/*

 * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.EOFException;

import java.io.IOException;

import java.io.InputStream;

import java.io.InterruptedIOException;

import java.io.OutputStream;

import java.net.InetAddress;

import java.net.InetSocketAddress;

import java.net.Socket;

import java.net.SocketAddress;

import java.net.SocketException;

import java.net.UnknownHostException;

import java.nio.ByteBuffer;

import java.util.List;

import java.util.function.BiFunction;

import javax.net.ssl.HandshakeCompletedListener;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLHandshakeException;

import javax.net.ssl.SSLParameters;

import javax.net.ssl.SSLProtocolException;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLSocket;

import jdk.internal.access.JavaNetInetAddressAccess;

import jdk.internal.access.SharedSecrets;

/**

 * Implementation of an SSL socket.

 * <P>

 * This is a normal connection type socket, implementing SSL over some lower

 * level socket, such as TCP.  Because it is layered over some lower level

 * socket, it MUST override all default socket methods.

 * <P>

 * This API offers a non-traditional option for establishing SSL

 * connections.  You may first establish the connection directly, then pass

 * that connection to the SSL socket constructor with a flag saying which

 * role should be taken in the handshake protocol.  (The two ends of the

 * connection must not choose the same role!)  This allows setup of SSL

 * proxying or tunneling, and also allows the kind of "role reversal"

 * that is required for most FTP data transfers.

 *

 * @see javax.net.ssl.SSLSocket

 * @see SSLServerSocket

 *

 * @author David Brownell

 */

public final class SSLSocketImpl

        extends BaseSSLSocketImpl implements SSLTransport {

    final SSLContextImpl            sslContext;

    final TransportContext          conContext;

    private final AppInputStream    appInput = new AppInputStream();

    private final AppOutputStream   appOutput = new AppOutputStream();

    private String                  peerHost;

    private boolean                 autoClose;

    private boolean                 isConnected = false;

    private volatile boolean        tlsIsClosed = false;

    /*

     * Is the local name service trustworthy?

     *

     * If the local name service is not trustworthy, reverse host name

     * resolution should not be performed for endpoint identification.

     */

    private static final boolean trustNameService =

            Utilities.getBooleanProperty("jdk.tls.trustNameService", false);

    /**

     * Package-private constructor used to instantiate an unconnected

     * socket.

     *

     * This instance is meant to set handshake state to use "client mode".

     */

    SSLSocketImpl(SSLContextImpl sslContext) {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

    }

    /**

     * Package-private constructor used to instantiate a server socket.

     *

     * This instance is meant to set handshake state to use "server mode".

     */

    SSLSocketImpl(SSLContextImpl sslContext, SSLConfiguration sslConfig) {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this, sslConfig,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash));

    }

    /**

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL session

     * if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext, String peerHost,

            int peerPort) throws IOException, UnknownHostException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress address, int peerPort) throws IOException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        SocketAddress socketAddress = new InetSocketAddress(address, peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a named host at a specified

     * port, using the authentication context provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            String peerHost, int peerPort, InetAddress localAddr,

            int localPort) throws IOException, UnknownHostException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress =

               peerHost != null ? new InetSocketAddress(peerHost, peerPort) :

               new InetSocketAddress(InetAddress.getByName(null), peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Constructs an SSL connection to a server at a specified

     * address, and TCP port, using the authentication context

     * provided.

     *

     * This endpoint acts as the client, and may rejoin an existing SSL

     * session if appropriate.

     */

    SSLSocketImpl(SSLContextImpl sslContext,

            InetAddress peerAddr, int peerPort,

            InetAddress localAddr, int localPort) throws IOException {

        super();

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        bind(new InetSocketAddress(localAddr, localPort));

        SocketAddress socketAddress = new InetSocketAddress(peerAddr, peerPort);

        connect(socketAddress, 0);

    }

    /**

     * Creates a server mode {@link Socket} layered over an

     * existing connected socket, and is able to read data which has

     * already been consumed/removed from the {@link Socket}'s

     * underlying {@link InputStream}.

     */

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

            InputStream consumed, boolean autoClose) throws IOException {

        super(sock, consumed);

        // We always layer over a connected socket

        if (!sock.isConnected()) {

            throw new SocketException("Underlying socket is not connected");

        }

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), false);

        this.autoClose = autoClose;

        doneConnect();

    }

    /**

     * Layer SSL traffic over an existing connection, rather than

     * creating a new connection.

     *

     * The existing connection may be used only for SSL traffic (using this

     * SSLSocket) until the SSLSocket.close() call returns. However, if a

     * protocol error is detected, that existing connection is automatically

     * closed.

     * <p>

     * This particular constructor always uses the socket in the

     * role of an SSL client. It may be useful in cases which start

     * using SSL after some initial data transfers, for example in some

     * SSL tunneling applications or as part of some kinds of application

     * protocols which negotiate use of a SSL based security.

