1 /*

     2  * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.IOException;

    29 import java.nio.ByteBuffer;

    30 import java.text.MessageFormat;

    31 import java.util.Locale;

    32 import javax.net.ssl.SSLProtocolException;

    33 

    34 import sun.security.ssl.ClientHello.ClientHelloMessage;

    35 import sun.security.ssl.SSLExtension.ExtensionConsumer;

    36 import sun.security.ssl.SSLHandshake.HandshakeMessage;

    37 import sun.security.ssl.SSLExtension.SSLExtensionSpec;

    38 import sun.security.ssl.ServerHello.ServerHelloMessage;

    39 import sun.security.util.HexDumpEncoder;

    40 

    41 public class CookieExtension {

    42     static final HandshakeProducer chNetworkProducer =

    43             new CHCookieProducer();

    44     static final ExtensionConsumer chOnLoadConsumer =

    45             new CHCookieConsumer();

    46     static final HandshakeConsumer chOnTradeConsumer =

    47             new CHCookieUpdate();

    48 

    49     static final HandshakeProducer hrrNetworkProducer =

    50             new HRRCookieProducer();

    51     static final ExtensionConsumer hrrOnLoadConsumer =

    52             new HRRCookieConsumer();

    53 

    54     static final HandshakeProducer hrrNetworkReproducer =

    55             new HRRCookieReproducer();

    56 

    57     static final CookieStringizer cookieStringizer =

    58             new CookieStringizer();

    59 

    60     /**

    61      * The "cookie" extension.

    62      */

    63     static class CookieSpec implements SSLExtensionSpec {

    64         final byte[] cookie;

    65 

    66         private CookieSpec(ByteBuffer m) throws IOException {

    67             // opaque cookie<1..2^16-1>;

    68             if (m.remaining() < 3) {

    69                 throw new SSLProtocolException(

    70                     "Invalid cookie extension: insufficient data");

    71             }

    72 

    73             this.cookie = Record.getBytes16(m);

    74         }

    75 

    76         @Override

    77         public String toString() {

    78             MessageFormat messageFormat = new MessageFormat(

    79                     "\"cookie\": '{'\n" +

    80                     "{0}\n" +

    81                     "'}',", Locale.ENGLISH);

    82             HexDumpEncoder hexEncoder = new HexDumpEncoder();

    83             Object[] messageFields = {

    84                 Utilities.indent(hexEncoder.encode(cookie))

    85             };

    86 

    87             return messageFormat.format(messageFields);

    88         }

    89     }

    90 

    91     private static final class CookieStringizer implements SSLStringizer {

    92         @Override

    93         public String toString(ByteBuffer buffer) {

    94             try {

    95                 return (new CookieSpec(buffer)).toString();

    96             } catch (IOException ioe) {

    97                 // For debug logging only, so please swallow exceptions.

    98                 return ioe.getMessage();

    99             }

   100         }

   101     }

   102 

   103     private static final

   104             class CHCookieProducer implements HandshakeProducer {

   105         // Prevent instantiation of this class.

   106         private CHCookieProducer() {

   107             // blank

   108         }

   109 

   110         @Override

   111         public byte[] produce(ConnectionContext context,

   112                 HandshakeMessage message) throws IOException {

   113             ClientHandshakeContext chc = (ClientHandshakeContext) context;

   114 

   115             // Is it a supported and enabled extension?

   116             if (!chc.sslConfig.isAvailable(SSLExtension.CH_COOKIE)) {

   117                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   118                     SSLLogger.fine(

   119                             "Ignore unavailable cookie extension");

   120                 }

   121                 return null;

   122             }

   123 

   124             // response to an HelloRetryRequest cookie

   125             CookieSpec spec = (CookieSpec)chc.handshakeExtensions.get(

   126                     SSLExtension.HRR_COOKIE);

   127 

   128             if (spec != null &&

   129                     spec.cookie != null && spec.cookie.length != 0) {

   130                 byte[] extData = new byte[spec.cookie.length + 2];

   131                 ByteBuffer m = ByteBuffer.wrap(extData);

   132                 Record.putBytes16(m, spec.cookie);

   133                 return extData;

   134             }

   135 

   136             return null;

   137         }

   138     }

   139 

   140     private static final

   141             class CHCookieConsumer implements ExtensionConsumer {

   142         // Prevent instantiation of this class.

   143         private CHCookieConsumer() {

   144             // blank

   145         }

   146 

   147         @Override

   148         public void consume(ConnectionContext context,

   149             HandshakeMessage message, ByteBuffer buffer) throws IOException {

   150             // The consuming happens in server side only.

   151             ServerHandshakeContext shc = (ServerHandshakeContext)context;

   152 

   153             // Is it a supported and enabled extension?

   154             if (!shc.sslConfig.isAvailable(SSLExtension.CH_COOKIE)) {

   155                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   156                     SSLLogger.fine(

   157                             "Ignore unavailable cookie extension");

   158                 }

   159                 return;     // ignore the extension

   160             }

   161 

   162             CookieSpec spec;

   163             try {

   164                 spec = new CookieSpec(buffer);

   165             } catch (IOException ioe) {

   166                 shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, ioe);

   167                 return;     // fatal() always throws, make the compiler happy.

   168             }

   169 

   170             shc.handshakeExtensions.put(SSLExtension.CH_COOKIE, spec);

   171 

   172             // No impact on session resumption.

