/*

 * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.IOException;

import java.nio.ByteBuffer;

import java.security.AlgorithmConstraints;

import java.security.GeneralSecurityException;

import java.text.MessageFormat;

import java.util.Arrays;

import java.util.LinkedList;

import java.util.List;

import java.util.Locale;

import java.util.Map;

import javax.crypto.SecretKey;

import javax.crypto.spec.IvParameterSpec;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.SSLProtocolException;

import sun.security.ssl.CipherSuite.KeyExchange;

import sun.security.ssl.ClientHello.ClientHelloMessage;

import sun.security.ssl.SSLCipher.SSLReadCipher;

import sun.security.ssl.SSLCipher.SSLWriteCipher;

import sun.security.ssl.SSLHandshake.HandshakeMessage;

import sun.security.ssl.SupportedVersionsExtension.SHSupportedVersionsSpec;

import static sun.security.ssl.SSLExtension.SH_SESSION_TICKET;

/**

 * Pack of the ServerHello/HelloRetryRequest handshake message.

 */

final class ServerHello {

    static final SSLConsumer handshakeConsumer =

        new ServerHelloConsumer();

    static final HandshakeProducer t12HandshakeProducer =

        new T12ServerHelloProducer();

    static final HandshakeProducer t13HandshakeProducer =

        new T13ServerHelloProducer();

    static final HandshakeProducer hrrHandshakeProducer =

        new T13HelloRetryRequestProducer();

    static final HandshakeProducer hrrReproducer =

        new T13HelloRetryRequestReproducer();

    private static final HandshakeConsumer t12HandshakeConsumer =

        new T12ServerHelloConsumer();

    private static final HandshakeConsumer t13HandshakeConsumer =

        new T13ServerHelloConsumer();

    private static final HandshakeConsumer d12HandshakeConsumer =

        new T12ServerHelloConsumer();

    private static final HandshakeConsumer d13HandshakeConsumer =

        new T13ServerHelloConsumer();

    private static final HandshakeConsumer t13HrrHandshakeConsumer =

        new T13HelloRetryRequestConsumer();

    private static final HandshakeConsumer d13HrrHandshakeConsumer =

        new T13HelloRetryRequestConsumer();

    /**

     * The ServerHello handshake message.

     */

    static final class ServerHelloMessage extends HandshakeMessage {

        final ProtocolVersion           serverVersion;      // TLS 1.3 legacy

        final RandomCookie              serverRandom;

        final SessionId                 sessionId;          // TLS 1.3 legacy

        final CipherSuite               cipherSuite;

        final byte                      compressionMethod;  // TLS 1.3 legacy

        final SSLExtensions             extensions;

        // The HelloRetryRequest producer needs to use the ClientHello message

        // for cookie generation.  Please don't use this field for other

        // purpose unless it is really necessary.

        final ClientHelloMessage        clientHello;

        // Reserved for HelloRetryRequest consumer.  Please don't use this

        // field for other purpose unless it is really necessary.

        final ByteBuffer                handshakeRecord;

        ServerHelloMessage(HandshakeContext context,

                ProtocolVersion serverVersion, SessionId sessionId,

                CipherSuite cipherSuite, RandomCookie serverRandom,

                ClientHelloMessage clientHello) {

            super(context);

            this.serverVersion = serverVersion;

            this.serverRandom = serverRandom;

            this.sessionId = sessionId;

            this.cipherSuite = cipherSuite;

            this.compressionMethod = 0x00;      // Don't support compression.

            this.extensions = new SSLExtensions(this);

            // Reserve the ClientHello message for cookie generation.

            this.clientHello = clientHello;

            // The handshakeRecord field is used for HelloRetryRequest consumer

            // only.  It's fine to set it to null for generating side of the

            // ServerHello/HelloRetryRequest message.

            this.handshakeRecord = null;

        }

        ServerHelloMessage(HandshakeContext context,

                ByteBuffer m) throws IOException {

            super(context);

            // Reserve for HelloRetryRequest consumer if needed.

            this.handshakeRecord = m.duplicate();

            byte major = m.get();

            byte minor = m.get();

            this.serverVersion = ProtocolVersion.valueOf(major, minor);

            if (this.serverVersion == null) {

                // The client should only request for known protocol versions.

                throw context.conContext.fatal(Alert.PROTOCOL_VERSION,

                    "Unsupported protocol version: " +

                    ProtocolVersion.nameOf(major, minor));

            }

            this.serverRandom = new RandomCookie(m);

            this.sessionId = new SessionId(Record.getBytes8(m));

            try {

                sessionId.checkLength(serverVersion.id);

