/*

 * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.*;

import java.math.BigInteger;

import java.security.*;

import java.util.*;

import java.security.interfaces.ECPublicKey;

import java.security.interfaces.RSAPublicKey;

import java.security.spec.ECParameterSpec;

import java.security.cert.X509Certificate;

import java.security.cert.CertificateException;

import java.security.cert.CertificateParsingException;

import java.security.cert.CertPathValidatorException;

import java.security.cert.CertPathValidatorException.Reason;

import java.security.cert.CertPathValidatorException.BasicReason;

import javax.security.auth.x500.X500Principal;

import javax.crypto.SecretKey;

import javax.net.ssl.*;

import sun.security.ssl.HandshakeMessage.*;

import static sun.security.ssl.CipherSuite.KeyExchange.*;

/**

 * ClientHandshaker does the protocol handshaking from the point

 * of view of a client.  It is driven asychronously by handshake messages

 * as delivered by the parent Handshaker class, and also uses

 * common functionality (e.g. key generation) that is provided there.

 *

 * @author David Brownell

 */

final class ClientHandshaker extends Handshaker {

    // constants for subject alt names of type DNS and IP

    private static final int ALTNAME_DNS = 2;

    private static final int ALTNAME_IP  = 7;

    // the server's public key from its certificate.

    private PublicKey serverKey;

    // the server's ephemeral public key from the server key exchange message

    // for ECDHE/ECDH_anon and RSA_EXPORT.

    private PublicKey ephemeralServerKey;

    // server's ephemeral public value for DHE/DH_anon key exchanges

    private BigInteger          serverDH;

    private DHCrypt             dh;

    private ECDHCrypt ecdh;

    private CertificateRequest  certRequest;

    private boolean serverKeyExchangeReceived;

    private boolean staplingActive = false;

    private X509Certificate[] deferredCerts;

    /*

     * The RSA PreMasterSecret needs to know the version of

     * ClientHello that was used on this handshake.  This represents

     * the "max version" this client is supporting.  In the

     * case of an initial handshake, it's the max version enabled,

     * but in the case of a resumption attempt, it's the version

     * of the session we're trying to resume.

     */

    private ProtocolVersion maxProtocolVersion;

    // To switch off the SNI extension.

    private static final boolean enableSNIExtension =

            Debug.getBooleanProperty("jsse.enableSNIExtension", true);

    /*

     * Allow unsafe server certificate change?

     *

     * Server certificate change during SSL/TLS renegotiation may be considered

     * unsafe, as described in the Triple Handshake attacks:

     *

     *     https://secure-resumption.com/tlsauth.pdf

     *

     * Endpoint identification (See

     * SSLParameters.getEndpointIdentificationAlgorithm()) is a pretty nice

     * guarantee that the server certificate change in renegotiation is legal.

     * However, endpoing identification is only enabled for HTTPS and LDAP

     * over SSL/TLS by default.  It is not enough to protect SSL/TLS

     * connections other than HTTPS and LDAP.

     *

     * The renegotiation indication extension (See RFC 5764) is a pretty

     * strong guarantee that the endpoints on both client and server sides

     * are identical on the same connection.  However, the Triple Handshake

     * attacks can bypass this guarantee if there is a session-resumption

     * handshake between the initial full handshake and the renegotiation

     * full handshake.

     *

     * Server certificate change may be unsafe and should be restricted if

     * endpoint identification is not enabled and the previous handshake is

     * a session-resumption abbreviated initial handshake, unless the

     * identities represented by both certificates can be regraded as the

     * same (See isIdentityEquivalent()).

     *

     * Considering the compatibility impact and the actual requirements to

     * support server certificate change in practice, the system property,

     * jdk.tls.allowUnsafeServerCertChange, is used to define whether unsafe

     * server certificate change in renegotiation is allowed or not.  The

     * default value of the system property is "false".  To mitigate the

     * compactibility impact, applications may want to set the system

     * property to "true" at their own risk.

     *

     * If the value of the system property is "false", server certificate

     * change in renegotiation after a session-resumption abbreviated initial

     * handshake is restricted (See isIdentityEquivalent()).

     *

     * If the system property is set to "true" explicitly, the restriction on

     * server certificate change in renegotiation is disabled.

