Subversion Repositories openrisc

/* ClientHandshake.java --

   Copyright (C) 2006  Free Software Foundation, Inc.

This file is a part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation; either version 2 of the License, or (at

your option) any later version.

GNU Classpath is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

General Public License for more details.

You should have received a copy of the GNU General Public License

along with GNU Classpath; if not, write to the Free Software

Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301

USA

Linking this library statically or dynamically with other modules is

making a combined work based on this library.  Thus, the terms and

conditions of the GNU General Public License cover the whole

combination.

As a special exception, the copyright holders of this library give you

permission to link this library with independent modules to produce an

executable, regardless of the license terms of these independent

modules, and to copy and distribute the resulting executable under

terms of your choice, provided that you also meet, for each linked

independent module, the terms and conditions of the license of that

module.  An independent module is a module which is not derived from

or based on this library.  If you modify this library, you may extend

this exception to your version of the library, but you are not

obligated to do so.  If you do not wish to do so, delete this

exception statement from your version. */

package gnu.javax.net.ssl.provider;

import static gnu.javax.net.ssl.provider.ClientHandshake.State.*;

import static gnu.javax.net.ssl.provider.KeyExchangeAlgorithm.*;

import gnu.classpath.debug.Component;

import gnu.java.security.action.GetSecurityPropertyAction;

import gnu.javax.crypto.key.dh.GnuDHPublicKey;

import gnu.javax.net.ssl.AbstractSessionContext;

import gnu.javax.net.ssl.Session;

import gnu.javax.net.ssl.provider.Alert.Description;

import gnu.javax.net.ssl.provider.Alert.Level;

import gnu.javax.net.ssl.provider.CertificateRequest.ClientCertificateType;

import gnu.javax.net.ssl.provider.ServerNameList.NameType;

import gnu.javax.net.ssl.provider.ServerNameList.ServerName;

import java.nio.ByteBuffer;

import java.security.AccessController;

import java.security.InvalidAlgorithmParameterException;

import java.security.InvalidKeyException;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.security.PrivateKey;

import java.security.SignatureException;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.util.Arrays;

import java.util.Collections;

import java.util.LinkedList;

import java.util.List;

import java.util.zip.Deflater;

import java.util.zip.Inflater;

import javax.crypto.BadPaddingException;

import javax.crypto.Cipher;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.NoSuchPaddingException;

import javax.crypto.interfaces.DHPrivateKey;

import javax.crypto.interfaces.DHPublicKey;

import javax.crypto.spec.DHParameterSpec;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLPeerUnverifiedException;

import javax.net.ssl.X509ExtendedKeyManager;

import javax.net.ssl.SSLEngineResult.HandshakeStatus;

import javax.security.auth.x500.X500Principal;

/**

 * @author Casey Marshall (csm@gnu.org)

 */

public class ClientHandshake extends AbstractHandshake

{

  static enum State

  {

    WRITE_CLIENT_HELLO (false, true),

    READ_SERVER_HELLO (true, false),

    READ_CERTIFICATE (true, false),

    READ_SERVER_KEY_EXCHANGE (true, false),

    READ_CERTIFICATE_REQUEST (true, false),

    READ_SERVER_HELLO_DONE (true, false),

    WRITE_CERTIFICATE (false, true),

    WRITE_CLIENT_KEY_EXCHANGE (false, true),

    WRITE_CERTIFICATE_VERIFY (false, true),

    WRITE_FINISHED (false, true),

    READ_FINISHED (true, false),

    DONE (false, false);

    private final boolean isWriteState;

    private final boolean isReadState;

    private State(boolean isReadState, boolean isWriteState)

    {

      this.isReadState = isReadState;

      this.isWriteState = isWriteState;

    }

    boolean isReadState()

    {

      return isReadState;

    }

    boolean isWriteState()

    {

      return isWriteState;

    }

  }

  private State state;

  private ByteBuffer outBuffer;

  private boolean continuedSession;

  private SessionImpl continued;

  private KeyPair dhPair;

  private String keyAlias;

  private PrivateKey privateKey;

  private MaxFragmentLength maxFragmentLengthSent;

  private boolean truncatedHMacSent;

  private ProtocolVersion sentVersion;

  // Delegated tasks.

