1 /*

     2  * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl;

    27 

    28 import java.io.*;

    29 import java.math.BigInteger;

    30 import java.security.*;

    31 import java.security.interfaces.*;

    32 import java.security.spec.*;

    33 import java.security.cert.*;

    34 import java.security.cert.Certificate;

    35 import java.util.*;

    36 import java.util.concurrent.ConcurrentHashMap;

    37 

    38 import java.lang.reflect.*;

    39 

    40 import javax.security.auth.x500.X500Principal;

    41 

    42 import javax.crypto.KeyGenerator;

    43 import javax.crypto.SecretKey;

    44 import javax.crypto.spec.DHPublicKeySpec;

    45 

    46 import javax.net.ssl.*;

    47 

    48 import sun.security.internal.spec.TlsPrfParameterSpec;

    49 import sun.security.ssl.CipherSuite.*;

    50 import static sun.security.ssl.CipherSuite.PRF.*;

    51 import sun.security.util.KeyUtil;

    52 import sun.security.util.MessageDigestSpi2;

    53 import sun.security.provider.certpath.OCSPResponse;

    54 

    55 /**

    56  * Many data structures are involved in the handshake messages.  These

    57  * classes are used as structures, with public data members.  They are

    58  * not visible outside the SSL package.

    59  *

    60  * Handshake messages all have a common header format, and they are all

    61  * encoded in a "handshake data" SSL record substream.  The base class

    62  * here (HandshakeMessage) provides a common framework and records the

    63  * SSL record type of the particular handshake message.

    64  *

    65  * This file contains subclasses for all the basic handshake messages.

    66  * All handshake messages know how to encode and decode themselves on

    67  * SSL streams; this facilitates using the same code on SSL client and

    68  * server sides, although they don't send and receive the same messages.

    69  *

    70  * Messages also know how to print themselves, which is quite handy

    71  * for debugging.  They always identify their type, and can optionally

    72  * dump all of their content.

    73  *

    74  * @author David Brownell

    75  */

    76 public abstract class HandshakeMessage {

    77 

    78     /* Class and subclass dynamic debugging support */

    79     public static final Debug debug = Debug.getInstance("ssl");

    80 

    81     // enum HandshakeType:

    82     //

    83     // Please update the isUnsupported() method accordingly if the handshake

    84     // types get updated in the future.

    85     static final byte   ht_hello_request          = 0;      // RFC 5246

    86     static final byte   ht_client_hello           = 1;      // RFC 5246

    87     static final byte   ht_server_hello           = 2;      // RFC 5246

    88     static final byte   ht_hello_verify_request   = 3;      // RFC 6347

    89     static final byte   ht_new_session_ticket     = 4;      // RFC 4507

    90 

    91     static final byte   ht_certificate            = 11;     // RFC 5246

    92     static final byte   ht_server_key_exchange    = 12;     // RFC 5246

    93     static final byte   ht_certificate_request    = 13;     // RFC 5246

    94     static final byte   ht_server_hello_done      = 14;     // RFC 5246

    95     static final byte   ht_certificate_verify     = 15;     // RFC 5246

    96     static final byte   ht_client_key_exchange    = 16;     // RFC 5246

    97 

    98     static final byte   ht_finished               = 20;     // RFC 5246

    99     static final byte   ht_certificate_url        = 21;     // RFC 6066

   100     static final byte   ht_certificate_status     = 22;     // RFC 6066

   101     static final byte   ht_supplemental_data      = 23;     // RFC 4680

   102 

   103     static final byte   ht_not_applicable         = -1;     // N/A

   104 

   105     /*

   106      * SSL 3.0 MAC padding constants.

   107      * Also used by CertificateVerify and Finished during the handshake.

   108      */

   109     static final byte[] MD5_pad1 = genPad(0x36, 48);

   110     static final byte[] MD5_pad2 = genPad(0x5c, 48);

   111 

   112     static final byte[] SHA_pad1 = genPad(0x36, 40);

   113     static final byte[] SHA_pad2 = genPad(0x5c, 40);

   114 

   115     // default constructor

   116     HandshakeMessage() {

   117     }

   118 

   119     /**

   120      * Utility method to convert a BigInteger to a byte array in unsigned

   121      * format as needed in the handshake messages. BigInteger uses

   122      * 2's complement format, i.e. it prepends an extra zero if the MSB

   123      * is set. We remove that.

   124      */

   125     static byte[] toByteArray(BigInteger bi) {

   126         byte[] b = bi.toByteArray();

   127         if ((b.length > 1) && (b[0] == 0)) {

   128             int n = b.length - 1;

   129             byte[] newarray = new byte[n];

   130             System.arraycopy(b, 1, newarray, 0, n);

   131             b = newarray;

   132         }

   133         return b;

   134     }

   135 

   136     static boolean isUnsupported(byte handshakeType) {

   137         return (handshakeType != ht_hello_request) &&

   138                (handshakeType != ht_client_hello) &&

   139                (handshakeType != ht_server_hello) &&

   140                (handshakeType != ht_hello_verify_request) &&

   141                (handshakeType != ht_new_session_ticket) &&

   142                (handshakeType != ht_certificate) &&

   143                (handshakeType != ht_server_key_exchange) &&

   144                (handshakeType != ht_certificate_request) &&

   145                (handshakeType != ht_server_hello_done) &&

   146                (handshakeType != ht_certificate_verify) &&

   147                (handshakeType != ht_client_key_exchange) &&

   148                (handshakeType != ht_finished) &&

   149                (handshakeType != ht_certificate_url) &&

   150                (handshakeType != ht_certificate_status) &&

   151                (handshakeType != ht_supplemental_data);

   152     }

   153 

   154     private static byte[] genPad(int b, int count) {

   155         byte[] padding = new byte[count];

   156         Arrays.fill(padding, (byte)b);

   157         return padding;

   158     }

   159 

   160     /*

   161      * Write a handshake message on the (handshake) output stream.

