2  * Copyright (c) 2003, 2016, Oracle and/or its affiliates. All rights reserved.

     2  * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.

    28 import java.io.*;

    28 import java.io.IOException;

    29 import java.nio.*;

    29 import java.nio.ByteBuffer;

    30 import java.security.*;

    30 import java.nio.ReadOnlyBufferException;

    31 import java.util.*;

    31 import java.security.AccessController;

    32 import java.security.PrivilegedActionException;

    33 import java.security.PrivilegedExceptionAction;

    34 import java.util.List;

    35 import java.util.Map;

    33 

    37 import javax.net.ssl.SSLEngine;

    34 import javax.crypto.BadPaddingException;

    38 import javax.net.ssl.SSLEngineResult;

    35 

    39 import javax.net.ssl.SSLEngineResult.HandshakeStatus;

    36 import javax.net.ssl.*;

    40 import javax.net.ssl.SSLEngineResult.Status;

    37 import javax.net.ssl.SSLEngineResult.*;

    41 import javax.net.ssl.SSLException;

    42 import javax.net.ssl.SSLHandshakeException;

    43 import javax.net.ssl.SSLKeyException;

    44 import javax.net.ssl.SSLParameters;

    45 import javax.net.ssl.SSLPeerUnverifiedException;

    46 import javax.net.ssl.SSLProtocolException;

    47 import javax.net.ssl.SSLSession;

    60 public final class SSLEngineImpl extends SSLEngine {

    54 final class SSLEngineImpl extends SSLEngine implements SSLTransport {

    61 

    55     private final SSLContextImpl        sslContext;

    62     //

    56     final TransportContext              conContext;

    63     // Fields and global comments

    64     //

    65 

    66     /*

    67      * There's a state machine associated with each connection, which

    68      * among other roles serves to negotiate session changes.

    69      *

    70      * - START with constructor, until the TCP connection's around.

    71      * - HANDSHAKE picks session parameters before allowing traffic.

    72      *          There are many substates due to sequencing requirements

    73      *          for handshake messages.

    74      * - DATA may be transmitted.

    75      * - RENEGOTIATE state allows concurrent data and handshaking

    76      *          traffic ("same" substates as HANDSHAKE), and terminates

    77      *          in selection of new session (and connection) parameters

    78      * - ERROR state immediately precedes abortive disconnect.

    79      * - CLOSED when one side closes down, used to start the shutdown

    80      *          process.  SSL connection objects are not reused.

    81      *

    82      * State affects what SSL record types may legally be sent:

    83      *

    84      * - Handshake ... only in HANDSHAKE and RENEGOTIATE states

    85      * - App Data ... only in DATA and RENEGOTIATE states

    86      * - Alert ... in HANDSHAKE, DATA, RENEGOTIATE

    87      *

    88      * Re what may be received:  same as what may be sent, except that

    89      * HandshakeRequest handshaking messages can come from servers even

    90      * in the application data state, to request entry to RENEGOTIATE.

    91      *

    92      * The state machine within HANDSHAKE and RENEGOTIATE states controls

    93      * the pending session, not the connection state, until the change

    94      * cipher spec and "Finished" handshake messages are processed and

    95      * make the "new" session become the current one.

    96      *

    97      * NOTE: details of the SMs always need to be nailed down better.

    98      * The text above illustrates the core ideas.

    99      *

   100      *                +---->-------+------>--------->-------+

   101      *                |            |                        |

   102      *     <-----<    ^            ^  <-----<               |

   103      *START>----->HANDSHAKE>----->DATA>----->RENEGOTIATE    |

   104      *                v            v               v        |

   105      *                |            |               |        |

   106      *                +------------+---------------+        |

   107      *                |                                     |

   108      *                v                                     |

   109      *               ERROR>------>----->CLOSED<--------<----+

   110      *

   111      * ALSO, note that the purpose of handshaking (renegotiation is

   112      * included) is to assign a different, and perhaps new, session to

   113      * the connection.  The SSLv3 spec is a bit confusing on that new

   114      * protocol feature.

   115      */

   116     private int                 connectionState;

   117 

   118     private static final int    cs_START = 0;

   119     private static final int    cs_HANDSHAKE = 1;

   120     private static final int    cs_DATA = 2;

   121     private static final int    cs_RENEGOTIATE = 3;

   122     private static final int    cs_ERROR = 4;

   123     private static final int    cs_CLOSED = 6;

   124 

   125     /*

   126      * Once we're in state cs_CLOSED, we can continue to

   127      * wrap/unwrap until we finish sending/receiving the messages

   128      * for close_notify.

   129      */

   130     private boolean             inboundDone = false;

   131     private boolean             outboundDone = false;

   132 

   133     /*

   134      * The authentication context holds all information used to establish

   135      * who this end of the connection is (certificate chains, private keys,

   136      * etc) and who is trusted (e.g. as CAs or websites).

   137      */

   138     private SSLContextImpl      sslContext;

   139 

   140     /*

   141      * This connection is one of (potentially) many associated with

   142      * any given session.  The output of the handshake protocol is a

   143      * new session ... although all the protocol description talks

   144      * about changing the cipher spec (and it does change), in fact

   145      * that's incidental since it's done by changing everything that

   146      * is associated with a session at the same time.  (TLS/IETF may

   147      * change that to add client authentication w/o new key exchg.)

