jdk/src/java.base/share/classes/sun/security/ssl/SSLSocketImpl.java
author xuelei
Fri, 22 Apr 2016 09:27:35 +0000
changeset 37601 6517589dcc94
parent 36641 cbff2fd02f9e
child 38865 429c08bd6158
permissions -rw-r--r--
8144566: Custom HostnameVerifier disables SNI extension Reviewed-by: mullan, wetmore
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
/*
36641
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
     2
 * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5195
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5195
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
 * accompanied this code).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
 *
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5195
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5195
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 5195
diff changeset
    23
 * questions.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
package sun.security.ssl;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
import java.io.*;
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
    30
import java.nio.*;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
import java.net.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
import java.security.GeneralSecurityException;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
import java.security.AccessController;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
import java.security.AccessControlContext;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
import java.security.PrivilegedAction;
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
    36
import java.security.AlgorithmConstraints;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
import java.util.*;
100
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
    38
import java.util.concurrent.TimeUnit;
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
    39
import java.util.concurrent.locks.ReentrantLock;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
import javax.crypto.BadPaddingException;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
import javax.net.ssl.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
32834
e1dca5fe4de3 8137056: Move SharedSecrets and interface friends out of sun.misc
chegar
parents: 32649
diff changeset
    44
import jdk.internal.misc.JavaNetInetAddressAccess;
e1dca5fe4de3 8137056: Move SharedSecrets and interface friends out of sun.misc
chegar
parents: 32649
diff changeset
    45
import jdk.internal.misc.SharedSecrets;
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
    46
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
/**
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
 * Implementation of an SSL socket.  This is a normal connection type
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
 * socket, implementing SSL over some lower level socket, such as TCP.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
 * Because it is layered over some lower level socket, it MUST override
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
 * all default socket methods.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
 * <P> This API offers a non-traditional option for establishing SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
 * connections.  You may first establish the connection directly, then pass
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
 * that connection to the SSL socket constructor with a flag saying which
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
 * role should be taken in the handshake protocol.  (The two ends of the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
 * connection must not choose the same role!)  This allows setup of SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
 * proxying or tunneling, and also allows the kind of "role reversal"
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
 * that is required for most FTP data transfers.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
 * @see javax.net.ssl.SSLSocket
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
 * @see SSLServerSocket
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
 * @author David Brownell
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
 */
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
    66
public final class SSLSocketImpl extends BaseSSLSocketImpl {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
90ce3da70b43 Initial load
duke
parents:
diff changeset
    68
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    69
     * ERROR HANDLING GUIDELINES
90ce3da70b43 Initial load
duke
parents:
diff changeset
    70
     * (which exceptions to throw and catch and which not to throw and catch)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    71
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    72
     * . if there is an IOException (SocketException) when accessing the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    73
     *   underlying Socket, pass it through
90ce3da70b43 Initial load
duke
parents:
diff changeset
    74
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    75
     * . do not throw IOExceptions, throw SSLExceptions (or a subclass)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    76
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    77
     * . for internal errors (things that indicate a bug in JSSE or a
90ce3da70b43 Initial load
duke
parents:
diff changeset
    78
     *   grossly misconfigured J2RE), throw either an SSLException or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
     *   a RuntimeException at your convenience.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    80
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    81
     * . handshaking code (Handshaker or HandshakeMessage) should generally
90ce3da70b43 Initial load
duke
parents:
diff changeset
    82
     *   pass through exceptions, but can handle them if they know what to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
     *   do.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    84
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    85
     * . exception chaining should be used for all new code. If you happen
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
     *   to touch old code that does not use chaining, you should change it.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    87
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
     * . there is a top level exception handler that sits at all entry
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
     *   points from application code to SSLSocket read/write code. It
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
     *   makes sure that all errors are handled (see handleException()).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
     * . JSSE internal code should generally not call close(), call
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
     *   closeInternal().
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
     * There's a state machine associated with each connection, which
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
     * among other roles serves to negotiate session changes.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
     * - START with constructor, until the TCP connection's around.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
     * - HANDSHAKE picks session parameters before allowing traffic.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
     *          There are many substates due to sequencing requirements
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
     *          for handshake messages.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
     * - DATA may be transmitted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
     * - RENEGOTIATE state allows concurrent data and handshaking
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
     *          traffic ("same" substates as HANDSHAKE), and terminates
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
     *          in selection of new session (and connection) parameters
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
     * - ERROR state immediately precedes abortive disconnect.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
     * - SENT_CLOSE sent a close_notify to the peer. For layered,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
     *          non-autoclose socket, must now read close_notify
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
     *          from peer before closing the connection. For nonlayered or
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
     *          non-autoclose socket, close connection and go onto
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
     *          cs_CLOSED state.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
     * - CLOSED after sending close_notify alert, & socket is closed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
     *          SSL connection objects are not reused.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
     * - APP_CLOSED once the application calls close(). Then it behaves like
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
     *          a closed socket, e.g.. getInputStream() throws an Exception.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
     * State affects what SSL record types may legally be sent:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
     * - Handshake ... only in HANDSHAKE and RENEGOTIATE states
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
     * - App Data ... only in DATA and RENEGOTIATE states
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
     * - Alert ... in HANDSHAKE, DATA, RENEGOTIATE
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
     * Re what may be received:  same as what may be sent, except that
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
     * HandshakeRequest handshaking messages can come from servers even
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
     * in the application data state, to request entry to RENEGOTIATE.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
     * The state machine within HANDSHAKE and RENEGOTIATE states controls
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
     * the pending session, not the connection state, until the change
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
     * cipher spec and "Finished" handshake messages are processed and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
     * make the "new" session become the current one.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
     * NOTE: details of the SMs always need to be nailed down better.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
     * The text above illustrates the core ideas.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
     *                +---->-------+------>--------->-------+
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
     *                |            |                        |
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
     *     <-----<    ^            ^  <-----<               v
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
     *START>----->HANDSHAKE>----->DATA>----->RENEGOTIATE  SENT_CLOSE
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
     *                v            v               v        |   |
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
     *                |            |               |        |   v
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
     *                +------------+---------------+        v ERROR
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
     *                |                                     |   |
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
     *                v                                     |   |
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
     *               ERROR>------>----->CLOSED<--------<----+-- +
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
     *                                     |
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
     *                                     v
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
     *                                 APP_CLOSED
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
     *
28059
e576535359cc 8067377: My hobby: caning, then then canning, the the can-can
martin
parents: 25859
diff changeset
   151
     * ALSO, note that the purpose of handshaking (renegotiation is
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
     * included) is to assign a different, and perhaps new, session to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
     * the connection.  The SSLv3 spec is a bit confusing on that new
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
     * protocol feature.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
    private static final int    cs_START = 0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
    private static final int    cs_HANDSHAKE = 1;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
    private static final int    cs_DATA = 2;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
    private static final int    cs_RENEGOTIATE = 3;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
    private static final int    cs_ERROR = 4;
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   161
    private static final int    cs_SENT_CLOSE = 5;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
    private static final int    cs_CLOSED = 6;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
    private static final int    cs_APP_CLOSED = 7;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
     * Drives the protocol state machine.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
     */
19223
e27cda06fe6a 8013809: deadlock in SSLSocketImpl between between write and close
xuelei
parents: 16913
diff changeset
   168
    private volatile int        connectionState;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
     * Flag indicating if the next record we receive MUST be a Finished
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
     * message. Temporarily set during the handshake to ensure that
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
     * a change cipher spec message is followed by a finished message.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
    private boolean             expectingFinished;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
     * For improved diagnostics, we detail connection closure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
     * If the socket is closed (connectionState >= cs_ERROR),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
     * closeReason != null indicates if the socket was closed
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
     * because of an error or because or normal shutdown.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
    private SSLException        closeReason;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
     * Per-connection private state that doesn't change when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
     * session is changed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   189
    private ClientAuthType      doClientAuth =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   190
                                        ClientAuthType.CLIENT_AUTH_NONE;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
    private boolean             roleIsServer;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
    private boolean             enableSessionCreation = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
    private String              host;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
    private boolean             autoClose = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
    private AccessControlContext acc;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   197
    // The cipher suites enabled for use on this connection.
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   198
    private CipherSuiteList     enabledCipherSuites;
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   199
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   200
    // The endpoint identification protocol
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   201
    private String              identificationProtocol = null;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   202
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   203
    // The cryptographic algorithm constraints
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   204
    private AlgorithmConstraints    algorithmConstraints = null;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   205
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   206
    // The server name indication and matchers
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   207
    List<SNIServerName>         serverNames =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   208
                                    Collections.<SNIServerName>emptyList();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   209
    Collection<SNIMatcher>      sniMatchers =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   210
                                    Collections.<SNIMatcher>emptyList();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   211
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   212
    // Is the serverNames set to empty with SSLParameters.setServerNames()?
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   213
    private boolean             noSniExtension = false;
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   214
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   215
    // Is the sniMatchers set to empty with SSLParameters.setSNIMatchers()?
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   216
    private boolean             noSniMatcher = false;
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   217
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   218
    // Configured application protocol values
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   219
    String[] applicationProtocols = new String[0];
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   220
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   221
    // Negotiated application protocol value.
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   222
    //
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   223
    // The value under negotiation will be obtained from handshaker.
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   224
    String applicationProtocol = null;
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
   225
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
     * READ ME * READ ME * READ ME * READ ME * READ ME * READ ME *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
     * IMPORTANT STUFF TO UNDERSTANDING THE SYNCHRONIZATION ISSUES.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
     * READ ME * READ ME * READ ME * READ ME * READ ME * READ ME *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
     * There are several locks here.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
     * The primary lock is the per-instance lock used by
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
     * synchronized(this) and the synchronized methods.  It controls all
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
     * access to things such as the connection state and variables which
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
     * affect handshaking.  If we are inside a synchronized method, we
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
     * can access the state directly, otherwise, we must use the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
     * synchronized equivalents.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
     * The handshakeLock is used to ensure that only one thread performs
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
     * the *complete initial* handshake.  If someone is handshaking, any
90ce3da70b43 Initial load
duke
parents:
diff changeset
   242
     * stray application or startHandshake() requests who find the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   243
     * connection state is cs_HANDSHAKE will stall on handshakeLock
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
     * until handshaking is done.  Once the handshake is done, we either
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
     * succeeded or failed, but we can never go back to the cs_HANDSHAKE
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
     * or cs_START state again.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
     * Note that the read/write() calls here in SSLSocketImpl are not
90ce3da70b43 Initial load
duke
parents:
diff changeset
   249
     * obviously synchronized.  In fact, it's very nonintuitive, and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
     * requires careful examination of code paths.  Grab some coffee,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
     * and be careful with any code changes.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
     * There can be only three threads active at a time in the I/O
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
     * subsection of this class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
     *    1.  startHandshake
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
     *    2.  AppInputStream
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
     *    3.  AppOutputStream
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
     * One thread could call startHandshake().
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
     * AppInputStream/AppOutputStream read() and write() calls are each
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
     * synchronized on 'this' in their respective classes, so only one
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
     * app. thread will be doing a SSLSocketImpl.read() or .write()'s at
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
     * a time.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
     * If handshaking is required (state cs_HANDSHAKE), and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
     * getConnectionState() for some/all threads returns cs_HANDSHAKE,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
     * only one can grab the handshakeLock, and the rest will stall
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
     * either on getConnectionState(), or on the handshakeLock if they
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
     * happen to successfully race through the getConnectionState().
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
     * If a writer is doing the initial handshaking, it must create a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
     * temporary reader to read the responses from the other side.  As a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
     * side-effect, the writer's reader will have priority over any
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
     * other reader.  However, the writer's reader is not allowed to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
     * consume any application data.  When handshakeLock is finally
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
     * released, we either have a cs_DATA connection, or a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
     * cs_CLOSED/cs_ERROR socket.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
     * The writeLock is held while writing on a socket connection and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
     * also to protect the MAC and cipher for their direction.  The
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
     * writeLock is package private for Handshaker which holds it while
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
     * writing the ChangeCipherSpec message.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
     * To avoid the problem of a thread trying to change operational
90ce3da70b43 Initial load
duke
parents:
diff changeset
   284
     * modes on a socket while handshaking is going on, we synchronize
90ce3da70b43 Initial load
duke
parents:
diff changeset
   285
     * on 'this'.  If handshaking has not started yet, we tell the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
     * handshaker to change its mode.  If handshaking has started,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
     * we simply store that request until the next pending session
90ce3da70b43 Initial load
duke
parents:
diff changeset
   288
     * is created, at which time the new handshaker's state is set.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   290
     * The readLock is held during readRecord(), which is responsible
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   291
     * for reading an SSLInputRecord, decrypting it, and processing it.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
     * The readLock ensures that these three steps are done atomically
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   293
     * and that once started, no other thread can block on SSLInputRecord.read.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
     * This is necessary so that processing of close_notify alerts
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
     * from the peer are handled properly.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
     */
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
   297
    private final Object        handshakeLock = new Object();
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   298
    final ReentrantLock         writeLock = new ReentrantLock();
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
   299
    private final Object        readLock = new Object();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   301
    InputRecord                 inputRecord;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   302
    OutputRecord                outputRecord;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
    /*
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   305
     * security parameters for secure renegotiation.
