1 /*

     2  * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.*;

    29 import java.math.BigInteger;

    30 import java.security.*;

    31 import java.util.*;

    32 

    33 import java.security.interfaces.ECPublicKey;

    34 import java.security.interfaces.RSAPublicKey;

    35 import java.security.spec.ECParameterSpec;

    36 

    37 import java.security.cert.X509Certificate;

    38 import java.security.cert.CertificateException;

    39 import java.security.cert.CertificateParsingException;

    40 import java.security.cert.CertPathValidatorException;

    41 import java.security.cert.CertPathValidatorException.Reason;

    42 import java.security.cert.CertPathValidatorException.BasicReason;

    43 import javax.security.auth.x500.X500Principal;

    44 

    45 import javax.crypto.SecretKey;

    46 

    47 import javax.net.ssl.*;

    48 

    49 import sun.security.ssl.HandshakeMessage.*;

    50 import static sun.security.ssl.CipherSuite.KeyExchange.*;

    51 

    52 /**

    53  * ClientHandshaker does the protocol handshaking from the point

    54  * of view of a client.  It is driven asychronously by handshake messages

    55  * as delivered by the parent Handshaker class, and also uses

    56  * common functionality (e.g. key generation) that is provided there.

    57  *

    58  * @author David Brownell

    59  */

    60 final class ClientHandshaker extends Handshaker {

    61 

    62     // constants for subject alt names of type DNS and IP

    63     private static final int ALTNAME_DNS = 2;

    64     private static final int ALTNAME_IP  = 7;

    65 

    66     // the server's public key from its certificate.

    67     private PublicKey serverKey;

    68 

    69     // the server's ephemeral public key from the server key exchange message

    70     // for ECDHE/ECDH_anon and RSA_EXPORT.

    71     private PublicKey ephemeralServerKey;

    72 

    73     // server's ephemeral public value for DHE/DH_anon key exchanges

    74     private BigInteger          serverDH;

    75 

    76     private DHCrypt             dh;

    77 

    78     private ECDHCrypt ecdh;

    79 

    80     private CertificateRequest  certRequest;

    81 

    82     private boolean serverKeyExchangeReceived;

    83 

    84     private boolean staplingActive = false;

    85     private X509Certificate[] deferredCerts;

    86 

    87     /*

    88      * The RSA PreMasterSecret needs to know the version of

    89      * ClientHello that was used on this handshake.  This represents

    90      * the "max version" this client is supporting.  In the

    91      * case of an initial handshake, it's the max version enabled,

    92      * but in the case of a resumption attempt, it's the version

    93      * of the session we're trying to resume.

    94      */

    95     private ProtocolVersion maxProtocolVersion;

    96 

    97     // To switch off the SNI extension.

    98     private static final boolean enableSNIExtension =

    99             Debug.getBooleanProperty("jsse.enableSNIExtension", true);

   100 

   101     /*

   102      * Allow unsafe server certificate change?

   103      *

   104      * Server certificate change during SSL/TLS renegotiation may be considered

   105      * unsafe, as described in the Triple Handshake attacks:

   106      *

   107      *     https://secure-resumption.com/tlsauth.pdf

   108      *

   109      * Endpoint identification (See

   110      * SSLParameters.getEndpointIdentificationAlgorithm()) is a pretty nice

   111      * guarantee that the server certificate change in renegotiation is legal.

   112      * However, endpoing identification is only enabled for HTTPS and LDAP

   113      * over SSL/TLS by default.  It is not enough to protect SSL/TLS

   114      * connections other than HTTPS and LDAP.

   115      *

   116      * The renegotiation indication extension (See RFC 5764) is a pretty

   117      * strong guarantee that the endpoints on both client and server sides

   118      * are identical on the same connection.  However, the Triple Handshake

   119      * attacks can bypass this guarantee if there is a session-resumption

   120      * handshake between the initial full handshake and the renegotiation

   121      * full handshake.

   122      *

   123      * Server certificate change may be unsafe and should be restricted if

   124      * endpoint identification is not enabled and the previous handshake is

   125      * a session-resumption abbreviated initial handshake, unless the

   126      * identities represented by both certificates can be regraded as the

   127      * same (See isIdentityEquivalent()).

   128      *

   129      * Considering the compatibility impact and the actual requirements to

   130      * support server certificate change in practice, the system property,

   131      * jdk.tls.allowUnsafeServerCertChange, is used to define whether unsafe

   132      * server certificate change in renegotiation is allowed or not.  The

   133      * default value of the system property is "false".  To mitigate the

   134      * compactibility impact, applications may want to set the system

   135      * property to "true" at their own risk.

   136      *

   137      * If the value of the system property is "false", server certificate

   138      * change in renegotiation after a session-resumption abbreviated initial

   139      * handshake is restricted (See isIdentityEquivalent()).

   140      *

   141      * If the system property is set to "true" explicitly, the restriction on

   142      * server certificate change in renegotiation is disabled.

   143      */

   144     private static final boolean allowUnsafeServerCertChange =

   145         Debug.getBooleanProperty("jdk.tls.allowUnsafeServerCertChange", false);

   146 

   147     // To switch off the max_fragment_length extension.

   148     private static final boolean enableMFLExtension =

   149             Debug.getBooleanProperty("jsse.enableMFLExtension", false);

   150 

   151     // To switch off the supported_groups extension for DHE cipher suite.

   152     private static final boolean enableFFDHE =

   153             Debug.getBooleanProperty("jsse.enableFFDHE", true);

   154 

   155     // Whether an ALPN extension was sent in the ClientHello

   156     private boolean alpnActive = false;

   157 

   158     private List<SNIServerName> requestedServerNames =

   159             Collections.<SNIServerName>emptyList();

   160 

   161     // maximum fragment length

   162     private int requestedMFLength = -1;     // -1: no fragment length limit

   163 

   164     private boolean serverNamesAccepted = false;

   165 

   166     private ClientHello initialClientHelloMsg = null;   // DTLS only

   167 

   168     /*

   169      * the reserved server certificate chain in previous handshaking

   170      *

   171      * The server certificate chain is only reserved if the previous

   172      * handshake is a session-resumption abbreviated initial handshake.

