security/ssl/OutputRecord.java

/*
 * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package sun.security.ssl;

import java.io.*;
import java.nio.*;
import java.util.Arrays;

import javax.net.ssl.SSLException;
import sun.security.util.HexDumpEncoder;


/**
 * {@code OutputRecord} takes care of the management of SSL/TLS/DTLS output
 * records, including buffering, encryption, handshake messages marshal, etc.
 *
 * @author David Brownell
 */
abstract class OutputRecord extends ByteArrayOutputStream
            implements Record, Closeable {

    /* Class and subclass dynamic debugging support */
    static final Debug          debug = Debug.getInstance("ssl");

    Authenticator               writeAuthenticator;
    CipherBox                   writeCipher;

    HandshakeHash               handshakeHash;
    boolean                     firstMessage;

    // current protocol version, sent as record version
    ProtocolVersion             protocolVersion;

    // version for the ClientHello message. Only relevant if this is a
    // client handshake record. If set to ProtocolVersion.SSL20Hello,
    // the V3 client hello is converted to V2 format.
    ProtocolVersion             helloVersion;

    // Is it the first application record to write?
    boolean                     isFirstAppOutputRecord = true;

    // packet size
    int                         packetSize;

    // fragment size
    int                         fragmentSize;

    // closed or not?
    boolean                     isClosed;

    /*
     * Mappings from V3 cipher suite encodings to their pure V2 equivalents.
     * This is taken from the SSL V3 specification, Appendix E.
     */
    private static int[] V3toV2CipherMap1 =
        {-1, -1, -1, 0x02, 0x01, -1, 0x04, 0x05, -1, 0x06, 0x07};
    private static int[] V3toV2CipherMap3 =
        {-1, -1, -1, 0x80, 0x80, -1, 0x80, 0x80, -1, 0x40, 0xC0};

    OutputRecord() {
        this.writeCipher = CipherBox.NULL;
        this.firstMessage = true;
        this.fragmentSize = Record.maxDataSize;

        // Please set packetSize and protocolVersion in the implementation.
    }

    void setVersion(ProtocolVersion protocolVersion) {
        this.protocolVersion = protocolVersion;
    }

    /*
     * Updates helloVersion of this record.
     */
    synchronized void setHelloVersion(ProtocolVersion helloVersion) {
        this.helloVersion = helloVersion;
    }

    /*
     * For handshaking, we need to be able to hash every byte above the
     * record marking layer.  This is where we're guaranteed to see those
     * bytes, so this is where we can hash them.
     */
    void setHandshakeHash(HandshakeHash handshakeHash) {
        this.handshakeHash = handshakeHash;
    }

    /*
     * Return true iff the record is empty -- to avoid doing the work
     * of sending empty records over the network.
     */
    boolean isEmpty() {
        return false;
    }

    boolean seqNumIsHuge() {
        return (writeAuthenticator != null) &&
                        writeAuthenticator.seqNumIsHuge();
    }

    // SSLEngine and SSLSocket
    abstract void encodeAlert(byte level, byte description) throws IOException;

    // SSLEngine and SSLSocket
    abstract void encodeHandshake(byte[] buffer,
            int offset, int length) throws IOException;

    // SSLEngine and SSLSocket
    abstract void encodeChangeCipherSpec() throws IOException;

    // apply to SSLEngine only
    Ciphertext encode(ByteBuffer[] sources, int offset, int length,
            ByteBuffer destination) throws IOException {
        throw new UnsupportedOperationException();
    }

    // apply to SSLEngine only
    void encodeV2NoCipher() throws IOException {
        throw new UnsupportedOperationException();
    }

    // apply to SSLSocket only
    void deliver(byte[] source, int offset, int length) throws IOException {
        throw new UnsupportedOperationException();
    }

    // apply to SSLSocket only
    void setDeliverStream(OutputStream outputStream) {
        throw new UnsupportedOperationException();
    }

