| /* |
| * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.ssl; |
| |
| import java.io.*; |
| import java.nio.*; |
| import java.util.Arrays; |
| |
| import javax.net.ssl.SSLException; |
| import sun.misc.HexDumpEncoder; |
| |
| |
| /** |
| * {@code OutputRecord} takes care of the management of SSL/TLS/DTLS output |
| * records, including buffering, encryption, handshake messages marshal, etc. |
| * |
| * @author David Brownell |
| */ |
| abstract class OutputRecord extends ByteArrayOutputStream |
| implements Record, Closeable { |
| |
| /* Class and subclass dynamic debugging support */ |
| static final Debug debug = Debug.getInstance("ssl"); |
| |
| Authenticator writeAuthenticator; |
| CipherBox writeCipher; |
| |
| HandshakeHash handshakeHash; |
| boolean firstMessage; |
| |
| // current protocol version, sent as record version |
| ProtocolVersion protocolVersion; |
| |
| // version for the ClientHello message. Only relevant if this is a |
| // client handshake record. If set to ProtocolVersion.SSL20Hello, |
| // the V3 client hello is converted to V2 format. |
| ProtocolVersion helloVersion; |
| |
| // Is it the first application record to write? |
| boolean isFirstAppOutputRecord = true; |
| |
| // packet size |
| int packetSize; |
| |
| // fragment size |
| int fragmentSize; |
| |
| // closed or not? |
| boolean isClosed; |
| |
| /* |
| * Mappings from V3 cipher suite encodings to their pure V2 equivalents. |
| * This is taken from the SSL V3 specification, Appendix E. |
| */ |
| private static int[] V3toV2CipherMap1 = |
| {-1, -1, -1, 0x02, 0x01, -1, 0x04, 0x05, -1, 0x06, 0x07}; |
| private static int[] V3toV2CipherMap3 = |
| {-1, -1, -1, 0x80, 0x80, -1, 0x80, 0x80, -1, 0x40, 0xC0}; |
| |
| OutputRecord() { |
| this.writeCipher = CipherBox.NULL; |
| this.firstMessage = true; |
| this.fragmentSize = Record.maxDataSize; |
| |
| // Please set packetSize and protocolVersion in the implementation. |
| } |
| |
| void setVersion(ProtocolVersion protocolVersion) { |
| this.protocolVersion = protocolVersion; |
| } |
| |
| /* |
| * Updates helloVersion of this record. |
| */ |
| synchronized void setHelloVersion(ProtocolVersion helloVersion) { |
| this.helloVersion = helloVersion; |
| } |
| |
| /* |
| * For handshaking, we need to be able to hash every byte above the |
| * record marking layer. This is where we're guaranteed to see those |
| * bytes, so this is where we can hash them. |
| */ |
| void setHandshakeHash(HandshakeHash handshakeHash) { |
| this.handshakeHash = handshakeHash; |
| } |
| |
| /* |
| * Return true iff the record is empty -- to avoid doing the work |
| * of sending empty records over the network. |
| */ |
| boolean isEmpty() { |
| return false; |
| } |
| |
| boolean seqNumIsHuge() { |
| return (writeAuthenticator != null) && |
| writeAuthenticator.seqNumIsHuge(); |
| } |
| |
| // SSLEngine and SSLSocket |
| abstract void encodeAlert(byte level, byte description) throws IOException; |
| |
| // SSLEngine and SSLSocket |
| abstract void encodeHandshake(byte[] buffer, |
| int offset, int length) throws IOException; |
| |
| // SSLEngine and SSLSocket |
| abstract void encodeChangeCipherSpec() throws IOException; |
| |
| // apply to SSLEngine only |
| Ciphertext encode(ByteBuffer[] sources, int offset, int length, |
| ByteBuffer destination) throws IOException { |
| throw new UnsupportedOperationException(); |
| } |
| |
| // apply to SSLEngine only |
| void encodeV2NoCipher() throws IOException { |
| throw new UnsupportedOperationException(); |
