1 /*

     2  * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 

    27 package sun.security.ssl;

    28 

    29 import java.io.*;

    30 import java.util.*;

    31 import java.util.concurrent.TimeUnit;

    32 import java.security.*;

    33 import java.security.cert.*;

    34 import java.security.interfaces.*;

    35 import java.security.spec.ECParameterSpec;

    36 import java.math.BigInteger;

    37 import java.util.function.BiFunction;

    38 

    39 import javax.crypto.SecretKey;

    40 import javax.net.ssl.*;

    41 

    42 import sun.security.action.GetLongAction;

    43 import sun.security.util.KeyUtil;

    44 import sun.security.util.LegacyAlgorithmConstraints;

    45 import sun.security.action.GetPropertyAction;

    46 import sun.security.ssl.HandshakeMessage.*;

    47 import sun.security.ssl.CipherSuite.*;

    48 import sun.security.ssl.SignatureAndHashAlgorithm.*;

    49 import static sun.security.ssl.CipherSuite.KeyExchange.*;

    50 

    51 /**

    52  * ServerHandshaker does the protocol handshaking from the point

    53  * of view of a server.  It is driven asychronously by handshake messages

    54  * as delivered by the parent Handshaker class, and also uses

    55  * common functionality (e.g. key generation) that is provided there.

    56  *

    57  * @author David Brownell

    58  */

    59 final class ServerHandshaker extends Handshaker {

    60 

    61     // The default number of milliseconds the handshaker will wait for

    62     // revocation status responses.

    63     private static final long DEFAULT_STATUS_RESP_DELAY = 5000;

    64 

    65     // is the server going to require the client to authenticate?

    66     private ClientAuthType      doClientAuth;

    67 

    68     // our authentication info

    69     private X509Certificate[]   certs;

    70     private PrivateKey          privateKey;

    71 

    72     private Object              serviceCreds;

    73 

    74     // flag to check for clientCertificateVerify message

    75     private boolean             needClientVerify = false;

    76 

    77     /*

    78      * For exportable ciphersuites using non-exportable key sizes, we use

    79      * ephemeral RSA keys. We could also do anonymous RSA in the same way

    80      * but there are no such ciphersuites currently defined.

    81      */

    82     private PrivateKey          tempPrivateKey;

    83     private PublicKey           tempPublicKey;

    84 

    85     /*

    86      * For anonymous and ephemeral Diffie-Hellman key exchange, we use

    87      * ephemeral Diffie-Hellman keys.

    88      */

    89     private DHCrypt dh;

    90 

    91     // Helper for ECDH based key exchanges

    92     private ECDHCrypt ecdh;

    93 

    94     // version request by the client in its ClientHello

    95     // we remember it for the RSA premaster secret version check

    96     private ProtocolVersion clientRequestedVersion;

    97 

    98     // client supported elliptic curves

    99     private SupportedGroupsExtension requestedGroups;

   100 

   101     // the preferable signature algorithm used by ServerKeyExchange message

   102     SignatureAndHashAlgorithm preferableSignatureAlgorithm;

   103 

   104     // Flag to use smart ephemeral DH key which size matches the corresponding

   105     // authentication key

   106     private static final boolean useSmartEphemeralDHKeys;

   107 

   108     // Flag to use legacy ephemeral DH key which size is 512 bits for

   109     // exportable cipher suites, and 768 bits for others

   110     private static final boolean useLegacyEphemeralDHKeys;

   111 

   112     // The customized ephemeral DH key size for non-exportable cipher suites.

   113     private static final int customizedDHKeySize;

   114 

   115     // legacy algorithm constraints

   116     private static final AlgorithmConstraints legacyAlgorithmConstraints =

   117             new LegacyAlgorithmConstraints(

   118                     LegacyAlgorithmConstraints.PROPERTY_TLS_LEGACY_ALGS,

   119                     new SSLAlgorithmDecomposer());

   120 

   121     private long statusRespTimeout;

   122 

   123     static {

   124         String property = GetPropertyAction

   125                 .privilegedGetProperty("jdk.tls.ephemeralDHKeySize");

   126         if (property == null || property.length() == 0) {

   127             useLegacyEphemeralDHKeys = false;

   128             useSmartEphemeralDHKeys = false;

   129             customizedDHKeySize = -1;

   130         } else if ("matched".equals(property)) {

   131             useLegacyEphemeralDHKeys = false;

   132             useSmartEphemeralDHKeys = true;

   133             customizedDHKeySize = -1;

   134         } else if ("legacy".equals(property)) {

   135             useLegacyEphemeralDHKeys = true;

   136             useSmartEphemeralDHKeys = false;

   137             customizedDHKeySize = -1;

   138         } else {

   139             useLegacyEphemeralDHKeys = false;

   140             useSmartEphemeralDHKeys = false;

   141 

   142             try {

   143                 // DH parameter generation can be extremely slow, best to

   144                 // use one of the supported pre-computed DH parameters

   145                 // (see DHCrypt class).

   146                 customizedDHKeySize = Integer.parseUnsignedInt(property);

   147                 if (customizedDHKeySize < 1024 || customizedDHKeySize > 8192 ||

   148                         (customizedDHKeySize & 0x3f) != 0) {

   149                     throw new IllegalArgumentException(

   150                         "Unsupported customized DH key size: " +

   151                         customizedDHKeySize + ". " +

   152                         "The key size must be multiple of 64, " +

   153                         "and can only range from 1024 to 8192 (inclusive)");

   154                 }

   155             } catch (NumberFormatException nfe) {

   156                 throw new IllegalArgumentException(

   157                         "Invalid system property jdk.tls.ephemeralDHKeySize");

   158             }

   159         }

   160     }

   161 

   162     /*

   163      * Constructor ... use the keys found in the auth context.

