* Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.

import java.nio.ByteBuffer;

import java.security.InvalidKeyException;

import java.security.NoSuchAlgorithmException;

import javax.crypto.Mac;

import javax.crypto.SecretKey;

import sun.security.ssl.CipherSuite.MacAlg;

abstract class Authenticator {

    protected final byte[] block;   // at least 8 bytes for sequence number

    private Authenticator(byte[] block) {

        this.block = block;

    static Authenticator valueOf(ProtocolVersion protocolVersion) {

        if (protocolVersion.isDTLS) {

            if (protocolVersion.useTLS13PlusSpec()) {

                return new DTLS13Authenticator(protocolVersion);

            } else {

                return new DTLS10Authenticator(protocolVersion);

            }

        } else {

            if (protocolVersion.useTLS13PlusSpec()) {

                return new TLS13Authenticator(protocolVersion);

            } else if (protocolVersion.useTLS10PlusSpec()) {

                return new TLS10Authenticator(protocolVersion);

            } else {

                return new SSL30Authenticator();

            }

        }

    }

    @SuppressWarnings({"unchecked"})

    static <T extends Authenticator & MAC> T

         valueOf(ProtocolVersion protocolVersion, MacAlg macAlg,

                 SecretKey key) throws NoSuchAlgorithmException,

                        InvalidKeyException {

        if (protocolVersion.isDTLS) {

            if (protocolVersion.useTLS13PlusSpec()) {

                throw new RuntimeException("No MacAlg used in DTLS 1.3");

            } else {

                return (T)(new DTLS10Mac(protocolVersion, macAlg, key));

            }

        } else {

            if (protocolVersion.useTLS13PlusSpec()) {

                throw new RuntimeException("No MacAlg used in TLS 1.3");

            } else if (protocolVersion.useTLS10PlusSpec()) {

                return (T)(new TLS10Mac(protocolVersion, macAlg, key));

            } else {

                return (T)(new SSL30Mac(protocolVersion, macAlg, key));

            }

        }

    }

    static Authenticator nullTlsMac() {

        return new SSLNullMac();

    }

    static Authenticator nullDtlsMac() {

        return new DTLSNullMac();

    abstract boolean seqNumOverflow();

    abstract boolean seqNumIsHuge();

    void setEpochNumber(int epoch) {

        throw new UnsupportedOperationException(

     * sequence number if using implicit sequence number.

    byte[] acquireAuthenticationBytes(

        throw new UnsupportedOperationException("Used by AEAD algorithms only");

    }

    private static class SSLAuthenticator extends Authenticator {

        private SSLAuthenticator(byte[] block) {

            super(block);

        }

        @Override

        boolean seqNumOverflow() {

            /*

             * Conservatively, we don't allow more records to be generated

             * when there are only 2^8 sequence numbers left.

             */

            return (block.length != 0 &&

                block[0] == (byte)0xFF && block[1] == (byte)0xFF &&

                block[2] == (byte)0xFF && block[3] == (byte)0xFF &&

                block[4] == (byte)0xFF && block[5] == (byte)0xFF &&

                block[6] == (byte)0xFF);

        }

        @Override

        boolean seqNumIsHuge() {

            return (block.length != 0 &&

                block[0] == (byte)0xFF && block[1] == (byte)0xFF &&

                block[2] == (byte)0xFF && block[3] == (byte)0xFF);

        }

    }

    // For null MAC only.

    private static class SSLNullAuthenticator extends SSLAuthenticator {

        private SSLNullAuthenticator() {

            super(new byte[8]);

        }

    }

    // For SSL 3.0

    private static class SSL30Authenticator extends SSLAuthenticator {

        // Block size of SSL v3.0:

        //     sequence number + record type + + record length

        private static final int BLOCK_SIZE = 11;   // 8 + 1 + 2

        private SSL30Authenticator() {

            super(new byte[BLOCK_SIZE]);

        }

        @Override

        byte[] acquireAuthenticationBytes(

                byte type, int length, byte[] sequence) {

            byte[] ad = block.clone();

            // Increase the implicit sequence number in the block array.

            increaseSequenceNumber();

            ad[8] = type;

            ad[9] = (byte)(length >> 8);

            ad[10] = (byte)(length);

            return ad;

        }

    }

    // For TLS 1.0 - 1.2

    private static class TLS10Authenticator extends SSLAuthenticator {

        // Block size of TLS v1.0/1.1/1.2.

