1 /*

     2  * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.*;

    29 import java.math.BigInteger;

    30 import java.security.*;

    31 import java.security.interfaces.*;

    32 import java.security.spec.*;

    33 import java.security.cert.*;

    34 import java.security.cert.Certificate;

    35 import java.util.*;

    36 import java.util.concurrent.ConcurrentHashMap;

    37 

    38 import java.lang.reflect.*;

    39 

    40 import javax.security.auth.x500.X500Principal;

    41 

    42 import javax.crypto.KeyGenerator;

    43 import javax.crypto.SecretKey;

    44 import javax.crypto.spec.DHPublicKeySpec;

    45 

    46 import javax.net.ssl.*;

    47 

    48 import sun.security.internal.spec.TlsPrfParameterSpec;

    49 import sun.security.ssl.CipherSuite.*;

    50 import static sun.security.ssl.CipherSuite.PRF.*;

    51 import sun.security.util.KeyUtil;

    52 import sun.security.util.MessageDigestSpi2;

    53 import sun.security.provider.certpath.OCSPResponse;

    54 

    55 /**

    56  * Many data structures are involved in the handshake messages.  These

    57  * classes are used as structures, with public data members.  They are

    58  * not visible outside the SSL package.

    59  *

    60  * Handshake messages all have a common header format, and they are all

    61  * encoded in a "handshake data" SSL record substream.  The base class

    62  * here (HandshakeMessage) provides a common framework and records the

    63  * SSL record type of the particular handshake message.

    64  *

    65  * This file contains subclasses for all the basic handshake messages.

    66  * All handshake messages know how to encode and decode themselves on

    67  * SSL streams; this facilitates using the same code on SSL client and

    68  * server sides, although they don't send and receive the same messages.

    69  *

    70  * Messages also know how to print themselves, which is quite handy

    71  * for debugging.  They always identify their type, and can optionally

    72  * dump all of their content.

    73  *

    74  * @author David Brownell

    75  */

    76 public abstract class HandshakeMessage {

    77 

    78     /* Class and subclass dynamic debugging support */

    79     public static final Debug debug = Debug.getInstance("ssl");

    80 

    81     // enum HandshakeType:

    82     //

    83     // Please update the isUnsupported() method accordingly if the handshake

    84     // types get updated in the future.

    85     static final byte   ht_hello_request          = 0;      // RFC 5246

    86     static final byte   ht_client_hello           = 1;      // RFC 5246

    87     static final byte   ht_server_hello           = 2;      // RFC 5246

    88     static final byte   ht_hello_verify_request   = 3;      // RFC 6347

    89     static final byte   ht_new_session_ticket     = 4;      // RFC 4507

    90 

    91     static final byte   ht_certificate            = 11;     // RFC 5246

    92     static final byte   ht_server_key_exchange    = 12;     // RFC 5246

    93     static final byte   ht_certificate_request    = 13;     // RFC 5246

    94     static final byte   ht_server_hello_done      = 14;     // RFC 5246

    95     static final byte   ht_certificate_verify     = 15;     // RFC 5246

    96     static final byte   ht_client_key_exchange    = 16;     // RFC 5246

    97 

    98     static final byte   ht_finished               = 20;     // RFC 5246

    99     static final byte   ht_certificate_url        = 21;     // RFC 6066

   100     static final byte   ht_certificate_status     = 22;     // RFC 6066

   101     static final byte   ht_supplemental_data      = 23;     // RFC 4680

   102 

   103     static final byte   ht_not_applicable         = -1;     // N/A

   104 

   105     /*

   106      * SSL 3.0 MAC padding constants.

   107      * Also used by CertificateVerify and Finished during the handshake.

   108      */

   109     static final byte[] MD5_pad1 = genPad(0x36, 48);

   110     static final byte[] MD5_pad2 = genPad(0x5c, 48);

   111 

   112     static final byte[] SHA_pad1 = genPad(0x36, 40);

   113     static final byte[] SHA_pad2 = genPad(0x5c, 40);

   114 

   115     // default constructor

   116     HandshakeMessage() {

   117     }

   118 

   119     /**

   120      * Utility method to convert a BigInteger to a byte array in unsigned

   121      * format as needed in the handshake messages. BigInteger uses

   122      * 2's complement format, i.e. it prepends an extra zero if the MSB

   123      * is set. We remove that.

   124      */

   125     static byte[] toByteArray(BigInteger bi) {

   126         byte[] b = bi.toByteArray();

   127         if ((b.length > 1) && (b[0] == 0)) {

   128             int n = b.length - 1;

   129             byte[] newarray = new byte[n];

   130             System.arraycopy(b, 1, newarray, 0, n);

   131             b = newarray;

   132         }

   133         return b;

   134     }

   135 

   136     static boolean isUnsupported(byte handshakeType) {

   137         return (handshakeType != ht_hello_request) &&

   138                (handshakeType != ht_client_hello) &&

   139                (handshakeType != ht_server_hello) &&

   140                (handshakeType != ht_hello_verify_request) &&

   141                (handshakeType != ht_new_session_ticket) &&

   142                (handshakeType != ht_certificate) &&

   143                (handshakeType != ht_server_key_exchange) &&

   144                (handshakeType != ht_certificate_request) &&

   145                (handshakeType != ht_server_hello_done) &&

   146                (handshakeType != ht_certificate_verify) &&

   147                (handshakeType != ht_client_key_exchange) &&

   148                (handshakeType != ht_finished) &&

   149                (handshakeType != ht_certificate_url) &&

   150                (handshakeType != ht_certificate_status) &&

   151                (handshakeType != ht_supplemental_data);

   152     }

   153 

   154     private static byte[] genPad(int b, int count) {

   155         byte[] padding = new byte[count];

   156         Arrays.fill(padding, (byte)b);

   157         return padding;

   158     }

   159 

   160     /*

   161      * Write a handshake message on the (handshake) output stream.