   164      */

   165     ServerHandshaker(SSLSocketImpl socket, SSLContextImpl context,

   166             ProtocolList enabledProtocols, ClientAuthType clientAuth,

   167             ProtocolVersion activeProtocolVersion, boolean isInitialHandshake,

   168             boolean secureRenegotiation,

   169             byte[] clientVerifyData, byte[] serverVerifyData) {

   170 

   171         super(socket, context, enabledProtocols,

   172                 (clientAuth != ClientAuthType.CLIENT_AUTH_NONE), false,

   173                 activeProtocolVersion, isInitialHandshake, secureRenegotiation,

   174                 clientVerifyData, serverVerifyData);

   175         doClientAuth = clientAuth;

   176         statusRespTimeout = AccessController.doPrivileged(

   177                     new GetLongAction("jdk.tls.stapling.responseTimeout",

   178                         DEFAULT_STATUS_RESP_DELAY));

   179         statusRespTimeout = statusRespTimeout >= 0 ? statusRespTimeout :

   180                 DEFAULT_STATUS_RESP_DELAY;

   181     }

   182 

   183     /*

   184      * Constructor ... use the keys found in the auth context.

   185      */

   186     ServerHandshaker(SSLEngineImpl engine, SSLContextImpl context,

   187             ProtocolList enabledProtocols, ClientAuthType clientAuth,

   188             ProtocolVersion activeProtocolVersion,

   189             boolean isInitialHandshake, boolean secureRenegotiation,

   190             byte[] clientVerifyData, byte[] serverVerifyData,

   191             boolean isDTLS) {

   192 

   193         super(engine, context, enabledProtocols,

   194                 (clientAuth != ClientAuthType.CLIENT_AUTH_NONE), false,

   195                 activeProtocolVersion, isInitialHandshake, secureRenegotiation,

   196                 clientVerifyData, serverVerifyData, isDTLS);

   197         doClientAuth = clientAuth;

   198         statusRespTimeout = AccessController.doPrivileged(

   199                     new GetLongAction("jdk.tls.stapling.responseTimeout",

   200                         DEFAULT_STATUS_RESP_DELAY));

   201         statusRespTimeout = statusRespTimeout >= 0 ? statusRespTimeout :

   202                 DEFAULT_STATUS_RESP_DELAY;

   203     }

   204 

   205     /*

   206      * As long as handshaking has not started, we can change

   207      * whether client authentication is required.  Otherwise,

   208      * we will need to wait for the next handshake.

   209      */

   210     void setClientAuth(ClientAuthType clientAuth) {

   211         doClientAuth = clientAuth;

   212     }

   213 

   214     /*

   215      * This routine handles all the server side handshake messages, one at

   216      * a time.  Given the message type (and in some cases the pending cipher

   217      * spec) it parses the type-specific message.  Then it calls a function

   218      * that handles that specific message.

   219      *

   220      * It updates the state machine as each message is processed, and writes

   221      * responses as needed using the connection in the constructor.

   222      */

   223     @Override

   224     void processMessage(byte type, int message_len)

   225             throws IOException {

   226 

   227         // check the handshake state

   228         handshakeState.check(type);

   229 

   230         switch (type) {

   231             case HandshakeMessage.ht_client_hello:

   232                 ClientHello ch = new ClientHello(input, message_len, isDTLS);

   233                 handshakeState.update(ch, resumingSession);

   234 

   235                 /*

   236                  * send it off for processing.

   237                  */

   238                 this.clientHello(ch);

   239                 break;

   240 

   241             case HandshakeMessage.ht_certificate:

   242                 if (doClientAuth == ClientAuthType.CLIENT_AUTH_NONE) {

   243                     fatalSE(Alerts.alert_unexpected_message,

   244                                 "client sent unsolicited cert chain");

   245                     // NOTREACHED

   246                 }

   247                 CertificateMsg certificateMsg = new CertificateMsg(input);

   248                 handshakeState.update(certificateMsg, resumingSession);

   249                 this.clientCertificate(certificateMsg);

   250                 break;

   251 

   252             case HandshakeMessage.ht_client_key_exchange:

   253                 SecretKey preMasterSecret;

   254                 switch (keyExchange) {

   255                 case K_RSA:

   256                 case K_RSA_EXPORT:

   257                     /*

   258                      * The client's pre-master secret is decrypted using

   259                      * either the server's normal private RSA key, or the

   260                      * temporary one used for non-export or signing-only

   261                      * certificates/keys.

   262                      */

   263                     RSAClientKeyExchange pms = new RSAClientKeyExchange(

   264                             protocolVersion, clientRequestedVersion,

   265                             sslContext.getSecureRandom(), input,

   266                             message_len, privateKey);

   267                     handshakeState.update(pms, resumingSession);

   268                     preMasterSecret = this.clientKeyExchange(pms);

   269                     break;

   270                 case K_DHE_RSA:

   271                 case K_DHE_DSS:

   272                 case K_DH_ANON:

   273                     /*

   274                      * The pre-master secret is derived using the normal

   275                      * Diffie-Hellman calculation.   Note that the main

   276                      * protocol difference in these five flavors is in how

   277                      * the ServerKeyExchange message was constructed!

