/*

 * Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.ByteArrayInputStream;

import java.io.IOException;

import java.nio.ByteBuffer;

import java.security.PublicKey;

import java.security.cert.CertPathValidatorException;

import java.security.cert.CertPathValidatorException.BasicReason;

import java.security.cert.CertPathValidatorException.Reason;

import java.security.cert.CertificateEncodingException;

import java.security.cert.CertificateException;

import java.security.cert.CertificateFactory;

import java.security.cert.CertificateParsingException;

import java.security.cert.X509Certificate;

import java.text.MessageFormat;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.Collection;

import java.util.Collections;

import java.util.HashSet;

import java.util.LinkedList;

import java.util.List;

import java.util.Locale;

import javax.net.ssl.SSLEngine;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLProtocolException;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.X509ExtendedTrustManager;

import javax.net.ssl.X509TrustManager;

import javax.security.auth.x500.X500Principal;

import static sun.security.ssl.ClientAuthType.CLIENT_AUTH_REQUIRED;

import sun.security.ssl.ClientHello.ClientHelloMessage;

import sun.security.ssl.SSLHandshake.HandshakeMessage;

import sun.security.ssl.X509Authentication.X509Credentials;

import sun.security.ssl.X509Authentication.X509Possession;

/**

 * Pack of the CertificateMessage handshake message.

 */

final class CertificateMessage {

    static final SSLConsumer t12HandshakeConsumer =

        new T12CertificateConsumer();

    static final HandshakeProducer t12HandshakeProducer =

        new T12CertificateProducer();

    static final SSLConsumer t13HandshakeConsumer =

        new T13CertificateConsumer();

    static final HandshakeProducer t13HandshakeProducer =

        new T13CertificateProducer();

    /**

     * The Certificate handshake message for TLS 1.2 and previous

     * SSL/TLS protocol versions.

     *

     * In server mode, the certificate handshake message is sent whenever the

     * agreed-upon key exchange method uses certificates for authentication.

     * In client mode, this message is only sent if the server requests a

     * certificate for client authentication.

     *

     *       opaque ASN.1Cert<1..2^24-1>;

     *

     * SSL 3.0:

     *       struct {

     *           ASN.1Cert certificate_list<1..2^24-1>;

     *       } Certificate;

     * Note: For SSL 3.0 client authentication, if no suitable certificate

     * is available, the client should send a no_certificate alert instead.

     * This alert is only a warning; however, the server may respond with

     * a fatal handshake failure alert if client authentication is required.

     *

     * TLS 1.0/1.1/1.2:

     *       struct {

     *           ASN.1Cert certificate_list<0..2^24-1>;

     *       } Certificate;

     */

    static final class T12CertificateMessage extends HandshakeMessage {

        final List<byte[]> encodedCertChain;

        T12CertificateMessage(HandshakeContext handshakeContext,

                X509Certificate[] certChain) throws SSLException {

            super(handshakeContext);

            List<byte[]> encodedCerts = new ArrayList<>(certChain.length);

            for (X509Certificate cert : certChain) {

                try {

                    encodedCerts.add(cert.getEncoded());

                } catch (CertificateEncodingException cee) {

                    // unlikely

                    handshakeContext.conContext.fatal(Alert.INTERNAL_ERROR,

                            "Could not encode certificate (" +

                            cert.getSubjectX500Principal() + ")", cee);

                    break;

                }

            }

            this.encodedCertChain = encodedCerts;

        }

        T12CertificateMessage(HandshakeContext handshakeContext,

                ByteBuffer m) throws IOException {

            super(handshakeContext);

            int listLen = Record.getInt24(m);

            if (listLen > m.remaining()) {

                handshakeContext.conContext.fatal(Alert.ILLEGAL_PARAMETER,

                    "Error parsing certificate message:no sufficient data");

            }

            if (listLen > 0) {

                List<byte[]> encodedCerts = new LinkedList<>();

                while (listLen > 0) {

                    byte[] encodedCert = Record.getBytes24(m);

                    listLen -= (3 + encodedCert.length);

                    encodedCerts.add(encodedCert);

                }

                this.encodedCertChain = encodedCerts;

            } else {

                this.encodedCertChain = Collections.emptyList();

            }

        }

        @Override

        public SSLHandshake handshakeType() {

            return SSLHandshake.CERTIFICATE;