   162      * This is just a four byte header followed by the data.

   163      *

   164      * NOTE that huge messages -- notably, ones with huge cert

   165      * chains -- are handled correctly.

   166      */

   167     final void write(HandshakeOutStream s) throws IOException {

   168         int len = messageLength();

   169         if (len >= Record.OVERFLOW_OF_INT24) {

   170             throw new SSLException("Handshake message too big"

   171                 + ", type = " + messageType() + ", len = " + len);

   172         }

   173         s.write(messageType());

   174         s.putInt24(len);

   175         send(s);

   176         s.complete();

   177     }

   178 

   179     /*

   180      * Subclasses implement these methods so those kinds of

   181      * messages can be emitted.  Base class delegates to subclass.

   182      */

   183     abstract int  messageType();

   184     abstract int  messageLength();

   185     abstract void send(HandshakeOutStream s) throws IOException;

   186 

   187     /*

   188      * Write a descriptive message on the output stream; for debugging.

   189      */

   190     abstract void print(PrintStream p) throws IOException;

   191 

   192 //

   193 // NOTE:  the rest of these classes are nested within this one, and are

   194 // imported by other classes in this package.  There are a few other

   195 // handshake message classes, not neatly nested here because of current

   196 // licensing requirement for native (RSA) methods.  They belong here,

   197 // but those native methods complicate things a lot!

   198 //

   199 

   200 

   201 /*

   202  * HelloRequest ... SERVER --> CLIENT

   203  *

   204  * Server can ask the client to initiate a new handshake, e.g. to change

   205  * session parameters after a connection has been (re)established.

   206  */

   207 static final class HelloRequest extends HandshakeMessage {

   208     @Override

   209     int messageType() { return ht_hello_request; }

   210 

   211     HelloRequest() { }

   212 

   213     HelloRequest(HandshakeInStream in) throws IOException

   214     {

   215         // nothing in this message

   216     }

   217 

   218     @Override

   219     int messageLength() { return 0; }

   220 

   221     @Override

   222     void send(HandshakeOutStream out) throws IOException

   223     {

   224         // nothing in this messaage

   225     }

   226 

   227     @Override

   228     void print(PrintStream out) throws IOException

   229     {

   230         out.println("*** HelloRequest (empty)");

   231     }

   232 

   233 }

   234 

   235 /*

   236  * HelloVerifyRequest ... SERVER --> CLIENT  [DTLS only]

   237  *

   238  * The definition of HelloVerifyRequest is as follows:

   239  *

   240  *     struct {

   241  *       ProtocolVersion server_version;

   242  *       opaque cookie<0..2^8-1>;

   243  *     } HelloVerifyRequest;

   244  *

   245  * For DTLS protocols, once the client has transmitted the ClientHello message,

   246  * it expects to see a HelloVerifyRequest from the server.  However, if the

   247  * server's message is lost, the client knows that either the ClientHello or

   248  * the HelloVerifyRequest has been lost and retransmits. [RFC 6347]

   249  */

   250 static final class HelloVerifyRequest extends HandshakeMessage {

   251     ProtocolVersion     protocolVersion;

   252     byte[]              cookie;         // 1 to 2^8 - 1 bytes

   253 

   254     HelloVerifyRequest(HelloCookieManager helloCookieManager,

   255             ClientHello clientHelloMsg) {

   256 

   257         this.protocolVersion = clientHelloMsg.protocolVersion;

   258         this.cookie = helloCookieManager.getCookie(clientHelloMsg);

   259     }

   260 

   261     HelloVerifyRequest(

   262             HandshakeInStream input, int messageLength) throws IOException {

   263 

   264         this.protocolVersion =

   265                 ProtocolVersion.valueOf(input.getInt8(), input.getInt8());

   266         this.cookie = input.getBytes8();

   267 

   268         // Is it a valid cookie?

   269         HelloCookieManager.checkCookie(protocolVersion, cookie);

   270     }

   271 

   272     @Override

   273     int messageType() {

   274         return ht_hello_verify_request;

   275     }

   276 

   277     @Override

   278     int messageLength() {

   279         return 2 + cookie.length;       // 2: the length of protocolVersion

   280     }

   281 

   282     @Override

   283     void send(HandshakeOutStream hos) throws IOException {

   284         hos.putInt8(protocolVersion.major);

   285         hos.putInt8(protocolVersion.minor);

   286         hos.putBytes8(cookie);

   287     }

   288 

   289     @Override

   290     void print(PrintStream out) throws IOException {

   291         out.println("*** HelloVerifyRequest");

   292         if (debug != null && Debug.isOn("verbose")) {

   293             out.println("server_version: " + protocolVersion);

   294             Debug.println(out, "cookie", cookie);

   295         }

   296     }

   297 }

   298 

   299 /*

   300  * ClientHello ... CLIENT --> SERVER

   301  *

   302  * Client initiates handshake by telling server what it wants, and what it

   303  * can support (prioritized by what's first in the ciphe suite list).

