/*

 * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.ByteArrayInputStream;

import java.io.IOException;

import java.util.Hashtable;

import java.util.Arrays;

import java.security.*;

import javax.crypto.*;

import javax.crypto.spec.IvParameterSpec;

import javax.crypto.spec.GCMParameterSpec;

import java.nio.*;

import sun.security.ssl.CipherSuite.*;

import static sun.security.ssl.CipherSuite.*;

import static sun.security.ssl.CipherSuite.CipherType.*;

import sun.misc.HexDumpEncoder;

/**

 * This class handles bulk data enciphering/deciphering for each SSLv3

 * message.  This provides data confidentiality.  Stream ciphers (such

 * as RC4) don't need to do padding; block ciphers (e.g. DES) need it.

 *

 * Individual instances are obtained by calling the static method

 * newCipherBox(), which should only be invoked by BulkCipher.newCipher().

 *

 * In RFC 2246, with bock ciphers in CBC mode, the Initialization

 * Vector (IV) for the first record is generated with the other keys

 * and secrets when the security parameters are set.  The IV for

 * subsequent records is the last ciphertext block from the previous

 * record.

 *

 * In RFC 4346, the implicit Initialization Vector (IV) is replaced

 * with an explicit IV to protect against CBC attacks.  RFC 4346

 * recommends two algorithms used to generated the per-record IV.

 * The implementation uses the algorithm (2)(b), as described at

 * section 6.2.3.2 of RFC 4346.

 *

 * The usage of IV in CBC block cipher can be illustrated in

 * the following diagrams.

 *

 *   (random)

 *        R         P1                    IV        C1

 *        |          |                     |         |

 *  SIV---+    |-----+    |-...            |-----    |------

 *        |    |     |    |                |    |    |     |

 *     +----+  |  +----+  |             +----+  |  +----+  |

 *     | Ek |  |  + Ek +  |             | Dk |  |  | Dk |  |

 *     +----+  |  +----+  |             +----+  |  +----+  |

 *        |    |     |    |                |    |    |     |

 *        |----|     |----|           SIV--+    |----|     |-...

 *        |          |                     |       |

 *       IV         C1                     R      P1

 *                                     (discard)

 *

 *       CBC Encryption                    CBC Decryption

 *

 * NOTE that any ciphering involved in key exchange (e.g. with RSA) is

 * handled separately.

 *

 * @author David Brownell

 * @author Andreas Sterbenz

 */

final class CipherBox {

    // A CipherBox that implements the identity operation

    /* Class and subclass dynamic debugging support */

    private static final Debug debug = Debug.getInstance("ssl");

    // the protocol version this cipher conforms to

    private final ProtocolVersion protocolVersion;

    // cipher object

    private final Cipher cipher;

    /**

     * secure random

     */

    private SecureRandom random;

    /**

     * fixed IV, the implicit nonce of AEAD cipher suite, only apply to

     * AEAD cipher suites

     */

    private final byte[] fixedIv;

    /**

     * the key, reserved only for AEAD cipher initialization

     */

    private final Key key;

    /**

     * the operation mode, reserved for AEAD cipher initialization

     */

    private final int mode;

    /**

     * the authentication tag size, only apply to AEAD cipher suites

     */

    private final int tagSize;

    /**

     * the record IV length, only apply to AEAD cipher suites

     */

    private final int recordIvSize;

    /**

     * cipher type

     */

    private final CipherType cipherType;

    /**

     * Fixed masks of various block size, as the initial decryption IVs

     * for TLS 1.1 or later.

     *

     * For performance, we do not use random IVs. As the initial decryption

     * IVs will be discarded by TLS decryption processes, so the fixed masks

     * do not hurt cryptographic strength.

     */

    private static Hashtable<Integer, IvParameterSpec> masks;

    /**

     * NULL cipherbox. Identity operation, no encryption.

     */

    private CipherBox() {

        this.protocolVersion = ProtocolVersion.DEFAULT_TLS;

        this.cipher = null;

        this.cipherType = NULL_CIPHER;

        this.fixedIv = new byte[0];

        this.key = null;

        this.mode = Cipher.ENCRYPT_MODE;    // choose at random

        this.random = null;

        this.tagSize = 0;

        this.recordIvSize = 0;

    }

    /**

     * Construct a new CipherBox using the cipher transformation.

     *

     * @exception NoSuchAlgorithmException if no appropriate JCE Cipher

     * implementation could be found.

     */

    private CipherBox(ProtocolVersion protocolVersion, BulkCipher bulkCipher,

            SecretKey key, IvParameterSpec iv, SecureRandom random,

            boolean encrypt) throws NoSuchAlgorithmException {

        try {

            this.protocolVersion = protocolVersion;

            this.cipher = JsseJce.getCipher(bulkCipher.transformation);

            this.mode = encrypt ? Cipher.ENCRYPT_MODE : Cipher.DECRYPT_MODE;

            if (random == null) {

                random = JsseJce.getSecureRandom();

            }

            this.random = random;

            this.cipherType = bulkCipher.cipherType;

            /*

             * RFC 4346 recommends two algorithms used to generated the

             * per-record IV. The implementation uses the algorithm (2)(b),

             * as described at section 6.2.3.2 of RFC 4346.