   173      */

   174     private X509Certificate[] reservedServerCerts = null;

   175 

   176     /*

   177      * Constructors

   178      */

   179     ClientHandshaker(SSLSocketImpl socket, SSLContextImpl context,

   180             ProtocolList enabledProtocols,

   181             ProtocolVersion activeProtocolVersion,

   182             boolean isInitialHandshake, boolean secureRenegotiation,

   183             byte[] clientVerifyData, byte[] serverVerifyData) {

   184 

   185         super(socket, context, enabledProtocols, true, true,

   186             activeProtocolVersion, isInitialHandshake, secureRenegotiation,

   187             clientVerifyData, serverVerifyData);

   188     }

   189 

   190     ClientHandshaker(SSLEngineImpl engine, SSLContextImpl context,

   191             ProtocolList enabledProtocols,

   192             ProtocolVersion activeProtocolVersion,

   193             boolean isInitialHandshake, boolean secureRenegotiation,

   194             byte[] clientVerifyData, byte[] serverVerifyData,

   195             boolean isDTLS) {

   196 

   197         super(engine, context, enabledProtocols, true, true,

   198             activeProtocolVersion, isInitialHandshake, secureRenegotiation,

   199             clientVerifyData, serverVerifyData, isDTLS);

   200     }

   201 

   202     /*

   203      * This routine handles all the client side handshake messages, one at

   204      * a time.  Given the message type (and in some cases the pending cipher

   205      * spec) it parses the type-specific message.  Then it calls a function

   206      * that handles that specific message.

   207      *

   208      * It updates the state machine (need to verify it) as each message

   209      * is processed, and writes responses as needed using the connection

   210      * in the constructor.

   211      */

   212     @Override

   213     void processMessage(byte type, int messageLen) throws IOException {

   214         // check the handshake state

   215         List<Byte> ignoredOptStates = handshakeState.check(type);

   216 

   217         // If the state machine has skipped over certificate status

   218         // and stapling was enabled, we need to check the chain immediately

   219         // because it was deferred, waiting for CertificateStatus.

   220         if (staplingActive && ignoredOptStates.contains(

   221                 HandshakeMessage.ht_certificate_status)) {

   222             checkServerCerts(deferredCerts);

   223             serverKey = session.getPeerCertificates()[0].getPublicKey();

   224         }

   225 

   226         switch (type) {

   227         case HandshakeMessage.ht_hello_request:

   228             HelloRequest helloRequest = new HelloRequest(input);

   229             handshakeState.update(helloRequest, resumingSession);

   230             this.serverHelloRequest(helloRequest);

   231             break;

   232 

   233         case HandshakeMessage.ht_hello_verify_request:

   234             if (!isDTLS) {

   235                 throw new SSLProtocolException(

   236                     "hello_verify_request is not a SSL/TLS handshake message");

   237             }

   238 

   239             HelloVerifyRequest helloVerifyRequest =

   240                         new HelloVerifyRequest(input, messageLen);

   241             handshakeState.update(helloVerifyRequest, resumingSession);

   242             this.helloVerifyRequest(helloVerifyRequest);

   243             break;

   244 

   245         case HandshakeMessage.ht_server_hello:

   246             ServerHello serverHello = new ServerHello(input, messageLen);

   247             this.serverHello(serverHello);

   248 

   249             // This handshake state update needs the resumingSession value

   250             // set by serverHello().

   251             handshakeState.update(serverHello, resumingSession);

   252             break;

   253 

   254         case HandshakeMessage.ht_certificate:

   255             if (keyExchange == K_DH_ANON || keyExchange == K_ECDH_ANON

   256                     || ClientKeyExchangeService.find(keyExchange.name) != null) {

   257                 // No external key exchange provider needs a cert now.

   258                 fatalSE(Alerts.alert_unexpected_message,

   259                     "unexpected server cert chain");

   260                 // NOTREACHED

   261             }

   262             CertificateMsg certificateMsg = new CertificateMsg(input);

   263             handshakeState.update(certificateMsg, resumingSession);

   264             this.serverCertificate(certificateMsg);

   265             if (!staplingActive) {

   266                 // If we are not doing stapling, we can set serverKey right

   267                 // away.  Otherwise, we will wait until verification of the

   268                 // chain has completed after CertificateStatus;

   269                 serverKey = session.getPeerCertificates()[0].getPublicKey();

   270             }

   271             break;

   272 

   273         case HandshakeMessage.ht_certificate_status:

   274             CertificateStatus certStatusMsg = new CertificateStatus(input);

   275             handshakeState.update(certStatusMsg, resumingSession);

   276             this.certificateStatus(certStatusMsg);

   277             serverKey = session.getPeerCertificates()[0].getPublicKey();

   278             break;

   279 

   280         case HandshakeMessage.ht_server_key_exchange:

   281             serverKeyExchangeReceived = true;

   282             switch (keyExchange) {

   283             case K_RSA_EXPORT:

   284                 /**

   285                  * The server key exchange message is sent by the server only

   286                  * when the server certificate message does not contain the

   287                  * proper amount of data to allow the client to exchange a

   288                  * premaster secret, such as when RSA_EXPORT is used and the

   289                  * public key in the server certificate is longer than 512 bits.

