Subversion Repositories openrisc

/* ServerHandshake.java -- the server-side handshake.

   Copyright (C) 2006  Free Software Foundation, Inc.

This file is a part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation; either version 2 of the License, or (at

your option) any later version.

GNU Classpath is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

General Public License for more details.

You should have received a copy of the GNU General Public License

along with GNU Classpath; if not, write to the Free Software

Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301

USA

Linking this library statically or dynamically with other modules is

making a combined work based on this library.  Thus, the terms and

conditions of the GNU General Public License cover the whole

combination.

As a special exception, the copyright holders of this library give you

permission to link this library with independent modules to produce an

executable, regardless of the license terms of these independent

modules, and to copy and distribute the resulting executable under

terms of your choice, provided that you also meet, for each linked

independent module, the terms and conditions of the license of that

module.  An independent module is a module which is not derived from

or based on this library.  If you modify this library, you may extend

this exception to your version of the library, but you are not

obligated to do so.  If you do not wish to do so, delete this

exception statement from your version.  */

package gnu.javax.net.ssl.provider;

import static gnu.javax.net.ssl.provider.Handshake.Type.*;

import static gnu.javax.net.ssl.provider.KeyExchangeAlgorithm.*;

import static gnu.javax.net.ssl.provider.ServerHandshake.State.*;

import gnu.classpath.debug.Component;

import gnu.java.security.action.GetSecurityPropertyAction;

import gnu.javax.crypto.key.dh.GnuDHPublicKey;

import gnu.javax.net.ssl.AbstractSessionContext;

import gnu.javax.net.ssl.Session;

import gnu.javax.net.ssl.provider.Alert.Description;

import gnu.javax.net.ssl.provider.CertificateRequest.ClientCertificateType;

import java.nio.ByteBuffer;

import java.security.AccessController;

import java.security.InvalidAlgorithmParameterException;

import java.security.InvalidKeyException;

import java.security.KeyManagementException;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.security.Principal;

import java.security.PrivateKey;

import java.security.SignatureException;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.HashSet;

import java.util.List;

import java.util.logging.Level;

import java.util.zip.Deflater;

import java.util.zip.Inflater;

import javax.crypto.BadPaddingException;

import javax.crypto.Cipher;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.NoSuchPaddingException;

import javax.crypto.SecretKey;

import javax.crypto.interfaces.DHPrivateKey;

import javax.crypto.interfaces.DHPublicKey;

import javax.crypto.spec.DHParameterSpec;

import javax.crypto.spec.SecretKeySpec;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLPeerUnverifiedException;

import javax.net.ssl.SSLSession;

import javax.net.ssl.X509ExtendedKeyManager;

import javax.net.ssl.SSLEngineResult.HandshakeStatus;

import javax.security.auth.x500.X500Principal;

class ServerHandshake extends AbstractHandshake

{

  /**

   * Handshake state enumeration.

   */

  static enum State

  {

    WRITE_HELLO_REQUEST (true, false),

    WRITE_SERVER_HELLO (true, false),

    WRITE_CERTIFICATE (true, false),

    WRITE_SERVER_KEY_EXCHANGE (true, false),

    WRITE_CERTIFICATE_REQUEST (true, false),

    WRITE_SERVER_HELLO_DONE (true, false),

    WRITE_FINISHED (true, false),

    READ_CLIENT_HELLO (false, true),

    READ_CERTIFICATE (false, true),

    READ_CLIENT_KEY_EXCHANGE (false, true),

    READ_CERTIFICATE_VERIFY (false, true),

    READ_FINISHED (false, true),

    DONE (false, false);

    private final boolean isWriteState;

    private final boolean isReadState;

    private State(final boolean isWriteState, final boolean isReadState)

    {

      this.isWriteState = isWriteState;

      this.isReadState = isReadState;

    }

    boolean isReadState()

    {

      return isReadState;

    }

    boolean isWriteState()

    {

      return isWriteState;

    }

  }

  private State state;

  /* Handshake result fields. */

  private ByteBuffer outBuffer;

  private boolean clientHadExtensions = false;

  private boolean continuedSession = false;

  private ServerNameList requestedNames = null;

  private String keyAlias = null;

  private X509Certificate clientCert = null;

  private X509Certificate localCert = null;

  private boolean helloV2 = false;

  private KeyPair dhPair;

  private PrivateKey serverKey;

