Examples with HandshakeState sun.security.ssl.HandshakeStateManager.HandshakeState used on opensource projects

Example 1 with HandshakeState

use of sun.security.ssl.HandshakeStateManager.HandshakeState in project Bytecoder by mirkosertic.

the class HandshakeStateManager method check.

List<Byte> check(byte handshakeType) throws SSLProtocolException {
    List<Byte> ignoredOptional = new LinkedList<>();
    String exceptionMsg = "Handshake message sequence violation, " + handshakeType;
    if (debugIsOn) {
        System.out.println("check handshake state: " + toString(handshakeType));
    }
    if (upcomingStates.isEmpty()) {
        // Is it a kickstart message?
        if ((handshakeType != HandshakeMessage.ht_hello_request) && (handshakeType != HandshakeMessage.ht_client_hello)) {
            throw new SSLProtocolException("Handshake message sequence violation, " + handshakeType);
        }
        // It is a kickstart message.
        return Collections.emptyList();
    }
    // may be sent by the server at any time.
    if (handshakeType == HandshakeMessage.ht_hello_request) {
        return Collections.emptyList();
    }
    for (HandshakeState handshakeState : upcomingStates) {
        if (handshakeState.handshakeType == handshakeType) {
            // It's the expected next handshake type.
            return ignoredOptional;
        }
        if (handshakeState.isOptional) {
            ignoredOptional.add(handshakeState.handshakeType);
            continue;
        } else {
            for (HandshakeState alternative : alternatives) {
                if (alternative.handshakeType == handshakeType) {
                    return ignoredOptional;
                }
                if (alternative.isOptional) {
                    continue;
                } else {
                    throw new SSLProtocolException(exceptionMsg);
                }
            }
        }
        throw new SSLProtocolException(exceptionMsg);
    }
    // Not an expected Handshake message.
    throw new SSLProtocolException("Handshake message sequence violation, " + handshakeType);
}

Example 2 with HandshakeState

use of sun.security.ssl.HandshakeStateManager.HandshakeState in project Bytecoder by mirkosertic.

the class HandshakeStateManager method changeCipherSpec.

void changeCipherSpec(boolean isInput, boolean isClient) throws SSLProtocolException {
    if (debugIsOn) {
        System.out.println("update handshake state: change_cipher_spec");
    }
    String exceptionMsg = "ChangeCipherSpec message sequence violation";
    HandshakeState expectedState;
    if ((isClient && isInput) || (!isClient && !isInput)) {
        expectedState = HS_SERVER_CHANGE_CIPHER_SPEC;
    } else {
        expectedState = HS_CLIENT_CHANGE_CIPHER_SPEC;
    }
    boolean hasPresentState = false;
    // Check and update the present state.
    while (!upcomingStates.isEmpty()) {
        HandshakeState handshakeState = upcomingStates.pop();
        if (handshakeState == expectedState) {
            hasPresentState = true;
            break;
        } else if (!handshakeState.isOptional) {
            throw new SSLProtocolException(exceptionMsg);
        }
    // Otherwise, looking for next state track.
    }
    // No present state.
    if (!hasPresentState) {
        throw new SSLProtocolException(exceptionMsg);
    }
    if (debugIsOn) {
        for (HandshakeState handshakeState : upcomingStates) {
            System.out.println("upcoming handshake states: " + handshakeState);
        }
        for (HandshakeState handshakeState : alternatives) {
            System.out.println("upcoming handshake alternative state: " + handshakeState);
        }
    }
}

Example 3 with HandshakeState

use of sun.security.ssl.HandshakeStateManager.HandshakeState in project Bytecoder by mirkosertic.

the class HandshakeStateManager method update.