   148      */

   149     private Handshaker                  handshaker;

   150     private SSLSessionImpl              sess;

   151     private volatile SSLSessionImpl     handshakeSession;

   152 

   153     /*

   154      * Flag indicating if the next record we receive MUST be a Finished

   155      * message. Temporarily set during the handshake to ensure that

   156      * a change cipher spec message is followed by a finished message.

   157      */

   158     private boolean             expectingFinished;

   159 

   160 

   161     /*

   162      * If someone tries to closeInbound() (say at End-Of-Stream)

   163      * our engine having received a close_notify, we need to

   164      * notify the app that we may have a truncation attack underway.

   165      */

   166     private boolean             recvCN;

   167 

   168     /*

   169      * For improved diagnostics, we detail connection closure

   170      * If the engine is closed (connectionState >= cs_ERROR),

   171      * closeReason != null indicates if the engine was closed

   172      * because of an error or because or normal shutdown.

   173      */

   174     private SSLException        closeReason;

   175 

   176     /*

   177      * Per-connection private state that doesn't change when the

   178      * session is changed.

   179      */

   180     private ClientAuthType          doClientAuth =

   181                                             ClientAuthType.CLIENT_AUTH_NONE;

   182     private boolean                 enableSessionCreation = true;

   183     InputRecord                     inputRecord;

   184     OutputRecord                    outputRecord;

   185     private AccessControlContext    acc;

   186 

   187     // The cipher suites enabled for use on this connection.

   188     private CipherSuiteList             enabledCipherSuites;

   189 

   190     // the endpoint identification protocol

   191     private String                      identificationProtocol = null;

   192 

   193     // The cryptographic algorithm constraints

   194     private AlgorithmConstraints        algorithmConstraints = null;

   195 

   196     // The server name indication and matchers

   197     List<SNIServerName>         serverNames =

   198                                     Collections.<SNIServerName>emptyList();

   199     Collection<SNIMatcher>      sniMatchers =

   200                                     Collections.<SNIMatcher>emptyList();

   201 

   202     // Configured application protocol values

   203     String[] applicationProtocols = new String[0];

   204 

   205     // Negotiated application protocol value.

   206     //

   207     // The value under negotiation will be obtained from handshaker.

   208     String applicationProtocol = null;

   209 

   210     // Callback function that selects the application protocol value during

   211     // the SSL/TLS handshake.

   212     BiFunction<SSLEngine, List<String>, String> applicationProtocolSelector;

   213 

   214     // Have we been told whether we're client or server?

   215     private boolean                     serverModeSet = false;

   216     private boolean                     roleIsServer;

   217 

   218     /*

   219      * The protocol versions enabled for use on this connection.

   220      *

   221      * Note: we support a pseudo protocol called SSLv2Hello which when

   222      * set will result in an SSL v2 Hello being sent with SSL (version 3.0)

   223      * or TLS (version 3.1, 3.2, etc.) version info.

   224      */

   225     private ProtocolList        enabledProtocols;

   226 

   227     /*

   228      * The SSL version associated with this connection.

   229      */

   230     private ProtocolVersion     protocolVersion;

   231 

   232     /*

   233      * security parameters for secure renegotiation.

   234      */

   235     private boolean             secureRenegotiation;

   236     private byte[]              clientVerifyData;

   237     private byte[]              serverVerifyData;

   238 

   239     /*

   240      * READ ME * READ ME * READ ME * READ ME * READ ME * READ ME *

   241      * IMPORTANT STUFF TO UNDERSTANDING THE SYNCHRONIZATION ISSUES.

   242      * READ ME * READ ME * READ ME * READ ME * READ ME * READ ME *

   243      *

   244      * There are several locks here.

   245      *

   246      * The primary lock is the per-instance lock used by

   247      * synchronized(this) and the synchronized methods.  It controls all

   248      * access to things such as the connection state and variables which

   249      * affect handshaking.  If we are inside a synchronized method, we

   250      * can access the state directly, otherwise, we must use the

   251      * synchronized equivalents.

   252      *

   253      * Note that we must never acquire the <code>this</code> lock after

   254      * <code>writeLock</code> or run the risk of deadlock.

   255      *

   256      * Grab some coffee, and be careful with any code changes.

   257      */

   258     private Object              wrapLock;

   259     private Object              unwrapLock;

   260     Object                      writeLock;

   261 

   262     /*

   263      * Whether local cipher suites preference in server side should be

   264      * honored during handshaking?

   265      */

   266     private boolean preferLocalCipherSuites = false;

   267 

   268     /*

   269      * whether DTLS handshake retransmissions should be enabled?

   270      */

   271     private boolean enableRetransmissions = false;

   272 

   273     /*

   274      * The maximum expected network packet size for SSL/TLS/DTLS records.

   275      */

   276     private int maximumPacketSize = 0;

   277 

   278     /*

   279      * Is this an instance for Datagram Transport Layer Security (DTLS)?

   280      */

   281     private final boolean isDTLS;

   282 

   283     /*

   284      * Class and subclass dynamic debugging support

   285      */

   286     private static final Debug debug = Debug.getInstance("ssl");

   287 

   288     //

   289     // Initialization/Constructors

   290     //

   294      * host/port hints.  This Engine will not be able to cache

    60      * host/port hints.

   295      * sessions, but must renegotiate everything by hand.

    61      *

    62      * This Engine will not be able to cache sessions, but must renegotiate

    63      * everything by hand.