        }

        @Override

        public int messageLength() {

            int msgLen = 3;

            for (byte[] encodedCert : encodedCertChain) {

                msgLen += (encodedCert.length + 3);

            }

            return msgLen;

        }

        @Override

        public void send(HandshakeOutStream hos) throws IOException {

            int listLen = 0;

            for (byte[] encodedCert : encodedCertChain) {

                listLen += (encodedCert.length + 3);

            }

            hos.putInt24(listLen);

            for (byte[] encodedCert : encodedCertChain) {

                hos.putBytes24(encodedCert);

            }

        }

        @Override

        public String toString() {

            if (encodedCertChain.isEmpty()) {

                return "\"Certificates\": <empty list>";

            }

            Object[] x509Certs = new Object[encodedCertChain.size()];

            try {

                CertificateFactory cf = CertificateFactory.getInstance("X.509");

                int i = 0;

                for (byte[] encodedCert : encodedCertChain) {

                    Object obj;

                    try {

                        obj = (X509Certificate)cf.generateCertificate(

                                    new ByteArrayInputStream(encodedCert));

                    } catch (CertificateException ce) {

                        obj = encodedCert;

                    }

                    x509Certs[i++] = obj;

                }

            } catch (CertificateException ce) {

                // no X.509 certificate factory service

                int i = 0;

                for (byte[] encodedCert : encodedCertChain) {

                    x509Certs[i++] = encodedCert;

                }

            }

            MessageFormat messageFormat = new MessageFormat(

                    "\"Certificates\": [\n" +

                    "{0}\n" +

                    "]",

                    Locale.ENGLISH);

            Object[] messageFields = {

                SSLLogger.toString(x509Certs)

            };

            return messageFormat.format(messageFields);

        }

    }

    /**

     * The "Certificate" handshake message producer for TLS 1.2 and

     * previous SSL/TLS protocol versions.

     */

    private static final

            class T12CertificateProducer implements HandshakeProducer {

        // Prevent instantiation of this class.

        private T12CertificateProducer() {

            // blank

        }

        @Override

        public byte[] produce(ConnectionContext context,

                HandshakeMessage message) throws IOException {

            // The producing happens in handshake context only.

            HandshakeContext hc = (HandshakeContext)context;

            if (hc.sslConfig.isClientMode) {

                return onProduceCertificate(

                        (ClientHandshakeContext)context, message);

            } else {

                return onProduceCertificate(

                        (ServerHandshakeContext)context, message);

            }

        }

        private byte[] onProduceCertificate(ServerHandshakeContext shc,

                SSLHandshake.HandshakeMessage message) throws IOException {

            X509Possession x509Possession = null;

            for (SSLPossession possession : shc.handshakePossessions) {

                if (possession instanceof X509Possession) {

                    x509Possession = (X509Possession)possession;

                    break;

                }

            }

            if (x509Possession == null) {       // unlikely

                shc.conContext.fatal(Alert.INTERNAL_ERROR,

                    "No expected X.509 certificate for server authentication");

                return null;        // make the compiler happy

            }

            shc.handshakeSession.setLocalPrivateKey(

                    x509Possession.popPrivateKey);

            shc.handshakeSession.setLocalCertificates(x509Possession.popCerts);

            T12CertificateMessage cm =

                    new T12CertificateMessage(shc, x509Possession.popCerts);

            if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                SSLLogger.fine(

                    "Produced server Certificate handshake message", cm);

            }

            // Output the handshake message.

            cm.write(shc.handshakeOutput);

            shc.handshakeOutput.flush();

            // The handshake message has been delivered.

            return null;

        }

        private byte[] onProduceCertificate(ClientHandshakeContext chc,

                SSLHandshake.HandshakeMessage message) throws IOException {

            X509Possession x509Possession = null;

            for (SSLPossession possession : chc.handshakePossessions) {

                if (possession instanceof X509Possession) {

                    x509Possession = (X509Possession)possession;

                    break;

                }

            }

            // Report to the server if no appropriate cert was found.  For

            // SSL 3.0, send a no_certificate alert;  TLS 1.0/1.1/1.2 uses

            // an empty cert chain instead.

