Java Code Examples for javax.net.ssl.SSLEngineResult.HandshakeStatus#NEED_WRAP

/**
 * Sends a SSL close message, will not physically close the connection here.<br>
 * To close the connection, you could do something like
 * <pre><code>
 *   close();
 *   while (isOpen() && !myTimeoutFunction()) Thread.sleep(25);
 *   if ( isOpen() ) close(true); //forces a close if you timed out
 * </code></pre>
 * @throws IOException if an I/O error occurs
 * @throws IOException if there is data on the outgoing network buffer and we are unable to flush it
 * TODO Implement this java.io.Closeable method
 */
@Override
public void close() throws IOException {
    if (closing) return;
    closing = true;
    sslEngine.closeOutbound();

    if (!flush(netOutBuffer)) {
        throw new IOException("Remaining data in the network buffer, can't send SSL close message, force a close with close(true) instead");
    }
    //prep the buffer for the close message
    netOutBuffer.clear();
    //perform the close, since we called sslEngine.closeOutbound
    SSLEngineResult handshake = sslEngine.wrap(getEmptyBuf(), netOutBuffer);
    //we should be in a close state
    if (handshake.getStatus() != SSLEngineResult.Status.CLOSED) {
        throw new IOException("Invalid close state, will not send network data.");
    }
    //prepare the buffer for writing
    netOutBuffer.flip();
    //if there is data to be written
    flush(netOutBuffer);

    //is the channel closed?
    closed = (!netOutBuffer.hasRemaining() && (handshake.getHandshakeStatus() != HandshakeStatus.NEED_WRAP));
}
 

/**
 * Sends a SSL close message, will not physically close the connection here.<br>
 * To close the connection, you could do something like
 * <pre><code>
 *   close();
 *   while (isOpen() && !myTimeoutFunction()) Thread.sleep(25);
 *   if ( isOpen() ) close(true); //forces a close if you timed out
 * </code></pre>
 * @throws IOException if an I/O error occurs
 * @throws IOException if there is data on the outgoing network buffer and we are unable to flush it
 * TODO Implement this java.io.Closeable method
 */
@Override
public void close() throws IOException {
    if (closing) return;
    closing = true;
    sslEngine.closeOutbound();

    if (!flush(netOutBuffer)) {
        throw new IOException("Remaining data in the network buffer, can't send SSL close message, force a close with close(true) instead");
    }
    //prep the buffer for the close message
    netOutBuffer.clear();
    //perform the close, since we called sslEngine.closeOutbound
    SSLEngineResult handshake = sslEngine.wrap(getEmptyBuf(), netOutBuffer);
    //we should be in a close state
    if (handshake.getStatus() != SSLEngineResult.Status.CLOSED) {
        throw new IOException("Invalid close state, will not send network data.");
    }
    //prepare the buffer for writing
    netOutBuffer.flip();
    //if there is data to be written
    flush(netOutBuffer);

    //is the channel closed?
    closed = (!netOutBuffer.hasRemaining() && (handshake.getHandshakeStatus() != HandshakeStatus.NEED_WRAP));
}
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

/**
 * Sends an SSL close message, will not physically close the connection here.
 * <br>To close the connection, you could do something like
 * <pre><code>
 *   close();
 *   while (isOpen() &amp;&amp; !myTimeoutFunction()) Thread.sleep(25);
 *   if ( isOpen() ) close(true); //forces a close if you timed out
 * </code></pre>
 * @throws IOException if an I/O error occurs
 * @throws IOException if there is data on the outgoing network buffer and
 *                     we are unable to flush it
 */
@Override
public void close() throws IOException {
    if (closing) {
        return;
    }
    closing = true;
    sslEngine.closeOutbound();

    if (!flush(netOutBuffer)) {
        throw new IOException(sm.getString("channel.nio.ssl.remainingDataDuringClose"));
    }
    //prep the buffer for the close message
    netOutBuffer.clear();
    //perform the close, since we called sslEngine.closeOutbound
    SSLEngineResult handshake = sslEngine.wrap(getEmptyBuf(), netOutBuffer);
    //we should be in a close state
    if (handshake.getStatus() != SSLEngineResult.Status.CLOSED) {
        throw new IOException(sm.getString("channel.nio.ssl.invalidCloseState"));
    }
    //prepare the buffer for writing
    netOutBuffer.flip();
    //if there is data to be written
    flush(netOutBuffer);

    //is the channel closed?
    closed = (!netOutBuffer.hasRemaining() && (handshake.getHandshakeStatus() != HandshakeStatus.NEED_WRAP));
}
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

WriteFuture writeNetBuffer(NextFilter nextFilter, boolean needFuture) throws Exception {
	// Check if any net data needed to be writen
	if (outNetBuffer == null || !outNetBuffer.hasRemaining())
		return null; // no; bail out