   278                      */

   279                     DHClientKeyExchange dhcke = new DHClientKeyExchange(input);

   280                     handshakeState.update(dhcke, resumingSession);

   281                     preMasterSecret = this.clientKeyExchange(dhcke);

   282                     break;

   283                 case K_ECDH_RSA:

   284                 case K_ECDH_ECDSA:

   285                 case K_ECDHE_RSA:

   286                 case K_ECDHE_ECDSA:

   287                 case K_ECDH_ANON:

   288                     ECDHClientKeyExchange ecdhcke =

   289                                     new ECDHClientKeyExchange(input);

   290                     handshakeState.update(ecdhcke, resumingSession);

   291                     preMasterSecret = this.clientKeyExchange(ecdhcke);

   292                     break;

   293                 default:

   294                     ClientKeyExchangeService p =

   295                             ClientKeyExchangeService.find(keyExchange.name);

   296                     if (p == null) {

   297                         throw new SSLProtocolException

   298                                 ("Unrecognized key exchange: " + keyExchange);

   299                     }

   300                     byte[] encodedTicket = input.getBytes16();

   301                     input.getBytes16();

   302                     byte[] secret = input.getBytes16();

   303                     ClientKeyExchange cke = p.createServerExchange(protocolVersion,

   304                             clientRequestedVersion,

   305                             sslContext.getSecureRandom(),

   306                             encodedTicket,

   307                             secret,

   308                             this.getAccSE(), serviceCreds);

   309                     handshakeState.update(cke, resumingSession);

   310                     preMasterSecret = this.clientKeyExchange(cke);

   311                     break;

   312                 }

   313 

   314                 //

   315                 // All keys are calculated from the premaster secret

   316                 // and the exchanged nonces in the same way.

   317                 //

   318                 calculateKeys(preMasterSecret, clientRequestedVersion);

   319                 break;

   320 

   321             case HandshakeMessage.ht_certificate_verify:

   322                 CertificateVerify cvm =

   323                         new CertificateVerify(input,

   324                             getLocalSupportedSignAlgs(), protocolVersion);

   325                 handshakeState.update(cvm, resumingSession);

   326                 this.clientCertificateVerify(cvm);

   327 

   328                 break;

   329 

   330             case HandshakeMessage.ht_finished:

   331                 Finished cfm =

   332                     new Finished(protocolVersion, input, cipherSuite);

   333                 handshakeState.update(cfm, resumingSession);

   334                 this.clientFinished(cfm);

   335 

   336                 break;

   337 

   338             default:

   339                 throw new SSLProtocolException(

   340                         "Illegal server handshake msg, " + type);

   341         }

   342 

   343     }

   344 

   345 

   346     /*

   347      * ClientHello presents the server with a bunch of options, to which the

   348      * server replies with a ServerHello listing the ones which this session

   349      * will use.  If needed, it also writes its Certificate plus in some cases

   350      * a ServerKeyExchange message.  It may also write a CertificateRequest,

   351      * to elicit a client certificate.

   352      *

   353      * All these messages are terminated by a ServerHelloDone message.  In

   354      * most cases, all this can be sent in a single Record.

   355      */

   356     private void clientHello(ClientHello mesg) throws IOException {

   357         if (debug != null && Debug.isOn("handshake")) {

   358             mesg.print(System.out);

   359         }

   360 

   361         // Reject client initiated renegotiation?

   362         //

   363         // If server side should reject client-initiated renegotiation,

   364         // send an alert_handshake_failure fatal alert, not a no_renegotiation

   365         // warning alert (no_renegotiation must be a warning: RFC 2246).

   366         // no_renegotiation might seem more natural at first, but warnings

   367         // are not appropriate because the sending party does not know how

   368         // the receiving party will behave.  This state must be treated as

   369         // a fatal server condition.

   370         //

   371         // This will not have any impact on server initiated renegotiation.

   372         if (rejectClientInitiatedRenego && !isInitialHandshake &&

   373                 !serverHelloRequested) {

   374             fatalSE(Alerts.alert_handshake_failure,

   375                 "Client initiated renegotiation is not allowed");

   376         }

   377 

   378         // check the server name indication if required

   379         ServerNameExtension clientHelloSNIExt = (ServerNameExtension)

   380                     mesg.extensions.get(ExtensionType.EXT_SERVER_NAME);

   381         if (!sniMatchers.isEmpty()) {

   382             // we do not reject client without SNI extension

   383             if (clientHelloSNIExt != null &&

   384                         !clientHelloSNIExt.isMatched(sniMatchers)) {

   385                 fatalSE(Alerts.alert_unrecognized_name,

   386                     "Unrecognized server name indication");

   387             }

   388         }

   389 

   390         // Does the message include security renegotiation indication?

   391         boolean renegotiationIndicated = false;

   392 

   393         // check the TLS_EMPTY_RENEGOTIATION_INFO_SCSV

   394         CipherSuiteList cipherSuites = mesg.getCipherSuites();

   395         if (cipherSuites.contains(CipherSuite.C_SCSV)) {

   396             renegotiationIndicated = true;

   397             if (isInitialHandshake) {

   398                 secureRenegotiation = true;

   399             } else {

   400                 // abort the handshake with a fatal handshake_failure alert

   401                 if (secureRenegotiation) {

   402                     fatalSE(Alerts.alert_handshake_failure,

   403                         "The SCSV is present in a secure renegotiation");

   404                 } else {

   405                     fatalSE(Alerts.alert_handshake_failure,

   406                         "The SCSV is present in a insecure renegotiation");

   407                 }

   408             }

   409         }

   410 

   411         // check the "renegotiation_info" extension

   412         RenegotiationInfoExtension clientHelloRI = (RenegotiationInfoExtension)

   413                     mesg.extensions.get(ExtensionType.EXT_RENEGOTIATION_INFO);

   414         if (clientHelloRI != null) {

   415             renegotiationIndicated = true;

   416             if (isInitialHandshake) {

   417                 // verify the length of the "renegotiated_connection" field

   418                 if (!clientHelloRI.isEmpty()) {

   419                     // abort the handshake with a fatal handshake_failure alert

   420                     fatalSE(Alerts.alert_handshake_failure,

   421                         "The renegotiation_info field is not empty");

   422                 }

   423 

   424                 secureRenegotiation = true;

   425             } else {

   426                 if (!secureRenegotiation) {

   427                     // unexpected RI extension for insecure renegotiation,

   428                     // abort the handshake with a fatal handshake_failure alert

   429                     fatalSE(Alerts.alert_handshake_failure,

   430                         "The renegotiation_info is present in a insecure " +

   431                         "renegotiation");

   432                 }

   433 

   434                 // verify the client_verify_data value

   435                 if (!MessageDigest.isEqual(clientVerifyData,

   436                                 clientHelloRI.getRenegotiatedConnection())) {

   437                     fatalSE(Alerts.alert_handshake_failure,

   438                         "Incorrect verify data in ClientHello " +

   439                         "renegotiation_info message");

   440                 }

   441             }

   442         } else if (!isInitialHandshake && secureRenegotiation) {

   443            // if the connection's "secure_renegotiation" flag is set to TRUE

   444            // and the "renegotiation_info" extension is not present, abort

   445            // the handshake.