            if (x509Possession == null) {

                if (chc.negotiatedProtocol.useTLS10PlusSpec()) {

                    if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                        SSLLogger.fine(

                            "No X.509 certificate for client authentication, " +

                            "use empty Certificate message instead");

                    }

                    x509Possession =

                            new X509Possession(null, new X509Certificate[0]);

                } else {

                    if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                        SSLLogger.fine(

                            "No X.509 certificate for client authentication, " +

                            "send a no_certificate alert");

                    }

                    chc.conContext.warning(Alert.NO_CERTIFICATE);

                    return null;

                }

            }

            chc.handshakeSession.setLocalPrivateKey(

                    x509Possession.popPrivateKey);

            if (x509Possession.popCerts != null &&

                    x509Possession.popCerts.length != 0) {

                chc.handshakeSession.setLocalCertificates(

                        x509Possession.popCerts);

            } else {

                chc.handshakeSession.setLocalCertificates(null);

            }

            T12CertificateMessage cm =

                    new T12CertificateMessage(chc, x509Possession.popCerts);

            if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                SSLLogger.fine(

                    "Produced client Certificate handshake message", cm);

            }

            // Output the handshake message.

            cm.write(chc.handshakeOutput);

            chc.handshakeOutput.flush();

            // The handshake message has been delivered.

            return null;

        }

    }

    /**

     * The "Certificate" handshake message consumer for TLS 1.2 and

     * previous SSL/TLS protocol versions.

     */

    static final

            class T12CertificateConsumer implements SSLConsumer {

        // Prevent instantiation of this class.

        private T12CertificateConsumer() {

            // blank

        }

        @Override

        public void consume(ConnectionContext context,

                ByteBuffer message) throws IOException {

            // The consuming happens in handshake context only.

            HandshakeContext hc = (HandshakeContext)context;

            // clean up this consumer

            hc.handshakeConsumers.remove(SSLHandshake.CERTIFICATE.id);

            T12CertificateMessage cm = new T12CertificateMessage(hc, message);

            if (hc.sslConfig.isClientMode) {

                if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                    SSLLogger.fine(

                        "Consuming server Certificate handshake message", cm);

                }

                onCertificate((ClientHandshakeContext)context, cm);

            } else {

                if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                    SSLLogger.fine(

                        "Consuming client Certificate handshake message", cm);

                }

                onCertificate((ServerHandshakeContext)context, cm);

            }

        }

        private void onCertificate(ServerHandshakeContext shc,

                T12CertificateMessage certificateMessage )throws IOException {

            List<byte[]> encodedCerts = certificateMessage.encodedCertChain;

            if (encodedCerts == null || encodedCerts.isEmpty()) {

                if (shc.sslConfig.clientAuthType !=

                        ClientAuthType.CLIENT_AUTH_REQUESTED) {

                    // unexpected or require client authentication

                    shc.conContext.fatal(Alert.BAD_CERTIFICATE,

                        "Empty server certificate chain");

                } else {

                    return;

                }

            }

            X509Certificate[] x509Certs =

                    new X509Certificate[encodedCerts.size()];

            try {

                CertificateFactory cf = CertificateFactory.getInstance("X.509");

                int i = 0;

                for (byte[] encodedCert : encodedCerts) {

                    x509Certs[i++] = (X509Certificate)cf.generateCertificate(

                                    new ByteArrayInputStream(encodedCert));

                }

            } catch (CertificateException ce) {

                shc.conContext.fatal(Alert.BAD_CERTIFICATE,

                    "Failed to parse server certificates", ce);

            }

            checkClientCerts(shc, x509Certs);

            //

            // update

            //

            shc.handshakeCredentials.add(

                new X509Credentials(x509Certs[0].getPublicKey(), x509Certs));

            shc.handshakeSession.setPeerCertificates(x509Certs);

        }

        private void onCertificate(ClientHandshakeContext chc,

                T12CertificateMessage certificateMessage) throws IOException {

            List<byte[]> encodedCerts = certificateMessage.encodedCertChain;

            if (encodedCerts == null || encodedCerts.isEmpty()) {

                chc.conContext.fatal(Alert.BAD_CERTIFICATE,

                    "Empty server certificate chain");

            }

            X509Certificate[] x509Certs =

                    new X509Certificate[encodedCerts.size()];

            try {

                CertificateFactory cf = CertificateFactory.getInstance("X.509");

                int i = 0;

                for (byte[] encodedCert : encodedCerts) {

                    x509Certs[i++] = (X509Certificate)cf.generateCertificate(

                                    new ByteArrayInputStream(encodedCert));

                }

            } catch (CertificateException ce) {

                chc.conContext.fatal(Alert.BAD_CERTIFICATE,

                    "Failed to parse server certificates", ce);

            }

            // Allow server certificate change in client side during

            // renegotiation after a session-resumption abbreviated

            // initial handshake?

