ProvSSLEngine.unwrap should process whole records only
import org.bouncycastle.tls.TlsClientProtocol;
import org.bouncycastle.tls.TlsProtocol;
import org.bouncycastle.tls.TlsServerProtocol;
+import org.bouncycastle.tls.TlsUtils;
/*
* TODO[jsse] Currently doesn't properly support NIO usage, or conform very well with SSLEngine javadoc
@@ -323,17 +324,24 @@ public synchronized SSLEngineResult unwrap(ByteBuffer src, ByteBuffer[] dsts, in
int bytesConsumed = 0, bytesProduced = 0;
if (!protocol.isClosed())
+ {
+ if (src.remaining() >= 5)
+ {
+ byte[] recordHeader = new byte[5];
+ src.slice().get(recordHeader);
+
+ int recordSize = TlsUtils.readUint16(recordHeader, 3) + 5;
+ if (recordSize > ProvSSLSessionImpl.NULL_SESSION.getPacketBufferSize())
{
/*
- * Limit the net data that we will process in one call
- * TODO[jsse] Ideally, we'd be processing exactly one record at a time
+ * TODO[jsse] Prefer to have the TLS layer raise a record_overflow alert
*/
- int srcLimit = ProvSSLSessionImpl.NULL_SESSION.getApplicationBufferSize() + 5;
+ throw new SSLException("Input record has invalid size: " + recordSize);
+ }
- int count = Math.min(src.remaining(), srcLimit);
- if (count > 0)
+ if (src.remaining() >= recordSize)
{
- byte[] buf = new byte[count];
+ byte[] buf = new byte[recordSize];
src.get(buf);
try
@@ -363,8 +371,8 @@ public synchronized SSLEngineResult unwrap(ByteBuffer src, ByteBuffer[] dsts, in
return new SSLEngineResult(Status.OK, HandshakeStatus.NEED_WRAP, bytesConsumed, bytesProduced);
}
- bytesConsumed += count;
- srcLimit -= count;
+ bytesConsumed += recordSize;
+ }
}
}