   162      * This is just a four byte header followed by the data.

   163      *

   164      * NOTE that huge messages -- notably, ones with huge cert

   165      * chains -- are handled correctly.

   166      */

   167     final void write(HandshakeOutStream s) throws IOException {

   168         int len = messageLength();

   169         if (len >= Record.OVERFLOW_OF_INT24) {

   170             throw new SSLException("Handshake message too big"

   171                 + ", type = " + messageType() + ", len = " + len);

   172         }

   173         s.write(messageType());

   174         s.putInt24(len);

   175         send(s);

   176         s.complete();

   177     }

   178 

   179     /*

   180      * Subclasses implement these methods so those kinds of

   181      * messages can be emitted.  Base class delegates to subclass.

   182      */

   183     abstract int  messageType();

   184     abstract int  messageLength();

   185     abstract void send(HandshakeOutStream s) throws IOException;

   186 

   187     /*

   188      * Write a descriptive message on the output stream; for debugging.

   189      */

   190     abstract void print(PrintStream p) throws IOException;

   191 

   192 //

   193 // NOTE:  the rest of these classes are nested within this one, and are

   194 // imported by other classes in this package.  There are a few other

   195 // handshake message classes, not neatly nested here because of current

   196 // licensing requirement for native (RSA) methods.  They belong here,

   197 // but those native methods complicate things a lot!

   198 //

   199 

   200 

   201 /*

   202  * HelloRequest ... SERVER --> CLIENT

   203  *

   204  * Server can ask the client to initiate a new handshake, e.g. to change

   205  * session parameters after a connection has been (re)established.

   206  */

   207 static final class HelloRequest extends HandshakeMessage {

   208     @Override

   209     int messageType() { return ht_hello_request; }

   210 

   211     HelloRequest() { }

   212 

   213     HelloRequest(HandshakeInStream in) throws IOException

   214     {

   215         // nothing in this message

   216     }

   217 

   218     @Override

   219     int messageLength() { return 0; }

   220 

   221     @Override

   222     void send(HandshakeOutStream out) throws IOException

   223     {

   224         // nothing in this messaage

   225     }

   226 

   227     @Override

   228     void print(PrintStream out) throws IOException

   229     {

   230         out.println("*** HelloRequest (empty)");

   231     }

   232 

   233 }

   234 

   235 /*

   236  * HelloVerifyRequest ... SERVER --> CLIENT  [DTLS only]

   237  *

   238  * The definition of HelloVerifyRequest is as follows:

   239  *

   240  *     struct {

   241  *       ProtocolVersion server_version;

   242  *       opaque cookie<0..2^8-1>;

   243  *     } HelloVerifyRequest;

   244  *

   245  * For DTLS protocols, once the client has transmitted the ClientHello message,

   246  * it expects to see a HelloVerifyRequest from the server.  However, if the

   247  * server's message is lost, the client knows that either the ClientHello or

   248  * the HelloVerifyRequest has been lost and retransmits. [RFC 6347]

   249  */

   250 static final class HelloVerifyRequest extends HandshakeMessage {

   251     ProtocolVersion     protocolVersion;

   252     byte[]              cookie;         // 1 to 2^8 - 1 bytes

   253 

   254     HelloVerifyRequest(HelloCookieManager helloCookieManager,

   255             ClientHello clientHelloMsg) {

   256 

   257         this.protocolVersion = clientHelloMsg.protocolVersion;

   258         this.cookie = helloCookieManager.getCookie(clientHelloMsg);

   259     }

   260 

   261     HelloVerifyRequest(

   262             HandshakeInStream input, int messageLength) throws IOException {

   263 

   264         this.protocolVersion =

   265                 ProtocolVersion.valueOf(input.getInt8(), input.getInt8());

   266         this.cookie = input.getBytes8();

   267 

   268         // Is it a valid cookie?

   269         HelloCookieManager.checkCookie(protocolVersion, cookie);

   270     }

   271 

   272     @Override

   273     int messageType() {

   274         return ht_hello_verify_request;

   275     }

   276 

   277     @Override

   278     int messageLength() {

   279         return 2 + cookie.length;       // 2: the length of protocolVersion

   280     }

   281 

   282     @Override

   283     void send(HandshakeOutStream hos) throws IOException {

   284         hos.putInt8(protocolVersion.major);

   285         hos.putInt8(protocolVersion.minor);

   286         hos.putBytes8(cookie);

   287     }

   288 

   289     @Override

   290     void print(PrintStream out) throws IOException {

   291         out.println("*** HelloVerifyRequest");

   292         if (debug != null && Debug.isOn("verbose")) {

   293             out.println("server_version: " + protocolVersion);

   294             Debug.println(out, "cookie", cookie);

   295         }

   296     }

   297 }

   298 

   299 /*

   300  * ClientHello ... CLIENT --> SERVER

   301  *

   302  * Client initiates handshake by telling server what it wants, and what it

   303  * can support (prioritized by what's first in the ciphe suite list).