void update(HandshakeMessage handshakeMessage, boolean isAbbreviated) throws SSLProtocolException {
    byte handshakeType = (byte) handshakeMessage.messageType();
    String exceptionMsg = "Handshake message sequence violation, " + handshakeType;
    if (debugIsOn) {
        System.out.println("update handshake state: " + toString(handshakeType));
    }
    boolean hasPresentState = false;
    switch(handshakeType) {
        case HandshakeMessage.ht_hello_request:
            // Add the upcoming states.
            if (!upcomingStates.isEmpty()) {
                // A ClientHello message should be followed.
                upcomingStates.add(HS_CLIENT_HELLO);
            }
            break;
        case HandshakeMessage.ht_client_hello:
            // Check and update the present state.
            if (!upcomingStates.isEmpty()) {
                // The current state should be HS_CLIENT_HELLO.
                HandshakeState handshakeState = upcomingStates.pop();
                if (handshakeState != HS_CLIENT_HELLO) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            }
            // Add the upcoming states.
            ClientHello clientHello = (ClientHello) handshakeMessage;
            if (isDTLS) {
                // Is it an initial ClientHello message?
                if (clientHello.cookie == null || clientHello.cookie.length == 0) {
                    // Is it an abbreviated handshake?
                    if (clientHello.sessionId.length() != 0) {
                        // A HelloVerifyRequest message or a ServerHello
                        // message may follow the abbreviated session
                        // resuming handshake request.
                        upcomingStates.add(HS_HELLO_VERIFY_REQUEST);
                        alternatives.add(HS_SERVER_HELLO);
                    } else {
                        // A HelloVerifyRequest message should follow
                        // the initial ClientHello message.
                        upcomingStates.add(HS_HELLO_VERIFY_REQUEST);
                    }
                } else {
                    // A HelloVerifyRequest may be followed if the cookie
                    // cannot be verified.
                    upcomingStates.add(HS_SERVER_HELLO);
                    alternatives.add(HS_HELLO_VERIFY_REQUEST);
                }
            } else {
                upcomingStates.add(HS_SERVER_HELLO);
            }
            break;
        case HandshakeMessage.ht_hello_verify_request:
            // Check and update the present state.
            if (!upcomingStates.isEmpty()) {
                // The current state should be HS_HELLO_VERIFY_REQUEST.
                HandshakeState handshakeState = upcomingStates.pop();
                HandshakeState alternative = null;
                if (!alternatives.isEmpty()) {
                    alternative = alternatives.pop();
                }
                if ((handshakeState != HS_HELLO_VERIFY_REQUEST) && (alternative != HS_HELLO_VERIFY_REQUEST)) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            } else {
                // No present state.
                throw new SSLProtocolException(exceptionMsg);
            }
            // Add the upcoming states.
            upcomingStates.add(HS_CLIENT_HELLO);
            break;
        case HandshakeMessage.ht_server_hello:
            // Check and update the present state.
            if (!upcomingStates.isEmpty()) {
                // The current state should be HS_SERVER_HELLO
                HandshakeState handshakeState = upcomingStates.pop();
                HandshakeState alternative = null;
                if (!alternatives.isEmpty()) {
                    alternative = alternatives.pop();
                }
                if ((handshakeState != HS_SERVER_HELLO) && (alternative != HS_SERVER_HELLO)) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            } else {
                // No present state.
                throw new SSLProtocolException(exceptionMsg);
            }
            // Add the upcoming states.
            ServerHello serverHello = (ServerHello) handshakeMessage;
            HelloExtensions hes = serverHello.extensions;
            if (isAbbreviated) {
                // Not support SessionTicket extension yet.
                // 
                // // Mandatory NewSessionTicket message
                // if (hasSessionTicketExt) {
                // upcomingStates.add(HS_NEW_SESSION_TICKET);
                // }
                // Mandatory server ChangeCipherSpec and Finished messages
                upcomingStates.add(HS_SERVER_CHANGE_CIPHER_SPEC);
                upcomingStates.add(HS_SERVER_FINISHED);
                // Mandatory client ChangeCipherSpec and Finished messages