            //

            // DO NOT need to check allowUnsafeServerCertChange here. We only

            // reserve server certificates when allowUnsafeServerCertChange is

            // false.

            if (chc.reservedServerCerts != null &&

                    !chc.handshakeSession.useExtendedMasterSecret) {

                // It is not necessary to check the certificate update if

                // endpoint identification is enabled.

                String identityAlg = chc.sslConfig.identificationProtocol;

                if ((identityAlg == null || identityAlg.length() == 0) &&

                        !isIdentityEquivalent(x509Certs[0],

                                chc.reservedServerCerts[0])) {

                    chc.conContext.fatal(Alert.BAD_CERTIFICATE,

                            "server certificate change is restricted " +

                            "during renegotiation");

                }

            }

            // ask the trust manager to verify the chain

            if (chc.staplingActive) {

                // Defer the certificate check until after we've received the

                // CertificateStatus message.  If that message doesn't come in

                // immediately following this message we will execute the

                // check from CertificateStatus' absent handler.

                chc.deferredCerts = x509Certs;

            } else {

                // We're not doing stapling, so perform the check right now

                checkServerCerts(chc, x509Certs);

            }

            //

            // update

            //

            chc.handshakeCredentials.add(

                new X509Credentials(x509Certs[0].getPublicKey(), x509Certs));

            chc.handshakeSession.setPeerCertificates(x509Certs);

        }

        /*

         * Whether the certificates can represent the same identity?

         *

         * The certificates can be used to represent the same identity:

         *     1. If the subject alternative names of IP address are present

         *        in both certificates, they should be identical; otherwise,

         *     2. if the subject alternative names of DNS name are present in

         *        both certificates, they should be identical; otherwise,

         *     3. if the subject fields are present in both certificates, the

         *        certificate subjects and issuers should be identical.

         */

        private static boolean isIdentityEquivalent(X509Certificate thisCert,

                X509Certificate prevCert) {

            if (thisCert.equals(prevCert)) {

                return true;

            }

            // check subject alternative names

            Collection<List<?>> thisSubjectAltNames = null;

            try {

                thisSubjectAltNames = thisCert.getSubjectAlternativeNames();

            } catch (CertificateParsingException cpe) {

                if (SSLLogger.isOn && SSLLogger.isOn("handshake")) {

                    SSLLogger.fine(

                        "Attempt to obtain subjectAltNames extension failed!");

                }

            }

            Collection<List<?>> prevSubjectAltNames = null;

            try {

                prevSubjectAltNames = prevCert.getSubjectAlternativeNames();

            } catch (CertificateParsingException cpe) {

                if (SSLLogger.isOn && SSLLogger.isOn("handshake")) {

                    SSLLogger.fine(

                        "Attempt to obtain subjectAltNames extension failed!");

                }

            }

            if (thisSubjectAltNames != null && prevSubjectAltNames != null) {

                // check the iPAddress field in subjectAltName extension

                //

                // 7: subject alternative name of type IP.

                Collection<String> thisSubAltIPAddrs =

                            getSubjectAltNames(thisSubjectAltNames, 7);

                Collection<String> prevSubAltIPAddrs =

                            getSubjectAltNames(prevSubjectAltNames, 7);

                if (thisSubAltIPAddrs != null && prevSubAltIPAddrs != null &&

                    isEquivalent(thisSubAltIPAddrs, prevSubAltIPAddrs)) {

                    return true;

                }

                // check the dNSName field in subjectAltName extension

                // 2: subject alternative name of type IP.

                Collection<String> thisSubAltDnsNames =

                            getSubjectAltNames(thisSubjectAltNames, 2);

                Collection<String> prevSubAltDnsNames =

                            getSubjectAltNames(prevSubjectAltNames, 2);