1 #define _POSIX_C_SOURCE 200809L
13 #include <sys/socket.h>
14 #include <arpa/inet.h>
21 #define mp_init(a) ltc_mp.init(a)
22 #define mp_init_multi ltc_init_multi
23 #define mp_clear(a) ltc_mp.deinit(a)
24 #define mp_clear_multi ltc_deinit_multi
25 #define mp_count_bits(a) ltc_mp.count_bits(a)
26 #define mp_read_radix(a, b, c) ltc_mp.read_radix(a, b, c)
27 #define mp_unsigned_bin_size(a) ltc_mp.unsigned_size(a)
28 #define mp_to_unsigned_bin(a, b) ltc_mp.unsigned_write(a, b)
29 #define mp_read_unsigned_bin(a, b, c) ltc_mp.unsigned_read(a, b, c)
30 #define mp_exptmod(a, b, c, d) ltc_mp.exptmod(a, b, c, d)
31 #define mp_add(a, b, c) ltc_mp.add(a, b, c)
32 #define mp_mul(a, b, c) ltc_mp.mul(a, b, c)
33 #define mp_cmp(a, b) ltc_mp.compare(a, b)
34 #define mp_cmp_d(a, b) ltc_mp.compare_d(a, b)
35 #define mp_sqr(a, b) ltc_mp.sqr(a, b)
36 #define mp_mod(a, b, c) ltc_mp.mpdiv(a, b, NULL, c)
37 #define mp_sub(a, b, c) ltc_mp.sub(a, b, c)
38 #define mp_set(a, b) ltc_mp.set_int(a, b)
41 #define LTC_PKCS_1_EMSA LTC_LTC_PKCS_1_EMSA
42 #define LTC_PKCS_1_V1_5 LTC_LTC_PKCS_1_V1_5
43 #define LTC_PKCS_1_PSS LTC_LTC_PKCS_1_PSS
50 #define TLS_DH_DEFAULT_P "87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597"
51 #define TLS_DH_DEFAULT_G "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"
52 #define TLS_DHE_KEY_SIZE 2048
55 #define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
59 #define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
62 #define CHECK_HANDSHAKE_STATE(context, n, limit) { if (context->hs_messages[n] >= limit) { DEBUG_PRINT("* UNEXPECTED MESSAGE (%i)\n", (int)n); payload_res = TLS_UNEXPECTED_MESSAGE; break; } context->hs_messages[n]++; }
78 } KeyExchangeAlgorithm;
85 rsa_ephemeral_dh_RESERVED = 5,
86 dss_ephemeral_dh_RESERVED = 6,
87 fortezza_dms_RESERVED = 20,
91 } TLSClientCertificateType;
109 } TLSSignatureAlgorithm;
116 typedef ssize_t (*tls_recv_func)(int sockfd, void *buf, size_t len,
118 typedef ssize_t (*tls_send_func)(int sockfd, const void *buf, size_t len,
121 static const unsigned int version_id[] = { 1, 1, 1, 0 };
122 static const unsigned int pk_id[] = { 1, 1, 7, 0 };
123 static const unsigned int serial_id[] = { 1, 1, 2, 1, 0 };
124 static const unsigned int issurer_id[] = { 1, 1, 4, 0 };
125 static const unsigned int owner_id[] = { 1, 1, 6, 0 };
126 static const unsigned int validity_id[] = { 1, 1, 5, 0 };
127 static const unsigned int algorithm_id[] = { 1, 1, 3, 0 };
128 static const unsigned int sign_id[] = { 1, 3, 2, 1, 0 };
129 static const unsigned int sign_id2[] = { 1, 3, 2, 2, 0 };
130 static const unsigned int priv_id[] = { 1, 4, 0 };
131 static const unsigned int priv_der_id[] = { 1, 3, 1, 0 };
132 static const unsigned int ecc_priv_id[] = { 1, 2, 0 };
134 static const unsigned char country_oid[] = { 0x55, 0x04, 0x06, 0x00 };
135 static const unsigned char state_oid[] = { 0x55, 0x04, 0x08, 0x00 };
136 static const unsigned char location_oid[] = { 0x55, 0x04, 0x07, 0x00 };
137 static const unsigned char entity_oid[] = { 0x55, 0x04, 0x0A, 0x00 };
138 static const unsigned char subject_oid[] = { 0x55, 0x04, 0x03, 0x00 };
139 static const unsigned char san_oid[] = { 0x55, 0x1D, 0x11, 0x00 };
140 static const unsigned char ocsp_oid[] =
141 { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x00 };
143 static const unsigned char TLS_RSA_SIGN_RSA_OID[] =
144 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x00 };
145 static const unsigned char TLS_RSA_SIGN_MD5_OID[] =
146 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04, 0x00 };
147 static const unsigned char TLS_RSA_SIGN_SHA1_OID[] =
148 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x00 };
149 static const unsigned char TLS_RSA_SIGN_SHA256_OID[] =
150 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x00 };
151 static const unsigned char TLS_RSA_SIGN_SHA384_OID[] =
152 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, 0x00 };
153 static const unsigned char TLS_RSA_SIGN_SHA512_OID[] =
154 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, 0x00 };
157 static const unsigned char TLS_ECDSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x01, 0x05, 0x00, 0x00};
158 static const unsigned char TLS_ECDSA_SIGN_SHA224_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x01, 0x05, 0x00, 0x00};
159 static const unsigned char TLS_ECDSA_SIGN_SHA256_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x05, 0x00, 0x00};
160 static const unsigned char TLS_ECDSA_SIGN_SHA384_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, 0x05, 0x00, 0x00};
161 static const unsigned char TLS_ECDSA_SIGN_SHA512_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, 0x05, 0x00, 0x00};
164 static const unsigned char TLS_EC_PUBLIC_KEY_OID[] =
165 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x00 };
167 static const unsigned char TLS_EC_prime192v1_OID[] =
168 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x01, 0x00 };
169 static const unsigned char TLS_EC_prime192v2_OID[] =
170 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x02, 0x00 };
171 static const unsigned char TLS_EC_prime192v3_OID[] =
172 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x03, 0x00 };
173 static const unsigned char TLS_EC_prime239v1_OID[] =
174 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x04, 0x00 };
175 static const unsigned char TLS_EC_prime239v2_OID[] =
176 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x05, 0x00 };
177 static const unsigned char TLS_EC_prime239v3_OID[] =
178 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x06, 0x00 };
179 static const unsigned char TLS_EC_prime256v1_OID[] =
180 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x00 };
182 #define TLS_EC_secp256r1_OID TLS_EC_prime256v1_OID
183 static const unsigned char TLS_EC_secp224r1_OID[] =
184 { 0x2B, 0x81, 0x04, 0x00, 0x21, 0x00 };
185 static const unsigned char TLS_EC_secp384r1_OID[] =
186 { 0x2B, 0x81, 0x04, 0x00, 0x22, 0x00 };
187 static const unsigned char TLS_EC_secp521r1_OID[] =
188 { 0x2B, 0x81, 0x04, 0x00, 0x23, 0x00 };
190 int tls_random(unsigned char *key, int len);
191 void tls_destroy_packet(struct TLSPacket *packet);
192 struct TLSPacket *tls_build_hello(struct TLSContext *context,
193 int tls13_downgrade);
197 static unsigned char TLS_DSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x52, 0xCE, 0x38, 0x04, 0x03, 0x00};
200 static uint16_t get16(const unsigned char *buf) {
203 res = ((*buf) << 8) + (*(buf+1));
207 static uint32_t get24(const unsigned char *buf) {
210 res = (buf[0] << 16) + (buf[1] << 8) + buf[2];
215 static char *packet_content_type(int type) {
217 case 20: return "change_cipher_spec"; break;
218 case 21: return "alert"; break;
219 case 22: return "handshake"; break;
220 case 23: return "application_data"; break;
223 return "unknown content type";
226 static char *packet_handshake_type(int type) {
228 case 0: return "hello_request"; break;
229 case 1: return "client_hello"; break;
230 case 2: return "server_hello"; break;
231 case 11: return "certificate"; break;
232 case 12: return "server_key_exchange"; break;
233 case 13: return "certificate_request"; break;
234 case 14: return "server_hello_done"; break;
235 case 15: return "certificate_verify"; break;
236 case 16: return "client_key_exchange"; break;
237 case 20: return "finished"; break;
240 return "unknown handshake type";