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   306
     */
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   307
    private boolean             secureRenegotiation;
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   308
    private byte[]              clientVerifyData;
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   309
    private byte[]              serverVerifyData;
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   310
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   311
    /*
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
     * The authentication context holds all information used to establish
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
     * who this end of the connection is (certificate chains, private keys,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
     * etc) and who is trusted (e.g. as CAs or websites).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   315
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   316
    private SSLContextImpl      sslContext;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
     * This connection is one of (potentially) many associated with
90ce3da70b43 Initial load
duke
parents:
diff changeset
   321
     * any given session.  The output of the handshake protocol is a
90ce3da70b43 Initial load
duke
parents:
diff changeset
   322
     * new session ... although all the protocol description talks
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
     * about changing the cipher spec (and it does change), in fact
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
     * that's incidental since it's done by changing everything that
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
     * is associated with a session at the same time.  (TLS/IETF may
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
     * change that to add client authentication w/o new key exchg.)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
     */
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   328
    private Handshaker                  handshaker;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   329
    private SSLSessionImpl              sess;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   330
    private volatile SSLSessionImpl     handshakeSession;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
     * If anyone wants to get notified about handshake completions,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
     * they'll show up on this list.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   337
    private HashMap<HandshakeCompletedListener, AccessControlContext>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
                                                        handshakeListeners;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   339
90ce3da70b43 Initial load
duke
parents:
diff changeset
   340
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   341
     * Reuse the same internal input/output streams.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   342
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   343
    private InputStream         sockInput;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   344
    private OutputStream        sockOutput;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   345
90ce3da70b43 Initial load
duke
parents:
diff changeset
   346
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
     * These input and output streams block their data in SSL records,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
     * and usually arrange integrity and privacy protection for those
90ce3da70b43 Initial load
duke
parents:
diff changeset
   350
     * records.  The guts of the SSL protocol are wrapped up in these
90ce3da70b43 Initial load
duke
parents:
diff changeset
   351
     * streams, and in the handshaking that establishes the details of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   352
     * that integrity and privacy protection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   353
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   354
    private AppInputStream      input;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   355
    private AppOutputStream     output;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   356
90ce3da70b43 Initial load
duke
parents:
diff changeset
   357
    /*
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   358
     * The protocol versions enabled for use on this connection.
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   359
     *
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   360
     * Note: we support a pseudo protocol called SSLv2Hello which when
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   361
     * set will result in an SSL v2 Hello being sent with SSL (version 3.0)
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   362
     * or TLS (version 3.1, 3.2, etc.) version info.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   364
    private ProtocolList enabledProtocols;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   365
90ce3da70b43 Initial load
duke
parents:
diff changeset
   366
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   367
     * The SSL version associated with this connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   369
    private ProtocolVersion     protocolVersion = ProtocolVersion.DEFAULT_TLS;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
90ce3da70b43 Initial load
duke
parents:
diff changeset
   371
    /* Class and subclass dynamic debugging support */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
    private static final Debug debug = Debug.getInstance("ssl");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   373
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   374
    /*
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   375
     * Whether local cipher suites preference in server side should be
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   376
     * honored during handshaking?
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   377
     */
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   378
    private boolean preferLocalCipherSuites = false;
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   379
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   380
    /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   381
     * The maximum expected network packet size for SSL/TLS/DTLS records.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   382
     */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   383
    private int maximumPacketSize = 0;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   384
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   385
    /*
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   386
     * Is the local name service trustworthy?
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   387
     *
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   388
     * If the local name service is not trustworthy, reverse host name
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   389
     * resolution should not be performed for endpoint identification.
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   390
     */
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   391
    static final boolean trustNameService =
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   392
            Debug.getBooleanProperty("jdk.tls.trustNameService", false);
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
   393
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   394
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   395
    // CONSTRUCTORS AND INITIALIZATION CODE
90ce3da70b43 Initial load
duke
parents:
diff changeset
   396
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   397
90ce3da70b43 Initial load
duke
parents:
diff changeset
   398
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   399
     * Constructs an SSL connection to a named host at a specified port,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   400
     * using the authentication context provided.  This endpoint acts as
90ce3da70b43 Initial load
duke
parents:
diff changeset
   401
     * the client, and may rejoin an existing SSL session if appropriate.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   402
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   403
     * @param context authentication context to use
90ce3da70b43 Initial load
duke
parents:
diff changeset
   404
     * @param host name of the host with which to connect
90ce3da70b43 Initial load
duke
parents:
diff changeset
   405
     * @param port number of the server's port
90ce3da70b43 Initial load
duke
parents:
diff changeset
   406
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   407
    SSLSocketImpl(SSLContextImpl context, String host, int port)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   408
            throws IOException, UnknownHostException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   409
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   410
        this.host = host;
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   411
        this.serverNames =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   412
            Utilities.addToSNIServerNameList(this.serverNames, this.host);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   413
        init(context, false);
2068
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   414
        SocketAddress socketAddress =
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   415
               host != null ? new InetSocketAddress(host, port) :
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   416
               new InetSocketAddress(InetAddress.getByName(null), port);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   417
        connect(socketAddress, 0);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   418
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   419
90ce3da70b43 Initial load
duke
parents:
diff changeset
   420
90ce3da70b43 Initial load
duke
parents:
diff changeset
   421
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   422
     * Constructs an SSL connection to a server at a specified address.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   423
     * and TCP port, using the authentication context provided.  This
90ce3da70b43 Initial load
duke
parents:
diff changeset
   424
     * endpoint acts as the client, and may rejoin an existing SSL session
90ce3da70b43 Initial load
duke
parents:
diff changeset
   425
     * if appropriate.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   426
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   427
     * @param context authentication context to use
90ce3da70b43 Initial load
duke
parents:
diff changeset
   428
     * @param address the server's host
90ce3da70b43 Initial load
duke
parents:
diff changeset
   429
     * @param port its port
90ce3da70b43 Initial load
duke
parents:
diff changeset
   430
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   431
    SSLSocketImpl(SSLContextImpl context, InetAddress host, int port)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   432
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   433
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   434
        init(context, false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   435
        SocketAddress socketAddress = new InetSocketAddress(host, port);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   436
        connect(socketAddress, 0);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   437
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   438
90ce3da70b43 Initial load
duke
parents:
diff changeset
   439
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   440
     * Constructs an SSL connection to a named host at a specified port,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   441
     * using the authentication context provided.  This endpoint acts as
90ce3da70b43 Initial load
duke
parents:
diff changeset
   442
     * the client, and may rejoin an existing SSL session if appropriate.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   443
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   444
     * @param context authentication context to use
90ce3da70b43 Initial load
duke
parents:
diff changeset
   445
     * @param host name of the host with which to connect
90ce3da70b43 Initial load
duke
parents:
diff changeset
   446
     * @param port number of the server's port
90ce3da70b43 Initial load
duke
parents:
diff changeset
   447
     * @param localAddr the local address the socket is bound to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   448
     * @param localPort the local port the socket is bound to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   449
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   450
    SSLSocketImpl(SSLContextImpl context, String host, int port,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   451
            InetAddress localAddr, int localPort)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   452
            throws IOException, UnknownHostException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   453
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   454
        this.host = host;
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   455
        this.serverNames =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   456
            Utilities.addToSNIServerNameList(this.serverNames, this.host);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   457
        init(context, false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   458
        bind(new InetSocketAddress(localAddr, localPort));
2068
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   459
        SocketAddress socketAddress =
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   460
               host != null ? new InetSocketAddress(host, port) :
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
   461
               new InetSocketAddress(InetAddress.getByName(null), port);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   462
        connect(socketAddress, 0);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   463
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   464
90ce3da70b43 Initial load
duke
parents:
diff changeset
   465
90ce3da70b43 Initial load
duke
parents:
diff changeset
   466
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   467
     * Constructs an SSL connection to a server at a specified address.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   468
     * and TCP port, using the authentication context provided.  This
90ce3da70b43 Initial load
duke
parents:
diff changeset
   469
     * endpoint acts as the client, and may rejoin an existing SSL session
90ce3da70b43 Initial load
duke
parents:
diff changeset
   470
     * if appropriate.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   471
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   472
     * @param context authentication context to use
90ce3da70b43 Initial load
duke
parents:
diff changeset
   473
     * @param address the server's host
90ce3da70b43 Initial load
duke
parents:
diff changeset
   474
     * @param port its port
90ce3da70b43 Initial load
duke
parents:
diff changeset
   475
     * @param localAddr the local address the socket is bound to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   476
     * @param localPort the local port the socket is bound to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   477
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   478
    SSLSocketImpl(SSLContextImpl context, InetAddress host, int port,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   479
            InetAddress localAddr, int localPort)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   480
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   481
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   482
        init(context, false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   483
        bind(new InetSocketAddress(localAddr, localPort));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   484
        SocketAddress socketAddress = new InetSocketAddress(host, port);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   485
        connect(socketAddress, 0);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   486
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   487
90ce3da70b43 Initial load
duke
parents:
diff changeset
   488
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   489
     * Package-private constructor used ONLY by SSLServerSocket.  The
90ce3da70b43 Initial load
duke
parents:
diff changeset
   490
     * java.net package accepts the TCP connection after this call is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   491
     * made.  This just initializes handshake state to use "server mode",
90ce3da70b43 Initial load
duke
parents:
diff changeset
   492
     * giving control over the use of SSL client authentication.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   493
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   494
    SSLSocketImpl(SSLContextImpl context, boolean serverMode,
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   495
            CipherSuiteList suites, ClientAuthType clientAuth,
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   496
            boolean sessionCreation, ProtocolList protocols,
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   497
            String identificationProtocol,
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   498
            AlgorithmConstraints algorithmConstraints,
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   499
            Collection<SNIMatcher> sniMatchers,
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   500
            boolean preferLocalCipherSuites) throws IOException {
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   501
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   502
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   503
        doClientAuth = clientAuth;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   504
        enableSessionCreation = sessionCreation;
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   505
        this.identificationProtocol = identificationProtocol;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   506
        this.algorithmConstraints = algorithmConstraints;
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   507
        this.sniMatchers = sniMatchers;
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
   508
        this.preferLocalCipherSuites = preferLocalCipherSuites;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   509
        init(context, serverMode);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   510
90ce3da70b43 Initial load
duke
parents:
diff changeset
   511
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   512
         * Override what was picked out for us.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   513
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   514
        enabledCipherSuites = suites;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   515
        enabledProtocols = protocols;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   516
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   517
90ce3da70b43 Initial load
duke
parents:
diff changeset
   518
90ce3da70b43 Initial load
duke
parents:
diff changeset
   519
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   520
     * Package-private constructor used to instantiate an unconnected
90ce3da70b43 Initial load
duke
parents:
diff changeset
   521
     * socket. The java.net package will connect it, either when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   522
     * connect() call is made by the application.  This instance is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   523
     * meant to set handshake state to use "client mode".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   524
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   525
    SSLSocketImpl(SSLContextImpl context) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   526
        super();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   527
        init(context, false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   528
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   529
90ce3da70b43 Initial load
duke
parents:
diff changeset
   530
90ce3da70b43 Initial load
duke
parents:
diff changeset
   531
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   532
     * Layer SSL traffic over an existing connection, rather than creating
90ce3da70b43 Initial load
duke
parents:
diff changeset
   533
     * a new connection.  The existing connection may be used only for SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
   534
     * traffic (using this SSLSocket) until the SSLSocket.close() call
90ce3da70b43 Initial load
duke
parents:
diff changeset
   535
     * returns. However, if a protocol error is detected, that existing
90ce3da70b43 Initial load
duke
parents:
diff changeset
   536
     * connection is automatically closed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   537
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   538
     * <P> This particular constructor always uses the socket in the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   539
     * role of an SSL client. It may be useful in cases which start
90ce3da70b43 Initial load
duke
parents:
diff changeset
   540
     * using SSL after some initial data transfers, for example in some
90ce3da70b43 Initial load
duke
parents:
diff changeset
   541
     * SSL tunneling applications or as part of some kinds of application
90ce3da70b43 Initial load
duke
parents:
diff changeset
   542
     * protocols which negotiate use of a SSL based security.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   543
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   544
     * @param sock the existing connection
90ce3da70b43 Initial load
duke
parents:
diff changeset
   545
     * @param context the authentication context to use
90ce3da70b43 Initial load
duke
parents:
diff changeset
   546
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   547
    SSLSocketImpl(SSLContextImpl context, Socket sock, String host,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   548
            int port, boolean autoClose) throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   549
        super(sock);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   550
        // We always layer over a connected socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
   551
        if (!sock.isConnected()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   552
            throw new SocketException("Underlying socket is not connected");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   553
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   554
        this.host = host;
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   555
        this.serverNames =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   556
            Utilities.addToSNIServerNameList(this.serverNames, this.host);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   557
        init(context, false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   558
        this.autoClose = autoClose;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   559
        doneConnect();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   560
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   561
90ce3da70b43 Initial load
duke
parents:
diff changeset
   562
    /**
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   563
     * Creates a server mode {@link Socket} layered over an
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   564
     * existing connected socket, and is able to read data which has
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   565
     * already been consumed/removed from the {@link Socket}'s
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   566
     * underlying {@link InputStream}.
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   567
     */
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   568
    SSLSocketImpl(SSLContextImpl context, Socket sock,
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   569
            InputStream consumed, boolean autoClose) throws IOException {
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   570
        super(sock, consumed);
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   571
        // We always layer over a connected socket
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   572
        if (!sock.isConnected()) {
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   573
            throw new SocketException("Underlying socket is not connected");
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   574
        }
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   575
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   576
        // In server mode, it is not necessary to set host and serverNames.
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   577
        // Otherwise, would require a reverse DNS lookup to get the hostname.