  // Delegated tasks we use.

  private GenDH genDH;

  private CertVerifier certVerifier;

  private CertLoader certLoader;

  private DelegatedTask keyExchangeTask;

  ServerHandshake (boolean writeHelloRequest, final SSLEngineImpl engine)

    throws NoSuchAlgorithmException

  {

    super(engine);

    if (writeHelloRequest)

      state = WRITE_HELLO_REQUEST;

    else

      state = READ_CLIENT_HELLO;

    handshakeOffset = 0;

  }

  /**

   * Choose the protocol version. Here we choose the largest protocol

   * version we support that is not greater than the client's

   * requested version.

   */

  private static ProtocolVersion chooseProtocol (final ProtocolVersion clientVersion,

                                                 final String[] enabledVersions)

    throws SSLException

  {

    ProtocolVersion version = null;

    for (int i = 0; i < enabledVersions.length; i++)

      {

        ProtocolVersion v = ProtocolVersion.forName (enabledVersions[i]);

        if (v.compareTo (clientVersion) <= 0)

          {

            if (version == null

                || v.compareTo (version) > 0)

              version = v;

          }

      }

    // The client requested a protocol version too old, or no protocol

    // versions are enabled.

    if (version == null)

      throw new SSLException ("no acceptable protocol version available");

    return version;

  }

  /**

   * Choose the first cipher suite in the client's requested list that

   * we have enabled.

   */

  private CipherSuite chooseSuite (final CipherSuiteList clientSuites,

                                   final String[] enabledSuites,

                                   final ProtocolVersion version)

    throws SSLException

  {

    // Figure out which SignatureAlgorithms we can support.

    HashSet<KeyExchangeAlgorithm> kexes = new HashSet<KeyExchangeAlgorithm>(8);

    kexes.add(NONE);

    X509ExtendedKeyManager km = engine.contextImpl.keyManager;

    if (km != null)

      {

        if (km.getServerAliases(DH_DSS.name(), null).length > 0)

          kexes.add(DH_DSS);

        if (km.getServerAliases(DH_RSA.name(), null).length > 0)

          kexes.add(DH_RSA);

        if (km.getServerAliases(DHE_DSS.name(), null).length > 0)

          kexes.add(DHE_DSS);

        if (km.getServerAliases(DHE_RSA.name(), null).length > 0)

          kexes.add(DHE_RSA);

        if (km.getServerAliases(RSA.name(), null).length > 0)

          kexes.add(RSA);

        if (km.getServerAliases(RSA_PSK.name(), null).length > 0

            && engine.contextImpl.pskManager != null)

          kexes.add(RSA_PSK);

      }

    if (engine.contextImpl.pskManager != null)

      {

        kexes.add(DHE_PSK);

        kexes.add(PSK);

      }

    if (Debug.DEBUG)

      logger.logv(Component.SSL_HANDSHAKE,

                  "we have certs for key exchange algorithms {0}", kexes);

    HashSet<CipherSuite> suites = new HashSet<CipherSuite>();

    for (String s : enabledSuites)

      {

        CipherSuite suite = CipherSuite.forName(s);

        if (suite == null)

          continue;

        if (!kexes.contains(suite.keyExchangeAlgorithm()))

          continue;

        suites.add(suite);

      }

    for (CipherSuite suite : clientSuites)

      {

        CipherSuite resolved = suite.resolve();

        if (!resolved.isResolved())

          continue;

        if (suites.contains(resolved))

          return resolved;

      }

    // We didn't find a match?

    throw new AlertException(new Alert(Alert.Level.FATAL,

                                       Alert.Description.INSUFFICIENT_SECURITY));

  }

  /**

   * Choose a compression method that we support, among the client's

   * requested compression methods. We prefer ZLIB over NONE in this

   * implementation.

   *

   * XXX Maybe consider implementing lzo (GNUTLS supports that).

