/*

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Sun designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Sun in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

 * CA 95054 USA or visit www.sun.com if you need additional information or

 * have any questions.

 */

package sun.security.ssl;

import java.io.*;

import java.util.*;

import java.security.*;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.security.AccessController;

import java.security.AccessControlContext;

import java.security.PrivilegedExceptionAction;

import java.security.PrivilegedActionException;

import java.security.cert.X509Certificate;

import javax.crypto.*;

import javax.crypto.spec.*;

import javax.net.ssl.*;

import sun.misc.HexDumpEncoder;

import sun.security.internal.spec.*;

import sun.security.internal.interfaces.TlsMasterSecret;

import sun.security.ssl.HandshakeMessage.*;

import sun.security.ssl.CipherSuite.*;

/**

 * Handshaker ... processes handshake records from an SSL V3.0

 * data stream, handling all the details of the handshake protocol.

 *

 * Note that the real protocol work is done in two subclasses, the  base

 * class just provides the control flow and key generation framework.

 *

 * @author David Brownell

 */

abstract class Handshaker {

    // current protocol version

    ProtocolVersion protocolVersion;

    // list of enabled protocols

    ProtocolList enabledProtocols;

    private boolean             isClient;

    SSLSocketImpl               conn = null;

    SSLEngineImpl               engine = null;

    HandshakeHash               handshakeHash;

    HandshakeInStream           input;

    HandshakeOutStream          output;

    int                         state;

    SSLContextImpl              sslContext;

    RandomCookie                clnt_random, svr_random;

    SSLSessionImpl              session;

    // Temporary MD5 and SHA message digests. Must always be left

    // in reset state after use.

    private MessageDigest md5Tmp, shaTmp;

    // list of enabled CipherSuites

    CipherSuiteList     enabledCipherSuites;

    // current CipherSuite. Never null, initially SSL_NULL_WITH_NULL_NULL

    CipherSuite         cipherSuite;

    // current key exchange. Never null, initially K_NULL

    KeyExchange         keyExchange;

    /* True if this session is being resumed (fast handshake) */

    boolean             resumingSession;

    /* True if it's OK to start a new SSL session */

    boolean             enableNewSession;

    // Temporary storage for the individual keys. Set by

    // calculateConnectionKeys() and cleared once the ciphers are

    // activated.

    private SecretKey clntWriteKey, svrWriteKey;

    private IvParameterSpec clntWriteIV, svrWriteIV;

    private SecretKey clntMacSecret, svrMacSecret;

    /*

     * Delegated task subsystem data structures.

     *

     * If thrown is set, we need to propagate this back immediately

     * on entry into processMessage().

     *

     * Data is protected by the SSLEngine.this lock.

     */

    private volatile boolean taskDelegated = false;

    private volatile DelegatedTask delegatedTask = null;

    private volatile Exception thrown = null;

    // Could probably use a java.util.concurrent.atomic.AtomicReference

    // here instead of using this lock.  Consider changing.

    private Object thrownLock = new Object();

    /* Class and subclass dynamic debugging support */

    static final Debug debug = Debug.getInstance("ssl");

    Handshaker(SSLSocketImpl c, SSLContextImpl context,

            ProtocolList enabledProtocols, boolean needCertVerify,

            boolean isClient) {

        this.conn = c;

        init(context, enabledProtocols, needCertVerify, isClient);

    }

    Handshaker(SSLEngineImpl engine, SSLContextImpl context,

            ProtocolList enabledProtocols, boolean needCertVerify,

            boolean isClient) {

        this.engine = engine;

        init(context, enabledProtocols, needCertVerify, isClient);

    }

    private void init(SSLContextImpl context, ProtocolList enabledProtocols,

            boolean needCertVerify, boolean isClient) {

        this.sslContext = context;

        this.isClient = isClient;

        enableNewSession = true;

        setCipherSuite(CipherSuite.C_NULL);

        md5Tmp = JsseJce.getMD5();

        shaTmp = JsseJce.getSHA();

        //

        // We accumulate digests of the handshake messages so that

        // we can read/write CertificateVerify and Finished messages,

        // getting assurance against some particular active attacks.

        //

        handshakeHash = new HandshakeHash(needCertVerify);

        setEnabledProtocols(enabledProtocols);

        if (conn != null) {

            conn.getAppInputStream().r.setHandshakeHash(handshakeHash);

        } else {        // engine != null

            engine.inputRecord.setHandshakeHash(handshakeHash);

        }

        //

        // In addition to the connection state machine, controlling

        // how the connection deals with the different sorts of records

        // that get sent (notably handshake transitions!), there's

        // also a handshaking state machine that controls message

        // sequencing.