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   578
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   579
        init(context, true);
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   580
        this.autoClose = autoClose;
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   581
        doneConnect();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   582
    }
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   583
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   584
    /**
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   585
     * Initializes the client socket.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   586
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   587
    private void init(SSLContextImpl context, boolean isServer) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   588
        sslContext = context;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   589
        sess = SSLSessionImpl.nullSession;
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
   590
        handshakeSession = null;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   591
90ce3da70b43 Initial load
duke
parents:
diff changeset
   592
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   593
         * role is as specified, state is START until after
90ce3da70b43 Initial load
duke
parents:
diff changeset
   594
         * the low level connection's established.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   595
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   596
        roleIsServer = isServer;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   597
        connectionState = cs_START;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   598
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   599
        // initial security parameters for secure renegotiation
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   600
        secureRenegotiation = false;
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   601
        clientVerifyData = new byte[0];
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   602
        serverVerifyData = new byte[0];
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
   603
9246
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
   604
        enabledCipherSuites =
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
   605
                sslContext.getDefaultCipherSuiteList(roleIsServer);
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
   606
        enabledProtocols =
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
   607
                sslContext.getDefaultProtocolList(roleIsServer);
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
   608
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   609
        inputRecord = new SSLSocketInputRecord();;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   610
        outputRecord = new SSLSocketOutputRecord();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   611
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   612
        maximumPacketSize = outputRecord.getMaxPacketSize();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   613
90ce3da70b43 Initial load
duke
parents:
diff changeset
   614
        // save the acc
90ce3da70b43 Initial load
duke
parents:
diff changeset
   615
        acc = AccessController.getContext();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   616
90ce3da70b43 Initial load
duke
parents:
diff changeset
   617
        input = new AppInputStream(this);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   618
        output = new AppOutputStream(this);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   619
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   620
90ce3da70b43 Initial load
duke
parents:
diff changeset
   621
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   622
     * Connects this socket to the server with a specified timeout
90ce3da70b43 Initial load
duke
parents:
diff changeset
   623
     * value.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   624
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   625
     * This method is either called on an unconnected SSLSocketImpl by the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   626
     * application, or it is called in the constructor of a regular
90ce3da70b43 Initial load
duke
parents:
diff changeset
   627
     * SSLSocketImpl. If we are layering on top on another socket, then
90ce3da70b43 Initial load
duke
parents:
diff changeset
   628
     * this method should not be called, because we assume that the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   629
     * underlying socket is already connected by the time it is passed to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   630
     * us.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   631
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   632
     * @param   endpoint the <code>SocketAddress</code>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   633
     * @param   timeout  the timeout value to be used, 0 is no timeout
90ce3da70b43 Initial load
duke
parents:
diff changeset
   634
     * @throws  IOException if an error occurs during the connection
90ce3da70b43 Initial load
duke
parents:
diff changeset
   635
     * @throws  SocketTimeoutException if timeout expires before connecting
90ce3da70b43 Initial load
duke
parents:
diff changeset
   636
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
   637
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   638
    public void connect(SocketAddress endpoint, int timeout)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   639
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   640
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   641
        if (isLayered()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   642
            throw new SocketException("Already connected");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   643
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   644
90ce3da70b43 Initial load
duke
parents:
diff changeset
   645
        if (!(endpoint instanceof InetSocketAddress)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   646
            throw new SocketException(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   647
                                  "Cannot handle non-Inet socket addresses.");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   648
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   649
90ce3da70b43 Initial load
duke
parents:
diff changeset
   650
        super.connect(endpoint, timeout);
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   651
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   652
        if (host == null || host.length() == 0) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   653
            useImplicitHost(false);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   654
        }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
   655
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   656
        doneConnect();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   657
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   658
90ce3da70b43 Initial load
duke
parents:
diff changeset
   659
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   660
     * Initialize the handshaker and socket streams.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   661
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   662
     * Called by connect, the layered constructor, and SSLServerSocket.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   663
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   664
    void doneConnect() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   665
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   666
         * Save the input and output streams.  May be done only after
90ce3da70b43 Initial load
duke
parents:
diff changeset
   667
         * java.net actually connects using the socket "self", else
90ce3da70b43 Initial load
duke
parents:
diff changeset
   668
         * we get some pretty bizarre failure modes.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   669
         */
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   670
        sockInput = super.getInputStream();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
   671
        sockOutput = super.getOutputStream();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   672
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   673
        inputRecord.setDeliverStream(sockOutput);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   674
        outputRecord.setDeliverStream(sockOutput);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   675
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   676
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   677
         * Move to handshaking state, with pending session initialized
90ce3da70b43 Initial load
duke
parents:
diff changeset
   678
         * to defaults and the appropriate kind of handshaker set up.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   679
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   680
        initHandshaker();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   681
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   682
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
   683
    private synchronized int getConnectionState() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   684
        return connectionState;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   685
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   686
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
   687
    private synchronized void setConnectionState(int state) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   688
        connectionState = state;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   689
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   690
90ce3da70b43 Initial load
duke
parents:
diff changeset
   691
    AccessControlContext getAcc() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   692
        return acc;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   693
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   694
90ce3da70b43 Initial load
duke
parents:
diff changeset
   695
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   696
    // READING AND WRITING RECORDS
90ce3da70b43 Initial load
duke
parents:
diff changeset
   697
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   698
90ce3da70b43 Initial load
duke
parents:
diff changeset
   699
    /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   700
     * Application data record output.
12428
e9feb65d37fa 7157903: JSSE client sockets are very slow
wetmore
parents: 11026
diff changeset
   701
     *
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   702
     * Application data can't be sent until the first handshake establishes
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   703
     * a session.
12428
e9feb65d37fa 7157903: JSSE client sockets are very slow
wetmore
parents: 11026
diff changeset
   704
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   705
    void writeRecord(byte[] source, int offset, int length) throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   706
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   707
         * The loop is in case of HANDSHAKE --> ERROR transitions, etc
90ce3da70b43 Initial load
duke
parents:
diff changeset
   708
         */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   709
        // Don't bother to check the emptiness of source applicatoin data
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   710
        // before the security connection established.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   711
        for (boolean readyForApp = false; !readyForApp;) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   712
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   713
             * Not all states support passing application data.  We
90ce3da70b43 Initial load
duke
parents:
diff changeset
   714
             * synchronize access to the connection state, so that
90ce3da70b43 Initial load
duke
parents:
diff changeset
   715
             * synchronous handshakes can complete cleanly.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   716
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   717
            switch (getConnectionState()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   718
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   719
                /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   720
                 * We've deferred the initial handshaking till just now,
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   721
                 * when presumably a thread's decided it's OK to block for
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   722
                 * longish periods of time for I/O purposes (as well as
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   723
                 * configured the cipher suites it wants to use).
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   724
                 */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   725
                case cs_HANDSHAKE:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   726
                    performInitialHandshake();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   727
                    break;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   728
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   729
                case cs_DATA:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   730
                case cs_RENEGOTIATE:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   731
                    readyForApp = true;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   732
                    break;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   733
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   734
                case cs_ERROR:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   735
                    fatal(Alerts.alert_close_notify,
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   736
                            "error while writing to socket");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   737
                    break; // dummy
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   738
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   739
                case cs_SENT_CLOSE:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   740
                case cs_CLOSED:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   741
                case cs_APP_CLOSED:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   742
                    // we should never get here (check in AppOutputStream)
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   743
                    // this is just a fallback
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   744
                    if (closeReason != null) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   745
                        throw closeReason;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   746
                    } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   747
                        throw new SocketException("Socket closed");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   748
                    }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   749
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   750
                /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   751
                 * Else something's goofy in this state machine's use.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   752
                 */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   753
                default:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   754
                    throw new SSLProtocolException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   755
                            "State error, send app data");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   756
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   757
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   758
90ce3da70b43 Initial load
duke
parents:
diff changeset
   759
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   760
        // Don't bother to really write empty records.  We went this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   761
        // far to drive the handshake machinery, for correctness; not
90ce3da70b43 Initial load
duke
parents:
diff changeset
   762
        // writing empty records improves performance by cutting CPU
90ce3da70b43 Initial load
duke
parents:
diff changeset
   763
        // time and network resource usage.  However, some protocol
90ce3da70b43 Initial load
duke
parents:
diff changeset
   764
        // implementations are fragile and don't like to see empty
90ce3da70b43 Initial load
duke
parents:
diff changeset
   765
        // records, so this also increases robustness.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   766
        //
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   767
        if (length > 0) {
34528
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   768
            IOException ioe = null;
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   769
            byte description = 0;    // 0: never used, make the compiler happy
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   770
            writeLock.lock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   771
            try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   772
                outputRecord.deliver(source, offset, length);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   773
            } catch (SSLHandshakeException she) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   774
                // may be record sequence number overflow
34528
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   775
                description = Alerts.alert_handshake_failure;
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   776
                ioe = she;
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   777
            } catch (IOException e) {
34528
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   778
                description = Alerts.alert_unexpected_message;
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   779
                ioe = e;
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   780
            } finally {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   781
                writeLock.unlock();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   782
            }
34528
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   783
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   784
            // Be care of deadlock. Please don't place the call to fatal()
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   785
            // into the writeLock locked block.
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   786
            if (ioe != null) {
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   787
                fatal(description, ioe);
279258fb670b 8141651: Deadlock in sun.security.ssl.SSLSocketImpl
xuelei
parents: 34380
diff changeset
   788
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   789
        }
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   790
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   791
        /*
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   792
         * Check the sequence number state
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   793
         *
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   794
         * Note that in order to maintain the connection I/O
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   795
         * properly, we check the sequence number after the last
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   796
         * record writing process. As we request renegotiation
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   797
         * or close the connection for wrapped sequence number
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   798
         * when there is enough sequence number space left to
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   799
         * handle a few more records, so the sequence number
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   800
         * of the last record cannot be wrapped.
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   801
         *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   802
         * Don't bother to kickstart the renegotiation when the
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   803
         * local is asking for it.
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
   804
         */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   805
        if ((connectionState == cs_DATA) && outputRecord.seqNumIsHuge()) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   806
            /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   807
             * Ask for renegotiation when need to renew sequence number.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   808
             *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   809
             * Don't bother to kickstart the renegotiation when the local is
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   810
             * asking for it.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   811
             */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   812
            if (debug != null && Debug.isOn("ssl")) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   813
                System.out.println(Thread.currentThread().getName() +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   814
                        ", request renegotiation " +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   815
                        "to avoid sequence number overflow");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   816
            }
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   817
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   818
            startHandshake();
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   819
        }
100
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
   820
    }
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
   821
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   822
    /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   823
     * Alert record output.
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   824
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   825
    void writeAlert(byte level, byte description) throws IOException {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   826
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   827
        // If the record is a close notify alert, we need to honor
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   828
        // socket option SO_LINGER. Note that we will try to send
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   829
        // the close notify even if the SO_LINGER set to zero.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   830
        if ((description == Alerts.alert_close_notify) && getSoLinger() >= 0) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   831
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   832
            // keep and clear the current thread interruption status.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   833
            boolean interrupted = Thread.interrupted();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   834
            try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   835
                if (writeLock.tryLock(getSoLinger(), TimeUnit.SECONDS)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   836
                    try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   837
                        outputRecord.encodeAlert(level, description);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   838
                    } finally {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   839
                        writeLock.unlock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   840
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   841
                } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   842
                    SSLException ssle = new SSLException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   843
                            "SO_LINGER timeout," +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   844
                            " close_notify message cannot be sent.");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   845
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   846
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   847
                    // For layered, non-autoclose sockets, we are not
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   848
                    // able to bring them into a usable state, so we
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   849
                    // treat it as fatal error.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   850
                    if (isLayered() && !autoClose) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   851
                        // Note that the alert description is
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   852
                        // specified as -1, so no message will be send
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   853
                        // to peer anymore.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   854
                        fatal((byte)(-1), ssle);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   855
                    } else if ((debug != null) && Debug.isOn("ssl")) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   856
                        System.out.println(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   857
                            Thread.currentThread().getName() +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   858
                            ", received Exception: " + ssle);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   859
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   860
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   861
                    // RFC2246 requires that the session becomes
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   862
                    // unresumable if any connection is terminated
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   863
                    // without proper close_notify messages with
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   864
                    // level equal to warning.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   865
                    //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   866
                    // RFC4346 no longer requires that a session not be
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   867
                    // resumed if failure to properly close a connection.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   868
                    //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   869
                    // We choose to make the session unresumable if
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   870
                    // failed to send the close_notify message.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   871
                    //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   872
                    sess.invalidate();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   873
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   874
            } catch (InterruptedException ie) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   875
                // keep interrupted status
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   876
                interrupted = true;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   877
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   878
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   879
            // restore the interrupted status
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   880
            if (interrupted) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   881
                Thread.currentThread().interrupt();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   882
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   883
        } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   884
            writeLock.lock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   885
            try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   886
                outputRecord.encodeAlert(level, description);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   887
            } finally {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   888
                writeLock.unlock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   889
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   890
        }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   891
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   892
        // Don't bother to check sequence number overlap here.  If sequence
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   893
        // number is huge, there should be enough sequence number space to
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   894
        // request renegotiation in next application data read and write.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   895
    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   896
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   897
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   898
    int bytesInCompletePacket() throws IOException {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   899
        if (getConnectionState() == cs_HANDSHAKE) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   900
            performInitialHandshake();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   901
        }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   902
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   903
        synchronized (readLock) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   904
            int state = getConnectionState();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   905
            if ((state == cs_CLOSED) ||
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   906
                    (state == cs_ERROR) || (state == cs_APP_CLOSED)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   907
                return -1;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   908
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   909
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   910
            try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   911
                return inputRecord.bytesInCompletePacket(sockInput);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   912
            } catch (EOFException eofe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   913
                boolean handshaking = (connectionState <= cs_HANDSHAKE);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   914
                boolean rethrow = requireCloseNotify || handshaking;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   915
                if ((debug != null) && Debug.isOn("ssl")) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   916
                    System.out.println(Thread.currentThread().getName() +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   917
                        ", received EOFException: "
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   918
                        + (rethrow ? "error" : "ignored"));
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   919
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   920
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   921
                if (!rethrow) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   922
                    // treat as if we had received a close_notify
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   923
                    closeInternal(false);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   924
                } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   925
                    SSLException e;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   926
                    if (handshaking) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   927
                        e = new SSLHandshakeException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   928
                            "Remote host terminated the handshake");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   929
                    } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   930
                        e = new SSLProtocolException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   931
                            "Remote host terminated the handshake");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   932
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   933
                    e.initCause(eofe);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   934
                    throw e;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   935
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   936
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   937
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   938
            return -1;
10915
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   939
        }
1e20964cebf3 7064341: jsse/runtime security problem
xuelei
parents: 9514
diff changeset
   940
    }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   941
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   942
    // the caller have synchronized readLock
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   943
    void expectingFinishFlight() {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   944
        inputRecord.expectingFinishFlight();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   945
    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   946
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   947
    /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   948
     * Read an application data record.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   949
     *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   950
     * Alerts and handshake messages are internally handled directly.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   951
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   952
    int readRecord(ByteBuffer buffer) throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   953
        if (getConnectionState() == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   954
            performInitialHandshake();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   955
        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   956
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   957
        return readRecord(buffer, true);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   958
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   959
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   960
    /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   961
     * Read a record, no application data input required.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   962
     *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   963
     * Alerts and handshake messages are internally handled directly.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   964
     */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   965
    int readRecord(boolean needAppData) throws IOException {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   966
        return readRecord(null, needAppData);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   967
    }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   968
90ce3da70b43 Initial load
duke
parents:
diff changeset
   969
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   970
     * Clear the pipeline of records from the peer, optionally returning
90ce3da70b43 Initial load
duke
parents:
diff changeset
   971
     * application data.   Caller is responsible for knowing that it's
90ce3da70b43 Initial load
duke
parents:
diff changeset
   972
     * possible to do this kind of clearing, if they don't want app
90ce3da70b43 Initial load
duke
parents:
diff changeset
   973
     * data -- e.g. since it's the initial SSL handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   974
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   975
     * Don't synchronize (this) during a blocking read() since it
90ce3da70b43 Initial load
duke
parents:
diff changeset
   976
     * protects data which is accessed on the write side as well.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   977
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   978
    private int readRecord(ByteBuffer buffer, boolean needAppData)
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   979
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   980
        int state;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   981
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   982
        // readLock protects reading and processing of an SSLInputRecord.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   983
        // It keeps the reading from sockInput and processing of the record
90ce3da70b43 Initial load
duke
parents:
diff changeset
   984
        // atomic so that no two threads can be blocked on the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   985
        // read from the same input stream at the same time.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   986
        // This is required for example when a reader thread is
90ce3da70b43 Initial load
duke
parents:
diff changeset
   987
        // blocked on the read and another thread is trying to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   988
        // close the socket. For a non-autoclose, layered socket,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   989
        // the thread performing the close needs to read the close_notify.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   990
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
   991
        // Use readLock instead of 'this' for locking because
90ce3da70b43 Initial load
duke
parents:
diff changeset
   992
        // 'this' also protects data accessed during writing.