                upcomingStates.add(HS_CLIENT_CHANGE_CIPHER_SPEC);
                upcomingStates.add(HS_CLEINT_FINISHED);
            } else {
                // Not support SupplementalData extension yet.
                // 
                // boolean hasSupplementalDataExt =
                // (hes.get(HandshakeMessage.ht_supplemental_data) != null);
                // Not support CertificateURL extension yet.
                // 
                // boolean hasCertificateUrlExt =
                // (hes.get(ExtensionType EXT_CLIENT_CERTIFICATE_URL)
                // != null);
                // Not support SupplementalData extension yet.
                // 
                // // Optional SupplementalData message
                // if (hasSupplementalDataExt) {
                // upcomingStates.add(HS_SERVER_SUPPLEMENTAL_DATA);
                // }
                // Need server Certificate message or not?
                KeyExchange keyExchange = serverHello.cipherSuite.keyExchange;
                if ((keyExchange != K_KRB5) && (keyExchange != K_KRB5_EXPORT) && (keyExchange != K_DH_ANON) && (keyExchange != K_ECDH_ANON)) {
                    // Mandatory Certificate message
                    upcomingStates.add(HS_SERVER_CERTIFICATE);
                }
                // Optional CertificateStatus message
                if (hes.get(ExtensionType.EXT_STATUS_REQUEST) != null || hes.get(ExtensionType.EXT_STATUS_REQUEST_V2) != null) {
                    upcomingStates.add(HS_CERTIFICATE_STATUS);
                }
                // Need ServerKeyExchange message or not?
                if ((keyExchange == K_RSA_EXPORT) || (keyExchange == K_DHE_RSA) || (keyExchange == K_DHE_DSS) || (keyExchange == K_DH_ANON) || (keyExchange == K_ECDHE_RSA) || (keyExchange == K_ECDHE_ECDSA) || (keyExchange == K_ECDH_ANON)) {
                    // Optional ServerKeyExchange message
                    upcomingStates.add(HS_SERVER_KEY_EXCHANGE);
                }
                // Optional CertificateRequest message
                upcomingStates.add(HS_CERTIFICATE_REQUEST);
                // Mandatory ServerHelloDone message
                upcomingStates.add(HS_SERVER_HELLO_DONE);
                // Not support SupplementalData extension yet.
                // 
                // // Optional SupplementalData message
                // if (hasSupplementalDataExt) {
                // upcomingStates.add(HS_CLIENT_SUPPLEMENTAL_DATA);
                // }
                // Optional client Certificate message
                upcomingStates.add(HS_CLIENT_CERTIFICATE);
                // Not support CertificateURL extension yet.
                // 
                // // Alternative CertificateURL message, optional too.
                // //
                // // Please put CertificateURL rather than Certificate
                // // message in the alternatives list.  So that we can
                // // simplify the process of this alternative pair later.
                // if (hasCertificateUrlExt) {
                // alternatives.add(HS_CERTIFICATE_URL);
                // }
                // Mandatory ClientKeyExchange message
                upcomingStates.add(HS_CLIENT_KEY_EXCHANGE);
                // Optional CertificateVerify message
                upcomingStates.add(HS_CERTIFICATE_VERIFY);
                // Mandatory client ChangeCipherSpec and Finished messages
                upcomingStates.add(HS_CLIENT_CHANGE_CIPHER_SPEC);
                upcomingStates.add(HS_CLEINT_FINISHED);
                // Not support SessionTicket extension yet.
                // 
                // // Mandatory NewSessionTicket message
                // if (hasSessionTicketExt) {
                // upcomingStates.add(HS_NEW_SESSION_TICKET);
                // }
                // Mandatory server ChangeCipherSpec and Finished messages
                upcomingStates.add(HS_SERVER_CHANGE_CIPHER_SPEC);
                upcomingStates.add(HS_SERVER_FINISHED);
            }
            break;
        case HandshakeMessage.ht_certificate:
            // Check and update the present state.
            while (!upcomingStates.isEmpty()) {
                HandshakeState handshakeState = upcomingStates.pop();
                if (handshakeState.handshakeType == handshakeType) {
                    hasPresentState = true;
                    // the alternative list.
                    if ((handshakeState != HS_CLIENT_CERTIFICATE) && (handshakeState != HS_SERVER_CERTIFICATE)) {
                        throw new SSLProtocolException(exceptionMsg);
                    }
                    // Is it an expected client Certificate message?
                    boolean isClientMessage = false;
                    if (!upcomingStates.isEmpty()) {
