1 /*
2 * Copyright (c) 2003, 2018, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26 package sun.security.ssl;
27
28 import java.io.IOException;
29 import java.nio.ByteBuffer;
30 import java.text.MessageFormat;
31 import java.util.Locale;
32 import javax.net.ssl.*;
33
34 /**
35 * SSL/(D)TLS Alter description
36 */
37 enum Alert {
38 // Please refer to TLS Alert Registry for the latest (D)TLS Alert values:
39 // https://www.iana.org/assignments/tls-parameters/
40 CLOSE_NOTIFY ((byte)0, "close_notify", false),
41 UNEXPECTED_MESSAGE ((byte)10, "unexpected_message", false),
42 BAD_RECORD_MAC ((byte)20, "bad_record_mac", false),
43 DECRYPTION_FAILED ((byte)21, "decryption_failed", false),
44 RECORD_OVERFLOW ((byte)22, "record_overflow", false),
45 DECOMPRESSION_FAILURE ((byte)30, "decompression_failure", false),
46 HANDSHAKE_FAILURE ((byte)40, "handshake_failure", true),
47 NO_CERTIFICATE ((byte)41, "no_certificate", true),
48 BAD_CERTIFICATE ((byte)42, "bad_certificate", true),
49 UNSUPPORTED_CERTIFCATE ((byte)43, "unsupported_certificate", true),
50 CERTIFICATE_REVOKED ((byte)44, "certificate_revoked", true),
51 CERTIFICATE_EXPIRED ((byte)45, "certificate_expired", true),
52 CERTIFICATE_UNKNOWN ((byte)46, "certificate_unknown", true),
53 ILLEGAL_PARAMETER ((byte)47, "illegal_parameter", true),
54 UNKNOWN_CA ((byte)48, "unknown_ca", true),
55 ACCESS_DENIED ((byte)49, "access_denied", true),
56 DECODE_ERROR ((byte)50, "decode_error", true),
57 DECRYPT_ERROR ((byte)51, "decrypt_error", true),
58 EXPORT_RESTRICTION ((byte)60, "export_restriction", true),
59 PROTOCOL_VERSION ((byte)70, "protocol_version", true),
60 INSUFFICIENT_SECURITY ((byte)71, "insufficient_security", true),
61 INTERNAL_ERROR ((byte)80, "internal_error", false),
62 INAPPROPRIATE_FALLBACK ((byte)86, "inappropriate_fallback", false),
63 USER_CANCELED ((byte)90, "user_canceled", false),
64 NO_RENEGOTIATION ((byte)100, "no_renegotiation", true),
65 MISSING_EXTENSION ((byte)109, "missing_extension", true),
66 UNSUPPORTED_EXTENSION ((byte)110, "unsupported_extension", true),
67 CERT_UNOBTAINABLE ((byte)111, "certificate_unobtainable", true),
68 UNRECOGNIZED_NAME ((byte)112, "unrecognized_name", true),
69 BAD_CERT_STATUS_RESPONSE((byte)113,
70 "bad_certificate_status_response", true),
71 BAD_CERT_HASH_VALUE ((byte)114, "bad_certificate_hash_value", true),
72 UNKNOWN_PSK_IDENTITY ((byte)115, "unknown_psk_identity", true),
73 CERTIFICATE_REQUIRED ((byte)116, "certificate_required", true),
74 NO_APPLICATION_PROTOCOL ((byte)120, "no_application_protocol", true);
75
76 // ordinal value of the Alert
77 final byte id;
78
79 // description of the Alert
80 final String description;
81
82 // Does tha alert happen during handshake only?
83 final boolean handshakeOnly;
84
85 // Alert message consumer
86 static final SSLConsumer alertConsumer = new AlertConsumer();
87
88 private Alert(byte id, String description, boolean handshakeOnly) {
89 this.id = id;
90 this.description = description;
91 this.handshakeOnly = handshakeOnly;
92 }
93
94 static Alert valueOf(byte id) {
95 for (Alert al : Alert.values()) {
96 if (al.id == id) {
97 return al;
98 }
99 }
100
101 return null;
102 }
103
104 static String nameOf(byte id) {
105 for (Alert al : Alert.values()) {
106 if (al.id == id) {
107 return al.description;
108 }
109 }
110
111 return "UNKNOWN ALERT (" + (id & 0x0FF) + ")";
112 }
113
114 SSLException createSSLException(String reason) {
115 return createSSLException(reason, null);
116 }
117
118 SSLException createSSLException(String reason, Throwable cause) {
119 if (reason == null) {
120 reason = (cause != null) ? cause.getMessage() : "";
121 }
122
123 SSLException ssle = handshakeOnly ?
124 new SSLHandshakeException(reason) : new SSLException(reason);
125 if (cause != null) {
126 ssle.initCause(cause);
127 }
128
129 return ssle;
130 }
131
132 /**
133 * SSL/(D)TLS Alert level.