   173             //

   174             // Note that the protocol version negotiation happens before the

   175             // session resumption negotiation.  And the session resumption

   176             // negotiation depends on the negotiated protocol version.

   177         }

   178     }

   179 

   180     private static final

   181             class CHCookieUpdate implements HandshakeConsumer {

   182         // Prevent instantiation of this class.

   183         private CHCookieUpdate() {

   184             // blank

   185         }

   186 

   187         @Override

   188         public void consume(ConnectionContext context,

   189                 HandshakeMessage message) throws IOException {

   190             // The consuming happens in server side only.

   191             ServerHandshakeContext shc = (ServerHandshakeContext)context;

   192             ClientHelloMessage clientHello = (ClientHelloMessage)message;

   193 

   194             CookieSpec spec = (CookieSpec)

   195                     shc.handshakeExtensions.get(SSLExtension.CH_COOKIE);

   196             if (spec == null) {

   197                 // Ignore, no "cookie" extension requested.

   198                 return;

   199             }

   200 

   201             HelloCookieManager hcm =

   202                 shc.sslContext.getHelloCookieManager(shc.negotiatedProtocol);

   203             if (!hcm.isCookieValid(shc, clientHello, spec.cookie)) {

   204                 shc.conContext.fatal(Alert.UNEXPECTED_MESSAGE,

   205                         "unrecognized cookie");

   206                 return;     // fatal() always throws, make the compiler happy.

   207             }

   208         }

   209     }

   210 

   211     private static final

   212             class HRRCookieProducer implements HandshakeProducer {

   213         // Prevent instantiation of this class.

   214         private HRRCookieProducer() {

   215             // blank

   216         }

   217 

   218         @Override

   219         public byte[] produce(ConnectionContext context,

   220                 HandshakeMessage message) throws IOException {

   221             // The producing happens in server side only.

   222             ServerHandshakeContext shc = (ServerHandshakeContext)context;

   223             ServerHelloMessage hrrm = (ServerHelloMessage)message;

   224 

   225             // Is it a supported and enabled extension?

   226             if (!shc.sslConfig.isAvailable(SSLExtension.HRR_COOKIE)) {

   227                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   228                     SSLLogger.fine(

   229                             "Ignore unavailable cookie extension");

   230                 }

   231                 return null;

   232             }

   233 

   234             HelloCookieManager hcm =

   235                 shc.sslContext.getHelloCookieManager(shc.negotiatedProtocol);

   236 

   237             byte[] cookie = hcm.createCookie(shc, hrrm.clientHello);

   238 

   239             byte[] extData = new byte[cookie.length + 2];

   240             ByteBuffer m = ByteBuffer.wrap(extData);

   241             Record.putBytes16(m, cookie);

   242 

   243             return extData;

   244         }

   245     }

   246 

   247     private static final

   248             class HRRCookieConsumer implements ExtensionConsumer {

   249         // Prevent instantiation of this class.

   250         private HRRCookieConsumer() {

   251             // blank

   252         }

   253 

   254         @Override

   255         public void consume(ConnectionContext context,

   256             HandshakeMessage message, ByteBuffer buffer) throws IOException {

   257             // The consuming happens in client side only.

   258             ClientHandshakeContext chc = (ClientHandshakeContext)context;

   259 

   260             // Is it a supported and enabled extension?

   261             if (!chc.sslConfig.isAvailable(SSLExtension.HRR_COOKIE)) {

   262                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   263                     SSLLogger.fine(

   264                             "Ignore unavailable cookie extension");

   265                 }

   266                 return;     // ignore the extension

   267             }

   268 

   269             CookieSpec spec;

   270             try {

   271                 spec = new CookieSpec(buffer);

   272             } catch (IOException ioe) {

   273                 chc.conContext.fatal(Alert.UNEXPECTED_MESSAGE, ioe);

   274                 return;     // fatal() always throws, make the compiler happy.

   275             }

   276 

   277             chc.handshakeExtensions.put(SSLExtension.HRR_COOKIE, spec);

   278         }

   279     }

   280 

   281     private static final

   282             class HRRCookieReproducer implements HandshakeProducer {

   283         // Prevent instantiation of this class.

   284         private HRRCookieReproducer() {

   285             // blank

   286         }

   287 

   288         @Override

   289         public byte[] produce(ConnectionContext context,

   290                 HandshakeMessage message) throws IOException {

   291             // The producing happens in server side only.

   292             ServerHandshakeContext shc = (ServerHandshakeContext) context;

   293 

   294             // Is it a supported and enabled extension?

   295             if (!shc.sslConfig.isAvailable(SSLExtension.HRR_COOKIE)) {

   296                 if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   297                     SSLLogger.fine(

   298                             "Ignore unavailable cookie extension");

   299                 }

   300                 return null;

   301             }

   302 

   303             // copy of the ClientHello cookie

   304             CookieSpec spec = (CookieSpec)shc.handshakeExtensions.get(

   305                     SSLExtension.CH_COOKIE);

   306 

   307             if (spec != null &&

   308                     spec.cookie != null && spec.cookie.length != 0) {

   309                 byte[] extData = new byte[spec.cookie.length + 2];

   310                 ByteBuffer m = ByteBuffer.wrap(extData);

   311                 Record.putBytes16(m, spec.cookie);

   312                 return extData;

   313             }

   314 

   315             return null;

   316         }

   317     }

   318 }