/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Sun designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Sun in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

 * CA 95054 USA or visit www.sun.com if you need additional information or

 * have any questions.

 */

package sun.security.ssl;

import java.io.*;

import java.util.*;

import java.security.*;

import java.security.cert.*;

import java.security.interfaces.*;

import java.security.spec.ECParameterSpec;

import javax.crypto.SecretKey;

import javax.crypto.spec.SecretKeySpec;

import javax.net.ssl.*;

import javax.security.auth.Subject;

import javax.security.auth.kerberos.KerberosKey;

import javax.security.auth.kerberos.KerberosPrincipal;

import javax.security.auth.kerberos.ServicePermission;

import sun.security.jgss.krb5.Krb5Util;

import com.sun.net.ssl.internal.ssl.X509ExtendedTrustManager;

import sun.security.ssl.HandshakeMessage.*;

import sun.security.ssl.CipherSuite.*;

import static sun.security.ssl.CipherSuite.*;

import static sun.security.ssl.CipherSuite.KeyExchange.*;

/**

 * ServerHandshaker does the protocol handshaking from the point

 * of view of a server.  It is driven asychronously by handshake messages

 * as delivered by the parent Handshaker class, and also uses

 * common functionality (e.g. key generation) that is provided there.

 *

 * @author David Brownell

 */

final class ServerHandshaker extends Handshaker {

    // is the server going to require the client to authenticate?

    private byte                doClientAuth;

    // our authentication info

    private X509Certificate[]   certs;

    private PrivateKey          privateKey;

    private KerberosKey[]       kerberosKeys;

    // flag to check for clientCertificateVerify message

    private boolean             needClientVerify = false;

    /*

     * For exportable ciphersuites using non-exportable key sizes, we use

     * ephemeral RSA keys. We could also do anonymous RSA in the same way

     * but there are no such ciphersuites currently defined.

     */

    private PrivateKey          tempPrivateKey;

    private PublicKey           tempPublicKey;

    /*

     * For anonymous and ephemeral Diffie-Hellman key exchange, we use

     * ephemeral Diffie-Hellman keys.

     */

    private DHCrypt dh;

    // Helper for ECDH based key exchanges

    private ECDHCrypt ecdh;

    // version request by the client in its ClientHello

    // we remember it for the RSA premaster secret version check

    private ProtocolVersion clientRequestedVersion;

    private SupportedEllipticCurvesExtension supportedCurves;

    /*

     * Constructor ... use the keys found in the auth context.

     */

    ServerHandshaker(SSLSocketImpl socket, SSLContextImpl context,

            ProtocolList enabledProtocols, byte clientAuth) {

        super(socket, context, enabledProtocols,

                        (clientAuth != SSLEngineImpl.clauth_none), false);

        doClientAuth = clientAuth;

    }

    /*

     * Constructor ... use the keys found in the auth context.

     */

    ServerHandshaker(SSLEngineImpl engine, SSLContextImpl context,

            ProtocolList enabledProtocols, byte clientAuth) {

        super(engine, context, enabledProtocols,

                        (clientAuth != SSLEngineImpl.clauth_none), false);

        doClientAuth = clientAuth;

    }

    /*

     * As long as handshaking has not started, we can change

     * whether client authentication is required.  Otherwise,

     * we will need to wait for the next handshake.

     */

    void setClientAuth(byte clientAuth) {

        doClientAuth = clientAuth;

    }

    /*

     * This routine handles all the server side handshake messages, one at

     * a time.  Given the message type (and in some cases the pending cipher

     * spec) it parses the type-specific message.  Then it calls a function

     * that handles that specific message.

     *

     * It updates the state machine as each message is processed, and writes

     * responses as needed using the connection in the constructor.

     */

    void processMessage(byte type, int message_len)

            throws IOException {

        //

        // In SSLv3 and TLS, messages follow strictly increasing

        // numerical order _except_ for one annoying special case.