   304  *

   305  * By RFC2246:7.4.1.2 it's explicitly anticipated that this message

   306  * will have more data added at the end ... e.g. what CAs the client trusts.

   307  * Until we know how to parse it, we will just read what we know

   308  * about, and let our caller handle the jumps over unknown data.

   309  */

   310 static final class ClientHello extends HandshakeMessage {

   311 

   312     ProtocolVersion             protocolVersion;

   313     RandomCookie                clnt_random;

   314     SessionId                   sessionId;

   315     byte[]                      cookie;                     // DTLS only

   316     private CipherSuiteList     cipherSuites;

   317     private final boolean       isDTLS;

   318     byte[]                      compression_methods;

   319 

   320     HelloExtensions extensions = new HelloExtensions();

   321 

   322     private static final byte[]  NULL_COMPRESSION = new byte[] {0};

   323 

   324     ClientHello(SecureRandom generator, ProtocolVersion protocolVersion,

   325             SessionId sessionId, CipherSuiteList cipherSuites,

   326             boolean isDTLS) {

   327 

   328         this.isDTLS = isDTLS;

   329         this.protocolVersion = protocolVersion;

   330         this.sessionId = sessionId;

   331         this.cipherSuites = cipherSuites;

   332         if (isDTLS) {

   333             this.cookie = new byte[0];

   334         } else {

   335             this.cookie = null;

   336         }

   337 

   338         clnt_random = new RandomCookie(generator);

   339         compression_methods = NULL_COMPRESSION;

   340     }

   341 

   342     ClientHello(HandshakeInStream s,

   343             int messageLength, boolean isDTLS) throws IOException {

   344 

   345         this.isDTLS = isDTLS;

   346 

   347         protocolVersion = ProtocolVersion.valueOf(s.getInt8(), s.getInt8());

   348         clnt_random = new RandomCookie(s);

   349         sessionId = new SessionId(s.getBytes8());

   350         sessionId.checkLength(protocolVersion);

   351         if (isDTLS) {

   352             cookie = s.getBytes8();

   353         } else {

   354             cookie = null;

   355         }

   356 

   357         cipherSuites = new CipherSuiteList(s);

   358         compression_methods = s.getBytes8();

   359         if (messageLength() != messageLength) {

   360             extensions = new HelloExtensions(s);

   361         }

   362     }

   363 

   364     CipherSuiteList getCipherSuites() {

   365         return cipherSuites;

   366     }

   367 

   368     // add renegotiation_info extension

   369     void addRenegotiationInfoExtension(byte[] clientVerifyData) {

   370         HelloExtension renegotiationInfo = new RenegotiationInfoExtension(

   371                     clientVerifyData, new byte[0]);

   372         extensions.add(renegotiationInfo);

   373     }

   374 

   375     // add server_name extension

   376     void addSNIExtension(List<SNIServerName> serverNames) {

   377         try {

   378             extensions.add(new ServerNameExtension(serverNames));

   379         } catch (IOException ioe) {

   380             // ignore the exception and return

   381         }

   382     }

   383 

   384     // add signature_algorithm extension

   385     void addSignatureAlgorithmsExtension(

   386             Collection<SignatureAndHashAlgorithm> algorithms) {

   387         HelloExtension signatureAlgorithm =

   388                 new SignatureAlgorithmsExtension(algorithms);

   389         extensions.add(signatureAlgorithm);

   390     }

   391 

   392     void addMFLExtension(int maximumPacketSize) {

   393         HelloExtension maxFragmentLength =

   394                 new MaxFragmentLengthExtension(maximumPacketSize);

   395         extensions.add(maxFragmentLength);

   396     }

   397 

   398     void updateHelloCookie(MessageDigest cookieDigest) {

   399         //

   400         // Just use HandshakeOutStream to compute the hello verify cookie.

   401         // Not actually used to output handshake message records.

   402         //

   403         HandshakeOutStream hos = new HandshakeOutStream(null);

   404 

   405         try {

   406             send(hos, false);    // Do not count hello verify cookie.

   407         } catch (IOException ioe) {

   408             // unlikely to happen

   409         }

   410 

   411         cookieDigest.update(hos.toByteArray());

   412     }

   413 

   414     // Add status_request extension type

   415     void addCertStatusRequestExtension() {

   416         extensions.add(new CertStatusReqExtension(StatusRequestType.OCSP,

   417                 new OCSPStatusRequest()));

   418     }

   419 

   420     // Add status_request_v2 extension type

   421     void addCertStatusReqListV2Extension() {

   422         // Create a default OCSPStatusRequest that we can use for both

   423         // OCSP_MULTI and OCSP request list items.

   424         OCSPStatusRequest osr = new OCSPStatusRequest();

   425         List<CertStatusReqItemV2> itemList = new ArrayList<>(2);

   426         itemList.add(new CertStatusReqItemV2(StatusRequestType.OCSP_MULTI,

   427                 osr));

   428         itemList.add(new CertStatusReqItemV2(StatusRequestType.OCSP, osr));

   429         extensions.add(new CertStatusReqListV2Extension(itemList));

   430     }

   431 

   432     // add application_layer_protocol_negotiation extension

   433     void addALPNExtension(String[] applicationProtocols) throws SSLException {

   434         extensions.add(new ALPNExtension(applicationProtocols));

   435     }

   436 

   437     @Override

   438     int messageType() { return ht_client_hello; }

   439 

   440     @Override

   441     int messageLength() {

   442         /*

   443          * Add fixed size parts of each field...