   446             fatalSE(Alerts.alert_handshake_failure,

   447                         "Inconsistent secure renegotiation indication");

   448         }

   449 

   450         // if there is no security renegotiation indication or the previous

   451         // handshake is insecure.

   452         if (!renegotiationIndicated || !secureRenegotiation) {

   453             if (isInitialHandshake) {

   454                 if (!allowLegacyHelloMessages) {

   455                     // abort the handshake with a fatal handshake_failure alert

   456                     fatalSE(Alerts.alert_handshake_failure,

   457                         "Failed to negotiate the use of secure renegotiation");

   458                 }

   459 

   460                 // continue with legacy ClientHello

   461                 if (debug != null && Debug.isOn("handshake")) {

   462                     System.out.println("Warning: No renegotiation " +

   463                         "indication in ClientHello, allow legacy ClientHello");

   464                 }

   465             } else if (!allowUnsafeRenegotiation) {

   466                 // abort the handshake

   467                 if (activeProtocolVersion.useTLS10PlusSpec()) {

   468                     // respond with a no_renegotiation warning

   469                     warningSE(Alerts.alert_no_renegotiation);

   470 

   471                     // invalidate the handshake so that the caller can

   472                     // dispose this object.

   473                     invalidated = true;

   474 

   475                     // If there is still unread block in the handshake

   476                     // input stream, it would be truncated with the disposal

   477                     // and the next handshake message will become incomplete.

   478                     //

   479                     // However, according to SSL/TLS specifications, no more

   480                     // handshake message could immediately follow ClientHello

   481                     // or HelloRequest. But in case of any improper messages,

   482                     // we'd better check to ensure there is no remaining bytes

   483                     // in the handshake input stream.

   484                     if (input.available() > 0) {

   485                         fatalSE(Alerts.alert_unexpected_message,

   486                             "ClientHello followed by an unexpected  " +

   487                             "handshake message");

   488                     }

   489 

   490                     return;

   491                 } else {

   492                     // For SSLv3, send the handshake_failure fatal error.

   493                     // Note that SSLv3 does not define a no_renegotiation

   494                     // alert like TLSv1. However we cannot ignore the message

   495                     // simply, otherwise the other side was waiting for a

   496                     // response that would never come.

   497                     fatalSE(Alerts.alert_handshake_failure,

   498                         "Renegotiation is not allowed");

   499                 }

   500             } else {   // !isInitialHandshake && allowUnsafeRenegotiation

   501                 // continue with unsafe renegotiation.

   502                 if (debug != null && Debug.isOn("handshake")) {

   503                     System.out.println(

   504                             "Warning: continue with insecure renegotiation");

   505                 }

   506             }

   507         }

   508 

   509         // check the "max_fragment_length" extension

   510         MaxFragmentLengthExtension maxFragLenExt = (MaxFragmentLengthExtension)

   511                     mesg.extensions.get(ExtensionType.EXT_MAX_FRAGMENT_LENGTH);

   512         if ((maxFragLenExt != null) && (maximumPacketSize != 0)) {

   513             // Not yet consider the impact of IV/MAC/padding.

   514             int estimatedMaxFragSize = maximumPacketSize;

   515             if (isDTLS) {

   516                 estimatedMaxFragSize -= DTLSRecord.headerSize;

   517             } else {

   518                 estimatedMaxFragSize -= SSLRecord.headerSize;

   519             }

   520 

   521             if (maxFragLenExt.getMaxFragLen() > estimatedMaxFragSize) {

   522                 // For better interoperability, abort the maximum fragment

   523                 // length negotiation, rather than terminate the connection

   524                 // with a fatal alert.

   525                 maxFragLenExt = null;

   526 

   527                 // fatalSE(Alerts.alert_illegal_parameter,

   528                 //         "Not an allowed max_fragment_length value");

   529             }

   530         }

   531 

   532         // check out the "extended_master_secret" extension

   533         if (useExtendedMasterSecret) {

   534             ExtendedMasterSecretExtension extendedMasterSecretExtension =

   535                     (ExtendedMasterSecretExtension)mesg.extensions.get(

   536                             ExtensionType.EXT_EXTENDED_MASTER_SECRET);

   537             if (extendedMasterSecretExtension != null) {

   538                 requestedToUseEMS = true;

   539             } else if (mesg.protocolVersion.useTLS10PlusSpec()) {

   540                 if (!allowLegacyMasterSecret) {

   541                     // For full handshake, if the server receives a ClientHello

   542                     // without the extension, it SHOULD abort the handshake if

   543                     // it does not wish to interoperate with legacy clients.

   544                     //

   545                     // As if extended master extension is required for full

   546                     // handshake, it MUST be used in abbreviated handshake too.

   547                     fatalSE(Alerts.alert_handshake_failure,

   548                         "Extended Master Secret extension is required");

   549                 }

   550             }

   551         }

   552 

   553         // check the ALPN extension

   554         ALPNExtension clientHelloALPN = (ALPNExtension)

   555             mesg.extensions.get(ExtensionType.EXT_ALPN);

   556 

   557         // Use the application protocol callback when provided.

   558         // Otherwise use the local list of application protocols.