            } catch (SSLProtocolException ex) {

                throw handshakeContext.conContext.fatal(

                        Alert.ILLEGAL_PARAMETER, ex);

            }

            int cipherSuiteId = Record.getInt16(m);

            this.cipherSuite = CipherSuite.valueOf(cipherSuiteId);

            if (cipherSuite == null || !context.isNegotiable(cipherSuite)) {

                throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,

                    "Server selected improper ciphersuite " +

                    CipherSuite.nameOf(cipherSuiteId));

            }

            this.compressionMethod = m.get();

            if (compressionMethod != 0) {

                throw context.conContext.fatal(Alert.ILLEGAL_PARAMETER,

                    "compression type not supported, " + compressionMethod);

            }

            SSLExtension[] supportedExtensions;

            if (serverRandom.isHelloRetryRequest()) {

                supportedExtensions = context.sslConfig.getEnabledExtensions(

                            SSLHandshake.HELLO_RETRY_REQUEST);

            } else {

                supportedExtensions = context.sslConfig.getEnabledExtensions(

                            SSLHandshake.SERVER_HELLO);

            }

            if (m.hasRemaining()) {

                this.extensions =

                    new SSLExtensions(this, m, supportedExtensions);

            } else {

                this.extensions = new SSLExtensions(this);

            }

            // The clientHello field is used for HelloRetryRequest producer

            // only.  It's fine to set it to null for receiving side of

            // ServerHello/HelloRetryRequest message.

            this.clientHello = null;        // not used, let it be null;

        }

        @Override

        public SSLHandshake handshakeType() {

            return serverRandom.isHelloRetryRequest() ?

                SSLHandshake.HELLO_RETRY_REQUEST : SSLHandshake.SERVER_HELLO;

        }

        @Override

        public int messageLength() {

            // almost fixed header size, except session ID and extensions:

            //      major + minor = 2

            //      random = 32

            //      session ID len field = 1

            //      cipher suite = 2

            //      compression = 1

            //      extensions: if present, 2 + length of extensions

            // In TLS 1.3, use of certain extensions is mandatory.

            return 38 + sessionId.length() + extensions.length();

        }

        @Override

        public void send(HandshakeOutStream hos) throws IOException {

            hos.putInt8(serverVersion.major);

            hos.putInt8(serverVersion.minor);

            hos.write(serverRandom.randomBytes);

            hos.putBytes8(sessionId.getId());

            hos.putInt8((cipherSuite.id >> 8) & 0xFF);

            hos.putInt8(cipherSuite.id & 0xff);

            hos.putInt8(compressionMethod);

            extensions.send(hos);           // In TLS 1.3, use of certain

                                            // extensions is mandatory.

        }

        @Override

        public String toString() {

            MessageFormat messageFormat = new MessageFormat(

                "\"{0}\": '{'\n" +

                "  \"server version\"      : \"{1}\",\n" +

                "  \"random\"              : \"{2}\",\n" +

                "  \"session id\"          : \"{3}\",\n" +

                "  \"cipher suite\"        : \"{4}\",\n" +

                "  \"compression methods\" : \"{5}\",\n" +

                "  \"extensions\"          : [\n" +

                "{6}\n" +

                "  ]\n" +

                "'}'",

                Locale.ENGLISH);

            Object[] messageFields = {

                serverRandom.isHelloRetryRequest() ?

                    "HelloRetryRequest" : "ServerHello",

                serverVersion.name,

                Utilities.toHexString(serverRandom.randomBytes),

                sessionId.toString(),

                cipherSuite.name + "(" +

                        Utilities.byte16HexString(cipherSuite.id) + ")",

                Utilities.toHexString(compressionMethod),

                Utilities.indent(extensions.toString(), "    ")

            };

            return messageFormat.format(messageFields);

        }

    }

    /**

     * The "ServerHello" handshake message producer.

     */

    private static final class T12ServerHelloProducer

            implements HandshakeProducer {

        // Prevent instantiation of this class.

        private T12ServerHelloProducer() {

            // blank

        }

        @Override

        public byte[] produce(ConnectionContext context,

                HandshakeMessage message) throws IOException {

            // The producing happens in server side only.