   290                  */

   291                 if (serverKey == null) {

   292                     throw new SSLProtocolException

   293                         ("Server did not send certificate message");

   294                 }

   295 

   296                 if (!(serverKey instanceof RSAPublicKey)) {

   297                     throw new SSLProtocolException("Protocol violation:" +

   298                         " the certificate type must be appropriate for the" +

   299                         " selected cipher suite's key exchange algorithm");

   300                 }

   301 

   302                 if (JsseJce.getRSAKeyLength(serverKey) <= 512) {

   303                     throw new SSLProtocolException("Protocol violation:" +

   304                         " server sent a server key exchange message for" +

   305                         " key exchange " + keyExchange +

   306                         " when the public key in the server certificate" +

   307                         " is less than or equal to 512 bits in length");

   308                 }

   309 

   310                 try {

   311                     RSA_ServerKeyExchange rsaSrvKeyExchange =

   312                                     new RSA_ServerKeyExchange(input);

   313                     handshakeState.update(rsaSrvKeyExchange, resumingSession);

   314                     this.serverKeyExchange(rsaSrvKeyExchange);

   315                 } catch (GeneralSecurityException e) {

   316                     throw new SSLException("Server key", e);

   317                 }

   318                 break;

   319             case K_DH_ANON:

   320                 try {

   321                     DH_ServerKeyExchange dhSrvKeyExchange =

   322                             new DH_ServerKeyExchange(input, protocolVersion);

   323                     handshakeState.update(dhSrvKeyExchange, resumingSession);

   324                     this.serverKeyExchange(dhSrvKeyExchange);

   325                 } catch (GeneralSecurityException e) {

   326                     throw new SSLException("Server key", e);

   327                 }

   328                 break;

   329             case K_DHE_DSS:

   330             case K_DHE_RSA:

   331                 try {

   332                     DH_ServerKeyExchange dhSrvKeyExchange =

   333                         new DH_ServerKeyExchange(

   334                             input, serverKey,

   335                             clnt_random.random_bytes, svr_random.random_bytes,

   336                             messageLen,

   337                             getLocalSupportedSignAlgs(), protocolVersion);

   338                     handshakeState.update(dhSrvKeyExchange, resumingSession);

   339                     this.serverKeyExchange(dhSrvKeyExchange);

   340                 } catch (GeneralSecurityException e) {

   341                     throw new SSLException("Server key", e);

   342                 }

   343                 break;

   344             case K_ECDHE_ECDSA:

   345             case K_ECDHE_RSA:

   346             case K_ECDH_ANON:

   347                 try {

   348                     ECDH_ServerKeyExchange ecdhSrvKeyExchange =

   349                         new ECDH_ServerKeyExchange

   350                             (input, serverKey, clnt_random.random_bytes,

   351                             svr_random.random_bytes,

   352                             getLocalSupportedSignAlgs(), protocolVersion);

   353                     handshakeState.update(ecdhSrvKeyExchange, resumingSession);

   354                     this.serverKeyExchange(ecdhSrvKeyExchange);

   355                 } catch (GeneralSecurityException e) {

   356                     throw new SSLException("Server key", e);

   357                 }

   358                 break;

   359             case K_RSA:

   360             case K_DH_RSA:

   361             case K_DH_DSS:

   362             case K_ECDH_ECDSA:

   363             case K_ECDH_RSA:

   364                 throw new SSLProtocolException(

   365                     "Protocol violation: server sent a server key exchange"

   366                     + " message for key exchange " + keyExchange);

   367             default:

   368                 throw new SSLProtocolException(

   369                     "unsupported or unexpected key exchange algorithm = "

   370                     + keyExchange);

   371             }

   372             break;

   373 

   374         case HandshakeMessage.ht_certificate_request:

   375             // save for later, it's handled by serverHelloDone

   376             if ((keyExchange == K_DH_ANON) || (keyExchange == K_ECDH_ANON)) {

   377                 throw new SSLHandshakeException(

   378                     "Client authentication requested for "+

   379                     "anonymous cipher suite.");

   380             } else if (ClientKeyExchangeService.find(keyExchange.name) != null) {

   381                 // No external key exchange provider needs a cert now.

   382                 throw new SSLHandshakeException(

   383                     "Client certificate requested for "+

   384                     "external cipher suite: " + keyExchange);

   385             }

   386             certRequest = new CertificateRequest(input, protocolVersion);

   387             if (debug != null && Debug.isOn("handshake")) {

   388                 certRequest.print(System.out);

   389             }

   390             handshakeState.update(certRequest, resumingSession);

   391 

   392             if (protocolVersion.useTLS12PlusSpec()) {

   393                 Collection<SignatureAndHashAlgorithm> peerSignAlgs =

   394                                         certRequest.getSignAlgorithms();

   395                 if (peerSignAlgs == null || peerSignAlgs.isEmpty()) {

   396                     throw new SSLHandshakeException(

   397                         "No peer supported signature algorithms");

   398                 }

   399 

   400                 Collection<SignatureAndHashAlgorithm> supportedPeerSignAlgs =

   401                     SignatureAndHashAlgorithm.getSupportedAlgorithms(

   402                             algorithmConstraints, peerSignAlgs);

   403                 if (supportedPeerSignAlgs.isEmpty()) {

   404                     throw new SSLHandshakeException(

   405                         "No supported signature and hash algorithm in common");

   406                 }

   407 

   408                 setPeerSupportedSignAlgs(supportedPeerSignAlgs);

   409                 session.setPeerSupportedSignatureAlgorithms(

   410                                                 supportedPeerSignAlgs);

   411             }

   412 

   413             break;

   414 

   415         case HandshakeMessage.ht_server_hello_done:

   416             ServerHelloDone serverHelloDone = new ServerHelloDone(input);

   417             handshakeState.update(serverHelloDone, resumingSession);

   418             this.serverHelloDone(serverHelloDone);

   419 

   420             break;

   421 

   422         case HandshakeMessage.ht_finished:

   423             Finished serverFinished =

   424                     new Finished(protocolVersion, input, cipherSuite);

   425             handshakeState.update(serverFinished, resumingSession);

   426             this.serverFinished(serverFinished);

   427 

   428             break;

   429 

   430         default:

   431             throw new SSLProtocolException(

   432                 "Illegal client handshake msg, " + type);

   433         }

   434     }

   435 

   436     /*

   437      * Used by the server to kickstart negotiations -- this requests a

   438      * "client hello" to renegotiate current cipher specs (e.g. maybe lots

   439      * of data has been encrypted with the same keys, or the server needs

   440      * the client to present a certificate).