   297     SSLEngineImpl(SSLContextImpl ctx, boolean isDTLS) {

    65     SSLEngineImpl(SSLContextImpl sslContext) {

   298         super();

    66         this(sslContext, null, -1);

   299         this.isDTLS = isDTLS;

   300         init(ctx, isDTLS);

   306     SSLEngineImpl(SSLContextImpl ctx, String host, int port, boolean isDTLS) {

    72     SSLEngineImpl(SSLContextImpl sslContext,

    73             String host, int port) {

   308         this.isDTLS = isDTLS;

    75         this.sslContext = sslContext;

   309         init(ctx, isDTLS);

    76         HandshakeHash handshakeHash = new HandshakeHash();

   310     }

    77         if (sslContext.isDTLS()) {

   311 

    78             this.conContext = new TransportContext(sslContext, this,

   312     /**

    79                     new DTLSInputRecord(handshakeHash),

   313      * Initializes the Engine

    80                     new DTLSOutputRecord(handshakeHash));

   314      */

   315     private void init(SSLContextImpl ctx, boolean isDTLS) {

   316         if (debug != null && Debug.isOn("ssl")) {

   317             System.out.println("Using SSLEngineImpl.");

   318         }

   319 

   320         sslContext = ctx;

   321         sess = SSLSessionImpl.nullSession;

   322         handshakeSession = null;

   323         protocolVersion = isDTLS ?

   324                 ProtocolVersion.DEFAULT_DTLS : ProtocolVersion.DEFAULT_TLS;

   325 

   326         /*

   327          * State is cs_START until we initialize the handshaker.

   328          *

   329          * Apps using SSLEngine are probably going to be server.

   330          * Somewhat arbitrary choice.

   331          */

   332         roleIsServer = true;

   333         connectionState = cs_START;

   334 

   335         // default server name indication

   336         serverNames =

   337             Utilities.addToSNIServerNameList(serverNames, getPeerHost());

   338 

   339         // default security parameters for secure renegotiation

   340         secureRenegotiation = false;

   341         clientVerifyData = new byte[0];

   342         serverVerifyData = new byte[0];

   343 

   344         enabledCipherSuites =

   345                 sslContext.getDefaultCipherSuiteList(roleIsServer);

   346         enabledProtocols =

   347                 sslContext.getDefaultProtocolList(roleIsServer);

   348 

   349         wrapLock = new Object();

   350         unwrapLock = new Object();

   351         writeLock = new Object();

   352 

   353         /*

   354          * Save the Access Control Context.  This will be used later

   355          * for a couple of things, including providing a context to

   356          * run tasks in, and for determining which credentials

   357          * to use for Subject based (JAAS) decisions

   358          */

   359         acc = AccessController.getContext();

   360 

   361         /*

   362          * All outbound application data goes through this OutputRecord,

   363          * other data goes through their respective records created

   364          * elsewhere.  All inbound data goes through this one

   365          * input record.

   366          */

   367         if (isDTLS) {

   368             enableRetransmissions = true;

   369 

   370             // SSLEngine needs no record local buffer

   371             outputRecord = new DTLSOutputRecord();

   372             inputRecord = new DTLSInputRecord();

   373 

   375             outputRecord = new SSLEngineOutputRecord();

    82             this.conContext = new TransportContext(sslContext, this,

   376             inputRecord = new SSLEngineInputRecord();

    83                     new SSLEngineInputRecord(handshakeHash),

   377         }

    84                     new SSLEngineOutputRecord(handshakeHash));

   378 

    85         }

   379         maximumPacketSize = outputRecord.getMaxPacketSize();

    86 

   380     }

    87         // Server name indication is a connection scope extension.

   381 

    88         if (host != null) {

   382     /**

    89             this.conContext.sslConfig.serverNames =

   383      * Initialize the handshaker object. This means:

    90                     Utilities.addToSNIServerNameList(

   384      *

    91                             conContext.sslConfig.serverNames, host);

   385      *  . if a handshake is already in progress (state is cs_HANDSHAKE

    92         }

   386      *    or cs_RENEGOTIATE), do nothing and return

    93     }

   387      *

    94 

   388      *  . if the engine is already closed, throw an Exception (internal error)

    95     @Override

   389      *

    96     public synchronized void beginHandshake() throws SSLException {

   390      *  . otherwise (cs_START or cs_DATA), create the appropriate handshaker

    97         if (conContext.isUnsureMode) {

   391      *    object and advance the connection state (to cs_HANDSHAKE or

    98             throw new IllegalStateException(

   392      *    cs_RENEGOTIATE, respectively).

    99                     "Client/Server mode has not yet been set.");

   393      *

   100         }

   394      * This method is called right after a new engine is created, when

   101 

   395      * starting renegotiation, or when changing client/server mode of the

   396      * engine.

   397      */

   398     private void initHandshaker() {

   399         switch (connectionState) {

   400 

   401         //

   402         // Starting a new handshake.

   403         //

   404         case cs_START:

   405         case cs_DATA:

   406             break;

   407 

   408         //

   409         // We're already in the middle of a handshake.

   410         //

   411         case cs_HANDSHAKE:

   412         case cs_RENEGOTIATE:

   413             return;

   414 

   415         //

   416         // Anyone allowed to call this routine is required to

   417         // do so ONLY if the connection state is reasonable...