     */

    SSLSocketImpl(SSLContextImpl sslContext, Socket sock,

            String peerHost, int port, boolean autoClose) throws IOException {

        super(sock);

        // We always layer over a connected socket

        if (!sock.isConnected()) {

            throw new SocketException("Underlying socket is not connected");

        }

        this.sslContext = sslContext;

        HandshakeHash handshakeHash = new HandshakeHash();

        this.conContext = new TransportContext(sslContext, this,

                new SSLSocketInputRecord(handshakeHash),

                new SSLSocketOutputRecord(handshakeHash), true);

        this.peerHost = peerHost;

        this.autoClose = autoClose;

        doneConnect();

    }

    @Override

    public void connect(SocketAddress endpoint,

            int timeout) throws IOException {

        if (isLayered()) {

            throw new SocketException("Already connected");

        }

        if (!(endpoint instanceof InetSocketAddress)) {

            throw new SocketException(

                    "Cannot handle non-Inet socket addresses.");

        }

        super.connect(endpoint, timeout);

        doneConnect();

    }

    @Override

    public String[] getSupportedCipherSuites() {

        return CipherSuite.namesOf(sslContext.getSupportedCipherSuites());

    }

    @Override

    public synchronized String[] getEnabledCipherSuites() {

        return CipherSuite.namesOf(conContext.sslConfig.enabledCipherSuites);

    }

    @Override

    public synchronized void setEnabledCipherSuites(String[] suites) {

        conContext.sslConfig.enabledCipherSuites =

                CipherSuite.validValuesOf(suites);

    }

    @Override

    public String[] getSupportedProtocols() {

        return ProtocolVersion.toStringArray(

                sslContext.getSupportedProtocolVersions());

    }

    @Override

    public synchronized String[] getEnabledProtocols() {

        return ProtocolVersion.toStringArray(

                conContext.sslConfig.enabledProtocols);

    }

    @Override

    public synchronized void setEnabledProtocols(String[] protocols) {

        if (protocols == null) {

            throw new IllegalArgumentException("Protocols cannot be null");

        }

        conContext.sslConfig.enabledProtocols =

                ProtocolVersion.namesOf(protocols);

    }

    @Override

    public SSLSession getSession() {

        try {

            // start handshaking, if failed, the connection will be closed.

            ensureNegotiated();

        } catch (IOException ioe) {

            if (SSLLogger.isOn && SSLLogger.isOn("handshake")) {

                SSLLogger.severe("handshake failed", ioe);

            }

            return SSLSessionImpl.nullSession;

        }

        return conContext.conSession;

    }

    @Override

    public synchronized SSLSession getHandshakeSession() {

        if (conContext.handshakeContext != null) {

            synchronized (this) {

                if (conContext.handshakeContext != null) {

                    return conContext.handshakeContext.handshakeSession;

                }

            }

        }

        return null;

    }

    @Override

    public synchronized void addHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.addHandshakeCompletedListener(listener);

    }

    @Override

    public synchronized void removeHandshakeCompletedListener(

            HandshakeCompletedListener listener) {

        if (listener == null) {

            throw new IllegalArgumentException("listener is null");

        }

        conContext.sslConfig.removeHandshakeCompletedListener(listener);

    }

    @Override

    public void startHandshake() throws IOException {

        if (!isConnected) {

            throw new SocketException("Socket is not connected");

        }

        if (conContext.isBroken || conContext.isInboundClosed() ||

                conContext.isOutboundClosed()) {

            throw new SocketException("Socket has been closed or broken");

        }

        synchronized (conContext) {     // handshake lock

            // double check the context status

            if (conContext.isBroken || conContext.isInboundClosed() ||

                    conContext.isOutboundClosed()) {

                throw new SocketException("Socket has been closed or broken");

            }

            try {

                conContext.kickstart();

                // All initial handshaking goes through this operation until we

                // have a valid SSL connection.

                //

                // Handle handshake messages only, need no application data.

                if (!conContext.isNegotiated) {

                    readHandshakeRecord();

                }

            } catch (IOException ioe) {

                throw conContext.fatal(Alert.HANDSHAKE_FAILURE,

                    "Couldn't kickstart handshaking", ioe);

            } catch (Exception oe) {    // including RuntimeException

                handleException(oe);

            }

        }

    }

    @Override

    public synchronized void setUseClientMode(boolean mode) {

        conContext.setUseClientMode(mode);

    }

    @Override

    public synchronized boolean getUseClientMode() {

        return conContext.sslConfig.isClientMode;

    }

    @Override

    public synchronized void setNeedClientAuth(boolean need) {

        conContext.sslConfig.clientAuthType =

                (need ? ClientAuthType.CLIENT_AUTH_REQUIRED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    }

    @Override

    public synchronized boolean getNeedClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUIRED);

    }

    @Override

    public synchronized void setWantClientAuth(boolean want) {

        conContext.sslConfig.clientAuthType =

                (want ? ClientAuthType.CLIENT_AUTH_REQUESTED :

                        ClientAuthType.CLIENT_AUTH_NONE);

    }

    @Override

    public synchronized boolean getWantClientAuth() {

        return (conContext.sslConfig.clientAuthType ==

                        ClientAuthType.CLIENT_AUTH_REQUESTED);

    }

    @Override

    public synchronized void setEnableSessionCreation(boolean flag) {

        conContext.sslConfig.enableSessionCreation = flag;

    }

    @Override

    public synchronized boolean getEnableSessionCreation() {

        return conContext.sslConfig.enableSessionCreation;

    }

    @Override

    public boolean isClosed() {

        return tlsIsClosed;

    }

    // Please don't synchronized this method.  Otherwise, the read and close

    // locks may be deadlocked.

    @Override

    public void close() throws IOException {

        if (tlsIsClosed) {

            return;

        }

        if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

            SSLLogger.fine("duplex close of SSLSocket");

        }

        try {

            // shutdown output bound, which may have been closed previously.

            if (!isOutputShutdown()) {

                duplexCloseOutput();

            }

            // shutdown input bound, which may have been closed previously.

            if (!isInputShutdown()) {

                duplexCloseInput();

            }

            if (!isClosed()) {

                // close the connection directly

                closeSocket(false);

            }

        } catch (IOException ioe) {

            // ignore the exception

            if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

                SSLLogger.warning("SSLSocket duplex close failed", ioe);