* Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.

import java.io.IOException;

import java.io.InputStream;

import java.io.InterruptedIOException;

import java.io.OutputStream;

import java.net.InetAddress;

import java.net.InetSocketAddress;

import java.net.Socket;

import java.net.SocketAddress;

import java.net.SocketException;

import java.net.UnknownHostException;

import java.nio.ByteBuffer;

import java.util.List;

import javax.net.ssl.HandshakeCompletedListener;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.SSLParameters;

import javax.net.ssl.SSLProtocolException;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLSocket;

 * Implementation of an SSL socket.

 * <P>

 * This is a normal connection type socket, implementing SSL over some lower

 * level socket, such as TCP.  Because it is layered over some lower level

 * socket, it MUST override all default socket methods.

 * <P>

 * This API offers a non-traditional option for establishing SSL

public final class SSLSocketImpl

        extends BaseSSLSocketImpl implements SSLTransport {

    final SSLContextImpl            sslContext;

    final TransportContext          conContext;

    private final AppInputStream    appInput = new AppInputStream();

    private final AppOutputStream   appOutput = new AppOutputStream();

    private String                  peerHost;

    private boolean                 autoClose;

    private boolean                 isConnected = false;

    private boolean                 tlsIsClosed = false;

            Utilities.getBooleanProperty("jdk.tls.trustNameService", false);

    /**

     * Package-private constructor used to instantiate an unconnected

     * socket.

     *

     * This instance is meant to set handshake state to use "client mode".

     */

    SSLSocketImpl(SSLContextImpl sslContext) {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

    }

     * Package-private constructor used to instantiate a server socket.

     * This instance is meant to set handshake state to use "server mode".

    SSLSocketImpl(SSLContextImpl sslContext, SSLConfiguration sslConfig) {

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this, sslConfig,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash));

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     * This endpoint acts as the client, and may rejoin an existing SSL session

     * if appropriate.

    SSLSocketImpl(SSLContextImpl sslContext, String peerHost,

            int peerPort) throws IOException, UnknownHostException {

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress address, int peerPort) throws IOException {

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        SocketAddress socketAddress = new InetSocketAddress(address, peerPort);

    /**

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

    SSLSocketImpl(SSLContextImpl sslContext,

            String peerHost, int peerPort, InetAddress localAddr,

            int localPort) throws IOException, UnknownHostException {

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

        connect(socketAddress, 0);

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress peerAddr, int peerPort,

            InetAddress localAddr, int localPort) throws IOException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress = new InetSocketAddress(peerAddr, peerPort);

        connect(socketAddress, 0);

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), false);

     * Layer SSL traffic over an existing connection, rather than

     * creating a new connection.

     *

     * The existing connection may be used only for SSL traffic (using this

     * SSLSocket) until the SSLSocket.close() call returns. However, if a

     * protocol error is detected, that existing connection is automatically

     * closed.

     * <p>

     * This particular constructor always uses the socket in the

     * role of an SSL client. It may be useful in cases which start

     * using SSL after some initial data transfers, for example in some

     * SSL tunneling applications or as part of some kinds of application

     * protocols which negotiate use of a SSL based security.

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

            String peerHost, int port, boolean autoClose) throws IOException {

        super(sock);

        // We always layer over a connected socket

        if (!sock.isConnected()) {

            throw new SocketException("Underlying socket is not connected");

        }

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        this.autoClose = autoClose;

        doneConnect();

    public void connect(SocketAddress endpoint,

            int timeout) throws IOException {

                    "Cannot handle non-Inet socket addresses.");

    @Override

    public String[] getSupportedCipherSuites() {

        return CipherSuite.namesOf(sslContext.getSupportedCipherSuites());

    }

    @Override

    public synchronized String[] getEnabledCipherSuites() {

        return CipherSuite.namesOf(conContext.sslConfig.enabledCipherSuites);

    }

    @Override

    public synchronized void setEnabledCipherSuites(String[] suites) {

        if (suites == null) {

            throw new IllegalArgumentException("CipherSuites cannot be null");

        }

        conContext.sslConfig.enabledCipherSuites =

                CipherSuite.validValuesOf(suites);

