My first initial commit with all of mine experimental changes.

Dmitry Kabak (userdima committed 13 years ago

Commit d37b88d1 parent 3f5b46618352 files · +2598093 −-8690Browse files

Showing the changes to java/pkg/sun/security/ssl/HandshakeMessage.java (1 of 18352 files). Show all

Unified · Split

java/pkg/sun/security/ssl/HandshakeMessage.java+2006−0

@@ -0,0 +1,2006 @@
	1	/*
	2	* Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package sun.security.ssl;
	27
	28	import java.io.*;
	29	import java.math.BigInteger;
	30	import java.security.*;
	31	import java.security.interfaces.*;
	32	import java.security.spec.*;
	33	import java.security.cert.*;
	34	import java.security.cert.Certificate;
	35	import java.util.*;
	36	import java.util.concurrent.ConcurrentHashMap;
	37
	38	import java.lang.reflect.*;
	39
	40	import javax.security.auth.x500.X500Principal;
	41
	42	import javax.crypto.KeyGenerator;
	43	import javax.crypto.SecretKey;
	44
	45	import javax.net.ssl.*;
	46
	47	import sun.security.internal.spec.TlsPrfParameterSpec;
	48	import sun.security.ssl.CipherSuite.*;
	49	import static sun.security.ssl.CipherSuite.PRF.*;
	50
	51	/**
	52	* Many data structures are involved in the handshake messages. These
	53	* classes are used as structures, with public data members. They are
	54	* not visible outside the SSL package.
	55	*
	56	* Handshake messages all have a common header format, and they are all
	57	* encoded in a "handshake data" SSL record substream. The base class
	58	* here (HandshakeMessage) provides a common framework and records the
	59	* SSL record type of the particular handshake message.
	60	*
	61	* This file contains subclasses for all the basic handshake messages.
	62	* All handshake messages know how to encode and decode themselves on
	63	* SSL streams; this facilitates using the same code on SSL client and
	64	* server sides, although they don't send and receive the same messages.
	65	*
	66	* Messages also know how to print themselves, which is quite handy
	67	* for debugging. They always identify their type, and can optionally
	68	* dump all of their content.
	69	*
	70	* @author David Brownell
	71	*/
	72	public abstract class HandshakeMessage {
	73
	74	HandshakeMessage() { }
	75
	76	// enum HandshakeType:
	77	static final byte ht_hello_request = 0;
	78	static final byte ht_client_hello = 1;
	79	static final byte ht_server_hello = 2;
	80
	81	static final byte ht_certificate = 11;
	82	static final byte ht_server_key_exchange = 12;
	83	static final byte ht_certificate_request = 13;
	84	static final byte ht_server_hello_done = 14;
	85	static final byte ht_certificate_verify = 15;
	86	static final byte ht_client_key_exchange = 16;
	87
	88	static final byte ht_finished = 20;
	89
	90	/* Class and subclass dynamic debugging support */
	91	public static final Debug debug = Debug.getInstance("ssl");
	92
	93	/**
	94	* Utility method to convert a BigInteger to a byte array in unsigned
	95	* format as needed in the handshake messages. BigInteger uses
	96	* 2's complement format, i.e. it prepends an extra zero if the MSB
	97	* is set. We remove that.
	98	*/
	99	static byte[] toByteArray(BigInteger bi) {
	100	byte[] b = bi.toByteArray();
	101	if ((b.length > 1) && (b[0] == 0)) {
	102	int n = b.length - 1;
	103	byte[] newarray = new byte[n];
	104	System.arraycopy(b, 1, newarray, 0, n);
	105	b = newarray;
	106	}
	107	return b;
	108	}
	109
	110	/*
	111	* SSL 3.0 MAC padding constants.
	112	* Also used by CertificateVerify and Finished during the handshake.
	113	*/
	114	static final byte[] MD5_pad1 = genPad(0x36, 48);
	115	static final byte[] MD5_pad2 = genPad(0x5c, 48);
	116
	117	static final byte[] SHA_pad1 = genPad(0x36, 40);
	118	static final byte[] SHA_pad2 = genPad(0x5c, 40);
	119
	120	private static byte[] genPad(int b, int count) {
	121	byte[] padding = new byte[count];
	122	Arrays.fill(padding, (byte)b);
	123	return padding;
	124	}
	125
	126	/*
	127	* Write a handshake message on the (handshake) output stream.
	128	* This is just a four byte header followed by the data.
	129	*
	130	* NOTE that huge messages -- notably, ones with huge cert
	131	* chains -- are handled correctly.
	132	*/
	133	final void write(HandshakeOutStream s) throws IOException {
	134	int len = messageLength();
	135	if (len > (1 << 24)) {
	136	throw new SSLException("Handshake message too big"
	137	+ ", type = " + messageType() + ", len = " + len);
	138	}
	139	s.write(messageType());
	140	s.putInt24(len);
	141	send(s);
	142	}
	143
	144	/*
	145	* Subclasses implement these methods so those kinds of
	146	* messages can be emitted. Base class delegates to subclass.
	147	*/
	148	abstract int messageType();
	149	abstract int messageLength();
	150	abstract void send(HandshakeOutStream s) throws IOException;
	151
	152	/*
	153	* Write a descriptive message on the output stream; for debugging.
	154	*/
	155	abstract void print(PrintStream p) throws IOException;
	156
	157	//
	158	// NOTE: the rest of these classes are nested within this one, and are
	159	// imported by other classes in this package. There are a few other
	160	// handshake message classes, not neatly nested here because of current
	161	// licensing requirement for native (RSA) methods. They belong here,
	162	// but those native methods complicate things a lot!
	163	//
	164
	165
	166	/*
	167	* HelloRequest ... SERVER --> CLIENT
	168	*
	169	* Server can ask the client to initiate a new handshake, e.g. to change
	170	* session parameters after a connection has been (re)established.
	171	*/
	172	static final class HelloRequest extends HandshakeMessage {
	173	int messageType() { return ht_hello_request; }
	174
	175	HelloRequest() { }
	176
	177	HelloRequest(HandshakeInStream in) throws IOException
	178	{
	179	// nothing in this message
	180	}
	181
	182	int messageLength() { return 0; }
	183
	184	void send(HandshakeOutStream out) throws IOException
	185	{
	186	// nothing in this messaage
	187	}
	188
	189	void print(PrintStream out) throws IOException
	190	{
	191	out.println("*** HelloRequest (empty)");
	192	}
	193
	194	}
	195
	196
	197	/*
	198	* ClientHello ... CLIENT --> SERVER
	199	*
	200	* Client initiates handshake by telling server what it wants, and what it
	201	* can support (prioritized by what's first in the ciphe suite list).
	202	*
	203	* By RFC2246:7.4.1.2 it's explicitly anticipated that this message
	204	* will have more data added at the end ... e.g. what CAs the client trusts.
	205	* Until we know how to parse it, we will just read what we know
	206	* about, and let our caller handle the jumps over unknown data.
	207	*/
	208	static final class ClientHello extends HandshakeMessage {
	209
	210	ProtocolVersion protocolVersion;
	211	RandomCookie clnt_random;
	212	SessionId sessionId;
	213	private CipherSuiteList cipherSuites;
	214	byte[] compression_methods;
	215
	216	HelloExtensions extensions = new HelloExtensions();
	217
	218	private final static byte[] NULL_COMPRESSION = new byte[] {0};
	219
	220	ClientHello(SecureRandom generator, ProtocolVersion protocolVersion,
	221	SessionId sessionId, CipherSuiteList cipherSuites) {
	222
	223	this.protocolVersion = protocolVersion;
	224	this.sessionId = sessionId;
	225	this.cipherSuites = cipherSuites;
	226
	227	if (cipherSuites.containsEC()) {
	228	extensions.add(SupportedEllipticCurvesExtension.DEFAULT);
	229	extensions.add(SupportedEllipticPointFormatsExtension.DEFAULT);
	230	}
	231
	232	clnt_random = new RandomCookie(generator);
	233	compression_methods = NULL_COMPRESSION;
	234	}
	235
	236	ClientHello(HandshakeInStream s, int messageLength) throws IOException {
	237	protocolVersion = ProtocolVersion.valueOf(s.getInt8(), s.getInt8());
	238	clnt_random = new RandomCookie(s);
	239	sessionId = new SessionId(s.getBytes8());
	240	cipherSuites = new CipherSuiteList(s);
	241	compression_methods = s.getBytes8();
	242	if (messageLength() != messageLength) {
	243	extensions = new HelloExtensions(s);
	244	}
	245	}
	246
	247	CipherSuiteList getCipherSuites() {
	248	return cipherSuites;
	249	}
	250
	251	// add renegotiation_info extension
	252	void addRenegotiationInfoExtension(byte[] clientVerifyData) {
	253	HelloExtension renegotiationInfo = new RenegotiationInfoExtension(
	254	clientVerifyData, new byte[0]);
	255	extensions.add(renegotiationInfo);
	256	}
	257
	258	// add server_name extension
	259	void addServerNameIndicationExtension(String hostname) {
	260	// We would have checked that the hostname ia a FQDN.