   441      */

   442     private void serverHelloRequest(HelloRequest mesg) throws IOException {

   443         if (debug != null && Debug.isOn("handshake")) {

   444             mesg.print(System.out);

   445         }

   446 

   447         //

   448         // Could be (e.g. at connection setup) that we already

   449         // sent the "client hello" but the server's not seen it.

   450         //

   451         if (!clientHelloDelivered) {

   452             if (!secureRenegotiation && !allowUnsafeRenegotiation) {

   453                 // renegotiation is not allowed.

   454                 if (activeProtocolVersion.useTLS10PlusSpec()) {

   455                     // response with a no_renegotiation warning,

   456                     warningSE(Alerts.alert_no_renegotiation);

   457 

   458                     // invalidate the handshake so that the caller can

   459                     // dispose this object.

   460                     invalidated = true;

   461 

   462                     // If there is still unread block in the handshake

   463                     // input stream, it would be truncated with the disposal

   464                     // and the next handshake message will become incomplete.

   465                     //

   466                     // However, according to SSL/TLS specifications, no more

   467                     // handshake message should immediately follow ClientHello

   468                     // or HelloRequest. So just let it be.

   469                 } else {

   470                     // For SSLv3, send the handshake_failure fatal error.

   471                     // Note that SSLv3 does not define a no_renegotiation

   472                     // alert like TLSv1. However we cannot ignore the message

   473                     // simply, otherwise the other side was waiting for a

   474                     // response that would never come.

   475                     fatalSE(Alerts.alert_handshake_failure,

   476                         "Renegotiation is not allowed");

   477                 }

   478             } else {

   479                 if (!secureRenegotiation) {

   480                     if (debug != null && Debug.isOn("handshake")) {

   481                         System.out.println(

   482                             "Warning: continue with insecure renegotiation");

   483                     }

   484                 }

   485                 kickstart();

   486             }

   487         }

   488     }

   489 

   490     private void helloVerifyRequest(

   491             HelloVerifyRequest mesg) throws IOException {

   492 

   493         if (debug != null && Debug.isOn("handshake")) {

   494             mesg.print(System.out);

   495         }

   496 

   497         //

   498         // Note that HelloVerifyRequest.server_version is used solely to

   499         // indicate packet formatting, and not as part of version negotiation.

   500         // Need not to check version values match for HelloVerifyRequest

   501         // message.

   502         //

   503         initialClientHelloMsg.cookie = mesg.cookie.clone();

   504 

   505         if (debug != null && Debug.isOn("handshake")) {

   506             initialClientHelloMsg.print(System.out);

   507         }

   508 

   509         // deliver the ClientHello message with cookie

   510         initialClientHelloMsg.write(output);

   511         handshakeState.update(initialClientHelloMsg, resumingSession);

   512     }

   513 

   514     /*

   515      * Server chooses session parameters given options created by the

   516      * client -- basically, cipher options, session id, and someday a

   517      * set of compression options.

   518      *

   519      * There are two branches of the state machine, decided by the

   520      * details of this message.  One is the "fast" handshake, where we

   521      * can resume the pre-existing session we asked resume.  The other

   522      * is a more expensive "full" handshake, with key exchange and

   523      * probably authentication getting done.

   524      */

   525     private void serverHello(ServerHello mesg) throws IOException {

   526         // Dispose the reserved ClientHello message (if exists).

   527         initialClientHelloMsg = null;

   528 

   529         serverKeyExchangeReceived = false;

   530         if (debug != null && Debug.isOn("handshake")) {

   531             mesg.print(System.out);

   532         }

   533 

   534         // check if the server selected protocol version is OK for us

   535         ProtocolVersion mesgVersion = mesg.protocolVersion;

   536         if (!isNegotiable(mesgVersion)) {

   537             throw new SSLHandshakeException(

   538                 "Server chose " + mesgVersion +

   539                 ", but that protocol version is not enabled or not supported " +

   540                 "by the client.");

   541         }

   542 

   543         handshakeHash.protocolDetermined(mesgVersion);

   544 

   545         // Set protocolVersion and propagate to SSLSocket and the

   546         // Handshake streams

   547         setVersion(mesgVersion);

   548 

   549         // check the "renegotiation_info" extension

   550         RenegotiationInfoExtension serverHelloRI = (RenegotiationInfoExtension)

   551                     mesg.extensions.get(ExtensionType.EXT_RENEGOTIATION_INFO);

   552         if (serverHelloRI != null) {

   553             if (isInitialHandshake) {

   554                 // verify the length of the "renegotiated_connection" field

   555                 if (!serverHelloRI.isEmpty()) {

   556                     // abort the handshake with a fatal handshake_failure alert

   557                     fatalSE(Alerts.alert_handshake_failure,

   558                         "The renegotiation_info field is not empty");

   559                 }

   560 

   561                 secureRenegotiation = true;

   562             } else {

   563                 // For a legacy renegotiation, the client MUST verify that

   564                 // it does not contain the "renegotiation_info" extension.