   444          * version + random + session + cipher + compress

   445          */

   446         return (2 + 32 + 1 + 2 + 1

   447             + sessionId.length()                /* ... + variable parts */

   448             + (isDTLS ? (1 + cookie.length) : 0)

   449             + (cipherSuites.size() * 2)

   450             + compression_methods.length)

   451             + extensions.length();

   452     }

   453 

   454     @Override

   455     void send(HandshakeOutStream s) throws IOException {

   456         send(s, true);  // Count hello verify cookie.

   457     }

   458 

   459     @Override

   460     void print(PrintStream s) throws IOException {

   461         s.println("*** ClientHello, " + protocolVersion);

   462 

   463         if (debug != null && Debug.isOn("verbose")) {

   464             s.print("RandomCookie:  ");

   465             clnt_random.print(s);

   466 

   467             s.print("Session ID:  ");

   468             s.println(sessionId);

   469 

   470             if (isDTLS) {

   471                 Debug.println(s, "cookie", cookie);

   472             }

   473 

   474             s.println("Cipher Suites: " + cipherSuites);

   475 

   476             Debug.println(s, "Compression Methods", compression_methods);

   477             extensions.print(s);

   478             s.println("***");

   479         }

   480     }

   481 

   482     private void send(HandshakeOutStream s,

   483             boolean computeCookie) throws IOException {

   484         s.putInt8(protocolVersion.major);

   485         s.putInt8(protocolVersion.minor);

   486         clnt_random.send(s);

   487         s.putBytes8(sessionId.getId());

   488         if (isDTLS && computeCookie) {

   489             s.putBytes8(cookie);

   490         }

   491         cipherSuites.send(s);

   492         s.putBytes8(compression_methods);

   493         extensions.send(s);

   494     }

   495 

   496 }

   497 

   498 /*

   499  * ServerHello ... SERVER --> CLIENT

   500  *

   501  * Server chooses protocol options from among those it supports and the

   502  * client supports.  Then it sends the basic session descriptive parameters

   503  * back to the client.

   504  */

   505 static final

   506 class ServerHello extends HandshakeMessage

   507 {

   508     @Override

   509     int messageType() { return ht_server_hello; }

   510 

   511     ProtocolVersion     protocolVersion;

   512     RandomCookie        svr_random;

   513     SessionId           sessionId;

   514     CipherSuite         cipherSuite;

   515     byte                compression_method;

   516     HelloExtensions extensions = new HelloExtensions();

   517 

   518     ServerHello() {

   519         // empty

   520     }

   521 

   522     ServerHello(HandshakeInStream input, int messageLength)

   523             throws IOException {

   524         protocolVersion = ProtocolVersion.valueOf(input.getInt8(),

   525                                                   input.getInt8());

   526         svr_random = new RandomCookie(input);

   527         sessionId = new SessionId(input.getBytes8());

   528         sessionId.checkLength(protocolVersion);

   529         cipherSuite = CipherSuite.valueOf(input.getInt8(), input.getInt8());

   530         compression_method = (byte)input.getInt8();

   531         if (messageLength() != messageLength) {

   532             extensions = new HelloExtensions(input);

   533         }

   534     }

   535 

   536     @Override

   537     int messageLength()

   538     {

   539         // almost fixed size, except session ID and extensions:

   540         //      major + minor = 2

   541         //      random = 32

   542         //      session ID len field = 1

   543         //      cipher suite + compression = 3

   544         //      extensions: if present, 2 + length of extensions

   545         return 38 + sessionId.length() + extensions.length();

   546     }

   547 

   548     @Override

   549     void send(HandshakeOutStream s) throws IOException

   550     {

   551         s.putInt8(protocolVersion.major);

   552         s.putInt8(protocolVersion.minor);

   553         svr_random.send(s);

   554         s.putBytes8(sessionId.getId());

   555         s.putInt8(cipherSuite.id >> 8);

   556         s.putInt8(cipherSuite.id & 0xff);

   557         s.putInt8(compression_method);

   558         extensions.send(s);

   559     }

   560 

   561     @Override

   562     void print(PrintStream s) throws IOException

   563     {

   564         s.println("*** ServerHello, " + protocolVersion);

   565 

   566         if (debug != null && Debug.isOn("verbose")) {

   567             s.print("RandomCookie:  ");

   568             svr_random.print(s);

   569 

   570             s.print("Session ID:  ");

   571             s.println(sessionId);

   572 

   573             s.println("Cipher Suite: " + cipherSuite);

   574             s.println("Compression Method: " + compression_method);

   575             extensions.print(s);

   576             s.println("***");

   577         }

   578     }

   579 }

   580 

   581 

   582 /*

   583  * CertificateMsg ... send by both CLIENT and SERVER

   584  *

   585  * Each end of a connection may need to pass its certificate chain to

   586  * the other end.  Such chains are intended to validate an identity with

   587  * reference to some certifying authority.  Examples include companies

   588  * like Verisign, or financial institutions.  There's some control over

   589  * the certifying authorities which are sent.

   590  *

   591  * NOTE: that these messages might be huge, taking many handshake records.

   592  * Up to 2^48 bytes of certificate may be sent, in records of at most 2^14

   593  * bytes each ... up to 2^32 records sent on the output stream.