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   993
        synchronized (readLock) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   994
            /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   995
             * Read and handle records ... return application data
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   996
             * ONLY if it's needed.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   997
             */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   998
            Plaintext plainText = null;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
   999
            while (((state = getConnectionState()) != cs_CLOSED) &&
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1000
                    (state != cs_ERROR) && (state != cs_APP_CLOSED)) {
36641
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1001
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1002
                /*
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1003
                 * clean the buffer and check if it is too small, e.g. because
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1004
                 * the AppInputStream did not have the chance to see the
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1005
                 * current packet length but rather something like that of the
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1006
                 * handshake before. In that case we return 0 at this point to
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1007
                 * give the caller the chance to adjust the buffer.
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1008
                 */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1009
                if (buffer != null) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1010
                    buffer.clear();
36641
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1011
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1012
                    if (buffer.remaining() <
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1013
                            inputRecord.bytesInCompletePacket(sockInput)) {
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1014
                        return 0;
cbff2fd02f9e 8149169: SSLSocketInputRecord.decodeInputRecord buffer overflow
clanger
parents: 34958
diff changeset
  1015
                    }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1016
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1017
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1018
                /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1019
                 * Read a record ... maybe emitting an alert if we get a
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1020
                 * comprehensible but unsupported "hello" message during
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1021
                 * format checking (e.g. V2).
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1022
                 */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1023
                try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1024
                    plainText = inputRecord.decode(sockInput, buffer);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1025
                } catch (BadPaddingException bpe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1026
                    byte alertType = (state != cs_DATA) ?
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1027
                            Alerts.alert_handshake_failure :
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1028
                            Alerts.alert_bad_record_mac;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1029
                    fatal(alertType, bpe.getMessage(), bpe);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1030
                } catch (SSLProtocolException spe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1031
                    try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1032
                        fatal(Alerts.alert_unexpected_message, spe);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1033
                    } catch (IOException x) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1034
                        // discard this exception, throw the original exception
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1035
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1036
                    throw spe;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1037
                } catch (SSLHandshakeException she) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1038
                    // may be record sequence number overflow
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1039
                    fatal(Alerts.alert_handshake_failure, she);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1040
                } catch (EOFException eof) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1041
                    boolean handshaking = (connectionState <= cs_HANDSHAKE);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1042
                    boolean rethrow = requireCloseNotify || handshaking;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1043
                    if ((debug != null) && Debug.isOn("ssl")) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1044
                        System.out.println(Thread.currentThread().getName() +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1045
                            ", received EOFException: "
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1046
                            + (rethrow ? "error" : "ignored"));
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1047
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1048
                    if (rethrow) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1049
                        SSLException e;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1050
                        if (handshaking) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1051
                            e = new SSLHandshakeException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1052
                                    "Remote host terminated the handshake");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1053
                        } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1054
                            e = new SSLProtocolException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1055
                                    "Remote host terminated the connection");
5182
62836694baeb 6898739: TLS renegotiation issue
xuelei
parents: 2068
diff changeset
  1056
                        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1057
                        e.initCause(eof);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1058
                        throw e;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1059
                    } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1060
                        // treat as if we had received a close_notify
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1061
                        closeInternal(false);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1062
                        continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1063
                    }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1064
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1065
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1066
                // PlainText should never be null. Process input record.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1067
                int volume = processInputRecord(plainText, needAppData);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1068
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1069
                if (plainText.contentType == Record.ct_application_data) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1070
                    return volume;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1071
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1072
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1073
                if (plainText.contentType == Record.ct_handshake) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1074
                    if (!needAppData && connectionState == cs_DATA) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1075
                        return volume;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1076
                    }   // otherwise, need to read more for app data.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1077
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1078
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1079
                // continue to read more net data
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1080
            }   // while
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1081
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1082
            //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1083
            // couldn't read, due to some kind of error
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1084
            //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1085
            return -1;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1086
        }  // readLock synchronization
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1087
    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1088
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1089
    /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1090
     * Process the plainText input record.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1091
     */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1092
    private synchronized int processInputRecord(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1093
            Plaintext plainText, boolean needAppData) throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1094
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1095
        /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1096
         * Process the record.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1097
         */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1098
        int volume = 0;    // no application data
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1099
        switch (plainText.contentType) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1100
            case Record.ct_handshake:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1101
                /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1102
                 * Handshake messages always go to a pending session
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1103
                 * handshaker ... if there isn't one, create one.  This
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1104
                 * must work asynchronously, for renegotiation.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1105
                 *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1106
                 * NOTE that handshaking will either resume a session
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1107
                 * which was in the cache (and which might have other
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1108
                 * connections in it already), or else will start a new
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1109
                 * session (new keys exchanged) with just this connection
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1110
                 * in it.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1111
                 */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1112
                initHandshaker();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1113
                if (!handshaker.activated()) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1114
                    // prior to handshaking, activate the handshake
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1115
                    if (connectionState == cs_RENEGOTIATE) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1116
                        // don't use SSLv2Hello when renegotiating
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1117
                        handshaker.activate(protocolVersion);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1118
                    } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1119
                        handshaker.activate(null);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1120
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1121
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1122
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1123
                /*
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1124
                 * process the handshake record ... may contain just
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1125
                 * a partial handshake message or multiple messages.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1126
                 *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1127
                 * The handshaker state machine will ensure that it's
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1128
                 * a finished message.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1129
                 */
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1130
                handshaker.processRecord(plainText.fragment, expectingFinished);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1131
                expectingFinished = false;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1132
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1133
                if (handshaker.invalidated) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1134
                    handshaker = null;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1135
                    inputRecord.setHandshakeHash(null);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1136
                    outputRecord.setHandshakeHash(null);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1137
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1138
                    // if state is cs_RENEGOTIATE, revert it to cs_DATA
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1139
                    if (connectionState == cs_RENEGOTIATE) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1140
                        connectionState = cs_DATA;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1141
                    }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1142
                } else if (handshaker.isDone()) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1143
                    // reset the parameters for secure renegotiation.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1144
                    secureRenegotiation =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1145
                                    handshaker.isSecureRenegotiation();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1146
                    clientVerifyData = handshaker.getClientVerifyData();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1147
                    serverVerifyData = handshaker.getServerVerifyData();
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  1148
                    // set connection ALPN value
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  1149
                    applicationProtocol =
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  1150
                        handshaker.getHandshakeApplicationProtocol();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1151
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1152
                    sess = handshaker.getSession();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1153
                    handshakeSession = null;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1154
                    handshaker = null;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1155
                    inputRecord.setHandshakeHash(null);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1156
                    outputRecord.setHandshakeHash(null);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1157
                    connectionState = cs_DATA;
28543
31afdc0e77af 8046656: Update protocol support
wetmore
parents: 28059
diff changeset
  1158
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1159
                    //
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1160
                    // Tell folk about handshake completion, but do
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1161
                    // it in a separate thread.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1162
                    //
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1163
                    if (handshakeListeners != null) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1164
                        HandshakeCompletedEvent event =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1165
                            new HandshakeCompletedEvent(this, sess);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1166
34716
7477a052aecc 8056152: API to create Threads that do not inherit inheritable thread-local initial values
chegar
parents: 34528
diff changeset
  1167
                        Thread thread = new Thread(
7477a052aecc 8056152: API to create Threads that do not inherit inheritable thread-local initial values
chegar
parents: 34528
diff changeset
  1168
                            null,
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1169
                            new NotifyHandshake(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1170
                                handshakeListeners.entrySet(), event),
34716
7477a052aecc 8056152: API to create Threads that do not inherit inheritable thread-local initial values
chegar
parents: 34528
diff changeset
  1171
                            "HandshakeCompletedNotify-Thread",
7477a052aecc 8056152: API to create Threads that do not inherit inheritable thread-local initial values
chegar
parents: 34528
diff changeset
  1172
                            0,
7477a052aecc 8056152: API to create Threads that do not inherit inheritable thread-local initial values
chegar
parents: 34528
diff changeset
  1173
                            false);
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1174
                        thread.start();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1175
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1176
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1177
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1178
                break;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1179
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1180
            case Record.ct_application_data:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1181
                if (connectionState != cs_DATA
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1182
                        && connectionState != cs_RENEGOTIATE
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1183
                        && connectionState != cs_SENT_CLOSE) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1184
                    throw new SSLProtocolException(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1185
                        "Data received in non-data state: " +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1186
                        connectionState);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1187
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1188
                if (expectingFinished) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1189
                    throw new SSLProtocolException
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1190
                            ("Expecting finished message, received data");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1191
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1192
                if (!needAppData) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1193
                    throw new SSLException("Discarding app data");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1194
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1195
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1196
                volume = plainText.fragment.remaining();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1197
                break;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1198
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1199
            case Record.ct_alert:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1200
                recvAlert(plainText.fragment);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1201
                break;
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1202
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1203
            case Record.ct_change_cipher_spec:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1204
                if ((connectionState != cs_HANDSHAKE
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1205
                        && connectionState != cs_RENEGOTIATE)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1206
                    // For the CCS message arriving in the wrong state
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1207
                    fatal(Alerts.alert_unexpected_message,
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1208
                            "illegal change cipher spec msg, conn state = "
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1209
                            + connectionState);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1210
                } else if (plainText.fragment.remaining() != 1
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1211
                        || plainText.fragment.get() != 1) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1212
                    // For structural/content issues with the CCS
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1213
                    fatal(Alerts.alert_unexpected_message,
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1214
                            "Malformed change cipher spec msg");
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1215
                }
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1216
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1217
                //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1218
                // The first message after a change_cipher_spec
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1219
                // record MUST be a "Finished" handshake record,
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1220
                // else it's a protocol violation.  We force this
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1221
                // to be checked by a minor tweak to the state
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1222
                // machine.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1223
                //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1224
                handshaker.receiveChangeCipherSpec();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1225
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1226
                CipherBox readCipher;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1227
                Authenticator readAuthenticator;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1228
                try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1229
                    readCipher = handshaker.newReadCipher();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1230
                    readAuthenticator = handshaker.newReadAuthenticator();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1231
                } catch (GeneralSecurityException e) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1232
                    // can't happen
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1233
                    throw new SSLException("Algorithm missing:  ", e);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1234
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1235
                inputRecord.changeReadCiphers(readAuthenticator, readCipher);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1236
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1237
                // next message MUST be a finished message
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1238
                expectingFinished = true;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1239
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1240
                break;
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1241
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1242
            default:
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1243
                //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1244
                // TLS requires that unrecognized records be ignored.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1245
                //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1246
                if (debug != null && Debug.isOn("ssl")) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1247
                    System.out.println(Thread.currentThread().getName() +
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1248
                        ", Received record type: " + plainText.contentType);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1249
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1250
                break;
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1251
        }
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1252
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1253
        /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1254
         * Check the sequence number state
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1255
         *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1256
         * Note that in order to maintain the connection I/O
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1257
         * properly, we check the sequence number after the last
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1258
         * record reading process. As we request renegotiation
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1259
         * or close the connection for wrapped sequence number
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1260
         * when there is enough sequence number space left to
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1261
         * handle a few more records, so the sequence number
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1262
         * of the last record cannot be wrapped.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1263
         *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1264
         * Don't bother to kickstart the renegotiation when the
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1265
         * local is asking for it.