     */

    private static final boolean allowUnsafeServerCertChange =

        Debug.getBooleanProperty("jdk.tls.allowUnsafeServerCertChange", false);

    // To switch off the max_fragment_length extension.

    private static final boolean enableMFLExtension =

            Debug.getBooleanProperty("jsse.enableMFLExtension", false);

    // Whether an ALPN extension was sent in the ClientHello

    private boolean alpnActive = false;

    private List<SNIServerName> requestedServerNames =

            Collections.<SNIServerName>emptyList();

    // maximum fragment length

    private int requestedMFLength = -1;     // -1: no fragment length limit

    private boolean serverNamesAccepted = false;

    private ClientHello initialClientHelloMsg = null;   // DTLS only

    /*

     * the reserved server certificate chain in previous handshaking

     *

     * The server certificate chain is only reserved if the previous

     * handshake is a session-resumption abbreviated initial handshake.

     */

    private X509Certificate[] reservedServerCerts = null;

    /*

     * Constructors

     */

    ClientHandshaker(SSLSocketImpl socket, SSLContextImpl context,

            ProtocolList enabledProtocols,

            ProtocolVersion activeProtocolVersion,

            boolean isInitialHandshake, boolean secureRenegotiation,

            byte[] clientVerifyData, byte[] serverVerifyData) {

        super(socket, context, enabledProtocols, true, true,

            activeProtocolVersion, isInitialHandshake, secureRenegotiation,

            clientVerifyData, serverVerifyData);

    }

    ClientHandshaker(SSLEngineImpl engine, SSLContextImpl context,

            ProtocolList enabledProtocols,

            ProtocolVersion activeProtocolVersion,

            boolean isInitialHandshake, boolean secureRenegotiation,

            byte[] clientVerifyData, byte[] serverVerifyData,

            boolean isDTLS) {

        super(engine, context, enabledProtocols, true, true,

            activeProtocolVersion, isInitialHandshake, secureRenegotiation,

            clientVerifyData, serverVerifyData, isDTLS);

    }

    /*

     * This routine handles all the client side handshake messages, one at

     * a time.  Given the message type (and in some cases the pending cipher

     * spec) it parses the type-specific message.  Then it calls a function

     * that handles that specific message.

     *

     * It updates the state machine (need to verify it) as each message

     * is processed, and writes responses as needed using the connection

     * in the constructor.

     */

    @Override

    void processMessage(byte type, int messageLen) throws IOException {

        // check the handshake state

        List<Byte> ignoredOptStates = handshakeState.check(type);

        // If the state machine has skipped over certificate status

        // and stapling was enabled, we need to check the chain immediately

        // because it was deferred, waiting for CertificateStatus.

        if (staplingActive && ignoredOptStates.contains(

                HandshakeMessage.ht_certificate_status)) {

            checkServerCerts(deferredCerts);

            serverKey = session.getPeerCertificates()[0].getPublicKey();

        }

        switch (type) {

        case HandshakeMessage.ht_hello_request:

            HelloRequest helloRequest = new HelloRequest(input);

            handshakeState.update(helloRequest, resumingSession);

            this.serverHelloRequest(helloRequest);

            break;

        case HandshakeMessage.ht_hello_verify_request:

            if (!isDTLS) {

                throw new SSLProtocolException(

                    "hello_verify_request is not a SSL/TLS handshake message");

            }

            HelloVerifyRequest helloVerifyRequest =

                        new HelloVerifyRequest(input, messageLen);

            handshakeState.update(helloVerifyRequest, resumingSession);

            this.helloVerifyRequest(helloVerifyRequest);

            break;

        case HandshakeMessage.ht_server_hello:

            ServerHello serverHello = new ServerHello(input, messageLen);

            this.serverHello(serverHello);

            // This handshake state update needs the resumingSession value

            // set by serverHello().

            handshakeState.update(serverHello, resumingSession);

            break;

        case HandshakeMessage.ht_certificate:

            if (keyExchange == K_DH_ANON || keyExchange == K_ECDH_ANON

                    || ClientKeyExchangeService.find(keyExchange.name) != null) {

                // No external key exchange provider needs a cert now.

                fatalSE(Alerts.alert_unexpected_message,

                    "unexpected server cert chain");

                // NOTREACHED

            }

            CertificateMsg certificateMsg = new CertificateMsg(input);

            handshakeState.update(certificateMsg, resumingSession);

            this.serverCertificate(certificateMsg);

            if (!staplingActive) {

                // If we are not doing stapling, we can set serverKey right

                // away.  Otherwise, we will wait until verification of the

                // chain has completed after CertificateStatus;

                serverKey = session.getPeerCertificates()[0].getPublicKey();