   559         boolean hasAPCallback =

   560             ((engine != null && appProtocolSelectorSSLEngine != null) ||

   561                 (conn != null && appProtocolSelectorSSLSocket != null));

   562 

   563         if (!hasAPCallback) {

   564             if ((clientHelloALPN != null) && (localApl.length > 0)) {

   565 

   566                 // Intersect the requested and the locally supported,

   567                 // and save for later.

   568                 String negotiatedValue = null;

   569                 List<String> protocols = clientHelloALPN.getPeerAPs();

   570 

   571                 // Use server preference order

   572                 for (String ap : localApl) {

   573                     if (protocols.contains(ap)) {

   574                         negotiatedValue = ap;

   575                         break;

   576                     }

   577                 }

   578 

   579                 if (negotiatedValue == null) {

   580                     fatalSE(Alerts.alert_no_application_protocol,

   581                         new SSLHandshakeException(

   582                             "No matching ALPN values"));

   583                 }

   584                 applicationProtocol = negotiatedValue;

   585 

   586             } else {

   587                 applicationProtocol = "";

   588             }

   589         }  // Otherwise, applicationProtocol will be set by the callback.

   590 

   591         session = null; // forget about the current session

   592         //

   593         // Here we go down either of two paths:  (a) the fast one, where

   594         // the client's asked to rejoin an existing session, and the server

   595         // permits this; (b) the other one, where a new session is created.

   596         //

   597         if (mesg.sessionId.length() != 0) {

   598             // client is trying to resume a session, let's see...

   599 

   600             SSLSessionImpl previous = ((SSLSessionContextImpl)sslContext

   601                         .engineGetServerSessionContext())

   602                         .get(mesg.sessionId.getId());

   603             //

   604             // Check if we can use the fast path, resuming a session.  We

   605             // can do so iff we have a valid record for that session, and

   606             // the cipher suite for that session was on the list which the

   607             // client requested, and if we're not forgetting any needed

   608             // authentication on the part of the client.

   609             //

   610             if (previous != null) {

   611                 resumingSession = previous.isRejoinable();

   612 

   613                 if (resumingSession) {

   614                     ProtocolVersion oldVersion = previous.getProtocolVersion();

   615                     // cannot resume session with different version

   616                     if (oldVersion != mesg.protocolVersion) {

   617                         resumingSession = false;

   618                     }

   619                 }

   620 

   621                 if (resumingSession && useExtendedMasterSecret) {

   622                     if (requestedToUseEMS &&

   623                             !previous.getUseExtendedMasterSecret()) {

   624                         // For abbreviated handshake request, If the original

   625                         // session did not use the "extended_master_secret"

   626                         // extension but the new ClientHello contains the

   627                         // extension, then the server MUST NOT perform the

   628                         // abbreviated handshake.  Instead, it SHOULD continue

   629                         // with a full handshake.

   630                         resumingSession = false;

   631                     } else if (!requestedToUseEMS &&

   632                             previous.getUseExtendedMasterSecret()) {

   633                         // For abbreviated handshake request, if the original

   634                         // session used the "extended_master_secret" extension

   635                         // but the new ClientHello does not contain it, the

   636                         // server MUST abort the abbreviated handshake.

   637                         fatalSE(Alerts.alert_handshake_failure,

   638                                 "Missing Extended Master Secret extension " +

   639                                 "on session resumption");

   640                     } else if (!requestedToUseEMS &&

   641                             !previous.getUseExtendedMasterSecret()) {

   642                         // For abbreviated handshake request, if neither the

   643                         // original session nor the new ClientHello uses the

   644                         // extension, the server SHOULD abort the handshake.

   645                         if (!allowLegacyResumption) {

   646                             fatalSE(Alerts.alert_handshake_failure,

   647                                 "Missing Extended Master Secret extension " +

   648                                 "on session resumption");

   649                         } else {  // Otherwise, continue with a full handshake.

   650                             resumingSession = false;

   651                         }

   652                     }

   653                 }

   654 

   655                 // cannot resume session with different server name indication

   656                 if (resumingSession) {

   657                     List<SNIServerName> oldServerNames =

   658                             previous.getRequestedServerNames();

   659                     if (clientHelloSNIExt != null) {

   660                         if (!clientHelloSNIExt.isIdentical(oldServerNames)) {

   661                             resumingSession = false;

   662                         }

   663                     } else if (!oldServerNames.isEmpty()) {

   664                         resumingSession = false;

   665                     }

   666 

   667                     if (!resumingSession &&

   668                             debug != null && Debug.isOn("handshake")) {

   669                         System.out.println(

   670                             "The requested server name indication " +

   671                             "is not identical to the previous one");

   672                     }

   673                 }

   674 

   675                 if (resumingSession &&

   676                         (doClientAuth == ClientAuthType.CLIENT_AUTH_REQUIRED)) {

   677                     try {

   678                         previous.getPeerPrincipal();

   679                     } catch (SSLPeerUnverifiedException e) {

   680                         resumingSession = false;

   681                     }

   682                 }

   683 

   684                 // validate subject identity

   685                 if (resumingSession) {

   686                     CipherSuite suite = previous.getSuite();

   687                     ClientKeyExchangeService p =

   688                         ClientKeyExchangeService.find(suite.keyExchange.name);

   689                     if (p != null) {

   690                         Principal localPrincipal = previous.getLocalPrincipal();

   691 

   692                         if (p.isRelated(

   693                                 false, getAccSE(), localPrincipal)) {

   694                             if (debug != null && Debug.isOn("session"))

   695                                 System.out.println("Subject can" +

   696                                         " provide creds for princ");

   697                         } else {

   698                             resumingSession = false;

   699                             if (debug != null && Debug.isOn("session"))

   700                                 System.out.println("Subject cannot" +

   701                                         " provide creds for princ");