   418         //

   419         default:

   420             throw new IllegalStateException("Internal error");

   421         }

   422 

   423         // state is either cs_START or cs_DATA

   424         if (connectionState == cs_START) {

   425             connectionState = cs_HANDSHAKE;

   426         } else { // cs_DATA

   427             connectionState = cs_RENEGOTIATE;

   428         }

   429 

   430         if (roleIsServer) {

   431             handshaker = new ServerHandshaker(this, sslContext,

   432                     enabledProtocols, doClientAuth,

   433                     protocolVersion, connectionState == cs_HANDSHAKE,

   434                     secureRenegotiation, clientVerifyData, serverVerifyData,

   435                     isDTLS);

   436             handshaker.setSNIMatchers(sniMatchers);

   437             handshaker.setUseCipherSuitesOrder(preferLocalCipherSuites);

   438         } else {

   439             handshaker = new ClientHandshaker(this, sslContext,

   440                     enabledProtocols,

   441                     protocolVersion, connectionState == cs_HANDSHAKE,

   442                     secureRenegotiation, clientVerifyData, serverVerifyData,

   443                     isDTLS);

   444             handshaker.setSNIServerNames(serverNames);

   445         }

   446         handshaker.setMaximumPacketSize(maximumPacketSize);

   447         handshaker.setEnabledCipherSuites(enabledCipherSuites);

   448         handshaker.setEnableSessionCreation(enableSessionCreation);

   449         handshaker.setApplicationProtocols(applicationProtocols);

   450         handshaker.setApplicationProtocolSelectorSSLEngine(

   451             applicationProtocolSelector);

   452 

   453         outputRecord.initHandshaker();

   454     }

   455 

   456     /*

   457      * Report the current status of the Handshaker

   458      */

   459     private HandshakeStatus getHSStatus(HandshakeStatus hss) {

   460 

   461         if (hss != null) {

   462             return hss;

   463         }

   464 

   465         synchronized (this) {

   466             if (!outputRecord.isEmpty()) {

   467                 // If no handshaking, special case to wrap alters.

   468                 return HandshakeStatus.NEED_WRAP;

   469             } else if (handshaker != null) {

   470                 if (handshaker.taskOutstanding()) {

   471                     return HandshakeStatus.NEED_TASK;

   472                 } else if (isDTLS && !inputRecord.isEmpty()) {

   473                     return HandshakeStatus.NEED_UNWRAP_AGAIN;

   474                 } else {

   475                     return HandshakeStatus.NEED_UNWRAP;

   476                 }

   477             } else if (connectionState == cs_CLOSED) {

   478                 /*

   479                  * Special case where we're closing, but

   480                  * still need the close_notify before we

   481                  * can officially be closed.

   482                  *

   483                  * Note isOutboundDone is taken care of by

   484                  * hasOutboundData() above.

   485                  */

   486                 if (!isInboundDone()) {

   487                     return HandshakeStatus.NEED_UNWRAP;

   488                 } // else not handshaking

   489             }

   490 

   491             return HandshakeStatus.NOT_HANDSHAKING;

   492         }

   493     }

   494 

   495     private synchronized void checkTaskThrown() throws SSLException {

   496         if (handshaker != null) {

   497             handshaker.checkThrown();

   498         }

   499     }

   500 

   501     //

   502     // Handshaking and connection state code

   503     //

   504 

   505     /*

   506      * Provides "this" synchronization for connection state.

   507      * Otherwise, you can access it directly.

   508      */

   509     private synchronized int getConnectionState() {

   510         return connectionState;

   511     }

   512 

   513     private synchronized void setConnectionState(int state) {

   514         connectionState = state;

   515     }

   516 

   517     /*

   518      * Get the Access Control Context.

   519      *

   520      * Used for a known context to

   521      * run tasks in, and for determining which credentials

   522      * to use for Subject-based (JAAS) decisions.

   523      */

   524     AccessControlContext getAcc() {

   525         return acc;

   526     }

   527 

   528     /*

   529      * Is a handshake currently underway?

   530      */

   531     @Override

   532     public SSLEngineResult.HandshakeStatus getHandshakeStatus() {

   533         return getHSStatus(null);

   534     }

   535 

   536     /*

   537      * used by Handshaker to change the active write cipher, follows

   538      * the output of the CCS message.

   539      *

   540      * Also synchronized on "this" from readRecord/delegatedTask.

   541      */

   542     void changeWriteCiphers() throws IOException {

   543 

   544         Authenticator writeAuthenticator;

   545         CipherBox writeCipher;

   547             writeCipher = handshaker.newWriteCipher();

   103             conContext.kickstart();

   548             writeAuthenticator = handshaker.newWriteAuthenticator();

   104         } catch (IOException ioe) {

   549         } catch (GeneralSecurityException e) {

   105             conContext.fatal(Alert.HANDSHAKE_FAILURE,

   550             // "can't happen"

   106                 "Couldn't kickstart handshaking", ioe);

   551             throw new SSLException("Algorithm missing:  ", e);

   107         } catch (Exception ex) {     // including RuntimeException

   552         }

   108             conContext.fatal(Alert.INTERNAL_ERROR,

   553 

   109                 "Fail to begin handshake", ex);

   554         outputRecord.changeWriteCiphers(writeAuthenticator, writeCipher);

   110         }

   555     }

   111     }

   556 

   112 

   557     /*

   113     @Override

   558      * Updates the SSL version associated with this connection.

   114     public synchronized SSLEngineResult wrap(ByteBuffer[] appData,

   559      * Called from Handshaker once it has determined the negotiated version.

   115             int offset, int length, ByteBuffer netData) throws SSLException {

   560      */

   116         return wrap(

   561     synchronized void setVersion(ProtocolVersion protocolVersion) {

   117                 appData, offset, length, new ByteBuffer[]{ netData }, 0, 1);

   562         this.protocolVersion = protocolVersion;

   118     }

   563         outputRecord.setVersion(protocolVersion);

   119 

   564     }

   120     // @Override

   565 

   121     public synchronized SSLEngineResult wrap(

   566 

   122         ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   567     /**

   123         ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws SSLException {

   568      * Kickstart the handshake if it is not already in progress.