    // apply to SSLEngine only
    Ciphertext acquireCiphertext(ByteBuffer destination) throws IOException {
        throw new UnsupportedOperationException();
    }

    void changeWriteCiphers(Authenticator writeAuthenticator,
            CipherBox writeCipher) throws IOException {

        encodeChangeCipherSpec();

        /*
         * Dispose of any intermediate state in the underlying cipher.
         * For PKCS11 ciphers, this will release any attached sessions,
         * and thus make finalization faster.
         *
         * Since MAC's doFinal() is called for every SSL/TLS packet, it's
         * not necessary to do the same with MAC's.
         */
        writeCipher.dispose();

        this.writeAuthenticator = writeAuthenticator;
        this.writeCipher = writeCipher;
        this.isFirstAppOutputRecord = true;
    }

    void changePacketSize(int packetSize) {
        this.packetSize = packetSize;
    }

    void changeFragmentSize(int fragmentSize) {
        this.fragmentSize = fragmentSize;
    }

    int getMaxPacketSize() {
        return packetSize;
    }

    // apply to DTLS SSLEngine
    void initHandshaker() {
        // blank
    }

    // apply to DTLS SSLEngine
    void launchRetransmission() {
        // blank
    }

    @Override
    public synchronized void close() throws IOException {
        if (!isClosed) {
            isClosed = true;
            writeCipher.dispose();
        }
    }

    //
    // shared helpers
    //

    // Encrypt a fragment and wrap up a record.
    //
    // To be consistent with the spec of SSLEngine.wrap() methods, the
    // destination ByteBuffer's position is updated to reflect the amount
    // of data produced.  The limit remains the same.
    static long encrypt(Authenticator authenticator,
            CipherBox encCipher, byte contentType, ByteBuffer destination,
            int headerOffset, int dstLim, int headerSize,
            ProtocolVersion protocolVersion, boolean isDTLS) {

        byte[] sequenceNumber = null;
        int dstContent = destination.position();

        // Acquire the current sequence number before using.
        if (isDTLS) {
            sequenceNumber = authenticator.sequenceNumber();
        }

        // The sequence number may be shared for different purpose.
        boolean sharedSequenceNumber = false;

        // "flip" but skip over header again, add MAC & encrypt
        if (authenticator instanceof MAC) {
            MAC signer = (MAC)authenticator;
            if (signer.MAClen() != 0) {
                byte[] hash = signer.compute(contentType, destination, false);

                /*
                 * position was advanced to limit in MAC compute above.
                 *
                 * Mark next area as writable (above layers should have
                 * established that we have plenty of room), then write
                 * out the hash.
                 */
                destination.limit(destination.limit() + hash.length);
                destination.put(hash);

                // reset the position and limit
                destination.limit(destination.position());
                destination.position(dstContent);

                // The signer has used and increased the sequence number.
                if (isDTLS) {
                    sharedSequenceNumber = true;
                }
            }
        }

        if (!encCipher.isNullCipher()) {
            if (protocolVersion.useTLS11PlusSpec() &&
                    (encCipher.isCBCMode() || encCipher.isAEADMode())) {
                byte[] nonce = encCipher.createExplicitNonce(
                        authenticator, contentType, destination.remaining());
                destination.position(headerOffset + headerSize);
                destination.put(nonce);
            }
            if (!encCipher.isAEADMode()) {
                // The explicit IV in TLS 1.1 and later can be encrypted.
                destination.position(headerOffset + headerSize);
            }   // Otherwise, DON'T encrypt the nonce_explicit for AEAD mode

            // Encrypt may pad, so again the limit may be changed.
            encCipher.encrypt(destination, dstLim);

            // The cipher has used and increased the sequence number.
            if (isDTLS && encCipher.isAEADMode()) {
                sharedSequenceNumber = true;
            }
        } else {
            destination.position(destination.limit());
        }