| } |
| |
| // apply to SSLSocket only |
| void deliver(byte[] source, int offset, int length) throws IOException { |
| throw new UnsupportedOperationException(); |
| } |
| |
| // apply to SSLSocket only |
| void setDeliverStream(OutputStream outputStream) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| // apply to SSLEngine only |
| Ciphertext acquireCiphertext(ByteBuffer destination) throws IOException { |
| throw new UnsupportedOperationException(); |
| } |
| |
| void changeWriteCiphers(Authenticator writeAuthenticator, |
| CipherBox writeCipher) throws IOException { |
| |
| encodeChangeCipherSpec(); |
| |
| /* |
| * Dispose of any intermediate state in the underlying cipher. |
| * For PKCS11 ciphers, this will release any attached sessions, |
| * and thus make finalization faster. |
| * |
| * Since MAC's doFinal() is called for every SSL/TLS packet, it's |
| * not necessary to do the same with MAC's. |
| */ |
| writeCipher.dispose(); |
| |
| this.writeAuthenticator = writeAuthenticator; |
| this.writeCipher = writeCipher; |
| this.isFirstAppOutputRecord = true; |
| } |
| |
| void changePacketSize(int packetSize) { |
| this.packetSize = packetSize; |
| } |
| |
| void changeFragmentSize(int fragmentSize) { |
| this.fragmentSize = fragmentSize; |
| } |
| |
| int getMaxPacketSize() { |
| return packetSize; |
| } |
| |
| // apply to DTLS SSLEngine |
| void initHandshaker() { |
| // blank |
| } |
| |
| @Override |
| public synchronized void close() throws IOException { |
| if (!isClosed) { |
| isClosed = true; |
| writeCipher.dispose(); |
| } |
| } |
| |
| // |
| // shared helpers |
| // |
| |
| // Encrypt a fragment and wrap up a record. |
| // |
| // To be consistent with the spec of SSLEngine.wrap() methods, the |
| // destination ByteBuffer's position is updated to reflect the amount |
| // of data produced. The limit remains the same. |
| static long encrypt(Authenticator authenticator, |
| CipherBox encCipher, byte contentType, ByteBuffer destination, |
| int headerOffset, int dstLim, int headerSize, |
| ProtocolVersion protocolVersion, boolean isDTLS) { |
| |
| byte[] sequenceNumber = null; |
| int dstContent = destination.position(); |
| |
| // Acquire the current sequence number before using. |
| if (isDTLS) { |
| sequenceNumber = authenticator.sequenceNumber(); |
| } |
| |
| // "flip" but skip over header again, add MAC & encrypt |
| if (authenticator instanceof MAC) { |
| MAC signer = (MAC)authenticator; |
| if (signer.MAClen() != 0) { |
| byte[] hash = signer.compute(contentType, destination, false); |
| |
| /* |
| * position was advanced to limit in MAC compute above. |
| * |
| * Mark next area as writable (above layers should have |
| * established that we have plenty of room), then write |
| * out the hash. |
| */ |
| destination.limit(destination.limit() + hash.length); |
| destination.put(hash); |
| |
| // reset the position and limit |
| destination.limit(destination.position()); |
| destination.position(dstContent); |
| } |
| } |
| |
| if (!encCipher.isNullCipher()) { |
| if (protocolVersion.useTLS11PlusSpec() && |
| (encCipher.isCBCMode() || encCipher.isAEADMode())) { |
| byte[] nonce = encCipher.createExplicitNonce( |
| authenticator, contentType, destination.remaining()); |
| destination.position(headerOffset + headerSize); |
| destination.put(nonce); |
| } |
| if (!encCipher.isAEADMode()) { |
| // The explicit IV in TLS 1.1 and later can be encrypted. |
| destination.position(headerOffset + headerSize); |