   124 

   569      * This means:

   125         if (conContext.isUnsureMode) {

   570      *

   126             throw new IllegalStateException(

   571      *  . if handshaking is already underway, do nothing and return

   127                     "Client/Server mode has not yet been set.");

   572      *

   128         }

   573      *  . if the engine is not connected or already closed, throw an

   129 

   574      *    Exception.

   130         // See if the handshaker needs to report back some SSLException.

   575      *

   131         if (conContext.outputRecord.isEmpty()) {

   576      *  . otherwise, call initHandshake() to initialize the handshaker

   132             checkTaskThrown();

   577      *    object and progress the state. Then, send the initial

   133         }   // Otherwise, deliver cached records before throwing task exception.

   578      *    handshaking message if appropriate (always on clients and

   134 

   579      *    on servers when renegotiating).

   135         // check parameters

   580      */

   136         checkParams(srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);

   581     private synchronized void kickstartHandshake() throws IOException {

   137 

   582         switch (connectionState) {

   583 

   584         case cs_START:

   585             if (!serverModeSet) {

   586                 throw new IllegalStateException(

   587                     "Client/Server mode not yet set.");

   588             }

   589             initHandshaker();

   590             break;

   591 

   592         case cs_HANDSHAKE:

   593             // handshaker already setup, proceed

   594             break;

   595 

   596         case cs_DATA:

   597             if (!secureRenegotiation && !Handshaker.allowUnsafeRenegotiation) {

   598                 throw new SSLHandshakeException(

   599                         "Insecure renegotiation is not allowed");

   600             }

   601 

   602             if (!secureRenegotiation) {

   603                 if (debug != null && Debug.isOn("handshake")) {

   604                     System.out.println(

   605                         "Warning: Using insecure renegotiation");

   606                 }

   607             }

   608 

   609             // initialize the handshaker, move to cs_RENEGOTIATE

   610             initHandshaker();

   611             break;

   612 

   613         case cs_RENEGOTIATE:

   614             // handshaking already in progress, return

   615             return;

   616 

   617         default:

   618             // cs_ERROR/cs_CLOSED

   619             throw new SSLException("SSLEngine is closing/closed");

   620         }

   621 

   622         //

   623         // Kickstart handshake state machine if we need to ...

   624         //

   625         if (!handshaker.activated()) {

   626              // prior to handshaking, activate the handshake

   627             if (connectionState == cs_RENEGOTIATE) {

   628                 // don't use SSLv2Hello when renegotiating

   629                 handshaker.activate(protocolVersion);

   630             } else {

   631                 handshaker.activate(null);

   632             }

   633 

   634             if (handshaker instanceof ClientHandshaker) {

   635                 // send client hello

   636                 handshaker.kickstart();

   637             } else {    // instanceof ServerHandshaker

   638                 if (connectionState == cs_HANDSHAKE) {

   639                     // initial handshake, no kickstart message to send

   640                 } else {

   641                     // we want to renegotiate, send hello request

   642                     handshaker.kickstart();

   643                 }

   644             }

   645         }

   646     }

   647 

   648     /*

   649      * Start a SSLEngine handshake

   650      */

   651     @Override

   652     public void beginHandshake() throws SSLException {

   654             kickstartHandshake();

   139             return writeRecord(

   655         } catch (Exception e) {

   140                 srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);

   656             fatal(Alerts.alert_handshake_failure,

   657                 "Couldn't kickstart handshaking", e);

   658         }

   659     }

   660 

   661 

   662     //

   663     // Read/unwrap side

   664     //

   665 

   666 

   667     /**

   668      * Unwraps a buffer.  Does a variety of checks before grabbing

   669      * the unwrapLock, which blocks multiple unwraps from occurring.

   670      */

   671     @Override

   672     public SSLEngineResult unwrap(ByteBuffer netData, ByteBuffer[] appData,

   673             int offset, int length) throws SSLException {

   674 

   675         // check engine parameters

   676         checkEngineParas(netData, appData, offset, length, false);

   677 

   678         try {

   679             synchronized (unwrapLock) {

   680                 return readNetRecord(netData, appData, offset, length);

   681             }

   684             fatal(Alerts.alert_unexpected_message, spe.getMessage(), spe);

   143             conContext.fatal(Alert.UNEXPECTED_MESSAGE, spe);

   685             return null;  // make compiler happy

   144         } catch (IOException ioe) {

   686         } catch (Exception e) {

   145             conContext.fatal(Alert.INTERNAL_ERROR,

   146                 "problem wrapping app data", ioe);

   147         } catch (Exception ex) {     // including RuntimeException

   148             conContext.fatal(Alert.INTERNAL_ERROR,

   149                 "Fail to wrap application data", ex);

   150         }

   151 

   152         return null;    // make compiler happy

   153     }

   154 

   155     private SSLEngineResult writeRecord(

   156         ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   157         ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws IOException {

   158 

   159         if (isOutboundDone()) {

   160             return new SSLEngineResult(

   161                     Status.CLOSED, getHandshakeStatus(), 0, 0);

   162         }

   163 

   164         HandshakeContext hc = conContext.handshakeContext;

   165         HandshakeStatus hsStatus = null;

   166         if (!conContext.isNegotiated) {

   167             conContext.kickstart();

   168 

   169             hsStatus = getHandshakeStatus();

   170             if (hsStatus == HandshakeStatus.NEED_UNWRAP) {

   171                 /*

   172                  * For DTLS, if the handshake state is

   173                  * HandshakeStatus.NEED_UNWRAP, a call to SSLEngine.wrap()

   174                  * means that the previous handshake packets (if delivered)

   175                  * get lost, and need retransmit the handshake messages.