	261	ArrayList<String> hostnames = new ArrayList<>(1);
	262	hostnames.add(hostname);
	263
	264	try {
	265	extensions.add(new ServerNameExtension(hostnames));
	266	} catch (IOException ioe) {
	267	// ignore the exception and return
	268	}
	269	}
	270
	271	// add signature_algorithm extension
	272	void addSignatureAlgorithmsExtension(
	273	Collection<SignatureAndHashAlgorithm> algorithms) {
	274	HelloExtension signatureAlgorithm =
	275	new SignatureAlgorithmsExtension(algorithms);
	276	extensions.add(signatureAlgorithm);
	277	}
	278
	279	@Override
	280	int messageType() { return ht_client_hello; }
	281
	282	@Override
	283	int messageLength() {
	284	/*
	285	* Add fixed size parts of each field...
	286	* version + random + session + cipher + compress
	287	*/
	288	return (2 + 32 + 1 + 2 + 1
	289	+ sessionId.length() /* ... + variable parts */
	290	+ (cipherSuites.size() * 2)
	291	+ compression_methods.length)
	292	+ extensions.length();
	293	}
	294
	295	@Override
	296	void send(HandshakeOutStream s) throws IOException {
	297	s.putInt8(protocolVersion.major);
	298	s.putInt8(protocolVersion.minor);
	299	clnt_random.send(s);
	300	s.putBytes8(sessionId.getId());
	301	cipherSuites.send(s);
	302	s.putBytes8(compression_methods);
	303	extensions.send(s);
	304	}
	305
	306	@Override
	307	void print(PrintStream s) throws IOException {
	308	s.println("*** ClientHello, " + protocolVersion);
	309
	310	if (debug != null && Debug.isOn("verbose")) {
	311	s.print("RandomCookie: ");
	312	clnt_random.print(s);
	313
	314	s.print("Session ID: ");
	315	s.println(sessionId);
	316
	317	s.println("Cipher Suites: " + cipherSuites);
	318
	319	Debug.println(s, "Compression Methods", compression_methods);
	320	extensions.print(s);
	321	s.println("***");
	322	}
	323	}
	324	}
	325
	326	/*
	327	* ServerHello ... SERVER --> CLIENT
	328	*
	329	* Server chooses protocol options from among those it supports and the
	330	* client supports. Then it sends the basic session descriptive parameters
	331	* back to the client.
	332	*/
	333	static final
	334	class ServerHello extends HandshakeMessage
	335	{
	336	int messageType() { return ht_server_hello; }
	337
	338	ProtocolVersion protocolVersion;
	339	RandomCookie svr_random;
	340	SessionId sessionId;
	341	CipherSuite cipherSuite;
	342	byte compression_method;
	343	HelloExtensions extensions = new HelloExtensions();
	344
	345	ServerHello() {
	346	// empty
	347	}
	348
	349	ServerHello(HandshakeInStream input, int messageLength)
	350	throws IOException {
	351	protocolVersion = ProtocolVersion.valueOf(input.getInt8(),
	352	input.getInt8());
	353	svr_random = new RandomCookie(input);
	354	sessionId = new SessionId(input.getBytes8());
	355	cipherSuite = CipherSuite.valueOf(input.getInt8(), input.getInt8());
	356	compression_method = (byte)input.getInt8();
	357	if (messageLength() != messageLength) {
	358	extensions = new HelloExtensions(input);
	359	}
	360	}
	361
	362	int messageLength()
	363	{
	364	// almost fixed size, except session ID and extensions:
	365	// major + minor = 2
	366	// random = 32
	367	// session ID len field = 1
	368	// cipher suite + compression = 3
	369	// extensions: if present, 2 + length of extensions
	370	return 38 + sessionId.length() + extensions.length();
	371	}
	372
	373	void send(HandshakeOutStream s) throws IOException
	374	{
	375	s.putInt8(protocolVersion.major);
	376	s.putInt8(protocolVersion.minor);
	377	svr_random.send(s);
	378	s.putBytes8(sessionId.getId());
	379	s.putInt8(cipherSuite.id >> 8);
	380	s.putInt8(cipherSuite.id & 0xff);
	381	s.putInt8(compression_method);
	382	extensions.send(s);
	383	}
	384
	385	void print(PrintStream s) throws IOException
	386	{
	387	s.println("*** ServerHello, " + protocolVersion);
	388
	389	if (debug != null && Debug.isOn("verbose")) {
	390	s.print("RandomCookie: ");
	391	svr_random.print(s);
	392
	393	int i;
	394
	395	s.print("Session ID: ");
	396	s.println(sessionId);
	397
	398	s.println("Cipher Suite: " + cipherSuite);
	399	s.println("Compression Method: " + compression_method);
	400	extensions.print(s);
	401	s.println("***");
	402	}
	403	}
	404	}
	405
	406
	407	/*
	408	* CertificateMsg ... send by both CLIENT and SERVER
	409	*
	410	* Each end of a connection may need to pass its certificate chain to
	411	* the other end. Such chains are intended to validate an identity with
	412	* reference to some certifying authority. Examples include companies
	413	* like Verisign, or financial institutions. There's some control over
	414	* the certifying authorities which are sent.
	415	*
	416	* NOTE: that these messages might be huge, taking many handshake records.
	417	* Up to 2^48 bytes of certificate may be sent, in records of at most 2^14
	418	* bytes each ... up to 2^32 records sent on the output stream.
	419	*/
	420	static final
	421	class CertificateMsg extends HandshakeMessage
	422	{
	423	int messageType() { return ht_certificate; }
	424
	425	private X509Certificate[] chain;
	426
	427	private List<byte[]> encodedChain;
	428
	429	private int messageLength;
	430
	431	CertificateMsg(X509Certificate[] certs) {
	432	chain = certs;
	433	}
	434
	435	CertificateMsg(HandshakeInStream input) throws IOException {
	436	int chainLen = input.getInt24();
	437	List<Certificate> v = new ArrayList<>(4);
	438
	439	CertificateFactory cf = null;
	440	while (chainLen > 0) {
	441	byte[] cert = input.getBytes24();
	442	chainLen -= (3 + cert.length);
	443	try {
	444	if (cf == null) {
	445	cf = CertificateFactory.getInstance("X.509");
	446	}
	447	v.add(cf.generateCertificate(new ByteArrayInputStream(cert)));
	448	} catch (CertificateException e) {
	449	throw (SSLProtocolException)new SSLProtocolException(
	450	e.getMessage()).initCause(e);
	451	}
	452	}
	453
	454	chain = v.toArray(new X509Certificate[v.size()]);
	455	}
	456
	457	int messageLength() {
	458	if (encodedChain == null) {
	459	messageLength = 3;
	460	encodedChain = new ArrayList<byte[]>(chain.length);
	461	try {
	462	for (X509Certificate cert : chain) {
	463	byte[] b = cert.getEncoded();
	464	encodedChain.add(b);
	465	messageLength += b.length + 3;
	466	}
	467	} catch (CertificateEncodingException e) {
	468	encodedChain = null;
	469	throw new RuntimeException("Could not encode certificates", e);
	470	}
	471	}
	472	return messageLength;
	473	}
	474
	475	void send(HandshakeOutStream s) throws IOException {
	476	s.putInt24(messageLength() - 3);
	477	for (byte[] b : encodedChain) {
	478	s.putBytes24(b);
	479	}
	480	}
	481
	482	void print(PrintStream s) throws IOException {
	483	s.println("*** Certificate chain");
	484
	485	if (debug != null && Debug.isOn("verbose")) {
	486	for (int i = 0; i < chain.length; i++)
	487	s.println("chain [" + i + "] = " + chain[i]);
	488	s.println("***");
	489	}
	490	}
	491
	492	X509Certificate[] getCertificateChain() {
	493	return chain.clone();
	494	}
	495	}
	496
	497	/*
	498	* ServerKeyExchange ... SERVER --> CLIENT
	499	*
	500	* The cipher suite selected, when combined with the certificate exchanged,
	501	* implies one of several different kinds of key exchange. Most current
	502	* cipher suites require the server to send more than its certificate.
	503	*
	504	* The primary exceptions are when a server sends an encryption-capable
	505	* RSA public key in its cert, to be used with RSA (or RSA_export) key
	506	* exchange; and when a server sends its Diffie-Hellman cert. Those kinds
	507	* of key exchange do not require a ServerKeyExchange message.
	508	*
	509	* Key exchange can be viewed as having three modes, which are explicit
	510	* for the Diffie-Hellman flavors and poorly specified for RSA ones:
	511	*
	512	* - "Ephemeral" keys. Here, a "temporary" key is allocated by the
	513	* server, and signed. Diffie-Hellman keys signed using RSA or
	514	* DSS are ephemeral (DHE flavor). RSA keys get used to do the same
	515	* thing, to cut the key size down to 512 bits (export restrictions)
	516	* or for signing-only RSA certificates.
	517	*
	518	* - Anonymity. Here no server certificate is sent, only the public
	519	* key of the server. This case is subject to man-in-the-middle
	520	* attacks. This can be done with Diffie-Hellman keys (DH_anon) or
	521	* with RSA keys, but is only used in SSLv3 for DH_anon.
	522	*
	523	* - "Normal" case. Here a server certificate is sent, and the public
	524	* key there is used directly in exchanging the premaster secret.
	525	* For example, Diffie-Hellman "DH" flavor, and any RSA flavor with
	526	* only 512 bit keys.
	527	*
	528	* If a server certificate is sent, there is no anonymity. However,
	529	* when a certificate is sent, ephemeral keys may still be used to
	530	* exchange the premaster secret. That's how RSA_EXPORT often works,
	531	* as well as how the DHE_* flavors work.
