1 /* 2 * Licensed to the Apache Software Foundation (ASF) under one or more 3 * contributor license agreements. See the NOTICE file distributed with 4 * this work for additional information regarding copyright ownership. 5 * The ASF licenses this file to You under the Apache License, Version 2.0 6 * (the "License"); you may not use this file except in compliance with 7 * the License. You may obtain a copy of the License at 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 */ 17 18 package org.conscrypt; 19 20 /** 21 * This class encapsulates the functionality of Alert Protocol. 22 * Constant values are taken according to the TLS v1 specification 23 * (http://www.ietf.org/rfc/rfc2246.txt), p 7.2. 24 */ 25 public class AlertProtocol { 26 27 // ------------------------ AlertLevel codes -------------------------- 28 /** 29 * Defines the severity of alert as warning 30 */ 31 protected static final byte WARNING = 1; 32 /** 33 * Defines the severity of alert as fatal 34 */ 35 protected static final byte FATAL = 2; 36 37 // --------------------- AlertDescription codes ----------------------- 38 /** 39 * Defines the description code of the close_notify alert 40 */ 41 protected static final byte CLOSE_NOTIFY = 0; 42 /** 43 * Defines the description code of the unexpected_message alert 44 */ 45 protected static final byte UNEXPECTED_MESSAGE = 10; 46 /** 47 * Defines the description code of the bad_record_mac alert 48 */ 49 protected static final byte BAD_RECORD_MAC = 20; 50 /** 51 * Defines the description code of the decryption_failed alert 52 */ 53 protected static final byte DECRYPTION_FAILED = 21; 54 /** 55 * Defines the description code of the record_overflow alert 56 */ 57 protected static final byte RECORD_OVERFLOW = 22; 58 /** 59 * Defines the description code of the decompression_failure alert 60 */ 61 protected static final byte DECOMPRESSION_FAILURE = 30; 62 /** 63 * Defines the description code of the handshake_failure alert 64 */ 65 protected static final byte HANDSHAKE_FAILURE = 40; 66 /** 67 * Defines the description code of the bad_certificate alert 68 */ 69 protected static final byte BAD_CERTIFICATE = 42; 70 /** 71 * Defines the description code of the unsupported_certificate alert 72 */ 73 protected static final byte UNSUPPORTED_CERTIFICATE = 43; 74 /** 75 * Defines the description code of the certificate_revoked alert 76 */ 77 protected static final byte CERTIFICATE_REVOKED = 44; 78 /** 79 * Defines the description code of the certificate_expired alert 80 */ 81 protected static final byte CERTIFICATE_EXPIRED = 45; 82 /** 83 * Defines the description code of the certificate_unknown alert 84 */ 85 protected static final byte CERTIFICATE_UNKNOWN = 46; 86 /** 87 * Defines the description code of the illegal_parameter alert 88 */ 89 protected static final byte ILLEGAL_PARAMETER = 47; 90 /** 91 * Defines the description code of the unknown_ca alert 92 */ 93 protected static final byte UNKNOWN_CA = 48; 94 /** 95 * Defines the description code of the access_denied alert 96 */ 97 protected static final byte ACCESS_DENIED = 49; 98 /** 99 * Defines the description code of the decode_error alert 100 */ 101 protected static final byte DECODE_ERROR = 50; 102 /** 103 * Defines the description code of the decrypt_error alert 104 */ 105 protected static final byte DECRYPT_ERROR = 51; 106 /** 107 * Defines the description code of the export_restriction alert 108 */ 109 protected static final byte EXPORT_RESTRICTION = 60; 110 /** 111 * Defines the description code of the protocol_version alert 112 */ 113 protected static final byte PROTOCOL_VERSION = 70; 114 /** 115 * Defines the description code of the insufficient_security alert 116 */ 117 protected static final byte INSUFFICIENT_SECURITY = 71; 118 /** 119 * Defines the description code of the internal_error alert 120 */ 121 protected static final byte INTERNAL_ERROR = 80; 122 /** 123 * Defines the description code of the user_canceled alert 124 */ 125 protected static final byte USER_CANCELED = 90; 126 /** 127 * Defines the description code of the no_renegotiation alert 128 */ 129 protected static final byte NO_RENEGOTIATION = 100; 130 // holds level and description codes 131 private final byte[] alert = new byte[2]; 132 // record protocol to be used to wrap the alerts 133 private SSLRecordProtocol recordProtocol; 134 135 private Logger.Stream logger = Logger.getStream("alert"); 136 137 /** 138 * Creates the instance of AlertProtocol. 