        //

        if ((state > type)

                && (state != HandshakeMessage.ht_client_key_exchange

                    && type != HandshakeMessage.ht_certificate_verify)) {

            throw new SSLProtocolException(

                    "Handshake message sequence violation, state = " + state

                    + ", type = " + type);

        }

        switch (type) {

            case HandshakeMessage.ht_client_hello:

                ClientHello ch = new ClientHello(input, message_len);

                /*

                 * send it off for processing.

                 */

                this.clientHello(ch);

                break;

            case HandshakeMessage.ht_certificate:

                if (doClientAuth == SSLEngineImpl.clauth_none) {

                    fatalSE(Alerts.alert_unexpected_message,

                                "client sent unsolicited cert chain");

                    // NOTREACHED

                }

                this.clientCertificate(new CertificateMsg(input));

                break;

            case HandshakeMessage.ht_client_key_exchange:

                SecretKey preMasterSecret;

                switch (keyExchange) {

                case K_RSA:

                case K_RSA_EXPORT:

                    /*

                     * The client's pre-master secret is decrypted using

                     * either the server's normal private RSA key, or the

                     * temporary one used for non-export or signing-only

                     * certificates/keys.

                     */

                    RSAClientKeyExchange pms = new RSAClientKeyExchange

                        (protocolVersion, input, message_len, privateKey);

                    preMasterSecret = this.clientKeyExchange(pms);

                    break;

                case K_KRB5:

                case K_KRB5_EXPORT:

                    preMasterSecret = this.clientKeyExchange(

                        new KerberosClientKeyExchange(protocolVersion,

                            clientRequestedVersion,

                            sslContext.getSecureRandom(),

                            input,

                            kerberosKeys));

                    break;

                case K_DHE_RSA:

                case K_DHE_DSS:

                case K_DH_ANON:

                    /*

                     * The pre-master secret is derived using the normal

                     * Diffie-Hellman calculation.   Note that the main

                     * protocol difference in these five flavors is in how

                     * the ServerKeyExchange message was constructed!

                     */

                    preMasterSecret = this.clientKeyExchange(

                            new DHClientKeyExchange(input));

                    break;

                case K_ECDH_RSA:

                case K_ECDH_ECDSA:

                case K_ECDHE_RSA:

                case K_ECDHE_ECDSA:

                case K_ECDH_ANON:

                    preMasterSecret = this.clientKeyExchange

                                            (new ECDHClientKeyExchange(input));

                    break;

                default:

                    throw new SSLProtocolException

                        ("Unrecognized key exchange: " + keyExchange);

                }

                //

                // All keys are calculated from the premaster secret

                // and the exchanged nonces in the same way.

                //

                calculateKeys(preMasterSecret, clientRequestedVersion);

                break;

            case HandshakeMessage.ht_certificate_verify:

                this.clientCertificateVerify(new CertificateVerify(input));

                break;

            case HandshakeMessage.ht_finished:

                this.clientFinished(new Finished(protocolVersion, input));

                break;

            default:

                throw new SSLProtocolException(

                        "Illegal server handshake msg, " + type);

        }

        //

        // Move the state machine forward except for that annoying

        // special case.  This means that clients could send extra

        // cert verify messages; not a problem so long as all of

        // them actually check out.

        //

        if (state < type && type != HandshakeMessage.ht_certificate_verify) {

            state = type;

        }

    }

    /*

     * ClientHello presents the server with a bunch of options, to which the

     * server replies with a ServerHello listing the ones which this session

     * will use.  If needed, it also writes its Certificate plus in some cases

     * a ServerKeyExchange message.  It may also write a CertificateRequest,

     * to elicit a client certificate.

     *

     * All these messages are terminated by a ServerHelloDone message.  In

     * most cases, all this can be sent in a single Record.

     */

    private void clientHello(ClientHello mesg) throws IOException {

        if (debug != null && Debug.isOn("handshake")) {

            mesg.print(System.out);

        }

        /*

         * Always make sure this entire record has been digested before we

         * start emitting output, to ensure correct digesting order.

         */

        input.digestNow();

        /*

         * FIRST, construct the ServerHello using the options and priorities

         * from the ClientHello.  Update the (pending) cipher spec as we do

         * so, and save the client's version to protect against rollback

         * attacks.