	532	*/
	533	static abstract class ServerKeyExchange extends HandshakeMessage
	534	{
	535	int messageType() { return ht_server_key_exchange; }
	536	}
	537
	538
	539	/*
	540	* Using RSA for Key Exchange: exchange a session key that's not as big
	541	* as the signing-only key. Used for export applications, since exported
	542	* RSA encryption keys can't be bigger than 512 bytes.
	543	*
	544	* This is never used when keys are 512 bits or smaller, and isn't used
	545	* on "US Domestic" ciphers in any case.
	546	*/
	547	static final
	548	class RSA_ServerKeyExchange extends ServerKeyExchange
	549	{
	550	private byte rsa_modulus[]; // 1 to 2^16 - 1 bytes
	551	private byte rsa_exponent[]; // 1 to 2^16 - 1 bytes
	552
	553	private Signature signature;
	554	private byte[] signatureBytes;
	555
	556	/*
	557	* Hash the nonces and the ephemeral RSA public key.
	558	*/
	559	private void updateSignature(byte clntNonce[], byte svrNonce[])
	560	throws SignatureException {
	561	int tmp;
	562
	563	signature.update(clntNonce);
	564	signature.update(svrNonce);
	565
	566	tmp = rsa_modulus.length;
	567	signature.update((byte)(tmp >> 8));
	568	signature.update((byte)(tmp & 0x0ff));
	569	signature.update(rsa_modulus);
	570
	571	tmp = rsa_exponent.length;
	572	signature.update((byte)(tmp >> 8));
	573	signature.update((byte)(tmp & 0x0ff));
	574	signature.update(rsa_exponent);
	575	}
	576
	577
	578	/*
	579	* Construct an RSA server key exchange message, using data
	580	* known _only_ to the server.
	581	*
	582	* The client knows the public key corresponding to this private
	583	* key, from the Certificate message sent previously. To comply
	584	* with US export regulations we use short RSA keys ... either
	585	* long term ones in the server's X509 cert, or else ephemeral
	586	* ones sent using this message.
	587	*/
	588	RSA_ServerKeyExchange(PublicKey ephemeralKey, PrivateKey privateKey,
	589	RandomCookie clntNonce, RandomCookie svrNonce, SecureRandom sr)
	590	throws GeneralSecurityException {
	591	RSAPublicKeySpec rsaKey = JsseJce.getRSAPublicKeySpec(ephemeralKey);
	592	rsa_modulus = toByteArray(rsaKey.getModulus());
	593	rsa_exponent = toByteArray(rsaKey.getPublicExponent());
	594	signature = RSASignature.getInstance();
	595	signature.initSign(privateKey, sr);
	596	updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);
	597	signatureBytes = signature.sign();
	598	}
	599
	600
	601	/*
	602	* Parse an RSA server key exchange message, using data known
	603	* to the client (and, in some situations, eavesdroppers).
	604	*/
	605	RSA_ServerKeyExchange(HandshakeInStream input)
	606	throws IOException, NoSuchAlgorithmException {
	607	signature = RSASignature.getInstance();
	608	rsa_modulus = input.getBytes16();
	609	rsa_exponent = input.getBytes16();
	610	signatureBytes = input.getBytes16();
	611	}
	612
	613	/*
	614	* Get the ephemeral RSA public key that will be used in this
	615	* SSL connection.
	616	*/
	617	PublicKey getPublicKey() {
	618	try {
	619	KeyFactory kfac = JsseJce.getKeyFactory("RSA");
	620	// modulus and exponent are always positive
	621	RSAPublicKeySpec kspec = new RSAPublicKeySpec(
	622	new BigInteger(1, rsa_modulus),
	623	new BigInteger(1, rsa_exponent));
	624	return kfac.generatePublic(kspec);
	625	} catch (Exception e) {
	626	throw new RuntimeException(e);
	627	}
	628	}
	629
	630	/*
	631	* Verify the signed temporary key using the hashes computed
	632	* from it and the two nonces. This is called by clients
	633	* with "exportable" RSA flavors.
	634	*/
	635	boolean verify(PublicKey certifiedKey, RandomCookie clntNonce,
	636	RandomCookie svrNonce) throws GeneralSecurityException {
	637	signature.initVerify(certifiedKey);
	638	updateSignature(clntNonce.random_bytes, svrNonce.random_bytes);
	639	return signature.verify(signatureBytes);
	640	}
	641
	642	int messageLength() {
	643	return 6 + rsa_modulus.length + rsa_exponent.length
	644	+ signatureBytes.length;
	645	}
	646
	647	void send(HandshakeOutStream s) throws IOException {
	648	s.putBytes16(rsa_modulus);
	649	s.putBytes16(rsa_exponent);
	650	s.putBytes16(signatureBytes);
	651	}
	652
	653	void print(PrintStream s) throws IOException {
	654	s.println("*** RSA ServerKeyExchange");
	655
	656	if (debug != null && Debug.isOn("verbose")) {
	657	Debug.println(s, "RSA Modulus", rsa_modulus);
	658	Debug.println(s, "RSA Public Exponent", rsa_exponent);
	659	}
	660	}
	661	}
	662
	663
	664	/*
	665	* Using Diffie-Hellman algorithm for key exchange. All we really need to
	666	* do is securely get Diffie-Hellman keys (using the same P, G parameters)
	667	* to our peer, then we automatically have a shared secret without need
	668	* to exchange any more data. (D-H only solutions, such as SKIP, could
	669	* eliminate key exchange negotiations and get faster connection setup.
	670	* But they still need a signature algorithm like DSS/DSA to support the
	671	* trusted distribution of keys without relying on unscalable physical
	672	* key distribution systems.)
	673	*
	674	* This class supports several DH-based key exchange algorithms, though
	675	* perhaps eventually each deserves its own class. Notably, this has
	676	* basic support for DH_anon and its DHE_DSS and DHE_RSA signed variants.
	677	*/
	678	static final
	679	class DH_ServerKeyExchange extends ServerKeyExchange
	680	{
	681	// Fix message encoding, see 4348279
	682	private final static boolean dhKeyExchangeFix =
	683	Debug.getBooleanProperty("com.sun.net.ssl.dhKeyExchangeFix", true);
	684
	685	private byte dh_p []; // 1 to 2^16 - 1 bytes
	686	private byte dh_g []; // 1 to 2^16 - 1 bytes
	687	private byte dh_Ys []; // 1 to 2^16 - 1 bytes
	688
	689	private byte signature [];
	690
	691	// protocol version being established using this ServerKeyExchange message
	692	ProtocolVersion protocolVersion;
	693
	694	// the preferable signature algorithm used by this ServerKeyExchange message
	695	private SignatureAndHashAlgorithm preferableSignatureAlgorithm;
	696
	697	/*
	698	* Construct from initialized DH key object, for DH_anon
	699	* key exchange.
	700	*/
	701	DH_ServerKeyExchange(DHCrypt obj, ProtocolVersion protocolVersion) {
	702	this.protocolVersion = protocolVersion;
	703	this.preferableSignatureAlgorithm = null;
	704
	705	setValues(obj);
	706	signature = null;
	707	}
	708
	709	/*
	710	* Construct from initialized DH key object and the key associated
	711	* with the cert chain which was sent ... for DHE_DSS and DHE_RSA
	712	* key exchange. (Constructor called by server.)
	713	*/
	714	DH_ServerKeyExchange(DHCrypt obj, PrivateKey key, byte clntNonce[],
	715	byte svrNonce[], SecureRandom sr,
	716	SignatureAndHashAlgorithm signAlgorithm,
	717	ProtocolVersion protocolVersion) throws GeneralSecurityException {
	718
	719	this.protocolVersion = protocolVersion;
	720
	721	setValues(obj);
	722
	723	Signature sig;
	724	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	725	this.preferableSignatureAlgorithm = signAlgorithm;
	726	sig = JsseJce.getSignature(signAlgorithm.getAlgorithmName());
	727	} else {
	728	this.preferableSignatureAlgorithm = null;
	729	if (key.getAlgorithm().equals("DSA")) {
	730	sig = JsseJce.getSignature(JsseJce.SIGNATURE_DSA);
	731	} else {
	732	sig = RSASignature.getInstance();
	733	}
	734	}
	735
	736	sig.initSign(key, sr);
	737	updateSignature(sig, clntNonce, svrNonce);
	738	signature = sig.sign();
	739	}
	740
	741	/*
	742	* Construct a DH_ServerKeyExchange message from an input
	743	* stream, as if sent from server to client for use with
	744	* DH_anon key exchange
	745	*/
	746	DH_ServerKeyExchange(HandshakeInStream input,
	747	ProtocolVersion protocolVersion) throws IOException {
	748
	749	this.protocolVersion = protocolVersion;
	750	this.preferableSignatureAlgorithm = null;
	751
	752	dh_p = input.getBytes16();
	753	dh_g = input.getBytes16();
	754	dh_Ys = input.getBytes16();
	755	signature = null;
	756	}
	757
	758	/*
	759	* Construct a DH_ServerKeyExchange message from an input stream
	760	* and a certificate, as if sent from server to client for use with
	761	* DHE_DSS or DHE_RSA key exchange. (Called by client.)