  private CertVerifier certVerifier;

  private ParamsVerifier paramsVerifier;

  private DelegatedTask keyExchange;

  private CertLoader certLoader;

  private GenCertVerify genCertVerify;

  public ClientHandshake(SSLEngineImpl engine) throws NoSuchAlgorithmException

  {

    super(engine);

    state = WRITE_CLIENT_HELLO;

    continuedSession = false;

  }

  /* (non-Javadoc)

   * @see gnu.javax.net.ssl.provider.AbstractHandshake#implHandleInput()

   */

  @Override protected HandshakeStatus implHandleInput() throws SSLException

  {

    if (state == DONE)

      return HandshakeStatus.FINISHED;

    if (state.isWriteState()

        || (outBuffer != null && outBuffer.hasRemaining()))

      return HandshakeStatus.NEED_WRAP;

    // Copy the current buffer, and prepare it for reading.

    ByteBuffer buffer = handshakeBuffer.duplicate ();

    buffer.flip();

    buffer.position(handshakeOffset);

    Handshake handshake = new Handshake(buffer.slice(),

                                        engine.session().suite,

                                        engine.session().version);

    if (Debug.DEBUG)

      logger.logv(Component.SSL_HANDSHAKE, "processing in state {0}:\n{1}",

                  state, handshake);

    switch (state)

      {

        // Server Hello.

        case READ_SERVER_HELLO:

        {

          if (handshake.type() != Handshake.Type.SERVER_HELLO)

            throw new AlertException(new Alert(Alert.Level.FATAL,

                                               Alert.Description.UNEXPECTED_MESSAGE));

          ServerHello hello = (ServerHello) handshake.body();

          serverRandom = hello.random().copy();

          engine.session().suite = hello.cipherSuite();

          engine.session().version = hello.version();

          compression = hello.compressionMethod();

          Session.ID serverId = new Session.ID(hello.sessionId());

          if (continued != null

              && continued.id().equals(serverId))

            {

              continuedSession = true;

              engine.setSession(continued);

            }

          else if (engine.getEnableSessionCreation())

            {

              ((AbstractSessionContext) engine.contextImpl

                  .engineGetClientSessionContext()).put(engine.session());

            }

          ExtensionList extensions = hello.extensions();

          if (extensions != null)

            {

              for (Extension extension : extensions)

                {

                  Extension.Type type = extension.type();

                  if (type == null)

                    continue;

                  switch (type)

                    {

                      case MAX_FRAGMENT_LENGTH:

                        MaxFragmentLength mfl

                          = (MaxFragmentLength) extension.value();

                        if (maxFragmentLengthSent == mfl)

                          engine.session().setApplicationBufferSize(mfl.maxLength());

                        break;

                      case TRUNCATED_HMAC:

                        if (truncatedHMacSent)

                          engine.session().setTruncatedMac(true);

                        break;

                    }

                }

            }

          KeyExchangeAlgorithm kex = engine.session().suite.keyExchangeAlgorithm();

          if (continuedSession)

            {

              byte[][] keys = generateKeys(clientRandom, serverRandom,

                                           engine.session());

              setupSecurityParameters(keys, true, engine, compression);

              state = READ_FINISHED;

            }

          else if (kex == RSA || kex == DH_DSS || kex == DH_RSA

                   || kex == DHE_DSS || kex == DHE_RSA || kex == RSA_PSK)

            state = READ_CERTIFICATE;

          else if (kex == DH_anon || kex == PSK || kex == DHE_PSK)

            state = READ_SERVER_KEY_EXCHANGE;

          else

            state = READ_CERTIFICATE_REQUEST;

        }

        break;

        // Server Certificate.

        case READ_CERTIFICATE:

        {

          if (handshake.type() != Handshake.Type.CERTIFICATE)

            {

              // We need a certificate for non-anonymous suites.

              if (engine.session().suite.signatureAlgorithm() != SignatureAlgorithm.ANONYMOUS)

                throw new AlertException(new Alert(Level.FATAL,

                                                   Description.UNEXPECTED_MESSAGE));

              state = READ_SERVER_KEY_EXCHANGE;

            }

          Certificate cert = (Certificate) handshake.body();

          X509Certificate[] chain = null;

          try

            {

              chain = cert.certificates().toArray(new X509Certificate[0]);

            }

          catch (CertificateException ce)

            {

              throw new AlertException(new Alert(Level.FATAL,

                                                 Description.BAD_CERTIFICATE),

                                       ce);

            }

          catch (NoSuchAlgorithmException nsae)

            {

              throw new AlertException(new Alert(Level.FATAL,

                                                 Description.UNSUPPORTED_CERTIFICATE),

                                       nsae);

            }

          engine.session().setPeerCertificates(chain);

          certVerifier = new CertVerifier(true, chain);

          tasks.add(certVerifier);

          // If we are doing an RSA key exchange, generate our parameters.