244 size_t tls_queue_packet(struct TLSPacket *packet) {
251 struct TLSContext *context = packet->context;
258 DEBUG_PRINTLN("sending packet type %d %s\n", (int)packet->buf[0],
259 packet_content_type(packet->buf[0]));
260 if (packet->buf[0] == 22) {
261 DEBUG_PRINTLN("handshake type %d %s\n", (int)packet->buf[5],
262 packet_handshake_type(packet->buf[5])
265 tls_buffer_append(&context->output_buffer, packet->buf, packet->len);
266 tls_destroy_packet(packet);
268 return context->output_buffer.len;
271 static void tls_send_change_cipher_spec(struct TLSContext *context) {
273 struct TLSPacket *packet =
274 tls_create_packet(context, TLS_CHANGE_CIPHER, context->version,
276 tls_packet_uint8(packet, 1);
277 tls_packet_update(packet);
278 context->local_sequence_number = 0;
279 tls_queue_packet(packet);
284 static void tls_send_encrypted_extensions(struct TLSContext *context) {
285 struct TLSPacket *packet =
286 tls_create_packet(context, TLS_HANDSHAKE, context->version, 3);
287 tls_packet_uint8(packet, 0x08);
289 if (context->negotiated_alpn) {
290 int alpn_negotiated_len = strlen(context->negotiated_alpn);
291 int alpn_len = alpn_negotiated_len + 1;
293 tls_packet_uint24(packet, alpn_len + 8);
294 tls_packet_uint16(packet, alpn_len + 6);
295 tls_packet_uint16(packet, 0x10);
296 tls_packet_uint16(packet, alpn_len + 2);
297 tls_packet_uint16(packet, alpn_len);
299 tls_packet_uint8(packet, alpn_negotiated_len);
300 tls_packet_append(packet, (unsigned char *) context->
301 negotiated_alpn, alpn_negotiated_len);
303 tls_packet_uint24(packet, 2);
304 tls_packet_uint16(packet, 0);
306 tls_packet_update(packet);
307 tls_queue_packet(packet);
311 static void tls_send_done(struct TLSContext *context) {
312 struct TLSPacket *packet =
313 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
314 tls_packet_uint8(packet, 0x0E);
315 tls_packet_uint24(packet, 0);
316 tls_packet_update(packet);
317 tls_queue_packet(packet);
321 static void tls_send_certificate(struct TLSContext *context) {
323 unsigned int all_certificate_size = 0;
324 int certificates_count;
325 struct TLSCertificate **certificates;
328 if (context->is_server) {
329 certificates_count = context->certificates_count;
330 certificates = context->certificates;
332 certificates_count = context->client_certificates_count;
333 certificates = context->client_certificates;
337 if (context->tlsver == TLS_VERSION13) {
341 int is_ecdsa = tls_is_ecdsa(context);
342 /* TODO can do one loop and test for ecdsa inside loop */
344 for (i = 0; i < certificates_count; i++) {
345 struct TLSCertificate *cert = certificates[i];
346 if (cert && cert->der_len && cert->ec_algorithm) {
347 all_certificate_size += cert->der_len + delta;
351 for (i = 0; i < certificates_count; i++) {
352 struct TLSCertificate *cert = certificates[i];
353 if (cert && cert->der_len && !cert->ec_algorithm) {
354 all_certificate_size += cert->der_len + delta;
359 for (i = 0; i < certificates_count; i++) {
360 struct TLSCertificate *cert = certificates[i];
361 if (cert && cert->der_len) {
362 all_certificate_size += cert->der_len + delta;
366 if (!all_certificate_size) {
367 DEBUG_PRINT("NO CERTIFICATE SET\n");
370 struct TLSPacket *packet = tls_create_packet(context, TLS_HANDSHAKE,
371 context->version, 0);
372 tls_packet_uint8(packet, 0x0B);
374 if (all_certificate_size) {
376 if (context->tlsver == TLS_VERSION13) {
377 tls_packet_uint24(packet, all_certificate_size + 4);
378 tls_packet_uint8(packet, 0);
380 tls_packet_uint24(packet, all_certificate_size + 3);
383 tls_packet_uint24(packet, all_certificate_size);
385 for (i = 0; i < certificates_count; i++) {
386 struct TLSCertificate *cert = certificates[i];
387 if (cert && cert->der_len) {
388 /* is RSA certificate ? */
389 if (is_ecdsa && !cert->ec_algorithm) {
392 /* is ECC certificate ? */
393 if (!is_ecdsa && cert->ec_algorithm) {
396 /* 2 times -> one certificate */
397 tls_packet_uint24(packet, cert->der_len);
398 tls_packet_append(packet, cert->der_bytes,
401 if (context->tlsver == TLS_VERSION13) {
402 tls_packet_uint16(packet, 0);
407 tls_packet_uint24(packet, all_certificate_size);
408 if (context->tlsver == TLS_VERSION13) {
409 tls_packet_uint8(packet, 0);
413 tls_packet_update(packet);
414 tls_queue_packet(packet);
419 int tls_supported_version(uint16_t ver) {
425 DEBUG_PRINT("UNSUPPORTED TLS VERSION %x\n", (int)ver);
431 void tls_set_packet_length(struct TLSPacket *packet, uint32_t length) {
432 int offset = packet->payload_pos;
433 packet->buf[offset] = (length >> 16) & 0xff;
434 packet->buf[offset+1] = (length >> 8) & 0xff;
435 packet->buf[offset+2] = (length >> 0) & 0xff;
438 static void tls_init() {
439 static int loaded = 0;
444 DEBUG_PRINT("Initializing dependencies\n");
453 /* TODO remove these */
454 register_hash(&md5_desc);
455 register_hash(&sha1_desc);
457 register_hash(&sha256_desc);
458 register_hash(&sha384_desc);
459 register_hash(&sha512_desc);
461 register_prng(&sprng_desc);
463 register_cipher(&aes_desc);
465 tls_ecc_init_curves();
468 static unsigned char *decrypt_rsa(struct TLSContext *context,
469 const unsigned char *buffer,
471 unsigned int *size) {
473 if (!len || !context || !context->private_key
474 || !context->private_key->der_bytes
475 || !context->private_key->der_len) {
476 DEBUG_PRINT("No private key set\n");
481 err = rsa_import(context->private_key->der_bytes,
482 context->private_key->der_len, &key);
485 DEBUG_PRINT("Error importing RSA key (code: %i)\n", err);
489 unsigned char *out = malloc(len);
490 unsigned long out_size = len;
491 int hash_idx = find_hash("sha256");
493 err = rsa_decrypt_key_ex(buffer, len, out, &out_size, (unsigned char *)
494 "Concept", 7, hash_idx, LTC_PKCS_1_V1_5, &res, &key);
497 if (err || !out_size) {
498 DEBUG_PRINT("RSA DECRYPT ERROR\n");
502 *size = (unsigned int) out_size;
506 static int verify_rsa(struct TLSContext *context, unsigned int hash_type, const
507 unsigned char *buffer, unsigned int len, const unsigned char
508 *message, unsigned long message_len) {
513 return TLS_GENERIC_ERROR;
516 struct TLSCertificate **cert;
519 if (context->is_server) {
520 cert = context->client_certificates;
521 count = context->client_certificates_count;
523 cert = context->certificates;
524 count = context->certificates_count;
527 if (count == 0 || !cert) {
528 return TLS_GENERIC_ERROR;
531 err = rsa_import(cert[0]->der_bytes, cert[0]->der_len, &key);
534 DEBUG_PRINT("Error importing RSA certificate (code: %i)\n",
536 return TLS_GENERIC_ERROR;
539 unsigned char hash[TLS_MAX_HASH_LEN];
540 unsigned long hash_len;
541 hash_len = (unsigned long)sizeof hash;
545 hash_idx = find_hash("md5");
548 hash_idx = find_hash("sha1");
551 hash_idx = find_hash("sha256");
554 hash_idx = find_hash("sha384");
557 hash_idx = find_hash("sha512");
560 err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
561 if (hash_idx < 0 || err) {
562 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
563 return TLS_GENERIC_ERROR;
566 if (context->tlsver == TLS_VERSION13) {
567 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
568 LTC_PKCS_1_PSS, hash_idx, 0, &rsa_stat, &key);
570 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
571 LTC_PKCS_1_V1_5, hash_idx, 0, &rsa_stat, &key);
580 static int sign_rsa(struct TLSContext *context, unsigned int hash_type, const