| } // Otherwise, DON'T encrypt the nonce_explicit for AEAD mode |
| |
| // Encrypt may pad, so again the limit may be changed. |
| encCipher.encrypt(destination, dstLim); |
| } else { |
| destination.position(destination.limit()); |
| } |
| |
| // Finish out the record header. |
| int fragLen = destination.limit() - headerOffset - headerSize; |
| |
| destination.put(headerOffset, contentType); // content type |
| destination.put(headerOffset + 1, protocolVersion.major); |
| destination.put(headerOffset + 2, protocolVersion.minor); |
| if (!isDTLS) { |
| // fragment length |
| destination.put(headerOffset + 3, (byte)(fragLen >> 8)); |
| destination.put(headerOffset + 4, (byte)fragLen); |
| } else { |
| // epoch and sequence_number |
| destination.put(headerOffset + 3, sequenceNumber[0]); |
| destination.put(headerOffset + 4, sequenceNumber[1]); |
| destination.put(headerOffset + 5, sequenceNumber[2]); |
| destination.put(headerOffset + 6, sequenceNumber[3]); |
| destination.put(headerOffset + 7, sequenceNumber[4]); |
| destination.put(headerOffset + 8, sequenceNumber[5]); |
| destination.put(headerOffset + 9, sequenceNumber[6]); |
| destination.put(headerOffset + 10, sequenceNumber[7]); |
| |
| // fragment length |
| destination.put(headerOffset + 11, (byte)(fragLen >> 8)); |
| destination.put(headerOffset + 12, (byte)fragLen); |
| |
| // Increase the sequence number for next use. |
| authenticator.increaseSequenceNumber(); |
| } |
| |
| // Update destination position to reflect the amount of data produced. |
| destination.position(destination.limit()); |
| |
| return Authenticator.toLong(sequenceNumber); |
| } |
| |
| // Encrypt a fragment and wrap up a record. |
| // |
| // Uses the internal expandable buf variable and the current |
| // protocolVersion variable. |
| void encrypt(Authenticator authenticator, |
| CipherBox encCipher, byte contentType, int headerSize) { |
| |
| int position = headerSize + writeCipher.getExplicitNonceSize(); |
| |
| // "flip" but skip over header again, add MAC & encrypt |
| int macLen = 0; |
| if (authenticator instanceof MAC) { |
| MAC signer = (MAC)authenticator; |
| macLen = signer.MAClen(); |
| if (macLen != 0) { |
| byte[] hash = signer.compute(contentType, |
| buf, position, (count - position), false); |
| |
| write(hash, 0, hash.length); |
| } |
| } |
| |
| if (!encCipher.isNullCipher()) { |
| // Requires explicit IV/nonce for CBC/AEAD cipher suites for |
| // TLS 1.1 or later. |
| if (protocolVersion.useTLS11PlusSpec() && |
| (encCipher.isCBCMode() || encCipher.isAEADMode())) { |
| |
| byte[] nonce = encCipher.createExplicitNonce( |
| authenticator, contentType, (count - position)); |
| int noncePos = position - nonce.length; |
| System.arraycopy(nonce, 0, buf, noncePos, nonce.length); |
| } |
| |
| if (!encCipher.isAEADMode()) { |
| // The explicit IV in TLS 1.1 and later can be encrypted. |
| position = headerSize; |
| } // Otherwise, DON'T encrypt the nonce_explicit for AEAD mode |
| |
| // increase buf capacity if necessary |
| int fragSize = count - position; |
| int packetSize = |
| encCipher.calculatePacketSize(fragSize, macLen, headerSize); |
| if (packetSize > (buf.length - position)) { |
| byte[] newBuf = new byte[position + packetSize]; |
| System.arraycopy(buf, 0, newBuf, 0, count); |
| buf = newBuf; |
| } |
| |
| // Encrypt may pad, so again the count may be changed. |
| count = position + |
| encCipher.encrypt(buf, position, (count - position)); |
| } |
| |
| // Fill out the header, write it and the message. |