        //     sequence number + record type + protocol version + record length

        private static final int BLOCK_SIZE = 13;   // 8 + 1 + 2 + 2

        private TLS10Authenticator(ProtocolVersion protocolVersion) {

            super(new byte[BLOCK_SIZE]);

            block[9] = protocolVersion.major;

            block[10] = protocolVersion.minor;

        }

        @Override

        byte[] acquireAuthenticationBytes(

                byte type, int length, byte[] sequence) {

            byte[] ad = block.clone();

            if (sequence != null) {

                if (sequence.length != 8) {

                    throw new RuntimeException(

                            "Insufficient explicit sequence number bytes");

                }

                System.arraycopy(sequence, 0, ad, 0, sequence.length);

            } else {    // Otherwise, use the implicit sequence number.

                // Increase the implicit sequence number in the block array.

                increaseSequenceNumber();

            ad[8] = type;

            ad[11] = (byte)(length >> 8);

            ad[12] = (byte)(length);

            return ad;

        }

    }

    // For TLS 1.3

    private static final class TLS13Authenticator extends SSLAuthenticator {

        // Block size of TLS v1.3:

        //     record type + protocol version + record length + sequence number

        private static final int BLOCK_SIZE = 13;   // 1 + 2 + 2 + 8

        private TLS13Authenticator(ProtocolVersion protocolVersion) {

            super(new byte[BLOCK_SIZE]);

            block[9] = ProtocolVersion.TLS12.major;

            block[10] = ProtocolVersion.TLS12.minor;

        }

        @Override

        byte[] acquireAuthenticationBytes(

                byte type, int length, byte[] sequence) {

            byte[] ad = Arrays.copyOfRange(block, 8, 13);

            // Increase the implicit sequence number in the block array.

            increaseSequenceNumber();

            ad[0] = type;

            ad[3] = (byte)(length >> 8);

            ad[4] = (byte)(length & 0xFF);

            return ad;

        }

    }

    private static class DTLSAuthenticator extends Authenticator {

        private DTLSAuthenticator(byte[] block) {

            super(block);

        }

        @Override

        boolean seqNumOverflow() {

            /*

             * Conservatively, we don't allow more records to be generated

             * when there are only 2^8 sequence numbers left.

             */

            return (block.length != 0 &&

                // no epoch bytes, block[0] and block[1]

                block[2] == (byte)0xFF && block[3] == (byte)0xFF &&

                block[4] == (byte)0xFF && block[5] == (byte)0xFF &&

                block[6] == (byte)0xFF);

        }

        @Override

        boolean seqNumIsHuge() {

            return (block.length != 0 &&

                // no epoch bytes, block[0] and block[1]

                block[2] == (byte)0xFF && block[3] == (byte)0xFF);

        }

        @Override

        void setEpochNumber(int epoch) {

            block[0] = (byte)((epoch >> 8) & 0xFF);

            block[1] = (byte)(epoch & 0xFF);

        }

    }

    // For null MAC only.

    private static class DTLSNullAuthenticator extends DTLSAuthenticator {

        private DTLSNullAuthenticator() {

            // For DTLS protocols, plaintexts use explicit epoch and

            // sequence number in each record.  The first 8 byte of

            // the block is initialized for null MAC so that the

            // epoch and sequence number can be acquired to generate

            // plaintext records.

            super(new byte[8]);

        }

    }

    // DTLS 1.0/1.2

    private static class DTLS10Authenticator extends DTLSAuthenticator {

        // Block size of DTLS v1.0 and later:

        //     epoch + sequence number +

        //     record type + protocol version + record length

        private static final int BLOCK_SIZE = 13;  // 2 + 6 + 1 + 2 + 2;

        private DTLS10Authenticator(ProtocolVersion protocolVersion) {

            super(new byte[BLOCK_SIZE]);

            block[9] = protocolVersion.major;

            block[10] = protocolVersion.minor;