   702                         }

   703                     }

   704                 }

   705 

   706                 if (resumingSession) {

   707                     CipherSuite suite = previous.getSuite();

   708                     // verify that the ciphersuite from the cached session

   709                     // is in the list of client requested ciphersuites and

   710                     // we have it enabled

   711                     if ((isNegotiable(suite) == false) ||

   712                             (mesg.getCipherSuites().contains(suite) == false)) {

   713                         resumingSession = false;

   714                     } else {

   715                         // everything looks ok, set the ciphersuite

   716                         // this should be done last when we are sure we

   717                         // will resume

   718                         setCipherSuite(suite);

   719                     }

   720                 }

   721 

   722                 if (resumingSession) {

   723                     session = previous;

   724                     if (debug != null &&

   725                         (Debug.isOn("handshake") || Debug.isOn("session"))) {

   726                         System.out.println("%% Resuming " + session);

   727                     }

   728                 }

   729             }

   730         }   // else client did not try to resume

   731 

   732         // cookie exchange

   733         if (isDTLS && !resumingSession) {

   734              HelloCookieManager hcMgr = sslContext.getHelloCookieManager();

   735              if ((mesg.cookie == null) || (mesg.cookie.length == 0) ||

   736                     (!hcMgr.isValid(mesg))) {

   737 

   738                 //

   739                 // Perform cookie exchange for DTLS handshaking if no cookie

   740                 // or the cookie is invalid in the ClientHello message.

   741                 //

   742                 HelloVerifyRequest m0 = new HelloVerifyRequest(hcMgr, mesg);

   743 

   744                 if (debug != null && Debug.isOn("handshake")) {

   745                     m0.print(System.out);

   746                 }

   747 

   748                 m0.write(output);

   749                 handshakeState.update(m0, resumingSession);

   750                 output.flush();

   751 

   752                 return;

   753             }

   754         }

   755 

   756         /*

   757          * FIRST, construct the ServerHello using the options and priorities

   758          * from the ClientHello.  Update the (pending) cipher spec as we do

   759          * so, and save the client's version to protect against rollback

   760          * attacks.

   761          *

   762          * There are a bunch of minor tasks here, and one major one: deciding

   763          * if the short or the full handshake sequence will be used.

   764          */

   765         ServerHello m1 = new ServerHello();

   766 

   767         clientRequestedVersion = mesg.protocolVersion;

   768 

   769         // select a proper protocol version.

   770         ProtocolVersion selectedVersion =

   771                selectProtocolVersion(clientRequestedVersion);

   772         if (selectedVersion == null ||

   773                 selectedVersion.v == ProtocolVersion.SSL20Hello.v) {

   774             fatalSE(Alerts.alert_handshake_failure,

   775                 "Client requested protocol " + clientRequestedVersion +

   776                 " not enabled or not supported");

   777         }

   778 

   779         handshakeHash.protocolDetermined(selectedVersion);

   780         setVersion(selectedVersion);

   781 

   782         m1.protocolVersion = protocolVersion;

   783 

   784         //

   785         // random ... save client and server values for later use

   786         // in computing the master secret (from pre-master secret)

   787         // and thence the other crypto keys.

   788         //

   789         // NOTE:  this use of three inputs to generating _each_ set

   790         // of ciphers slows things down, but it does increase the

   791         // security since each connection in the session can hold

   792         // its own authenticated (and strong) keys.  One could make

   793         // creation of a session a rare thing...

   794         //

   795         clnt_random = mesg.clnt_random;

   796         svr_random = new RandomCookie(sslContext.getSecureRandom());

   797         m1.svr_random = svr_random;

   798 

   799         //

   800         // If client hasn't specified a session we can resume, start a

   801         // new one and choose its cipher suite and compression options.

   802         // Unless new session creation is disabled for this connection!

   803         //

   804         if (session == null) {

   805             if (!enableNewSession) {

   806                 throw new SSLException("Client did not resume a session");

   807             }

   808 

   809             requestedGroups = (SupportedGroupsExtension)

   810                     mesg.extensions.get(ExtensionType.EXT_SUPPORTED_GROUPS);

   811 

   812             // We only need to handle the "signature_algorithm" extension

   813             // for full handshakes and TLS 1.2 or later.

   814             if (protocolVersion.useTLS12PlusSpec()) {

   815                 SignatureAlgorithmsExtension signAlgs =

   816                     (SignatureAlgorithmsExtension)mesg.extensions.get(

   817                                     ExtensionType.EXT_SIGNATURE_ALGORITHMS);

   818                 if (signAlgs != null) {

   819                     Collection<SignatureAndHashAlgorithm> peerSignAlgs =

   820                                             signAlgs.getSignAlgorithms();

   821                     if (peerSignAlgs == null || peerSignAlgs.isEmpty()) {

   822                         throw new SSLHandshakeException(

   823                             "No peer supported signature algorithms");

   824                     }

   825 

   826                     Collection<SignatureAndHashAlgorithm>

   827                         supportedPeerSignAlgs =

   828                             SignatureAndHashAlgorithm.getSupportedAlgorithms(

   829                                 algorithmConstraints, peerSignAlgs);

   830                     if (supportedPeerSignAlgs.isEmpty()) {

   831                         throw new SSLHandshakeException(

   832                             "No signature and hash algorithm in common");

   833                     }

   834 

   835                     setPeerSupportedSignAlgs(supportedPeerSignAlgs);

   836                 } // else, need to use peer implicit supported signature algs

   837             }

   838 

   839             session = new SSLSessionImpl(protocolVersion, CipherSuite.C_NULL,

   840                         getLocalSupportedSignAlgs(),

   841                         sslContext.getSecureRandom(),

   842                         getHostAddressSE(), getPortSE(),

   843                         (requestedToUseEMS &&

   844                                 protocolVersion.useTLS10PlusSpec()));