	762	*/
	763	DH_ServerKeyExchange(HandshakeInStream input, PublicKey publicKey,
	764	byte clntNonce[], byte svrNonce[], int messageSize,
	765	Collection<SignatureAndHashAlgorithm> localSupportedSignAlgs,
	766	ProtocolVersion protocolVersion)
	767	throws IOException, GeneralSecurityException {
	768
	769	this.protocolVersion = protocolVersion;
	770
	771	// read params: ServerDHParams
	772	dh_p = input.getBytes16();
	773	dh_g = input.getBytes16();
	774	dh_Ys = input.getBytes16();
	775
	776	// read the signature and hash algorithm
	777	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	778	int hash = input.getInt8(); // hash algorithm
	779	int signature = input.getInt8(); // signature algorithm
	780
	781	preferableSignatureAlgorithm =
	782	SignatureAndHashAlgorithm.valueOf(hash, signature, 0);
	783
	784	// Is it a local supported signature algorithm?
	785	if (!localSupportedSignAlgs.contains(
	786	preferableSignatureAlgorithm)) {
	787	throw new SSLHandshakeException(
	788	"Unsupported SignatureAndHashAlgorithm in " +
	789	"ServerKeyExchange message");
	790	}
	791	} else {
	792	this.preferableSignatureAlgorithm = null;
	793	}
	794
	795	// read the signature
	796	byte signature[];
	797	if (dhKeyExchangeFix) {
	798	signature = input.getBytes16();
	799	} else {
	800	messageSize -= (dh_p.length + 2);
	801	messageSize -= (dh_g.length + 2);
	802	messageSize -= (dh_Ys.length + 2);
	803
	804	signature = new byte[messageSize];
	805	input.read(signature);
	806	}
	807
	808	Signature sig;
	809	String algorithm = publicKey.getAlgorithm();
	810	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	811	sig = JsseJce.getSignature(
	812	preferableSignatureAlgorithm.getAlgorithmName());
	813	} else {
	814	if (algorithm.equals("DSA")) {
	815	sig = JsseJce.getSignature(JsseJce.SIGNATURE_DSA);
	816	} else if (algorithm.equals("RSA")) {
	817	sig = RSASignature.getInstance();
	818	} else {
	819	throw new SSLKeyException("neither an RSA or a DSA key");
	820	}
	821	}
	822
	823	sig.initVerify(publicKey);
	824	updateSignature(sig, clntNonce, svrNonce);
	825
	826	if (sig.verify(signature) == false ) {
	827	throw new SSLKeyException("Server D-H key verification failed");
	828	}
	829	}
	830
	831	/* Return the Diffie-Hellman modulus */
	832	BigInteger getModulus() {
	833	return new BigInteger(1, dh_p);
	834	}
	835
	836	/* Return the Diffie-Hellman base/generator */
	837	BigInteger getBase() {
	838	return new BigInteger(1, dh_g);
	839	}
	840
	841	/* Return the server's Diffie-Hellman public key */
	842	BigInteger getServerPublicKey() {
	843	return new BigInteger(1, dh_Ys);
	844	}
	845
	846	/*
	847	* Update sig with nonces and Diffie-Hellman public key.
	848	*/
	849	private void updateSignature(Signature sig, byte clntNonce[],
	850	byte svrNonce[]) throws SignatureException {
	851	int tmp;
	852
	853	sig.update(clntNonce);
	854	sig.update(svrNonce);
	855
	856	tmp = dh_p.length;
	857	sig.update((byte)(tmp >> 8));
	858	sig.update((byte)(tmp & 0x0ff));
	859	sig.update(dh_p);
	860
	861	tmp = dh_g.length;
	862	sig.update((byte)(tmp >> 8));
	863	sig.update((byte)(tmp & 0x0ff));
	864	sig.update(dh_g);
	865
	866	tmp = dh_Ys.length;
	867	sig.update((byte)(tmp >> 8));
	868	sig.update((byte)(tmp & 0x0ff));
	869	sig.update(dh_Ys);
	870	}
	871
	872	private void setValues(DHCrypt obj) {
	873	dh_p = toByteArray(obj.getModulus());
	874	dh_g = toByteArray(obj.getBase());
	875	dh_Ys = toByteArray(obj.getPublicKey());
	876	}
	877
	878	int messageLength() {
	879	int temp = 6; // overhead for p, g, y(s) values.
	880
	881	temp += dh_p.length;
	882	temp += dh_g.length;
	883	temp += dh_Ys.length;
	884
	885	if (signature != null) {
	886	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	887	temp += SignatureAndHashAlgorithm.sizeInRecord();
	888	}
	889
	890	temp += signature.length;
	891	if (dhKeyExchangeFix) {
	892	temp += 2;
	893	}
	894	}
	895
	896	return temp;
	897	}
	898
	899	void send(HandshakeOutStream s) throws IOException {
	900	s.putBytes16(dh_p);
	901	s.putBytes16(dh_g);
	902	s.putBytes16(dh_Ys);
	903
	904	if (signature != null) {
	905	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	906	s.putInt8(preferableSignatureAlgorithm.getHashValue());
	907	s.putInt8(preferableSignatureAlgorithm.getSignatureValue());
	908	}
	909
	910	if (dhKeyExchangeFix) {
	911	s.putBytes16(signature);
	912	} else {
	913	s.write(signature);
	914	}
	915	}
	916	}
	917
	918	void print(PrintStream s) throws IOException {
	919	s.println("*** Diffie-Hellman ServerKeyExchange");
	920
	921	if (debug != null && Debug.isOn("verbose")) {
	922	Debug.println(s, "DH Modulus", dh_p);
	923	Debug.println(s, "DH Base", dh_g);
	924	Debug.println(s, "Server DH Public Key", dh_Ys);
	925
	926	if (signature == null) {
	927	s.println("Anonymous");
	928	} else {
	929	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	930	s.println("Signature Algorithm " +
	931	preferableSignatureAlgorithm.getAlgorithmName());
	932	}
	933
	934	s.println("Signed with a DSA or RSA public key");
	935	}
	936	}
	937	}
	938	}
	939
	940	/*
	941	* ECDH server key exchange message. Sent by the server for ECDHE and ECDH_anon
	942	* ciphersuites to communicate its ephemeral public key (including the
	943	* EC domain parameters).
	944	*
	945	* We support named curves only, no explicitly encoded curves.
	946	*/
	947	static final
	948	class ECDH_ServerKeyExchange extends ServerKeyExchange {
	949
	950	// constants for ECCurveType
	951	private final static int CURVE_EXPLICIT_PRIME = 1;
	952	private final static int CURVE_EXPLICIT_CHAR2 = 2;
	953	private final static int CURVE_NAMED_CURVE = 3;
	954
	955	// id of the curve we are using
	956	private int curveId;
	957	// encoded public point
	958	private byte[] pointBytes;
	959
	960	// signature bytes (or null if anonymous)
	961	private byte[] signatureBytes;
	962
	963	// public key object encapsulated in this message
	964	private ECPublicKey publicKey;
	965
	966	// protocol version being established using this ServerKeyExchange message
	967	ProtocolVersion protocolVersion;
	968
	969	// the preferable signature algorithm used by this ServerKeyExchange message
	970	private SignatureAndHashAlgorithm preferableSignatureAlgorithm;
	971
	972	ECDH_ServerKeyExchange(ECDHCrypt obj, PrivateKey privateKey,
	973	byte[] clntNonce, byte[] svrNonce, SecureRandom sr,
	974	SignatureAndHashAlgorithm signAlgorithm,
	975	ProtocolVersion protocolVersion) throws GeneralSecurityException {
	976
	977	this.protocolVersion = protocolVersion;
	978
	979	publicKey = (ECPublicKey)obj.getPublicKey();
	980	ECParameterSpec params = publicKey.getParams();
	981	ECPoint point = publicKey.getW();
	982	pointBytes = JsseJce.encodePoint(point, params.getCurve());
	983	curveId = SupportedEllipticCurvesExtension.getCurveIndex(params);
	984
	985	if (privateKey == null) {
	986	// ECDH_anon
	987	return;
	988	}
	989
	990	Signature sig;
	991	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	992	this.preferableSignatureAlgorithm = signAlgorithm;
	993	sig = JsseJce.getSignature(signAlgorithm.getAlgorithmName());
	994	} else {
	995	sig = getSignature(privateKey.getAlgorithm());
	996	}
	997	sig.initSign(privateKey); // where is the SecureRandom?
	998
	999	updateSignature(sig, clntNonce, svrNonce);
	1000	signatureBytes = sig.sign();
	1001	}
	1002
	1003	/*
	1004	* Parse an ECDH server key exchange message.
	1005	*/
	1006	ECDH_ServerKeyExchange(HandshakeInStream input, PublicKey signingKey,
	1007	byte[] clntNonce, byte[] svrNonce,
	1008	Collection<SignatureAndHashAlgorithm> localSupportedSignAlgs,
	1009	ProtocolVersion protocolVersion)
	1010	throws IOException, GeneralSecurityException {
	1011
	1012	this.protocolVersion = protocolVersion;
	1013
	1014	// read params: ServerECDHParams
	1015	int curveType = input.getInt8();
	1016	ECParameterSpec parameters;
	1017	// These parsing errors should never occur as we negotiated
	1018	// the supported curves during the exchange of the Hello messages.
