/*

 * Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.IOException;

import java.io.InputStream;

import java.io.InterruptedIOException;

import java.io.OutputStream;

import java.net.InetAddress;

import java.net.InetSocketAddress;

import java.net.Socket;

import java.net.SocketAddress;

import java.net.SocketException;

import java.net.UnknownHostException;

import java.nio.ByteBuffer;

import java.util.List;

import java.util.function.BiFunction;

import javax.net.ssl.HandshakeCompletedListener;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.SSLParameters;

import javax.net.ssl.SSLProtocolException;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLSocket;

import jdk.internal.misc.JavaNetInetAddressAccess;

import jdk.internal.misc.SharedSecrets;

/**

 * Implementation of an SSL socket.

 * <P>

 * This is a normal connection type socket, implementing SSL over some lower

 * level socket, such as TCP.  Because it is layered over some lower level

 * socket, it MUST override all default socket methods.

 * <P>

 * This API offers a non-traditional option for establishing SSL

 * connections.  You may first establish the connection directly, then pass

 * that connection to the SSL socket constructor with a flag saying which

 * role should be taken in the handshake protocol.  (The two ends of the

 * connection must not choose the same role!)  This allows setup of SSL

 * proxying or tunneling, and also allows the kind of "role reversal"

 * that is required for most FTP data transfers.

 *

 * @see javax.net.ssl.SSLSocket

 * @see SSLServerSocket

 *

 * @author David Brownell

 */

public final class SSLSocketImpl

        extends BaseSSLSocketImpl implements SSLTransport {

    final SSLContextImpl            sslContext;

    final TransportContext          conContext;

    private final AppInputStream    appInput = new AppInputStream();

    private final AppOutputStream   appOutput = new AppOutputStream();

    private String                  peerHost;

    private boolean                 autoClose;

    private boolean                 isConnected = false;

    private boolean                 tlsIsClosed = false;

    /*

     * Is the local name service trustworthy?

     *

     * If the local name service is not trustworthy, reverse host name

     * resolution should not be performed for endpoint identification.

     */

    static final boolean trustNameService =

            Utilities.getBooleanProperty("jdk.tls.trustNameService", false);

    /**

     * Package-private constructor used to instantiate an unconnected

     * socket.

     *

     * This instance is meant to set handshake state to use "client mode".

     */

    SSLSocketImpl(SSLContextImpl sslContext) {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

    }

    /**

     * Package-private constructor used to instantiate a server socket.

     *

     * This instance is meant to set handshake state to use "server mode".

     */

    SSLSocketImpl(SSLContextImpl sslContext, SSLConfiguration sslConfig) {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this, sslConfig,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash));

    }

    /**

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL session

     * if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext, String peerHost,

            int peerPort) throws IOException, UnknownHostException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress address, int peerPort) throws IOException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        SocketAddress socketAddress = new InetSocketAddress(address, peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            String peerHost, int peerPort, InetAddress localAddr,

            int localPort) throws IOException, UnknownHostException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress peerAddr, int peerPort,

            InetAddress localAddr, int localPort) throws IOException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress = new InetSocketAddress(peerAddr, peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Creates a server mode {@link Socket} layered over an

     * existing connected socket, and is able to read data which has

     * already been consumed/removed from the {@link Socket}'s

     * underlying {@link InputStream}.

     */

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

            InputStream consumed, boolean autoClose) throws IOException {

        super(sock, consumed);

        // We always layer over a connected socket

        if (!sock.isConnected()) {

            throw new SocketException("Underlying socket is not connected");

        }

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), false);

        this.autoClose = autoClose;

        doneConnect();

    }

    /**

     * Layer SSL traffic over an existing connection, rather than

     * creating a new connection.

     *

     * The existing connection may be used only for SSL traffic (using this

     * SSLSocket) until the SSLSocket.close() call returns. However, if a

     * protocol error is detected, that existing connection is automatically

     * closed.

     * <p>

     * This particular constructor always uses the socket in the

     * role of an SSL client. It may be useful in cases which start

     * using SSL after some initial data transfers, for example in some

     * SSL tunneling applications or as part of some kinds of application

     * protocols which negotiate use of a SSL based security.

