/*

 * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.IOException;

import java.nio.ByteBuffer;

import java.security.SecureRandom;

import java.security.cert.X509Certificate;

import java.text.MessageFormat;

import java.util.Arrays;

import java.util.Collections;

import java.util.LinkedList;

import java.util.List;

import java.util.Locale;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.SSLPeerUnverifiedException;

import javax.net.ssl.SSLProtocolException;

import static sun.security.ssl.ClientAuthType.CLIENT_AUTH_REQUIRED;

import sun.security.ssl.SSLHandshake.HandshakeMessage;

import sun.security.ssl.SupportedVersionsExtension.CHSupportedVersionsSpec;

/**

 * Pack of the ClientHello handshake message.

 */

final class ClientHello {

    static final SSLProducer kickstartProducer =

        new ClientHelloKickstartProducer();

    static final SSLConsumer handshakeConsumer =

        new ClientHelloConsumer();

    static final HandshakeProducer handshakeProducer =

        new ClientHelloProducer();

    private static final HandshakeConsumer t12HandshakeConsumer =

            new T12ClientHelloConsumer();

    private static final HandshakeConsumer t13HandshakeConsumer =

            new T13ClientHelloConsumer();

    private static final HandshakeConsumer d12HandshakeConsumer =

            new D12ClientHelloConsumer();

    private static final HandshakeConsumer d13HandshakeConsumer =

            new D13ClientHelloConsumer();

    /**

     * The ClientHello handshake message.

     *

     * See RFC 5264/4346/2246/6347 for the specifications.

     */

    static final class ClientHelloMessage extends HandshakeMessage {

        private final boolean       isDTLS;

        final int                   clientVersion;

        final RandomCookie          clientRandom;

        final SessionId             sessionId;

        private byte[]              cookie;         // DTLS only

        final int[]                 cipherSuiteIds;

        final List<CipherSuite>     cipherSuites;   // known cipher suites only

        final byte[]                compressionMethod;

        final SSLExtensions         extensions;

        private static final byte[]  NULL_COMPRESSION = new byte[] {0};

        ClientHelloMessage(HandshakeContext handshakeContext,

                int clientVersion, SessionId sessionId,

                List<CipherSuite> cipherSuites, SecureRandom generator) {

            super(handshakeContext);

            this.isDTLS = handshakeContext.sslContext.isDTLS();

            this.clientVersion = clientVersion;

            this.clientRandom = new RandomCookie(generator);

            this.sessionId = sessionId;

            if (isDTLS) {

                this.cookie = new byte[0];

            } else {

                this.cookie = null;

            }

            this.cipherSuites = cipherSuites;

            this.cipherSuiteIds = getCipherSuiteIds(cipherSuites);

            this.extensions = new SSLExtensions(this);

            // Don't support compression.

            this.compressionMethod = NULL_COMPRESSION;

        }

        /* Read up to the binders in the PSK extension. After this method

         * returns, the ByteBuffer position will be at end of the message

         * fragment that should be hashed to produce the PSK binder values.

         * The client of this method can use this position to determine the

         * message fragment and produce the binder values.

         */

        static void readPartial(TransportContext tc,

                ByteBuffer m) throws IOException {

            boolean isDTLS = tc.sslContext.isDTLS();

            // version

            Record.getInt16(m);

            new RandomCookie(m);

            // session ID

            Record.getBytes8(m);

            // DTLS cookie

            if (isDTLS) {

                Record.getBytes8(m);

            }

            // cipher suite IDs

            Record.getBytes16(m);

            // compression method

            Record.getBytes8(m);

            // read extensions, if present

            if (m.remaining() >= 2) {

                int remaining = Record.getInt16(m);

                while (remaining > 0) {

                    int id = Record.getInt16(m);

                    int extLen = Record.getInt16(m);

                    remaining -= extLen + 4;

                    if (id == SSLExtension.CH_PRE_SHARED_KEY.id) {

                        // ensure pre_shared_key is the last extension

                        if (remaining > 0) {

                            throw tc.fatal(Alert.ILLEGAL_PARAMETER,

                                    "pre_shared_key extension is not last");

                        }

                        // read only up to the IDs

                        Record.getBytes16(m);

                        return;

                    } else {

                        m.position(m.position() + extLen);

                    }

                }

            }   // Otherwise, ignore the remaining bytes.