   565                 if (!secureRenegotiation) {

   566                     fatalSE(Alerts.alert_handshake_failure,

   567                         "Unexpected renegotiation indication extension");

   568                 }

   569 

   570                 // verify the client_verify_data and server_verify_data values

   571                 byte[] verifyData =

   572                     new byte[clientVerifyData.length + serverVerifyData.length];

   573                 System.arraycopy(clientVerifyData, 0, verifyData,

   574                         0, clientVerifyData.length);

   575                 System.arraycopy(serverVerifyData, 0, verifyData,

   576                         clientVerifyData.length, serverVerifyData.length);

   577                 if (!MessageDigest.isEqual(verifyData,

   578                                 serverHelloRI.getRenegotiatedConnection())) {

   579                     fatalSE(Alerts.alert_handshake_failure,

   580                         "Incorrect verify data in ServerHello " +

   581                         "renegotiation_info message");

   582                 }

   583             }

   584         } else {

   585             // no renegotiation indication extension

   586             if (isInitialHandshake) {

   587                 if (!allowLegacyHelloMessages) {

   588                     // abort the handshake with a fatal handshake_failure alert

   589                     fatalSE(Alerts.alert_handshake_failure,

   590                         "Failed to negotiate the use of secure renegotiation");

   591                 }

   592 

   593                 secureRenegotiation = false;

   594                 if (debug != null && Debug.isOn("handshake")) {

   595                     System.out.println("Warning: No renegotiation " +

   596                                     "indication extension in ServerHello");

   597                 }

   598             } else {

   599                 // For a secure renegotiation, the client must abort the

   600                 // handshake if no "renegotiation_info" extension is present.

   601                 if (secureRenegotiation) {

   602                     fatalSE(Alerts.alert_handshake_failure,

   603                         "No renegotiation indication extension");

   604                 }

   605 

   606                 // we have already allowed unsafe renegotation before request

   607                 // the renegotiation.

   608             }

   609         }

   610 

   611         //

   612         // Save server nonce, we always use it to compute connection

   613         // keys and it's also used to create the master secret if we're

   614         // creating a new session (i.e. in the full handshake).

   615         //

   616         svr_random = mesg.svr_random;

   617 

   618         if (isNegotiable(mesg.cipherSuite) == false) {

   619             fatalSE(Alerts.alert_illegal_parameter,

   620                 "Server selected improper ciphersuite " + mesg.cipherSuite);

   621         }

   622 

   623         setCipherSuite(mesg.cipherSuite);

   624         if (protocolVersion.useTLS12PlusSpec()) {

   625             handshakeHash.setFinishedAlg(cipherSuite.prfAlg.getPRFHashAlg());

   626         }

   627 

   628         if (mesg.compression_method != 0) {

   629             fatalSE(Alerts.alert_illegal_parameter,

   630                 "compression type not supported, "

   631                 + mesg.compression_method);

   632             // NOTREACHED

   633         }

   634 

   635         // so far so good, let's look at the session

   636         if (session != null) {

   637             // we tried to resume, let's see what the server decided

   638             if (session.getSessionId().equals(mesg.sessionId)) {

   639                 // server resumed the session, let's make sure everything

   640                 // checks out

   641 

   642                 // Verify that the session ciphers are unchanged.

   643                 CipherSuite sessionSuite = session.getSuite();

   644                 if (cipherSuite != sessionSuite) {

   645                     throw new SSLProtocolException

   646                         ("Server returned wrong cipher suite for session");

   647                 }

   648 

   649                 // verify protocol version match

   650                 ProtocolVersion sessionVersion = session.getProtocolVersion();

   651                 if (protocolVersion != sessionVersion) {

   652                     throw new SSLProtocolException

   653                         ("Server resumed session with wrong protocol version");

   654                 }

   655 

   656                 // validate subject identity

   657                 ClientKeyExchangeService p =

   658                         ClientKeyExchangeService.find(

   659                                 sessionSuite.keyExchange.name);

   660                 if (p != null) {

   661                     Principal localPrincipal = session.getLocalPrincipal();

   662 

   663                     if (p.isRelated(true, getAccSE(), localPrincipal)) {

   664                         if (debug != null && Debug.isOn("session"))

   665                             System.out.println("Subject identity is same");

   666                     } else {

   667                         throw new SSLProtocolException(

   668                                 "Server resumed session with " +

   669                                 "wrong subject identity or no subject");

   670                     }

   671                 }

   672 

   673                 // looks fine; resume it.

   674                 resumingSession = true;

   675                 calculateConnectionKeys(session.getMasterSecret());

   676                 if (debug != null && Debug.isOn("session")) {

   677                     System.out.println("%% Server resumed " + session);

   678                 }

   679             } else {

   680                 // we wanted to resume, but the server refused

   681                 //

   682                 // Invalidate the session for initial handshake in case

   683                 // of reusing next time.

   684                 if (isInitialHandshake) {

   685                     session.invalidate();

   686                 }

   687                 session = null;

   688                 if (!enableNewSession) {

   689                     throw new SSLException("New session creation is disabled");

   690                 }

   691             }

   692         }

   693 

   694         // check the "max_fragment_length" extension

   695         MaxFragmentLengthExtension maxFragLenExt = (MaxFragmentLengthExtension)

   696                 mesg.extensions.get(ExtensionType.EXT_MAX_FRAGMENT_LENGTH);

   697         if (maxFragLenExt != null) {

   698             if ((requestedMFLength == -1) ||

   699                     maxFragLenExt.getMaxFragLen() != requestedMFLength) {

   700                 // If the client did not request this extension, or the

   701                 // response value is different from the length it requested,

   702                 // abort the handshake with a fatal illegal_parameter alert.

   703                 fatalSE(Alerts.alert_illegal_parameter,

   704                         "Failed to negotiate the max_fragment_length");

   705             }

   706         } else if (!resumingSession) {

   707             // no "max_fragment_length" extension

   708             requestedMFLength = -1;

   709         }   // Otherwise, using the value negotiated during the original

   710             // session initiation

   711 

   712         // check the "extended_master_secret" extension

   713         ExtendedMasterSecretExtension extendedMasterSecretExt =

   714                 (ExtendedMasterSecretExtension)mesg.extensions.get(

   715                         ExtensionType.EXT_EXTENDED_MASTER_SECRET);

   716         if (extendedMasterSecretExt != null) {

   717             // Is it the expected server extension?