581 unsigned char *message, unsigned int message_len, unsigned char
582 *out, unsigned long *outlen) {
586 unsigned char hash[TLS_MAX_HASH_LEN];
587 unsigned long hash_len = 0;
590 if (!outlen || !context || !out || !context->private_key
591 || !context->private_key->der_bytes
592 || !context->private_key->der_len) {
593 DEBUG_PRINT("No private key set\n");
594 return TLS_GENERIC_ERROR;
597 err = rsa_import(context->private_key->der_bytes,
598 context->private_key->der_len, &key);
601 DEBUG_PRINT("Error %d importing RSA certificate", err);
602 return TLS_GENERIC_ERROR;
607 hash_index = find_hash("sha1");
611 hash_index = find_hash("sha256");
615 hash_index = find_hash("sha384");
619 hash_index = find_hash("sha512");
624 hash_index = find_hash("md5");
629 if (hash_index < 0 || err) {
630 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
631 return TLS_GENERIC_ERROR;
634 hash_memory(hash_index, message, message_len, hash, &hash_len);
636 if (hash_type == _md5_sha1) {
637 unsigned long hlen = 20;
638 hash_index = find_hash("sha1");
639 hash_memory(hash_index, message, message_len, hash+16, &hlen);
643 //err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
645 if (context->tlsver == TLS_VERSION13) {
646 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
647 LTC_PKCS_1_PSS, NULL, find_prng("sprng"),
648 hash_index, hash_type == sha256 ? 32 : 48, &key);
650 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
651 LTC_PKCS_1_V1_5, NULL, find_prng("sprng"),
652 hash_index, 0, &key);
663 static int tls_is_point(ecc_key * key) {
664 void *prime, *b, *t1, *t2;
667 if ((err = mp_init_multi(&prime, &b, &t1, &t2, NULL)) != CRYPT_OK) {
671 /* load prime and b */
672 if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) {
675 if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) {
680 if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) {
685 if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) {
688 if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) {
691 if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) {
695 /* compute y^2 - x^3 */
696 if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) {
700 /* compute y^2 - x^3 + 3x */
701 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
704 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
707 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
710 if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) {
713 while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
714 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) {
718 while (mp_cmp(t1, prime) != LTC_MP_LT) {
719 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) {
725 if (mp_cmp(t1, b) != LTC_MP_EQ) {
726 err = CRYPT_INVALID_PACKET;
732 mp_clear_multi(prime, b, t1, t2, NULL);
736 static int tls_ecc_import_key(const unsigned char *private_key,
738 const unsigned char *public_key,
739 int public_len, ecc_key *key,
740 const ltc_ecc_set_type *dp) {
743 if (!key || !ltc_mp.name) {
747 key->type = PK_PRIVATE;
750 (&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k,
754 if (public_len && !public_key[0]) {
758 if ((err = mp_read_unsigned_bin(key->pubkey.x,
759 (unsigned char *) public_key + 1,
760 (public_len - 1) >> 1)) != CRYPT_OK) {
761 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
766 if ((err = mp_read_unsigned_bin(key->pubkey.y,
767 (unsigned char *) public_key + 1 +
768 ((public_len - 1) >> 1),
769 (public_len - 1) >> 1)) != CRYPT_OK) {
770 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
776 mp_read_unsigned_bin(key->k, (unsigned char *) private_key,
777 private_len)) != CRYPT_OK) {
778 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
787 if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
788 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
793 /* is it a point on the curve? */
794 if ((err = tls_is_point(key)) != CRYPT_OK) {
795 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
796 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
805 static int sign_ecdsa(struct TLSContext *context,
806 unsigned int hash_type,
807 const unsigned char *message,
808 unsigned int message_len, unsigned char *out,
809 unsigned long *outlen) {
810 if (!outlen || !context || !out || !outlen
811 || !context->ec_private_key
812 || !context->ec_private_key->priv
813 || !context->ec_private_key->priv_len
814 || !context->ec_private_key->pk
815 || !context->ec_private_key->pk_len) {
816 DEBUG_PRINT("No private ECDSA key set\n");
817 return TLS_GENERIC_ERROR;
820 const struct ECCCurveParameters *curve = NULL;
822 switch (context->ec_private_key->ec_algorithm) {
845 DEBUG_PRINT("UNSUPPORTED CURVE\n");
849 return TLS_GENERIC_ERROR;
855 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&curve->dp;
857 /* broken ... fix this */
858 err = tls_ecc_import_key(context->ec_private_key->priv,
859 context->ec_private_key->priv_len,
860 context->ec_private_key->pk,
861 context->ec_private_key->pk_len, &key, dp);
864 DEBUG_PRINT("Error importing ECC certificate (code: %i)\n",
866 return TLS_GENERIC_ERROR;
869 unsigned char hash[TLS_MAX_HASH_LEN];
870 unsigned long hash_len = 0;
875 hash_index = find_hash("sha1");
879 hash_index = find_hash("sha256");
883 hash_index = find_hash("sha384");
887 hash_index = find_hash("sha512");
892 hash_index = find_hash("md5");
897 hash_memory(hash_index, message, message_len, hash, &hash_len);
899 if (hash_type == _md5_sha1) {
900 unsigned long hlen = 20;
901 hash_index = find_hash("sha1");
902 hash_memory(hash_index, message, message_len, hash+16, &hlen);
907 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
908 return TLS_GENERIC_ERROR;
910 /* "Let z be the Ln leftmost bits of e, where Ln is the bit length of
911 * the group order n." */
912 if ((int)hash_len > curve->size) {
913 hash_len = curve->size;
915 err = ecc_sign_hash(hash, hash_len, out, outlen, NULL,
916 find_prng("sprng"), &key);
917 DEBUG_DUMP_HEX_LABEL("ECC SIGNATURE", out, *outlen);
923 static void tls_send_certificate_verify(struct TLSContext *context) {
924 struct TLSPacket *packet =
925 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
926 /* certificate verify */
927 tls_packet_uint8(packet, 0x0F);
928 tls_packet_uint24(packet, 0);
930 unsigned char out[TLS_MAX_RSA_KEY];
931 unsigned long out_len = TLS_MAX_RSA_KEY;
933 unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
934 int signing_data_len;
936 /* first 64 bytes to 0x20 (32) */
937 memset(signing_data, 0x20, 64);
938 /* context string 33 bytes */
939 if (context->is_server) {
940 memcpy(signing_data + 64, "TLS 1.3, server CertificateVerify",
943 memcpy(signing_data + 64, "TLS 1.3, client CertificateVerify",
946 /* a single 0 byte separator */
947 signing_data[97] = 0;
948 signing_data_len = 98;
950 signing_data_len += tls_get_hash(context, signing_data + 98);
951 DEBUG_DUMP_HEX_LABEL("verify data", signing_data, signing_data_len);
952 int hash_algorithm = sha256;
953 if (tls_is_ecdsa(context)) {
954 switch (context->ec_private_key->ec_algorithm) {
956 /* secp256r1 + sha256 */
957 tls_packet_uint16(packet, 0x0403);
960 /* secp384r1 + sha384 */
961 tls_packet_uint16(packet, 0x0503);
962 hash_algorithm = sha384;
965 /* secp521r1 + sha512 */
966 tls_packet_uint16(packet, 0x0603);
967 hash_algorithm = sha512;
970 DEBUG_PRINT("UNSUPPORTED CURVE (SIGNING)\n");
976 tls_packet_uint16(packet, 0x0804);
