/*
 * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */


package sun.security.ssl;

import java.io.*;
import java.nio.*;
import javax.net.ssl.*;
import javax.crypto.BadPaddingException;
import sun.misc.HexDumpEncoder;


Wrapper class around InputRecord. Application data is kept external to the InputRecord, but handshake data (alert/change_cipher_spec/handshake) will be kept internally in the ByteArrayInputStream.
Author:Brad Wetmore
/** * Wrapper class around InputRecord. * * Application data is kept external to the InputRecord, * but handshake data (alert/change_cipher_spec/handshake) will * be kept internally in the ByteArrayInputStream. * * @author Brad Wetmore */
final class EngineInputRecord extends InputRecord { private SSLEngineImpl engine; /* * A dummy ByteBuffer we'll pass back even when the data * is stored internally. It'll never actually be used. */ static private ByteBuffer tmpBB = ByteBuffer.allocate(0); /* * Flag to tell whether the last read/parsed data resides * internal in the ByteArrayInputStream, or in the external * buffers. */ private boolean internalData; EngineInputRecord(SSLEngineImpl engine) { super(); this.engine = engine; } byte contentType() { if (internalData) { return super.contentType(); } else { return ct_application_data; } } /* * Check if there is enough inbound data in the ByteBuffer * to make a inbound packet. Look for both SSLv2 and SSLv3. * * @return -1 if there are not enough bytes to tell (small header), */ int bytesInCompletePacket(ByteBuffer buf) throws SSLException { /* * SSLv2 length field is in bytes 0/1 * SSLv3/TLS length field is in bytes 3/4 */ if (buf.remaining() < 5) { return -1; } int pos = buf.position(); byte byteZero = buf.get(pos); int len = 0; /* * If we have already verified previous packets, we can * ignore the verifications steps, and jump right to the * determination. Otherwise, try one last hueristic to * see if it's SSL/TLS. */ if (formatVerified || (byteZero == ct_handshake) || (byteZero == ct_alert)) { /* * Last sanity check that it's not a wild record */ ProtocolVersion recordVersion = ProtocolVersion.valueOf(buf.get(pos + 1), buf.get(pos + 2)); // Check if too old (currently not possible) // or if the major version does not match. // The actual version negotiation is in the handshaker classes if ((recordVersion.v < ProtocolVersion.MIN.v) || (recordVersion.major > ProtocolVersion.MAX.major)) { throw new SSLException( "Unsupported record version " + recordVersion); } /* * Reasonably sure this is a V3, disable further checks. * We can't do the same in the v2 check below, because * read still needs to parse/handle the v2 clientHello. */ formatVerified = true; /* * One of the SSLv3/TLS message types. */ len = ((buf.get(pos + 3) & 0xff) << 8) + (buf.get(pos + 4) & 0xff) + headerSize; } else { /* * Must be SSLv2 or something unknown. * Check if it's short (2 bytes) or * long (3) header. * * Internals can warn about unsupported SSLv2 */ boolean isShort = ((byteZero & 0x80) != 0); if (isShort && ((buf.get(pos + 2) == 1) || buf.get(pos + 2) == 4)) { ProtocolVersion recordVersion = ProtocolVersion.valueOf(buf.get(pos + 3), buf.get(pos + 4)); // Check if too old (currently not possible) // or if the major version does not match. // The actual version negotiation is in the handshaker classes if ((recordVersion.v < ProtocolVersion.MIN.v) || (recordVersion.major > ProtocolVersion.MAX.major)) { // if it's not SSLv2, we're out of here. if (recordVersion.v != ProtocolVersion.SSL20Hello.v) { throw new SSLException( "Unsupported record version " + recordVersion); } } /* * Client or Server Hello */ int mask = (isShort ? 0x7f : 0x3f); len = ((byteZero & mask) << 8) + (buf.get(pos + 1) & 0xff) + (isShort ? 2 : 3); } else { // Gobblygook! throw new SSLException( "Unrecognized SSL message, plaintext connection?"); } } return len; } /* * Pass the data down if it's internally cached, otherwise * do it here. * * If internal data, data is decrypted internally. * * If external data(app), return a new ByteBuffer with data to * process. */ ByteBuffer decrypt(MAC signer, CipherBox box, ByteBuffer bb) throws BadPaddingException { if (internalData) { decrypt(signer, box); // MAC is checked during decryption return tmpBB; } BadPaddingException reservedBPE = null; int tagLen = signer.MAClen(); int cipheredLength = bb.remaining(); if (!box.isNullCipher()) { // sanity check length of the ciphertext if (!box.sanityCheck(tagLen, cipheredLength)) { throw new BadPaddingException( "ciphertext sanity check failed"); } try { // Note that the CipherBox.decrypt() does not change // the capacity of the buffer. box.decrypt(bb, tagLen); } catch (BadPaddingException bpe) { // RFC 2246 states that decryption_failed should be used // for this purpose. However, that allows certain attacks, // so we just send bad record MAC. We also need to make // sure to always check the MAC to avoid a timing attack // for the same issue. See paper by Vaudenay et al and the // update in RFC 4346/5246. // // Failover to message authentication code checking. reservedBPE = bpe; } finally { bb.rewind(); } } if (tagLen != 0) { int macOffset = bb.limit() - tagLen; // Note that although it is not necessary, we run the same MAC // computation and comparison on the payload for both stream // cipher and CBC block cipher. if (bb.remaining() < tagLen) { // negative data length, something is wrong if (reservedBPE == null) { reservedBPE = new BadPaddingException("bad