   */

  private static CompressionMethod chooseCompression (final CompressionMethodList comps)

    throws SSLException

  {

    GetSecurityPropertyAction gspa

      = new GetSecurityPropertyAction("jessie.enable.compression");

    String enable = AccessController.doPrivileged(gspa);

    // Scan for ZLIB first.

    if (Boolean.valueOf(enable))

      {

        for (CompressionMethod cm : comps)

          {

            if (cm.equals (CompressionMethod.ZLIB))

              return CompressionMethod.ZLIB;

          }

      }

    for (CompressionMethod cm : comps)

      {

        if (cm.equals (CompressionMethod.NULL))

          return CompressionMethod.NULL;

      }

    throw new SSLException ("no supported compression method");

  }

  protected @Override boolean doHash()

  {

    boolean b = helloV2;

    helloV2 = false;

    return (state != WRITE_HELLO_REQUEST) && !b;

  }

  public @Override HandshakeStatus implHandleInput()

    throws SSLException

  {

    if (state == DONE)

      return HandshakeStatus.FINISHED;

    if (state.isWriteState()

        || (outBuffer != null && outBuffer.hasRemaining()))

      return HandshakeStatus.NEED_WRAP;

    // Copy the current buffer, and prepare it for reading.

    ByteBuffer buffer = handshakeBuffer.duplicate ();

    buffer.flip();

    buffer.position(handshakeOffset);

    Handshake handshake = new Handshake(buffer.slice(),

                                        engine.session().suite,

                                        engine.session().version);

    if (Debug.DEBUG)

      logger.logv(Component.SSL_HANDSHAKE, "processing in state {0}:\n{1}",

                  state, handshake);

    switch (state)

      {

        // Client Hello.

        //

        // This message is sent by the client to initiate a new handshake.

        // On a new connection, it is the first handshake message sent.

        //

        // The state of the handshake, after this message is processed,

        // will have a protocol version, cipher suite, compression method,

        // session ID, and various extensions (that the server also

        // supports).

        case READ_CLIENT_HELLO:

          if (handshake.type () != CLIENT_HELLO)

            throw new AlertException(new Alert(Alert.Level.FATAL,

                                               Alert.Description.UNEXPECTED_MESSAGE));

          {

            ClientHello hello = (ClientHello) handshake.body ();

            engine.session().version

              = chooseProtocol (hello.version (),

                                engine.getEnabledProtocols ());

            engine.session().suite =

              chooseSuite (hello.cipherSuites (),

                           engine.getEnabledCipherSuites (),

                           engine.session().version);

            compression = chooseCompression (hello.compressionMethods ());

            if (Debug.DEBUG)

              logger.logv(Component.SSL_HANDSHAKE,

                          "chose version:{0} suite:{1} compression:{2}",

                          engine.session().version, engine.session().suite,

                          compression);

            clientRandom = hello.random().copy();

            byte[] sessionId = hello.sessionId();

            if (hello.hasExtensions())

              {

                ExtensionList exts = hello.extensions();

                clientHadExtensions = exts.size() > 0;

                for (Extension e : hello.extensions())

                  {

                    Extension.Type type = e.type();

                    if (type == null)

                      continue;

                    switch (type)

                    {

                    case TRUNCATED_HMAC:

                      engine.session().setTruncatedMac(true);

                      break;

                    case MAX_FRAGMENT_LENGTH:

                      MaxFragmentLength len = (MaxFragmentLength) e.value();

                      engine.session().maxLength = len;

                      engine.session().setApplicationBufferSize(len.maxLength());

                      break;

                    case SERVER_NAME:

                      requestedNames = (ServerNameList) e.value();

                      List<String> names

                        = new ArrayList<String>(requestedNames.size());

                      for (ServerNameList.ServerName name : requestedNames)

                        names.add(name.name());

                      engine.session().putValue("gnu.javax.net.ssl.RequestedServerNames", names);

                      break;

                    default:

                      logger.log(Level.INFO, "skipping unsupported extension {0}", e);

                    }

                  }

              }

            AbstractSessionContext sessions = (AbstractSessionContext)

              engine.contextImpl.engineGetServerSessionContext();

            SSLSession s = sessions.getSession(sessionId);

            if (Debug.DEBUG)

              logger.logv(Component.SSL_HANDSHAKE, "looked up saved session {0}", s);

            if (s != null && s.isValid() && (s instanceof SessionImpl))

              {

                engine.setSession((SessionImpl) s);

                continuedSession = true;

              }

            else

              {

                // We *may* wind up with a badly seeded PRNG, and emit the

                // same session ID over and over (this did happen to me,

                // so we add this sanity check just in case).

                if (engine.session().id().equals(new Session.ID(sessionId)))

                  {

                    byte[] newId = new byte[32];

                    engine.session().random().nextBytes(newId);

                    engine.session().setId(new Session.ID(newId));

                  }

                sessions.put(engine.session());

              }

            state = WRITE_SERVER_HELLO;

          }

          break;

        // Certificate.