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1266
         */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1267
        if ((connectionState == cs_DATA) && inputRecord.seqNumIsHuge()) {
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1268
            /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1269
             * Ask for renegotiation when need to renew sequence number.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1270
             *
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1271
             * Don't bother to kickstart the renegotiation when the local is
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1272
             * asking for it.
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1273
             */
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1274
            if (debug != null && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1275
                System.out.println(Thread.currentThread().getName() +
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1276
                        ", request renegotiation " +
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1277
                        "to avoid sequence number overflow");
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1278
            }
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1279
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1280
            startHandshake();
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1281
        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1282
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1283
        return volume;
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1284
    }
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1285
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1286
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1287
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1288
    // HANDSHAKE RELATED CODE
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1289
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1290
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1291
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1292
     * Return the AppInputStream. For use by Handshaker only.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1293
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1294
    AppInputStream getAppInputStream() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1295
        return input;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1296
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1297
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1298
    /**
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1299
     * Return the AppOutputStream. For use by Handshaker only.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1300
     */
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1301
    AppOutputStream getAppOutputStream() {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1302
        return output;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1303
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1304
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1305
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1306
     * Initialize the handshaker object. This means:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1307
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1308
     *  . if a handshake is already in progress (state is cs_HANDSHAKE
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1309
     *    or cs_RENEGOTIATE), do nothing and return
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1310
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1311
     *  . if the socket is already closed, throw an Exception (internal error)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1312
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1313
     *  . otherwise (cs_START or cs_DATA), create the appropriate handshaker
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1314
     *    object, and advance the connection state (to cs_HANDSHAKE or
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1315
     *    cs_RENEGOTIATE, respectively).
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1316
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1317
     * This method is called right after a new socket is created, when
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1318
     * starting renegotiation, or when changing client/ server mode of the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1319
     * socket.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1320
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1321
    private void initHandshaker() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1322
        switch (connectionState) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1323
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1324
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1325
        // Starting a new handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1326
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1327
        case cs_START:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1328
        case cs_DATA:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1329
            break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1330
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1331
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1332
        // We're already in the middle of a handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1333
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1334
        case cs_HANDSHAKE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1335
        case cs_RENEGOTIATE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1336
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1337
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1338
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1339
        // Anyone allowed to call this routine is required to
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1340
        // do so ONLY if the connection state is reasonable...
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1341
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1342
        default:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1343
            throw new IllegalStateException("Internal error");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1344
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1345
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1346
        // state is either cs_START or cs_DATA
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1347
        if (connectionState == cs_START) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1348
            connectionState = cs_HANDSHAKE;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1349
        } else { // cs_DATA
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1350
            connectionState = cs_RENEGOTIATE;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1351
        }
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  1352
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1353
        if (roleIsServer) {
5182
62836694baeb 6898739: TLS renegotiation issue
xuelei
parents: 2068
diff changeset
  1354
            handshaker = new ServerHandshaker(this, sslContext,
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1355
                    enabledProtocols, doClientAuth,
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1356
                    protocolVersion, connectionState == cs_HANDSHAKE,
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1357
                    secureRenegotiation, clientVerifyData, serverVerifyData);
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1358
            handshaker.setSNIMatchers(sniMatchers);
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
  1359
            handshaker.setUseCipherSuitesOrder(preferLocalCipherSuites);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1360
        } else {
5182
62836694baeb 6898739: TLS renegotiation issue
xuelei
parents: 2068
diff changeset
  1361
            handshaker = new ClientHandshaker(this, sslContext,
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1362
                    enabledProtocols,
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1363
                    protocolVersion, connectionState == cs_HANDSHAKE,
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1364
                    secureRenegotiation, clientVerifyData, serverVerifyData);
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1365
            handshaker.setSNIServerNames(serverNames);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1366
        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1367
        handshaker.setMaximumPacketSize(maximumPacketSize);
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1368
        handshaker.setEnabledCipherSuites(enabledCipherSuites);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1369
        handshaker.setEnableSessionCreation(enableSessionCreation);
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  1370
        handshaker.setApplicationProtocols(applicationProtocols);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1371
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1372
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1373
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1374
     * Synchronously perform the initial handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1375
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1376
     * If the handshake is already in progress, this method blocks until it
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1377
     * is completed. If the initial handshake has already been completed,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1378
     * it returns immediately.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1379
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1380
    private void performInitialHandshake() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1381
        // use handshakeLock and the state check to make sure only
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1382
        // one thread performs the handshake
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1383
        synchronized (handshakeLock) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1384
            if (getConnectionState() == cs_HANDSHAKE) {
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1385
                kickstartHandshake();
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1386
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1387
                /*
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1388
                 * All initial handshaking goes through this operation
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1389
                 * until we have a valid SSL connection.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1390
                 *
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1391
                 * Handle handshake messages only, need no application data.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1392
                 */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1393
                readRecord(false);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1394
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1395
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1396
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1397
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1398
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1399
     * Starts an SSL handshake on this connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1400
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  1401
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1402
    public void startHandshake() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1403
        // start an ssl handshake that could be resumed from timeout exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1404
        startHandshake(true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1405
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1406
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1407
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1408
     * Starts an ssl handshake on this connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1409
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1410
     * @param resumable indicates the handshake process is resumable from a
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1411
     *          certain exception. If <code>resumable</code>, the socket will
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1412
     *          be reserved for exceptions like timeout; otherwise, the socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1413
     *          will be closed, no further communications could be done.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1414
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1415
    private void startHandshake(boolean resumable) throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1416
        checkWrite();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1417
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1418
            if (getConnectionState() == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1419
                // do initial handshake
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1420
                performInitialHandshake();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1421
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1422
                // start renegotiation
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1423
                kickstartHandshake();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1424
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1425
        } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1426
            // shutdown and rethrow (wrapped) exception as appropriate
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1427
            handleException(e, resumable);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1428
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1429
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1430
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1431
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1432
     * Kickstart the handshake if it is not already in progress.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1433
     * This means:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1434
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1435
     *  . if handshaking is already underway, do nothing and return
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1436
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1437
     *  . if the socket is not connected or already closed, throw an
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1438
     *    Exception.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1439
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1440
     *  . otherwise, call initHandshake() to initialize the handshaker
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1441
     *    object and progress the state. Then, send the initial
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1442
     *    handshaking message if appropriate (always on clients and
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1443
     *    on servers when renegotiating).
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1444
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1445
    private synchronized void kickstartHandshake() throws IOException {
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1446
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1447
        switch (connectionState) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1448
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1449
        case cs_HANDSHAKE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1450
            // handshaker already setup, proceed
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1451
            break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1452
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1453
        case cs_DATA:
6856
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1454
            if (!secureRenegotiation && !Handshaker.allowUnsafeRenegotiation) {
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1455
                throw new SSLHandshakeException(
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1456
                        "Insecure renegotiation is not allowed");
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1457
            }
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1458
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1459
            if (!secureRenegotiation) {
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1460
                if (debug != null && Debug.isOn("handshake")) {
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1461
                    System.out.println(
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1462
                        "Warning: Using insecure renegotiation");
533f4ad71f88 6914943: Implement final TLS renegotiation fix
xuelei
parents: 5506
diff changeset
  1463
                }
5182
62836694baeb 6898739: TLS renegotiation issue
xuelei
parents: 2068
diff changeset
  1464
            }
62836694baeb 6898739: TLS renegotiation issue
xuelei
parents: 2068
diff changeset
  1465
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1466
            // initialize the handshaker, move to cs_RENEGOTIATE
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1467
            initHandshaker();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1468
            break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1469
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1470
        case cs_RENEGOTIATE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1471
            // handshaking already in progress, return
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1472
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1473
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1474
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1475
         * The only way to get a socket in the state is when
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1476
         * you have an unconnected socket.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1477
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1478
        case cs_START:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1479
            throw new SocketException(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1480
                "handshaking attempted on unconnected socket");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1481
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1482
        default:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1483
            throw new SocketException("connection is closed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1484
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1485
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1486
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1487
        // Kickstart handshake state machine if we need to ...
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1488
        //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1489
        // Note that handshaker.kickstart() writes the message
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1490
        // to its HandshakeOutStream, which calls back into
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1491
        // SSLSocketImpl.writeRecord() to send it.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1492
        //
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1493
        if (!handshaker.activated()) {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1494
             // prior to handshaking, activate the handshake
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1495
            if (connectionState == cs_RENEGOTIATE) {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1496
                // don't use SSLv2Hello when renegotiating
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1497
                handshaker.activate(protocolVersion);
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1498
            } else {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1499
                handshaker.activate(null);
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1500
            }
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  1501
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1502
            if (handshaker instanceof ClientHandshaker) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1503
                // send client hello
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1504
                handshaker.kickstart();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1505
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1506
                if (connectionState == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1507
                    // initial handshake, no kickstart message to send
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1508
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1509
                    // we want to renegotiate, send hello request
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1510
                    handshaker.kickstart();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1511
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1512
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1513
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1514
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1515
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1516
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1517
    // CLOSURE RELATED CALLS
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1518
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1519
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1520
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1521
     * Return whether the socket has been explicitly closed by the application.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1522
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  1523
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1524
    public boolean isClosed() {
19223
e27cda06fe6a 8013809: deadlock in SSLSocketImpl between between write and close
xuelei
parents: 16913
diff changeset
  1525
        return connectionState == cs_APP_CLOSED;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1526
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1527
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1528
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1529
     * Return whether we have reached end-of-file.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1530
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1531
     * If the socket is not connected, has been shutdown because of an error
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1532
     * or has been closed, throw an Exception.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1533
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1534
    boolean checkEOF() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1535
        switch (getConnectionState()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1536
        case cs_START:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1537
            throw new SocketException("Socket is not connected");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1538
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1539
        case cs_HANDSHAKE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1540
        case cs_DATA:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1541
        case cs_RENEGOTIATE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1542
        case cs_SENT_CLOSE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1543
            return false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1544
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1545
        case cs_APP_CLOSED:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1546
            throw new SocketException("Socket is closed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1547
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1548
        case cs_ERROR:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1549
        case cs_CLOSED:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1550
        default:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1551
            // either closed because of error, or normal EOF
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1552
            if (closeReason == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1553
                return true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1554
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1555
            IOException e = new SSLException
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1556
                        ("Connection has been shutdown: " + closeReason);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1557
            e.initCause(closeReason);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1558
            throw e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1559
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1560
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1561
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1562
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1563
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1564
     * Check if we can write data to this socket. If not, throw an IOException.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1565
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1566
    void checkWrite() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1567
        if (checkEOF() || (getConnectionState() == cs_SENT_CLOSE)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1568
            // we are at EOF, write must throw Exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1569
            throw new SocketException("Connection closed by remote host");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1570
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1571
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1572
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1573
    private void closeSocket() throws IOException {
1580
9af5946d4060 6745052: SLServerSocket file descriptor leak
xuelei
parents: 100
diff changeset
  1574
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1575
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1576
            System.out.println(Thread.currentThread().getName() +
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1577
                                                ", called closeSocket()");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1578
        }
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1579
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1580
        super.close();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1581
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1582
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1583
    private void closeSocket(boolean selfInitiated) throws IOException {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1584
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1585
            System.out.println(Thread.currentThread().getName() +
11018
be74e8b8f3eb 7111548: unexpected debug log message
xuelei
parents: 10336
diff changeset
  1586
                ", called closeSocket(" + selfInitiated + ")");
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1587
        }
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1588
        if (!isLayered() || autoClose) {
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1589
            super.close();
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1590
        } else if (selfInitiated) {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1591
            // layered && non-autoclose
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1592
            // read close_notify alert to clear input stream
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1593
            waitForClose(false);
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1594
        }
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1595
    }
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1596
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1597
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1598
     * Closing the connection is tricky ... we can't officially close the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1599
     * connection until we know the other end is ready to go away too,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1600
     * and if ever the connection gets aborted we must forget session
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1601
     * state (it becomes invalid).
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1602
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1603
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1604
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1605
     * Closes the SSL connection.  SSL includes an application level
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1606
     * shutdown handshake; you should close SSL sockets explicitly
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1607
     * rather than leaving it for finalization, so that your remote
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1608
     * peer does not experience a protocol error.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1609
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  1610
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1611
    public void close() throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1612
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1613
            System.out.println(Thread.currentThread().getName() +
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1614
                                                    ", called close()");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1615
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1616
        closeInternal(true);  // caller is initiating close
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1617
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1618
        // Clearup the resources.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1619
        try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1620
            synchronized (readLock) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1621
                inputRecord.close();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1622
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1623
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1624
            writeLock.lock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1625
            try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1626
                outputRecord.close();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1627
            } finally {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1628
                writeLock.unlock();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1629
            }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1630
        } catch (IOException ioe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1631
           // ignore
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1632
        }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1633
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1634
        setConnectionState(cs_APP_CLOSED);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1635
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1636
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1637
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1638
     * Don't synchronize the whole method because waitForClose()
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1639
     * (which calls readRecord()) might be called.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1640
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1641
     * @param selfInitiated Indicates which party initiated the close.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1642
     * If selfInitiated, this side is initiating a close; for layered and
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1643
     * non-autoclose socket, wait for close_notify response.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1644
     * If !selfInitiated, peer sent close_notify; we reciprocate but
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1645
     * no need to wait for response.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1646
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1647
    private void closeInternal(boolean selfInitiated) throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1648
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1649
            System.out.println(Thread.currentThread().getName() +
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1650
                        ", called closeInternal(" + selfInitiated + ")");
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1651
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1652
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1653
        int state = getConnectionState();
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1654
        boolean closeSocketCalled = false;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1655
        Throwable cachedThrowable = null;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1656
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1657
            switch (state) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1658
            case cs_START:
13370
785cedd026db 7179879: SSLSocket connect times out instead of throwing socket closed exception
coffeys
parents: 12428
diff changeset
  1659
                // unconnected socket or handshaking has not been initialized
785cedd026db 7179879: SSLSocket connect times out instead of throwing socket closed exception
coffeys
parents: 12428
diff changeset
  1660
                closeSocket(selfInitiated);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1661
                break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1662
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1663
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1664
             * If we're closing down due to error, we already sent (or else
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1665
             * received) the fatal alert ... no niceties, blow the connection
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1666
             * away as quickly as possible (even if we didn't allocate the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1667
             * socket ourselves; it's unusable, regardless).