   304  *

   305  * By RFC2246:7.4.1.2 it's explicitly anticipated that this message

   306  * will have more data added at the end ... e.g. what CAs the client trusts.

   307  * Until we know how to parse it, we will just read what we know

   308  * about, and let our caller handle the jumps over unknown data.

   309  */

   310 static final class ClientHello extends HandshakeMessage {

   311 

   312     ProtocolVersion             protocolVersion;

   313     RandomCookie                clnt_random;

   314     SessionId                   sessionId;

   315     byte[]                      cookie;                     // DTLS only

   316     private CipherSuiteList     cipherSuites;

   317     private final boolean       isDTLS;

   318     byte[]                      compression_methods;

   319 

   320     HelloExtensions extensions = new HelloExtensions();

   321 

   322     private static final byte[]  NULL_COMPRESSION = new byte[] {0};

   323 

   324     ClientHello(SecureRandom generator, ProtocolVersion protocolVersion,

   325             SessionId sessionId, CipherSuiteList cipherSuites,

   326             boolean isDTLS) {

   327 

   328         this.isDTLS = isDTLS;

   329         this.protocolVersion = protocolVersion;

   330         this.sessionId = sessionId;

   331         this.cipherSuites = cipherSuites;

   332         if (isDTLS) {

   333             this.cookie = new byte[0];

   334         } else {

   335             this.cookie = null;

   336         }

   337 

   338         clnt_random = new RandomCookie(generator);

   339         compression_methods = NULL_COMPRESSION;

   340     }

   341 

   342     ClientHello(HandshakeInStream s,

   343             int messageLength, boolean isDTLS) throws IOException {

   344 

   345         this.isDTLS = isDTLS;

   346 

   347         protocolVersion = ProtocolVersion.valueOf(s.getInt8(), s.getInt8());

   348         clnt_random = new RandomCookie(s);

   349         sessionId = new SessionId(s.getBytes8());

   350         sessionId.checkLength(protocolVersion);

   351         if (isDTLS) {

   352             cookie = s.getBytes8();

   353         } else {

   354             cookie = null;

   355         }

   356 

   357         cipherSuites = new CipherSuiteList(s);

   358         compression_methods = s.getBytes8();

   359         if (messageLength() != messageLength) {

   360             extensions = new HelloExtensions(s);

   361         }

   362     }

   363 

   364     CipherSuiteList getCipherSuites() {

   365         return cipherSuites;

   366     }

   367 

   368     // add renegotiation_info extension

   369     void addRenegotiationInfoExtension(byte[] clientVerifyData) {

   370         HelloExtension renegotiationInfo = new RenegotiationInfoExtension(

   371                     clientVerifyData, new byte[0]);

   372         extensions.add(renegotiationInfo);

   373     }

   374 

   375     // add server_name extension

   376     void addSNIExtension(List<SNIServerName> serverNames) {

   377         try {

   378             extensions.add(new ServerNameExtension(serverNames));

   379         } catch (IOException ioe) {

   380             // ignore the exception and return

   381         }

   382     }

   383 

   384     // add signature_algorithm extension

   385     void addSignatureAlgorithmsExtension(

   386             Collection<SignatureAndHashAlgorithm> algorithms) {

   387         HelloExtension signatureAlgorithm =

   388                 new SignatureAlgorithmsExtension(algorithms);

   389         extensions.add(signatureAlgorithm);

   390     }

   391 

   392     void addExtendedMasterSecretExtension() {

   393         extensions.add(new ExtendedMasterSecretExtension());

   394     }

   395 

   396     void addMFLExtension(int maximumPacketSize) {

   397         HelloExtension maxFragmentLength =

   398                 new MaxFragmentLengthExtension(maximumPacketSize);

   399         extensions.add(maxFragmentLength);

   400     }

   401 

   402     void updateHelloCookie(MessageDigest cookieDigest) {

   403         //

   404         // Just use HandshakeOutStream to compute the hello verify cookie.

   405         // Not actually used to output handshake message records.

   406         //

   407         HandshakeOutStream hos = new HandshakeOutStream(null);

   408 

   409         try {

   410             send(hos, false);    // Do not count hello verify cookie.

   411         } catch (IOException ioe) {

   412             // unlikely to happen

   413         }

   414 

   415         cookieDigest.update(hos.toByteArray());

   416     }

   417 

   418     // Add status_request extension type

   419     void addCertStatusRequestExtension() {

   420         extensions.add(new CertStatusReqExtension(StatusRequestType.OCSP,

   421                 new OCSPStatusRequest()));

   422     }

   423 

   424     // Add status_request_v2 extension type

   425     void addCertStatusReqListV2Extension() {

   426         // Create a default OCSPStatusRequest that we can use for both

   427         // OCSP_MULTI and OCSP request list items.

   428         OCSPStatusRequest osr = new OCSPStatusRequest();

   429         List<CertStatusReqItemV2> itemList = new ArrayList<>(2);

   430         itemList.add(new CertStatusReqItemV2(StatusRequestType.OCSP_MULTI,

   431                 osr));

   432         itemList.add(new CertStatusReqItemV2(StatusRequestType.OCSP, osr));

   433         extensions.add(new CertStatusReqListV2Extension(itemList));

   434     }

   435 

   436     // add application_layer_protocol_negotiation extension

   437     void addALPNExtension(String[] applicationProtocols) throws SSLException {

   438         extensions.add(new ALPNExtension(applicationProtocols));

   439     }

   440 

   441     @Override

   442     int messageType() { return ht_client_hello; }

   443 

   444     @Override

   445     int messageLength() {

   446         /*

   447          * Add fixed size parts of each field...