        // Finish out the record header.
        int fragLen = destination.limit() - headerOffset - headerSize;

        destination.put(headerOffset, contentType);         // content type
        destination.put(headerOffset + 1, protocolVersion.major);
        destination.put(headerOffset + 2, protocolVersion.minor);
        if (!isDTLS) {
            // fragment length
            destination.put(headerOffset + 3, (byte)(fragLen >> 8));
            destination.put(headerOffset + 4, (byte)fragLen);
        } else {
            // epoch and sequence_number
            destination.put(headerOffset + 3, sequenceNumber[0]);
            destination.put(headerOffset + 4, sequenceNumber[1]);
            destination.put(headerOffset + 5, sequenceNumber[2]);
            destination.put(headerOffset + 6, sequenceNumber[3]);
            destination.put(headerOffset + 7, sequenceNumber[4]);
            destination.put(headerOffset + 8, sequenceNumber[5]);
            destination.put(headerOffset + 9, sequenceNumber[6]);
            destination.put(headerOffset + 10, sequenceNumber[7]);

            // fragment length
            destination.put(headerOffset + 11, (byte)(fragLen >> 8));
            destination.put(headerOffset + 12, (byte)fragLen);

            // Increase the sequence number for next use if it is not shared.
            if (!sharedSequenceNumber) {
                authenticator.increaseSequenceNumber();
            }
        }

        // Update destination position to reflect the amount of data produced.
        destination.position(destination.limit());

        return Authenticator.toLong(sequenceNumber);
    }

    // Encrypt a fragment and wrap up a record.
    //
    // Uses the internal expandable buf variable and the current
    // protocolVersion variable.
    void encrypt(Authenticator authenticator,
            CipherBox encCipher, byte contentType, int headerSize) {

        int position = headerSize + writeCipher.getExplicitNonceSize();

        // "flip" but skip over header again, add MAC & encrypt
        int macLen = 0;
        if (authenticator instanceof MAC) {
            MAC signer = (MAC)authenticator;
            macLen = signer.MAClen();
            if (macLen != 0) {
                byte[] hash = signer.compute(contentType,
                        buf, position, (count - position), false);

                write(hash, 0, hash.length);
            }
        }

        if (!encCipher.isNullCipher()) {
            // Requires explicit IV/nonce for CBC/AEAD cipher suites for
            // TLS 1.1 or later.
            if (protocolVersion.useTLS11PlusSpec() &&
                    (encCipher.isCBCMode() || encCipher.isAEADMode())) {

                byte[] nonce = encCipher.createExplicitNonce(
                        authenticator, contentType, (count - position));
                int noncePos = position - nonce.length;
                System.arraycopy(nonce, 0, buf, noncePos, nonce.length);
            }

            if (!encCipher.isAEADMode()) {
                // The explicit IV in TLS 1.1 and later can be encrypted.
                position = headerSize;
            }   // Otherwise, DON'T encrypt the nonce_explicit for AEAD mode

            // increase buf capacity if necessary
            int fragSize = count - position;
            int packetSize =
                    encCipher.calculatePacketSize(fragSize, macLen, headerSize);
            if (packetSize > (buf.length - position)) {
                byte[] newBuf = new byte[position + packetSize];
                System.arraycopy(buf, 0, newBuf, 0, count);
                buf = newBuf;
            }

            // Encrypt may pad, so again the count may be changed.
            count = position +
                    encCipher.encrypt(buf, position, (count - position));
        }

        // Fill out the header, write it and the message.
        int fragLen = count - headerSize;
        buf[0] = contentType;
        buf[1] = protocolVersion.major;
        buf[2] = protocolVersion.minor;
        buf[3] = (byte)((fragLen >> 8) & 0xFF);
        buf[4] = (byte)(fragLen & 0xFF);
    }

    static ByteBuffer encodeV2ClientHello(
            byte[] fragment, int offset, int length) throws IOException {

        int v3SessIdLenOffset = offset + 34;      //  2: client_version
                                                  // 32: random

        int v3SessIdLen = fragment[v3SessIdLenOffset];
        int v3CSLenOffset = v3SessIdLenOffset + 1 + v3SessIdLen;
        int v3CSLen = ((fragment[v3CSLenOffset] & 0xff) << 8) +
                       (fragment[v3CSLenOffset + 1] & 0xff);
        int cipherSpecs = v3CSLen / 2;        // 2: cipher spec size