   176                  */

   177                 if (!sslContext.isDTLS() || hc == null ||

   178                         !hc.sslConfig.enableRetransmissions ||

   179                         conContext.outputRecord.firstMessage) {

   180 

   181                     return new SSLEngineResult(Status.OK, hsStatus, 0, 0);

   182                 }   // otherwise, need retransmission

   183             }

   184         }

   185 

   186         if (hsStatus == null) {

   187             hsStatus = getHandshakeStatus();

   188         }

   189 

   190         /*

   191          * If we have a task outstanding, this *MUST* be done before

   192          * doing any more wrapping, because we could be in the middle

   193          * of receiving a handshake message, for example, a finished

   194          * message which would change the ciphers.

   195          */

   196         if (hsStatus == HandshakeStatus.NEED_TASK) {

   197             return new SSLEngineResult(Status.OK, hsStatus, 0, 0);

   198         }

   199 

   200         int dstsRemains = 0;

   201         for (int i = dstsOffset; i < dstsOffset + dstsLength; i++) {

   202             dstsRemains += dsts[i].remaining();

   203         }

   204 

   205         // Check destination buffer size.

   206         //

   207         // We can be smarter about using smaller buffer sizes later.  For

   208         // now, force it to be large enough to handle any valid record.

   209         if (dstsRemains < conContext.conSession.getPacketBufferSize()) {

   210             return new SSLEngineResult(

   211                 Status.BUFFER_OVERFLOW, getHandshakeStatus(), 0, 0);

   212         }

   213 

   214         int srcsRemains = 0;

   215         for (int i = srcsOffset; i < srcsOffset + srcsLength; i++) {

   216             srcsRemains += srcs[i].remaining();

   217         }

   218 

   219         Ciphertext ciphertext = null;

   220         try {

   221             // Acquire the buffered to-be-delivered records or retransmissions.

   222             //

   223             // May have buffered records, or need retransmission if handshaking.

   224             if (!conContext.outputRecord.isEmpty() || (hc != null &&

   225                     hc.sslConfig.enableRetransmissions &&

   226                     hc.sslContext.isDTLS() &&

   227                     hsStatus == HandshakeStatus.NEED_UNWRAP)) {

   228                 ciphertext = encode(null, 0, 0,

   229                         dsts, dstsOffset, dstsLength);

   230             }

   231 

   232             if (ciphertext == null && srcsRemains != 0) {

   233                 ciphertext = encode(srcs, srcsOffset, srcsLength,

   234                         dsts, dstsOffset, dstsLength);

   235             }

   236         } catch (IOException ioe) {

   237             if (ioe instanceof SSLException) {

   238                 throw ioe;

   239             } else {

   240                 throw new SSLException("Write problems", ioe);

   241             }

   242         }

   243 

   244         /*

   245          * Check for status.

   246          */

   247         Status status = (isOutboundDone() ? Status.CLOSED : Status.OK);

   248         if (ciphertext != null && ciphertext.handshakeStatus != null) {

   249             hsStatus = ciphertext.handshakeStatus;

   250         } else {

   251             hsStatus = getHandshakeStatus();

   252         }

   253 

   254         int deltaSrcs = srcsRemains;

   255         for (int i = srcsOffset; i < srcsOffset + srcsLength; i++) {

   256             deltaSrcs -= srcs[i].remaining();

   257         }

   258 

   259         int deltaDsts = dstsRemains;

   260         for (int i = dstsOffset; i < dstsOffset + dstsLength; i++) {

   261             deltaDsts -= dsts[i].remaining();

   262         }

   263 

   264         return new SSLEngineResult(status, hsStatus, deltaSrcs, deltaDsts,

   265                 ciphertext != null ? ciphertext.recordSN : -1L);

   266     }

   267 

   268     private Ciphertext encode(

   269         ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   270         ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws IOException {

   271 

   272         Ciphertext ciphertext = null;

   273         try {

   274             ciphertext = conContext.outputRecord.encode(

   275                 srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);

   276         } catch (SSLHandshakeException she) {

   277             // may be record sequence number overflow

   278             conContext.fatal(Alert.HANDSHAKE_FAILURE, she);

   279         } catch (IOException e) {

   280             conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);

   281         }

   282 

   283         if (ciphertext == null) {

   284             return Ciphertext.CIPHERTEXT_NULL;

   285         }

   286 

   287         // Is the handshake completed?

   288         boolean needRetransmission =

   289                 conContext.sslContext.isDTLS() &&

   290                 conContext.handshakeContext != null &&

   291                 conContext.handshakeContext.sslConfig.enableRetransmissions;

   292         HandshakeStatus hsStatus =

   293                 tryToFinishHandshake(ciphertext.contentType);

   294         if (needRetransmission &&

   295                 hsStatus == HandshakeStatus.FINISHED &&

   296                 conContext.sslContext.isDTLS() &&

   297                 ciphertext.handshakeType == SSLHandshake.FINISHED.id) {

   298             // Retransmit the last flight for DTLS.

