1 /*

     2  * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.IOException;

    29 import java.util.List;

    30 import java.util.Collections;

    31 import java.util.ArrayList;

    32 import java.util.Objects;

    33 import javax.net.ssl.SSLException;

    34 

    35 /*

    36  * RFC6066 defines the TLS extension,"status_request" (type 0x5),

    37  * which allows the client to request that the server perform OCSP

    38  * on the client's behalf.

    39  * The "extension data" field of this extension contains a

    40  * "CertificateStatusRequest" structure:

    41  *

    42  *      struct {

    43  *          CertificateStatusType status_type;

    44  *          select (status_type) {

    45  *              case ocsp: OCSPStatusRequest;

    46  *          } request;

    47  *      } CertificateStatusRequest;

    48  *

    49  *      enum { ocsp(1), (255) } CertificateStatusType;

    50  *

    51  *      struct {

    52  *          ResponderID responder_id_list<0..2^16-1>;

    53  *          Extensions  request_extensions;

    54  *      } OCSPStatusRequest;

    55  *

    56  *      opaque ResponderID<1..2^16-1>;

    57  *      opaque Extensions<0..2^16-1>;

    58  */

    59 

    60 final class CertStatusReqListV2Extension extends HelloExtension {

    61 

    62     private final List<CertStatusReqItemV2> itemList;

    63     private final int itemListLength;

    64 

    65     /**

    66      * Construct a default {@code CertStatusReqListV2Extension}.  The default

    67      * object results in a status_request_v2 extension where the extension

    68      * data segment is zero-length.  This is used primarily in ServerHello

    69      * messages where the server asserts it can do RFC 6961 status stapling.

    70      */

    71     CertStatusReqListV2Extension() {

    72         super(ExtensionType.EXT_STATUS_REQUEST_V2);

    73         itemList = Collections.emptyList();

    74         itemListLength = 0;

    75     }

    76 

    77     /**

    78      * Construct a {@code CertStatusReqListV2Extension} from a provided list

    79      *      of {@code CertStatusReqItemV2} objects.

    80      *

    81      * @param reqList a {@code List} containing one or more

    82      *      {@code CertStatusReqItemV2} objects to be included in this TLS

    83      *      Hello extension.  Passing an empty list will result in the encoded

    84      *      extension having a zero-length extension_data segment, and is

    85      *      the same as using the default constructor.

    86      *

    87      * @throws NullPointerException if reqList is {@code null}

    88      */

    89     CertStatusReqListV2Extension(List<CertStatusReqItemV2> reqList) {

    90         super(ExtensionType.EXT_STATUS_REQUEST_V2);

    91         Objects.requireNonNull(reqList,

    92                 "Unallowed null value for certificate_status_req_list");

    93         itemList = Collections.unmodifiableList(new ArrayList<>(reqList));

    94         itemListLength = calculateListLength();

    95     }

    96 

    97     /**

    98      *  Construct the {@code CertStatusReqListV2Extension} object from data

    99      *      read from a {@code HandshakeInputStream}

   100      *

   101      * @param s the {@code HandshakeInputStream} providing the encoded data

   102      * @param len the length of the extension data

   103      *

   104      * @throws IOException if any decoding errors happen during object

   105      *      construction.

   106      */

   107     CertStatusReqListV2Extension(HandshakeInStream s, int len)

   108             throws IOException {

   109         super(ExtensionType.EXT_STATUS_REQUEST_V2);

   110 

   111         if (len <= 0) {

   112             // Handle the empty extension data case (from a ServerHello)

   113             itemList = Collections.emptyList();

   114             itemListLength = 0;

   115         } else {

   116             List<CertStatusReqItemV2> workingList = new ArrayList<>();

   117 

   118             itemListLength = s.getInt16();

   119             if (itemListLength <= 0) {

   120                 throw new SSLException("certificate_status_req_list length " +

   121                         "must be greater than zero (received length: " +

   122                         itemListLength + ")");

   123             }

   124 

   125             int totalRead = 0;

   126             CertStatusReqItemV2 reqItem;

   127             do {

   128                 reqItem = new CertStatusReqItemV2(s);

   129                 totalRead += reqItem.length();

   130             } while (workingList.add(reqItem) && totalRead < itemListLength);

   131 

   132             // If for some reason the add returns false, we may not have read

   133             // all the necessary bytes from the stream.  Check this and throw

   134             // an exception if we terminated the loop early.

   135             if (totalRead != itemListLength) {

   136                 throw new SSLException("Not all certificate_status_req_list " +

   137                         "bytes were read: expected " + itemListLength +

   138                         ", read " + totalRead);

   139             }

   140 

   141             itemList = Collections.unmodifiableList(workingList);

   142         }

   143     }

   144 

   145     /**

   146      * Get the list of {@code CertStatusReqItemV2} objects for this extension

   147      *

   148      * @return an unmodifiable list of {@code CertStatusReqItemV2} objects

   149      */

   150     List<CertStatusReqItemV2> getRequestItems() {

   151         return itemList;

   152     }

   153 

   154     /**

   155      * Return the length of the encoded extension, including extension type

   156      *      and extension length fields.

   157      *

   158      * @return the length in bytes, including the extension type and

   159      *      extension_data length.

   160      */

   161     @Override

   162     int length() {

   163         return (itemList.isEmpty() ? 4 : itemListLength + 6);

   164     }

   165 

   166     /**

   167      * Send the encoded {@code CertStatusReqListV2Extension} through a

   168      *      {@code HandshakeOutputStream}

   169      *

   170      * @param s the {@code HandshakeOutputStream} used to send the encoded data

   171      *

   172      * @throws IOException if any errors occur during the encoding process

   173      */

   174     @Override

   175     void send(HandshakeOutStream s) throws IOException {

   176         s.putInt16(type.id);

   177         s.putInt16(this.length() - 4);

   178         if (itemListLength > 0) {

   179             s.putInt16(itemListLength);

   180             for (CertStatusReqItemV2 item : itemList) {

   181                 item.send(s);

   182             }

   183         }

   184     }

   185 

   186     /**

   187      * Create a string representation of this

   188      *      {@code CertStatusReqListV2Extension}

   189      *

   190      * @return the string representation of this

   191      *      {@code CertStatusReqListV2Extension}

   192      */

   193     @Override

   194     public String toString() {

   195         StringBuilder sb = new StringBuilder("Extension ").append(type);

   196         for (CertStatusReqItemV2 item : itemList) {

   197             sb.append("\n").append(item);

   198         }

   199 

   200         return sb.toString();

   201     }

   202 

   203     /**

   204      * Determine the length of the certificate_status_req_list field in

   205      * the status_request_v2 extension.

   206      *

   207      * @return the total encoded length of all items in the list, or 0 if the

   208      *      encapsulating extension_data is zero-length (from a ServerHello)

   209      */

   210     private int calculateListLength() {

   211         int listLen = 0;

   212 

   213         for (CertStatusReqItemV2 item : itemList) {

   214             listLen += item.length();

   215         }

   216 

   217         return listLen;

   218     }

   219 

   220 }