981 if (tls_is_ecdsa(context)) {
982 if (sign_ecdsa(context, hash_algorithm, signing_data,
983 signing_data_len, out, &out_len) == 1)
986 ("ECDSA signing OK! (ECDSA, length %lu)\n",
988 tls_packet_uint16(packet, out_len);
989 tls_packet_append(packet, out, out_len);
990 packet_size += out_len + 2;
992 } else if (sign_rsa(context, hash_algorithm, signing_data,
993 signing_data_len, out, &out_len) == 1) {
994 DEBUG_PRINT("RSA signing OK! (length %lu)\n", out_len);
995 tls_packet_uint16(packet, out_len);
996 tls_packet_append(packet, out, out_len);
997 packet_size += out_len + 2;
1000 tls_set_packet_length(packet, packet_size);
1002 tls_packet_update(packet);
1003 tls_queue_packet(packet);
1007 static int tls_ecc_import_pk(const unsigned char *public_key,
1008 int public_len, ecc_key * key,
1009 const ltc_ecc_set_type * dp) {
1012 if (!key || !ltc_mp.name) {
1016 key->type = PK_PUBLIC;
1018 if (mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z,
1019 &key->k, NULL) != CRYPT_OK) {
1023 if (public_len && !public_key[0]) {
1027 if ((err = mp_read_unsigned_bin(key->pubkey.x,
1028 (unsigned char *) public_key + 1,
1029 (public_len - 1) >> 1)) != CRYPT_OK) {
1030 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1035 if ((err = mp_read_unsigned_bin(key->pubkey.y,
1036 (unsigned char *) public_key + 1 +
1037 ((public_len - 1) >> 1),
1038 (public_len - 1) >> 1)) != CRYPT_OK) {
1039 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1048 if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
1049 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1054 /* is it a point on the curve? */
1055 if ((err = tls_is_point(key)) != CRYPT_OK) {
1056 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
1057 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1066 static int tls_verify_ecdsa(struct TLSContext *context,
1067 unsigned int hash_type,
1068 const unsigned char *buffer,
1070 const unsigned char *message,
1071 unsigned int message_len,
1072 const struct ECCCurveParameters *curve_hint)
1078 curve_hint = context->curve;
1082 return TLS_GENERIC_ERROR;
1085 struct TLSCertificate **cert;
1088 if (context->is_server) {
1089 cert = context->client_certificates;
1090 count = context->client_certificates_count;
1092 cert = context->certificates;
1093 count = context->certificates_count;
1096 if (count == 0 || !cert || !cert[0] || !cert[0]->pk ||
1098 return TLS_GENERIC_ERROR;
1101 err = tls_ecc_import_pk(cert[0]->pk, cert[0]->pk_len, &key,
1102 (ltc_ecc_set_type *)&curve_hint->dp);
1105 DEBUG_PRINT("Error importing ECC certificate (code: %i)", err);
1106 return TLS_GENERIC_ERROR;
1110 unsigned char hash[TLS_MAX_HASH_LEN];
1111 unsigned long hash_len = 0;
1113 switch (hash_type) {
1115 hash_idx = find_hash("md5");
1119 hash_idx = find_hash("sha1");
1123 hash_idx = find_hash("sha256");
1127 hash_idx = find_hash("sha384");
1131 hash_idx = find_hash("sha512");
1136 err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
1138 if (hash_idx < 0 || err) {
1139 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
1140 return TLS_GENERIC_ERROR;
1144 err = ecc_verify_hash(buffer, len, hash, hash_len, &ecc_stat, &key);
1152 static void prf_helper(int hash_idx, unsigned long dlen,
1153 unsigned char *output, unsigned int outlen,
1154 const unsigned char *secret,
1155 const unsigned int secret_len,
1156 const unsigned char *label,
1157 unsigned int label_len, unsigned char *seed,
1158 unsigned int seed_len, unsigned char *seed_b,
1159 unsigned int seed_b_len) {
1160 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1161 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1165 hmac_init(&hmac, hash_idx, secret, secret_len);
1166 hmac_process(&hmac, label, label_len);
1168 hmac_process(&hmac, seed, seed_len);
1169 if (seed_b && seed_b_len) {
1170 hmac_process(&hmac, seed_b, seed_b_len);
1172 hmac_done(&hmac, digest_out0, &dlen);
1175 hmac_init(&hmac, hash_idx, secret, secret_len);
1176 hmac_process(&hmac, digest_out0, dlen);
1177 hmac_process(&hmac, label, label_len);
1178 hmac_process(&hmac, seed, seed_len);
1179 if (seed_b && seed_b_len) {
1180 hmac_process(&hmac, seed_b, seed_b_len);
1182 hmac_done(&hmac, digest_out1, &dlen);
1184 unsigned int copylen = outlen;
1185 if (copylen > dlen) {
1189 for (i = 0; i < copylen; i++) {
1190 output[idx++] ^= digest_out1[i];
1198 hmac_init(&hmac, hash_idx, secret, secret_len);
1199 hmac_process(&hmac, digest_out0, dlen);
1200 hmac_done(&hmac, digest_out0, &dlen);
1204 static void tls_prf(struct TLSContext *context,
1205 unsigned char *output, unsigned int outlen,
1206 const unsigned char *secret,
1207 const unsigned int secret_len,
1208 const unsigned char *label, unsigned int label_len,
1209 unsigned char *seed, unsigned int seed_len,
1210 unsigned char *seed_b, unsigned int seed_b_len) {
1211 if (!secret || !secret_len) {
1212 DEBUG_PRINT("NULL SECRET\n");
1216 /* TODO I don't think this is right, wouldn't use md5 for tls v1.3 */
1217 if (context->version != TLS_V12) {
1218 int md5_hash_idx = find_hash("md5");
1219 int sha1_hash_idx = find_hash("sha1");
1220 int half_secret = (secret_len + 1) / 2;
1222 memset(output, 0, outlen);
1223 prf_helper(md5_hash_idx, 16, output, outlen, secret,
1224 half_secret, label, label_len, seed, seed_len,
1225 seed_b, seed_b_len);
1226 prf_helper(sha1_hash_idx, 20, output, outlen, secret +
1227 (secret_len - half_secret), secret_len -
1228 half_secret, label, label_len, seed, seed_len,
1229 seed_b, seed_b_len);
1232 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1233 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1234 unsigned long dlen = 32;
1236 unsigned int mac_length = tls_mac_length(context);
1238 if (mac_length == TLS_SHA384_MAC_SIZE) {
1239 hash_idx = find_hash("sha384");
1242 hash_idx = find_hash("sha256");
1248 hmac_init(&hmac, hash_idx, secret, secret_len);
1249 hmac_process(&hmac, label, label_len);
1250 hmac_process(&hmac, seed, seed_len);
1251 if (seed_b && seed_b_len) {
1252 hmac_process(&hmac, seed_b, seed_b_len);
1254 hmac_done(&hmac, digest_out0, &dlen);
1258 hmac_init(&hmac, hash_idx, secret, secret_len);
1259 hmac_process(&hmac, digest_out0, dlen);
1260 hmac_process(&hmac, label, label_len);
1261 hmac_process(&hmac, seed, seed_len);
1262 if (seed_b && seed_b_len) {
1263 hmac_process(&hmac, seed_b, seed_b_len);
1265 hmac_done(&hmac, digest_out1, &dlen);
1267 unsigned int copylen = outlen;
1268 if (copylen > dlen) {
1269 copylen = (unsigned int) dlen;
1272 for (i = 0; i < copylen; i++) {
1273 output[idx++] = digest_out1[i];
1281 hmac_init(&hmac, hash_idx, secret, secret_len);
1282 hmac_process(&hmac, digest_out0, dlen);
1283 hmac_done(&hmac, digest_out0, &dlen);
1288 static void tls_send_finished(struct TLSContext *context) {
1290 struct TLSPacket *packet =
1291 tls_create_packet(context, TLS_HANDSHAKE, context->version,
1292 TLS_MIN_FINISHED_OPAQUE_LEN + 64);
1293 tls_packet_uint8(packet, 20);
1295 if (context->tlsver == TLS_VERSION13) {
1296 tls_packet_uint24(packet, tls_mac_length(context));
1298 tls_packet_uint24(packet, TLS_MIN_FINISHED_OPAQUE_LEN);
1302 unsigned char hash[TLS_MAX_HASH_SIZE];
1303 unsigned long out_size = TLS_MIN_FINISHED_OPAQUE_LEN;
1304 unsigned char out[TLS_MAX_HASH_SIZE];
1305 unsigned int hash_len;
1307 int context_is_v13 = 0;
1309 if (packet->context->tlsver == TLS_VERSION13) {