   299             //

   300             // The application data transactions may begin immediately

   301             // after the last flight.  If the last flight get lost, the

   302             // application data may be discarded accordingly.  As could

   303             // be an issue for some applications.  This impact can be

   304             // mitigated by sending the last fligth twice.

   305             if (SSLLogger.isOn && SSLLogger.isOn("ssl,verbose")) {

   306                 SSLLogger.finest("retransmit the last flight messages");

   307             }

   308 

   309             conContext.outputRecord.launchRetransmission();

   310             hsStatus = HandshakeStatus.NEED_WRAP;

   311         }

   312 

   313         if (hsStatus == null) {

   314             hsStatus = conContext.getHandshakeStatus();

   315         }

   316 

   317         // Is the sequence number is nearly overflow?

   318         if (conContext.outputRecord.seqNumIsHuge()) {

   319             hsStatus = tryKeyUpdate(hsStatus);

   320         }

   321 

   322         // update context status

   323         ciphertext.handshakeStatus = hsStatus;

   324 

   325         return ciphertext;

   326     }

   327 

   328     private HandshakeStatus tryToFinishHandshake(byte contentType) {

   329         HandshakeStatus hsStatus = null;

   330         if ((contentType == ContentType.HANDSHAKE.id) &&

   331                 conContext.outputRecord.isEmpty()) {

   332             if (conContext.handshakeContext == null) {

   333                 hsStatus = HandshakeStatus.FINISHED;

   334             } else if (conContext.handshakeContext.handshakeFinished) {

   335                 hsStatus = conContext.finishHandshake();

   336             }

   337         }   // Otherwise, the followed call to getHSStatus() will help.

   338 

   339         return hsStatus;

   340     }

   341 

   342     /**

   343      * Try renegotiation or key update for sequence number wrap.

   344      *

   345      * Note that in order to maintain the handshake status properly, we check

   346      * the sequence number after the last record reading/writing process.  As

   347      * we request renegotiation or close the connection for wrapped sequence

   348      * number when there is enough sequence number space left to handle a few

   349      * more records, so the sequence number of the last record cannot be

   350      * wrapped.

   351      */

   352     private HandshakeStatus tryKeyUpdate(

   353             HandshakeStatus currentHandshakeStatus) throws IOException {

   354         // Don't bother to kickstart the renegotiation or key update when the

   355         // local is asking for it.

   356         if ((conContext.handshakeContext == null) &&

   357                 !conContext.isClosed() && !conContext.isBroken) {

   358             if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

   359                 SSLLogger.finest("key update to wrap sequence number");

   360             }

   361             conContext.keyUpdate();

   362             return conContext.getHandshakeStatus();

   363         }

   364 

   365         return currentHandshakeStatus;

   366     }

   367 

   368     private static void checkParams(

   369             ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   370             ByteBuffer[] dsts, int dstsOffset, int dstsLength) {

   371 

   372         if ((srcs == null) || (dsts == null)) {

   373             throw new IllegalArgumentException(

   374                     "source or destination buffer is null");

   375         }

   376 

   377         if ((srcsOffset < 0) || (srcsLength < 0) ||

   378                 (srcsOffset > srcs.length - srcsLength)) {

   379             throw new IndexOutOfBoundsException(

   380                     "index out of bound of the source buffers");

   381         }

   382 

   383         if ((dstsOffset < 0) || (dstsLength < 0) ||

   384                 (dstsOffset > dsts.length - dstsLength)) {

   385             throw new IndexOutOfBoundsException(

   386                     "index out of bound of the destination buffers");

   387         }

   388 

   389         for (int i = srcsOffset; i < srcsOffset + srcsLength; i++) {

   390             if (srcs[i] == null) {

   391                 throw new IllegalArgumentException(

   392                         "source buffer[" + i + "] == null");

   393             }

   394         }

   395 

   396         for (int i = dstsOffset; i < dstsOffset + dstsLength; i++) {

   397             if (dsts[i] == null) {

   398                 throw new IllegalArgumentException(

   399                         "destination buffer[" + i + "] == null");

   400             }

   401 

   402             /*

   403              * Make sure the destination bufffers are writable.

   404              */

   405             if (dsts[i].isReadOnly()) {

   406                 throw new ReadOnlyBufferException();

   407             }

   408         }

   409     }

   410 

   411     @Override

   412     public synchronized SSLEngineResult unwrap(ByteBuffer src,

   413             ByteBuffer[] dsts, int offset, int length) throws SSLException {

   414         return unwrap(

   415                 new ByteBuffer[]{src}, 0, 1, dsts, offset, length);

   416     }

   417 

   418     // @Override

   419     public synchronized SSLEngineResult unwrap(

   420         ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   421         ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws SSLException {

   422 

   423         if (conContext.isUnsureMode) {

   424             throw new IllegalStateException(

   425                     "Client/Server mode has not yet been set.");

   426         }

   427 

   428         // See if the handshaker needs to report back some SSLException.