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1668
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1669
            case cs_ERROR:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1670
                closeSocket();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1671
                break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1672
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1673
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1674
             * Sometimes close() gets called more than once.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1675
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1676
            case cs_CLOSED:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1677
            case cs_APP_CLOSED:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1678
                 break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1679
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1680
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1681
             * Otherwise we indicate clean termination.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1682
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1683
            // case cs_HANDSHAKE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1684
            // case cs_DATA:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1685
            // case cs_RENEGOTIATE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1686
            // case cs_SENT_CLOSE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1687
            default:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1688
                synchronized (this) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1689
                    if (((state = getConnectionState()) == cs_CLOSED) ||
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1690
                       (state == cs_ERROR) || (state == cs_APP_CLOSED)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1691
                        return;  // connection was closed while we waited
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1692
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1693
                    if (state != cs_SENT_CLOSE) {
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1694
                        try {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1695
                            warning(Alerts.alert_close_notify);
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1696
                            connectionState = cs_SENT_CLOSE;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1697
                        } catch (Throwable th) {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1698
                            // we need to ensure socket is closed out
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1699
                            // if we encounter any errors.
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1700
                            connectionState = cs_ERROR;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1701
                            // cache this for later use
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1702
                            cachedThrowable = th;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1703
                            closeSocketCalled = true;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1704
                            closeSocket(selfInitiated);
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1705
                        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1706
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1707
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1708
                // If state was cs_SENT_CLOSE before, we don't do the actual
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1709
                // closing since it is already in progress.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1710
                if (state == cs_SENT_CLOSE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1711
                    if (debug != null && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1712
                        System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1713
                            ", close invoked again; state = " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1714
                            getConnectionState());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1715
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1716
                    if (selfInitiated == false) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1717
                        // We were called because a close_notify message was
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1718
                        // received. This may be due to another thread calling
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1719
                        // read() or due to our call to waitForClose() below.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1720
                        // In either case, just return.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1721
                        return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1722
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1723
                    // Another thread explicitly called close(). We need to
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1724
                    // wait for the closing to complete before returning.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1725
                    synchronized (this) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1726
                        while (connectionState < cs_CLOSED) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1727
                            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1728
                                this.wait();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1729
                            } catch (InterruptedException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1730
                                // ignore
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1731
                            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1732
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1733
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1734
                    if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1735
                        System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1736
                            ", after primary close; state = " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1737
                            getConnectionState());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1738
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1739
                    return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1740
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1741
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1742
                if (!closeSocketCalled)  {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1743
                    closeSocketCalled = true;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1744
                    closeSocket(selfInitiated);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1745
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1746
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1747
                break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1748
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1749
        } finally {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1750
            synchronized (this) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1751
                // Upon exit from this method, the state is always >= cs_CLOSED
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1752
                connectionState = (connectionState == cs_APP_CLOSED)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1753
                                ? cs_APP_CLOSED : cs_CLOSED;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1754
                // notify any threads waiting for the closing to finish
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1755
                this.notifyAll();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1756
            }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1757
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1758
            if (cachedThrowable != null) {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1759
               /*
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1760
                * Rethrow the error to the calling method
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1761
                * The Throwable caught can only be an Error or RuntimeException
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1762
                */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1763
                if (cachedThrowable instanceof Error) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1764
                    throw (Error)cachedThrowable;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1765
                } else if (cachedThrowable instanceof RuntimeException) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1766
                    throw (RuntimeException)cachedThrowable;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1767
                }   // Otherwise, unlikely
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1768
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1769
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1770
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1771
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1772
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1773
     * Reads a close_notify or a fatal alert from the input stream.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1774
     * Keep reading records until we get a close_notify or until
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1775
     * the connection is otherwise closed.  The close_notify or alert
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1776
     * might be read by another reader,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1777
     * which will then process the close and set the connection state.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1778
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1779
    void waitForClose(boolean rethrow) throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1780
        if (debug != null && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1781
            System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1782
                ", waiting for close_notify or alert: state "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1783
                + getConnectionState());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1784
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1785
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1786
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1787
            int state;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1788
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1789
            while (((state = getConnectionState()) != cs_CLOSED) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1790
                   (state != cs_ERROR) && (state != cs_APP_CLOSED)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1791
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1792
                // Ask for app data and then throw it away
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1793
                try {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1794
                    readRecord(true);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1795
                } catch (SocketTimeoutException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1796
                    // if time out, ignore the exception and continue
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1797
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1798
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1799
        } catch (IOException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1800
            if (debug != null && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1801
                System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1802
                    ", Exception while waiting for close " +e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1803
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1804
            if (rethrow) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1805
                throw e; // pass exception up
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1806
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1807
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1808
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1809
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1810
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1811
    // EXCEPTION AND ALERT HANDLING
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1812
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1813
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1814
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1815
     * Handle an exception. This method is called by top level exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1816
     * handlers (in read(), write()) to make sure we always shutdown the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1817
     * connection correctly and do not pass runtime exception to the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1818
     * application.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1819
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1820
    void handleException(Exception e) throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1821
        handleException(e, true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1822
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1823
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1824
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1825
     * Handle an exception. This method is called by top level exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1826
     * handlers (in read(), write(), startHandshake()) to make sure we
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1827
     * always shutdown the connection correctly and do not pass runtime
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1828
     * exception to the application.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1829
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1830
     * This method never returns normally, it always throws an IOException.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1831
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1832
     * We first check if the socket has already been shutdown because of an
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1833
     * error. If so, we just rethrow the exception. If the socket has not
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1834
     * been shutdown, we sent a fatal alert and remember the exception.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1835
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1836
     * @param e the Exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1837
     * @param resumable indicates the caller process is resumable from the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1838
     *          exception. If <code>resumable</code>, the socket will be
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1839
     *          reserved for exceptions like timeout; otherwise, the socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1840
     *          will be closed, no further communications could be done.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1841
     */
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  1842
    private synchronized void handleException(Exception e, boolean resumable)
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1843
        throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1844
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1845
            System.out.println(Thread.currentThread().getName() +
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1846
                        ", handling exception: " + e.toString());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1847
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1848
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1849
        // don't close the Socket in case of timeouts or interrupts if
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1850
        // the process is resumable.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1851
        if (e instanceof InterruptedIOException && resumable) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1852
            throw (IOException)e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1853
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1854
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1855
        // if we've already shutdown because of an error,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1856
        // there is nothing to do except rethrow the exception
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1857
        if (closeReason != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1858
            if (e instanceof IOException) { // includes SSLException
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1859
                throw (IOException)e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1860
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1861
                // this is odd, not an IOException.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1862
                // normally, this should not happen
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1863
                // if closeReason has been already been set
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1864
                throw Alerts.getSSLException(Alerts.alert_internal_error, e,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1865
                                      "Unexpected exception");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1866
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1867
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1868
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1869
        // need to perform error shutdown
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1870
        boolean isSSLException = (e instanceof SSLException);
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1871
        if ((!isSSLException) && (e instanceof IOException)) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1872
            // IOException from the socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1873
            // this means the TCP connection is already dead
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1874
            // we call fatal just to set the error status
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1875
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1876
                fatal(Alerts.alert_unexpected_message, e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1877
            } catch (IOException ee) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1878
                // ignore (IOException wrapped in SSLException)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1879
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1880
            // rethrow original IOException
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1881
            throw (IOException)e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1882
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1883
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1884
        // must be SSLException or RuntimeException
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1885
        byte alertType;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1886
        if (isSSLException) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1887
            if (e instanceof SSLHandshakeException) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1888
                alertType = Alerts.alert_handshake_failure;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1889
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1890
                alertType = Alerts.alert_unexpected_message;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1891
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1892
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1893
            alertType = Alerts.alert_internal_error;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1894
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1895
        fatal(alertType, e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1896
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1897
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1898
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1899
     * Send a warning alert.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1900
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1901
    void warning(byte description) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1902
        sendAlert(Alerts.alert_warning, description);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1903
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1904
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1905
    synchronized void fatal(byte description, String diagnostic)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1906
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1907
        fatal(description, diagnostic, null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1908
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1909
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1910
    synchronized void fatal(byte description, Throwable cause)
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1911
            throws IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1912
        fatal(description, null, cause);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1913
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1914
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1915
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1916
     * Send a fatal alert, and throw an exception so that callers will
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1917
     * need to stand on their heads to accidentally continue processing.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1918
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1919
    synchronized void fatal(byte description, String diagnostic,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1920
            Throwable cause) throws IOException {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1921
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1922
        // Be care of deadlock. Please don't synchronize readLock.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1923
        try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1924
            inputRecord.close();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1925
        } catch (IOException ioe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1926
            // ignore
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1927
        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1928
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1929
        sess.invalidate();
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  1930
        if (handshakeSession != null) {
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  1931
            handshakeSession.invalidate();
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  1932
        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1933
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1934
        int oldState = connectionState;
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1935
        if (connectionState < cs_ERROR) {
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1936
            connectionState = cs_ERROR;
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1937
        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1938
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1939
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1940
         * Has there been an error received yet?  If not, remember it.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1941
         * By RFC 2246, we don't bother waiting for a response.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1942
         * Fatal errors require immediate shutdown.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1943
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1944
        if (closeReason == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1945
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1946
             * Try to clear the kernel buffer to avoid TCP connection resets.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1947
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1948
            if (oldState == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1949
                sockInput.skip(sockInput.available());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1950
            }
100
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  1951
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  1952
            // If the description equals -1, the alert won't be sent to peer.
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  1953
            if (description != -1) {
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  1954
                sendAlert(Alerts.alert_fatal, description);
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  1955
            }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1956
            if (cause instanceof SSLException) { // only true if != null
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1957
                closeReason = (SSLException)cause;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1958
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1959
                closeReason =
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1960
                    Alerts.getSSLException(description, cause, diagnostic);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1961
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1962
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1963
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1964
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1965
         * Clean up our side.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1966
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1967
        closeSocket();
1763
0a6b65d56746 6750401: SSL stress test with GF leads to 32 bit max process size in less than 5 minutes,with PCKS11 provider
wetmore
parents: 1580
diff changeset
  1968
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1969
        // Be care of deadlock. Please don't synchronize writeLock.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1970
        try {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1971
            outputRecord.close();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1972
        } catch (IOException ioe) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1973
            // ignore
9514
bdb24db75fe8 7025227: SSLSocketImpl does not close the TCP layer socket if a close notify cannot be sent to the peer
coffeys
parents: 9246
diff changeset
  1974
        }
1763
0a6b65d56746 6750401: SSL stress test with GF leads to 32 bit max process size in less than 5 minutes,with PCKS11 provider
wetmore
parents: 1580
diff changeset
  1975
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1976
        throw closeReason;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1977
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1978
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1979
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1980
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1981
     * Process an incoming alert ... caller must already have synchronized
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1982
     * access to "this".
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1983
     */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1984
    private void recvAlert(ByteBuffer fragment) throws IOException {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1985
        byte level = fragment.get();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1986
        byte description = fragment.get();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  1987
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1988
        if (description == -1) { // check for short message
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1989
            fatal(Alerts.alert_illegal_parameter, "Short alert message");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1990
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1991
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1992
        if (debug != null && (Debug.isOn("record") ||
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1993
                Debug.isOn("handshake"))) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1994
            synchronized (System.out) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  1995
                System.out.print(Thread.currentThread().getName());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1996
                System.out.print(", RECV " + protocolVersion + " ALERT:  ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1997
                if (level == Alerts.alert_fatal) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1998
                    System.out.print("fatal, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  1999
                } else if (level == Alerts.alert_warning) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2000
                    System.out.print("warning, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2001
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2002
                    System.out.print("<level " + (0x0ff & level) + ">, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2003
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2004
                System.out.println(Alerts.alertDescription(description));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2005
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2006
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2007
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2008
        if (level == Alerts.alert_warning) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2009
            if (description == Alerts.alert_close_notify) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2010
                if (connectionState == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2011
                    fatal(Alerts.alert_unexpected_message,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2012
                                "Received close_notify during handshake");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2013
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2014
                    closeInternal(false);  // reply to close
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2015
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2016
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2017
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2018
                //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2019
                // The other legal warnings relate to certificates,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2020
                // e.g. no_certificate, bad_certificate, etc; these
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2021
                // are important to the handshaking code, which can
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2022
                // also handle illegal protocol alerts if needed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2023
                //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2024
                if (handshaker != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2025
                    handshaker.handshakeAlert(description);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2026
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2027
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2028
        } else { // fatal or unknown level
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2029
            String reason = "Received fatal alert: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2030
                + Alerts.alertDescription(description);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2031
            if (closeReason == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2032
                closeReason = Alerts.getSSLException(description, reason);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2033
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2034
            fatal(Alerts.alert_unexpected_message, reason);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2035
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2036
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2037
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2038
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2039
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2040
     * Emit alerts.  Caller must have synchronized with "this".