	1019	if (curveType == CURVE_NAMED_CURVE) {
	1020	curveId = input.getInt16();
	1021	if (SupportedEllipticCurvesExtension.isSupported(curveId)
	1022	== false) {
	1023	throw new SSLHandshakeException(
	1024	"Unsupported curveId: " + curveId);
	1025	}
	1026	String curveOid =
	1027	SupportedEllipticCurvesExtension.getCurveOid(curveId);
	1028	if (curveOid == null) {
	1029	throw new SSLHandshakeException(
	1030	"Unknown named curve: " + curveId);
	1031	}
	1032	parameters = JsseJce.getECParameterSpec(curveOid);
	1033	if (parameters == null) {
	1034	throw new SSLHandshakeException(
	1035	"Unsupported curve: " + curveOid);
	1036	}
	1037	} else {
	1038	throw new SSLHandshakeException(
	1039	"Unsupported ECCurveType: " + curveType);
	1040	}
	1041	pointBytes = input.getBytes8();
	1042
	1043	ECPoint point = JsseJce.decodePoint(pointBytes, parameters.getCurve());
	1044	KeyFactory factory = JsseJce.getKeyFactory("EC");
	1045	publicKey = (ECPublicKey)factory.generatePublic(
	1046	new ECPublicKeySpec(point, parameters));
	1047
	1048	if (signingKey == null) {
	1049	// ECDH_anon
	1050	return;
	1051	}
	1052
	1053	// read the signature and hash algorithm
	1054	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1055	int hash = input.getInt8(); // hash algorithm
	1056	int signature = input.getInt8(); // signature algorithm
	1057
	1058	preferableSignatureAlgorithm =
	1059	SignatureAndHashAlgorithm.valueOf(hash, signature, 0);
	1060
	1061	// Is it a local supported signature algorithm?
	1062	if (!localSupportedSignAlgs.contains(
	1063	preferableSignatureAlgorithm)) {
	1064	throw new SSLHandshakeException(
	1065	"Unsupported SignatureAndHashAlgorithm in " +
	1066	"ServerKeyExchange message");
	1067	}
	1068	}
	1069
	1070	// read the signature
	1071	signatureBytes = input.getBytes16();
	1072
	1073	// verify the signature
	1074	Signature sig;
	1075	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1076	sig = JsseJce.getSignature(
	1077	preferableSignatureAlgorithm.getAlgorithmName());
	1078	} else {
	1079	sig = getSignature(signingKey.getAlgorithm());
	1080	}
	1081	sig.initVerify(signingKey);
	1082
	1083	updateSignature(sig, clntNonce, svrNonce);
	1084
	1085	if (sig.verify(signatureBytes) == false ) {
	1086	throw new SSLKeyException(
	1087	"Invalid signature on ECDH server key exchange message");
	1088	}
	1089	}
	1090
	1091	/*
	1092	* Get the ephemeral EC public key encapsulated in this message.
	1093	*/
	1094	ECPublicKey getPublicKey() {
	1095	return publicKey;
	1096	}
	1097
	1098	private static Signature getSignature(String keyAlgorithm)
	1099	throws NoSuchAlgorithmException {
	1100	if (keyAlgorithm.equals("EC")) {
	1101	return JsseJce.getSignature(JsseJce.SIGNATURE_ECDSA);
	1102	} else if (keyAlgorithm.equals("RSA")) {
	1103	return RSASignature.getInstance();
	1104	} else {
	1105	throw new NoSuchAlgorithmException("neither an RSA or a EC key");
	1106	}
	1107	}
	1108
	1109	private void updateSignature(Signature sig, byte clntNonce[],
	1110	byte svrNonce[]) throws SignatureException {
	1111	sig.update(clntNonce);
	1112	sig.update(svrNonce);
	1113
	1114	sig.update((byte)CURVE_NAMED_CURVE);
	1115	sig.update((byte)(curveId >> 8));
	1116	sig.update((byte)curveId);
	1117	sig.update((byte)pointBytes.length);
	1118	sig.update(pointBytes);
	1119	}
	1120
	1121	int messageLength() {
	1122	int sigLen = 0;
	1123	if (signatureBytes != null) {
	1124	sigLen = 2 + signatureBytes.length;
	1125	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1126	sigLen += SignatureAndHashAlgorithm.sizeInRecord();
	1127	}
	1128	}
	1129
	1130	return 4 + pointBytes.length + sigLen;
	1131	}
	1132
	1133	void send(HandshakeOutStream s) throws IOException {
	1134	s.putInt8(CURVE_NAMED_CURVE);
	1135	s.putInt16(curveId);
	1136	s.putBytes8(pointBytes);
	1137
	1138	if (signatureBytes != null) {
	1139	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1140	s.putInt8(preferableSignatureAlgorithm.getHashValue());
	1141	s.putInt8(preferableSignatureAlgorithm.getSignatureValue());
	1142	}
	1143
	1144	s.putBytes16(signatureBytes);
	1145	}
	1146	}
	1147
	1148	void print(PrintStream s) throws IOException {
	1149	s.println("*** ECDH ServerKeyExchange");
	1150
	1151	if (debug != null && Debug.isOn("verbose")) {
	1152	if (signatureBytes == null) {
	1153	s.println("Anonymous");
	1154	} else {
	1155	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1156	s.println("Signature Algorithm " +
	1157	preferableSignatureAlgorithm.getAlgorithmName());
	1158	}
	1159	}
	1160
	1161	s.println("Server key: " + publicKey);
	1162	}
	1163	}
	1164	}
	1165
	1166	static final class DistinguishedName {
	1167
	1168	/*
	1169	* DER encoded distinguished name.
	1170	* TLS requires that its not longer than 65535 bytes.
	1171	*/
	1172	byte name[];
	1173
	1174	DistinguishedName(HandshakeInStream input) throws IOException {
	1175	name = input.getBytes16();
	1176	}
	1177
	1178	DistinguishedName(X500Principal dn) {
	1179	name = dn.getEncoded();
	1180	}
	1181
	1182	X500Principal getX500Principal() throws IOException {
	1183	try {
	1184	return new X500Principal(name);
	1185	} catch (IllegalArgumentException e) {
	1186	throw (SSLProtocolException)new SSLProtocolException(
	1187	e.getMessage()).initCause(e);
	1188	}
	1189	}
	1190
	1191	int length() {
	1192	return 2 + name.length;
	1193	}
	1194
	1195	void send(HandshakeOutStream output) throws IOException {
	1196	output.putBytes16(name);
	1197	}
	1198
	1199	void print(PrintStream output) throws IOException {
	1200	X500Principal principal = new X500Principal(name);
	1201	output.println("<" + principal.toString() + ">");
	1202	}
	1203	}
	1204
	1205	/*
	1206	* CertificateRequest ... SERVER --> CLIENT
	1207	*
	1208	* Authenticated servers may ask clients to authenticate themselves
	1209	* in turn, using this message.
	1210	*
	1211	* Prior to TLS 1.2, the structure of the message is defined as:
	1212	* struct {
	1213	* ClientCertificateType certificate_types<1..2^8-1>;
	1214	* DistinguishedName certificate_authorities<0..2^16-1>;
	1215	* } CertificateRequest;
	1216	*
	1217	* In TLS 1.2, the structure is changed to:
	1218	* struct {
	1219	* ClientCertificateType certificate_types<1..2^8-1>;
	1220	* SignatureAndHashAlgorithm
	1221	* supported_signature_algorithms<2^16-1>;
	1222	* DistinguishedName certificate_authorities<0..2^16-1>;
	1223	* } CertificateRequest;
	1224	*
	1225	*/
	1226	static final
	1227	class CertificateRequest extends HandshakeMessage
	1228	{
	1229	// enum ClientCertificateType
	1230	static final int cct_rsa_sign = 1;
	1231	static final int cct_dss_sign = 2;
	1232	static final int cct_rsa_fixed_dh = 3;
	1233	static final int cct_dss_fixed_dh = 4;
	1234
	1235	// The existance of these two values is a bug in the SSL specification.
	1236	// They are never used in the protocol.
	1237	static final int cct_rsa_ephemeral_dh = 5;
	1238	static final int cct_dss_ephemeral_dh = 6;
	1239
	1240	// From RFC 4492 (ECC)
	1241	static final int cct_ecdsa_sign = 64;
	1242	static final int cct_rsa_fixed_ecdh = 65;
	1243	static final int cct_ecdsa_fixed_ecdh = 66;
	1244
	1245	private final static byte[] TYPES_NO_ECC = { cct_rsa_sign, cct_dss_sign };
	1246	private final static byte[] TYPES_ECC =
	1247	{ cct_rsa_sign, cct_dss_sign, cct_ecdsa_sign };
	1248
	1249	byte types []; // 1 to 255 types
	1250	DistinguishedName authorities []; // 3 to 2^16 - 1
	1251	// ... "3" because that's the smallest DER-encoded X500 DN
	1252
	1253	// protocol version being established using this CertificateRequest message
	1254	ProtocolVersion protocolVersion;
	1255
	1256	// supported_signature_algorithms for TLS 1.2 or later
	1257	private Collection<SignatureAndHashAlgorithm> algorithms;
	1258
	1259	// length of supported_signature_algorithms
	1260	private int algorithmsLen;
	1261
	1262	CertificateRequest(X509Certificate ca[], KeyExchange keyExchange,
	1263	Collection<SignatureAndHashAlgorithm> signAlgs,
	1264	ProtocolVersion protocolVersion) throws IOException {
	1265
	1266	this.protocolVersion = protocolVersion;
	1267
	1268	// always use X500Principal
	1269	authorities = new DistinguishedName[ca.length];
	1270	for (int i = 0; i < ca.length; i++) {
	1271	X500Principal x500Principal = ca[i].getSubjectX500Principal();
	1272	authorities[i] = new DistinguishedName(x500Principal);
	1273	}
	1274	// we support RSA, DSS, and ECDSA client authentication and they
	1275	// can be used with all ciphersuites. If this changes, the code
	1276	// needs to be adapted to take keyExchange into account.