   594  */

   595 static final

   596 class CertificateMsg extends HandshakeMessage

   597 {

   598     @Override

   599     int messageType() { return ht_certificate; }

   600 

   601     private X509Certificate[] chain;

   602 

   603     private List<byte[]> encodedChain;

   604 

   605     private int messageLength;

   606 

   607     CertificateMsg(X509Certificate[] certs) {

   608         chain = certs;

   609     }

   610 

   611     CertificateMsg(HandshakeInStream input) throws IOException {

   612         int chainLen = input.getInt24();

   613         List<Certificate> v = new ArrayList<>(4);

   614 

   615         CertificateFactory cf = null;

   616         while (chainLen > 0) {

   617             byte[] cert = input.getBytes24();

   618             chainLen -= (3 + cert.length);

   619             try {

   620                 if (cf == null) {

   621                     cf = CertificateFactory.getInstance("X.509");

   622                 }

   623                 v.add(cf.generateCertificate(new ByteArrayInputStream(cert)));

   624             } catch (CertificateException e) {

   625                 throw (SSLProtocolException)new SSLProtocolException(

   626                     e.getMessage()).initCause(e);

   627             }

   628         }

   629 

   630         chain = v.toArray(new X509Certificate[v.size()]);

   631     }

   632 

   633     @Override

   634     int messageLength() {

   635         if (encodedChain == null) {

   636             messageLength = 3;

   637             encodedChain = new ArrayList<byte[]>(chain.length);

   638             try {

   639                 for (X509Certificate cert : chain) {

   640                     byte[] b = cert.getEncoded();

   641                     encodedChain.add(b);

   642                     messageLength += b.length + 3;

   643                 }

   644             } catch (CertificateEncodingException e) {

   645                 encodedChain = null;

   646                 throw new RuntimeException("Could not encode certificates", e);

   647             }

   648         }

   649         return messageLength;

   650     }

   651 

   652     @Override

   653     void send(HandshakeOutStream s) throws IOException {

   654         s.putInt24(messageLength() - 3);

   655         for (byte[] b : encodedChain) {

   656             s.putBytes24(b);

   657         }

   658     }

   659 

   660     @Override

   661     void print(PrintStream s) throws IOException {

   662         s.println("*** Certificate chain");

   663 

   664         if (chain.length == 0) {

   665             s.println("<Empty>");

   666         } else if (debug != null && Debug.isOn("verbose")) {

   667             for (int i = 0; i < chain.length; i++) {

   668                 s.println("chain [" + i + "] = " + chain[i]);

   669             }

   670         }

   671         s.println("***");

   672     }

   673 

   674     X509Certificate[] getCertificateChain() {

   675         return chain.clone();

   676     }

   677 }

   678 

   679 /*

   680  * CertificateStatus ... SERVER --> CLIENT

   681  *

   682  * When a ClientHello asserting the status_request or status_request_v2

   683  * extensions is accepted by the server, it will fetch and return one

   684  * or more status responses in this handshake message.

   685  *

   686  * NOTE: Like the Certificate handshake message, this can potentially

   687  * be a very large message both due to the size of multiple status

   688  * responses and the certificate chains that are often attached to them.

   689  * Up to 2^24 bytes of status responses may be sent, possibly fragmented

   690  * over multiple TLS records.

   691  */

   692 static final class CertificateStatus extends HandshakeMessage

   693 {

   694     private final StatusRequestType statusType;

   695     private int encodedResponsesLen;

   696     private int messageLength = -1;

   697     private List<byte[]> encodedResponses;

   698 

   699     @Override

   700     int messageType() { return ht_certificate_status; }

   701 

   702     /**

   703      * Create a CertificateStatus message from the certificates and their

   704      * respective OCSP responses

   705      *

   706      * @param type an indication of the type of response (OCSP or OCSP_MULTI)

   707      * @param responses a {@code List} of OCSP responses in DER-encoded form.

   708      *      For the OCSP type, only the first entry in the response list is

   709      *      used, and must correspond to the end-entity certificate sent to the

   710      *      peer.  Zero-length or null values for the response data are not

   711      *      allowed for the OCSP type.  For the OCSP_MULTI type, each entry in

   712      *      the list should match its corresponding certificate sent in the

   713      *      Server Certificate message.  Where an OCSP response does not exist,

   714      *      either a zero-length array or a null value should be used.

   715      *

   716      * @throws SSLException if an unsupported StatusRequestType or invalid

   717      *      OCSP response data is provided.

   718      */

   719     CertificateStatus(StatusRequestType type, X509Certificate[] chain,

   720             Map<X509Certificate, byte[]> responses) {

   721         statusType = type;

   722         encodedResponsesLen = 0;

   723         encodedResponses = new ArrayList<>(chain.length);

   724 

   725         Objects.requireNonNull(chain, "Null chain not allowed");

   726         Objects.requireNonNull(responses, "Null responses not allowed");

   727 

   728         if (statusType == StatusRequestType.OCSP) {

   729             // Just get the response for the end-entity certificate

   730             byte[] respDER = responses.get(chain[0]);

   731             if (respDER != null && respDER.length > 0) {

   732                 encodedResponses.add(respDER);

   733                 encodedResponsesLen = 3 + respDER.length;

   734             } else {

   735                 throw new IllegalArgumentException("Zero-length or null " +

   736                         "OCSP Response");

   737             }

   738         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   739             for (X509Certificate cert : chain) {

   740                 byte[] respDER = responses.get(cert);

   741                 if (respDER != null) {

   742                     encodedResponses.add(respDER);

   743                     encodedResponsesLen += (respDER.length + 3);

   744                 } else {

   745                     // If we cannot find a response for a given certificate

   746                     // then use a zero-length placeholder.