        // Estimate the max V2ClientHello message length
        //
        // 11: header size
        // (cipherSpecs * 6): cipher_specs
        //    6: one cipher suite may need 6 bytes, see V3toV2CipherSuite.
        // 3: placeholder for the TLS_EMPTY_RENEGOTIATION_INFO_SCSV
        //    signaling cipher suite
        // 32: challenge size
        int v2MaxMsgLen = 11 + (cipherSpecs * 6) + 3 + 32;

        // Create a ByteBuffer backed by an accessible byte array.
        byte[] dstBytes = new byte[v2MaxMsgLen];
        ByteBuffer dstBuf = ByteBuffer.wrap(dstBytes);

        /*
         * Copy over the cipher specs. We don't care about actually
         * translating them for use with an actual V2 server since
         * we only talk V3.  Therefore, just copy over the V3 cipher
         * spec values with a leading 0.
         */
        int v3CSOffset = v3CSLenOffset + 2;   // skip length field
        int v2CSLen = 0;

        dstBuf.position(11);
        boolean containsRenegoInfoSCSV = false;
        for (int i = 0; i < cipherSpecs; i++) {
            byte byte1, byte2;

            byte1 = fragment[v3CSOffset++];
            byte2 = fragment[v3CSOffset++];
            v2CSLen += V3toV2CipherSuite(dstBuf, byte1, byte2);
            if (!containsRenegoInfoSCSV &&
                    byte1 == (byte)0x00 && byte2 == (byte)0xFF) {
                containsRenegoInfoSCSV = true;
            }
        }

        if (!containsRenegoInfoSCSV) {
            v2CSLen += V3toV2CipherSuite(dstBuf, (byte)0x00, (byte)0xFF);
        }

        /*
         * Copy in the nonce.
         */
        dstBuf.put(fragment, (offset + 2), 32);

        /*
         * Build the first part of the V3 record header from the V2 one
         * that's now buffered up.  (Lengths are fixed up later).
         */
        int msgLen = dstBuf.position() - 2;   // Exclude the legth field itself
        dstBuf.position(0);
        dstBuf.put((byte)(0x80 | ((msgLen >>> 8) & 0xFF)));  // pos: 0
        dstBuf.put((byte)(msgLen & 0xFF));                   // pos: 1
        dstBuf.put(HandshakeMessage.ht_client_hello);        // pos: 2
        dstBuf.put(fragment[offset]);         // major version, pos: 3
        dstBuf.put(fragment[offset + 1]);     // minor version, pos: 4
        dstBuf.put((byte)(v2CSLen >>> 8));                   // pos: 5
        dstBuf.put((byte)(v2CSLen & 0xFF));                  // pos: 6
        dstBuf.put((byte)0x00);           // session_id_length, pos: 7
        dstBuf.put((byte)0x00);                              // pos: 8
        dstBuf.put((byte)0x00);           // challenge_length,  pos: 9
        dstBuf.put((byte)32);                                // pos: 10

        dstBuf.position(0);
        dstBuf.limit(msgLen + 2);

        return dstBuf;
    }

    private static int V3toV2CipherSuite(ByteBuffer dstBuf,
            byte byte1, byte byte2) {
        dstBuf.put((byte)0);
        dstBuf.put(byte1);
        dstBuf.put(byte2);

        if (((byte2 & 0xff) > 0xA) || (V3toV2CipherMap1[byte2] == -1)) {
            return 3;
        }

        dstBuf.put((byte)V3toV2CipherMap1[byte2]);
        dstBuf.put((byte)0);
        dstBuf.put((byte)V3toV2CipherMap3[byte2]);

        return 6;
    }
}