	1277	// We only request ECDSA client auth if we have ECC crypto available.
	1278	this.types = JsseJce.isEcAvailable() ? TYPES_ECC : TYPES_NO_ECC;
	1279
	1280	// Use supported_signature_algorithms for TLS 1.2 or later.
	1281	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1282	if (signAlgs == null \|\| signAlgs.isEmpty()) {
	1283	throw new SSLProtocolException(
	1284	"No supported signature algorithms");
	1285	}
	1286
	1287	algorithms = new ArrayList<SignatureAndHashAlgorithm>(signAlgs);
	1288	algorithmsLen =
	1289	SignatureAndHashAlgorithm.sizeInRecord() * algorithms.size();
	1290	} else {
	1291	algorithms = new ArrayList<SignatureAndHashAlgorithm>();
	1292	algorithmsLen = 0;
	1293	}
	1294	}
	1295
	1296	CertificateRequest(HandshakeInStream input,
	1297	ProtocolVersion protocolVersion) throws IOException {
	1298
	1299	this.protocolVersion = protocolVersion;
	1300
	1301	// Read the certificate_types.
	1302	types = input.getBytes8();
	1303
	1304	// Read the supported_signature_algorithms for TLS 1.2 or later.
	1305	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1306	algorithmsLen = input.getInt16();
	1307	if (algorithmsLen < 2) {
	1308	throw new SSLProtocolException(
	1309	"Invalid supported_signature_algorithms field");
	1310	}
	1311
	1312	algorithms = new ArrayList<SignatureAndHashAlgorithm>();
	1313	int remains = algorithmsLen;
	1314	int sequence = 0;
	1315	while (remains > 1) { // needs at least two bytes
	1316	int hash = input.getInt8(); // hash algorithm
	1317	int signature = input.getInt8(); // signature algorithm
	1318
	1319	SignatureAndHashAlgorithm algorithm =
	1320	SignatureAndHashAlgorithm.valueOf(hash, signature,
	1321	++sequence);
	1322	algorithms.add(algorithm);
	1323	remains -= 2; // one byte for hash, one byte for signature
	1324	}
	1325
	1326	if (remains != 0) {
	1327	throw new SSLProtocolException(
	1328	"Invalid supported_signature_algorithms field");
	1329	}
	1330	} else {
	1331	algorithms = new ArrayList<SignatureAndHashAlgorithm>();
	1332	algorithmsLen = 0;
	1333	}
	1334
	1335	// read the certificate_authorities
	1336	int len = input.getInt16();
	1337	ArrayList<DistinguishedName> v = new ArrayList<>();
	1338	while (len >= 3) {
	1339	DistinguishedName dn = new DistinguishedName(input);
	1340	v.add(dn);
	1341	len -= dn.length();
	1342	}
	1343
	1344	if (len != 0) {
	1345	throw new SSLProtocolException("Bad CertificateRequest DN length");
	1346	}
	1347
	1348	authorities = v.toArray(new DistinguishedName[v.size()]);
	1349	}
	1350
	1351	X500Principal[] getAuthorities() throws IOException {
	1352	X500Principal[] ret = new X500Principal[authorities.length];
	1353	for (int i = 0; i < authorities.length; i++) {
	1354	ret[i] = authorities[i].getX500Principal();
	1355	}
	1356	return ret;
	1357	}
	1358
	1359	Collection<SignatureAndHashAlgorithm> getSignAlgorithms() {
	1360	return algorithms;
	1361	}
	1362
	1363	@Override
	1364	int messageType() {
	1365	return ht_certificate_request;
	1366	}
	1367
	1368	@Override
	1369	int messageLength() {
	1370	int len = 1 + types.length + 2;
	1371
	1372	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1373	len += algorithmsLen + 2;
	1374	}
	1375
	1376	for (int i = 0; i < authorities.length; i++) {
	1377	len += authorities[i].length();
	1378	}
	1379
	1380	return len;
	1381	}
	1382
	1383	@Override
	1384	void send(HandshakeOutStream output) throws IOException {
	1385	// put certificate_types
	1386	output.putBytes8(types);
	1387
	1388	// put supported_signature_algorithms
	1389	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1390	output.putInt16(algorithmsLen);
	1391	for (SignatureAndHashAlgorithm algorithm : algorithms) {
	1392	output.putInt8(algorithm.getHashValue()); // hash
	1393	output.putInt8(algorithm.getSignatureValue()); // signature
	1394	}
	1395	}
	1396
	1397	// put certificate_authorities
	1398	int len = 0;
	1399	for (int i = 0; i < authorities.length; i++) {
	1400	len += authorities[i].length();
	1401	}
	1402
	1403	output.putInt16(len);
	1404	for (int i = 0; i < authorities.length; i++) {
	1405	authorities[i].send(output);
	1406	}
	1407	}
	1408
	1409	@Override
	1410	void print(PrintStream s) throws IOException {
	1411	s.println("*** CertificateRequest");
	1412
	1413	if (debug != null && Debug.isOn("verbose")) {
	1414	s.print("Cert Types: ");
	1415	for (int i = 0; i < types.length; i++) {
	1416	switch (types[i]) {
	1417	case cct_rsa_sign:
	1418	s.print("RSA"); break;
	1419	case cct_dss_sign:
	1420	s.print("DSS"); break;
	1421	case cct_rsa_fixed_dh:
	1422	s.print("Fixed DH (RSA sig)"); break;
	1423	case cct_dss_fixed_dh:
	1424	s.print("Fixed DH (DSS sig)"); break;
	1425	case cct_rsa_ephemeral_dh:
	1426	s.print("Ephemeral DH (RSA sig)"); break;
	1427	case cct_dss_ephemeral_dh:
	1428	s.print("Ephemeral DH (DSS sig)"); break;
	1429	case cct_ecdsa_sign:
	1430	s.print("ECDSA"); break;
	1431	case cct_rsa_fixed_ecdh:
	1432	s.print("Fixed ECDH (RSA sig)"); break;
	1433	case cct_ecdsa_fixed_ecdh:
	1434	s.print("Fixed ECDH (ECDSA sig)"); break;
	1435	default:
	1436	s.print("Type-" + (types[i] & 0xff)); break;
	1437	}
	1438	if (i != types.length - 1) {
	1439	s.print(", ");
	1440	}
	1441	}
	1442	s.println();
	1443
	1444	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1445	StringBuffer buffer = new StringBuffer();
	1446	boolean opened = false;
	1447	for (SignatureAndHashAlgorithm signAlg : algorithms) {
	1448	if (opened) {
	1449	buffer.append(", " + signAlg.getAlgorithmName());
	1450	} else {
	1451	buffer.append(signAlg.getAlgorithmName());
	1452	opened = true;
	1453	}
	1454	}
	1455	s.println("Supported Signature Algorithms: " + buffer);
	1456	}
	1457
	1458	s.println("Cert Authorities:");
	1459	if (authorities.length == 0) {
	1460	s.println("<Empty>");
	1461	} else {
	1462	for (int i = 0; i < authorities.length; i++) {
	1463	authorities[i].print(s);
	1464	}
	1465	}
	1466	}
	1467	}
	1468	}
	1469
	1470
	1471	/*
	1472	* ServerHelloDone ... SERVER --> CLIENT
	1473	*
	1474	* When server's done sending its messages in response to the client's
	1475	* "hello" (e.g. its own hello, certificate, key exchange message, perhaps
	1476	* client certificate request) it sends this message to flag that it's
	1477	* done that part of the handshake.
	1478	*/
	1479	static final
	1480	class ServerHelloDone extends HandshakeMessage
	1481	{
	1482	int messageType() { return ht_server_hello_done; }
	1483
	1484	ServerHelloDone() { }
	1485
	1486	ServerHelloDone(HandshakeInStream input)
	1487	{
	1488	// nothing to do
	1489	}
	1490
	1491	int messageLength()
	1492	{
	1493	return 0;
	1494	}
	1495
	1496	void send(HandshakeOutStream s) throws IOException
	1497	{
	1498	// nothing to send
	1499	}
	1500
	1501	void print(PrintStream s) throws IOException
	1502	{
	1503	s.println("*** ServerHelloDone");
	1504	}
	1505	}
	1506
	1507
	1508	/*
	1509	* CertificateVerify ... CLIENT --> SERVER
	1510	*
	1511	* Sent after client sends signature-capable certificates (e.g. not
	1512	* Diffie-Hellman) to verify.
	1513	*/
	1514	static final class CertificateVerify extends HandshakeMessage {
	1515
	1516	// the signature bytes
	1517	private byte[] signature;
	1518
	1519	// protocol version being established using this ServerKeyExchange message
	1520	ProtocolVersion protocolVersion;
	1521
	1522	// the preferable signature algorithm used by this CertificateVerify message
	1523	private SignatureAndHashAlgorithm preferableSignatureAlgorithm = null;
	1524
	1525	/*
	1526	* Create an RSA or DSA signed certificate verify message.