        }

        @Override

        byte[] acquireAuthenticationBytes(

                byte type, int length, byte[] sequence) {

            byte[] ad = block.clone();

            if (sequence != null) {

                if (sequence.length != 8) {

                    throw new RuntimeException(

                            "Insufficient explicit sequence number bytes");

                }

                System.arraycopy(sequence, 0, ad, 0, sequence.length);

            } else {    // Otherwise, use the implicit sequence number.

            ad[8] = type;

            ad[11] = (byte)(length >> 8);

            ad[12] = (byte)(length);

            return ad;

        }

    }

    // DTLS 1.3

    private static final class DTLS13Authenticator extends DTLSAuthenticator {

        // Block size of DTLS v1.0 and later:

        //     epoch + sequence number +

        //     record type + protocol version + record length

        private static final int BLOCK_SIZE = 13;  // 2 + 6 + 1 + 2 + 2;

        private DTLS13Authenticator(ProtocolVersion protocolVersion) {

            super(new byte[BLOCK_SIZE]);

            block[9] = ProtocolVersion.TLS12.major;

            block[10] = ProtocolVersion.TLS12.minor;

        }

        @Override

        byte[] acquireAuthenticationBytes(

                byte type, int length, byte[] sequence) {

            byte[] ad = Arrays.copyOfRange(block, 8, 13);

            // Increase the implicit sequence number in the block array.

            increaseSequenceNumber();

            ad[0] = type;

            ad[3] = (byte)(length >> 8);

            ad[4] = (byte)(length & 0xFF);

            return ad;

        }

    }

    interface MAC {

        MacAlg macAlg();

        /**

         * Compute and returns the MAC for the remaining data

         * in this ByteBuffer.

         *

         * On return, the bb position == limit, and limit will

         * have not changed.

         *

         * @param type record type

         * @param bb a ByteBuffer in which the position and limit

         *          demarcate the data to be MAC'd.

         * @param isSimulated if true, simulate the MAC computation

         * @param sequence the explicit sequence number, or null if using

         *        the implicit sequence number for the computation

         *

         * @return the MAC result

         */

        byte[] compute(byte type, ByteBuffer bb,

                byte[] sequence, boolean isSimulated);

        /**

         * Compute and returns the MAC for the remaining data

         * in this ByteBuffer.

         *

         * On return, the bb position == limit, and limit will

         * have not changed.

         *

         * @param type record type

         * @param bb a ByteBuffer in which the position and limit

         *        demarcate the data to be MAC'd.

         * @param isSimulated if true, simulate the MAC computation

         *

         * @return the MAC result

         */

        default byte[] compute(byte type, ByteBuffer bb, boolean isSimulated) {

            return compute(type, bb, null, isSimulated);

        }

    }

    private class MacImpl implements MAC {

        // internal identifier for the MAC algorithm

        private final MacAlg macAlg;

        // JCE Mac object

        private final Mac mac;

        private MacImpl() {

            macAlg = MacAlg.M_NULL;

            mac = null;

        }

        private MacImpl(ProtocolVersion protocolVersion, MacAlg macAlg,

                SecretKey key) throws NoSuchAlgorithmException,

                        InvalidKeyException {

            if (macAlg == null) {

                throw new RuntimeException("Null MacAlg");

            }

            // using SSL MAC computation?

            boolean useSSLMac = (protocolVersion.id < ProtocolVersion.TLS10.id);

            String algorithm;

            switch (macAlg) {

                case M_MD5:

                    algorithm = useSSLMac ? "SslMacMD5" : "HmacMD5";

                    break;

                case M_SHA:

                    algorithm = useSSLMac ? "SslMacSHA1" : "HmacSHA1";

                    break;

                case M_SHA256:

                    algorithm = "HmacSHA256";    // TLS 1.2+

                    break;

                case M_SHA384:

                    algorithm = "HmacSHA384";    // TLS 1.2+

                    break;

                default:

                    throw new RuntimeException("Unknown MacAlg " + macAlg);

            }

            Mac m = JsseJce.getMac(algorithm);

            m.init(key);

            this.macAlg = macAlg;

            this.mac = m;

        }

        @Override

        public MacAlg macAlg() {

            return macAlg;