                        // If the next expected message is ClientKeyExchange,
                        // this one should be an expected client Certificate
                        // message.
                        HandshakeState nextState = upcomingStates.getFirst();
                        if (nextState == HS_CLIENT_KEY_EXCHANGE) {
                            isClientMessage = true;
                        }
                    }
                    if (isClientMessage) {
                        if (handshakeState != HS_CLIENT_CERTIFICATE) {
                            throw new SSLProtocolException(exceptionMsg);
                        }
                    // Not support CertificateURL extension yet.
                    /**
                     *****************************************
                     *                        // clear up the alternatives list
                     *                        if (!alternatives.isEmpty()) {
                     *                            HandshakeState alternative = alternatives.pop();
                     *
                     *                            if (alternative != HS_CERTIFICATE_URL) {
                     *                                throw new SSLProtocolException(exceptionMsg);
                     *                            }
                     *                        }
                     *******************************************
                     */
                    } else {
                        if ((handshakeState != HS_SERVER_CERTIFICATE)) {
                            throw new SSLProtocolException(exceptionMsg);
                        }
                    }
                    break;
                } else if (!handshakeState.isOptional) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            // Otherwise, looking for next state track.
            }
            // No present state.
            if (!hasPresentState) {
                throw new SSLProtocolException(exceptionMsg);
            }
            break;
        /**
         **********************************************
         */
        case HandshakeMessage.ht_certificate_url:
            // Check and update the present state.
            while (!upcomingStates.isEmpty()) {
                // The current state should be HS_CLIENT_CERTIFICATE.
                // 
                // Note that we won't put HS_CLIENT_CERTIFICATE into
                // the alternative list.
                HandshakeState handshakeState = upcomingStates.pop();
                if (handshakeState.handshakeType == HS_CLIENT_CERTIFICATE.handshakeType) {
                    hasPresentState = true;
                    // Look for HS_CERTIFICATE_URL state track.
                    if (!alternatives.isEmpty()) {
                        HandshakeState alternative = alternatives.pop();
                        if (alternative != HS_CERTIFICATE_URL) {
                            throw new SSLProtocolException(exceptionMsg);
                        }
                    } else {
                        // No alternative CertificateUR state track.
                        throw new SSLProtocolException(exceptionMsg);
                    }
                    if ((handshakeState != HS_CLIENT_CERTIFICATE)) {
                        throw new SSLProtocolException(exceptionMsg);
                    }
                    break;
                } else if (!handshakeState.isOptional) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            // Otherwise, looking for next state track.
            }
            // No present state.
            if (!hasPresentState) {
                // No present state.
                throw new SSLProtocolException(exceptionMsg);
            }
            break;
        default:
            // Check and update the present state.
            while (!upcomingStates.isEmpty()) {
                HandshakeState handshakeState = upcomingStates.pop();
                if (handshakeState.handshakeType == handshakeType) {
                    hasPresentState = true;
                    break;
                } else if (!handshakeState.isOptional) {
                    throw new SSLProtocolException(exceptionMsg);
                }
            // Otherwise, looking for next state track.
            }
            // No present state.
            if (!hasPresentState) {
                throw new SSLProtocolException(exceptionMsg);
            }
    }
    if (debugIsOn) {
        for (HandshakeState handshakeState : upcomingStates) {
            System.out.println("upcoming handshake states: " + handshakeState);
        }
        for (HandshakeState handshakeState : alternatives) {
            System.out.println("upcoming handshake alternative state: " + handshakeState);
        }
    }
}