        }

        ClientHelloMessage(HandshakeContext handshakeContext, ByteBuffer m,

                SSLExtension[] supportedExtensions) throws IOException {

            super(handshakeContext);

            this.isDTLS = handshakeContext.sslContext.isDTLS();

            this.clientVersion = ((m.get() & 0xFF) << 8) | (m.get() & 0xFF);

            this.clientRandom = new RandomCookie(m);

            this.sessionId = new SessionId(Record.getBytes8(m));

            try {

                sessionId.checkLength(clientVersion);

            } catch (SSLProtocolException ex) {

                throw handshakeContext.conContext.fatal(

                        Alert.ILLEGAL_PARAMETER, ex);

            }

            if (isDTLS) {

                this.cookie = Record.getBytes8(m);

            } else {

                this.cookie = null;

            }

            byte[] encodedIds = Record.getBytes16(m);

            if (encodedIds.length == 0 || (encodedIds.length & 0x01) != 0) {

                throw handshakeContext.conContext.fatal(

                        Alert.ILLEGAL_PARAMETER,

                        "Invalid ClientHello message");

            }

            this.cipherSuiteIds = new int[encodedIds.length >> 1];

            for (int i = 0, j = 0; i < encodedIds.length; i++, j++) {

                cipherSuiteIds[j] =

                    ((encodedIds[i++] & 0xFF) << 8) | (encodedIds[i] & 0xFF);

            }

            this.cipherSuites = getCipherSuites(cipherSuiteIds);

            this.compressionMethod = Record.getBytes8(m);

            // In TLS 1.3, use of certain extensions is mandatory.

            if (m.hasRemaining()) {

                this.extensions =

                        new SSLExtensions(this, m, supportedExtensions);

            } else {

                this.extensions = new SSLExtensions(this);

            }

        }

        void setHelloCookie(byte[] cookie) {

            this.cookie = cookie;

        }

        // DTLS 1.0/1.2, for cookie generation.

        byte[] getHelloCookieBytes() {

            HandshakeOutStream hos = new HandshakeOutStream(null);

            try {

                // copied from send() method

                hos.putInt8((byte)((clientVersion >>> 8) & 0xFF));

                hos.putInt8((byte)(clientVersion & 0xFF));

                hos.write(clientRandom.randomBytes, 0, 32);

                hos.putBytes8(sessionId.getId());

                // ignore cookie

                hos.putBytes16(getEncodedCipherSuites());

                hos.putBytes8(compressionMethod);

                extensions.send(hos);       // In TLS 1.3, use of certain

                                            // extensions is mandatory.

            } catch (IOException ioe) {

                // unlikely

            }

            return hos.toByteArray();

        }

        // (D)TLS 1.3, for cookie generation.

        byte[] getHeaderBytes() {

            HandshakeOutStream hos = new HandshakeOutStream(null);

            try {

                // copied from send() method

                hos.putInt8((byte)((clientVersion >>> 8) & 0xFF));

                hos.putInt8((byte)(clientVersion & 0xFF));

                hos.write(clientRandom.randomBytes, 0, 32);

                hos.putBytes8(sessionId.getId());

                hos.putBytes16(getEncodedCipherSuites());

                hos.putBytes8(compressionMethod);

            } catch (IOException ioe) {

                // unlikely

            }

            return hos.toByteArray();

        }

        private static int[] getCipherSuiteIds(

                List<CipherSuite> cipherSuites) {

            if (cipherSuites != null) {

                int[] ids = new int[cipherSuites.size()];

                int i = 0;

                for (CipherSuite cipherSuite : cipherSuites) {

                    ids[i++] = cipherSuite.id;

                }

                return ids;

            }

            return new int[0];

        }

        private static List<CipherSuite> getCipherSuites(int[] ids) {

            List<CipherSuite> cipherSuites = new LinkedList<>();

            for (int id : ids) {

                CipherSuite cipherSuite = CipherSuite.valueOf(id);

                if (cipherSuite != null) {

                    cipherSuites.add(cipherSuite);

                }

            }

            return Collections.unmodifiableList(cipherSuites);

        }

        private List<String> getCipherSuiteNames() {

            List<String> names = new LinkedList<>();

            for (int id : cipherSuiteIds) {

                names.add(CipherSuite.nameOf(id) +

                        "(" + Utilities.byte16HexString(id) + ")");            }

            return names;

        }

        private byte[] getEncodedCipherSuites() {

            byte[] encoded = new byte[cipherSuiteIds.length << 1];

            int i = 0;

            for (int id : cipherSuiteIds) {

                encoded[i++] = (byte)(id >> 8);

                encoded[i++] = (byte)id;

            }

            return encoded;

        }

        @Override

        public SSLHandshake handshakeType() {

            return SSLHandshake.CLIENT_HELLO;

        }

        @Override

        public int messageLength() {

            /*

             * Add fixed size parts of each field...