            ServerHandshakeContext shc = (ServerHandshakeContext)context;

            ClientHelloMessage clientHello = (ClientHelloMessage)message;

            // If client hasn't specified a session we can resume, start a

            // new one and choose its cipher suite and compression options,

            // unless new session creation is disabled for this connection!

            if (!shc.isResumption || shc.resumingSession == null) {

                if (!shc.sslConfig.enableSessionCreation) {

                    throw new SSLException(

                        "Not resumption, and no new session is allowed");

                }

                if (shc.localSupportedSignAlgs == null) {

                    shc.localSupportedSignAlgs =

                        SignatureScheme.getSupportedAlgorithms(

                                shc.algorithmConstraints, shc.activeProtocols);

                }

                SSLSessionImpl session =

                        new SSLSessionImpl(shc, CipherSuite.C_NULL);

                session.setMaximumPacketSize(shc.sslConfig.maximumPacketSize);

                shc.handshakeSession = session;

                // consider the handshake extension impact

                SSLExtension[] enabledExtensions =

                        shc.sslConfig.getEnabledExtensions(

                            SSLHandshake.CLIENT_HELLO, shc.negotiatedProtocol);

                clientHello.extensions.consumeOnTrade(shc, enabledExtensions);

                // negotiate the cipher suite.

                KeyExchangeProperties credentials =

                        chooseCipherSuite(shc, clientHello);

                if (credentials == null) {

                    throw shc.conContext.fatal(Alert.HANDSHAKE_FAILURE,

                            "no cipher suites in common");

                }

                shc.negotiatedCipherSuite = credentials.cipherSuite;

                shc.handshakeKeyExchange = credentials.keyExchange;

                shc.handshakeSession.setSuite(credentials.cipherSuite);

                shc.handshakePossessions.addAll(

                        Arrays.asList(credentials.possessions));

                shc.handshakeHash.determine(

                        shc.negotiatedProtocol, shc.negotiatedCipherSuite);

                // Check the incoming OCSP stapling extensions and attempt

                // to get responses.  If the resulting stapleParams is non

                // null, it implies that stapling is enabled on the server side.

                shc.stapleParams = StatusResponseManager.processStapling(shc);

                shc.staplingActive = (shc.stapleParams != null);

                // update the responders

                SSLKeyExchange ke = credentials.keyExchange;

                if (ke != null) {

                    for (Map.Entry<Byte, HandshakeProducer> me :

                            ke.getHandshakeProducers(shc)) {

                        shc.handshakeProducers.put(

                                me.getKey(), me.getValue());

                    }

                }

                if ((ke != null) &&

                        (shc.sslConfig.clientAuthType !=

                                ClientAuthType.CLIENT_AUTH_NONE) &&

                        !shc.negotiatedCipherSuite.isAnonymous()) {

                    for (SSLHandshake hs :

                            ke.getRelatedHandshakers(shc)) {

                        if (hs == SSLHandshake.CERTIFICATE) {

                            shc.handshakeProducers.put(

                                    SSLHandshake.CERTIFICATE_REQUEST.id,

                                    SSLHandshake.CERTIFICATE_REQUEST);

                            break;

                        }

                    }

                }

                shc.handshakeProducers.put(SSLHandshake.SERVER_HELLO_DONE.id,

                        SSLHandshake.SERVER_HELLO_DONE);

            } else {

                // stateless and use the client session id (RFC 5077 3.4)

                if (shc.statelessResumption) {

                    shc.resumingSession = new SSLSessionImpl(shc.resumingSession,

                            (clientHello.sessionId.length() == 0) ?

                                    new SessionId(true,

                                            shc.sslContext.getSecureRandom()) :

                                    new SessionId(clientHello.sessionId.getId())

                    );

                }

                shc.handshakeSession = shc.resumingSession;

                shc.negotiatedProtocol =

                        shc.resumingSession.getProtocolVersion();

                shc.negotiatedCipherSuite = shc.resumingSession.getSuite();

                shc.handshakeHash.determine(

                        shc.negotiatedProtocol, shc.negotiatedCipherSuite);

            }

            // Generate the ServerHello handshake message.

            ServerHelloMessage shm = new ServerHelloMessage(shc,

                    shc.negotiatedProtocol,

                    shc.handshakeSession.getSessionId(),

                    shc.negotiatedCipherSuite,

                    new RandomCookie(shc),

                    clientHello);

            shc.serverHelloRandom = shm.serverRandom;

            // Produce extensions for ServerHello handshake message.

            SSLExtension[] serverHelloExtensions =

                shc.sslConfig.getEnabledExtensions(

                        SSLHandshake.SERVER_HELLO, shc.negotiatedProtocol);

            shm.extensions.produce(shc, serverHelloExtensions);

            if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                SSLLogger.fine("Produced ServerHello handshake message", shm);

            }

            // Output the handshake message.

            shm.write(shc.handshakeOutput);

            shc.handshakeOutput.flush();

            if (shc.isResumption && shc.resumingSession != null) {

                SSLTrafficKeyDerivation kdg =

                    SSLTrafficKeyDerivation.valueOf(shc.negotiatedProtocol);

                if (kdg == null) {

                    // unlikely

                    throw shc.conContext.fatal(Alert.INTERNAL_ERROR,

                            "Not supported key derivation: " +

                            shc.negotiatedProtocol);

