1 /*

     2  * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.IOException;

    29 import java.nio.ByteBuffer;

    30 import java.security.GeneralSecurityException;

    31 import java.text.MessageFormat;

    32 import java.util.Locale;

    33 

    34 import sun.security.ssl.SSLHandshake.HandshakeMessage;

    35 import sun.security.ssl.SSLCipher.SSLReadCipher;

    36 import sun.security.ssl.SSLCipher.SSLWriteCipher;

    37 

    38 import javax.crypto.SecretKey;

    39 import javax.crypto.spec.IvParameterSpec;

    40 

    41 /**

    42  * Pack of the KeyUpdate handshake message.

    43  */

    44 final class KeyUpdate {

    45     static final SSLProducer kickstartProducer =

    46         new KeyUpdateKickstartProducer();

    47 

    48     static final SSLConsumer handshakeConsumer =

    49         new KeyUpdateConsumer();

    50     static final HandshakeProducer handshakeProducer =

    51         new KeyUpdateProducer();

    52 

    53     /**

    54      * The KeyUpdate handshake message.

    55      *

    56      * The KeyUpdate handshake message is used to indicate that the sender is

    57      * updating its sending cryptographic keys.

    58      *

    59      *       enum {

    60      *           update_not_requested(0), update_requested(1), (255)

    61      *       } KeyUpdateRequest;

    62      *

    63      *       struct {

    64      *           KeyUpdateRequest request_update;

    65      *       } KeyUpdate;

    66      */

    67     static final class KeyUpdateMessage extends HandshakeMessage {

    68         private final KeyUpdateRequest status;

    69 

    70         KeyUpdateMessage(PostHandshakeContext context,

    71                 KeyUpdateRequest status) {

    72             super(context);

    73             this.status = status;

    74         }

    75 

    76         KeyUpdateMessage(PostHandshakeContext context,

    77                 ByteBuffer m) throws IOException {

    78             super(context);

    79 

    80             if (m.remaining() != 1) {

    81                 context.conContext.fatal(Alert.ILLEGAL_PARAMETER,

    82                         "KeyUpdate has an unexpected length of "+

    83                         m.remaining());

    84             }

    85 

    86             byte request = m.get();

    87             this.status = KeyUpdateRequest.valueOf(request);

    88             if (status == null) {

    89                 context.conContext.fatal(Alert.ILLEGAL_PARAMETER,

    90                         "Invalid KeyUpdate message value: " +

    91                         KeyUpdateRequest.nameOf(request));

    92             }

    93         }

    94 

    95         @Override

    96         public SSLHandshake handshakeType() {

    97             return SSLHandshake.KEY_UPDATE;

    98         }

    99 

   100         @Override

   101         public int messageLength() {

   102             // one byte enum

   103             return 1;

   104         }

   105 

   106         @Override

   107         public void send(HandshakeOutStream s) throws IOException {

   108             s.putInt8(status.id);

   109         }

   110 

   111         @Override

   112         public String toString() {

   113             MessageFormat messageFormat = new MessageFormat(

   114                     "\"KeyUpdate\": '{'\n" +

   115                     "  \"request_update\": {0}\n" +

   116                     "'}'",

   117                     Locale.ENGLISH);

   118 

   119             Object[] messageFields = {

   120                 status.name

   121             };

   122 

   123             return messageFormat.format(messageFields);

   124         }

   125     }

   126 

   127     enum KeyUpdateRequest {

   128         NOTREQUESTED        ((byte)0, "update_not_requested"),

   129         REQUESTED           ((byte)1, "update_requested");

   130 

   131         final byte id;

   132         final String name;

   133 

   134         private KeyUpdateRequest(byte id, String name) {

   135             this.id = id;

   136             this.name = name;

   137         }

   138 

   139         static KeyUpdateRequest valueOf(byte id) {

   140             for (KeyUpdateRequest kur : KeyUpdateRequest.values()) {

   141                 if (kur.id == id) {

   142                     return kur;

   143                 }

   144             }

   145 

   146             return null;

   147         }

   148 

   149         static String nameOf(byte id) {

   150             for (KeyUpdateRequest kur : KeyUpdateRequest.values()) {

   151                 if (kur.id == id) {

   152                     return kur.name;

   153                 }

   154             }

   155 

   156             return "<UNKNOWN KeyUpdateRequest TYPE: " + (id & 0x0FF) + ">";

   157         }

   158     }

   159 

   160     private static final

   161             class KeyUpdateKickstartProducer implements SSLProducer {

   162         // Prevent instantiation of this class.

   163         private KeyUpdateKickstartProducer() {

   164             // blank

   165         }

   166 

   167         // Produce kickstart handshake message.

   168         @Override

   169         public byte[] produce(ConnectionContext context) throws IOException {

   170             PostHandshakeContext hc = (PostHandshakeContext)context;

   171             return handshakeProducer.produce(context,

   172                     new KeyUpdateMessage(hc, KeyUpdateRequest.REQUESTED));

   173         }

   174     }

   175 

   176     /**

   177      * The "KeyUpdate" handshake message consumer.

   178      */

   179     private static final class KeyUpdateConsumer implements SSLConsumer {

   180         // Prevent instantiation of this class.

   181         private KeyUpdateConsumer() {

   182             // blank

   183         }

   184 

   185         @Override

   186         public void consume(ConnectionContext context,

   187                 ByteBuffer message) throws IOException {

   188             // The consuming happens in client side only.

   189             PostHandshakeContext hc = (PostHandshakeContext)context;

   190             KeyUpdateMessage km = new KeyUpdateMessage(hc, message);

   191             if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   192                 SSLLogger.fine(

   193                         "Consuming KeyUpdate post-handshake message", km);

   194             }

   195 

   196             // Update read key and IV.