          KeyExchangeAlgorithm kea = engine.session().suite.keyExchangeAlgorithm();

          if (kea == RSA || kea == RSA_PSK)

            {

              keyExchange = new RSAGen(kea == RSA);

              tasks.add(keyExchange);

              if (kea == RSA)

                state = READ_CERTIFICATE_REQUEST;

              else

                state = READ_SERVER_KEY_EXCHANGE;

            }

          else

            state = READ_SERVER_KEY_EXCHANGE;

        }

        break;

        // Server Key Exchange.

        case READ_SERVER_KEY_EXCHANGE:

        {

          CipherSuite s = engine.session().suite;

          KeyExchangeAlgorithm kexalg = s.keyExchangeAlgorithm();

          // XXX also SRP.

          if (kexalg != DHE_DSS && kexalg != DHE_RSA && kexalg != DH_anon

              && kexalg != DHE_PSK && kexalg != PSK && kexalg != RSA_PSK)

            throw new AlertException(new Alert(Level.FATAL,

                                               Description.UNEXPECTED_MESSAGE));

          if (handshake.type() != Handshake.Type.SERVER_KEY_EXCHANGE)

            {

              if (kexalg != RSA_PSK && kexalg != PSK)

                throw new AlertException(new Alert(Level.FATAL,

                                                   Description.UNEXPECTED_MESSAGE));

              state = READ_CERTIFICATE_REQUEST;

              return HandshakeStatus.NEED_UNWRAP;

            }

          ServerKeyExchange skex = (ServerKeyExchange) handshake.body();

          ByteBuffer paramsBuffer = null;

          if (kexalg == DHE_DSS || kexalg == DHE_RSA || kexalg == DH_anon)

            {

              ServerDHParams dhParams = (ServerDHParams) skex.params();

              ByteBuffer b = dhParams.buffer();

              paramsBuffer = ByteBuffer.allocate(b.remaining());

              paramsBuffer.put(b);

            }

          if (s.signatureAlgorithm() != SignatureAlgorithm.ANONYMOUS)

            {

              byte[] signature = skex.signature().signature();

              paramsVerifier = new ParamsVerifier(paramsBuffer, signature);

              tasks.add(paramsVerifier);

            }

          if (kexalg == DHE_DSS || kexalg == DHE_RSA || kexalg == DH_anon)

            {

              ServerDHParams dhParams = (ServerDHParams) skex.params();

              DHPublicKey serverKey = new GnuDHPublicKey(null,

                                                         dhParams.p(),

                                                         dhParams.g(),

                                                         dhParams.y());

              DHParameterSpec params = new DHParameterSpec(dhParams.p(),

                                                           dhParams.g());

              keyExchange = new ClientDHGen(serverKey, params, true);

              tasks.add(keyExchange);

            }

          if (kexalg == DHE_PSK)

            {

              ServerDHE_PSKParameters pskParams = (ServerDHE_PSKParameters)

                skex.params();

              ServerDHParams dhParams = pskParams.params();

              DHPublicKey serverKey = new GnuDHPublicKey(null,

                                                         dhParams.p(),

                                                         dhParams.g(),

                                                         dhParams.y());

              DHParameterSpec params = new DHParameterSpec(dhParams.p(),

                                                           dhParams.g());

              keyExchange = new ClientDHGen(serverKey, params, false);

              tasks.add(keyExchange);

            }

          state = READ_CERTIFICATE_REQUEST;

        }

        break;

        // Certificate Request.

        case READ_CERTIFICATE_REQUEST:

        {

          if (handshake.type() != Handshake.Type.CERTIFICATE_REQUEST)

            {

              state = READ_SERVER_HELLO_DONE;

              return HandshakeStatus.NEED_UNWRAP;

            }

          CertificateRequest req = (CertificateRequest) handshake.body();

          ClientCertificateTypeList types = req.types();

          LinkedList<String> typeList = new LinkedList<String>();

          for (ClientCertificateType t : types)

            typeList.add(t.name());

          X500PrincipalList issuers = req.authorities();

