/* * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */  package sun.security.ssl; import java.io.ByteArrayOutputStream;import java.security.*;import java.util.Arrays;import java.util.LinkedList;import java.util.List;import java.util.Locale;import java.util.Set; /** * Abstraction for the SSL/TLS hash of all handshake messages that is * maintained to verify the integrity of the negotiation. Internally, * it consists of an MD5 and an SHA1 digest. They are used in the client * and server finished messages and in certificate verify messages (if sent). * * This class transparently deals with cloneable and non-cloneable digests. * * This class now supports TLS 1.2 also. The key difference for TLS 1.2 * is that you cannot determine the hash algorithms for CertificateVerify * at a early stage. On the other hand, it's simpler than TLS 1.1 (and earlier) * that there is no messy MD5+SHA1 digests. * * You need to obey these conventions when using this class: * * 1. protocolDetermined(version) should be called when the negotiated * protocol version is determined. * * 2. Before protocolDetermined() is called, only update(), reset(), * restrictCertificateVerifyAlgs(), setFinishedAlg(), and * setCertificateVerifyAlg() can be called. * * 3. After protocolDetermined() is called, reset() cannot be called. * * 4. After protocolDetermined() is called, if the version is pre-TLS 1.2, * getFinishedHash() and getCertificateVerifyHash() cannot be called. Otherwise, * getMD5Clone() and getSHAClone() cannot be called. * * 5. getMD5Clone() and getSHAClone() can only be called after * protocolDetermined() is called and version is pre-TLS 1.2. * * 6. getFinishedHash() and getCertificateVerifyHash() can only be called after * all protocolDetermined(), setCertificateVerifyAlg() and setFinishedAlg() * have been called and the version is TLS 1.2. If a CertificateVerify message * is to be used, call setCertificateVerifyAlg() with the hash algorithm as the * argument. Otherwise, you still must call setCertificateVerifyAlg(null) before * calculating any hash value. * * Suggestions: Call protocolDetermined(), restrictCertificateVerifyAlgs(), * setFinishedAlg(), and setCertificateVerifyAlg() as early as possible. * * Example: * <pre> * HandshakeHash hh = new HandshakeHash(...) * hh.protocolDetermined(ProtocolVersion.TLS12); * hh.update(clientHelloBytes); * hh.setFinishedAlg("SHA-256"); * hh.update(serverHelloBytes); * ... * hh.setCertificateVerifyAlg("SHA-384"); * hh.update(CertificateVerifyBytes); * byte[] cvDigest = hh.getCertificateVerifyHash(); * ... * hh.update(finished1); * byte[] finDigest1 = hh.getFinishedHash(); * hh.update(finished2); * byte[] finDigest2 = hh.getFinishedHash(); * </pre> * If no CertificateVerify message is to be used, call * <pre> * hh.setCertificateVerifyAlg(null); * </pre> * This call can be made once you are certain that this message * will never be used. */final class HandshakeHash {     // Common     // -1:  unknown    //  1:  <=TLS 1.1    //  2:  TLS 1.2    private int version = -1;    private ByteArrayOutputStream data = new ByteArrayOutputStream();    private final boolean isServer;     // For TLS 1.1    private MessageDigest md5, sha;    private final int clonesNeeded;    // needs to be saved for later use     // For TLS 1.2    // cvAlgDetermined == true means setCertificateVerifyAlg() is called    private boolean cvAlgDetermined = false;    private String cvAlg;    private MessageDigest finMD;     /**     * Create a new HandshakeHash. needCertificateVerify indicates whether     * a hash for the certificate verify message is required. The argument     * algs is a set of all possible hash algorithms that might be used in     * TLS 1.2. If the caller is sure that TLS 1.2 won't be used or no     * CertificateVerify message will be used, leave it null or empty.     */    HandshakeHash(boolean isServer, boolean needCertificateVerify,            Set<String> algs) {        this.isServer = isServer;        clonesNeeded = needCertificateVerify ? 3 : 2;    }     void update(byte[] b, int offset, int len) {        switch (version) {            case 1:                md5.update(b, offset, len);                sha.update(b, offset, len);                break;            default:                if (finMD != null) {                    finMD.update(b, offset, len);                }                data.write(b, offset, len);                break;        }    }     /**     * Reset the remaining digests. Note this does *not* reset the number of     * digest clones that can be obtained. Digests that have already been     * cloned and are gone remain gone.     */    void reset() {        if (version != -1) {            throw new RuntimeException(                    "reset() can be only be called before protocolDetermined");        }        data.reset();    }      void protocolDetermined(ProtocolVersion pv) {         // Do not set again, will ignore        if (version != -1) return;         version = pv.compareTo(ProtocolVersion.TLS12) >= 0 ? 2 : 1;        switch (version) {            case 1:                // initiate md5, sha and call update on saved array                try {                    md5 = CloneableDigest.getDigest("MD5", clonesNeeded);                    sha = CloneableDigest.getDigest("SHA", clonesNeeded);                } catch (NoSuchAlgorithmException e) {                    throw new RuntimeException                                ("Algorithm MD5 or SHA not available", e);                }                byte[] bytes = data.toByteArray();                update(bytes, 0, bytes.length);                break;            case 2:                break;        }    }     /////////////////////////////////////////////////////////////    // Below are old methods for pre-TLS 1.1    /////////////////////////////////////////////////////////////     /**     * Return a new MD5 digest updated with all data hashed so far.     */    MessageDigest getMD5Clone() {        if (version != 1) {            throw new RuntimeException(                    "getMD5Clone() can be only be called for TLS 1.1");        }        return cloneDigest(md5);    }     /**     * Return a new SHA digest updated with all data hashed so far.     */    MessageDigest getSHAClone() {        if (version != 1) {            throw new RuntimeException(                    "getSHAClone() can be only be called for TLS 1.1");        }        return cloneDigest(sha);    }     private static MessageDigest cloneDigest(MessageDigest digest) {        try {            return (MessageDigest)digest.clone();        } catch (CloneNotSupportedException e) {            // cannot occur for digests generated via CloneableDigest            throw new RuntimeException("Could not clone digest", e);        }    }     /////////////////////////////////////////////////////////////    // Below are new methods for TLS 1.2    /////////////////////////////////////////////////////////////     private static String normalizeAlgName(String alg) {        alg = alg.toUpperCase(Locale.US);        if (alg.startsWith("SHA")) {            if (alg.length() == 3) {                return "SHA-1";            }            if (alg.charAt(3) != '-') {                return "SHA-" + alg.substring(3);            }        }        return alg;    }    /**     * Specifies the hash algorithm used in Finished. This should be called     * based in info in ServerHello.     * Can be called multiple times.     */    void setFinishedAlg(String s) {        if (s == null) {            throw new RuntimeException(                    "setFinishedAlg's argument cannot be null");        }         // Can be called multiple times, but only set once        if (finMD != null) return;         try {            finMD = CloneableDigest.getDigest(normalizeAlgName(s), 2);        } catch (NoSuchAlgorithmException e) {            throw new Error(e);        }        finMD.update(data.toByteArray());    }     /**     * Restricts the possible algorithms for the CertificateVerify. Called by     * the server based on info in CertRequest. The argument must be a subset     * of the argument with the same name in the constructor. The method can be     * called multiple times. If the caller is sure that no CertificateVerify     * message will be used, leave this argument null or empty.     */    void restrictCertificateVerifyAlgs(Set<String> algs) {        if (version == 1) {            throw new RuntimeException(                    "setCertificateVerifyAlg() cannot be called for TLS 1.1");        }        // Not used yet    }     /**     * Specifies the hash algorithm used in CertificateVerify.     * Can be called multiple times.     */    void setCertificateVerifyAlg(String s) {         // Can be called multiple times, but only set once        if (cvAlgDetermined) return;         cvAlg = s == null ? null : normalizeAlgName(s);        cvAlgDetermined = true;    }     byte[] getAllHandshakeMessages() {        return data.toByteArray();    }     /**     * Calculates the hash in the CertificateVerify. Must be called right     * after setCertificateVerifyAlg()     */    /*byte[] getCertificateVerifyHash() {        throw new Error("Do not call getCertificateVerifyHash()");    }*/     /**     * Calculates the hash in Finished. Must be called after setFinishedAlg().     * This method can be called twice, for Finished messages of the server     * side and client side respectively.     */    byte[] getFinishedHash() {        try {            return cloneDigest(finMD).digest();        } catch (Exception e) {            throw new Error("BAD");        }    }} /** * A wrapper for MessageDigests that simulates cloning of non-cloneable * digests. It uses the standard MessageDigest API and therefore can be used * transparently in place of a regular digest. * * Note that we extend the MessageDigest class directly rather than * MessageDigestSpi. This works because MessageDigest was originally designed * this way in the JDK 1.1 days which allows us to avoid creating an internal * provider. * * It can be "cloned" a limited number of times, which is specified at * construction time. This is achieved by internally maintaining n digests * in parallel. Consequently, it is only 1/n-th times as fast as the original * digest. * * Example: *   MessageDigest md = CloneableDigest.getDigest("SHA", 2); *   md.update(data1); *   MessageDigest md2 = (MessageDigest)md.clone(); *   md2.update(data2); *   byte[] d1 = md2.digest(); // digest of data1 || data2 *   md.update(data3); *   byte[] d2 = md.digest();  // digest of data1 || data3 * * This class is not thread safe. * */final class CloneableDigest extends MessageDigest implements Cloneable {     /**     * The individual MessageDigests. Initially, all elements are non-null.     * When clone() is called, the non-null element with the maximum index is     * returned and the array element set to null.     *     * All non-null element are always in the same state.     */    private final MessageDigest[] digests;     private CloneableDigest(MessageDigest digest, int n, String algorithm)            throws NoSuchAlgorithmException {        super(algorithm);        digests = new MessageDigest[n];        digests[0] = digest;        for (int i = 1; i < n; i++) {            digests[i] = JsseJce.getMessageDigest(algorithm);        }    }     /**     * Return a MessageDigest for the given algorithm that can be cloned the     * specified number of times. If the default implementation supports     * cloning, it is returned. Otherwise, an instance of this class is     * returned.     */    static MessageDigest getDigest(String algorithm, int n)            throws NoSuchAlgorithmException {        MessageDigest digest = JsseJce.getMessageDigest(algorithm);        try {            digest.clone();            // already cloneable, use it            return digest;        } catch (CloneNotSupportedException e) {            return new CloneableDigest(digest, n, algorithm);        }    }     /**     * Check if this object is still usable. If it has already been cloned the     * maximum number of times, there are no digests left and this object can no     * longer be used.     */    private void checkState() {        // XXX handshaking currently doesn't stop updating hashes...        // if (digests[0] == null) {        //     throw new IllegalStateException("no digests left");        // }    }     protected int engineGetDigestLength() {        checkState();        return digests[0].getDigestLength();    }     protected void engineUpdate(byte b) {        checkState();        for (int i = 0; (i < digests.length) && (digests[i] != null); i++) {            digests[i].update(b);        }    }     protected void engineUpdate(byte[] b, int offset, int len) {        checkState();        for (int i = 0; (i < digests.length) && (digests[i] != null); i++) {            digests[i].update(b, offset, len);        }    }     protected byte[] engineDigest() {        checkState();        byte[] digest = digests[0].digest();        digestReset();        return digest;    }     protected int engineDigest(byte[] buf, int offset, int len)            throws DigestException {        checkState();        int n = digests[0].digest(buf, offset, len);        digestReset();        return n;    }     /**     * Reset all digests after a digest() call. digests[0] has already been     * implicitly reset by the digest() call and does not need to be reset     * again.     */    private void digestReset() {        for (int i = 1; (i < digests.length) && (digests[i] != null); i++) {            digests[i].reset();        }    }     protected void engineReset() {        checkState();        for (int i = 0; (i < digests.length) && (digests[i] != null); i++) {            digests[i].reset();        }    }     public Object clone() {        checkState();        for (int i = digests.length - 1; i >= 0; i--) {            if (digests[i] != null) {                MessageDigest digest = digests[i];                digests[i] = null;                return digest;            }        }        // cannot occur        throw new InternalError();    } }