   197             SSLTrafficKeyDerivation kdg =

   198                 SSLTrafficKeyDerivation.valueOf(hc.conContext.protocolVersion);

   199             if (kdg == null) {

   200                 // unlikely

   201                 hc.conContext.fatal(Alert.INTERNAL_ERROR,

   202                         "Not supported key derivation: " +

   203                                 hc.conContext.protocolVersion);

   204                 return;

   205             }

   206 

   207             SSLKeyDerivation skd = kdg.createKeyDerivation(hc,

   208                     hc.conContext.inputRecord.readCipher.baseSecret);

   209             if (skd == null) {

   210                 // unlikely

   211                 hc.conContext.fatal(Alert.INTERNAL_ERROR, "no key derivation");

   212                 return;

   213             }

   214 

   215             SecretKey nplus1 = skd.deriveKey("TlsUpdateNplus1", null);

   216             SSLKeyDerivation kd = kdg.createKeyDerivation(hc, nplus1);

   217             SecretKey key = kd.deriveKey("TlsKey", null);

   218             IvParameterSpec ivSpec = new IvParameterSpec(

   219                     kd.deriveKey("TlsIv", null).getEncoded());

   220             try {

   221                 SSLReadCipher rc =

   222                     hc.negotiatedCipherSuite.bulkCipher.createReadCipher(

   223                         Authenticator.valueOf(hc.conContext.protocolVersion),

   224                         hc.conContext.protocolVersion, key, ivSpec,

   225                         hc.sslContext.getSecureRandom());

   226                 hc.conContext.inputRecord.changeReadCiphers(rc);

   227                 hc.conContext.inputRecord.readCipher.baseSecret = nplus1;

   228                 if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

   229                     SSLLogger.fine("KeyUpdate: read key updated");

   230                 }

   231             } catch (GeneralSecurityException gse) {

   232                 hc.conContext.fatal(Alert.INTERNAL_ERROR,

   233                         "Failure to derive read secrets", gse);

   234                 return;

   235             }

   236 

   237             if (km.status == KeyUpdateRequest.REQUESTED) {

   238                 // Update the write key and IV.

   239                 handshakeProducer.produce(hc,

   240                     new KeyUpdateMessage(hc, KeyUpdateRequest.NOTREQUESTED));

   241                 return;

   242             }

   243 

   244             // clean handshake context

   245             hc.conContext.finishPostHandshake();

   246         }

   247     }

   248 

   249     /**

   250      * The "KeyUpdate" handshake message producer.

   251      */

   252     private static final class KeyUpdateProducer implements HandshakeProducer {

   253         // Prevent instantiation of this class.

   254         private KeyUpdateProducer() {

   255             // blank

   256         }

   257 

   258         @Override

   259         public byte[] produce(ConnectionContext context,

   260                 HandshakeMessage message) throws IOException {

   261             // The producing happens in server side only.

   262             PostHandshakeContext hc = (PostHandshakeContext)context;

   263             KeyUpdateMessage km = (KeyUpdateMessage)message;

   264             if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

   265                 SSLLogger.fine(

   266                         "Produced KeyUpdate post-handshake message", km);

   267             }

   268 

   269             // Update the write key and IV.

   270             SSLTrafficKeyDerivation kdg =

   271                 SSLTrafficKeyDerivation.valueOf(hc.conContext.protocolVersion);

   272             if (kdg == null) {

   273                 // unlikely

   274                 hc.conContext.fatal(Alert.INTERNAL_ERROR,

   275                         "Not supported key derivation: " +

   276                                 hc.conContext.protocolVersion);

   277                 return null;

   278             }

   279 

   280             SSLKeyDerivation skd = kdg.createKeyDerivation(hc,

   281                     hc.conContext.outputRecord.writeCipher.baseSecret);

   282             if (skd == null) {

   283                 // unlikely

   284                 hc.conContext.fatal(Alert.INTERNAL_ERROR, "no key derivation");

   285                 return null;

   286             }

   287 

   288             SecretKey nplus1 = skd.deriveKey("TlsUpdateNplus1", null);

   289             SSLKeyDerivation kd = kdg.createKeyDerivation(hc, nplus1);

   290             SecretKey key = kd.deriveKey("TlsKey", null);

   291             IvParameterSpec ivSpec = new IvParameterSpec(

   292                     kd.deriveKey("TlsIv", null).getEncoded());

   293 

   294             SSLWriteCipher wc;

   295             try {

   296                 wc = hc.negotiatedCipherSuite.bulkCipher.createWriteCipher(

   297                         Authenticator.valueOf(hc.conContext.protocolVersion),

   298                         hc.conContext.protocolVersion, key, ivSpec,

   299                         hc.sslContext.getSecureRandom());

   300             } catch (GeneralSecurityException gse) {

   301                 hc.conContext.fatal(Alert.INTERNAL_ERROR,

   302                         "Failure to derive write secrets", gse);

   303                 return null;

   304             }

   305 

   306             // Output the handshake message.

   307             km.write(hc.handshakeOutput);

   308             hc.handshakeOutput.flush();

   309 

   310             // change write cipher

   311             hc.conContext.outputRecord.changeWriteCiphers(wc, false);

   312             hc.conContext.outputRecord.writeCipher.baseSecret = nplus1;

   313             if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {

   314                 SSLLogger.fine("KeyUpdate: write key updated");

   315             }

   316 

   317             // clean handshake context

   318             hc.conContext.finishPostHandshake();

   319 

   320             // The handshake message has been delivered.

   321             return null;

   322         }

   323     }

   324 }