         *

         * There are a bunch of minor tasks here, and one major one: deciding

         * if the short or the full handshake sequence will be used.

         */

        ServerHello m1 = new ServerHello();

        clientRequestedVersion = mesg.protocolVersion;

        // check if clientVersion is recent enough for us

        if (clientRequestedVersion.v < enabledProtocols.min.v) {

            fatalSE(Alerts.alert_handshake_failure,

                "Client requested protocol " + clientRequestedVersion +

                 " not enabled or not supported");

        }

        // now we know we have an acceptable version

        // use the lower of our max and the client requested version

        ProtocolVersion selectedVersion;

        if (clientRequestedVersion.v <= enabledProtocols.max.v) {

            selectedVersion = clientRequestedVersion;

        } else {

            selectedVersion = enabledProtocols.max;

        }

        setVersion(selectedVersion);

        m1.protocolVersion = protocolVersion;

        //

        // random ... save client and server values for later use

        // in computing the master secret (from pre-master secret)

        // and thence the other crypto keys.

        //

        // NOTE:  this use of three inputs to generating _each_ set

        // of ciphers slows things down, but it does increase the

        // security since each connection in the session can hold

        // its own authenticated (and strong) keys.  One could make

        // creation of a session a rare thing...

        //

        clnt_random = mesg.clnt_random;

        svr_random = new RandomCookie(sslContext.getSecureRandom());

        m1.svr_random = svr_random;

        session = null; // forget about the current session

        //

        // Here we go down either of two paths:  (a) the fast one, where

        // the client's asked to rejoin an existing session, and the server

        // permits this; (b) the other one, where a new session is created.

        //

        if (mesg.sessionId.length() != 0) {

            // client is trying to resume a session, let's see...

            SSLSessionImpl previous = ((SSLSessionContextImpl)sslContext

                        .engineGetServerSessionContext())

                        .get(mesg.sessionId.getId());

            //

            // Check if we can use the fast path, resuming a session.  We

            // can do so iff we have a valid record for that session, and

            // the cipher suite for that session was on the list which the

            // client requested, and if we're not forgetting any needed

            // authentication on the part of the client.

            //

            if (previous != null) {

                resumingSession = previous.isRejoinable();

                if (resumingSession) {

                    ProtocolVersion oldVersion = previous.getProtocolVersion();

                    // cannot resume session with different version

                    if (oldVersion != protocolVersion) {

                        resumingSession = false;

                    }

                }

                if (resumingSession &&

                        (doClientAuth == SSLEngineImpl.clauth_required)) {

                    try {

                        previous.getPeerPrincipal();

                    } catch (SSLPeerUnverifiedException e) {

                        resumingSession = false;

                    }

                }

                // validate subject identity

                if (resumingSession) {

                    CipherSuite suite = previous.getSuite();

                    if (suite.keyExchange == K_KRB5 ||

                        suite.keyExchange == K_KRB5_EXPORT) {

                        Principal localPrincipal = previous.getLocalPrincipal();

                        Subject subject = null;

                        try {

                            subject = AccessController.doPrivileged(

                                new PrivilegedExceptionAction<Subject>() {

                                public Subject run() throws Exception {

                                    return Krb5Util.getSubject(

                                        getAccSE());

                            }});

                        } catch (PrivilegedActionException e) {

                            subject = null;

                            if (debug != null && Debug.isOn("session")) {

                                System.out.println("Attempt to obtain" +

                                                " subject failed!");

                            }

                        }

                        if (subject != null) {

                            Set<KerberosPrincipal> principals =

                                subject.getPrincipals(KerberosPrincipal.class);

                            if (!principals.contains(localPrincipal)) {

                                resumingSession = false;

                                if (debug != null && Debug.isOn("session")) {

                                    System.out.println("Subject identity" +

                                                        " is not the same");

                                }

                            } else {

                                if (debug != null && Debug.isOn("session"))

                                    System.out.println("Subject identity" +

                                                        " is same");

                            }

                        } else {

                            resumingSession = false;

                            if (debug != null && Debug.isOn("session"))