1313 /* server verifies client's message */
1314 if (context->is_server) {
1315 if (context_is_v13) {
1316 hash_len = tls_get_hash(context, hash);
1317 if (!context->finished_key || !hash_len) {
1319 ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
1321 /* TODO probably need to terminate */
1322 tls_destroy_packet(packet);
1327 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
1328 DEBUG_DUMP_HEX_LABEL("HS FINISH",
1329 context->finished_key,
1332 out_size = hash_len;
1334 hmac_init(&hmac, tls_get_hash_idx(context),
1335 context->finished_key, hash_len);
1336 hmac_process(&hmac, hash, hash_len);
1337 hmac_done(&hmac, out, &out_size);
1339 hash_len = tls_done_hash(context, hash);
1340 tls_prf(context, out,
1341 TLS_MIN_FINISHED_OPAQUE_LEN,
1342 context->master_key,
1343 context->master_key_len,
1345 "server finished", 15, hash,
1347 tls_destroy_hash(context);
1351 hash_len = tls_get_hash(context, hash);
1352 tls_prf(context, out, TLS_MIN_FINISHED_OPAQUE_LEN,
1353 context->master_key,
1354 context->master_key_len,
1355 (unsigned char *) "client finished", 15,
1356 hash, hash_len, NULL, 0);
1359 tls_packet_append(packet, out, out_size);
1360 tls_packet_update(packet);
1361 DEBUG_DUMP_HEX_LABEL("VERIFY DATA", out, out_size);
1362 tls_queue_packet(packet);
1367 static int tls_key_length(struct TLSContext *context) {
1368 switch (context->cipher) {
1369 case TLS_RSA_WITH_AES_128_CBC_SHA:
1370 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1371 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1372 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1373 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1374 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1375 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1376 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1377 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1378 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1379 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1380 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1381 case TLS_AES_128_GCM_SHA256:
1383 case TLS_RSA_WITH_AES_256_CBC_SHA:
1384 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1385 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1386 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1387 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1388 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1389 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1390 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1391 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1392 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1393 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1394 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1395 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1396 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1397 case TLS_AES_256_GCM_SHA384:
1398 case TLS_CHACHA20_POLY1305_SHA256:
1404 /* 0 is none, 1 is GCM?, 2 is chacha */
1405 int tls_is_aead(struct TLSContext *context) {
1406 switch (context->cipher) {
1407 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1408 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1409 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1410 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1411 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1412 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1413 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1414 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1415 case TLS_AES_128_GCM_SHA256:
1416 case TLS_AES_256_GCM_SHA384:
1418 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1419 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1420 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1421 case TLS_CHACHA20_POLY1305_SHA256:
1427 int tls_mac_length(struct TLSContext *context) {
1428 switch (context->cipher) {
1429 case TLS_RSA_WITH_AES_128_CBC_SHA:
1430 case TLS_RSA_WITH_AES_256_CBC_SHA:
1431 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1432 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1433 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1434 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1435 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1436 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1437 return TLS_SHA1_MAC_SIZE;
1438 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1439 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1440 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1441 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1442 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1443 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1444 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1445 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1446 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1447 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1448 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1449 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1450 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1451 case TLS_AES_128_GCM_SHA256:
1452 case TLS_CHACHA20_POLY1305_SHA256:
1453 case TLS_AES_128_CCM_SHA256:
1454 case TLS_AES_128_CCM_8_SHA256:
1455 return TLS_SHA256_MAC_SIZE;
1456 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1457 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1458 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1459 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1460 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1461 case TLS_AES_256_GCM_SHA384:
1462 return TLS_SHA384_MAC_SIZE;
1467 int _private_tls13_key(struct TLSContext *context, int handshake) {
1468 int key_length = tls_key_length(context);
1469 int mac_length = tls_mac_length(context);
1471 if (!context->premaster_key || !context->premaster_key_len) {
1475 if (!key_length || !mac_length) {
1477 ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1478 key_length, mac_length);
1482 unsigned char *clientkey = NULL;
1483 unsigned char *serverkey = NULL;
1484 unsigned char *clientiv = NULL;
1485 unsigned char *serveriv = NULL;
1486 int is_aead = tls_is_aead(context);
1488 unsigned char local_keybuffer[TLS_V13_MAX_KEY_SIZE];
1489 unsigned char local_ivbuffer[TLS_V13_MAX_IV_SIZE];
1490 unsigned char remote_keybuffer[TLS_V13_MAX_KEY_SIZE];
1491 unsigned char remote_ivbuffer[TLS_V13_MAX_IV_SIZE];
1493 unsigned char prk[TLS_MAX_HASH_SIZE];
1494 unsigned char hash[TLS_MAX_HASH_SIZE];
1495 static unsigned char earlysecret[TLS_MAX_HASH_SIZE];
1497 const char *server_key = "s ap traffic";
1498 const char *client_key = "c ap traffic";
1500 server_key = "s hs traffic";
1501 client_key = "c hs traffic";
1504 unsigned char salt[TLS_MAX_HASH_SIZE];
1507 /* TODO what is the point of this ? */
1508 if (mac_length == TLS_SHA384_MAC_SIZE) {
1510 sha384_done(&md, hash);
1513 sha256_done(&md, hash);
1515 /* extract secret "early" */
1516 if (context->master_key && context->master_key_len && !handshake) {
1517 DEBUG_DUMP_HEX_LABEL("USING PREVIOUS SECRET",
1518 context->master_key,
1519 context->master_key_len);
1520 tls_hkdf_expand_label(mac_length, salt, mac_length,
1521 context->master_key, context->master_key_len,
1522 "derived", 7, hash, mac_length);