        //

        // This message is sent by the client if the server had previously

        // requested that the client authenticate itself with a certificate,

        // and if the client has an appropriate certificate available.

        //

        // Processing this message will save the client's certificate,

        // rejecting it if the certificate is not trusted, in preparation

        // for the certificate verify message that will follow.

        case READ_CERTIFICATE:

          {

            if (handshake.type() != CERTIFICATE)

              {

                if (engine.getNeedClientAuth()) // XXX throw better exception.

                  throw new SSLException("client auth required");

                state = READ_CLIENT_KEY_EXCHANGE;

                return HandshakeStatus.NEED_UNWRAP;

              }

            Certificate cert = (Certificate) handshake.body();

            try

              {

                engine.session().setPeerVerified(false);

                X509Certificate[] chain

                  = cert.certificates().toArray(new X509Certificate[0]);

                if (chain.length == 0)

                  throw new CertificateException("no certificates in chain");

                certVerifier = new CertVerifier(false, chain);

                tasks.add(certVerifier);

                engine.session().setPeerCertificates(chain);

                clientCert = chain[0];

                // Delay setting 'peerVerified' until CertificateVerify.

              }

            catch (CertificateException ce)

              {

                if (engine.getNeedClientAuth())

                  {

                    SSLPeerUnverifiedException x

                      = new SSLPeerUnverifiedException("client certificates could not be verified");

                    x.initCause(ce);

                    throw x;

                  }

              }

            catch (NoSuchAlgorithmException nsae)

              {

                throw new SSLException(nsae);

              }

            state = READ_CLIENT_KEY_EXCHANGE;

          }

          break;

        // Client Key Exchange.

        //

        // The client's key exchange. This message is sent either following

        // the certificate message, or if no certificate is available or

        // requested, following the server's hello done message.

        //

        // After receipt of this message, the session keys for this

        // session will have been created.

        case READ_CLIENT_KEY_EXCHANGE:

          {

            if (handshake.type() != CLIENT_KEY_EXCHANGE)

              throw new SSLException("expecting client key exchange");

            ClientKeyExchange kex = (ClientKeyExchange) handshake.body();

            KeyExchangeAlgorithm alg = engine.session().suite.keyExchangeAlgorithm();

            switch (alg)

              {

                case DHE_DSS:

                case DHE_RSA:

                case DH_anon:

                  {

                    ClientDiffieHellmanPublic pub = (ClientDiffieHellmanPublic)

                      kex.exchangeKeys();

                    DHPublicKey myKey = (DHPublicKey) dhPair.getPublic();

                    DHPublicKey clientKey =

                      new GnuDHPublicKey(null, myKey.getParams().getP(),

                                         myKey.getParams().getG(),

                                         pub.publicValue());

                    keyExchangeTask = new DHPhase(clientKey);

                    tasks.add(keyExchangeTask);

                  }

                  break;

                case RSA:

                  {

                    EncryptedPreMasterSecret secret = (EncryptedPreMasterSecret)

                      kex.exchangeKeys();

                    keyExchangeTask = new RSAKeyExchange(secret.encryptedSecret());

                    tasks.add(keyExchangeTask);

                  }

                  break;

                case PSK:

                  {

                    ClientPSKParameters params = (ClientPSKParameters)

                      kex.exchangeKeys();

                    generatePSKSecret(params.identity(), null, false);

                  }

                  break;

                case DHE_PSK:

                  {

                    ClientDHE_PSKParameters params = (ClientDHE_PSKParameters)

                      kex.exchangeKeys();

                    DHPublicKey serverKey = (DHPublicKey) dhPair.getPublic();