139 * Note that class is not ready to work without providing of 140 * record protocol 141 * @see #setRecordProtocol 142 */ 143 protected AlertProtocol() {} 144 145 /** 146 * Sets up the record protocol to be used by this allert protocol. 147 */ 148 protected void setRecordProtocol(SSLRecordProtocol recordProtocol) { 149 this.recordProtocol = recordProtocol; 150 } 151 152 /** 153 * Reports an alert to be sent/received by transport. 154 * This method is usually called during processing 155 * of the income TSL record: if it contains alert message from another 156 * peer, or if warning alert occured during the processing of the 157 * message and this warning should be sent to another peer. 158 * @param level alert level code 159 * @param description alert description code 160 */ 161 protected void alert(byte level, byte description) { 162 if (logger != null) { 163 logger.println("Alert.alert: "+level+" "+description); 164 } 165 this.alert[0] = level; 166 this.alert[1] = description; 167 } 168 169 /** 170 * Returns the description code of alert or -100 if there 171 * is no alert. 172 */ 173 protected byte getDescriptionCode() { 174 return (alert[0] != 0) ? alert[1] : -100; 175 } 176 177 /** 178 * Resets the protocol to be in "no alert" state. 179 * This method shoud be called after processing of the reported alert. 180 */ 181 protected void setProcessed() { 182 // free the info about alert 183 if (logger != null) { 184 logger.println("Alert.setProcessed"); 185 } 186 this.alert[0] = 0; 187 } 188 189 /** 190 * Checks if any alert has occured. 191 */ 192 protected boolean hasAlert() { 193 return (alert[0] != 0); 194 } 195 196 /** 197 * Checks if occured alert is fatal alert. 198 */ 199 protected boolean isFatalAlert() { 200 return (alert[0] == 2); 201 } 202 203 /** 204 * Returns the string representation of occured alert. 205 * If no alert has occured null is returned. 206 */ 207 protected String getAlertDescription() { 208 switch (alert[1]) { 209 case CLOSE_NOTIFY: 210 return "close_notify"; 211 case UNEXPECTED_MESSAGE: 212 return "unexpected_message"; 213 case BAD_RECORD_MAC: 214 return "bad_record_mac"; 215 case DECRYPTION_FAILED: 216 return "decryption_failed"; 217 case RECORD_OVERFLOW: 218 return "record_overflow"; 219 case DECOMPRESSION_FAILURE: 220 return "decompression_failure"; 221 case HANDSHAKE_FAILURE: 222 return "handshake_failure"; 223 case BAD_CERTIFICATE: 224 return "bad_certificate"; 225 case UNSUPPORTED_CERTIFICATE: 226 return "unsupported_certificate"; 227 case CERTIFICATE_REVOKED: 228 return "certificate_revoked"; 229 case CERTIFICATE_EXPIRED: 230 return "certificate_expired"; 231 case CERTIFICATE_UNKNOWN: 232 return "certificate_unknown"; 233 case ILLEGAL_PARAMETER: 234 return "illegal_parameter"; 235 case UNKNOWN_CA: 236 return "unknown_ca"; 237 case ACCESS_DENIED: 238 return "access_denied"; 239 case DECODE_ERROR: 240 return "decode_error"; 241 case DECRYPT_ERROR: 242 return "decrypt_error"; 243 case EXPORT_RESTRICTION: 244 return "export_restriction"; 245 case PROTOCOL_VERSION: 246 return "protocol_version"; 247 case INSUFFICIENT_SECURITY: 248 return "insufficient_security"; 249 case INTERNAL_ERROR: 250 return "internal_error"; 251 case USER_CANCELED: 252 return "user_canceled"; 253 case NO_RENEGOTIATION: 254 return "no_renegotiation"; 255 } 256 return null; 257 } 258 259 /** 260 * Returns the record with reported alert message. 261 * The returned array of bytes is ready to be sent to another peer. 262 * Note, that this method does not automatically set the state of alert 263 * protocol in "no alert" state, so after wrapping the method setProcessed 264 * should be called. 265 */ 266 protected byte[] wrap() { 267 byte[] res = recordProtocol.wrap(ContentType.ALERT, alert, 0, 2); 268 return res; 269 } 270 271 /** 272 * Shutdown the protocol. It will be impossible to use the instance 273 * after the calling of this method. 274 */ 275 protected void shutdown() { 276 alert[0] = 0; 277 alert[1] = 0; 278 recordProtocol = null; 279 } 280 } 281 282