   448          * version + random + session + cipher + compress

   449          */

   450         return (2 + 32 + 1 + 2 + 1

   451             + sessionId.length()                /* ... + variable parts */

   452             + (isDTLS ? (1 + cookie.length) : 0)

   453             + (cipherSuites.size() * 2)

   454             + compression_methods.length)

   455             + extensions.length();

   456     }

   457 

   458     @Override

   459     void send(HandshakeOutStream s) throws IOException {

   460         send(s, true);  // Count hello verify cookie.

   461     }

   462 

   463     @Override

   464     void print(PrintStream s) throws IOException {

   465         s.println("*** ClientHello, " + protocolVersion);

   466 

   467         if (debug != null && Debug.isOn("verbose")) {

   468             s.print("RandomCookie:  ");

   469             clnt_random.print(s);

   470 

   471             s.print("Session ID:  ");

   472             s.println(sessionId);

   473 

   474             if (isDTLS) {

   475                 Debug.println(s, "cookie", cookie);

   476             }

   477 

   478             s.println("Cipher Suites: " + cipherSuites);

   479 

   480             Debug.println(s, "Compression Methods", compression_methods);

   481             extensions.print(s);

   482             s.println("***");

   483         }

   484     }

   485 

   486     private void send(HandshakeOutStream s,

   487             boolean computeCookie) throws IOException {

   488         s.putInt8(protocolVersion.major);

   489         s.putInt8(protocolVersion.minor);

   490         clnt_random.send(s);

   491         s.putBytes8(sessionId.getId());

   492         if (isDTLS && computeCookie) {

   493             s.putBytes8(cookie);

   494         }

   495         cipherSuites.send(s);

   496         s.putBytes8(compression_methods);

   497         extensions.send(s);

   498     }

   499 

   500 }

   501 

   502 /*

   503  * ServerHello ... SERVER --> CLIENT

   504  *

   505  * Server chooses protocol options from among those it supports and the

   506  * client supports.  Then it sends the basic session descriptive parameters

   507  * back to the client.

   508  */

   509 static final

   510 class ServerHello extends HandshakeMessage

   511 {

   512     @Override

   513     int messageType() { return ht_server_hello; }

   514 

   515     ProtocolVersion     protocolVersion;

   516     RandomCookie        svr_random;

   517     SessionId           sessionId;

   518     CipherSuite         cipherSuite;

   519     byte                compression_method;

   520     HelloExtensions extensions = new HelloExtensions();

   521 

   522     ServerHello() {

   523         // empty

   524     }

   525 

   526     ServerHello(HandshakeInStream input, int messageLength)

   527             throws IOException {

   528         protocolVersion = ProtocolVersion.valueOf(input.getInt8(),

   529                                                   input.getInt8());

   530         svr_random = new RandomCookie(input);

   531         sessionId = new SessionId(input.getBytes8());

   532         sessionId.checkLength(protocolVersion);

   533         cipherSuite = CipherSuite.valueOf(input.getInt8(), input.getInt8());

   534         compression_method = (byte)input.getInt8();

   535         if (messageLength() != messageLength) {

   536             extensions = new HelloExtensions(input);

   537         }

   538     }

   539 

   540     @Override

   541     int messageLength()

   542     {

   543         // almost fixed size, except session ID and extensions:

   544         //      major + minor = 2

   545         //      random = 32

   546         //      session ID len field = 1

   547         //      cipher suite + compression = 3

   548         //      extensions: if present, 2 + length of extensions

   549         return 38 + sessionId.length() + extensions.length();

   550     }

   551 

   552     @Override

   553     void send(HandshakeOutStream s) throws IOException

   554     {

   555         s.putInt8(protocolVersion.major);

   556         s.putInt8(protocolVersion.minor);

   557         svr_random.send(s);

   558         s.putBytes8(sessionId.getId());

   559         s.putInt8(cipherSuite.id >> 8);

   560         s.putInt8(cipherSuite.id & 0xff);

   561         s.putInt8(compression_method);

   562         extensions.send(s);

   563     }

   564 

   565     @Override

   566     void print(PrintStream s) throws IOException

   567     {

   568         s.println("*** ServerHello, " + protocolVersion);

   569 

   570         if (debug != null && Debug.isOn("verbose")) {

   571             s.print("RandomCookie:  ");

   572             svr_random.print(s);

   573 

   574             s.print("Session ID:  ");

   575             s.println(sessionId);

   576 

   577             s.println("Cipher Suite: " + cipherSuite);

   578             s.println("Compression Method: " + compression_method);

   579             extensions.print(s);

   580             s.println("***");

   581         }

   582     }

   583 }

   584 

   585 

   586 /*

   587  * CertificateMsg ... send by both CLIENT and SERVER

   588  *

   589  * Each end of a connection may need to pass its certificate chain to

   590  * the other end.  Such chains are intended to validate an identity with

   591  * reference to some certifying authority.  Examples include companies

   592  * like Verisign, or financial institutions.  There's some control over

   593  * the certifying authorities which are sent.

