Add check that server status_request extension_data is empty (RFC 3546)

1 files changed, 15 insertions, 0 deletions

diff --git a/core/src/main/java/org/bouncycastle/crypto/tls/DTLSProtocol.java b/core/src/main/java/org/bouncycastle/crypto/tls/DTLSProtocol.java
index e27580c1..350c6c2b 100644
--- a/core/src/main/java/org/bouncycastle/crypto/tls/DTLSProtocol.java
+++ b/core/src/main/java/org/bouncycastle/crypto/tls/DTLSProtocol.java
@@ -49,6 +49,21 @@ public abstract class DTLSProtocol
         return maxFragmentLength;
     }
 
+    protected static boolean evaluateStatusRequestExtension(Hashtable serverExtensions, short alertDescription)
+        throws IOException
+    {
+        byte[] statusRequest = TlsUtils.getExtensionData(serverExtensions, TlsExtensionsUtils.EXT_status_request);
+        if (statusRequest == null)
+        {
+            return false;
+        }
+        if (statusRequest.length != 0)
+        {
+            throw new TlsFatalAlert(alertDescription);
+        }
+        return true;
+    }
+
     protected static byte[] generateCertificate(Certificate certificate)
         throws IOException
     {