	// set flag that we are writing encrypted data (used in SSLFilter.filterWrite())
	writingEncryptedData = true;

	// write net data
	WriteFuture writeFuture = (needFuture ? new DefaultWriteFuture(session) : null);

	try {
		IoBuffer writeBuffer = fetchOutNetBuffer();
		sslFilter.filterWrite(nextFilter, session, writeFuture != null ? new DefaultWriteRequest(writeBuffer, writeFuture) : writeBuffer);

		// loop while more writes required to complete handshake
		while (handshakeStatus == HandshakeStatus.NEED_WRAP && !isInboundDone()) {
			try {
				handshake(nextFilter);
			} catch (SSLException ssle) {
				SSLException newSsle = new SSLHandshakeException("SSL handshake failed");
				newSsle.initCause(ssle);
				throw newSsle;
			}

			IoBuffer currentOutNetBuffer = fetchOutNetBuffer();
			if (currentOutNetBuffer != null && currentOutNetBuffer.hasRemaining()) {
				writeFuture = (needFuture ? new DefaultWriteFuture(session) : null);
				sslFilter.filterWrite(nextFilter, session, writeFuture != null ? new DefaultWriteRequest(currentOutNetBuffer, writeFuture) : currentOutNetBuffer);
			}
		}
	} finally {
		writingEncryptedData = false;
	}

	return writeFuture;
}
 

private static void wrapEagerly(final SqSSL ssl, final ByteBuffer target) throws SSLException {
    HandshakeStatus status = ssl.engine.getHandshakeStatus();
    while (status == HandshakeStatus.NEED_WRAP) {
        final SSLEngineResult result = wrap(ssl, EMPTY_BUFFER, target);
        checkStatus("Handshake wrap", result, Status.OK);
        runTasks(ssl);
        if (result.getHandshakeStatus() == HandshakeStatus.FINISHED) {
            handshakeCompleted(ssl);
        }
        status = ssl.engine.getHandshakeStatus();
    }
}
 

public synchronized boolean shutdown() throws IOException
{
    shutdown = true;

    if (!sslEngine.isOutboundDone())
    {
        sslEngine.closeOutbound();
    }

    // Try to "fire-and-forget" the closed notification (RFC2616).
    SSLEngineResult result;
    if (prepare(outputBuffer, minBufferSize))
    {
        result = sslEngine.wrap(emptyBuffer, outputBuffer[0]);
        if (result.getStatus() != Status.CLOSED)
        {
            throw new SSLException("Unexpected shutdown status '" + result.getStatus() + '\'');
        }
        outputBuffer[0].flip();
    }
    else
    {
        result = null;
    }
    flush(outputBuffer[0]);
    return !outputBuffer[0].hasRemaining() && (result != null)
        && (result.getHandshakeStatus() != HandshakeStatus.NEED_WRAP);
}
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

private HandshakeStatus getOutboundData(ByteBuffer dstBB) {

        Object msg = outboundList.removeFirst();
        assert(msg instanceof ByteBuffer);

        ByteBuffer bbIn = (ByteBuffer) msg;
        assert(dstBB.remaining() >= bbIn.remaining());

        dstBB.put(bbIn);

        /*
         * If we have more data in the queue, it's either
         * a finished message, or an indication that we need
         * to call wrap again.
         */
        if (hasOutboundDataInternal()) {
            msg = outboundList.getFirst();
            if (msg == HandshakeStatus.FINISHED) {
                outboundList.removeFirst();     // consume the message
                return HandshakeStatus.FINISHED;
            } else {
                return HandshakeStatus.NEED_WRAP;
            }
        } else {
            return null;
        }
    }
 

HandshakeStatus getHandshakeStatus() {
    if (!outputRecord.isEmpty()) {
        // If no handshaking, special case to wrap alters or
        // post-handshake messages.
        return HandshakeStatus.NEED_WRAP;
    } else if (isOutboundClosed() && isInboundClosed()) {
        return HandshakeStatus.NOT_HANDSHAKING;
    } else if (handshakeContext != null) {
        if (!handshakeContext.delegatedActions.isEmpty()) {
            return HandshakeStatus.NEED_TASK;
        } else if (!isInboundClosed()) {
              //JDK8 NEED_UNWRAP returnned for NEED_UNWRAP_AGAIN status
              // needUnwrapAgain should be used to determine NEED_UNWRAP_AGAIN
            return HandshakeStatus.NEED_UNWRAP;
        } else if (!isOutboundClosed()) {
            // Special case that the inbound was closed, but outbound open.
            return HandshakeStatus.NEED_WRAP;
        }
    } else if (isOutboundClosed() && !isInboundClosed()) {
        // Special case that the outbound was closed, but inbound open.
        return HandshakeStatus.NEED_UNWRAP;
    } else if (!isOutboundClosed() && isInboundClosed()) {
        // Special case that the inbound was closed, but outbound open.
        return HandshakeStatus.NEED_WRAP;
    }

    return HandshakeStatus.NOT_HANDSHAKING;
}
 

private Ciphertext encode(
    ByteBuffer[] srcs, int srcsOffset, int srcsLength,
    ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws IOException {