    }

    @Override

    public String[] getSupportedProtocols() {

        return ProtocolVersion.toStringArray(

                sslContext.getSuportedProtocolVersions());

    }

    @Override

    public synchronized String[] getEnabledProtocols() {

        return ProtocolVersion.toStringArray(

                conContext.sslConfig.enabledProtocols);

    }

    @Override

    public synchronized void setEnabledProtocols(String[] protocols) {

        if (protocols == null) {

            throw new IllegalArgumentException("Protocols cannot be null");

        }

        conContext.sslConfig.enabledProtocols =

                ProtocolVersion.namesOf(protocols);

    }

    @Override

    public synchronized SSLSession getSession() {

        try {

            // start handshaking, if failed, the connection will be closed.

            ensureNegotiated();

        } catch (IOException ioe) {

            if (SSLLogger.isOn && SSLLogger.isOn("handshake")) {

                SSLLogger.severe("handshake failed", ioe);

            }

            return SSLSessionImpl.nullSession;

        }

        return conContext.conSession;

    }

    @Override

    public synchronized SSLSession getHandshakeSession() {

        if (conContext.handshakeContext != null) {

            return conContext.handshakeContext.handshakeSession;

        }

        return null;

    }

    @Override

    public synchronized void addHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.addHandshakeCompletedListener(listener);

    }

    @Override

    public synchronized void removeHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.removeHandshakeCompletedListener(listener);

    @Override

    public synchronized void startHandshake() throws IOException {

        checkWrite();

        try {

            conContext.kickstart();

            // All initial handshaking goes through this operation until we

            // have a valid SSL connection.

            //

            // Handle handshake messages only, need no application data.

            if (!conContext.isNegotiated) {

                readRecord();

            }

        } catch (IOException ioe) {

            conContext.fatal(Alert.HANDSHAKE_FAILURE,

                "Couldn't kickstart handshaking", ioe);

        } catch (Exception oe) {    // including RuntimeException

            handleException(oe);

        }

    }

    @Override

    public synchronized void setUseClientMode(boolean mode) {

        conContext.setUseClientMode(mode);

    }

    @Override

    public synchronized boolean getUseClientMode() {

        return conContext.sslConfig.isClientMode;

    }

    @Override

    public synchronized void setNeedClientAuth(boolean need) {

        conContext.sslConfig.clientAuthType =

                (need ? ClientAuthType.CLIENT_AUTH_REQUIRED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    }

    @Override

    public synchronized boolean getNeedClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUIRED);

    }

    @Override

    public synchronized void setWantClientAuth(boolean want) {

        conContext.sslConfig.clientAuthType =

                (want ? ClientAuthType.CLIENT_AUTH_REQUESTED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    @Override

    public synchronized boolean getWantClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUESTED);

    }

    @Override

    public synchronized void setEnableSessionCreation(boolean flag) {

        conContext.sslConfig.enableSessionCreation = flag;

    }

    @Override

    public synchronized boolean getEnableSessionCreation() {

        return conContext.sslConfig.enableSessionCreation;

    }

    @Override

    public synchronized boolean isClosed() {

        return tlsIsClosed && conContext.isClosed();

    @Override

    public synchronized void close() throws IOException {

        try {

            conContext.close();

        } catch (IOException ioe) {

            // ignore the exception

            if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

                SSLLogger.warning("connection context closure failed", ioe);

            }

        } finally {

            tlsIsClosed = true;

        }

    }

    @Override

    public synchronized InputStream getInputStream() throws IOException {

        if (isClosed() || conContext.isInboundDone()) {

            throw new SocketException("Socket or inbound is closed");

        }

        if (!isConnected) {

            throw new SocketException("Socket is not connected");

        }

        return appInput;

    }

    private synchronized void ensureNegotiated() throws IOException {

        if (conContext.isNegotiated || conContext.isClosed()) {

            return;

        }

        startHandshake();

    private class AppInputStream extends InputStream {

        // One element array used to implement the single byte read() method

        private final byte[] oneByte = new byte[1];

        // the temporary buffer used to read network

        private ByteBuffer buffer;

        // Is application data available in the stream?

        private boolean appDataIsAvailable;

        AppInputStream() {

            this.appDataIsAvailable = false;

            this.buffer = ByteBuffer.allocate(4096);