   718             if (!useExtendedMasterSecret ||

   719                     !mesgVersion.useTLS10PlusSpec() || !requestedToUseEMS) {

   720                 fatalSE(Alerts.alert_unsupported_extension,

   721                         "Server sent the extended_master_secret " +

   722                         "extension improperly");

   723             }

   724 

   725             // For abbreviated handshake, if the original session did not use

   726             // the "extended_master_secret" extension but the new ServerHello

   727             // contains the extension, the client MUST abort the handshake.

   728             if (resumingSession && (session != null) &&

   729                     !session.getUseExtendedMasterSecret()) {

   730                 fatalSE(Alerts.alert_unsupported_extension,

   731                         "Server sent an unexpected extended_master_secret " +

   732                         "extension on session resumption");

   733             }

   734         } else {

   735             if (useExtendedMasterSecret && !allowLegacyMasterSecret) {

   736                 // For full handshake, if a client receives a ServerHello

   737                 // without the extension, it SHOULD abort the handshake if

   738                 // it does not wish to interoperate with legacy servers.

   739                 fatalSE(Alerts.alert_handshake_failure,

   740                     "Extended Master Secret extension is required");

   741             }

   742 

   743             if (resumingSession && (session != null)) {

   744                 if (session.getUseExtendedMasterSecret()) {

   745                     // For abbreviated handshake, if the original session used

   746                     // the "extended_master_secret" extension but the new

   747                     // ServerHello does not contain the extension, the client

   748                     // MUST abort the handshake.

   749                     fatalSE(Alerts.alert_handshake_failure,

   750                             "Missing Extended Master Secret extension " +

   751                             "on session resumption");

   752                 } else if (useExtendedMasterSecret && !allowLegacyResumption) {

   753                     // Unlikely, abbreviated handshake should be discarded.

   754                     fatalSE(Alerts.alert_handshake_failure,

   755                         "Extended Master Secret extension is required");

   756                 }

   757             }

   758         }

   759 

   760         // check the ALPN extension

   761         ALPNExtension serverHelloALPN =

   762             (ALPNExtension) mesg.extensions.get(ExtensionType.EXT_ALPN);

   763 

   764         if (serverHelloALPN != null) {

   765             // Check whether an ALPN extension was sent in ClientHello message

   766             if (!alpnActive) {

   767                 fatalSE(Alerts.alert_unsupported_extension,

   768                     "Server sent " + ExtensionType.EXT_ALPN +

   769                     " extension when not requested by client");

   770             }

   771 

   772             List<String> protocols = serverHelloALPN.getPeerAPs();

   773             // Only one application protocol name should be present

   774             String p;

   775             if ((protocols.size() == 1) &&

   776                     !((p = protocols.get(0)).isEmpty())) {

   777                 int i;

   778                 for (i = 0; i < localApl.length; i++) {

   779                     if (localApl[i].equals(p)) {

   780                         break;

   781                     }

   782                 }

   783                 if (i == localApl.length) {

   784                     fatalSE(Alerts.alert_handshake_failure,

   785                         "Server has selected an application protocol name " +

   786                         "which was not offered by the client: " + p);

   787                 }

   788                 applicationProtocol = p;

   789             } else {

   790                 fatalSE(Alerts.alert_handshake_failure,

   791                     "Incorrect data in ServerHello " + ExtensionType.EXT_ALPN +

   792                     " message");

   793             }

   794         } else {

   795             applicationProtocol = "";

   796         }

   797 

   798         if (resumingSession && session != null) {

   799             setHandshakeSessionSE(session);

   800             // Reserve the handshake state if this is a session-resumption

   801             // abbreviated initial handshake.

   802             if (isInitialHandshake) {

   803                 session.setAsSessionResumption(true);

   804             }

   805 

   806             return;

   807         }

   808 

   809         // check extensions

   810         for (HelloExtension ext : mesg.extensions.list()) {

   811             ExtensionType type = ext.type;

   812             if (type == ExtensionType.EXT_SERVER_NAME) {

   813                 serverNamesAccepted = true;

   814             } else if (type == ExtensionType.EXT_STATUS_REQUEST ||

   815                     type == ExtensionType.EXT_STATUS_REQUEST_V2) {

   816                 // Only enable the stapling feature if the client asserted

   817                 // these extensions.

   818                 if (sslContext.isStaplingEnabled(true)) {

   819                     staplingActive = true;

   820                 } else {

   821                     fatalSE(Alerts.alert_unexpected_message, "Server set " +

   822                             type + " extension when not requested by client");

   823                 }

   824             } else if ((type != ExtensionType.EXT_SUPPORTED_GROUPS)

   825                     && (type != ExtensionType.EXT_EC_POINT_FORMATS)

   826                     && (type != ExtensionType.EXT_SERVER_NAME)

   827                     && (type != ExtensionType.EXT_ALPN)

   828                     && (type != ExtensionType.EXT_RENEGOTIATION_INFO)

   829                     && (type != ExtensionType.EXT_STATUS_REQUEST)

   830                     && (type != ExtensionType.EXT_STATUS_REQUEST_V2)

   831                     && (type != ExtensionType.EXT_EXTENDED_MASTER_SECRET)) {

   832                 // Note: Better to check client requested extensions rather

   833                 // than all supported extensions.

   834                 fatalSE(Alerts.alert_unsupported_extension,

   835                     "Server sent an unsupported extension: " + type);

   836             }

   837         }

   838 

   839         // Create a new session, we need to do the full handshake

   840         session = new SSLSessionImpl(protocolVersion, cipherSuite,

   841                             getLocalSupportedSignAlgs(),

   842                             mesg.sessionId, getHostSE(), getPortSE(),

   843                             (extendedMasterSecretExt != null));

   844         session.setRequestedServerNames(requestedServerNames);

   845         session.setNegotiatedMaxFragSize(requestedMFLength);

   846         session.setMaximumPacketSize(maximumPacketSize);

   847         setHandshakeSessionSE(session);

   848         if (debug != null && Debug.isOn("handshake")) {

   849             System.out.println("** " + cipherSuite);

   850         }

   851     }

   852 

   853     /*

   854      * Server's own key was either a signing-only key, or was too

   855      * large for export rules ... this message holds an ephemeral

   856      * RSA key to use for key exchange.

