author | xuelei |
Mon, 25 Jun 2018 13:41:39 -0700 | |
changeset 50768 | 68fa3d4026ea |
parent 47216 | src/java.base/share/classes/sun/security/ssl/Alerts.java@71c04702a3d5 |
child 51222 | d5138f8da1ba |
permissions | -rw-r--r-- |
2 | 1 |
/* |
50768 | 2 |
* Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
package sun.security.ssl; |
|
27 |
||
50768 | 28 |
import java.io.IOException; |
29 |
import java.nio.ByteBuffer; |
|
30 |
import java.text.MessageFormat; |
|
31 |
import java.util.Locale; |
|
32 |
import javax.net.ssl.SSLException; |
|
33 |
import javax.net.ssl.SSLHandshakeException; |
|
2 | 34 |
|
50768 | 35 |
/** |
36 |
* SSL/(D)TLS Alter description |
|
37 |
*/ |
|
38 |
enum Alert { |
|
39 |
// Please refer to TLS Alert Registry for the latest (D)TLS Alert values: |
|
40 |
// https://www.iana.org/assignments/tls-parameters/ |
|
41 |
CLOSE_NOTIFY ((byte)0, "close_notify", false), |
|
42 |
UNEXPECTED_MESSAGE ((byte)10, "unexpected_message", false), |
|
43 |
BAD_RECORD_MAC ((byte)20, "bad_record_mac", false), |
|
44 |
DECRYPTION_FAILED ((byte)21, "decryption_failed", false), |
|
45 |
RECORD_OVERFLOW ((byte)22, "record_overflow", false), |
|
46 |
DECOMPRESSION_FAILURE ((byte)30, "decompression_failure", false), |
|
47 |
HANDSHAKE_FAILURE ((byte)40, "handshake_failure", true), |
|
48 |
NO_CERTIFICATE ((byte)41, "no_certificate", true), |
|
49 |
BAD_CERTIFICATE ((byte)42, "bad_certificate", true), |
|
50 |
UNSUPPORTED_CERTIFCATE ((byte)43, "unsupported_certificate", true), |
|
51 |
CERTIFICATE_REVOKED ((byte)44, "certificate_revoked", true), |
|
52 |
CERTIFICATE_EXPIRED ((byte)45, "certificate_expired", true), |
|
53 |
CERTIFICATE_UNKNOWN ((byte)46, "certificate_unknown", true), |
|
54 |
ILLEGAL_PARAMETER ((byte)47, "illegal_parameter", true), |
|
55 |
UNKNOWN_CA ((byte)48, "unknown_ca", true), |
|
56 |
ACCESS_DENIED ((byte)49, "access_denied", true), |
|
57 |
DECODE_ERROR ((byte)50, "decode_error", true), |
|
58 |
DECRYPT_ERROR ((byte)51, "decrypt_error", true), |
|
59 |
EXPORT_RESTRICTION ((byte)60, "export_restriction", true), |
|
60 |
PROTOCOL_VERSION ((byte)70, "protocol_version", true), |
|
61 |
INSUFFICIENT_SECURITY ((byte)71, "insufficient_security", true), |
|
62 |
INTERNAL_ERROR ((byte)80, "internal_error", false), |
|
63 |
INAPPROPRIATE_FALLBACK ((byte)86, "inappropriate_fallback", false), |
|
64 |
USER_CANCELED ((byte)90, "user_canceled", false), |
|
65 |
NO_RENEGOTIATION ((byte)100, "no_renegotiation", true), |
|
66 |
MISSING_EXTENSION ((byte)109, "missing_extension", true), |
|
67 |
UNSUPPORTED_EXTENSION ((byte)110, "unsupported_extension", true), |
|
68 |
CERT_UNOBTAINABLE ((byte)111, "certificate_unobtainable", true), |
|
69 |
UNRECOGNIZED_NAME ((byte)112, "unrecognized_name", true), |
|
70 |
BAD_CERT_STATUS_RESPONSE((byte)113, |
|
71 |
"bad_certificate_status_response", true), |
|
72 |
BAD_CERT_HASH_VALUE ((byte)114, "bad_certificate_hash_value", true), |
|
73 |
UNKNOWN_PSK_IDENTITY ((byte)115, "unknown_psk_identity", true), |
|
74 |
CERTIFICATE_REQUIRED ((byte)116, "certificate_required", true), |
|
75 |
NO_APPLICATION_PROTOCOL ((byte)120, "no_application_protocol", true); |
|