   594  *

   595  * NOTE: that these messages might be huge, taking many handshake records.

   596  * Up to 2^48 bytes of certificate may be sent, in records of at most 2^14

   597  * bytes each ... up to 2^32 records sent on the output stream.

   598  */

   599 static final

   600 class CertificateMsg extends HandshakeMessage

   601 {

   602     @Override

   603     int messageType() { return ht_certificate; }

   604 

   605     private X509Certificate[] chain;

   606 

   607     private List<byte[]> encodedChain;

   608 

   609     private int messageLength;

   610 

   611     CertificateMsg(X509Certificate[] certs) {

   612         chain = certs;

   613     }

   614 

   615     CertificateMsg(HandshakeInStream input) throws IOException {

   616         int chainLen = input.getInt24();

   617         List<Certificate> v = new ArrayList<>(4);

   618 

   619         CertificateFactory cf = null;

   620         while (chainLen > 0) {

   621             byte[] cert = input.getBytes24();

   622             chainLen -= (3 + cert.length);

   623             try {

   624                 if (cf == null) {

   625                     cf = CertificateFactory.getInstance("X.509");

   626                 }

   627                 v.add(cf.generateCertificate(new ByteArrayInputStream(cert)));

   628             } catch (CertificateException e) {

   629                 throw (SSLProtocolException)new SSLProtocolException(

   630                     e.getMessage()).initCause(e);

   631             }

   632         }

   633 

   634         chain = v.toArray(new X509Certificate[v.size()]);

   635     }

   636 

   637     @Override

   638     int messageLength() {

   639         if (encodedChain == null) {

   640             messageLength = 3;

   641             encodedChain = new ArrayList<byte[]>(chain.length);

   642             try {

   643                 for (X509Certificate cert : chain) {

   644                     byte[] b = cert.getEncoded();

   645                     encodedChain.add(b);

   646                     messageLength += b.length + 3;

   647                 }

   648             } catch (CertificateEncodingException e) {

   649                 encodedChain = null;

   650                 throw new RuntimeException("Could not encode certificates", e);

   651             }

   652         }

   653         return messageLength;

   654     }

   655 

   656     @Override

   657     void send(HandshakeOutStream s) throws IOException {

   658         s.putInt24(messageLength() - 3);

   659         for (byte[] b : encodedChain) {

   660             s.putBytes24(b);

   661         }

   662     }

   663 

   664     @Override

   665     void print(PrintStream s) throws IOException {

   666         s.println("*** Certificate chain");

   667 

   668         if (chain.length == 0) {

   669             s.println("<Empty>");

   670         } else if (debug != null && Debug.isOn("verbose")) {

   671             for (int i = 0; i < chain.length; i++) {

   672                 s.println("chain [" + i + "] = " + chain[i]);

   673             }

   674         }

   675         s.println("***");

   676     }

   677 

   678     X509Certificate[] getCertificateChain() {

   679         return chain.clone();

   680     }

   681 }

   682 

   683 /*

   684  * CertificateStatus ... SERVER --> CLIENT

   685  *

   686  * When a ClientHello asserting the status_request or status_request_v2

   687  * extensions is accepted by the server, it will fetch and return one

   688  * or more status responses in this handshake message.

   689  *

   690  * NOTE: Like the Certificate handshake message, this can potentially

   691  * be a very large message both due to the size of multiple status

   692  * responses and the certificate chains that are often attached to them.

   693  * Up to 2^24 bytes of status responses may be sent, possibly fragmented

   694  * over multiple TLS records.

   695  */

   696 static final class CertificateStatus extends HandshakeMessage

   697 {

   698     private final StatusRequestType statusType;

   699     private int encodedResponsesLen;

   700     private int messageLength = -1;

   701     private List<byte[]> encodedResponses;

   702 

   703     @Override

   704     int messageType() { return ht_certificate_status; }

   705 

   706     /**

   707      * Create a CertificateStatus message from the certificates and their

   708      * respective OCSP responses

   709      *

   710      * @param type an indication of the type of response (OCSP or OCSP_MULTI)

   711      * @param responses a {@code List} of OCSP responses in DER-encoded form.

   712      *      For the OCSP type, only the first entry in the response list is

   713      *      used, and must correspond to the end-entity certificate sent to the

   714      *      peer.  Zero-length or null values for the response data are not

   715      *      allowed for the OCSP type.  For the OCSP_MULTI type, each entry in

   716      *      the list should match its corresponding certificate sent in the

   717      *      Server Certificate message.  Where an OCSP response does not exist,

   718      *      either a zero-length array or a null value should be used.

   719      *

   720      * @throws SSLException if an unsupported StatusRequestType or invalid

   721      *      OCSP response data is provided.

   722      */

   723     CertificateStatus(StatusRequestType type, X509Certificate[] chain,

   724             Map<X509Certificate, byte[]> responses) {

   725         statusType = type;

   726         encodedResponsesLen = 0;

   727         encodedResponses = new ArrayList<>(chain.length);

   728 

   729         Objects.requireNonNull(chain, "Null chain not allowed");

   730         Objects.requireNonNull(responses, "Null responses not allowed");

   731 

   732         if (statusType == StatusRequestType.OCSP) {

   733             // Just get the response for the end-entity certificate

   734             byte[] respDER = responses.get(chain[0]);

   735             if (respDER != null && respDER.length > 0) {

   736                 encodedResponses.add(respDER);

   737                 encodedResponsesLen = 3 + respDER.length;

   738             } else {

   739                 throw new IllegalArgumentException("Zero-length or null " +

   740                         "OCSP Response");

   741             }

   742         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   743             for (X509Certificate cert : chain) {

   744                 byte[] respDER = responses.get(cert);

   745                 if (respDER != null) {

   746                     encodedResponses.add(respDER);

   747                     encodedResponsesLen += (respDER.length + 3);

   748                 } else {

   749                     // If we cannot find a response for a given certificate

   750                     // then use a zero-length placeholder.

