/*
 * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package sun.security.ssl;

import java.io.IOException;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Arrays;
import static sun.security.ssl.ClientHello.ClientHelloMessage;

TLS handshake cookie manager
/** * TLS handshake cookie manager */
abstract class HelloCookieManager { static class Builder { final SecureRandom secureRandom; private volatile T13HelloCookieManager t13HelloCookieManager; Builder(SecureRandom secureRandom) { this.secureRandom = secureRandom; } HelloCookieManager valueOf(ProtocolVersion protocolVersion) { if (protocolVersion.useTLS13PlusSpec()) { if (t13HelloCookieManager != null) { return t13HelloCookieManager; } synchronized (this) { if (t13HelloCookieManager == null) { t13HelloCookieManager = new T13HelloCookieManager(secureRandom); } } return t13HelloCookieManager; } return null; } } abstract byte[] createCookie(ServerHandshakeContext context, ClientHelloMessage clientHello) throws IOException; abstract boolean isCookieValid(ServerHandshakeContext context, ClientHelloMessage clientHello, byte[] cookie) throws IOException; private static final class T13HelloCookieManager extends HelloCookieManager { final SecureRandom secureRandom; private int cookieVersion; // version + sequence private final byte[] cookieSecret; private final byte[] legacySecret; T13HelloCookieManager(SecureRandom secureRandom) { this.secureRandom = secureRandom; this.cookieVersion = secureRandom.nextInt(); this.cookieSecret = new byte[64]; this.legacySecret = new byte[64]; secureRandom.nextBytes(cookieSecret); System.arraycopy(cookieSecret, 0, legacySecret, 0, 64); } @Override byte[] createCookie(ServerHandshakeContext context, ClientHelloMessage clientHello) throws IOException { int version; byte[] secret; synchronized (this) { version = cookieVersion; secret = cookieSecret; // the cookie secret usage limit is 2^24 if ((cookieVersion & 0xFFFFFF) == 0) { // reset the secret System.arraycopy(cookieSecret, 0, legacySecret, 0, 64); secureRandom.nextBytes(cookieSecret); } cookieVersion++; // allow wrapped version number } MessageDigest md = JsseJce.getMessageDigest( context.negotiatedCipherSuite.hashAlg.name); byte[] headerBytes = clientHello.getHeaderBytes(); md.update(headerBytes); byte[] headerCookie = md.digest(secret); // hash of ClientHello handshake message context.handshakeHash.update(); byte[] clientHelloHash = context.handshakeHash.digest(); // version and cipher suite // // Store the negotiated cipher suite in the cookie as well. // cookie[0]/[1]: cipher suite // cookie[2]: cookie version // + (hash length): Mac(ClientHello header) // + (hash length): Hash(ClientHello) byte[] prefix = new byte[] { (byte)((context.negotiatedCipherSuite.id >> 8) & 0xFF), (byte)(context.negotiatedCipherSuite.id & 0xFF), (byte)((version >> 24) & 0xFF) }; byte[] cookie = Arrays.copyOf(prefix, prefix.length + headerCookie.length + clientHelloHash.length); System.arraycopy(headerCookie, 0, cookie, prefix.length, headerCookie.length); System.arraycopy(clientHelloHash, 0, cookie, prefix.length + headerCookie.length, clientHelloHash.length); return cookie; } @Override boolean isCookieValid(ServerHandshakeContext context, ClientHelloMessage clientHello, byte[] cookie) throws IOException { // no cookie exchange or not a valid cookie length if ((cookie == null) || (cookie.length <= 32)) { // 32: roughly return false; } int csId = ((cookie[0] & 0xFF) << 8) | (cookie[1] & 0xFF); CipherSuite cs = CipherSuite.valueOf(csId); if (cs == null || cs.hashAlg == null || cs.hashAlg.hashLength == 0) { return false; } int hashLen = cs.hashAlg.hashLength; if (cookie.length != (3 + hashLen * 2)) { return false; } byte[] prevHeadCookie = Arrays.copyOfRange(cookie, 3, 3 + hashLen); byte[] prevClientHelloHash = Arrays.copyOfRange(cookie, 3 + hashLen, cookie.length); byte[] secret; synchronized (this) { if ((byte)((cookieVersion >> 24) & 0xFF) == cookie[2]) { secret = cookieSecret; } else { secret = legacySecret; // including out of window cookies } } MessageDigest md = JsseJce.getMessageDigest(cs.hashAlg.name); byte[] headerBytes = clientHello.getHeaderBytes(); md.update(headerBytes); byte[] headerCookie = md.digest(secret); if (!Arrays.equals(headerCookie, prevHeadCookie)) { return false; } // Use the ClientHello hash in the cookie for transtript // hash calculation for stateless HelloRetryRequest. // // Transcript-Hash(ClientHello1, HelloRetryRequest, ... Mn) = // Hash(message_hash || /* Handshake type */ // 00 00 Hash.length || /* Handshake message length (bytes) */ // Hash(ClientHello1) || /* Hash of ClientHello1 */ // HelloRetryRequest || ... || Mn) // Reproduce HelloRetryRequest handshake message byte[] hrrMessage = ServerHello.hrrReproducer.produce(context, clientHello); context.handshakeHash.push(hrrMessage); // Construct the 1st ClientHello message for transcript hash byte[] hashedClientHello = new byte[4 + hashLen]; hashedClientHello[0] = SSLHandshake.MESSAGE_HASH.id; hashedClientHello[1] = (byte)0x00; hashedClientHello[2] = (byte)0x00; hashedClientHello[3] = (byte)(hashLen & 0xFF); System.arraycopy(prevClientHelloHash, 0, hashedClientHello, 4, hashLen); context.handshakeHash.push(hashedClientHello); return true; } } }