2 | 76 |
|
50768 | 77 |
// ordinal value of the Alert |
78 |
final byte id; |
|
79 |
||
80 |
// description of the Alert |
|
81 |
final String description; |
|
82 |
||
83 |
// Does tha alert happen during handshake only? |
|
84 |
final boolean handshakeOnly; |
|
2 | 85 |
|
50768 | 86 |
// Alert message consumer |
87 |
static final SSLConsumer alertConsumer = new AlertConsumer(); |
|
34380
2b2609379881
8144093: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension
vinnie
parents:
25859
diff
changeset
|
88 |
|
50768 | 89 |
private Alert(byte id, String description, boolean handshakeOnly) { |
90 |
this.id = id; |
|
91 |
this.description = description; |
|
92 |
this.handshakeOnly = handshakeOnly; |
|
93 |
} |
|
2 | 94 |
|
50768 | 95 |
static Alert valueOf(byte id) { |
96 |
for (Alert al : Alert.values()) { |
|
97 |
if (al.id == id) { |
|
98 |
return al; |
|
99 |
} |
|
100 |
} |
|
101 |
||
102 |
return null; |
|
103 |
} |
|
104 |
||
105 |
static String nameOf(byte id) { |
|
106 |
for (Alert al : Alert.values()) { |
|
107 |
if (al.id == id) { |
|
108 |
return al.description; |
|
109 |
} |
|
110 |
} |
|
111 |
||
112 |
return "UNKNOWN ALERT (" + (id & 0x0FF) + ")"; |
|
113 |
} |
|
114 |
||
115 |
SSLException createSSLException(String reason) { |
|
116 |
return createSSLException(reason, null); |
|
117 |
} |
|
118 |
||
119 |
SSLException createSSLException(String reason, Throwable cause) { |
|
120 |
if (reason == null) { |
|
121 |
reason = (cause != null) ? cause.getMessage() : ""; |
|
122 |
} |
|
123 |
||
124 |
SSLException ssle = handshakeOnly ? |
|
125 |
new SSLHandshakeException(reason) : new SSLException(reason); |
|
126 |
if (cause != null) { |
|
127 |
ssle.initCause(cause); |
|
128 |
} |
|
2 | 129 |
|
50768 | 130 |
return ssle; |
131 |
} |
|
132 |
||
133 |
/** |
|
134 |
* SSL/(D)TLS Alert level. |
|
135 |
*/ |
|
136 |
enum Level { |
|
137 |
WARNING ((byte)1, "warning"), |
|
138 |
FATAL ((byte)2, "fatal"); |
|
139 |
||
140 |
// ordinal value of the Alert level |
|
141 |
final byte level; |
|
142 |
||
143 |
// description of the Alert level |
|
144 |
final String description; |
|
145 |
||
146 |
private Level(byte level, String description) { |
|
147 |
this.level = level; |
|
148 |
this.description = description; |
|
149 |
} |
|
150 |
||
151 |
static Level valueOf(byte level) { |
|
152 |
for (Level lv : Level.values()) { |
|
153 |
if (lv.level == level) { |
|
154 |
return lv; |
|
155 |
} |
|
156 |
} |
|
157 |
||
158 |
return null; |
|
159 |
} |
|
160 |
||
161 |
static String nameOf(byte level) { |
|
162 |
for (Level lv : Level.values()) { |
|
163 |
if (lv.level == level) { |
|
164 |
return lv.description; |
|
165 |
} |
|
166 |
} |
|
167 |
||
168 |
return "UNKNOWN ALERT LEVEL (" + (level & 0x0FF) + ")"; |
|
2 | 169 |
} |
170 |
} |
|
171 |
||
50768 | 172 |
/** |
173 |
* The Alert message. |
|
174 |
*/ |
|
175 |
private static final class AlertMessage { |
|
176 |
private final byte level; // level |
|
177 |
private final byte id; // description |
|
178 |
||
179 |
AlertMessage(TransportContext context, |
|
180 |
ByteBuffer m) throws IOException { |
|
181 |
// struct { |
|
182 |
// AlertLevel level; |
|