   751                     encodedResponses.add(new byte[0]);

   752                     encodedResponsesLen += 3;

   753                 }

   754             }

   755         } else {

   756             throw new IllegalArgumentException(

   757                     "Unsupported StatusResponseType: " + statusType);

   758         }

   759     }

   760 

   761     /**

   762      * Decode the CertificateStatus handshake message coming from a

   763      * {@code HandshakeInputStream}.

   764      *

   765      * @param input the {@code HandshakeInputStream} containing the

   766      * CertificateStatus message bytes.

   767      *

   768      * @throws SSLHandshakeException if a zero-length response is found in the

   769      * OCSP response type, or an unsupported response type is detected.

   770      * @throws IOException if a decoding error occurs.

   771      */

   772     CertificateStatus(HandshakeInStream input) throws IOException {

   773         encodedResponsesLen = 0;

   774         encodedResponses = new ArrayList<>();

   775 

   776         statusType = StatusRequestType.get(input.getInt8());

   777         if (statusType == StatusRequestType.OCSP) {

   778             byte[] respDER = input.getBytes24();

   779             // Convert the incoming bytes to a OCSPResponse strucutre

   780             if (respDER.length > 0) {

   781                 encodedResponses.add(respDER);

   782                 encodedResponsesLen = 3 + respDER.length;

   783             } else {

   784                 throw new SSLHandshakeException("Zero-length OCSP Response");

   785             }

   786         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   787             int respListLen = input.getInt24();

   788             encodedResponsesLen = respListLen;

   789 

   790             // Add each OCSP reponse into the array list in the order

   791             // we receive them off the wire.  A zero-length array is

   792             // allowed for ocsp_multi, and means that a response for

   793             // a given certificate is not available.

   794             while (respListLen > 0) {

   795                 byte[] respDER = input.getBytes24();

   796                 encodedResponses.add(respDER);

   797                 respListLen -= (respDER.length + 3);

   798             }

   799 

   800             if (respListLen != 0) {

   801                 throw new SSLHandshakeException(

   802                         "Bad OCSP response list length");

   803             }

   804         } else {

   805             throw new SSLHandshakeException("Unsupported StatusResponseType: " +

   806                     statusType);

   807         }

   808     }

   809 

   810     /**

   811      * Get the length of the CertificateStatus message.

   812      *

   813      * @return the length of the message in bytes.

   814      */

   815     @Override

   816     int messageLength() {

   817         int len = 1;            // Length + Status type

   818 

   819         if (messageLength == -1) {

   820             if (statusType == StatusRequestType.OCSP) {

   821                 len += encodedResponsesLen;

   822             } else if (statusType == StatusRequestType.OCSP_MULTI) {

   823                 len += 3 + encodedResponsesLen;

   824             }

   825             messageLength = len;

   826         }

   827 

   828         return messageLength;

   829     }

   830 

   831     /**

   832      * Encode the CertificateStatus handshake message and place it on a

   833      * {@code HandshakeOutputStream}.

   834      *

   835      * @param s the HandshakeOutputStream that will the message bytes.

   836      *

   837      * @throws IOException if an encoding error occurs.

   838      */

   839     @Override

   840     void send(HandshakeOutStream s) throws IOException {

   841         s.putInt8(statusType.id);

   842         if (statusType == StatusRequestType.OCSP) {

   843             s.putBytes24(encodedResponses.get(0));

   844         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   845             s.putInt24(encodedResponsesLen);

   846             for (byte[] respBytes : encodedResponses) {

   847                 if (respBytes != null) {

   848                     s.putBytes24(respBytes);

   849                 } else {

   850                     s.putBytes24(null);

   851                 }

   852             }

   853         } else {

   854             // It is highly unlikely that we will fall into this section of

   855             // the code.

   856             throw new SSLHandshakeException("Unsupported status_type: " +

   857                     statusType.id);

   858         }

   859     }

   860 

   861     /**

   862      * Display a human-readable representation of the CertificateStatus message.

   863      *

   864      * @param s the PrintStream used to display the message data.

   865      *

   866      * @throws IOException if any errors occur while parsing the OCSP response

   867      * bytes into a readable form.

   868      */

   869     @Override

   870     void print(PrintStream s) throws IOException {

   871         s.println("*** CertificateStatus");

   872         if (debug != null && Debug.isOn("verbose")) {

   873             s.println("Type: " + statusType);

   874             if (statusType == StatusRequestType.OCSP) {

   875                 OCSPResponse oResp = new OCSPResponse(encodedResponses.get(0));

   876                 s.println(oResp);

   877             } else if (statusType == StatusRequestType.OCSP_MULTI) {

   878                 int numResponses = encodedResponses.size();

   879                 s.println(numResponses +

   880                         (numResponses == 1 ? " entry:" : " entries:"));

   881                 for (byte[] respDER : encodedResponses) {

   882                     if (respDER.length > 0) {

   883                         OCSPResponse oResp = new OCSPResponse(respDER);

   884                         s.println(oResp);

   885                     } else {

   886                         s.println("<Zero-length entry>");

   887                     }

   888                 }

   889             }

   890         }

   891     }

   892 

   893     /**

   894      * Get the type of CertificateStatus message

   895      *

   896      * @return the {@code StatusRequestType} for this CertificateStatus

   897      *      message.

