new GnuDHPublicKey(null, servParams.getParams().getP(),
servParams.getParams().getG(), serv_y);
Signature s = null;
if (suite.getSignature() != "anon")
{
ISignature sig = null;
if (suite.getSignature() == "RSA")
{
sig = new SSLRSASignature();
}
else
{
sig = SignatureFactory.getInstance(Registry.DSS_SIG);
}
sig.setupSign(Collections.singletonMap(ISignature.SIGNER_KEY,
signPair.getPrivate()));
byte[] buf = clientRandom.getEncoded();
sig.update(buf, 0, buf.length);
buf = serverRandom.getEncoded();
sig.update(buf, 0, buf.length);
updateSig(sig, pubkey.getParams().getP());
updateSig(sig, pubkey.getParams().getG());
updateSig(sig, pubkey.getY());
s = new Signature(sig.sign(), suite.getSignature());
}
skex = new ServerKeyExchange(pubkey, s);
}
else if (suite.getKeyExchange() == "SRP")
{
BigInteger N = null;
BigInteger g = null;
BigInteger salt = null;
BigInteger B = null;
try
{
in = new IncomingMessage(out.toByteArray());
N = in.readMPI();
g = in.readMPI();
salt = in.readMPI();
B = in.readMPI();
}
catch (KeyAgreementException x)
{
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "SRP exception", x);
}
throwHandshakeFailure();
}
Signature s = null;
final byte[] srpSalt = Util.trim(salt);
if (suite.getSignature() != "anon")
{
ISignature sig = null;
if (suite.getSignature() == "RSA")
{
sig = new SSLRSASignature();
}
else
{
sig = SignatureFactory.getInstance(Registry.DSS_SIG);
}
sig.setupSign(Collections.singletonMap(ISignature.SIGNER_KEY,
signPair.getPrivate()));
byte[] buf = clientRandom.getEncoded();
sig.update(buf, 0, buf.length);
buf = serverRandom.getEncoded();
sig.update(buf, 0, buf.length);
updateSig(sig, N);
updateSig(sig, g);
sig.update((byte) srpSalt.length);
sig.update(srpSalt, 0, srpSalt.length);
updateSig(sig, B);
s = new Signature(sig.sign(), suite.getSignature());
}
final SRPPublicKey pubkey = new SRPPublicKey(N, g, B);
skex = new ServerKeyExchange(pubkey, s, srpSalt);
}
if (skex != null)
{
msg = new Handshake(Handshake.Type.SERVER_KEY_EXCHANGE, skex);
if (DEBUG_HANDSHAKE_LAYER)
logger.log (Component.SSL_HANDSHAKE, "{0}", msg);
msg.write(dout, version);
// recordOutput.setHandshakeAvail(msg.write(dout, version));;
dout.flush();
}
// If we are configured to want or need client authentication, then
// ask for it.
if (wantClientAuth || needClientAuth)
{
Principal[] auths = null;
CertificateRequest.ClientType[] types =
new CertificateRequest.ClientType[] {
CertificateRequest.ClientType.RSA_SIGN,
CertificateRequest.ClientType.DSS_SIGN,
CertificateRequest.ClientType.RSA_FIXED_DH,
CertificateRequest.ClientType.DSS_FIXED_DH
};
try
{
auths = (Principal[])
Util.transform(session.trustManager.getAcceptedIssuers(),
Principal.class, "getSubjectDN", null);
}
catch (Exception x)
{
internalError();
RuntimeException re = new RuntimeException (x.getMessage());
re.initCause (x);
throw re;
}
CertificateRequest req = new CertificateRequest(types, auths);
msg = new Handshake(Handshake.Type.CERTIFICATE_REQUEST, req);
msg.write(dout, version);
dout.flush();
}
// Send our server hello done.
msg = new Handshake(Handshake.Type.SERVER_HELLO_DONE, null);
if (DEBUG_HANDSHAKE_LAYER)
logger.log (Component.SSL_HANDSHAKE, "{0}", msg);
msg.write(dout, version);
dout.flush();
if (suite.getKeyExchange() == "RSA")
{
msg = Handshake.read(din, suite, kexPair.getPublic());
}
else
{
msg = Handshake.read(din, suite, null);
}
boolean clientCertOk = false;
boolean clientCanSign = false;
X509Certificate[] clientChain = null;
PublicKey clientKey = null;
// Read the client's certificate, if sent.
if (msg.getType() == Handshake.Type.CERTIFICATE)
{
if (DEBUG_HANDSHAKE_LAYER)
logger.log (Component.SSL_HANDSHAKE, "{0}", msg);
Certificate cliCert = (Certificate) msg.getBody();
clientChain = cliCert.getCertificates();
try
{
session.trustManager.checkClientTrusted(clientChain,
suite.getAuthType());
session.peerCerts = clientChain;
session.peerVerified = true;
clientKey = clientChain[0].getPublicKey();
}
catch (Exception x)
{
}
clientCanSign = ((clientKey instanceof DSAPublicKey) ||
(clientKey instanceof RSAPublicKey));
if (suite.getKeyExchange().startsWith("DH"))
{
msg = Handshake.read(din, suite, clientKey);
}
else
{
msg = Handshake.read(din, suite, kexPair.getPublic());
}
}
// If we require client authentication, and the client sent an
// unverifiable certificate or no certificate at all, drop the
// connection.