   747                     encodedResponses.add(new byte[0]);

   748                     encodedResponsesLen += 3;

   749                 }

   750             }

   751         } else {

   752             throw new IllegalArgumentException(

   753                     "Unsupported StatusResponseType: " + statusType);

   754         }

   755     }

   756 

   757     /**

   758      * Decode the CertificateStatus handshake message coming from a

   759      * {@code HandshakeInputStream}.

   760      *

   761      * @param input the {@code HandshakeInputStream} containing the

   762      * CertificateStatus message bytes.

   763      *

   764      * @throws SSLHandshakeException if a zero-length response is found in the

   765      * OCSP response type, or an unsupported response type is detected.

   766      * @throws IOException if a decoding error occurs.

   767      */

   768     CertificateStatus(HandshakeInStream input) throws IOException {

   769         encodedResponsesLen = 0;

   770         encodedResponses = new ArrayList<>();

   771 

   772         statusType = StatusRequestType.get(input.getInt8());

   773         if (statusType == StatusRequestType.OCSP) {

   774             byte[] respDER = input.getBytes24();

   775             // Convert the incoming bytes to a OCSPResponse strucutre

   776             if (respDER.length > 0) {

   777                 encodedResponses.add(respDER);

   778                 encodedResponsesLen = 3 + respDER.length;

   779             } else {

   780                 throw new SSLHandshakeException("Zero-length OCSP Response");

   781             }

   782         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   783             int respListLen = input.getInt24();

   784             encodedResponsesLen = respListLen;

   785 

   786             // Add each OCSP reponse into the array list in the order

   787             // we receive them off the wire.  A zero-length array is

   788             // allowed for ocsp_multi, and means that a response for

   789             // a given certificate is not available.

   790             while (respListLen > 0) {

   791                 byte[] respDER = input.getBytes24();

   792                 encodedResponses.add(respDER);

   793                 respListLen -= (respDER.length + 3);

   794             }

   795 

   796             if (respListLen != 0) {

   797                 throw new SSLHandshakeException(

   798                         "Bad OCSP response list length");

   799             }

   800         } else {

   801             throw new SSLHandshakeException("Unsupported StatusResponseType: " +

   802                     statusType);

   803         }

   804     }

   805 

   806     /**

   807      * Get the length of the CertificateStatus message.

   808      *

   809      * @return the length of the message in bytes.

   810      */

   811     @Override

   812     int messageLength() {

   813         int len = 1;            // Length + Status type

   814 

   815         if (messageLength == -1) {

   816             if (statusType == StatusRequestType.OCSP) {

   817                 len += encodedResponsesLen;

   818             } else if (statusType == StatusRequestType.OCSP_MULTI) {

   819                 len += 3 + encodedResponsesLen;

   820             }

   821             messageLength = len;

   822         }

   823 

   824         return messageLength;

   825     }

   826 

   827     /**

   828      * Encode the CertificateStatus handshake message and place it on a

   829      * {@code HandshakeOutputStream}.

   830      *

   831      * @param s the HandshakeOutputStream that will the message bytes.

   832      *

   833      * @throws IOException if an encoding error occurs.

   834      */

   835     @Override

   836     void send(HandshakeOutStream s) throws IOException {

   837         s.putInt8(statusType.id);

   838         if (statusType == StatusRequestType.OCSP) {

   839             s.putBytes24(encodedResponses.get(0));

   840         } else if (statusType == StatusRequestType.OCSP_MULTI) {

   841             s.putInt24(encodedResponsesLen);

   842             for (byte[] respBytes : encodedResponses) {

   843                 if (respBytes != null) {

   844                     s.putBytes24(respBytes);

   845                 } else {

   846                     s.putBytes24(null);

   847                 }

   848             }

   849         } else {

   850             // It is highly unlikely that we will fall into this section of

   851             // the code.

   852             throw new SSLHandshakeException("Unsupported status_type: " +

   853                     statusType.id);

   854         }

   855     }

   856 

   857     /**

   858      * Display a human-readable representation of the CertificateStatus message.

   859      *

   860      * @param s the PrintStream used to display the message data.

   861      *

   862      * @throws IOException if any errors occur while parsing the OCSP response

   863      * bytes into a readable form.

   864      */

   865     @Override

   866     void print(PrintStream s) throws IOException {

   867         s.println("*** CertificateStatus");

   868         if (debug != null && Debug.isOn("verbose")) {

   869             s.println("Type: " + statusType);

   870             if (statusType == StatusRequestType.OCSP) {

   871                 OCSPResponse oResp = new OCSPResponse(encodedResponses.get(0));

   872                 s.println(oResp);

   873             } else if (statusType == StatusRequestType.OCSP_MULTI) {

   874                 int numResponses = encodedResponses.size();

   875                 s.println(numResponses +

   876                         (numResponses == 1 ? " entry:" : " entries:"));

   877                 for (byte[] respDER : encodedResponses) {

   878                     if (respDER.length > 0) {

   879                         OCSPResponse oResp = new OCSPResponse(respDER);

   880                         s.println(oResp);

   881                     } else {

   882                         s.println("<Zero-length entry>");

   883                     }

   884                 }

   885             }

   886         }

   887     }

   888 

   889     /**

   890      * Get the type of CertificateStatus message

   891      *

   892      * @return the {@code StatusRequestType} for this CertificateStatus

   893      *      message.