   898      */

   899     StatusRequestType getType() {

   900         return statusType;

   901     }

   902 

   903     /**

   904      * Get the list of non-zero length OCSP responses.

   905      * The responses returned in this list can be used to map to

   906      * {@code X509Certificate} objects provided by the peer and

   907      * provided to a {@code PKIXRevocationChecker}.

   908      *

   909      * @return an unmodifiable List of zero or more byte arrays, each one

   910      *      consisting of a single status response.

   911      */

   912     List<byte[]> getResponses() {

   913         return Collections.unmodifiableList(encodedResponses);

   914     }

   915 }

   916 

   917 /*

   918  * ServerKeyExchange ... SERVER --> CLIENT

   919  *

   920  * The cipher suite selected, when combined with the certificate exchanged,

   921  * implies one of several different kinds of key exchange.  Most current

   922  * cipher suites require the server to send more than its certificate.

   923  *

   924  * The primary exceptions are when a server sends an encryption-capable

   925  * RSA public key in its cert, to be used with RSA (or RSA_export) key

   926  * exchange; and when a server sends its Diffie-Hellman cert.  Those kinds

   927  * of key exchange do not require a ServerKeyExchange message.

   928  *

   929  * Key exchange can be viewed as having three modes, which are explicit

   930  * for the Diffie-Hellman flavors and poorly specified for RSA ones:

   931  *

   932  *      - "Ephemeral" keys.  Here, a "temporary" key is allocated by the

   933  *        server, and signed.  Diffie-Hellman keys signed using RSA or

   934  *        DSS are ephemeral (DHE flavor).  RSA keys get used to do the same

   935  *        thing, to cut the key size down to 512 bits (export restrictions)

   936  *        or for signing-only RSA certificates.

   937  *

   938  *      - Anonymity.  Here no server certificate is sent, only the public

   939  *        key of the server.  This case is subject to man-in-the-middle

   940  *        attacks.  This can be done with Diffie-Hellman keys (DH_anon) or

   941  *        with RSA keys, but is only used in SSLv3 for DH_anon.

   942  *

   943  *      - "Normal" case.  Here a server certificate is sent, and the public

   944  *        key there is used directly in exchanging the premaster secret.

   945  *        For example, Diffie-Hellman "DH" flavor, and any RSA flavor with

   946  *        only 512 bit keys.

   947  *

   948  * If a server certificate is sent, there is no anonymity.  However,

   949  * when a certificate is sent, ephemeral keys may still be used to

   950  * exchange the premaster secret.  That's how RSA_EXPORT often works,

   951  * as well as how the DHE_* flavors work.

   952  */

   953 abstract static class ServerKeyExchange extends HandshakeMessage

   954 {

   955     @Override

   956     int messageType() { return ht_server_key_exchange; }

   957 }

   958 

   959 

   960 /*

   961  * Using RSA for Key Exchange:  exchange a session key that's not as big

   962  * as the signing-only key.  Used for export applications, since exported

   963  * RSA encryption keys can't be bigger than 512 bytes.

   964  *

   965  * This is never used when keys are 512 bits or smaller, and isn't used

   966  * on "US Domestic" ciphers in any case.

   967  */

   968 static final

   969 class RSA_ServerKeyExchange extends ServerKeyExchange

   970 {

   971     private byte[] rsa_modulus;     // 1 to 2^16 - 1 bytes

   972     private byte[] rsa_exponent;    // 1 to 2^16 - 1 bytes

   973 

   974     private Signature signature;

   975     private byte[] signatureBytes;

   976 

   977     /*

   978      * Hash the nonces and the ephemeral RSA public key.

   979      */

   980     private void updateSignature(byte[] clntNonce, byte[] svrNonce)

   981             throws SignatureException {

   982         int tmp;

   983 

   984         signature.update(clntNonce);

   985         signature.update(svrNonce);

   986 

   987         tmp = rsa_modulus.length;

   988         signature.update((byte)(tmp >> 8));

   989         signature.update((byte)(tmp & 0x0ff));

   990         signature.update(rsa_modulus);

   991 

   992         tmp = rsa_exponent.length;

   993         signature.update((byte)(tmp >> 8));

   994         signature.update((byte)(tmp & 0x0ff));

   995         signature.update(rsa_exponent);

   996     }

   997 

   998 

   999     /*

  1000      * Construct an RSA server key exchange message, using data

  1001      * known _only_ to the server.

  1002      *

  1003      * The client knows the public key corresponding to this private

  1004      * key, from the Certificate message sent previously.  To comply

  1005      * with US export regulations we use short RSA keys ... either

  1006      * long term ones in the server's X509 cert, or else ephemeral

  1007      * ones sent using this message.