134 */
135 enum Level {
136 WARNING ((byte)1, "warning"),
137 FATAL ((byte)2, "fatal");
138
139 // ordinal value of the Alert level
140 final byte level;
141
142 // description of the Alert level
143 final String description;
144
145 private Level(byte level, String description) {
146 this.level = level;
147 this.description = description;
148 }
149
150 static Level valueOf(byte level) {
151 for (Level lv : Level.values()) {
152 if (lv.level == level) {
153 return lv;
154 }
155 }
156
157 return null;
158 }
159
160 static String nameOf(byte level) {
161 for (Level lv : Level.values()) {
162 if (lv.level == level) {
163 return lv.description;
164 }
165 }
166
167 return "UNKNOWN ALERT LEVEL (" + (level & 0x0FF) + ")";
168 }
169 }
170
171 /**
172 * The Alert message.
173 */
174 private static final class AlertMessage {
175 private final byte level; // level
176 private final byte id; // description
177
178 AlertMessage(TransportContext context,
179 ByteBuffer m) throws IOException {
180 // struct {
181 // AlertLevel level;
182 // AlertDescription description;
183 // } Alert;
184 if (m.remaining() != 2) {
185 context.fatal(Alert.ILLEGAL_PARAMETER,
186 "Invalid Alert message: no sufficient data");
187 }
188
189 this.level = m.get(); // level
190 this.id = m.get(); // description
191 }
192
193 @Override
194 public String toString() {
195 MessageFormat messageFormat = new MessageFormat(
196 "\"Alert\": '{'\n" +
197 " \"level\" : \"{0}\",\n" +
198 " \"description\": \"{1}\"\n" +
199 "'}'",
200 Locale.ENGLISH);
201
202 Object[] messageFields = {
203 Level.nameOf(level),
204 Alert.nameOf(id)
205 };
206
207 return messageFormat.format(messageFields);
208 }
209 }
210
211 /**
212 * Consumer of alert messages
213 */
214 private static final class AlertConsumer implements SSLConsumer {
215 // Prevent instantiation of this class.
216 private AlertConsumer() {
217 // blank
218 }
219
220 @Override
221 public void consume(ConnectionContext context,
222 ByteBuffer m) throws IOException {
223 TransportContext tc = (TransportContext)context;
224
225 AlertMessage am = new AlertMessage(tc, m);
226 if (SSLLogger.isOn && SSLLogger.isOn("ssl")) {
227 SSLLogger.fine("Received alert message", am);
228 }
229
230 Level level = Level.valueOf(am.level);
231 Alert alert = Alert.valueOf(am.id);
232 if (alert == Alert.CLOSE_NOTIFY) {
233 if (tc.handshakeContext != null) {
234 tc.fatal(Alert.UNEXPECTED_MESSAGE,
235 "Received close_notify during handshake");
236 }
237
238 tc.isInputCloseNotified = true;
239 tc.closeInbound();
240 } else if ((level == Level.WARNING) && (alert != null)) {
241 // Terminate the connection if an alert with a level of warning
242 // is received during handshaking, except the no_certificate
243 // warning.
244 if (alert.handshakeOnly && (tc.handshakeContext != null)) {
245 // It's OK to get a no_certificate alert from a client of
246 // which we requested client authentication. However,
247 // if we required it, then this is not acceptable.
248 if (tc.sslConfig.isClientMode ||
249 alert != Alert.NO_CERTIFICATE ||
250 (tc.sslConfig.clientAuthType !=
251 ClientAuthType.CLIENT_AUTH_REQUESTED)) {
252 tc.fatal(Alert.HANDSHAKE_FAILURE,
253 "received handshake warning: " + alert.description);
254 } // Otherwise, ignore the warning
255 } // Otherwise, ignore the warning.
256 } else { // fatal or unknown
257 String diagnostic;
258 if (alert == null) {
259 alert = Alert.UNEXPECTED_MESSAGE;
260 diagnostic = "Unknown alert description (" + am.id + ")";
261 } else {
262 diagnostic = "Received fatal alert: " + alert.description;
263 }
264
265 tc.fatal(alert, diagnostic, true, null);
266 }
267 }
268 }
269 }