   857      */

   858     private void serverKeyExchange(RSA_ServerKeyExchange mesg)

   859             throws IOException, GeneralSecurityException {

   860         if (debug != null && Debug.isOn("handshake")) {

   861             mesg.print(System.out);

   862         }

   863         if (!mesg.verify(serverKey, clnt_random, svr_random)) {

   864             fatalSE(Alerts.alert_handshake_failure,

   865                 "server key exchange invalid");

   866             // NOTREACHED

   867         }

   868         ephemeralServerKey = mesg.getPublicKey();

   869 

   870         // check constraints of RSA PublicKey

   871         if (!algorithmConstraints.permits(

   872             EnumSet.of(CryptoPrimitive.KEY_AGREEMENT), ephemeralServerKey)) {

   873 

   874             throw new SSLHandshakeException("RSA ServerKeyExchange " +

   875                     "does not comply to algorithm constraints");

   876         }

   877     }

   878 

   879     /*

   880      * Diffie-Hellman key exchange.  We save the server public key and

   881      * our own D-H algorithm object so we can defer key calculations

   882      * until after we've sent the client key exchange message (which

   883      * gives client and server some useful parallelism).

   884      *

   885      * Note per section 3 of RFC 7919, if the server is not compatible with

   886      * FFDHE specification, the client MAY decide to continue the connection

   887      * if the selected DHE group is acceptable under local policy, or it MAY

   888      * decide to terminate the connection with a fatal insufficient_security

   889      * (71) alert.  The algorithm constraints mechanism is JDK local policy

   890      * used for additional DHE parameters checking.  So this implementation

   891      * does not check the server compatibility and just pass to the local

   892      * algorithm constraints checking.  The client will continue the

   893      * connection if the server selected DHE group is acceptable by the

   894      * specified algorithm constraints.

   895      */

   896     private void serverKeyExchange(DH_ServerKeyExchange mesg)

   897             throws IOException {

   898         if (debug != null && Debug.isOn("handshake")) {

   899             mesg.print(System.out);

   900         }

   901         dh = new DHCrypt(mesg.getModulus(), mesg.getBase(),

   902                                             sslContext.getSecureRandom());

   903         serverDH = mesg.getServerPublicKey();

   904 

   905         // check algorithm constraints

   906         dh.checkConstraints(algorithmConstraints, serverDH);

   907     }

   908 

   909     private void serverKeyExchange(ECDH_ServerKeyExchange mesg)

   910             throws IOException {

   911         if (debug != null && Debug.isOn("handshake")) {

   912             mesg.print(System.out);

   913         }

   914         ECPublicKey key = mesg.getPublicKey();

   915         ecdh = new ECDHCrypt(key.getParams(), sslContext.getSecureRandom());

   916         ephemeralServerKey = key;

   917 

   918         // check constraints of EC PublicKey

   919         if (!algorithmConstraints.permits(

   920             EnumSet.of(CryptoPrimitive.KEY_AGREEMENT), ephemeralServerKey)) {

   921 

   922             throw new SSLHandshakeException("ECDH ServerKeyExchange " +

   923                     "does not comply to algorithm constraints");

   924         }

   925     }

   926 

   927     /*

   928      * The server's "Hello Done" message is the client's sign that

   929      * it's time to do all the hard work.

   930      */

   931     private void serverHelloDone(ServerHelloDone mesg) throws IOException {

   932         if (debug != null && Debug.isOn("handshake")) {

   933             mesg.print(System.out);

   934         }

   935 

   936         /*

   937          * FIRST ... if requested, send an appropriate Certificate chain

   938          * to authenticate the client, and remember the associated private

   939          * key to sign the CertificateVerify message.

   940          */

   941         PrivateKey signingKey = null;

   942 

   943         if (certRequest != null) {

   944             X509ExtendedKeyManager km = sslContext.getX509KeyManager();

   945 

   946             ArrayList<String> keytypesTmp = new ArrayList<>(4);

   947 

   948             for (int i = 0; i < certRequest.types.length; i++) {

   949                 String typeName;

   950 

   951                 switch (certRequest.types[i]) {

   952                     case CertificateRequest.cct_rsa_sign:

   953                         typeName = "RSA";

   954                         break;

   955 

   956                     case CertificateRequest.cct_dss_sign:

   957                         typeName = "DSA";

   958                             break;

   959 

   960                     case CertificateRequest.cct_ecdsa_sign:

   961                         // ignore if we do not have EC crypto available

   962                         typeName = JsseJce.isEcAvailable() ? "EC" : null;

   963                         break;

   964 

   965                     // Fixed DH/ECDH client authentication not supported

   966                     //

   967                     // case CertificateRequest.cct_rsa_fixed_dh:

   968                     // case CertificateRequest.cct_dss_fixed_dh:

   969                     // case CertificateRequest.cct_rsa_fixed_ecdh:

   970                     // case CertificateRequest.cct_ecdsa_fixed_ecdh:

   971                     //

   972                     // Any other values (currently not used in TLS)

   973                     //

   974                     // case CertificateRequest.cct_rsa_ephemeral_dh:

   975                     // case CertificateRequest.cct_dss_ephemeral_dh:

   976                     default:

   977                         typeName = null;

   978                         break;

   979                 }

   980 

   981                 if ((typeName != null) && (!keytypesTmp.contains(typeName))) {

   982                     keytypesTmp.add(typeName);

   983                 }

   984             }

   985 

   986             String alias = null;

   987             int keytypesTmpSize = keytypesTmp.size();