   845 

   846             if (protocolVersion.useTLS12PlusSpec()) {

   847                 if (peerSupportedSignAlgs != null) {

   848                     session.setPeerSupportedSignatureAlgorithms(

   849                             peerSupportedSignAlgs);

   850                 }   // else, we will set the implicit peer supported signature

   851                     // algorithms in chooseCipherSuite()

   852             }

   853 

   854             // set the server name indication in the session

   855             List<SNIServerName> clientHelloSNI =

   856                     Collections.<SNIServerName>emptyList();

   857             if (clientHelloSNIExt != null) {

   858                 clientHelloSNI = clientHelloSNIExt.getServerNames();

   859             }

   860             session.setRequestedServerNames(clientHelloSNI);

   861 

   862             // set the handshake session

   863             setHandshakeSessionSE(session);

   864 

   865             // choose cipher suite and corresponding private key

   866             chooseCipherSuite(mesg);

   867 

   868             session.setSuite(cipherSuite);

   869             session.setLocalPrivateKey(privateKey);

   870 

   871             // chooseCompression(mesg);

   872 

   873             // set the negotiated maximum fragment in the session

   874             //

   875             // The protocol version and cipher suite have been negotiated

   876             // in previous processes.

   877             if (maxFragLenExt != null) {

   878                 int maxFragLen = maxFragLenExt.getMaxFragLen();

   879 

   880                 // More check of the requested "max_fragment_length" extension.

   881                 if (maximumPacketSize != 0) {

   882                     int estimatedMaxFragSize = cipherSuite.calculatePacketSize(

   883                             maxFragLen, protocolVersion, isDTLS);

   884                     if (estimatedMaxFragSize > maximumPacketSize) {

   885                         // For better interoperability, abort the maximum

   886                         // fragment length negotiation, rather than terminate

   887                         // the connection with a fatal alert.

   888                         maxFragLenExt = null;

   889 

   890                         // fatalSE(Alerts.alert_illegal_parameter,

   891                         //         "Not an allowed max_fragment_length value");

   892                     }

   893                 }

   894 

   895                 if (maxFragLenExt != null) {

   896                     session.setNegotiatedMaxFragSize(maxFragLen);

   897                 }

   898             }

   899 

   900             session.setMaximumPacketSize(maximumPacketSize);

   901         } else {

   902             // set the handshake session

   903             setHandshakeSessionSE(session);

   904         }

   905 

   906         if (protocolVersion.useTLS12PlusSpec()) {

   907             handshakeHash.setFinishedAlg(cipherSuite.prfAlg.getPRFHashAlg());

   908         }

   909 

   910         m1.cipherSuite = cipherSuite;

   911         m1.sessionId = session.getSessionId();

   912         m1.compression_method = session.getCompression();

   913 

   914         if (secureRenegotiation) {

   915             // For ServerHellos that are initial handshakes, then the

   916             // "renegotiated_connection" field in "renegotiation_info"

   917             // extension is of zero length.

   918             //

   919             // For ServerHellos that are renegotiating, this field contains

   920             // the concatenation of client_verify_data and server_verify_data.

   921             //

   922             // Note that for initial handshakes, both the clientVerifyData

   923             // variable and serverVerifyData variable are of zero length.

   924             HelloExtension serverHelloRI = new RenegotiationInfoExtension(

   925                                         clientVerifyData, serverVerifyData);

   926             m1.extensions.add(serverHelloRI);

   927         }

   928 

   929         if (!sniMatchers.isEmpty() && clientHelloSNIExt != null) {

   930             // When resuming a session, the server MUST NOT include a

   931             // server_name extension in the server hello.

   932             if (!resumingSession) {

   933                 ServerNameExtension serverHelloSNI = new ServerNameExtension();

   934                 m1.extensions.add(serverHelloSNI);

   935             }

   936         }

   937 

   938         if ((maxFragLenExt != null) && !resumingSession) {

   939             // When resuming a session, the server MUST NOT include a

   940             // max_fragment_length extension in the server hello.

   941             //

   942             // Otherwise, use the same value as the requested extension.

   943             m1.extensions.add(maxFragLenExt);

   944         }

   945 

   946         if (session.getUseExtendedMasterSecret()) {

   947             m1.extensions.add(new ExtendedMasterSecretExtension());

   948         }

   949 

   950         StaplingParameters staplingParams = processStapling(mesg);

   951         if (staplingParams != null) {

   952             // We now can safely assert status_request[_v2] in our

   953             // ServerHello, and know for certain that we can provide

   954             // responses back to this client for this connection.

   955             if (staplingParams.statusRespExt ==

   956                     ExtensionType.EXT_STATUS_REQUEST) {

   957                 m1.extensions.add(new CertStatusReqExtension());

   958             } else if (staplingParams.statusRespExt ==

   959                     ExtensionType.EXT_STATUS_REQUEST_V2) {

   960                 m1.extensions.add(new CertStatusReqListV2Extension());

   961             }

   962         }

   963 

   964         // Prepare the ALPN response

   965         if (clientHelloALPN != null) {

   966             List<String> peerAPs = clientHelloALPN.getPeerAPs();

   967 

   968             // check for a callback function

   969             if (hasAPCallback) {

   970                 if (conn != null) {

   971                     applicationProtocol =

   972                         appProtocolSelectorSSLSocket.apply(conn, peerAPs);

   973                 } else {

   974                     applicationProtocol =

   975                         appProtocolSelectorSSLEngine.apply(engine, peerAPs);

   976                 }

   977             }

   978 

   979             // check for no-match and that the selected name was also proposed

   980             // by the TLS peer

   981             if (applicationProtocol == null ||

   982                    (!applicationProtocol.isEmpty() &&

   983                         !peerAPs.contains(applicationProtocol))) {

   984 

   985                 fatalSE(Alerts.alert_no_application_protocol,

   986                     new SSLHandshakeException(

   987                         "No matching ALPN values"));

   988 

   989             } else if (!applicationProtocol.isEmpty()) {

   990                 m1.extensions.add(new ALPNExtension(applicationProtocol));

   991             }

   992         } else {

   993             // Nothing was negotiated, returned at end of the handshake

   994             applicationProtocol = "";

   995         }

   996 

   997         if (debug != null && Debug.isOn("handshake")) {

   998             m1.print(System.out);

   999             System.out.println("Cipher suite:  " + session.getSuite());

  1000         }

  1001         m1.write(output);

  1002         handshakeState.update(m1, resumingSession);

  1003 

  1004         //

  1005         // If we are resuming a session, we finish writing handshake

  1006         // messages right now and then finish.