1523 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1524 tls_hkdf_extract(mac_length, prk, mac_length, salt, mac_length,
1525 earlysecret, mac_length);
1527 tls_hkdf_extract(mac_length, prk, mac_length, NULL, 0,
1528 earlysecret, mac_length);
1529 /* derive secret for handshake "tls13 derived": */
1530 DEBUG_DUMP_HEX_LABEL("null hash", hash, mac_length);
1531 tls_hkdf_expand_label(mac_length, salt, mac_length, prk,
1532 mac_length, "derived", 7, hash, mac_length);
1533 /* extract secret "handshake": */
1534 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1535 tls_hkdf_extract(mac_length, prk, mac_length,
1537 context->premaster_key,
1538 context->premaster_key_len);
1542 DEBUG_PRINT("KEY EXPANSION FAILED, NON AEAD CIPHER\n");
1546 unsigned char secret[TLS_MAX_MAC_SIZE];
1547 unsigned char hs_secret[TLS_MAX_HASH_SIZE];
1551 hash_size = tls_get_hash(context, hash);
1553 hash_size = tls_done_hash(context, hash);
1556 DEBUG_DUMP_HEX_LABEL("messages hash", hash, hash_size);
1558 if (context->is_server) {
1559 tls_hkdf_expand_label(mac_length, hs_secret, mac_length, prk,
1560 mac_length, server_key, 12, context->
1561 server_finished_hash ? context->
1562 server_finished_hash : hash, hash_size);
1563 DEBUG_DUMP_HEX_LABEL(server_key, hs_secret, mac_length);
1564 serverkey = local_keybuffer;
1565 serveriv = local_ivbuffer;
1566 clientkey = remote_keybuffer;
1567 clientiv = remote_ivbuffer;
1569 tls_hkdf_expand_label(mac_length, hs_secret,
1570 mac_length, prk, mac_length,
1573 server_finished_hash ?
1575 server_finished_hash : hash,
1577 serverkey = remote_keybuffer;
1578 serveriv = remote_ivbuffer;
1579 clientkey = local_keybuffer;
1580 clientiv = local_ivbuffer;
1583 int iv_length = TLS_13_AES_GCM_IV_LENGTH;
1585 iv_length = TLS_CHACHA20_IV_LENGTH;
1588 tls_hkdf_expand_label(mac_length, local_keybuffer, key_length,
1589 hs_secret, mac_length, "key", 3, NULL, 0);
1590 tls_hkdf_expand_label(mac_length, local_ivbuffer, iv_length, hs_secret,
1591 mac_length, "iv", 2, NULL, 0);
1593 tls_hkdf_expand_label(mac_length, secret,
1594 mac_length, prk, mac_length,
1595 context->is_server ? client_key : server_key,
1597 context->server_finished_hash ?
1598 context->server_finished_hash :
1602 tls_hkdf_expand_label(mac_length, remote_keybuffer, key_length, secret,
1603 mac_length, "key", 3, NULL, 0);
1604 tls_hkdf_expand_label(mac_length, remote_ivbuffer, iv_length, secret,
1605 mac_length, "iv", 2, NULL, 0);
1607 DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1608 DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1609 DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1610 DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1611 free(context->finished_key);
1612 free(context->remote_finished_key);
1615 context->finished_key = malloc(mac_length);
1616 context->remote_finished_key = malloc(mac_length);
1618 if (context->finished_key) {
1619 tls_hkdf_expand_label(mac_length,
1620 context->finished_key, mac_length,
1621 hs_secret, mac_length, "finished", 8,
1623 DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1627 if (context->remote_finished_key) {
1628 tls_hkdf_expand_label(mac_length,
1629 context->remote_finished_key,
1630 mac_length, secret, mac_length,
1631 "finished", 8, NULL, 0);
1632 DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1636 context->finished_key = NULL;
1637 context->remote_finished_key = NULL;
1638 free(context->server_finished_hash);
1639 context->server_finished_hash = NULL;
1642 if (context->is_server) {
1644 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1645 clientiv, iv_length);
1646 memcpy(context->crypto.ctx_local_mac.local_nonce,
1647 serveriv, iv_length);
1648 } else if (is_aead) {
1649 memcpy(context->crypto.ctx_remote_mac.remote_iv,
1650 clientiv, iv_length);
1651 memcpy(context->crypto.ctx_local_mac.local_iv,
1652 serveriv, iv_length);
1654 if (tls_crypto_create(context, key_length,
1655 serverkey, serveriv, clientkey,
1661 memcpy(context->crypto.ctx_local_mac.local_nonce,
1662 clientiv, iv_length);
1663 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1664 serveriv, iv_length);
1665 } else if (is_aead) {
1666 memcpy(context->crypto.ctx_local_mac.local_iv,
1667 clientiv, iv_length);
1668 memcpy(context->crypto.ctx_remote_mac.remote_iv,
1669 serveriv, iv_length);
1672 if (tls_crypto_create(context, key_length,
1673 clientkey, clientiv, serverkey,
1679 context->crypto.created = 1 + is_aead;
1681 free(context->master_key);
1682 context->master_key = malloc(mac_length);
1683 if (context->master_key) {
1684 memcpy(context->master_key, prk, mac_length);
1685 context->master_key_len = mac_length;
1687 context->local_sequence_number = 0;
1688 context->remote_sequence_number = 0;
1691 * extract client_mac_key(mac_key_length)
1692 * extract server_mac_key(mac_key_length)
1693 * extract client_key(enc_key_length)
1694 * extract server_key(enc_key_length)
1695 * extract client_iv(fixed_iv_lengh)
1696 * extract server_iv(fixed_iv_length)
1701 static int tls_expand_key(struct TLSContext *context) {
1702 unsigned char key[TLS_MAX_KEY_EXPANSION_SIZE];
1703 if (context->tlsver == TLS_VERSION13) {
1707 if (!context->master_key || !context->master_key_len) {
1711 int key_length = tls_key_length(context);
1712 int mac_length = tls_mac_length(context);
1714 if (!key_length || !mac_length) {
1716 ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1717 key_length, mac_length);
1720 unsigned char *clientkey = NULL;
1721 unsigned char *serverkey = NULL;
1722 unsigned char *clientiv = NULL;
1723 unsigned char *serveriv = NULL;
1724 int iv_length = TLS_AES_IV_LENGTH;
1725 int is_aead = tls_is_aead(context);
1727 if (context->is_server) {
1728 tls_prf(context, key, sizeof(key),
1729 context->master_key, context->master_key_len,
1730 (unsigned char *) "key expansion", 13,
1731 context->local_random, TLS_SERVER_RANDOM_SIZE,
1732 context->remote_random,
1733 TLS_CLIENT_RANDOM_SIZE);
1735 tls_prf(context, key, sizeof(key),
1736 context->master_key,
1737 context->master_key_len,
1738 (unsigned char *) "key expansion", 13,
1739 context->remote_random,
1740 TLS_SERVER_RANDOM_SIZE,
1741 context->local_random,
1742 TLS_CLIENT_RANDOM_SIZE);
1745 DEBUG_DUMP_HEX_LABEL("LOCAL RANDOM ", context->local_random,
1746 TLS_SERVER_RANDOM_SIZE);
1747 DEBUG_DUMP_HEX_LABEL("REMOTE RANDOM", context->remote_random,
1748 TLS_CLIENT_RANDOM_SIZE);
1749 DEBUG_PRINT("\n=========== EXPANSION ===========\n");
1750 DEBUG_DUMP_HEX(key, TLS_MAX_KEY_EXPANSION_SIZE);
1755 iv_length = TLS_CHACHA20_IV_LENGTH;
1758 iv_length = TLS_AES_GCM_IV_LENGTH;
1760 if (context->is_server) {
1761 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1762 &key[pos], mac_length);
1764 memcpy(context->crypto.ctx_local_mac.local_mac,
1765 &key[pos], mac_length);
1768 memcpy(context->crypto.ctx_local_mac.local_mac,
1769 &key[pos], mac_length);
1771 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1772 &key[pos], mac_length);
1778 clientkey = &key[pos];
1780 serverkey = &key[pos];
1782 clientiv = &key[pos];
1784 serveriv = &key[pos];
1786 DEBUG_PRINT("EXPANSION %i/%i\n", (int) pos,
1787 (int) TLS_MAX_KEY_EXPANSION_SIZE);
1788 DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1789 DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1790 DEBUG_DUMP_HEX_LABEL("CLIENT MAC KEY",
1791 context->is_server ? context->crypto.