   988             if (keytypesTmpSize != 0) {

   989                 String[] keytypes =

   990                         keytypesTmp.toArray(new String[keytypesTmpSize]);

   991 

   992                 if (conn != null) {

   993                     alias = km.chooseClientAlias(keytypes,

   994                         certRequest.getAuthorities(), conn);

   995                 } else {

   996                     alias = km.chooseEngineClientAlias(keytypes,

   997                         certRequest.getAuthorities(), engine);

   998                 }

   999             }

  1000 

  1001             CertificateMsg m1 = null;

  1002             if (alias != null) {

  1003                 X509Certificate[] certs = km.getCertificateChain(alias);

  1004                 if ((certs != null) && (certs.length != 0)) {

  1005                     PublicKey publicKey = certs[0].getPublicKey();

  1006                     if (publicKey != null) {

  1007                         m1 = new CertificateMsg(certs);

  1008                         signingKey = km.getPrivateKey(alias);

  1009                         session.setLocalPrivateKey(signingKey);

  1010                         session.setLocalCertificates(certs);

  1011                     }

  1012                 }

  1013             }

  1014             if (m1 == null) {

  1015                 //

  1016                 // No appropriate cert was found ... report this to the

  1017                 // server.  For SSLv3, send the no_certificate alert;

  1018                 // TLS uses an empty cert chain instead.

  1019                 //

  1020                 if (protocolVersion.useTLS10PlusSpec()) {

  1021                     m1 = new CertificateMsg(new X509Certificate [0]);

  1022                 } else {

  1023                     warningSE(Alerts.alert_no_certificate);

  1024                 }

  1025                 if (debug != null && Debug.isOn("handshake")) {

  1026                     System.out.println(

  1027                         "Warning: no suitable certificate found - " +

  1028                         "continuing without client authentication");

  1029                 }

  1030             }

  1031 

  1032             //

  1033             // At last ... send any client certificate chain.

  1034             //

  1035             if (m1 != null) {

  1036                 if (debug != null && Debug.isOn("handshake")) {

  1037                     m1.print(System.out);

  1038                 }

  1039                 m1.write(output);

  1040                 handshakeState.update(m1, resumingSession);

  1041             }

  1042         }

  1043 

  1044         /*

  1045          * SECOND ... send the client key exchange message.  The

  1046          * procedure used is a function of the cipher suite selected;

  1047          * one is always needed.

  1048          */

  1049         HandshakeMessage m2;

  1050 

  1051         switch (keyExchange) {

  1052 

  1053         case K_RSA:

  1054         case K_RSA_EXPORT:

  1055             if (serverKey == null) {

  1056                 throw new SSLProtocolException

  1057                         ("Server did not send certificate message");

  1058             }

  1059 

  1060             if (!(serverKey instanceof RSAPublicKey)) {

  1061                 throw new SSLProtocolException

  1062                         ("Server certificate does not include an RSA key");

  1063             }

  1064 

  1065             /*

  1066              * For RSA key exchange, we randomly generate a new

  1067              * pre-master secret and encrypt it with the server's

  1068              * public key.  Then we save that pre-master secret

  1069              * so that we can calculate the keying data later;

  1070              * it's a performance speedup not to do that until

  1071              * the client's waiting for the server response, but

  1072              * more of a speedup for the D-H case.

  1073              *

  1074              * If the RSA_EXPORT scheme is active, when the public

  1075              * key in the server certificate is less than or equal

  1076              * to 512 bits in length, use the cert's public key,

  1077              * otherwise, the ephemeral one.

  1078              */

  1079             PublicKey key;

  1080             if (keyExchange == K_RSA) {

  1081                 key = serverKey;

  1082             } else {    // K_RSA_EXPORT

  1083                 if (JsseJce.getRSAKeyLength(serverKey) <= 512) {

  1084                     // extraneous ephemeralServerKey check done

  1085                     // above in processMessage()

  1086                     key = serverKey;

  1087                 } else {

  1088                     if (ephemeralServerKey == null) {

  1089                         throw new SSLProtocolException("Server did not send" +

  1090                             " a RSA_EXPORT Server Key Exchange message");

  1091                     }

  1092                     key = ephemeralServerKey;

  1093                 }

  1094             }

  1095 

  1096             m2 = new RSAClientKeyExchange(protocolVersion, maxProtocolVersion,

  1097                                 sslContext.getSecureRandom(), key);

  1098             break;

  1099         case K_DH_RSA:

  1100         case K_DH_DSS:

  1101             /*

  1102              * For DH Key exchange, we only need to make sure the server

  1103              * knows our public key, so we calculate the same pre-master

  1104              * secret.

  1105              *

  1106              * For certs that had DH keys in them, we send an empty

  1107              * handshake message (no key) ... we flag this case by

  1108              * passing a null "dhPublic" value.

  1109              *

  1110              * Otherwise we send ephemeral DH keys, unsigned.

  1111              */

  1112             // if (useDH_RSA || useDH_DSS)

  1113             m2 = new DHClientKeyExchange();

  1114             break;

  1115         case K_DHE_RSA:

  1116         case K_DHE_DSS:

  1117         case K_DH_ANON:

  1118             if (dh == null) {

  1119                 throw new SSLProtocolException

  1120                     ("Server did not send a DH Server Key Exchange message");

  1121             }

  1122             m2 = new DHClientKeyExchange(dh.getPublicKey());

  1123             break;

  1124         case K_ECDHE_RSA:

  1125         case K_ECDHE_ECDSA:

  1126         case K_ECDH_ANON:

  1127             if (ecdh == null) {

  1128                 throw new SSLProtocolException

  1129                     ("Server did not send a ECDH Server Key Exchange message");

  1130             }

  1131             m2 = new ECDHClientKeyExchange(ecdh.getPublicKey());

  1132             break;

  1133         case K_ECDH_RSA:

  1134         case K_ECDH_ECDSA:

  1135             if (serverKey == null) {