             * version + random + session + cipher + compress

             */

            return (2 + 32 + 1 + 2 + 1

                + sessionId.length()        /* ... + variable parts */

                + (isDTLS ? (1 + cookie.length) : 0)

                + (cipherSuiteIds.length * 2)

                + compressionMethod.length)

                + extensions.length();      // In TLS 1.3, use of certain

                                            // extensions is mandatory.

        }

        @Override

        public void send(HandshakeOutStream hos) throws IOException {

            sendCore(hos);

            extensions.send(hos);       // In TLS 1.3, use of certain

                                        // extensions is mandatory.

        }

        void sendCore(HandshakeOutStream hos) throws IOException {

            hos.putInt8((byte) (clientVersion >>> 8));

            hos.putInt8((byte) clientVersion);

            hos.write(clientRandom.randomBytes, 0, 32);

            hos.putBytes8(sessionId.getId());

            if (isDTLS) {

                hos.putBytes8(cookie);

            }

            hos.putBytes16(getEncodedCipherSuites());

            hos.putBytes8(compressionMethod);

        }

        @Override

        public String toString() {

            if (isDTLS) {

                MessageFormat messageFormat = new MessageFormat(

                    "\"ClientHello\": '{'\n" +

                    "  \"client version\"      : \"{0}\",\n" +

                    "  \"random\"              : \"{1}\",\n" +

                    "  \"session id\"          : \"{2}\",\n" +

                    "  \"cookie\"              : \"{3}\",\n" +

                    "  \"cipher suites\"       : \"{4}\",\n" +

                    "  \"compression methods\" : \"{5}\",\n" +

                    "  \"extensions\"          : [\n" +

                    "{6}\n" +

                    "  ]\n" +

                    "'}'",

                    Locale.ENGLISH);

                Object[] messageFields = {

                    ProtocolVersion.nameOf(clientVersion),

                    Utilities.toHexString(clientRandom.randomBytes),

                    sessionId.toString(),

                    Utilities.toHexString(cookie),

                    getCipherSuiteNames().toString(),

                    Utilities.toHexString(compressionMethod),

                    Utilities.indent(Utilities.indent(extensions.toString()))

                };

                return messageFormat.format(messageFields);

            } else {

                MessageFormat messageFormat = new MessageFormat(

                    "\"ClientHello\": '{'\n" +

                    "  \"client version\"      : \"{0}\",\n" +

                    "  \"random\"              : \"{1}\",\n" +

                    "  \"session id\"          : \"{2}\",\n" +

                    "  \"cipher suites\"       : \"{3}\",\n" +

                    "  \"compression methods\" : \"{4}\",\n" +

                    "  \"extensions\"          : [\n" +

                    "{5}\n" +

                    "  ]\n" +

                    "'}'",

                    Locale.ENGLISH);

                Object[] messageFields = {

                    ProtocolVersion.nameOf(clientVersion),

                    Utilities.toHexString(clientRandom.randomBytes),

                    sessionId.toString(),

                    getCipherSuiteNames().toString(),

                    Utilities.toHexString(compressionMethod),

                    Utilities.indent(Utilities.indent(extensions.toString()))

                };

                return messageFormat.format(messageFields);

            }

        }

    }

    /**

     * The "ClientHello" handshake message kick start producer.

     */

    private static final

            class ClientHelloKickstartProducer implements SSLProducer {

        // Prevent instantiation of this class.

        private ClientHelloKickstartProducer() {

            // blank

        }

        // Produce kickstart handshake message.

        @Override

        public byte[] produce(ConnectionContext context) throws IOException {

            // The producing happens in client side only.

            ClientHandshakeContext chc = (ClientHandshakeContext)context;

            // clean up this producer

            chc.handshakeProducers.remove(SSLHandshake.CLIENT_HELLO.id);

            // the max protocol version this client is supporting.