            }

            break;

        case HandshakeMessage.ht_certificate_status:

            CertificateStatus certStatusMsg = new CertificateStatus(input);

            handshakeState.update(certStatusMsg, resumingSession);

            this.certificateStatus(certStatusMsg);

            serverKey = session.getPeerCertificates()[0].getPublicKey();

            break;

        case HandshakeMessage.ht_server_key_exchange:

            serverKeyExchangeReceived = true;

            switch (keyExchange) {

            case K_RSA_EXPORT:

                /**

                 * The server key exchange message is sent by the server only

                 * when the server certificate message does not contain the

                 * proper amount of data to allow the client to exchange a

                 * premaster secret, such as when RSA_EXPORT is used and the

                 * public key in the server certificate is longer than 512 bits.

                 */

                if (serverKey == null) {

                    throw new SSLProtocolException

                        ("Server did not send certificate message");

                }

                if (!(serverKey instanceof RSAPublicKey)) {

                    throw new SSLProtocolException("Protocol violation:" +

                        " the certificate type must be appropriate for the" +

                        " selected cipher suite's key exchange algorithm");

                }

                if (JsseJce.getRSAKeyLength(serverKey) <= 512) {

                    throw new SSLProtocolException("Protocol violation:" +

                        " server sent a server key exchange message for" +

                        " key exchange " + keyExchange +

                        " when the public key in the server certificate" +

                        " is less than or equal to 512 bits in length");

                }

                try {

                    RSA_ServerKeyExchange rsaSrvKeyExchange =

                                    new RSA_ServerKeyExchange(input);

                    handshakeState.update(rsaSrvKeyExchange, resumingSession);

                    this.serverKeyExchange(rsaSrvKeyExchange);

                } catch (GeneralSecurityException e) {

                    throw new SSLException("Server key", e);

                }

                break;

            case K_DH_ANON:

                try {

                    DH_ServerKeyExchange dhSrvKeyExchange =

                            new DH_ServerKeyExchange(input, protocolVersion);

                    handshakeState.update(dhSrvKeyExchange, resumingSession);

                    this.serverKeyExchange(dhSrvKeyExchange);

                } catch (GeneralSecurityException e) {

                    throw new SSLException("Server key", e);

                }

                break;

            case K_DHE_DSS:

            case K_DHE_RSA:

                try {

                    DH_ServerKeyExchange dhSrvKeyExchange =

                        new DH_ServerKeyExchange(

                            input, serverKey,

                            clnt_random.random_bytes, svr_random.random_bytes,

                            messageLen,

                            getLocalSupportedSignAlgs(), protocolVersion);

                    handshakeState.update(dhSrvKeyExchange, resumingSession);

                    this.serverKeyExchange(dhSrvKeyExchange);

                } catch (GeneralSecurityException e) {

                    throw new SSLException("Server key", e);

                }

                break;

            case K_ECDHE_ECDSA:

            case K_ECDHE_RSA:

            case K_ECDH_ANON:

                try {

                    ECDH_ServerKeyExchange ecdhSrvKeyExchange =

                        new ECDH_ServerKeyExchange

                            (input, serverKey, clnt_random.random_bytes,

                            svr_random.random_bytes,

                            getLocalSupportedSignAlgs(), protocolVersion);

                    handshakeState.update(ecdhSrvKeyExchange, resumingSession);

                    this.serverKeyExchange(ecdhSrvKeyExchange);

                } catch (GeneralSecurityException e) {

                    throw new SSLException("Server key", e);

                }

                break;

            case K_RSA:

            case K_DH_RSA:

            case K_DH_DSS:

            case K_ECDH_ECDSA:

            case K_ECDH_RSA:

                throw new SSLProtocolException(

                    "Protocol violation: server sent a server key exchange"

                    + " message for key exchange " + keyExchange);

            default:

                throw new SSLProtocolException(

                    "unsupported or unexpected key exchange algorithm = "

                    + keyExchange);

            }

            break;

        case HandshakeMessage.ht_certificate_request:

            // save for later, it's handled by serverHelloDone

            if ((keyExchange == K_DH_ANON) || (keyExchange == K_ECDH_ANON)) {

                throw new SSLHandshakeException(

                    "Client authentication requested for "+

                    "anonymous cipher suite.");