             *

             * As we don't care about the initial IV value for TLS 1.1 or

             * later, so if the "iv" parameter is null, we use the default

             * value generated by Cipher.init() for encryption, and a fixed

             * mask for decryption.

             */

            if (iv == null && bulkCipher.ivSize != 0 &&

                    mode == Cipher.DECRYPT_MODE &&

                    protocolVersion.useTLS11PlusSpec()) {

                iv = getFixedMask(bulkCipher.ivSize);

            }

            if (cipherType == AEAD_CIPHER) {

                // AEAD must completely initialize the cipher for each packet,

                // and so we save initialization parameters for packet

                // processing time.

                // Set the tag size for AEAD cipher

                tagSize = bulkCipher.tagSize;

                // Reserve the key for AEAD cipher initialization

                this.key = key;

                fixedIv = iv.getIV();

                if (fixedIv == null ||

                        fixedIv.length != bulkCipher.fixedIvSize) {

                    throw new RuntimeException("Improper fixed IV for AEAD");

                }

                // Set the record IV length for AEAD cipher

                recordIvSize = bulkCipher.ivSize - bulkCipher.fixedIvSize;

                // DON'T initialize the cipher for AEAD!

            } else {

                // CBC only requires one initialization during its lifetime

                // (future packets/IVs set the proper CBC state), so we can

                // initialize now.

                // Zeroize the variables that only apply to AEAD cipher

                this.tagSize = 0;

                this.fixedIv = new byte[0];

                this.recordIvSize = 0;

                this.key = null;

                // Initialize the cipher

                cipher.init(mode, key, iv, random);

            }

        } catch (NoSuchAlgorithmException e) {

            throw e;

        } catch (Exception e) {

            throw new NoSuchAlgorithmException

                    ("Could not create cipher " + bulkCipher, e);

        } catch (ExceptionInInitializerError e) {

            throw new NoSuchAlgorithmException

                    ("Could not create cipher " + bulkCipher, e);

        }

    }

    /*

     * Factory method to obtain a new CipherBox object.

     */

    static CipherBox newCipherBox(ProtocolVersion version, BulkCipher cipher,

            SecretKey key, IvParameterSpec iv, SecureRandom random,

            boolean encrypt) throws NoSuchAlgorithmException {

        if (cipher.allowed == false) {

            throw new NoSuchAlgorithmException("Unsupported cipher " + cipher);

        }

        if (cipher == BulkCipher.B_NULL) {

            return NULL;

        } else {

            return new CipherBox(version, cipher, key, iv, random, encrypt);

        }

    }

    /*

     * Get a fixed mask, as the initial decryption IVs for TLS 1.1 or later.

     */

    private static IvParameterSpec getFixedMask(int ivSize) {

        if (masks == null) {

            masks = new Hashtable<Integer, IvParameterSpec>(5);

        }

        IvParameterSpec iv = masks.get(ivSize);

        if (iv == null) {

            iv = new IvParameterSpec(new byte[ivSize]);

            masks.put(ivSize, iv);

        }

        return iv;

    }

    /*

     * Encrypts a block of data, returning the size of the

     * resulting block.

     */

    int encrypt(byte[] buf, int offset, int len) {

        if (cipher == null) {

            return len;

        }

        try {

            int blockSize = cipher.getBlockSize();

            if (cipherType == BLOCK_CIPHER) {

                len = addPadding(buf, offset, len, blockSize);

            }

            if (debug != null && Debug.isOn("plaintext")) {

                try {

                    HexDumpEncoder hd = new HexDumpEncoder();

                    System.out.println(

                        "Padded plaintext before ENCRYPTION:  len = "

                        + len);

                    hd.encodeBuffer(

                        new ByteArrayInputStream(buf, offset, len),

                        System.out);

                } catch (IOException e) { }

            }

            if (cipherType == AEAD_CIPHER) {

                try {

                    return cipher.doFinal(buf, offset, len, buf, offset);

                } catch (IllegalBlockSizeException | BadPaddingException ibe) {

                    // unlikely to happen

                    throw new RuntimeException(

                        "Cipher error in AEAD mode in JCE provider " +

                        cipher.getProvider().getName(), ibe);

                }

            } else {

                int newLen = cipher.update(buf, offset, len, buf, offset);

                if (newLen != len) {

                    // catch BouncyCastle buffering error

                    throw new RuntimeException("Cipher buffering error " +

                        "in JCE provider " + cipher.getProvider().getName());

                }

                return newLen;

            }

        } catch (ShortBufferException e) {

            // unlikely to happen, we should have enough buffer space here

            throw new ArrayIndexOutOfBoundsException(e.toString());

        }

    }

    /*

     * Encrypts a ByteBuffer block of data, returning the size of the

     * resulting block.

     *

     * The byte buffers position and limit initially define the amount

     * to encrypt.  On return, the position and limit are

     * set to last position padded/encrypted.  The limit may have changed

     * because of the added padding bytes.