     */

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

            String peerHost, int port, boolean autoClose) throws IOException {

        super(sock);

        // We always layer over a connected socket

        if (!sock.isConnected()) {

            throw new SocketException("Underlying socket is not connected");

        }

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        this.autoClose = autoClose;

        doneConnect();

    }

    @Override

    public void connect(SocketAddress endpoint,

            int timeout) throws IOException {

        if (isLayered()) {

            throw new SocketException("Already connected");

        }

        if (!(endpoint instanceof InetSocketAddress)) {

            throw new SocketException(

                    "Cannot handle non-Inet socket addresses.");

        }

        super.connect(endpoint, timeout);

        doneConnect();

    }

    @Override

    public String[] getSupportedCipherSuites() {

        return CipherSuite.namesOf(sslContext.getSupportedCipherSuites());

    }

    @Override

    public synchronized String[] getEnabledCipherSuites() {

        return CipherSuite.namesOf(conContext.sslConfig.enabledCipherSuites);

    }

    @Override

    public synchronized void setEnabledCipherSuites(String[] suites) {

        if (suites == null) {

            throw new IllegalArgumentException("CipherSuites cannot be null");

        }

        conContext.sslConfig.enabledCipherSuites =

                CipherSuite.validValuesOf(suites);

    }

    @Override

    public String[] getSupportedProtocols() {

        return ProtocolVersion.toStringArray(

                sslContext.getSupportedProtocolVersions());

    }

    @Override

    public synchronized String[] getEnabledProtocols() {

        return ProtocolVersion.toStringArray(

                conContext.sslConfig.enabledProtocols);

    }

    @Override

    public synchronized void setEnabledProtocols(String[] protocols) {

        if (protocols == null) {

            throw new IllegalArgumentException("Protocols cannot be null");

        }

        conContext.sslConfig.enabledProtocols =

                ProtocolVersion.namesOf(protocols);

    }

    @Override

    public synchronized SSLSession getSession() {

        try {

            // start handshaking, if failed, the connection will be closed.

            ensureNegotiated();

        } catch (IOException ioe) {

            if (SSLLogger.isOn && SSLLogger.isOn("handshake")) {

                SSLLogger.severe("handshake failed", ioe);

            }

            return SSLSessionImpl.nullSession;

        }

        return conContext.conSession;

    }

    @Override

    public synchronized SSLSession getHandshakeSession() {

        if (conContext.handshakeContext != null) {

            return conContext.handshakeContext.handshakeSession;

        }

        return null;

    }

    @Override

    public synchronized void addHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.addHandshakeCompletedListener(listener);

    }

    @Override

    public synchronized void removeHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.removeHandshakeCompletedListener(listener);

    }

    @Override

    public synchronized void startHandshake() throws IOException {

        checkWrite();

        try {

            conContext.kickstart();

            // All initial handshaking goes through this operation until we

            // have a valid SSL connection.

            //

            // Handle handshake messages only, need no application data.

            if (!conContext.isNegotiated) {

                readRecord();

            }

        } catch (IOException ioe) {

            conContext.fatal(Alert.HANDSHAKE_FAILURE,

                "Couldn't kickstart handshaking", ioe);

        } catch (Exception oe) {    // including RuntimeException

            handleException(oe);

        }

    }

    @Override

    public synchronized void setUseClientMode(boolean mode) {

        conContext.setUseClientMode(mode);

    }

    @Override

    public synchronized boolean getUseClientMode() {

        return conContext.sslConfig.isClientMode;

    }

    @Override

    public synchronized void setNeedClientAuth(boolean need) {

        conContext.sslConfig.clientAuthType =

                (need ? ClientAuthType.CLIENT_AUTH_REQUIRED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    }

    @Override

    public synchronized boolean getNeedClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUIRED);

    }

    @Override

    public synchronized void setWantClientAuth(boolean want) {

        conContext.sslConfig.clientAuthType =

                (want ? ClientAuthType.CLIENT_AUTH_REQUESTED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    }

    @Override

    public synchronized boolean getWantClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUESTED);

    }

    @Override

    public synchronized void setEnableSessionCreation(boolean flag) {

        conContext.sslConfig.enableSessionCreation = flag;

    }

    @Override

    public synchronized boolean getEnableSessionCreation() {

        return conContext.sslConfig.enableSessionCreation;

    }

    @Override

    public synchronized boolean isClosed() {

        return tlsIsClosed && conContext.isClosed();

    }

    @Override

    public synchronized void close() throws IOException {

        try {

            conContext.close();

        } catch (IOException ioe) {

            // ignore the exception

            if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

                SSLLogger.warning("connection context closure failed", ioe);

            }

        } finally {

            tlsIsClosed = true;

        }

    }

    @Override

    public synchronized InputStream getInputStream() throws IOException {

        if (isClosed() || conContext.isInboundDone()) {

            throw new SocketException("Socket or inbound is closed");

        }

        if (!isConnected) {

            throw new SocketException("Socket is not connected");

        }

        return appInput;

    }

    private synchronized void ensureNegotiated() throws IOException {

        if (conContext.isNegotiated ||

                conContext.isClosed() || conContext.isBroken) {

            return;

        }

        startHandshake();

    }

    private class AppInputStream extends InputStream {

        // One element array used to implement the single byte read() method

        private final byte[] oneByte = new byte[1];

        // the temporary buffer used to read network

        private ByteBuffer buffer;

        // Is application data available in the stream?

        private boolean appDataIsAvailable;