            } else if (ClientKeyExchangeService.find(keyExchange.name) != null) {

                // No external key exchange provider needs a cert now.

                throw new SSLHandshakeException(

                    "Client certificate requested for "+

                    "external cipher suite: " + keyExchange);

            }

            certRequest = new CertificateRequest(input, protocolVersion);

            if (debug != null && Debug.isOn("handshake")) {

                certRequest.print(System.out);

            }

            handshakeState.update(certRequest, resumingSession);

            if (protocolVersion.useTLS12PlusSpec()) {

                Collection<SignatureAndHashAlgorithm> peerSignAlgs =

                                        certRequest.getSignAlgorithms();

                if (peerSignAlgs == null || peerSignAlgs.isEmpty()) {

                    throw new SSLHandshakeException(

                        "No peer supported signature algorithms");

                }

                Collection<SignatureAndHashAlgorithm> supportedPeerSignAlgs =

                    SignatureAndHashAlgorithm.getSupportedAlgorithms(

                            algorithmConstraints, peerSignAlgs);

                if (supportedPeerSignAlgs.isEmpty()) {

                    throw new SSLHandshakeException(

                        "No supported signature and hash algorithm in common");

                }

                setPeerSupportedSignAlgs(supportedPeerSignAlgs);

                session.setPeerSupportedSignatureAlgorithms(

                                                supportedPeerSignAlgs);

            }

            break;

        case HandshakeMessage.ht_server_hello_done:

            ServerHelloDone serverHelloDone = new ServerHelloDone(input);

            handshakeState.update(serverHelloDone, resumingSession);

            this.serverHelloDone(serverHelloDone);

            break;

        case HandshakeMessage.ht_finished:

            Finished serverFinished =

                    new Finished(protocolVersion, input, cipherSuite);

            handshakeState.update(serverFinished, resumingSession);

            this.serverFinished(serverFinished);

            break;

        default:

            throw new SSLProtocolException(

                "Illegal client handshake msg, " + type);

        }

    }

    /*

     * Used by the server to kickstart negotiations -- this requests a

     * "client hello" to renegotiate current cipher specs (e.g. maybe lots

     * of data has been encrypted with the same keys, or the server needs

     * the client to present a certificate).

     */

    private void serverHelloRequest(HelloRequest mesg) throws IOException {

        if (debug != null && Debug.isOn("handshake")) {

            mesg.print(System.out);

        }

        //

        // Could be (e.g. at connection setup) that we already

        // sent the "client hello" but the server's not seen it.

        //

        if (!clientHelloDelivered) {

            if (!secureRenegotiation && !allowUnsafeRenegotiation) {

                // renegotiation is not allowed.

                if (activeProtocolVersion.useTLS10PlusSpec()) {

                    // response with a no_renegotiation warning,

                    warningSE(Alerts.alert_no_renegotiation);

                    // invalidate the handshake so that the caller can

                    // dispose this object.

                    invalidated = true;

                    // If there is still unread block in the handshake

                    // input stream, it would be truncated with the disposal

                    // and the next handshake message will become incomplete.

                    //

                    // However, according to SSL/TLS specifications, no more

                    // handshake message should immediately follow ClientHello

                    // or HelloRequest. So just let it be.

                } else {

                    // For SSLv3, send the handshake_failure fatal error.

                    // Note that SSLv3 does not define a no_renegotiation

                    // alert like TLSv1. However we cannot ignore the message

                    // simply, otherwise the other side was waiting for a

                    // response that would never come.

                    fatalSE(Alerts.alert_handshake_failure,

                        "Renegotiation is not allowed");

                }

            } else {

                if (!secureRenegotiation) {

                    if (debug != null && Debug.isOn("handshake")) {

                        System.out.println(

                            "Warning: continue with insecure renegotiation");

                    }

                }

                kickstart();

            }

        }

    }

    private void helloVerifyRequest(

            HelloVerifyRequest mesg) throws IOException {

        if (debug != null && Debug.isOn("handshake")) {

            mesg.print(System.out);

        }

        //

        // Note that HelloVerifyRequest.server_version is used solely to

        // indicate packet formatting, and not as part of version negotiation.

        // Need not to check version values match for HelloVerifyRequest

        // message.

        //

        initialClientHelloMsg.cookie = mesg.cookie.clone();