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2041
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2042
    private void sendAlert(byte level, byte description) {
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2043
        // the connectionState cannot be cs_START
100
01ef29ca378f 6447412: Issue with socket.close() for ssl sockets when poweroff on other system
xuelei
parents: 2
diff changeset
  2044
        if (connectionState >= cs_SENT_CLOSE) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2045
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2046
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2047
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2048
        // For initial handshaking, don't send alert message to peer if
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2049
        // handshaker has not started.
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2050
        //
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2051
        // Shall we send an fatal alter to terminate the connection gracefully?
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2052
        if (connectionState <= cs_HANDSHAKE &&
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2053
                (handshaker == null || !handshaker.started() ||
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2054
                        !handshaker.activated())) {
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2055
            return;
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2056
        }
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2057
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2058
        boolean useDebug = debug != null && Debug.isOn("ssl");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2059
        if (useDebug) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2060
            synchronized (System.out) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2061
                System.out.print(Thread.currentThread().getName());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2062
                System.out.print(", SEND " + protocolVersion + " ALERT:  ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2063
                if (level == Alerts.alert_fatal) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2064
                    System.out.print("fatal, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2065
                } else if (level == Alerts.alert_warning) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2066
                    System.out.print("warning, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2067
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2068
                    System.out.print("<level = " + (0x0ff & level) + ">, ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2069
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2070
                System.out.println("description = "
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2071
                        + Alerts.alertDescription(description));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2072
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2073
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2074
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2075
        try {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2076
            writeAlert(level, description);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2077
        } catch (IOException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2078
            if (useDebug) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2079
                System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2080
                    ", Exception sending alert: " + e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2081
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2082
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2083
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2084
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2085
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2086
    // VARIOUS OTHER METHODS
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2087
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2088
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2089
    // used by Handshaker
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2090
    void changeWriteCiphers() throws IOException {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2091
        Authenticator writeAuthenticator;
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2092
        CipherBox writeCipher;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2093
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2094
            writeCipher = handshaker.newWriteCipher();
16913
a6f4d1626ad9 8011680: Re-integrate AEAD implementation of JSSE
xuelei
parents: 16126
diff changeset
  2095
            writeAuthenticator = handshaker.newWriteAuthenticator();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2096
        } catch (GeneralSecurityException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2097
            // "can't happen"
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 10128
diff changeset
  2098
            throw new SSLException("Algorithm missing:  ", e);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2099
        }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2100
        outputRecord.changeWriteCiphers(writeAuthenticator, writeCipher);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2101
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2102
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2103
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2104
     * Updates the SSL version associated with this connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2105
     * Called from Handshaker once it has determined the negotiated version.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2106
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2107
    synchronized void setVersion(ProtocolVersion protocolVersion) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2108
        this.protocolVersion = protocolVersion;
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2109
        outputRecord.setVersion(protocolVersion);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2110
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2111
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2112
    //
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2113
    // ONLY used by ClientHandshaker for the server hostname during handshaking
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2114
    //
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2115
    synchronized String getHost() {
2068
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
  2116
        // Note that the host may be null or empty for localhost.
cdbc5929b91e 5067458: Loopback SSLSocketImpl createSocket is throwing an exception
xuelei
parents: 1763
diff changeset
  2117
        if (host == null || host.length() == 0) {
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2118
            useImplicitHost(true);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2119
        }
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2120
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2121
        return host;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2122
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2123
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2124
    /*
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2125
     * Try to set and use the implicit specified hostname
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2126
     */
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2127
    private synchronized void useImplicitHost(boolean noSniUpdate) {
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2128
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2129
        // Note: If the local name service is not trustworthy, reverse
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2130
        // host name resolution should not be performed for endpoint
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2131
        // identification.  Use the application original specified
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2132
        // hostname or IP address instead.
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2133
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2134
        // Get the original hostname via jdk.internal.misc.SharedSecrets
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2135
        InetAddress inetAddress = getInetAddress();
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2136
        if (inetAddress == null) {      // not connected
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2137
            return;
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2138
        }
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2139
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2140
        JavaNetInetAddressAccess jna =
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2141
                SharedSecrets.getJavaNetInetAddressAccess();
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2142
        String originalHostname = jna.getOriginalHostName(inetAddress);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2143
        if ((originalHostname != null) &&
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2144
                (originalHostname.length() != 0)) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2145
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2146
            host = originalHostname;
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2147
            if (!noSniUpdate && serverNames.isEmpty() && !noSniExtension) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2148
                serverNames =
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2149
                        Utilities.addToSNIServerNameList(serverNames, host);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2150
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2151
                if (!roleIsServer &&
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2152
                        (handshaker != null) && !handshaker.started()) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2153
                    handshaker.setSNIServerNames(serverNames);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2154
                }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2155
            }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2156
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2157
            return;
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2158
        }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2159
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2160
        // No explicitly specified hostname, no server name indication.
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2161
        if (!trustNameService) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2162
            // The local name service is not trustworthy, use IP address.
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2163
            host = inetAddress.getHostAddress();
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2164
        } else {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2165
            // Use the underlying reverse host name resolution service.
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2166
            host = getInetAddress().getHostName();
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2167
        }
31687
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2168
    }
d6eb4f028c60 8067694: Improved certification checking
xuelei
parents: 30904
diff changeset
  2169
5162
0dbedf4fdb8c 6614957: HttpsURLConnection not using the set SSLSocketFactory for creating all its Sockets
chegar
parents: 2068
diff changeset
  2170
    // ONLY used by HttpsClient to setup the URI specified hostname
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2171
    //
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2172
    // Please NOTE that this method MUST be called before calling to
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2173
    // SSLSocket.setSSLParameters(). Otherwise, the {@code host} parameter
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2174
    // may override SNIHostName in the customized server name indication.
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2175
    public synchronized void setHost(String host) {
5162
0dbedf4fdb8c 6614957: HttpsURLConnection not using the set SSLSocketFactory for creating all its Sockets
chegar
parents: 2068
diff changeset
  2176
        this.host = host;
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2177
        this.serverNames =
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2178
            Utilities.addToSNIServerNameList(this.serverNames, this.host);
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2179
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2180
        if (!roleIsServer && (handshaker != null) && !handshaker.started()) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2181
            handshaker.setSNIServerNames(serverNames);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2182
        }
5162
0dbedf4fdb8c 6614957: HttpsURLConnection not using the set SSLSocketFactory for creating all its Sockets
chegar
parents: 2068
diff changeset
  2183
    }
0dbedf4fdb8c 6614957: HttpsURLConnection not using the set SSLSocketFactory for creating all its Sockets
chegar
parents: 2068
diff changeset
  2184
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2185
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2186
     * Gets an input stream to read from the peer on the other side.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2187
     * Data read from this stream was always integrity protected in
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2188
     * transit, and will usually have been confidentiality protected.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2189
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2190
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2191
    public synchronized InputStream getInputStream() throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2192
        if (isClosed()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2193
            throw new SocketException("Socket is closed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2194
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2195
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2196
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2197
         * Can't call isConnected() here, because the Handshakers
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2198
         * do some initialization before we actually connect.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2199
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2200
        if (connectionState == cs_START) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2201
            throw new SocketException("Socket is not connected");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2202
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2203
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2204
        return input;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2205
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2206
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2207
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2208
     * Gets an output stream to write to the peer on the other side.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2209
     * Data written on this stream is always integrity protected, and
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2210
     * will usually be confidentiality protected.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2211
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2212
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2213
    public synchronized OutputStream getOutputStream() throws IOException {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2214
        if (isClosed()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2215
            throw new SocketException("Socket is closed");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2216
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2217
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2218
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2219
         * Can't call isConnected() here, because the Handshakers
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2220
         * do some initialization before we actually connect.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2221
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2222
        if (connectionState == cs_START) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2223
            throw new SocketException("Socket is not connected");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2224
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2225
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2226
        return output;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2227
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2228
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2229
    /**
28059
e576535359cc 8067377: My hobby: caning, then then canning, the the can-can
martin
parents: 25859
diff changeset
  2230
     * Returns the SSL Session in use by this connection.  These can
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2231
     * be long lived, and frequently correspond to an entire login session
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2232
     * for some user.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2233
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2234
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2235
    public SSLSession getSession() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2236
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2237
         * Force a synchronous handshake, if appropriate.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2238
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2239
        if (getConnectionState() == cs_HANDSHAKE) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2240
            try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2241
                // start handshaking, if failed, the connection will be closed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2242
                startHandshake(false);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2243
            } catch (IOException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2244
                // handshake failed. log and return a nullSession
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2245
                if (debug != null && Debug.isOn("handshake")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2246
                      System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2247
                          ", IOException in getSession():  " + e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2248
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2249
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2250
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2251
        synchronized (this) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2252
            return sess;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2253
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2254
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2255
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2256
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2257
    public synchronized SSLSession getHandshakeSession() {
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2258
        return handshakeSession;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2259
    }
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2260
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2261
    synchronized void setHandshakeSession(SSLSessionImpl session) {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2262
        // update the fragment size, which may be negotiated during handshaking
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2263
        inputRecord.changeFragmentSize(session.getNegotiatedMaxFragSize());
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2264
        outputRecord.changeFragmentSize(session.getNegotiatedMaxFragSize());
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2265
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2266
        handshakeSession = session;
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2267
    }
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2268
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2269
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2270
     * Controls whether new connections may cause creation of new SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2271
     * sessions.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2272
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2273
     * As long as handshaking has not started, we can change
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2274
     * whether we enable session creations.  Otherwise,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2275
     * we will need to wait for the next handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2276
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2277
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2278
    public synchronized void setEnableSessionCreation(boolean flag) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2279
        enableSessionCreation = flag;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2280
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2281
        if ((handshaker != null) && !handshaker.activated()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2282
            handshaker.setEnableSessionCreation(enableSessionCreation);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2283
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2284
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2285
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2286
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2287
     * Returns true if new connections may cause creation of new SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2288
     * sessions.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2289
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2290
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2291
    public synchronized boolean getEnableSessionCreation() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2292
        return enableSessionCreation;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2293
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2294
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2295
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2296
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2297
     * Sets the flag controlling whether a server mode socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2298
     * *REQUIRES* SSL client authentication.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2299
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2300
     * As long as handshaking has not started, we can change
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2301
     * whether client authentication is needed.  Otherwise,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2302
     * we will need to wait for the next handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2303
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2304
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2305
    public synchronized void setNeedClientAuth(boolean flag) {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2306
        doClientAuth = (flag ? ClientAuthType.CLIENT_AUTH_REQUIRED :
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2307
                ClientAuthType.CLIENT_AUTH_NONE);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2308
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2309
        if ((handshaker != null) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2310
                (handshaker instanceof ServerHandshaker) &&
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2311
                !handshaker.activated()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2312
            ((ServerHandshaker) handshaker).setClientAuth(doClientAuth);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2313
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2314
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2315
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2316
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2317
    public synchronized boolean getNeedClientAuth() {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2318
        return (doClientAuth == ClientAuthType.CLIENT_AUTH_REQUIRED);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2319
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2320
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2321
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2322
     * Sets the flag controlling whether a server mode socket
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2323
     * *REQUESTS* SSL client authentication.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2324
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2325
     * As long as handshaking has not started, we can change
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2326
     * whether client authentication is requested.  Otherwise,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2327
     * we will need to wait for the next handshake.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2328
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2329
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2330
    public synchronized void setWantClientAuth(boolean flag) {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2331
        doClientAuth = (flag ? ClientAuthType.CLIENT_AUTH_REQUESTED :
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2332
                ClientAuthType.CLIENT_AUTH_NONE);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2333
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2334
        if ((handshaker != null) &&
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2335
                (handshaker instanceof ServerHandshaker) &&
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2336
                !handshaker.activated()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2337
            ((ServerHandshaker) handshaker).setClientAuth(doClientAuth);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2338
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2339
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2340
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2341
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2342
    public synchronized boolean getWantClientAuth() {
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2343
        return (doClientAuth == ClientAuthType.CLIENT_AUTH_REQUESTED);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2344
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2345
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2346
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2347
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2348
     * Sets the flag controlling whether the socket is in SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2349
     * client or server mode.  Must be called before any SSL
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2350
     * traffic has started.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2351
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2352
    @Override
10336
0bb1999251f8 7064075: Security libraries don't build with javac -Xlint:all,-deprecation -Werror
jjg
parents: 10128
diff changeset
  2353
    @SuppressWarnings("fallthrough")
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2354
    public synchronized void setUseClientMode(boolean flag) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2355
        switch (connectionState) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2356
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2357
        case cs_START:
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2358
            /*
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2359
             * If we need to change the socket mode and the enabled
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2360
             * protocols and cipher suites haven't specifically been
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2361
             * set by the user, change them to the corresponding
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2362
             * default ones.
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2363
             */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2364
            if (roleIsServer != (!flag)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2365
                if (sslContext.isDefaultProtocolList(enabledProtocols)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2366
                    enabledProtocols =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2367
                            sslContext.getDefaultProtocolList(!flag);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2368
                }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2369
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2370
                if (sslContext.isDefaultCipherSuiteList(enabledCipherSuites)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2371
                    enabledCipherSuites =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2372
                            sslContext.getDefaultCipherSuiteList(!flag);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2373
                }
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2374
            }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2375
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2376
            roleIsServer = !flag;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2377
            break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2378
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2379
        case cs_HANDSHAKE:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2380
            /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2381
             * If we have a handshaker, but haven't started
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2382
             * SSL traffic, we can throw away our current
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2383
             * handshaker, and start from scratch.  Don't
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2384
             * need to call doneConnect() again, we already
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2385
             * have the streams.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2386
             */
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2387
            assert(handshaker != null);
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2388
            if (!handshaker.activated()) {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2389
                /*
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2390
                 * If we need to change the socket mode and the enabled
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2391
                 * protocols and cipher suites haven't specifically been
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2392
                 * set by the user, change them to the corresponding
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2393
                 * default ones.