   894      */

   895     StatusRequestType getType() {

   896         return statusType;

   897     }

   898 

   899     /**

   900      * Get the list of non-zero length OCSP responses.

   901      * The responses returned in this list can be used to map to

   902      * {@code X509Certificate} objects provided by the peer and

   903      * provided to a {@code PKIXRevocationChecker}.

   904      *

   905      * @return an unmodifiable List of zero or more byte arrays, each one

   906      *      consisting of a single status response.

   907      */

   908     List<byte[]> getResponses() {

   909         return Collections.unmodifiableList(encodedResponses);

   910     }

   911 }

   912 

   913 /*

   914  * ServerKeyExchange ... SERVER --> CLIENT

   915  *

   916  * The cipher suite selected, when combined with the certificate exchanged,

   917  * implies one of several different kinds of key exchange.  Most current

   918  * cipher suites require the server to send more than its certificate.

   919  *

   920  * The primary exceptions are when a server sends an encryption-capable

   921  * RSA public key in its cert, to be used with RSA (or RSA_export) key

   922  * exchange; and when a server sends its Diffie-Hellman cert.  Those kinds

   923  * of key exchange do not require a ServerKeyExchange message.

   924  *

   925  * Key exchange can be viewed as having three modes, which are explicit

   926  * for the Diffie-Hellman flavors and poorly specified for RSA ones:

   927  *

   928  *      - "Ephemeral" keys.  Here, a "temporary" key is allocated by the

   929  *        server, and signed.  Diffie-Hellman keys signed using RSA or

   930  *        DSS are ephemeral (DHE flavor).  RSA keys get used to do the same

   931  *        thing, to cut the key size down to 512 bits (export restrictions)

   932  *        or for signing-only RSA certificates.

   933  *

   934  *      - Anonymity.  Here no server certificate is sent, only the public

   935  *        key of the server.  This case is subject to man-in-the-middle

   936  *        attacks.  This can be done with Diffie-Hellman keys (DH_anon) or

   937  *        with RSA keys, but is only used in SSLv3 for DH_anon.

   938  *

   939  *      - "Normal" case.  Here a server certificate is sent, and the public

   940  *        key there is used directly in exchanging the premaster secret.

   941  *        For example, Diffie-Hellman "DH" flavor, and any RSA flavor with

   942  *        only 512 bit keys.

   943  *

   944  * If a server certificate is sent, there is no anonymity.  However,

   945  * when a certificate is sent, ephemeral keys may still be used to

   946  * exchange the premaster secret.  That's how RSA_EXPORT often works,

   947  * as well as how the DHE_* flavors work.

   948  */

   949 abstract static class ServerKeyExchange extends HandshakeMessage

   950 {

   951     @Override

   952     int messageType() { return ht_server_key_exchange; }

   953 }

   954 

   955 

   956 /*

   957  * Using RSA for Key Exchange:  exchange a session key that's not as big

   958  * as the signing-only key.  Used for export applications, since exported

   959  * RSA encryption keys can't be bigger than 512 bytes.

   960  *

   961  * This is never used when keys are 512 bits or smaller, and isn't used

   962  * on "US Domestic" ciphers in any case.

   963  */

   964 static final

   965 class RSA_ServerKeyExchange extends ServerKeyExchange

   966 {

   967     private byte[] rsa_modulus;     // 1 to 2^16 - 1 bytes

   968     private byte[] rsa_exponent;    // 1 to 2^16 - 1 bytes

   969 

   970     private Signature signature;

   971     private byte[] signatureBytes;

   972 

   973     /*

   974      * Hash the nonces and the ephemeral RSA public key.

   975      */

   976     private void updateSignature(byte[] clntNonce, byte[] svrNonce)

   977             throws SignatureException {

   978         int tmp;

   979 

   980         signature.update(clntNonce);

   981         signature.update(svrNonce);

   982 

   983         tmp = rsa_modulus.length;

   984         signature.update((byte)(tmp >> 8));

   985         signature.update((byte)(tmp & 0x0ff));

   986         signature.update(rsa_modulus);

   987 

   988         tmp = rsa_exponent.length;

   989         signature.update((byte)(tmp >> 8));

   990         signature.update((byte)(tmp & 0x0ff));

   991         signature.update(rsa_exponent);

   992     }

   993 

   994 

   995     /*

   996      * Construct an RSA server key exchange message, using data

   997      * known _only_ to the server.

   998      *

   999      * The client knows the public key corresponding to this private

  1000      * key, from the Certificate message sent previously.  To comply

  1001      * with US export regulations we use short RSA keys ... either

  1002      * long term ones in the server's X509 cert, or else ephemeral

  1003      * ones sent using this message.