    Ciphertext ciphertext = null;
    try {
        ciphertext = conContext.outputRecord.encode(
            srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);
    } catch (SSLHandshakeException she) {
        // may be record sequence number overflow
        throw conContext.fatal(Alert.HANDSHAKE_FAILURE, she);
    } catch (IOException e) {
        throw conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);
    }

    if (ciphertext == null) {
        return null;
    }

    // Is the handshake completed?
    boolean needRetransmission =
            conContext.sslContext.isDTLS() &&
            conContext.handshakeContext != null &&
            conContext.handshakeContext.sslConfig.enableRetransmissions;
    HandshakeStatus hsStatus =
            tryToFinishHandshake(ciphertext.contentType);
    if (needRetransmission &&
            hsStatus == HandshakeStatus.FINISHED &&
            conContext.sslContext.isDTLS() &&
            ciphertext.handshakeType == SSLHandshake.FINISHED.id) {
        // Retransmit the last flight for DTLS.
        //
        // The application data transactions may begin immediately
        // after the last flight.  If the last flight get lost, the
        // application data may be discarded accordingly.  As could
        // be an issue for some applications.  This impact can be
        // mitigated by sending the last fligth twice.
        if (SSLLogger.isOn && SSLLogger.isOn("ssl,verbose")) {
            SSLLogger.finest("retransmit the last flight messages");
        }

        conContext.outputRecord.launchRetransmission();
        hsStatus = HandshakeStatus.NEED_WRAP;
    }

    if (hsStatus == null) {
        hsStatus = conContext.getHandshakeStatus();
    }

    // Is the sequence number is nearly overflow?
    if (conContext.outputRecord.seqNumIsHuge() ||
            conContext.outputRecord.writeCipher.atKeyLimit()) {
        hsStatus = tryKeyUpdate(hsStatus);
    }

    // Check if NewSessionTicket PostHandshake message needs to be sent
    if (conContext.conSession.updateNST &&
            !conContext.sslConfig.isClientMode) {
        hsStatus = tryNewSessionTicket(hsStatus);
    }

    // update context status
    ciphertext.handshakeStatus = hsStatus;

    return ciphertext;
}
 

private Ciphertext encode(
    ByteBuffer[] srcs, int srcsOffset, int srcsLength,
    ByteBuffer[] dsts, int dstsOffset, int dstsLength) throws IOException {

    Ciphertext ciphertext = null;
    try {
        ciphertext = conContext.outputRecord.encode(
            srcs, srcsOffset, srcsLength, dsts, dstsOffset, dstsLength);
    } catch (SSLHandshakeException she) {
        // may be record sequence number overflow
        throw conContext.fatal(Alert.HANDSHAKE_FAILURE, she);
    } catch (IOException e) {
        throw conContext.fatal(Alert.UNEXPECTED_MESSAGE, e);
    }

    if (ciphertext == null) {
        return Ciphertext.CIPHERTEXT_NULL;
    }

    // Is the handshake completed?
    boolean needRetransmission =
            conContext.sslContext.isDTLS() &&
            conContext.handshakeContext != null &&
            conContext.handshakeContext.sslConfig.enableRetransmissions;
    HandshakeStatus hsStatus =
            tryToFinishHandshake(ciphertext.contentType);
    if (needRetransmission &&
            hsStatus == HandshakeStatus.FINISHED &&
            conContext.sslContext.isDTLS() &&
            ciphertext.handshakeType == SSLHandshake.FINISHED.id) {
        // Retransmit the last flight for DTLS.
        //
        // The application data transactions may begin immediately
        // after the last flight.  If the last flight get lost, the
        // application data may be discarded accordingly.  As could
        // be an issue for some applications.  This impact can be
        // mitigated by sending the last fligth twice.
        if (SSLLogger.isOn && SSLLogger.isOn("ssl,verbose")) {
            SSLLogger.finest("retransmit the last flight messages");
        }

        conContext.outputRecord.launchRetransmission();
        hsStatus = HandshakeStatus.NEED_WRAP;
    }

    if (hsStatus == null) {
        hsStatus = conContext.getHandshakeStatus();
    }

    // Is the sequence number is nearly overflow?
    if (conContext.outputRecord.seqNumIsHuge() ||
            conContext.outputRecord.writeCipher.atKeyLimit()) {
        hsStatus = tryKeyUpdate(hsStatus);
    }

    // update context status
    ciphertext.handshakeStatus = hsStatus;

    return ciphertext;
}