            ProtocolVersion maxProtocolVersion = chc.maximumActiveProtocol;

            // session ID of the ClientHello message

            SessionId sessionId = SSLSessionImpl.nullSession.getSessionId();

            // a list of cipher suites sent by the client

            List<CipherSuite> cipherSuites = chc.activeCipherSuites;

            //

            // Try to resume an existing session.

            //

            SSLSessionContextImpl ssci = (SSLSessionContextImpl)

                    chc.sslContext.engineGetClientSessionContext();

            SSLSessionImpl session = ssci.get(

                    chc.conContext.transport.getPeerHost(),

                    chc.conContext.transport.getPeerPort());

            if (session != null) {

                // If unsafe server certificate change is not allowed, reserve

                // current server certificates if the previous handshake is a

                // session-resumption abbreviated initial handshake.

                if (!ClientHandshakeContext.allowUnsafeServerCertChange &&

                        session.isSessionResumption()) {

                    try {

                        // If existing, peer certificate chain cannot be null.

                        chc.reservedServerCerts =

                            (X509Certificate[])session.getPeerCertificates();

                    } catch (SSLPeerUnverifiedException puve) {

                        // Maybe not certificate-based, ignore the exception.

                    }

                }

                if (!session.isRejoinable()) {

                    session = null;

                    if (SSLLogger.isOn &&

                            SSLLogger.isOn("ssl,handshake,verbose")) {

                        SSLLogger.finest(

                            "Can't resume, the session is not rejoinable");

                    }

                }

            }

            CipherSuite sessionSuite = null;

            if (session != null) {

                sessionSuite = session.getSuite();

                if (!chc.isNegotiable(sessionSuite)) {

                    session = null;

                    if (SSLLogger.isOn &&

                            SSLLogger.isOn("ssl,handshake,verbose")) {

                        SSLLogger.finest(

                            "Can't resume, unavailable session cipher suite");

                    }

                }

            }

            ProtocolVersion sessionVersion = null;

            if (session != null) {

                sessionVersion = session.getProtocolVersion();

                if (!chc.isNegotiable(sessionVersion)) {

                    session = null;

                    if (SSLLogger.isOn &&

                            SSLLogger.isOn("ssl,handshake,verbose")) {

                        SSLLogger.finest(

                            "Can't resume, unavailable protocol version");

                    }

                }

            }

            if (session != null &&

                !sessionVersion.useTLS13PlusSpec() &&

                SSLConfiguration.useExtendedMasterSecret) {

                boolean isEmsAvailable = chc.sslConfig.isAvailable(

                    SSLExtension.CH_EXTENDED_MASTER_SECRET, sessionVersion);

                if (isEmsAvailable && !session.useExtendedMasterSecret &&

                        !SSLConfiguration.allowLegacyResumption) {

                    // perform full handshake instead

                    //

                    // The client SHOULD NOT offer an abbreviated handshake

                    // to resume a session that does not use an extended

                    // master secret.  Instead, it SHOULD offer a full

                    // handshake.

                     session = null;

                }

                if ((session != null) &&

                        !ClientHandshakeContext.allowUnsafeServerCertChange) {

                    // It is fine to move on with abbreviate handshake if

                    // endpoint identification is enabled.

                    String identityAlg = chc.sslConfig.identificationProtocol;

                    if (identityAlg == null || identityAlg.isEmpty()) {

                        if (isEmsAvailable) {

                            if (!session.useExtendedMasterSecret) {

                                // perform full handshake instead

                                session = null;

                            }   // Otherwise, use extended master secret.

                        } else {

                            // The extended master secret extension does not

                            // apply to SSL 3.0.  Perform a full handshake

                            // instead.

                            //

                            // Note that the useExtendedMasterSecret is

                            // extended to protect SSL 3.0 connections,

                            // by discarding abbreviate handshake.

                            session = null;

                        }

                    }

                }

            }

            // ensure that the endpoint identification algorithm matches the

            // one in the session

            String identityAlg = chc.sslConfig.identificationProtocol;

            if (session != null && identityAlg != null) {

                String sessionIdentityAlg =

                    session.getIdentificationProtocol();

                if (!identityAlg.equalsIgnoreCase(sessionIdentityAlg)) {

                    if (SSLLogger.isOn &&

                    SSLLogger.isOn("ssl,handshake,verbose")) {

                        SSLLogger.finest("Can't resume, endpoint id" +

                            " algorithm does not match, requested: " +

                            identityAlg + ", cached: " + sessionIdentityAlg);