	1527	*/
	1528	CertificateVerify(ProtocolVersion protocolVersion,
	1529	HandshakeHash handshakeHash, PrivateKey privateKey,
	1530	SecretKey masterSecret, SecureRandom sr,
	1531	SignatureAndHashAlgorithm signAlgorithm)
	1532	throws GeneralSecurityException {
	1533
	1534	this.protocolVersion = protocolVersion;
	1535
	1536	String algorithm = privateKey.getAlgorithm();
	1537	Signature sig = null;
	1538	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1539	this.preferableSignatureAlgorithm = signAlgorithm;
	1540	sig = JsseJce.getSignature(signAlgorithm.getAlgorithmName());
	1541	} else {
	1542	sig = getSignature(protocolVersion, algorithm);
	1543	}
	1544	sig.initSign(privateKey, sr);
	1545	updateSignature(sig, protocolVersion, handshakeHash, algorithm,
	1546	masterSecret);
	1547	signature = sig.sign();
	1548	}
	1549
	1550	//
	1551	// Unmarshal the signed data from the input stream.
	1552	//
	1553	CertificateVerify(HandshakeInStream input,
	1554	Collection<SignatureAndHashAlgorithm> localSupportedSignAlgs,
	1555	ProtocolVersion protocolVersion) throws IOException {
	1556
	1557	this.protocolVersion = protocolVersion;
	1558
	1559	// read the signature and hash algorithm
	1560	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1561	int hashAlg = input.getInt8(); // hash algorithm
	1562	int signAlg = input.getInt8(); // signature algorithm
	1563
	1564	preferableSignatureAlgorithm =
	1565	SignatureAndHashAlgorithm.valueOf(hashAlg, signAlg, 0);
	1566
	1567	// Is it a local supported signature algorithm?
	1568	if (!localSupportedSignAlgs.contains(
	1569	preferableSignatureAlgorithm)) {
	1570	throw new SSLHandshakeException(
	1571	"Unsupported SignatureAndHashAlgorithm in " +
	1572	"ServerKeyExchange message");
	1573	}
	1574	}
	1575
	1576	// read the signature
	1577	signature = input.getBytes16();
	1578	}
	1579
	1580	/*
	1581	* Get the preferable signature algorithm used by this message
	1582	*/
	1583	SignatureAndHashAlgorithm getPreferableSignatureAlgorithm() {
	1584	return preferableSignatureAlgorithm;
	1585	}
	1586
	1587	/*
	1588	* Verify a certificate verify message. Return the result of verification,
	1589	* if there is a problem throw a GeneralSecurityException.
	1590	*/
	1591	boolean verify(ProtocolVersion protocolVersion,
	1592	HandshakeHash handshakeHash, PublicKey publicKey,
	1593	SecretKey masterSecret) throws GeneralSecurityException {
	1594	String algorithm = publicKey.getAlgorithm();
	1595	Signature sig = null;
	1596	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1597	sig = JsseJce.getSignature(
	1598	preferableSignatureAlgorithm.getAlgorithmName());
	1599	} else {
	1600	sig = getSignature(protocolVersion, algorithm);
	1601	}
	1602	sig.initVerify(publicKey);
	1603	updateSignature(sig, protocolVersion, handshakeHash, algorithm,
	1604	masterSecret);
	1605	return sig.verify(signature);
	1606	}
	1607
	1608	/*
	1609	* Get the Signature object appropriate for verification using the
	1610	* given signature algorithm and protocol version.
	1611	*/
	1612	private static Signature getSignature(ProtocolVersion protocolVersion,
	1613	String algorithm) throws GeneralSecurityException {
	1614	if (algorithm.equals("RSA")) {
	1615	return RSASignature.getInternalInstance();
	1616	} else if (algorithm.equals("DSA")) {
	1617	return JsseJce.getSignature(JsseJce.SIGNATURE_RAWDSA);
	1618	} else if (algorithm.equals("EC")) {
	1619	return JsseJce.getSignature(JsseJce.SIGNATURE_RAWECDSA);
	1620	} else {
	1621	throw new SignatureException("Unrecognized algorithm: "
	1622	+ algorithm);
	1623	}
	1624	}
	1625
	1626	/*
	1627	* Update the Signature with the data appropriate for the given
	1628	* signature algorithm and protocol version so that the object is
	1629	* ready for signing or verifying.
	1630	*/
	1631	private static void updateSignature(Signature sig,
	1632	ProtocolVersion protocolVersion,
	1633	HandshakeHash handshakeHash, String algorithm, SecretKey masterKey)
	1634	throws SignatureException {
	1635
	1636	if (algorithm.equals("RSA")) {
	1637	if (protocolVersion.v < ProtocolVersion.TLS12.v) { // TLS1.1-
	1638	MessageDigest md5Clone = handshakeHash.getMD5Clone();
	1639	MessageDigest shaClone = handshakeHash.getSHAClone();
	1640
	1641	if (protocolVersion.v < ProtocolVersion.TLS10.v) { // SSLv3
	1642	updateDigest(md5Clone, MD5_pad1, MD5_pad2, masterKey);
	1643	updateDigest(shaClone, SHA_pad1, SHA_pad2, masterKey);
	1644	}
	1645
	1646	// The signature must be an instance of RSASignature, need
	1647	// to use these hashes directly.
	1648	RSASignature.setHashes(sig, md5Clone, shaClone);
	1649	} else { // TLS1.2+
	1650	sig.update(handshakeHash.getAllHandshakeMessages());
	1651	}
	1652	} else { // DSA, ECDSA
	1653	if (protocolVersion.v < ProtocolVersion.TLS12.v) { // TLS1.1-
	1654	MessageDigest shaClone = handshakeHash.getSHAClone();
	1655
	1656	if (protocolVersion.v < ProtocolVersion.TLS10.v) { // SSLv3
	1657	updateDigest(shaClone, SHA_pad1, SHA_pad2, masterKey);
	1658	}
	1659
	1660	sig.update(shaClone.digest());
	1661	} else { // TLS1.2+
	1662	sig.update(handshakeHash.getAllHandshakeMessages());
	1663	}
	1664	}
	1665	}
	1666
	1667	/*
	1668	* Update the MessageDigest for SSLv3 certificate verify or finished
	1669	* message calculation. The digest must already have been updated with
	1670	* all preceding handshake messages.
	1671	* Used by the Finished class as well.
	1672	*/
	1673	private static void updateDigest(MessageDigest md,
	1674	byte[] pad1, byte[] pad2,
	1675	SecretKey masterSecret) {
	1676	// Digest the key bytes if available.
	1677	// Otherwise (sensitive key), try digesting the key directly.
	1678	// That is currently only implemented in SunPKCS11 using a private
	1679	// reflection API, so we avoid that if possible.
	1680	byte[] keyBytes = "RAW".equals(masterSecret.getFormat())
	1681	? masterSecret.getEncoded() : null;
	1682	if (keyBytes != null) {
	1683	md.update(keyBytes);
	1684	} else {
	1685	digestKey(md, masterSecret);
	1686	}
	1687	md.update(pad1);
	1688	byte[] temp = md.digest();
	1689
	1690	if (keyBytes != null) {
	1691	md.update(keyBytes);
	1692	} else {
	1693	digestKey(md, masterSecret);
	1694	}
	1695	md.update(pad2);
	1696	md.update(temp);
	1697	}
	1698
	1699	private final static Class delegate;
	1700	private final static Field spiField;
	1701
	1702	static {
	1703	try {
	1704	delegate = Class.forName("java.security.MessageDigest$Delegate");
	1705	spiField = delegate.getDeclaredField("digestSpi");
	1706	} catch (Exception e) {
	1707	throw new RuntimeException("Reflection failed", e);
	1708	}
	1709	makeAccessible(spiField);
	1710	}
	1711
	1712	private static void makeAccessible(final AccessibleObject o) {
	1713	AccessController.doPrivileged(new PrivilegedAction<Object>() {
	1714	public Object run() {
	1715	o.setAccessible(true);
	1716	return null;
	1717	}
	1718	});
	1719	}
	1720
	1721	// ConcurrentHashMap does not allow null values, use this marker object
	1722	private final static Object NULL_OBJECT = new Object();
	1723
	1724	// cache Method objects per Spi class
	1725	// Note that this will prevent the Spi classes from being GC'd. We assume
	1726	// that is not a problem.
	1727	private final static Map<Class,Object> methodCache =
	1728	new ConcurrentHashMap<>();
	1729
	1730	private static void digestKey(MessageDigest md, SecretKey key) {
	1731	try {
	1732	// Verify that md is implemented via MessageDigestSpi, not
	1733	// via JDK 1.1 style MessageDigest subclassing.