                                System.out.println("Kerberos credentials are" +

                                    " not present in the current Subject;" +

                                    " check if " +

                                    " javax.security.auth.useSubjectAsCreds" +

                                    " system property has been set to false");

                        }

                    }

                }

                if (resumingSession) {

                    CipherSuite suite = previous.getSuite();

                    // verify that the ciphersuite from the cached session

                    // is in the list of client requested ciphersuites and

                    // we have it enabled

                    if ((isEnabled(suite) == false) ||

                            (mesg.getCipherSuites().contains(suite) == false)) {

                        resumingSession = false;

                    } else {

                        // everything looks ok, set the ciphersuite

                        // this should be done last when we are sure we

                        // will resume

                        setCipherSuite(suite);

                    }

                }

                if (resumingSession) {

                    session = previous;

                    if (debug != null &&

                        (Debug.isOn("handshake") || Debug.isOn("session"))) {

                        System.out.println("%% Resuming " + session);

                    }

                }

            }

        } // else client did not try to resume

        //

        // If client hasn't specified a session we can resume, start a

        // new one and choose its cipher suite and compression options.

        // Unless new session creation is disabled for this connection!

        //

        if (session == null) {

            if (!enableNewSession) {

                throw new SSLException("Client did not resume a session");

            }

            supportedCurves = (SupportedEllipticCurvesExtension)mesg.extensions.get

                                        (ExtensionType.EXT_ELLIPTIC_CURVES);

            chooseCipherSuite(mesg);

            session = new SSLSessionImpl(protocolVersion, cipherSuite,

                sslContext.getSecureRandom(),

                getHostAddressSE(), getPortSE());

            session.setLocalPrivateKey(privateKey);

            // chooseCompression(mesg);

        }

        m1.cipherSuite = cipherSuite;

        m1.sessionId = session.getSessionId();

        m1.compression_method = session.getCompression();

        if (debug != null && Debug.isOn("handshake")) {

            m1.print(System.out);

            System.out.println("Cipher suite:  " + session.getSuite());

        }

        m1.write(output);

        //

        // If we are resuming a session, we finish writing handshake

        // messages right now and then finish.

        //

        if (resumingSession) {

            calculateConnectionKeys(session.getMasterSecret());

            sendChangeCipherAndFinish(false);

            return;

        }

        /*

         * SECOND, write the server Certificate(s) if we need to.

         *

         * NOTE:  while an "anonymous RSA" mode is explicitly allowed by

         * the protocol, we can't support it since all of the SSL flavors

         * defined in the protocol spec are explicitly stated to require

         * using RSA certificates.

         */

        if (keyExchange == K_KRB5 || keyExchange == K_KRB5_EXPORT) {

            // Server certificates are omitted for Kerberos ciphers

        } else if ((keyExchange != K_DH_ANON) && (keyExchange != K_ECDH_ANON)) {

            if (certs == null) {

                throw new RuntimeException("no certificates");

            }

            CertificateMsg m2 = new CertificateMsg(certs);

            /*

             * Set local certs in the SSLSession, output

             * debug info, and then actually write to the client.

             */

            session.setLocalCertificates(certs);

            if (debug != null && Debug.isOn("handshake")) {

                m2.print(System.out);

            }

            m2.write(output);

            // XXX has some side effects with OS TCP buffering,

            // leave it out for now

            // let client verify chain in the meantime...

            // output.flush();

        } else {

            if (certs != null) {

                throw new RuntimeException("anonymous keyexchange with certs");

            }

        }

        /*

         * THIRD, the ServerKeyExchange message ... iff it's needed.

         *

         * It's usually needed unless there's an encryption-capable

         * RSA cert, or a D-H cert.  The notable exception is that

         * exportable ciphers used with big RSA keys need to downgrade

         * to use short RSA keys, even when the key/cert encrypts OK.

         */

        ServerKeyExchange m3;

        switch (keyExchange) {

        case K_RSA:

        case K_KRB5:

        case K_KRB5_EXPORT:

            // no server key exchange for RSA or KRB5 ciphersuites

            m3 = null;

            break;