          LinkedList<X500Principal> issuerList = new LinkedList<X500Principal>();

          for (X500Principal p : issuers)

            issuerList.add(p);

          certLoader = new CertLoader(typeList, issuerList);

          tasks.add(certLoader);

        }

        break;

        // Server Hello Done.

        case READ_SERVER_HELLO_DONE:

        {

          if (handshake.type() != Handshake.Type.SERVER_HELLO_DONE)

            throw new AlertException(new Alert(Level.FATAL,

                                               Description.UNEXPECTED_MESSAGE));

          state = WRITE_CERTIFICATE;

        }

        break;

        // Finished.

        case READ_FINISHED:

        {

          if (handshake.type() != Handshake.Type.FINISHED)

            throw new AlertException(new Alert(Level.FATAL,

                                               Description.UNEXPECTED_MESSAGE));

          Finished serverFinished = (Finished) handshake.body();

          MessageDigest md5copy = null;

          MessageDigest shacopy = null;

          try

            {

              md5copy = (MessageDigest) md5.clone();

              shacopy = (MessageDigest) sha.clone();

            }

          catch (CloneNotSupportedException cnse)

            {

              // We're improperly configured to use a non-cloneable

              // md5/sha-1, OR there's a runtime bug.

              throw new SSLException(cnse);

            }

          Finished clientFinished =

            new Finished(generateFinished(md5copy, shacopy,

                                          false, engine.session()),

                                          engine.session().version);

          if (Debug.DEBUG)

            logger.logv(Component.SSL_HANDSHAKE, "clientFinished: {0}",

                        clientFinished);

          if (engine.session().version == ProtocolVersion.SSL_3)

            {

              if (!Arrays.equals(clientFinished.md5Hash(),

                                 serverFinished.md5Hash())

                  || !Arrays.equals(clientFinished.shaHash(),

                                    serverFinished.shaHash()))

                {

                  engine.session().invalidate();

                  throw new SSLException("session verify failed");

                }

            }

          else

            {

              if (!Arrays.equals(clientFinished.verifyData(),

                                 serverFinished.verifyData()))

                {

                  engine.session().invalidate();

                  throw new SSLException("session verify failed");

                }

            }

          if (continuedSession)

            {

              engine.changeCipherSpec();

              state = WRITE_FINISHED;

            }

          else

            state = DONE;

        }

        break;

        default:

          throw new IllegalStateException("invalid state: " + state);

      }

    handshakeOffset += handshake.length() + 4;

    if (!tasks.isEmpty())

      return HandshakeStatus.NEED_TASK;

    if (state.isWriteState()

        || (outBuffer != null && outBuffer.hasRemaining()))

      return HandshakeStatus.NEED_WRAP;

    if (state.isReadState())

      return HandshakeStatus.NEED_UNWRAP;

    return HandshakeStatus.FINISHED;

  }

  /* (non-Javadoc)

   * @see gnu.javax.net.ssl.provider.AbstractHandshake#implHandleOutput(java.nio.ByteBuffer)

   */

  @Override protected HandshakeStatus implHandleOutput(ByteBuffer fragment)

    throws SSLException

  {

    if (Debug.DEBUG)

      logger.logv(Component.SSL_HANDSHAKE, "output to {0}; state:{1}; outBuffer:{2}",

                  fragment, state, outBuffer);

    // Drain the output buffer, if it needs it.

    if (outBuffer != null && outBuffer.hasRemaining())

      {

        int l = Math.min(fragment.remaining(), outBuffer.remaining());

        fragment.put((ByteBuffer) outBuffer.duplicate().limit(outBuffer.position() + l));

        outBuffer.position(outBuffer.position() + l);

      }

    if (!fragment.hasRemaining())

      {

        if (state.isWriteState() || outBuffer.hasRemaining())

          return HandshakeStatus.NEED_WRAP;

        else

          return HandshakeStatus.NEED_UNWRAP;

      }

outer_loop:

    while (fragment.remaining() >= 4 && state.isWriteState())

      {

        if (Debug.DEBUG)

          logger.logv(Component.SSL_HANDSHAKE, "loop state={0}", state);

        switch (state)

          {

            case WRITE_CLIENT_HELLO:

            {

              ClientHelloBuilder hello = new ClientHelloBuilder();

              AbstractSessionContext ctx = (AbstractSessionContext)

                engine.contextImpl.engineGetClientSessionContext();

              continued = (SessionImpl) ctx.getSession(engine.getPeerHost(),

                                                       engine.getPeerPort());

              engine.session().setId(new Session.ID(new byte[0]));