                    DHPublicKey clientKey =

                      new GnuDHPublicKey(null, serverKey.getParams().getP(),

                                         serverKey.getParams().getG(),

                                         params.params().publicValue());

                    SecretKey psk = null;

                    try

                      {

                        psk = engine.contextImpl.pskManager.getKey(params.identity());

                      }

                    catch (KeyManagementException kme)

                      {

                      }

                    keyExchangeTask = new DHE_PSKGen(clientKey, psk, false);

                    tasks.add(keyExchangeTask);

                  }

                  break;

                case RSA_PSK:

                  {

                    ClientRSA_PSKParameters params = (ClientRSA_PSKParameters)

                      kex.exchangeKeys();

                    SecretKey psk = null;

                    try

                      {

                        psk = engine.contextImpl.pskManager.getKey(params.identity());

                      }

                    catch (KeyManagementException kme)

                      {

                      }

                    if (psk == null)

                      {

                        byte[] fakeKey = new byte[16];

                        engine.session().random().nextBytes(fakeKey);

                        psk = new SecretKeySpec(fakeKey, "DHE_PSK");

                      }

                    keyExchangeTask =

                      new RSA_PSKExchange(params.secret().encryptedSecret(), psk);

                    tasks.add(keyExchangeTask);

                  }

                  break;

                case NONE:

                  {

                    Inflater inflater = null;

                    Deflater deflater = null;

                    if (compression == CompressionMethod.ZLIB)

                      {

                        inflater = new Inflater();

                        deflater = new Deflater();

                      }

                    inParams = new InputSecurityParameters(null, null, inflater,

                                                           engine.session(),

                                                           engine.session().suite);

                    outParams = new OutputSecurityParameters(null, null, deflater,

                                                             engine.session(),

                                                             engine.session().suite);

                    engine.session().privateData.masterSecret = new byte[0];

                  }

                  break;

              }

            // XXX SRP

            if (clientCert != null)

              state = READ_CERTIFICATE_VERIFY;

            else

              state = READ_FINISHED;

          }

          break;

        // Certificate Verify.

        //

        // This message is sent following the client key exchange message,

        // but only when the client included its certificate in a previous

        // message.

        //

        // After receipt of this message, the client's certificate (and,

        // to a degree, the client's identity) will have been verified.

        case READ_CERTIFICATE_VERIFY:

          {

            if (handshake.type() != CERTIFICATE_VERIFY)

              throw new SSLException("expecting certificate verify message");

            CertificateVerify verify = (CertificateVerify) handshake.body();

            try

              {

                verifyClient(verify.signature());

                if (certVerifier != null && certVerifier.verified())

                  engine.session().setPeerVerified(true);

              }

            catch (SignatureException se)

              {

                if (engine.getNeedClientAuth())

                  throw new SSLException("client auth failed", se);

              }

            if (continuedSession)

              {

                engine.changeCipherSpec();

                state = WRITE_FINISHED;

              }

            else

              state = READ_FINISHED;

          }

          break;

        // Finished.

        //

        // This message is sent immediately following the change cipher

        // spec message (which is sent outside of the handshake layer).

        // After receipt of this message, the session keys for the client

        // side will have been verified (this is the first message the

        // client sends encrypted and authenticated with the newly

        // negotiated keys).

        //

        // In the case of a continued session, the client sends its

        // finished message first. Otherwise, the server will send its

        // finished message first.

        case READ_FINISHED:

          {

            if (handshake.type() != FINISHED)

              throw new AlertException(new Alert(Alert.Level.FATAL,

                                                 Description.UNEXPECTED_MESSAGE));

            Finished clientFinished = (Finished) handshake.body();

            MessageDigest md5copy = null;

            MessageDigest shacopy = null;

            try

              {

                md5copy = (MessageDigest) md5.clone();

                shacopy = (MessageDigest) sha.clone();

              }

            catch (CloneNotSupportedException cnse)

              {

                // We're improperly configured to use a non-cloneable

                // md5/sha-1, OR there's a runtime bug.

                throw new SSLException(cnse);

              }

            Finished serverFinished =

              new Finished(generateFinished(md5copy, shacopy,

                                            true, engine.session()),

                                            engine.session().version);