                } else {

                    shc.handshakeKeyDerivation = kdg.createKeyDerivation(

                            shc, shc.resumingSession.getMasterSecret());

                }

                // update the responders

                shc.handshakeProducers.put(SSLHandshake.FINISHED.id,

                        SSLHandshake.FINISHED);

            }

            // The handshake message has been delivered.

            return null;

        }

        private static KeyExchangeProperties chooseCipherSuite(

                ServerHandshakeContext shc,

                ClientHelloMessage clientHello) throws IOException {

            List<CipherSuite> preferred;

            List<CipherSuite> proposed;

            if (shc.sslConfig.preferLocalCipherSuites) {

                preferred = shc.activeCipherSuites;

                proposed = clientHello.cipherSuites;

            } else {

                preferred = clientHello.cipherSuites;

                proposed = shc.activeCipherSuites;

            }

            List<CipherSuite> legacySuites = new LinkedList<>();

            for (CipherSuite cs : preferred) {

                if (!HandshakeContext.isNegotiable(

                        proposed, shc.negotiatedProtocol, cs)) {

                    continue;

                }

                if (shc.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUIRED) {

                    if ((cs.keyExchange == KeyExchange.K_DH_ANON) ||

                        (cs.keyExchange == KeyExchange.K_ECDH_ANON)) {

                        continue;

                    }

                }

                SSLKeyExchange ke = SSLKeyExchange.valueOf(

                        cs.keyExchange, shc.negotiatedProtocol);

                if (ke == null) {

                    continue;

                }

                if (!ServerHandshakeContext.legacyAlgorithmConstraints.permits(

                        null, cs.name, null)) {

                    legacySuites.add(cs);

                    continue;

                }

                SSLPossession[] hcds = ke.createPossessions(shc);

                if ((hcds == null) || (hcds.length == 0)) {

                    continue;

                }

                // The cipher suite has been negotiated.

                if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                    SSLLogger.fine("use cipher suite " + cs.name);

                }

                return new KeyExchangeProperties(cs, ke, hcds);

            }

            for (CipherSuite cs : legacySuites) {

                SSLKeyExchange ke = SSLKeyExchange.valueOf(

                        cs.keyExchange,  shc.negotiatedProtocol);

                if (ke != null) {

                    SSLPossession[] hcds = ke.createPossessions(shc);

                    if ((hcds != null) && (hcds.length != 0)) {

                        if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                            SSLLogger.warning(

                                "use legacy cipher suite " + cs.name);

                        }

                        return new KeyExchangeProperties(cs, ke, hcds);

                    }

                }

            }

            throw shc.conContext.fatal(Alert.HANDSHAKE_FAILURE,

                    "no cipher suites in common");

        }

        private static final class KeyExchangeProperties {

            final CipherSuite cipherSuite;

            final SSLKeyExchange keyExchange;

            final SSLPossession[] possessions;

            private KeyExchangeProperties(CipherSuite cipherSuite,

                    SSLKeyExchange keyExchange, SSLPossession[] possessions) {

                this.cipherSuite = cipherSuite;

                this.keyExchange = keyExchange;

                this.possessions = possessions;

            }

        }

    }

    /**

     * The "ServerHello" handshake message producer.

     */

    private static final

            class T13ServerHelloProducer implements HandshakeProducer {

        // Prevent instantiation of this class.

        private T13ServerHelloProducer() {

            // blank

        }

        @Override

        public byte[] produce(ConnectionContext context,

                HandshakeMessage message) throws IOException {

            // The producing happens in server side only.

            ServerHandshakeContext shc = (ServerHandshakeContext)context;

            ClientHelloMessage clientHello = (ClientHelloMessage)message;

            SSLSessionContextImpl sessionCache = (SSLSessionContextImpl)

                    shc.sslContext.engineGetServerSessionContext();

            // If client hasn't specified a session we can resume, start a

            // new one and choose its cipher suite and compression options,

            // unless new session creation is disabled for this connection!

            if (!shc.isResumption || shc.resumingSession == null) {

                if (!shc.sslConfig.enableSessionCreation) {

                    throw new SSLException(

                        "Not resumption, and no new session is allowed");

                }

                if (shc.localSupportedSignAlgs == null) {

                    shc.localSupportedSignAlgs =

                        SignatureScheme.getSupportedAlgorithms(

                                shc.algorithmConstraints, shc.activeProtocols);

                }

                SSLSessionImpl session =

                        new SSLSessionImpl(shc, CipherSuite.C_NULL);

                session.setMaximumPacketSize(shc.sslConfig.maximumPacketSize);