  1004      */

  1005     RSA_ServerKeyExchange(PublicKey ephemeralKey, PrivateKey privateKey,

  1006             RandomCookie clntNonce, RandomCookie svrNonce, SecureRandom sr)

  1007             throws GeneralSecurityException {

  1008         RSAPublicKeySpec rsaKey = JsseJce.getRSAPublicKeySpec(ephemeralKey);

  1009         rsa_modulus = toByteArray(rsaKey.getModulus());

  1010         rsa_exponent = toByteArray(rsaKey.getPublicExponent());

  1011         signature = RSASignature.getInstance();

  1012         signature.initSign(privateKey, sr);

  1013         updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);

  1014         signatureBytes = signature.sign();

  1015     }

  1016 

  1017 

  1018     /*

  1019      * Parse an RSA server key exchange message, using data known

  1020      * to the client (and, in some situations, eavesdroppers).

  1021      */

  1022     RSA_ServerKeyExchange(HandshakeInStream input)

  1023             throws IOException, NoSuchAlgorithmException {

  1024         signature = RSASignature.getInstance();

  1025         rsa_modulus = input.getBytes16();

  1026         rsa_exponent = input.getBytes16();

  1027         signatureBytes = input.getBytes16();

  1028     }

  1029 

  1030     /*

  1031      * Get the ephemeral RSA public key that will be used in this

  1032      * SSL connection.

  1033      */

  1034     PublicKey getPublicKey() {

  1035         try {

  1036             KeyFactory kfac = JsseJce.getKeyFactory("RSA");

  1037             // modulus and exponent are always positive

  1038             RSAPublicKeySpec kspec = new RSAPublicKeySpec(

  1039                 new BigInteger(1, rsa_modulus),

  1040                 new BigInteger(1, rsa_exponent));

  1041             return kfac.generatePublic(kspec);

  1042         } catch (Exception e) {

  1043             throw new RuntimeException(e);

  1044         }

  1045     }

  1046 

  1047     /*

  1048      * Verify the signed temporary key using the hashes computed

  1049      * from it and the two nonces.  This is called by clients

  1050      * with "exportable" RSA flavors.

  1051      */

  1052     boolean verify(PublicKey certifiedKey, RandomCookie clntNonce,

  1053             RandomCookie svrNonce) throws GeneralSecurityException {

  1054         signature.initVerify(certifiedKey);

  1055         updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);

  1056         return signature.verify(signatureBytes);

  1057     }

  1058 

  1059     @Override

  1060     int messageLength() {

  1061         return 6 + rsa_modulus.length + rsa_exponent.length

  1062                + signatureBytes.length;

  1063     }

  1064 

  1065     @Override

  1066     void send(HandshakeOutStream s) throws IOException {

  1067         s.putBytes16(rsa_modulus);

  1068         s.putBytes16(rsa_exponent);

  1069         s.putBytes16(signatureBytes);

  1070     }

  1071 

  1072     @Override

  1073     void print(PrintStream s) throws IOException {

  1074         s.println("*** RSA ServerKeyExchange");

  1075 

  1076         if (debug != null && Debug.isOn("verbose")) {

  1077             Debug.println(s, "RSA Modulus", rsa_modulus);

  1078             Debug.println(s, "RSA Public Exponent", rsa_exponent);

  1079         }

  1080     }

  1081 }

  1082 

  1083 

  1084 /*

  1085  * Using Diffie-Hellman algorithm for key exchange.  All we really need to

  1086  * do is securely get Diffie-Hellman keys (using the same P, G parameters)

  1087  * to our peer, then we automatically have a shared secret without need

  1088  * to exchange any more data.  (D-H only solutions, such as SKIP, could

  1089  * eliminate key exchange negotiations and get faster connection setup.

  1090  * But they still need a signature algorithm like DSS/DSA to support the

  1091  * trusted distribution of keys without relying on unscalable physical

  1092  * key distribution systems.)

  1093  *

  1094  * This class supports several DH-based key exchange algorithms, though

  1095  * perhaps eventually each deserves its own class.  Notably, this has

  1096  * basic support for DH_anon and its DHE_DSS and DHE_RSA signed variants.

  1097  */

  1098 static final

  1099 class DH_ServerKeyExchange extends ServerKeyExchange

  1100 {

  1101     // Fix message encoding, see 4348279

  1102     private static final boolean dhKeyExchangeFix =

  1103         Debug.getBooleanProperty("com.sun.net.ssl.dhKeyExchangeFix", true);

  1104 

  1105     private byte[]                dh_p;        // 1 to 2^16 - 1 bytes

  1106     private byte[]                dh_g;        // 1 to 2^16 - 1 bytes

  1107     private byte[]                dh_Ys;       // 1 to 2^16 - 1 bytes

  1108 

  1109     private byte[]                signature;

  1110 

  1111     // protocol version being established using this ServerKeyExchange message

  1112     ProtocolVersion protocolVersion;

  1113 

  1114     // the preferable signature algorithm used by this ServerKeyExchange message

  1115     private SignatureAndHashAlgorithm preferableSignatureAlgorithm;

  1116 

  1117     /*

  1118      * Construct from initialized DH key object, for DH_anon

  1119      * key exchange.

  1120      */

  1121     DH_ServerKeyExchange(DHCrypt obj, ProtocolVersion protocolVersion) {

  1122         this.protocolVersion = protocolVersion;

  1123         this.preferableSignatureAlgorithm = null;

  1124 

  1125         // The DH key has been validated in the constructor of DHCrypt.

  1126         setValues(obj);

  1127         signature = null;

  1128     }

  1129 

  1130     /*

  1131      * Construct from initialized DH key object and the key associated

  1132      * with the cert chain which was sent ... for DHE_DSS and DHE_RSA

  1133      * key exchange.  (Constructor called by server.)

  1134      */