record"); } // set offset of the dummy MAC macOffset = cipheredLength - tagLen; bb.limit(cipheredLength); } // Run MAC computation and comparison on the payload. if (checkMacTags(contentType(), bb, signer, false)) { if (reservedBPE == null) { reservedBPE = new BadPaddingException("bad record MAC"); } } // Run MAC computation and comparison on the remainder. // // It is only necessary for CBC block cipher. It is used to get a // constant time of MAC computation and comparison on each record. if (box.isCBCMode()) { int remainingLen = calculateRemainingLen( signer, cipheredLength, macOffset); // NOTE: here we use the InputRecord.buf because I did not find // an effective way to work on ByteBuffer when its capacity is // less than remainingLen. // NOTE: remainingLen may be bigger (less than 1 block of the // hash algorithm of the MAC) than the cipheredLength. However, // We won't need to worry about it because we always use a // maximum buffer for every record. We need a change here if // we use small buffer size in the future. if (remainingLen > buf.length) { // unlikely to happen, just a placehold throw new RuntimeException( "Internal buffer capacity error"); } // Won't need to worry about the result on the remainder. And // then we won't need to worry about what's actual data to // check MAC tag on. We start the check from the header of the // buffer so that we don't need to construct a new byte buffer. checkMacTags(contentType(), buf, 0, remainingLen, signer, true); } bb.limit(macOffset); } // Is it a failover? if (reservedBPE != null) { throw reservedBPE; } return bb.slice(); } /* * Run MAC computation and comparison * * Please DON'T change the content of the ByteBuffer parameter! */ private static boolean checkMacTags(byte contentType, ByteBuffer bb, MAC signer, boolean isSimulated) { int tagLen = signer.MAClen(); int lim = bb.limit(); int macData = lim - tagLen; bb.limit(macData); byte[] hash = signer.compute(contentType, bb, isSimulated); if (hash == null || tagLen != hash.length) { // Something is wrong with MAC implementation. throw new RuntimeException("Internal MAC error"); } bb.position(macData); bb.limit(lim); try { int[] results = compareMacTags(bb, hash); return (results[0] != 0); } finally { bb.rewind(); bb.limit(macData); } } /* * A constant-time comparison of the MAC tags. * * Please DON'T change the content of the ByteBuffer parameter! */ private static int[] compareMacTags(ByteBuffer bb, byte[] tag) { // An array of hits is used to prevent Hotspot optimization for // the purpose of a constant-time check. int[] results = {0, 0}; // {missed #, matched #} // The caller ensures there are enough bytes available in the buffer. // So we won't need to check the remaining of the buffer. for (int i = 0; i < tag.length; i++) { if (bb.get() != tag[i]) { results[0]++; // mismatched bytes } else { results[1]++; // matched bytes } } return results; } /* * Override the actual write below. We do things this way to be * consistent with InputRecord. InputRecord may try to write out * data to the peer, and *then* throw an Exception. This forces * data to be generated/output before the exception is ever * generated. */ void writeBuffer(OutputStream s, byte [] buf, int off, int len) throws IOException { /* * Copy data out of buffer, it's ready to go. */ ByteBuffer netBB = (ByteBuffer) (ByteBuffer.allocate(len).put(buf, 0, len).flip()); engine.writer.putOutboundDataSync(netBB); } /* * Delineate or read a complete packet from src. * * If internal data (hs, alert, ccs), the data is read and * stored internally. * * If external data (app), return a new ByteBuffer which points * to the data to process. */ ByteBuffer read(ByteBuffer srcBB) throws IOException { /* * Could have a src == null/dst == null check here, * but that was already checked by SSLEngine.unwrap before * ever attempting to read. */ /* * If we have anything besides application data, * or if we haven't even done the initial v2 verification, * we send this down to be processed by the underlying * internal cache. */ if (!formatVerified || (srcBB.get(srcBB.position()) != ct_application_data)) { internalData = true; read(new ByteBufferInputStream(srcBB), (OutputStream) null); return tmpBB; } internalData = false; int srcPos = srcBB.position(); int srcLim = srcBB.limit(); ProtocolVersion recordVersion = ProtocolVersion.valueOf( srcBB.get(srcPos + 1), srcBB.get(srcPos + 2)); // Check if too old (currently not possible) // or if the major version does not match. // The actual version negotiation is in the handshaker classes if ((recordVersion.v < ProtocolVersion.MIN.v) || (recordVersion.major > ProtocolVersion.MAX.major)) { throw new SSLException( "Unsupported record version " + recordVersion); } /* * It's really application data. How much to consume? * Jump over the header. */ int len = bytesInCompletePacket(srcBB); assert(len > 0); if (debug != null && Debug.isOn("packet")) { try { HexDumpEncoder hd = new HexDumpEncoder(); srcBB.limit(srcPos + len); ByteBuffer bb = srcBB.duplicate(); // Use copy of BB System.out.println("[Raw read (bb)]: length = " + len); hd.encodeBuffer(bb, System.out); } catch (IOException e) { } } // Demarcate past header to end of packet. srcBB.position(srcPos + headerSize); srcBB.limit(srcPos + len); // Protect remainder of buffer, create slice to actually // operate on. ByteBuffer bb = srcBB.slice(); srcBB.position(srcBB.limit()); srcBB.limit(srcLim); return bb; } }