1792 ctx_remote_mac.remote_mac : context->
1793 crypto.ctx_local_mac.local_mac,
1795 DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1796 DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1797 DEBUG_DUMP_HEX_LABEL("SERVER MAC KEY",
1798 context->is_server ? context->crypto.
1799 ctx_local_mac.local_mac : context->crypto.
1800 ctx_remote_mac.remote_mac, mac_length);
1801 if (context->is_server) {
1803 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1804 clientiv, iv_length);
1805 memcpy(context->crypto.ctx_local_mac.local_nonce,
1806 serveriv, iv_length);
1809 memcpy(context->crypto.ctx_remote_mac.
1810 remote_aead_iv, clientiv, iv_length);
1811 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1812 serveriv, iv_length);
1816 if (tls_crypto_create(context, key_length,
1817 serverkey, serveriv, clientkey,
1823 memcpy(context->crypto.ctx_local_mac.local_nonce,
1824 clientiv, iv_length);
1825 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1826 serveriv, iv_length);
1829 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1830 clientiv, iv_length);
1831 memcpy(context->crypto.ctx_remote_mac.
1832 remote_aead_iv, serveriv, iv_length);
1836 if (tls_crypto_create(context, key_length,
1837 clientkey, clientiv, serverkey,
1844 * extract client_mac_key(mac_key_length)
1845 * extract server_mac_key(mac_key_length)
1846 * extract client_key(enc_key_length)
1847 * extract server_key(enc_key_length)
1848 * extract client_iv(fixed_iv_lengh)
1849 * extract server_iv(fixed_iv_length)
1854 int tls_compute_key(struct TLSContext *context, unsigned int key_len) {
1855 if (context->tlsver == TLS_VERSION13) {
1859 if (!context->premaster_key || !context->premaster_key_len
1861 DEBUG_PRINT("CANNOT COMPUTE MASTER SECRET\n");
1865 unsigned char master_secret_label[] = "master secret";
1866 #ifdef TLS_CHECK_PREMASTER_KEY
1867 if (!tls_cipher_is_ephemeral(context)) {
1868 uint16_t version = get16(context->premaster_key);
1869 /* this check is not true for DHE/ECDHE ciphers */
1870 if (context->version > version) {
1871 DEBUG_PRINT("Mismatch protocol version 0x(%x)\n",
1877 free(context->master_key);
1878 context->master_key_len = 0;
1879 context->master_key = NULL;
1881 context->master_key = malloc(key_len);
1882 if (!context->master_key) {
1886 context->master_key_len = key_len;
1887 if (context->is_server) {
1889 context->master_key,
1890 context->master_key_len,
1891 context->premaster_key,
1892 context->premaster_key_len,
1893 master_secret_label, 13,
1894 context->remote_random,
1895 TLS_CLIENT_RANDOM_SIZE,
1896 context->local_random,
1897 TLS_SERVER_RANDOM_SIZE);
1900 context->master_key,
1901 context->master_key_len,
1902 context->premaster_key,
1903 context->premaster_key_len,
1904 master_secret_label, 13,
1905 context->local_random,
1906 TLS_CLIENT_RANDOM_SIZE,
1907 context->remote_random,
1908 TLS_SERVER_RANDOM_SIZE);
1910 free(context->premaster_key);
1911 context->premaster_key = NULL;
1912 context->premaster_key_len = 0;
1913 DEBUG_PRINT("\n=========== Master key ===========\n");
1914 DEBUG_DUMP_HEX(context->master_key,
1915 context->master_key_len);
1917 tls_expand_key(context);
1921 int _is_oid(const unsigned char *oid, const unsigned char *compare_to,
1922 int compare_to_len) {
1924 while ((oid[i]) && (i < compare_to_len)) {
1925 if (oid[i] != compare_to[i])
1933 int _is_oid2(const unsigned char *oid, const unsigned char *compare_to,
1934 int compare_to_len, int oid_len) {
1936 if (oid_len < compare_to_len) {
1937 compare_to_len = oid_len;
1940 while (i < compare_to_len) {
1941 if (oid[i] != compare_to[i]) {
1950 struct TLSCertificate *tls_create_certificate() {
1951 struct TLSCertificate zero = { 0 };
1952 struct TLSCertificate *cert = malloc(sizeof *cert);
1956 cert->not_before[0] = 0;
1957 cert->not_after[0] = 0;
1962 int tls_certificate_valid_subject_name(const unsigned char *cert_subject,
1963 const char *subject) {
1964 /* no subjects ... */
1965 if ((!cert_subject || !cert_subject[0]) && (!subject || !subject[0])) {
1969 if (!subject || !subject[0]) {
1970 return bad_certificate;
1973 if (!cert_subject || !cert_subject[0]) {
1974 return bad_certificate;
1978 if (!strcmp((const char *) cert_subject, subject)) {
1982 const char *wildcard = strchr((const char *) cert_subject, '*');
1984 /* 6.4.3 (1) The client SHOULD NOT attempt to match a presented
1985 * identifier in which the wildcard character comprises a label
1986 * other than the left-most label
1991 * subject is [something*] .. invalid
1993 return bad_certificate;
1996 const char *match = strstr(subject, wildcard);
1997 if ((!match) && (wildcard[0] == '.')) {
1998 /* check *.domain.com against domain.com */
2000 if (!strcasecmp(subject, wildcard))
2004 unsigned long offset = (unsigned long) match -
2005 (unsigned long) subject;
2007 /* check for foo.*.domain.com against *.domain.com (invalid) */
2008 if (memchr(subject, '.', offset))
2009 return bad_certificate;
2011 /* check if exact match */
2012 if (!strcasecmp(match, wildcard)) {
2018 return bad_certificate;
2021 int tls_certificate_valid_subject(struct TLSCertificate *cert,
2022 const char *subject) {
2025 return certificate_unknown;
2028 int err = tls_certificate_valid_subject_name(cert->subject, subject);
2029 if (err && cert->san) {
2030 for (i = 0; i < cert->san_length; i++) {
2031 err = tls_certificate_valid_subject_name(cert->san[i],
2041 int tls_certificate_is_valid(struct TLSCertificate *cert) {
2043 return certificate_unknown;