              Session.ID sid = engine.session().id();

              // If we have a session that we may want to continue, send

              // that ID.

              if (continued != null)

                sid = continued.id();

              hello.setSessionId(sid.id());

              sentVersion = chooseVersion();

              hello.setVersion(sentVersion);

              hello.setCipherSuites(getSuites());

              hello.setCompressionMethods(getCompressionMethods());

              Random r = hello.random();

              r.setGmtUnixTime(Util.unixTime());

              byte[] nonce = new byte[28];

              engine.session().random().nextBytes(nonce);

              r.setRandomBytes(nonce);

              clientRandom = r.copy();

              if (enableExtensions())

                {

                  List<Extension> extensions = new LinkedList<Extension>();

                  MaxFragmentLength fraglen = maxFragmentLength();

                  if (fraglen != null)

                    {

                      extensions.add(new Extension(Extension.Type.MAX_FRAGMENT_LENGTH,

                                                   fraglen));

                      maxFragmentLengthSent = fraglen;

                    }

                  String host = engine.getPeerHost();

                  if (host != null)

                    {

                      ServerName name

                        = new ServerName(NameType.HOST_NAME, host);

                      ServerNameList names

                        = new ServerNameList(Collections.singletonList(name));

                      extensions.add(new Extension(Extension.Type.SERVER_NAME,

                                                   names));

                    }

                  if (truncatedHMac())

                    {

                      extensions.add(new Extension(Extension.Type.TRUNCATED_HMAC,

                                                   new TruncatedHMAC()));

                      truncatedHMacSent = true;

                    }

                  ExtensionList elist = new ExtensionList(extensions);

                  hello.setExtensions(elist.buffer());

                }

              else

                hello.setDisableExtensions(true);

              if (Debug.DEBUG)

                logger.logv(Component.SSL_HANDSHAKE, "{0}", hello);

              fragment.putInt((Handshake.Type.CLIENT_HELLO.getValue() << 24)

                              | (hello.length() & 0xFFFFFF));

              outBuffer = hello.buffer();

              int l = Math.min(fragment.remaining(), outBuffer.remaining());

              fragment.put((ByteBuffer) outBuffer.duplicate()

                           .limit(outBuffer.position() + l));

              outBuffer.position(outBuffer.position() + l);

              state = READ_SERVER_HELLO;

            }

            break;

            case WRITE_CERTIFICATE:

            {

              java.security.cert.Certificate[] chain

                = engine.session().getLocalCertificates();

              if (chain != null)

                {

                  CertificateBuilder cert

                    = new CertificateBuilder(CertificateType.X509);

                  try

                    {

                      cert.setCertificates(Arrays.asList(chain));

                    }

                  catch (CertificateException ce)

                    {

                      throw new AlertException(new Alert(Level.FATAL,

                                                         Description.INTERNAL_ERROR),

                                               ce);

                    }

                  outBuffer = cert.buffer();

                  fragment.putInt((Handshake.Type.CERTIFICATE.getValue() << 24)

                                  | (cert.length() & 0xFFFFFF));

                  int l = Math.min(fragment.remaining(), outBuffer.remaining());

                  fragment.put((ByteBuffer) outBuffer.duplicate()

                               .limit(outBuffer.position() + l));

                  outBuffer.position(outBuffer.position() + l);

                }

              state = WRITE_CLIENT_KEY_EXCHANGE;

            }

            break;

            case WRITE_CLIENT_KEY_EXCHANGE:

            {

              KeyExchangeAlgorithm kea = engine.session().suite.keyExchangeAlgorithm();

              ClientKeyExchangeBuilder ckex

                = new ClientKeyExchangeBuilder(engine.session().suite,

                                               engine.session().version);

              if (kea == DHE_DSS || kea == DHE_RSA || kea == DH_anon

                  || kea == DH_DSS || kea == DH_RSA)

                {

                  assert(dhPair != null);

                  DHPublicKey pubkey = (DHPublicKey) dhPair.getPublic();

                  ClientDiffieHellmanPublic pub

                    = new ClientDiffieHellmanPublic(pubkey.getY());

                  ckex.setExchangeKeys(pub.buffer());

                }

              if (kea == RSA || kea == RSA_PSK)

                {

                  assert(keyExchange instanceof RSAGen);

                  assert(keyExchange.hasRun());

                  if (keyExchange.thrown() != null)