        //

        // It's a convenient artifact of the protocol that this can,

        // with only a couple of minor exceptions, be driven by the

        // type constant for the last message seen:  except for the

        // client's cert verify, those constants are in a convenient

        // order to drastically simplify state machine checking.

        //

        state = -1;

    }

    /*

     * Reroutes calls to the SSLSocket or SSLEngine (*SE).

     *

     * We could have also done it by extra classes

     * and letting them override, but this seemed much

     * less involved.

     */

    void fatalSE(byte b, String diagnostic) throws IOException {

        fatalSE(b, diagnostic, null);

    }

    void fatalSE(byte b, Throwable cause) throws IOException {

        fatalSE(b, null, cause);

    }

    void fatalSE(byte b, String diagnostic, Throwable cause)

            throws IOException {

        if (conn != null) {

            conn.fatal(b, diagnostic, cause);

        } else {

            engine.fatal(b, diagnostic, cause);

        }

    }

    void warningSE(byte b) {

        if (conn != null) {

            conn.warning(b);

        } else {

            engine.warning(b);

        }

    }

    String getHostSE() {

        if (conn != null) {

            return conn.getHost();

        } else {

            return engine.getPeerHost();

        }

    }

    String getHostAddressSE() {

        if (conn != null) {

            return conn.getInetAddress().getHostAddress();

        } else {

            /*

             * This is for caching only, doesn't matter that's is really

             * a hostname.  The main thing is that it doesn't do

             * a reverse DNS lookup, potentially slowing things down.

             */

            return engine.getPeerHost();

        }

    }

    boolean isLoopbackSE() {

        if (conn != null) {

            return conn.getInetAddress().isLoopbackAddress();

        } else {

            return false;

        }

    }

    int getPortSE() {

        if (conn != null) {

            return conn.getPort();

        } else {

            return engine.getPeerPort();

        }

    }

    int getLocalPortSE() {

        if (conn != null) {

            return conn.getLocalPort();

        } else {

            return -1;

        }

    }

    String getHostnameVerificationSE() {

        if (conn != null) {

            return conn.getHostnameVerification();

        } else {

            return engine.getHostnameVerification();

        }

    }

    AccessControlContext getAccSE() {

        if (conn != null) {

            return conn.getAcc();

        } else {

            return engine.getAcc();

        }

    }

    private void setVersionSE(ProtocolVersion protocolVersion) {

        if (conn != null) {

            conn.setVersion(protocolVersion);

        } else {

            engine.setVersion(protocolVersion);

        }

    }

    /**

     * Set the active protocol version and propagate it to the SSLSocket

     * and our handshake streams. Called from ClientHandshaker

     * and ServerHandshaker with the negotiated protocol version.

     */

    void setVersion(ProtocolVersion protocolVersion) {

        this.protocolVersion = protocolVersion;

        setVersionSE(protocolVersion);

        output.r.setVersion(protocolVersion);

    }

    /**

     * Set the enabled protocols. Called from the constructor or

     * SSLSocketImpl.setEnabledProtocols() (if the handshake is not yet

     * in progress).

     */

    void setEnabledProtocols(ProtocolList enabledProtocols) {

        this.enabledProtocols = enabledProtocols;

        // temporary protocol version until the actual protocol version

        // is negotiated in the Hello exchange. This affects the record

        // version we sent with the ClientHello. Using max() as the record

        // version is not really correct but some implementations fail to

        // correctly negotiate TLS otherwise.

        protocolVersion = enabledProtocols.max;

        ProtocolVersion helloVersion = enabledProtocols.helloVersion;

        input = new HandshakeInStream(handshakeHash);

        if (conn != null) {

            output = new HandshakeOutStream(protocolVersion, helloVersion,

                                        handshakeHash, conn);

            conn.getAppInputStream().r.setHelloVersion(helloVersion);

        } else {

            output = new HandshakeOutStream(protocolVersion, helloVersion,

                                        handshakeHash, engine);

            engine.outputRecord.setHelloVersion(helloVersion);

        }

    }

    /**

     * Set cipherSuite and keyExchange to the given CipherSuite.

     * Does not perform any verification that this is a valid selection,

     * this must be done before calling this method.

     */

    void setCipherSuite(CipherSuite s) {

        this.cipherSuite = s;

        this.keyExchange = s.keyExchange;

    }

    /**

     * Check if the given ciphersuite is enabled and available.

     * (Enabled ciphersuites are always available unless the status has

     * changed due to change in JCE providers since it was enabled).

     * Does not check if the required server certificates are available.

     */

    boolean isEnabled(CipherSuite s) {

        return enabledCipherSuites.contains(s) && s.isAvailable();

    }

    /**

     * As long as handshaking has not started, we can

     * change whether session creations are allowed.

     *

     * Callers should do their own checking if handshaking

     * has started.