| int fragLen = count - headerSize; |
| buf[0] = contentType; |
| buf[1] = protocolVersion.major; |
| buf[2] = protocolVersion.minor; |
| buf[3] = (byte)((fragLen >> 8) & 0xFF); |
| buf[4] = (byte)(fragLen & 0xFF); |
| } |
| |
| static ByteBuffer encodeV2ClientHello( |
| byte[] fragment, int offset, int length) throws IOException { |
| |
| int v3SessIdLenOffset = offset + 34; // 2: client_version |
| // 32: random |
| |
| int v3SessIdLen = fragment[v3SessIdLenOffset]; |
| int v3CSLenOffset = v3SessIdLenOffset + 1 + v3SessIdLen; |
| int v3CSLen = ((fragment[v3CSLenOffset] & 0xff) << 8) + |
| (fragment[v3CSLenOffset + 1] & 0xff); |
| int cipherSpecs = v3CSLen / 2; // 2: cipher spec size |
| |
| // Estimate the max V2ClientHello message length |
| // |
| // 11: header size |
| // (cipherSpecs * 6): cipher_specs |
| // 6: one cipher suite may need 6 bytes, see V3toV2CipherSuite. |
| // 3: placeholder for the TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
| // signaling cipher suite |
| // 32: challenge size |
| int v2MaxMsgLen = 11 + (cipherSpecs * 6) + 3 + 32; |
| |
| // Create a ByteBuffer backed by an accessible byte array. |
| byte[] dstBytes = new byte[v2MaxMsgLen]; |
| ByteBuffer dstBuf = ByteBuffer.wrap(dstBytes); |
| |
| /* |
| * Copy over the cipher specs. We don't care about actually |
| * translating them for use with an actual V2 server since |
| * we only talk V3. Therefore, just copy over the V3 cipher |
| * spec values with a leading 0. |
| */ |
| int v3CSOffset = v3CSLenOffset + 2; // skip length field |
| int v2CSLen = 0; |
| |
| dstBuf.position(11); |
| boolean containsRenegoInfoSCSV = false; |
| for (int i = 0; i < cipherSpecs; i++) { |
| byte byte1, byte2; |
| |
| byte1 = fragment[v3CSOffset++]; |
| byte2 = fragment[v3CSOffset++]; |
| v2CSLen += V3toV2CipherSuite(dstBuf, byte1, byte2); |
| if (!containsRenegoInfoSCSV && |
| byte1 == (byte)0x00 && byte2 == (byte)0xFF) { |
| containsRenegoInfoSCSV = true; |
| } |
| } |
| |
| if (!containsRenegoInfoSCSV) { |
| v2CSLen += V3toV2CipherSuite(dstBuf, (byte)0x00, (byte)0xFF); |
| } |
| |
| /* |
| * Copy in the nonce. |
| */ |
| dstBuf.put(fragment, (offset + 2), 32); |
| |
| /* |
| * Build the first part of the V3 record header from the V2 one |
| * that's now buffered up. (Lengths are fixed up later). |
| */ |
| int msgLen = dstBuf.position() - 2; // Exclude the legth field itself |
| dstBuf.position(0); |
| dstBuf.put((byte)(0x80 | ((msgLen >>> 8) & 0xFF))); // pos: 0 |
| dstBuf.put((byte)(msgLen & 0xFF)); // pos: 1 |
| dstBuf.put(HandshakeMessage.ht_client_hello); // pos: 2 |
| dstBuf.put(fragment[offset]); // major version, pos: 3 |
| dstBuf.put(fragment[offset + 1]); // minor version, pos: 4 |
| dstBuf.put((byte)(v2CSLen >>> 8)); // pos: 5 |
| dstBuf.put((byte)(v2CSLen & 0xFF)); // pos: 6 |
| dstBuf.put((byte)0x00); // session_id_length, pos: 7 |
| dstBuf.put((byte)0x00); // pos: 8 |
| dstBuf.put((byte)0x00); // challenge_length, pos: 9 |
| dstBuf.put((byte)32); // pos: 10 |
| |
| dstBuf.position(0); |
| dstBuf.limit(msgLen + 2); |
| |
| return dstBuf; |
| } |
| |
| private static int V3toV2CipherSuite(ByteBuffer dstBuf, |
| byte byte1, byte byte2) { |
| dstBuf.put((byte)0); |
| dstBuf.put(byte1); |
| dstBuf.put(byte2); |
| |
| if (((byte2 & 0xff) > 0xA) || (V3toV2CipherMap1[byte2] == -1)) { |
| return 3; |
| } |
| |
| dstBuf.put((byte)V3toV2CipherMap1[byte2]); |
| dstBuf.put((byte)0); |
| dstBuf.put((byte)V3toV2CipherMap3[byte2]); |
| |
| return 6; |
| } |
| } |