     */

    int encrypt(ByteBuffer bb, int outLimit) {

        int len = bb.remaining();

        if (cipher == null) {

            bb.position(bb.limit());

            return len;

        }

        int pos = bb.position();

        int blockSize = cipher.getBlockSize();

        if (cipherType == BLOCK_CIPHER) {

            // addPadding adjusts pos/limit

            len = addPadding(bb, blockSize);

            bb.position(pos);

        }

        if (debug != null && Debug.isOn("plaintext")) {

            try {

                HexDumpEncoder hd = new HexDumpEncoder();

                System.out.println(

                    "Padded plaintext before ENCRYPTION:  len = "

                    + len);

                hd.encodeBuffer(bb.duplicate(), System.out);

            } catch (IOException e) { }

        }

        /*

         * Encrypt "in-place".  This does not add its own padding.

         */

        ByteBuffer dup = bb.duplicate();

        if (cipherType == AEAD_CIPHER) {

            try {

                int outputSize = cipher.getOutputSize(dup.remaining());

                if (outputSize > bb.remaining()) {

                    // need to expand the limit of the output buffer for

                    // the authentication tag.

                    //

                    // DON'T worry about the buffer's capacity, we have

                    // reserved space for the authentication tag.

                    if (outLimit < pos + outputSize) {

                        // unlikely to happen

                        throw new ShortBufferException(

                                    "need more space in output buffer");

                    }

                    bb.limit(pos + outputSize);

                }

                int newLen = cipher.doFinal(dup, bb);

                if (newLen != outputSize) {

                    throw new RuntimeException(

                            "Cipher buffering error in JCE provider " +

                            cipher.getProvider().getName());

                }

                return newLen;

            } catch (IllegalBlockSizeException |

                           BadPaddingException | ShortBufferException ibse) {

                // unlikely to happen

                throw new RuntimeException(

                        "Cipher error in AEAD mode in JCE provider " +

                        cipher.getProvider().getName(), ibse);

            }

        } else {

            int newLen;

            try {

                newLen = cipher.update(dup, bb);

            } catch (ShortBufferException sbe) {

                // unlikely to happen

                throw new RuntimeException("Cipher buffering error " +

                    "in JCE provider " + cipher.getProvider().getName());

            }

            if (bb.position() != dup.position()) {

                throw new RuntimeException("bytebuffer padding error");

            }

            if (newLen != len) {

                // catch BouncyCastle buffering error

                throw new RuntimeException("Cipher buffering error " +

                    "in JCE provider " + cipher.getProvider().getName());

            }

            return newLen;

        }

    }

    /*

     * Decrypts a block of data, returning the size of the

     * resulting block if padding was required.

     *

     * For SSLv3 and TLSv1.0, with block ciphers in CBC mode the

     * Initialization Vector (IV) for the first record is generated by

     * the handshake protocol, the IV for subsequent records is the

     * last ciphertext block from the previous record.

     *

     * From TLSv1.1, the implicit IV is replaced with an explicit IV to

     * protect against CBC attacks.

     *

     * Differentiating between bad_record_mac and decryption_failed alerts

     * may permit certain attacks against CBC mode. It is preferable to

     * uniformly use the bad_record_mac alert to hide the specific type of

     * the error.

     */

    int decrypt(byte[] buf, int offset, int len,

            int tagLen) throws BadPaddingException {

        if (cipher == null) {

            return len;

        }

        try {

            int newLen;

            if (cipherType == AEAD_CIPHER) {

                try {

                    newLen = cipher.doFinal(buf, offset, len, buf, offset);

                } catch (IllegalBlockSizeException ibse) {

                    // unlikely to happen

                    throw new RuntimeException(

                        "Cipher error in AEAD mode in JCE provider " +

                        cipher.getProvider().getName(), ibse);

                }

            } else {

                newLen = cipher.update(buf, offset, len, buf, offset);

                if (newLen != len) {

                    // catch BouncyCastle buffering error

                    throw new RuntimeException("Cipher buffering error " +

                        "in JCE provider " + cipher.getProvider().getName());

                }

            }

            if (debug != null && Debug.isOn("plaintext")) {

                try {

                    HexDumpEncoder hd = new HexDumpEncoder();

                    System.out.println(

                        "Padded plaintext after DECRYPTION:  len = "

                        + newLen);

                    hd.encodeBuffer(

                        new ByteArrayInputStream(buf, offset, newLen),

                        System.out);

                } catch (IOException e) { }

            }

            if (cipherType == BLOCK_CIPHER) {

                int blockSize = cipher.getBlockSize();

                newLen = removePadding(

                    buf, offset, newLen, tagLen, blockSize, protocolVersion);

                if (protocolVersion.useTLS11PlusSpec()) {

                    if (newLen < blockSize) {

                        throw new BadPaddingException("invalid explicit IV");

                    }

                }

            }

            return newLen;

        } catch (ShortBufferException e) {

            // unlikely to happen, we should have enough buffer space here