     */

    void setEnableSessionCreation(boolean newSessions) {

        enableNewSession = newSessions;

    }

    /**

     * Create a new read cipher and return it to caller.

     */

    CipherBox newReadCipher() throws NoSuchAlgorithmException {

        BulkCipher cipher = cipherSuite.cipher;

        CipherBox box;

        if (isClient) {

            box = cipher.newCipher(protocolVersion, svrWriteKey, svrWriteIV,

                                   false);

            svrWriteKey = null;

            svrWriteIV = null;

        } else {

            box = cipher.newCipher(protocolVersion, clntWriteKey, clntWriteIV,

                                   false);

            clntWriteKey = null;

            clntWriteIV = null;

        }

        return box;

    }

    /**

     * Create a new write cipher and return it to caller.

     */

    CipherBox newWriteCipher() throws NoSuchAlgorithmException {

        BulkCipher cipher = cipherSuite.cipher;

        CipherBox box;

        if (isClient) {

            box = cipher.newCipher(protocolVersion, clntWriteKey, clntWriteIV,

                                   true);

            clntWriteKey = null;

            clntWriteIV = null;

        } else {

            box = cipher.newCipher(protocolVersion, svrWriteKey, svrWriteIV,

                                   true);

            svrWriteKey = null;

            svrWriteIV = null;

        }

        return box;

    }

    /**

     * Create a new read MAC and return it to caller.

     */

    MAC newReadMAC() throws NoSuchAlgorithmException, InvalidKeyException {

        MacAlg macAlg = cipherSuite.macAlg;

        MAC mac;

        if (isClient) {

            mac = macAlg.newMac(protocolVersion, svrMacSecret);

            svrMacSecret = null;

        } else {

            mac = macAlg.newMac(protocolVersion, clntMacSecret);

            clntMacSecret = null;

        }

        return mac;

    }

    /**

     * Create a new write MAC and return it to caller.

     */

    MAC newWriteMAC() throws NoSuchAlgorithmException, InvalidKeyException {

        MacAlg macAlg = cipherSuite.macAlg;

        MAC mac;

        if (isClient) {

            mac = macAlg.newMac(protocolVersion, clntMacSecret);

            clntMacSecret = null;

        } else {

            mac = macAlg.newMac(protocolVersion, svrMacSecret);

            svrMacSecret = null;

        }

        return mac;

    }

    /*

     * Returns true iff the handshake sequence is done, so that

     * this freshly created session can become the current one.

     */

    boolean isDone() {

        return state == HandshakeMessage.ht_finished;

    }

    /*

     * Returns the session which was created through this

     * handshake sequence ... should be called after isDone()

     * returns true.

     */

    SSLSessionImpl getSession() {

        return session;

    }

    /*

     * This routine is fed SSL handshake records when they become available,

     * and processes messages found therein.

     */

    void process_record(InputRecord r, boolean expectingFinished)

            throws IOException {

        checkThrown();

        /*

         * Store the incoming handshake data, then see if we can

         * now process any completed handshake messages

         */

        input.incomingRecord(r);

        /*

         * We don't need to create a separate delegatable task

         * for finished messages.

         */

        if ((conn != null) || expectingFinished) {

            processLoop();

        } else {

            delegateTask(new PrivilegedExceptionAction<Void>() {

                public Void run() throws Exception {

                    processLoop();

                    return null;

                }

            });

        }

    }

    /*

     * On input, we hash messages one at a time since servers may need

     * to access an intermediate hash to validate a CertificateVerify

     * message.

     *

     * Note that many handshake messages can come in one record (and often

     * do, to reduce network resource utilization), and one message can also

     * require multiple records (e.g. very large Certificate messages).

     */

    void processLoop() throws IOException {

        while (input.available() > 0) {

            byte messageType;

            int messageLen;

            /*

             * See if we can read the handshake message header, and

             * then the entire handshake message.  If not, wait till

             * we can read and process an entire message.

             */

            input.mark(4);

            messageType = (byte)input.getInt8();

            messageLen = input.getInt24();

            if (input.available() < messageLen) {

                input.reset();

                return;

            }

            /*

             * Process the messsage.  We require

             * that processMessage() consumes the entire message.  In

             * lieu of explicit error checks (how?!) we assume that the

             * data will look like garbage on encoding/processing errors,

             * and that other protocol code will detect such errors.

             *

             * Note that digesting is normally deferred till after the

             * message has been processed, though to process at least the

             * client's Finished message (i.e. send the server's) we need

             * to acccelerate that digesting.

             *

             * Also, note that hello request messages are never hashed;

             * that includes the hello request header, too.

             */

            if (messageType == HandshakeMessage.ht_hello_request) {

                input.reset();

                processMessage(messageType, messageLen);