if (!allowUnsafeLegacyRenegotiation) { + // Prevent futher handshakes by removing all cipher suites + ((SSLSocket) sock).setEnabledCipherSuites(new String[0]); } } - - public void handshake(Socket sock) throws IOException { - ((SSLSocket)sock).startHandshake(); - } - /* * Determines the SSL cipher suites to be enabled. * Modified: branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESupport.java =================================================================== --- branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESupport.java 2011-03-18 14:55:17 UTC (rev 1683) +++ branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/java/org/apache/tomcat/util/net/jsse/JSSESupport.java 2011-03-18 15:10:05 UTC (rev 1684) @@ -148,6 +148,15 @@ ssl.setNeedClientAuth(true); } + if (ssl.getEnabledCipherSuites().length == 0) { + // Handshake is never going to be successful. + // Assume this is because handshakes are disabled + log.warn("SSL server initiated renegotiation is disabled, closing connection"); + session.invalidate(); + ssl.close(); + return; + } + InputStream in = ssl.getInputStream(); int oldTimeout = ssl.getSoTimeout(); ssl.setSoTimeout(1000); @@ -170,10 +179,7 @@ break; } } - // If legacy re-negotiation is disabled, socked could be closed here - if (!ssl.isClosed()) { - ssl.setSoTimeout(oldTimeout); - } + ssl.setSoTimeout(oldTimeout); if (listener.completed == false) { throw new SocketException("SSL Cert handshake timeout"); } Modified: branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/webapps/docs/changelog.xml =================================================================== --- branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/webapps/docs/changelog.xml 2011-03-18 14:55:17 UTC (rev 1683) +++ branches/JBOSSWEB_2_1_7_GA_JBPAPP-6139/webapps/docs/changelog.xml 2011-03-18 15:10:05 UTC (rev 1684) @@ -15,6 +15,15 @@ </properties> <body> +<section name="JBoss Web 2.1.11.GA (remm)"> + <subsection name="Coyote"> + <changelog> + <fix> + <jboss-jira>JBPAPP-5293</jboss-jira>: ConcurrentModificationException in HandshakeCompletedNotify-Thread. (remm) + </fix> + </changelog> + </subsection> +</section> <section name="JBoss Web 2.1.7.GA (remm)"> <subsection name="Coyote">