   429         checkTaskThrown();

   430 

   431         // check parameters

   432         checkParams(srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);

   433 

   434         try {

   435             return readRecord(

   436                 srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);

   437         } catch (SSLProtocolException spe) {

   438             // may be an unexpected handshake message

   439             conContext.fatal(Alert.UNEXPECTED_MESSAGE,

   440                     spe.getMessage(), spe);

   441         } catch (IOException ioe) {

   693             fatal(Alerts.alert_internal_error,

   448             conContext.fatal(Alert.INTERNAL_ERROR,

   694                 "problem unwrapping net record", e);

   449                     "problem unwrapping net record", ioe);

   695             return null;  // make compiler happy

   450         } catch (Exception ex) {     // including RuntimeException

   696         }

   451             conContext.fatal(Alert.INTERNAL_ERROR,

   697     }

   452                 "Fail to unwrap network record", ex);

   698 

   453         }

   699     private static void checkEngineParas(ByteBuffer netData,

   454 

   700             ByteBuffer[] appData, int offset, int len, boolean isForWrap) {

   455         return null;    // make compiler happy

   701 

   456     }

   702         if ((netData == null) || (appData == null)) {

   457 

   703             throw new IllegalArgumentException("src/dst is null");

   458     private SSLEngineResult readRecord(

   704         }

   459         ByteBuffer[] srcs, int srcsOffset, int srcsLength,

   705 

   460         ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws IOException {

   706         if ((offset < 0) || (len < 0) || (offset > appData.length - len)) {

   707             throw new IndexOutOfBoundsException();

   708         }

   709 

   710         /*

   711          * If wrapping, make sure the destination bufffer is writable.

   712          */

   713         if (isForWrap && netData.isReadOnly()) {

   714             throw new ReadOnlyBufferException();

   715         }

   716 

   717         for (int i = offset; i < offset + len; i++) {

   718             if (appData[i] == null) {

   719                 throw new IllegalArgumentException(

   720                         "appData[" + i + "] == null");

   721             }

   722 

   723             /*

   724              * If unwrapping, make sure the destination bufffers are writable.

   725              */

   726             if (!isForWrap && appData[i].isReadOnly()) {

   727                 throw new ReadOnlyBufferException();

   728             }

   729         }

   730     }

   731 

   732     /*

   733      * Makes additional checks for unwrap, but this time more

   734      * specific to this packet and the current state of the machine.

   735      */

   736     private SSLEngineResult readNetRecord(ByteBuffer netData,

   737             ByteBuffer[] appData, int offset, int length) throws IOException {

   738 

   739         Status status = null;

   740         HandshakeStatus hsStatus = null;

   741 

   742         /*

   743          * See if the handshaker needs to report back some SSLException.

   744          */

   745         checkTaskThrown();

   751             return new SSLEngineResult(Status.CLOSED, getHSStatus(null), 0, 0);

   466             return new SSLEngineResult(

   752         }

   467                     Status.CLOSED, getHandshakeStatus(), 0, 0);

   753 

   468         }

   754         /*

   469 

   755          * If we're still in cs_HANDSHAKE, make sure it's been

   470         HandshakeStatus hsStatus = null;

   756          * started.

   471         if (!conContext.isNegotiated) {

   757          */

   472             conContext.kickstart();

   758         synchronized (this) {

   473 

   759             if ((connectionState == cs_HANDSHAKE) ||

   474             /*

   760                     (connectionState == cs_START)) {

   475              * If there's still outbound data to flush, we

   761                 kickstartHandshake();

   476              * can return without trying to unwrap anything.

   762 

   477              */

   763                 /*

   478             hsStatus = getHandshakeStatus();

   764                  * If there's still outbound data to flush, we

   479             if (hsStatus == HandshakeStatus.NEED_WRAP) {

   765                  * can return without trying to unwrap anything.

   480                 return new SSLEngineResult(Status.OK, hsStatus, 0, 0);

   766                  */

   481             }

   767                 hsStatus = getHSStatus(null);

   482         }

   768 

   483 

   769                 if (hsStatus == HandshakeStatus.NEED_WRAP) {

   770                     return new SSLEngineResult(Status.OK, hsStatus, 0, 0);

   771                 }

   772             }

   773         }

   774 

   775         /*

   776          * Grab a copy of this if it doesn't already exist,

   777          * and we can use it several places before anything major

   778          * happens on this side.  Races aren't critical

   779          * here.

   780          */

   782             hsStatus = getHSStatus(null);

   485             hsStatus = getHandshakeStatus();

   798                 plainText = readRecord(null, null, 0, 0);

   501                 plainText = decode(null, 0, 0,

   799             } catch (SSLException e) {

   502                         dsts, dstsOffset, dstsLength);

   800                 throw e;

   503             } catch (IOException ioe) {

   801             } catch (IOException e) {

   504                 if (ioe instanceof SSLException) {

   802                 throw new SSLException("readRecord", e);

   505                     throw ioe;

   803             }

   506                 } else {

   804 

   507                     throw new SSLException("readRecord", ioe);

   805             status = (isInboundDone() ? Status.CLOSED : Status.OK);

   508                 }

   806             hsStatus = getHSStatus(plainText.handshakeStatus);

   509             }

   510 

   511             Status status = (isInboundDone() ? Status.CLOSED : Status.OK);

   512             if (plainText.handshakeStatus != null) {

   513                 hsStatus = plainText.handshakeStatus;

   514             } else {

   515                 hsStatus = getHandshakeStatus();

   516             }

   818             packetLen = inputRecord.bytesInCompletePacket(netData);

   537             packetLen = conContext.inputRecord.bytesInCompletePacket(

   538                     srcs, srcsOffset, srcsLength);

   821             if (isDTLS) {

   541             if (sslContext.isDTLS()) {

   822                 if (debug != null && Debug.isOn("ssl")) {

   542                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,verbose")) {

   823                     System.out.println(

   543                     SSLLogger.finest("Discard invalid DTLS records", ssle);

   824                         Thread.currentThread().getName() +

   825                         " discard invalid record: " + ssle);