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2394
                 */
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2395
                if (roleIsServer != (!flag)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2396
                    if (sslContext.isDefaultProtocolList(enabledProtocols)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2397
                        enabledProtocols =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2398
                                sslContext.getDefaultProtocolList(!flag);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2399
                    }
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2400
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2401
                    if (sslContext.isDefaultCipherSuiteList(
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2402
                                                    enabledCipherSuites)) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2403
                        enabledCipherSuites =
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2404
                            sslContext.getDefaultCipherSuiteList(!flag);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2405
                    }
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2406
                }
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2407
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2408
                roleIsServer = !flag;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2409
                connectionState = cs_START;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2410
                initHandshaker();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2411
                break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2412
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2413
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2414
            // If handshake has started, that's an error.  Fall through...
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2415
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2416
        default:
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2417
            if (debug != null && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2418
                System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2419
                    ", setUseClientMode() invoked in state = " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2420
                    connectionState);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2421
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2422
            throw new IllegalArgumentException(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2423
                "Cannot change mode after SSL traffic has started");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2424
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2425
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2426
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2427
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2428
    public synchronized boolean getUseClientMode() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2429
        return !roleIsServer;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2430
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2431
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2432
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2433
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2434
     * Returns the names of the cipher suites which could be enabled for use
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2435
     * on an SSL connection.  Normally, only a subset of these will actually
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2436
     * be enabled by default, since this list may include cipher suites which
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2437
     * do not support the mutual authentication of servers and clients, or
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2438
     * which do not protect data confidentiality.  Servers may also need
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2439
     * certain kinds of certificates to use certain cipher suites.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2440
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2441
     * @return an array of cipher suite names
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2442
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2443
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2444
    public String[] getSupportedCipherSuites() {
13815
2de30ecf335e 7199066: Typo in method name
xuelei
parents: 13370
diff changeset
  2445
        return sslContext.getSupportedCipherSuiteList().toStringArray();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2446
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2447
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2448
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2449
     * Controls which particular cipher suites are enabled for use on
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2450
     * this connection.  The cipher suites must have been listed by
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2451
     * getCipherSuites() as being supported.  Even if a suite has been
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2452
     * enabled, it might never be used if no peer supports it or the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2453
     * requisite certificates (and private keys) are not available.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2454
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2455
     * @param suites Names of all the cipher suites to enable.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2456
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2457
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2458
    public synchronized void setEnabledCipherSuites(String[] suites) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2459
        enabledCipherSuites = new CipherSuiteList(suites);
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2460
        if ((handshaker != null) && !handshaker.activated()) {
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2461
            handshaker.setEnabledCipherSuites(enabledCipherSuites);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2462
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2463
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2464
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2465
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2466
     * Returns the names of the SSL cipher suites which are currently enabled
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2467
     * for use on this connection.  When an SSL socket is first created,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2468
     * all enabled cipher suites <em>(a)</em> protect data confidentiality,
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2469
     * by traffic encryption, and <em>(b)</em> can mutually authenticate
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2470
     * both clients and servers.  Thus, in some environments, this value
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2471
     * might be empty.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2472
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2473
     * @return an array of cipher suite names
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2474
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2475
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2476
    public synchronized String[] getEnabledCipherSuites() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2477
        return enabledCipherSuites.toStringArray();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2478
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2479
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2480
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2481
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2482
     * Returns the protocols that are supported by this implementation.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2483
     * A subset of the supported protocols may be enabled for this connection
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2484
     * @return an array of protocol names.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2485
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2486
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2487
    public String[] getSupportedProtocols() {
9246
c459f79af46b 6976117: SSLContext.getInstance("TLSv1.1") returns SSLEngines/SSLSockets without TLSv1.1 enabled
xuelei
parents: 7043
diff changeset
  2488
        return sslContext.getSuportedProtocolList().toStringArray();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2489
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2490
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2491
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2492
     * Controls which protocols are enabled for use on
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2493
     * this connection.  The protocols must have been listed by
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2494
     * getSupportedProtocols() as being supported.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2495
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2496
     * @param protocols protocols to enable.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2497
     * @exception IllegalArgumentException when one of the protocols
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2498
     *  named by the parameter is not supported.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2499
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2500
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2501
    public synchronized void setEnabledProtocols(String[] protocols) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2502
        enabledProtocols = new ProtocolList(protocols);
7039
6464c8e62a18 4873188: Support TLS 1.1
xuelei
parents: 6856
diff changeset
  2503
        if ((handshaker != null) && !handshaker.activated()) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2504
            handshaker.setEnabledProtocols(enabledProtocols);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2505
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2506
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2507
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2508
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2509
    public synchronized String[] getEnabledProtocols() {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2510
        return enabledProtocols.toStringArray();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2511
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2512
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2513
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2514
     * Assigns the socket timeout.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2515
     * @see java.net.Socket#setSoTimeout
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2516
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2517
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2518
    public void setSoTimeout(int timeout) throws SocketException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2519
        if ((debug != null) && Debug.isOn("ssl")) {
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2520
            System.out.println(Thread.currentThread().getName() +
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2521
                ", setSoTimeout(" + timeout + ") called");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2522
        }
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2523
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2524
        super.setSoTimeout(timeout);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2525
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2526
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2527
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2528
     * Registers an event listener to receive notifications that an
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2529
     * SSL handshake has completed on this connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2530
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2531
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2532
    public synchronized void addHandshakeCompletedListener(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2533
            HandshakeCompletedListener listener) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2534
        if (listener == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2535
            throw new IllegalArgumentException("listener is null");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2536
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2537
        if (handshakeListeners == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2538
            handshakeListeners = new
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2539
                HashMap<HandshakeCompletedListener, AccessControlContext>(4);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2540
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2541
        handshakeListeners.put(listener, AccessController.getContext());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2542
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2543
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2544
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2545
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2546
     * Removes a previously registered handshake completion listener.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2547
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2548
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2549
    public synchronized void removeHandshakeCompletedListener(
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2550
            HandshakeCompletedListener listener) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2551
        if (handshakeListeners == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2552
            throw new IllegalArgumentException("no listeners");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2553
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2554
        if (handshakeListeners.remove(listener) == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2555
            throw new IllegalArgumentException("listener not registered");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2556
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2557
        if (handshakeListeners.isEmpty()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2558
            handshakeListeners = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2559
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2560
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2561
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2562
    /**
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2563
     * Returns the SSLParameters in effect for this SSLSocket.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2564
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2565
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2566
    public synchronized SSLParameters getSSLParameters() {
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2567
        SSLParameters params = super.getSSLParameters();
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2568
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2569
        // the super implementation does not handle the following parameters
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2570
        params.setEndpointIdentificationAlgorithm(identificationProtocol);
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2571
        params.setAlgorithmConstraints(algorithmConstraints);
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2572
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2573
        if (sniMatchers.isEmpty() && !noSniMatcher) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2574
            // 'null' indicates none has been set
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2575
            params.setSNIMatchers(null);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2576
        } else {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2577
            params.setSNIMatchers(sniMatchers);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2578
        }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2579
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2580
        if (serverNames.isEmpty() && !noSniExtension) {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2581
            // 'null' indicates none has been set
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2582
            params.setServerNames(null);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2583
        } else {
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2584
            params.setServerNames(serverNames);
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2585
        }
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2586
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
  2587
        params.setUseCipherSuitesOrder(preferLocalCipherSuites);
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2588
        params.setMaximumPacketSize(maximumPacketSize);
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2589
        params.setApplicationProtocols(applicationProtocols);
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2590
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2591
        // DTLS handshake retransmissions parameter does not apply here.
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2592
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2593
        return params;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2594
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2595
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2596
    /**
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2597
     * Applies SSLParameters to this socket.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2598
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2599
    @Override
32649
2ee9017c7597 8136583: Core libraries should use blessed modifier order
martin
parents: 31918
diff changeset
  2600
    public synchronized void setSSLParameters(SSLParameters params) {
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2601
        super.setSSLParameters(params);
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2602
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2603
        // the super implementation does not handle the following parameters
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2604
        identificationProtocol = params.getEndpointIdentificationAlgorithm();
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2605
        algorithmConstraints = params.getAlgorithmConstraints();
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
  2606
        preferLocalCipherSuites = params.getUseCipherSuitesOrder();
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2607
        maximumPacketSize = params.getMaximumPacketSize();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2608
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2609
        // DTLS handshake retransmissions parameter does not apply here.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2610
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2611
        if (maximumPacketSize != 0) {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2612
            outputRecord.changePacketSize(maximumPacketSize);
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2613
        } else {
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2614
            // use the implicit maximum packet size.
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2615
            maximumPacketSize = outputRecord.getMaxPacketSize();
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2616
        }
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2617
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2618
        List<SNIServerName> sniNames = params.getServerNames();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2619
        if (sniNames != null) {
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2620
            noSniExtension = sniNames.isEmpty();
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2621
            serverNames = sniNames;
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2622
        }
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2623
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2624
        Collection<SNIMatcher> matchers = params.getSNIMatchers();
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2625
        if (matchers != null) {
37601
6517589dcc94 8144566: Custom HostnameVerifier disables SNI extension
xuelei
parents: 36641
diff changeset
  2626
            noSniMatcher = matchers.isEmpty();
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2627
            sniMatchers = matchers;
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2628
        }
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2629
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2630
        applicationProtocols = params.getApplicationProtocols();
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2631
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2632
        if ((handshaker != null) && !handshaker.started()) {
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2633
            handshaker.setIdentificationProtocol(identificationProtocol);
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2634
            handshaker.setAlgorithmConstraints(algorithmConstraints);
30904
ec0224270f90 8043758: Datagram Transport Layer Security (DTLS)
xuelei
parents: 29923
diff changeset
  2635
            handshaker.setMaximumPacketSize(maximumPacketSize);
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2636
            handshaker.setApplicationProtocols(applicationProtocols);
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2637
            if (roleIsServer) {
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2638
                handshaker.setSNIMatchers(sniMatchers);
19823
f0fd09e20528 7188657: There should be a way to reorder the JSSE ciphers
xuelei
parents: 19223
diff changeset
  2639
                handshaker.setUseCipherSuitesOrder(preferLocalCipherSuites);
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2640
            } else {
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2641
                handshaker.setSNIServerNames(serverNames);
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2642
            }
7043
5e2d1edeb2c7 6916074: Add support for TLS 1.2
xuelei
parents: 7039
diff changeset
  2643
        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2644
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2645
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2646
    @Override
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2647
    public synchronized String getApplicationProtocol() {
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2648
        return applicationProtocol;
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2649
    }
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2650
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2651
    @Override
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2652
    public synchronized String getHandshakeApplicationProtocol() {
34958
82de431119cd 8145849: ALPN: getHandshakeApplicationProtocol() always return null
wetmore
parents: 34716
diff changeset
  2653
        if ((handshaker != null) && handshaker.started()) {
34380
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2654
            return handshaker.getHandshakeApplicationProtocol();
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2655
        }
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2656
        return null;
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2657
    }
2b2609379881 8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents: 32834
diff changeset
  2658
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2659
    //
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2660
    // We allocate a separate thread to deliver handshake completion
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2661
    // events.  This ensures that the notifications don't block the
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2662
    // protocol state machine.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2663
    //
29923
e3ee0996bedb 8042332: Enhance thread contexts in security libraries
valeriep
parents: 28550
diff changeset
  2664
    private static class NotifyHandshake implements Runnable {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2665
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2666
        private Set<Map.Entry<HandshakeCompletedListener,AccessControlContext>>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2667
                targets;        // who gets notified
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2668
        private HandshakeCompletedEvent event;          // the notification
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2669
29923
e3ee0996bedb 8042332: Enhance thread contexts in security libraries
valeriep
parents: 28550
diff changeset
  2670
        NotifyHandshake(
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2671
            Set<Map.Entry<HandshakeCompletedListener,AccessControlContext>>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2672
            entrySet, HandshakeCompletedEvent e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2673
10128
f505a8514bd7 7065972: Some race condition may happen in SSLSocketImpl class
xuelei
parents: 9514
diff changeset
  2674
            targets = new HashSet<>(entrySet);          // clone the entry set
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2675
            event = e;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2676
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2677
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2678
        @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2679
        public void run() {
10128
f505a8514bd7 7065972: Some race condition may happen in SSLSocketImpl class
xuelei
parents: 9514
diff changeset
  2680
            // Don't need to synchronize, as it only runs in one thread.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2681
            for (Map.Entry<HandshakeCompletedListener,AccessControlContext>
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2682
                entry : targets) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2683
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2684
                final HandshakeCompletedListener l = entry.getKey();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2685
                AccessControlContext acc = entry.getValue();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2686
                AccessController.doPrivileged(new PrivilegedAction<Void>() {
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2687
                    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2688
                    public Void run() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2689
                        l.handshakeCompleted(event);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2690
                        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2691
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2692
                }, acc);
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2693
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2694
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2695
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2696
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2697
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2698
     * Returns a printable representation of this end of the connection.
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2699
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 14194
diff changeset
  2700
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2701
    public String toString() {
24969
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 21278
diff changeset
  2702
        StringBuilder retval = new StringBuilder(80);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2703
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2704
        retval.append(Integer.toHexString(hashCode()));
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2705
        retval.append("[");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2706
        retval.append(sess.getCipherSuite());
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2707
        retval.append(": ");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2708
14194
971f46db533d 7068321: Support TLS Server Name Indication (SNI) Extension in JSSE Server
xuelei
parents: 13815
diff changeset
  2709
        retval.append(super.toString());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2710
        retval.append("]");
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2711
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2712
        return retval.toString();
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2713
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
  2714
}