	1734	if (md.getClass() != delegate) {
	1735	throw new Exception("Digest is not a MessageDigestSpi");
	1736	}
	1737	MessageDigestSpi spi = (MessageDigestSpi)spiField.get(md);
	1738	Class<?> clazz = spi.getClass();
	1739	Object r = methodCache.get(clazz);
	1740	if (r == null) {
	1741	try {
	1742	r = clazz.getDeclaredMethod("implUpdate", SecretKey.class);
	1743	makeAccessible((Method)r);
	1744	} catch (NoSuchMethodException e) {
	1745	r = NULL_OBJECT;
	1746	}
	1747	methodCache.put(clazz, r);
	1748	}
	1749	if (r == NULL_OBJECT) {
	1750	throw new Exception(
	1751	"Digest does not support implUpdate(SecretKey)");
	1752	}
	1753	Method update = (Method)r;
	1754	update.invoke(spi, key);
	1755	} catch (Exception e) {
	1756	throw new RuntimeException(
	1757	"Could not obtain encoded key and "
	1758	+ "MessageDigest cannot digest key", e);
	1759	}
	1760	}
	1761
	1762	@Override
	1763	int messageType() {
	1764	return ht_certificate_verify;
	1765	}
	1766
	1767	@Override
	1768	int messageLength() {
	1769	int temp = 2;
	1770
	1771	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1772	temp += SignatureAndHashAlgorithm.sizeInRecord();
	1773	}
	1774
	1775	return temp + signature.length;
	1776	}
	1777
	1778	@Override
	1779	void send(HandshakeOutStream s) throws IOException {
	1780	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1781	s.putInt8(preferableSignatureAlgorithm.getHashValue());
	1782	s.putInt8(preferableSignatureAlgorithm.getSignatureValue());
	1783	}
	1784
	1785	s.putBytes16(signature);
	1786	}
	1787
	1788	@Override
	1789	void print(PrintStream s) throws IOException {
	1790	s.println("*** CertificateVerify");
	1791
	1792	if (debug != null && Debug.isOn("verbose")) {
	1793	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1794	s.println("Signature Algorithm " +
	1795	preferableSignatureAlgorithm.getAlgorithmName());
	1796	}
	1797	}
	1798	}
	1799	}
	1800
	1801
	1802	/*
	1803	* FINISHED ... sent by both CLIENT and SERVER
	1804	*
	1805	* This is the FINISHED message as defined in the SSL and TLS protocols.
	1806	* Both protocols define this handshake message slightly differently.
	1807	* This class supports both formats.
	1808	*
	1809	* When handshaking is finished, each side sends a "change_cipher_spec"
	1810	* record, then immediately sends a "finished" handshake message prepared
	1811	* according to the newly adopted cipher spec.
	1812	*
	1813	* NOTE that until this is sent, no application data may be passed, unless
	1814	* some non-default cipher suite has already been set up on this connection
	1815	* connection (e.g. a previous handshake arranged one).
	1816	*/
	1817	static final class Finished extends HandshakeMessage {
	1818
	1819	// constant for a Finished message sent by the client
	1820	final static int CLIENT = 1;
	1821
	1822	// constant for a Finished message sent by the server
	1823	final static int SERVER = 2;
	1824
	1825	// enum Sender: "CLNT" and "SRVR"
	1826	private static final byte[] SSL_CLIENT = { 0x43, 0x4C, 0x4E, 0x54 };
	1827	private static final byte[] SSL_SERVER = { 0x53, 0x52, 0x56, 0x52 };
	1828
	1829	/*
	1830	* Contents of the finished message ("checksum"). For TLS, it
	1831	* is 12 bytes long, for SSLv3 36 bytes.
	1832	*/
	1833	private byte[] verifyData;
	1834
	1835	/*
	1836	* Current cipher suite we are negotiating. TLS 1.2 has
	1837	* ciphersuite-defined PRF algorithms.
	1838	*/
	1839	private ProtocolVersion protocolVersion;
	1840	private CipherSuite cipherSuite;
	1841
	1842	/*
	1843	* Create a finished message to send to the remote peer.
	1844	*/
	1845	Finished(ProtocolVersion protocolVersion, HandshakeHash handshakeHash,
	1846	int sender, SecretKey master, CipherSuite cipherSuite) {
	1847	this.protocolVersion = protocolVersion;
	1848	this.cipherSuite = cipherSuite;
	1849	verifyData = getFinished(handshakeHash, sender, master);
	1850	}
	1851
	1852	/*
	1853	* Constructor that reads FINISHED message from stream.
	1854	*/
	1855	Finished(ProtocolVersion protocolVersion, HandshakeInStream input,
	1856	CipherSuite cipherSuite) throws IOException {
	1857	this.protocolVersion = protocolVersion;
	1858	this.cipherSuite = cipherSuite;
	1859	int msgLen = (protocolVersion.v >= ProtocolVersion.TLS10.v) ? 12 : 36;
	1860	verifyData = new byte[msgLen];
	1861	input.read(verifyData);
	1862	}
	1863
	1864	/*
	1865	* Verify that the hashes here are what would have been produced
	1866	* according to a given set of inputs. This is used to ensure that
	1867	* both client and server are fully in sync, and that the handshake
	1868	* computations have been successful.
	1869	*/
	1870	boolean verify(HandshakeHash handshakeHash, int sender, SecretKey master) {
	1871	byte[] myFinished = getFinished(handshakeHash, sender, master);
	1872	return Arrays.equals(myFinished, verifyData);
	1873	}
	1874
	1875	/*
	1876	* Perform the actual finished message calculation.
	1877	*/
	1878	private byte[] getFinished(HandshakeHash handshakeHash,
	1879	int sender, SecretKey masterKey) {
	1880	byte[] sslLabel;
	1881	String tlsLabel;
	1882	if (sender == CLIENT) {
	1883	sslLabel = SSL_CLIENT;
	1884	tlsLabel = "client finished";
	1885	} else if (sender == SERVER) {
	1886	sslLabel = SSL_SERVER;
	1887	tlsLabel = "server finished";
	1888	} else {
	1889	throw new RuntimeException("Invalid sender: " + sender);
	1890	}
	1891
	1892	if (protocolVersion.v >= ProtocolVersion.TLS10.v) {
	1893	// TLS 1.0+
	1894	try {
	1895	byte [] seed;
	1896	String prfAlg;
	1897	PRF prf;
	1898
	1899	// Get the KeyGenerator alg and calculate the seed.
	1900	if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
	1901	// TLS 1.2
	1902	seed = handshakeHash.getFinishedHash();
	1903
	1904	prfAlg = "SunTls12Prf";
	1905	prf = cipherSuite.prfAlg;
	1906	} else {
	1907	// TLS 1.0/1.1
	1908	MessageDigest md5Clone = handshakeHash.getMD5Clone();
	1909	MessageDigest shaClone = handshakeHash.getSHAClone();
	1910	seed = new byte[36];
	1911	md5Clone.digest(seed, 0, 16);
	1912	shaClone.digest(seed, 16, 20);
	1913
	1914	prfAlg = "SunTlsPrf";
	1915	prf = P_NONE;
	1916	}
	1917
	1918	String prfHashAlg = prf.getPRFHashAlg();
	1919	int prfHashLength = prf.getPRFHashLength();
	1920	int prfBlockSize = prf.getPRFBlockSize();
	1921
	1922	/*
	1923	* RFC 5246/7.4.9 says that finished messages can
	1924	* be ciphersuite-specific in both length/PRF hash
	1925	* algorithm. If we ever run across a different
	1926	* length, this call will need to be updated.
	1927	*/
	1928	TlsPrfParameterSpec spec = new TlsPrfParameterSpec(
	1929	masterKey, tlsLabel, seed, 12,
	1930	prfHashAlg, prfHashLength, prfBlockSize);
	1931
	1932	KeyGenerator kg = JsseJce.getKeyGenerator(prfAlg);
	1933	kg.init(spec);
	1934	SecretKey prfKey = kg.generateKey();
	1935	if ("RAW".equals(prfKey.getFormat()) == false) {
	1936	throw new ProviderException(
	1937	"Invalid PRF output, format must be RAW");
	1938	}
	1939	byte[] finished = prfKey.getEncoded();
	1940	return finished;
	1941	} catch (GeneralSecurityException e) {
	1942	throw new RuntimeException("PRF failed", e);
	1943	}
	1944	} else {
	1945	// SSLv3
	1946	MessageDigest md5Clone = handshakeHash.getMD5Clone();
	1947	MessageDigest shaClone = handshakeHash.getSHAClone();
	1948	updateDigest(md5Clone, sslLabel, MD5_pad1, MD5_pad2, masterKey);
	1949	updateDigest(shaClone, sslLabel, SHA_pad1, SHA_pad2, masterKey);
	1950	byte[] finished = new byte[36];
	1951	try {
	1952	md5Clone.digest(finished, 0, 16);
	1953	shaClone.digest(finished, 16, 20);
	1954	} catch (DigestException e) {
	1955	// cannot occur
	1956	throw new RuntimeException("Digest failed", e);
	1957	}
	1958	return finished;
	1959	}
	1960	}
	1961
	1962	/*
	1963	* Update the MessageDigest for SSLv3 finished message calculation.
	1964	* The digest must already have been updated with all preceding handshake
	1965	* messages. This operation is almost identical to the certificate verify
	1966	* hash, reuse that code.
	1967	*/
	1968	private static void updateDigest(MessageDigest md, byte[] sender,
	1969	byte[] pad1, byte[] pad2, SecretKey masterSecret) {
	1970	md.update(sender);
	1971	CertificateVerify.updateDigest(md, pad1, pad2, masterSecret);
	1972	}
	1973
	1974	// get the verify_data of the finished message
	1975	byte[] getVerifyData() {
	1976	return verifyData;
	1977	}
	1978
	1979	@Override
	1980	int messageType() { return ht_finished; }
	1981
	1982	@Override
	1983	int messageLength() {
	1984	return verifyData.length;
	1985	}
	1986
	1987	@Override
	1988	void send(HandshakeOutStream out) throws IOException {
	1989	out.write(verifyData);
	1990	}
	1991
	1992	@Override
	1993	void print(PrintStream s) throws IOException {
	1994	s.println("*** Finished");
	1995	if (debug != null && Debug.isOn("verbose")) {
	1996	Debug.println(s, "verify_data", verifyData);
	1997	s.println("***");
	1998	}
	1999	}
	2000	}
	2001
	2002	//
	2003	// END of nested classes
	2004	//
	2005
	2006	}