if (!session.peerVerified && needClientAuth)
{
throwHandshakeFailure();
}
// Read the client key exchange.
if (msg.getType() != Handshake.Type.CLIENT_KEY_EXCHANGE)
{
throwUnexpectedMessage();
}
if (DEBUG_HANDSHAKE_LAYER)
logger.log (Component.SSL_HANDSHAKE, "{0}", msg);
ClientKeyExchange ckex = (ClientKeyExchange) msg.getBody();
byte[] preMasterSecret = null;
if (suite.getKeyExchange() == "RSA")
{
byte[] enc = (byte[]) ckex.getExchangeObject();
BigInteger bi = new BigInteger(1, enc);
try
{
bi = RSA.decrypt(kexPair.getPrivate(), bi);
EME_PKCS1_V1_5 pkcs1 = EME_PKCS1_V1_5.getInstance(
(RSAPrivateKey) kexPair.getPrivate());
preMasterSecret = pkcs1.decode(Util.concat(new byte[1], bi.toByteArray()));
//rsa.init(kexPair);
//preMasterSecret = rsa.decrypt(enc);
}
catch (Exception x)
{
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "RSA exception", x);
}
// Generate a fake pre-master secret if the RSA decryption
// fails.
byte[] b = new byte[46];
session.random.nextBytes (b);
preMasterSecret = Util.concat(version.getEncoded(), b);
}
}
else if (suite.getKeyExchange().startsWith("DH"))
{
try
{
out = new OutgoingMessage();
if (clientKey == null)
out.writeMPI((BigInteger) ckex.getExchangeObject());
else
out.writeMPI(((DHPublicKey) clientKey).getY());
in = new IncomingMessage(out.toByteArray());
serverKA.processMessage(in);
preMasterSecret = serverKA.getSharedSecret();
}
catch (KeyAgreementException kae)
{
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "DH exception", kae);
}
internalError();
RuntimeException re = new RuntimeException (kae.getMessage());
re.initCause (kae);
throw re;
}
}
else if (suite.getKeyExchange() == "SRP")
{
BigInteger A = (BigInteger) ckex.getExchangeObject();
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "SRP: client A: {0}", A);
}
try
{
out = new OutgoingMessage();
out.writeMPI(A);
in = new IncomingMessage(out.toByteArray());
out = serverKA.processMessage(in);
preMasterSecret = serverKA.getSharedSecret();
}
catch (KeyAgreementException x)
{
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "SRP exception", x);
}
throwHandshakeFailure();
}
finally
{
serverKA = null;
}
}
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "preMasterSecret:\n{0}",
Util.toHexString(preMasterSecret, ':'));
logger.log (Component.SSL_KEY_EXCHANGE, "client.random:\n{0}",
Util.toHexString(clientRandom.getEncoded(), ':'));
logger.log (Component.SSL_KEY_EXCHANGE, "server.random:\n{0}",
Util.toHexString(serverRandom.getEncoded(), ':'));
}
// Generate the master secret.
IRandom genSecret = null;
if (version == ProtocolVersion.SSL_3)
{
genSecret = new SSLRandom();
HashMap attr = new HashMap();
attr.put(SSLRandom.SECRET, preMasterSecret);
attr.put(SSLRandom.SEED, Util.concat(clientRandom.getEncoded(),
serverRandom.getEncoded()));
genSecret.init(attr);
}
else
{
genSecret = new TLSRandom();
HashMap attr = new HashMap();
attr.put(TLSRandom.SECRET, preMasterSecret);
attr.put(TLSRandom.SEED,
Util.concat(("master secret").getBytes("UTF-8"),
Util.concat(clientRandom.getEncoded(),
serverRandom.getEncoded())));
genSecret.init(attr);
}
session.masterSecret = new byte[48];
try
{
genSecret.nextBytes(session.masterSecret, 0, 48);
for (int i = 0; i < preMasterSecret.length; i++)
{
preMasterSecret[i] = 0;
}
}
catch (LimitReachedException shouldNotHappen)
{
internalError();
RuntimeException re = new RuntimeException();
re.initCause (shouldNotHappen);
throw re;
}
if (DEBUG_KEY_EXCHANGE)
{
logger.log (Component.SSL_KEY_EXCHANGE, "masterSecret: {0}",
Util.toHexString(session.masterSecret, ':'));
}
// Read the client's certificate verify message, if needed.
if (clientCanSign && (wantClientAuth || needClientAuth))
{
msg = Handshake.read(din);
if (msg.getType() != Handshake.Type.CERTIFICATE_VERIFY)
{
throwUnexpectedMessage();
}
CertificateVerify verify = (CertificateVerify) msg.getBody();
if (clientChain != null && clientChain.length > 0)
{
IMessageDigest cvMD5 = (IMessageDigest) md5.clone();
IMessageDigest cvSHA = (IMessageDigest) sha.clone();
clientKey = clientChain[0].getPublicKey();
if (clientKey instanceof RSAPublicKey)
{
SSLRSASignature sig = new SSLRSASignature(cvMD5, cvSHA);
sig.setupVerify(Collections.singletonMap(ISignature.VERIFIER_KEY, clientKey));
if (!sig.verify(verify.getSigValue()))
{
handshakeFailure();
throw new SSLHandshakeException("client certificate verify failed");
}
}