  1008      */

  1009     RSA_ServerKeyExchange(PublicKey ephemeralKey, PrivateKey privateKey,

  1010             RandomCookie clntNonce, RandomCookie svrNonce, SecureRandom sr)

  1011             throws GeneralSecurityException {

  1012         RSAPublicKeySpec rsaKey = JsseJce.getRSAPublicKeySpec(ephemeralKey);

  1013         rsa_modulus = toByteArray(rsaKey.getModulus());

  1014         rsa_exponent = toByteArray(rsaKey.getPublicExponent());

  1015         signature = RSASignature.getInstance();

  1016         signature.initSign(privateKey, sr);

  1017         updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);

  1018         signatureBytes = signature.sign();

  1019     }

  1020 

  1021 

  1022     /*

  1023      * Parse an RSA server key exchange message, using data known

  1024      * to the client (and, in some situations, eavesdroppers).

  1025      */

  1026     RSA_ServerKeyExchange(HandshakeInStream input)

  1027             throws IOException, NoSuchAlgorithmException {

  1028         signature = RSASignature.getInstance();

  1029         rsa_modulus = input.getBytes16();

  1030         rsa_exponent = input.getBytes16();

  1031         signatureBytes = input.getBytes16();

  1032     }

  1033 

  1034     /*

  1035      * Get the ephemeral RSA public key that will be used in this

  1036      * SSL connection.

  1037      */

  1038     PublicKey getPublicKey() {

  1039         try {

  1040             KeyFactory kfac = JsseJce.getKeyFactory("RSA");

  1041             // modulus and exponent are always positive

  1042             RSAPublicKeySpec kspec = new RSAPublicKeySpec(

  1043                 new BigInteger(1, rsa_modulus),

  1044                 new BigInteger(1, rsa_exponent));

  1045             return kfac.generatePublic(kspec);

  1046         } catch (Exception e) {

  1047             throw new RuntimeException(e);

  1048         }

  1049     }

  1050 

  1051     /*

  1052      * Verify the signed temporary key using the hashes computed

  1053      * from it and the two nonces.  This is called by clients

  1054      * with "exportable" RSA flavors.

  1055      */

  1056     boolean verify(PublicKey certifiedKey, RandomCookie clntNonce,

  1057             RandomCookie svrNonce) throws GeneralSecurityException {

  1058         signature.initVerify(certifiedKey);

  1059         updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);

  1060         return signature.verify(signatureBytes);

  1061     }

  1062 

  1063     @Override

  1064     int messageLength() {

  1065         return 6 + rsa_modulus.length + rsa_exponent.length

  1066                + signatureBytes.length;

  1067     }

  1068 

  1069     @Override

  1070     void send(HandshakeOutStream s) throws IOException {

  1071         s.putBytes16(rsa_modulus);

  1072         s.putBytes16(rsa_exponent);

  1073         s.putBytes16(signatureBytes);

  1074     }

  1075 

  1076     @Override

  1077     void print(PrintStream s) throws IOException {

  1078         s.println("*** RSA ServerKeyExchange");

  1079 

  1080         if (debug != null && Debug.isOn("verbose")) {

  1081             Debug.println(s, "RSA Modulus", rsa_modulus);

  1082             Debug.println(s, "RSA Public Exponent", rsa_exponent);

  1083         }

  1084     }

  1085 }

  1086 

  1087 

  1088 /*

  1089  * Using Diffie-Hellman algorithm for key exchange.  All we really need to

  1090  * do is securely get Diffie-Hellman keys (using the same P, G parameters)

  1091  * to our peer, then we automatically have a shared secret without need

  1092  * to exchange any more data.  (D-H only solutions, such as SKIP, could

  1093  * eliminate key exchange negotiations and get faster connection setup.

  1094  * But they still need a signature algorithm like DSS/DSA to support the

  1095  * trusted distribution of keys without relying on unscalable physical

  1096  * key distribution systems.)

  1097  *

  1098  * This class supports several DH-based key exchange algorithms, though

  1099  * perhaps eventually each deserves its own class.  Notably, this has

  1100  * basic support for DH_anon and its DHE_DSS and DHE_RSA signed variants.

  1101  */

  1102 static final

  1103 class DH_ServerKeyExchange extends ServerKeyExchange

  1104 {

  1105     // Fix message encoding, see 4348279

  1106     private static final boolean dhKeyExchangeFix =

  1107         Debug.getBooleanProperty("com.sun.net.ssl.dhKeyExchangeFix", true);

  1108 

  1109     private byte[]                dh_p;        // 1 to 2^16 - 1 bytes

  1110     private byte[]                dh_g;        // 1 to 2^16 - 1 bytes

  1111     private byte[]                dh_Ys;       // 1 to 2^16 - 1 bytes

  1112 

  1113     private byte[]                signature;

  1114 

  1115     // protocol version being established using this ServerKeyExchange message

  1116     ProtocolVersion protocolVersion;

  1117 

  1118     // the preferable signature algorithm used by this ServerKeyExchange message

  1119     private SignatureAndHashAlgorithm preferableSignatureAlgorithm;

  1120 

  1121     /*

  1122      * Construct from initialized DH key object, for DH_anon

  1123      * key exchange.

  1124      */

  1125     DH_ServerKeyExchange(DHCrypt obj, ProtocolVersion protocolVersion) {

  1126         this.protocolVersion = protocolVersion;

  1127         this.preferableSignatureAlgorithm = null;

  1128 

  1129         // The DH key has been validated in the constructor of DHCrypt.

  1130         setValues(obj);

  1131         signature = null;

  1132     }

  1133 

  1134     /*