183 |
// AlertDescription description; |
|
184 |
// } Alert; |
|
185 |
if (m.remaining() != 2) { |
|
186 |
context.fatal(Alert.ILLEGAL_PARAMETER, |
|
187 |
"Invalid Alert message: no sufficient data"); |
|
188 |
} |
|
189 |
||
190 |
this.level = m.get(); // level |
|
191 |
this.id = m.get(); // description |
|
192 |
} |
|
193 |
||
194 |
@Override |
|
195 |
public String toString() { |
|
196 |
MessageFormat messageFormat = new MessageFormat( |
|
197 |
"\"Alert\": '{'\n" + |
|
198 |
" \"level\" : \"{0}\",\n" + |
|
199 |
" \"description\": \"{1}\"\n" + |
|
200 |
"'}'", |
|
201 |
Locale.ENGLISH); |
|
202 |
||
203 |
Object[] messageFields = { |
|
204 |
Level.nameOf(level), |
|
205 |
Alert.nameOf(id) |
|
206 |
}; |
|
207 |
||
208 |
return messageFormat.format(messageFields); |
|
209 |
} |
|
2 | 210 |
} |
211 |
||
50768 | 212 |
/** |
213 |
* Consumer of alert messages |
|
2 | 214 |
*/ |
50768 | 215 |
private static final class AlertConsumer implements SSLConsumer { |
216 |
// Prevent instantiation of this class. |
|
217 |
private AlertConsumer() { |
|
218 |
// blank |
|
219 |
} |
|
220 |
||
221 |
@Override |
|
222 |
public void consume(ConnectionContext context, |
|
223 |
ByteBuffer m) throws IOException { |
|
224 |
TransportContext tc = (TransportContext)context; |
|
225 |
||
226 |
AlertMessage am = new AlertMessage(tc, m); |
|
227 |
if (SSLLogger.isOn && SSLLogger.isOn("ssl")) { |
|
228 |
SSLLogger.fine("Received alert message", am); |
|
229 |
} |
|
230 |
||
231 |
Level level = Level.valueOf(am.level); |
|
232 |
Alert alert = Alert.valueOf(am.id); |
|
233 |
if (alert == Alert.CLOSE_NOTIFY) { |
|
234 |
if (tc.handshakeContext != null) { |
|
235 |
tc.fatal(Alert.UNEXPECTED_MESSAGE, |
|
236 |
"Received close_notify during handshake"); |
|
237 |
} |
|
2 | 238 |
|
50768 | 239 |
tc.isInputCloseNotified = true; |
240 |
tc.closeInbound(); |
|
241 |
} else if ((level == Level.WARNING) && (alert != null)) { |
|
242 |
// Terminate the connection if an alert with a level of warning |
|
243 |
// is received during handshaking, except the no_certificate |
|
244 |
// warning. |
|
245 |
if (alert.handshakeOnly && (tc.handshakeContext != null)) { |
|
246 |
// It's OK to get a no_certificate alert from a client of |
|
247 |
// which we requested client authentication. However, |
|
248 |
// if we required it, then this is not acceptable. |
|
249 |
if (tc.sslConfig.isClientMode || |
|
250 |
alert != Alert.NO_CERTIFICATE || |
|
251 |
(tc.sslConfig.clientAuthType != |
|
252 |
ClientAuthType.CLIENT_AUTH_REQUESTED)) { |
|
253 |
tc.fatal(Alert.HANDSHAKE_FAILURE, |
|
254 |
"received handshake warning: " + alert.description); |
|
255 |
} // Otherwise, ignore the warning |
|
256 |
} // Otherwise, ignore the warning. |
|
257 |
} else { // fatal or unknown |
|
258 |
String diagnostic; |
|
259 |
if (alert == null) { |
|
260 |
alert = Alert.UNEXPECTED_MESSAGE; |
|
261 |
diagnostic = "Unknown alert description (" + am.id + ")"; |
|
262 |
} else { |
|
263 |
diagnostic = "Received fatal alert: " + alert.description; |
|
264 |
} |
|
265 |
||
266 |
tc.fatal(alert, diagnostic, true, null); |
|
2 | 267 |
} |
268 |
} |
|
269 |
} |
|
270 |
} |