  1007         //

  1008         if (resumingSession) {

  1009             calculateConnectionKeys(session.getMasterSecret());

  1010             sendChangeCipherAndFinish(false);

  1011 

  1012             // expecting the final ChangeCipherSpec and Finished messages

  1013             expectingFinishFlightSE();

  1014 

  1015             return;

  1016         }

  1017 

  1018 

  1019         /*

  1020          * SECOND, write the server Certificate(s) if we need to.

  1021          *

  1022          * NOTE:  while an "anonymous RSA" mode is explicitly allowed by

  1023          * the protocol, we can't support it since all of the SSL flavors

  1024          * defined in the protocol spec are explicitly stated to require

  1025          * using RSA certificates.

  1026          */

  1027         if (ClientKeyExchangeService.find(

  1028                 cipherSuite.keyExchange.name) != null) {

  1029             // No external key exchange provider needs a cert now.

  1030         } else if ((keyExchange != K_DH_ANON) && (keyExchange != K_ECDH_ANON)) {

  1031             if (certs == null) {

  1032                 throw new RuntimeException("no certificates");

  1033             }

  1034 

  1035             CertificateMsg m2 = new CertificateMsg(certs);

  1036 

  1037             /*

  1038              * Set local certs in the SSLSession, output

  1039              * debug info, and then actually write to the client.

  1040              */

  1041             session.setLocalCertificates(certs);

  1042             if (debug != null && Debug.isOn("handshake")) {

  1043                 m2.print(System.out);

  1044             }

  1045             m2.write(output);

  1046             handshakeState.update(m2, resumingSession);

  1047 

  1048             // XXX has some side effects with OS TCP buffering,

  1049             // leave it out for now

  1050 

  1051             // let client verify chain in the meantime...

  1052             // output.flush();

  1053         } else {

  1054             if (certs != null) {

  1055                 throw new RuntimeException("anonymous keyexchange with certs");

  1056             }

  1057         }

  1058 

  1059         /**

  1060          * The CertificateStatus message ... only if it is needed.

  1061          * This would only be needed if we've established that this handshake

  1062          * supports status stapling and there is at least one response to

  1063          * return to the client.

  1064          */

  1065         if (staplingParams != null) {

  1066             CertificateStatus csMsg = new CertificateStatus(

  1067                     staplingParams.statReqType, certs,

  1068                     staplingParams.responseMap);

  1069             if (debug != null && Debug.isOn("handshake")) {

  1070                 csMsg.print(System.out);

  1071             }

  1072             csMsg.write(output);

  1073             handshakeState.update(csMsg, resumingSession);

  1074         }

  1075 

  1076         /*

  1077          * THIRD, the ServerKeyExchange message ... iff it's needed.

  1078          *

  1079          * It's usually needed unless there's an encryption-capable

  1080          * RSA cert, or a D-H cert.  The notable exception is that

  1081          * exportable ciphers used with big RSA keys need to downgrade

  1082          * to use short RSA keys, even when the key/cert encrypts OK.

  1083          */

  1084 

  1085         ServerKeyExchange m3;

  1086         switch (keyExchange) {

  1087         case K_RSA:

  1088             // no server key exchange for RSA ciphersuites

  1089             m3 = null;

  1090             break;

  1091         case K_RSA_EXPORT:

  1092             if (JsseJce.getRSAKeyLength(certs[0].getPublicKey()) > 512) {

  1093                 try {

  1094                     m3 = new RSA_ServerKeyExchange(

  1095                         tempPublicKey, privateKey,

  1096                         clnt_random, svr_random,

  1097                         sslContext.getSecureRandom());

  1098                     privateKey = tempPrivateKey;

  1099                 } catch (GeneralSecurityException e) {

  1100                     m3 = null; // make compiler happy

  1101                     throw new SSLException(

  1102                             "Error generating RSA server key exchange", e);

  1103                 }

  1104             } else {

  1105                 // RSA_EXPORT with short key, don't need ServerKeyExchange

  1106                 m3 = null;

  1107             }

  1108             break;

  1109         case K_DHE_RSA:

  1110         case K_DHE_DSS:

  1111             try {

  1112                 m3 = new DH_ServerKeyExchange(dh,

  1113                     privateKey,

  1114                     clnt_random.random_bytes,

  1115                     svr_random.random_bytes,

  1116                     sslContext.getSecureRandom(),

  1117                     preferableSignatureAlgorithm,

  1118                     protocolVersion);

  1119             } catch (GeneralSecurityException e) {

  1120                 m3 = null; // make compiler happy

  1121                 throw new SSLException(

  1122                         "Error generating DH server key exchange", e);

  1123             }

  1124             break;

  1125         case K_DH_ANON:

  1126             m3 = new DH_ServerKeyExchange(dh, protocolVersion);

  1127             break;

  1128         case K_ECDHE_RSA:

  1129         case K_ECDHE_ECDSA:

  1130         case K_ECDH_ANON:

  1131             try {

  1132                 m3 = new ECDH_ServerKeyExchange(ecdh,

  1133                     privateKey,

  1134                     clnt_random.random_bytes,

  1135                     svr_random.random_bytes,