2046 char ts[16]; /* YYYYMMDDHHMMSSZ */
2047 time_t t = time(NULL);
2048 struct tm *utc = gmtime(&t);
2051 strftime(ts, sizeof ts, "%Y%m%d%H%M%SZ", utc);
2053 if (strcmp(cert->not_before, ts) > 0) {
2055 ("Certificate is not yet valid, now: %s (validity: %s - %s)\n",
2056 ts, cert->not_before, cert->not_after);
2057 return certificate_expired;
2060 if (strcmp(cert->not_after, ts) < 0) {
2062 ("Expired certificate, now: %s (validity: %s - %s)\n",
2063 ts, cert->not_before, cert->not_after);
2064 return certificate_expired;
2066 DEBUG_PRINT("Valid certificate, now: %s (validity: %s - %s)\n",
2067 ts, cert->not_before,
2073 void tls_certificate_set_copy(unsigned char **member,
2074 const unsigned char *val, int len) {
2082 *member = malloc(len + 1);
2084 memcpy(*member, val, len);
2092 void tls_certificate_set_copy_date(unsigned char *member,
2093 const unsigned char *val, int len) {
2096 if (val[0] >= '5') {
2103 memcpy(member + 2, val, len);
2110 void tls_certificate_set_key(struct TLSCertificate *cert,
2111 const unsigned char *val, int len) {
2112 if (!val[0] && len % 2) {
2116 tls_certificate_set_copy(&cert->pk, val, len);
2122 void tls_certificate_set_priv(struct TLSCertificate *cert,
2123 const unsigned char *val, int len) {
2124 tls_certificate_set_copy(&cert->priv, val, len);
2126 cert->priv_len = len;
2130 void tls_certificate_set_sign_key(struct TLSCertificate *cert,
2131 const unsigned char *val, int len) {
2132 if (!val[0] && len % 2) {
2136 tls_certificate_set_copy(&cert->sign_key, val, len);
2137 if (cert->sign_key) {
2138 cert->sign_len = len;
2142 void tls_certificate_set_exponent(struct TLSCertificate *cert,
2143 const unsigned char *val, int len) {
2144 tls_certificate_set_copy(&cert->exponent, val, len);
2145 if (cert->exponent) {
2146 cert->exponent_len = len;
2150 void tls_certificate_set_serial(struct TLSCertificate *cert,
2151 const unsigned char *val, int len) {
2152 tls_certificate_set_copy(&cert->serial_number, val, len);
2153 if (cert->serial_number) {
2154 cert->serial_len = len;
2158 void tls_certificate_set_algorithm(unsigned int *algorithm,
2159 const unsigned char *val, int len) {
2160 if (len == 7 && _is_oid(val, TLS_EC_PUBLIC_KEY_OID, 7)) {
2161 *algorithm = TLS_EC_PUBLIC_KEY;
2166 if (_is_oid(val, TLS_EC_prime192v1_OID, len)) {
2167 *algorithm = TLS_EC_prime192v1;
2170 if (_is_oid(val, TLS_EC_prime192v2_OID, len)) {
2171 *algorithm = TLS_EC_prime192v2;
2174 if (_is_oid(val, TLS_EC_prime192v3_OID, len)) {
2175 *algorithm = TLS_EC_prime192v3;
2178 if (_is_oid(val, TLS_EC_prime239v1_OID, len)) {
2179 *algorithm = TLS_EC_prime239v1;
2182 if (_is_oid(val, TLS_EC_prime239v2_OID, len)) {
2183 *algorithm = TLS_EC_prime239v2;
2186 if (_is_oid(val, TLS_EC_prime239v3_OID, len)) {
2187 *algorithm = TLS_EC_prime239v3;
2190 if (_is_oid(val, TLS_EC_prime256v1_OID, len)) {
2191 *algorithm = TLS_EC_prime256v1;
2197 (val, TLS_EC_secp224r1_OID, len,
2198 sizeof(TLS_EC_secp224r1_OID) - 1)) {
2199 *algorithm = TLS_EC_secp224r1;
2203 (val, TLS_EC_secp384r1_OID, len,
2204 sizeof(TLS_EC_secp384r1_OID) - 1)) {
2205 *algorithm = TLS_EC_secp384r1;
2209 (val, TLS_EC_secp521r1_OID, len,
2210 sizeof(TLS_EC_secp521r1_OID) - 1)) {
2211 *algorithm = TLS_EC_secp521r1;
2219 if (_is_oid(val, TLS_RSA_SIGN_SHA256_OID, 9)) {
2220 *algorithm = TLS_RSA_SIGN_SHA256;
2224 if (_is_oid(val, TLS_RSA_SIGN_RSA_OID, 9)) {
2225 *algorithm = TLS_RSA_SIGN_RSA;
2229 if (_is_oid(val, TLS_RSA_SIGN_SHA1_OID, 9)) {
2230 *algorithm = TLS_RSA_SIGN_SHA1;
2234 if (_is_oid(val, TLS_RSA_SIGN_SHA512_OID, 9)) {
2235 *algorithm = TLS_RSA_SIGN_SHA512;
2239 if (_is_oid(val, TLS_RSA_SIGN_SHA384_OID, 9)) {
2240 *algorithm = TLS_RSA_SIGN_SHA384;
2244 if (_is_oid(val, TLS_RSA_SIGN_MD5_OID, 9)) {
2245 *algorithm = TLS_RSA_SIGN_MD5;
2250 void tls_destroy_certificate(struct TLSCertificate *cert) {
2253 free(cert->exponent);
2255 free(cert->issuer_country);
2256 free(cert->issuer_state);
2257 free(cert->issuer_location);
2258 free(cert->issuer_entity);
2259 free(cert->issuer_subject);
2260 free(cert->country);
2262 free(cert->location);
2263 free(cert->subject);
2264 for (i = 0; i < cert->san_length; i++) {
2269 free(cert->serial_number);
2271 cert->not_before[0] = 0;
2272 cert->not_after[0] = 0;
2273 free(cert->sign_key);
2275 free(cert->der_bytes);
2277 free(cert->fingerprint);
2282 struct TLSPacket *tls_create_packet(struct TLSContext *context,
2284 unsigned short version,
2285 int payload_size_hint) {
2286 struct TLSPacket *packet = malloc(sizeof *packet);
2291 if (payload_size_hint > 0) {
2292 packet->size = payload_size_hint + 10;
2294 packet->size = TLS_BLOB_INCREMENT;
2296 packet->buf = malloc(packet->size);
2297 memset(packet->buf, 0, packet->size);
2298 packet->context = context;
2304 packet->payload_pos = 6;
2305 packet->len = packet->payload_pos - 1;
2309 packet->buf[0] = type;
2311 /* big endian protocol version */
2312 packet->buf[1] = version >> 8;
2313 packet->buf[2] = version & 0xff;
2314 if (version == TLS_V13) {
2315 packet->buf[2] = 0x04;
2321 void tls_destroy_packet(struct TLSPacket *packet) {
2330 int tls_crypto_create(struct TLSContext *context, int key_length,
2331 unsigned char *localkey,
2332 unsigned char *localiv,
2333 unsigned char *remotekey,
2334 unsigned char *remoteiv) {
2335 if (context->crypto.created) {
2336 if (context->crypto.created == 1) {
2337 cbc_done(&context->crypto.ctx_remote.aes_remote);
2338 cbc_done(&context->crypto.ctx_local.aes_local);
2340 if (context->crypto.created == 2) {
2341 unsigned char dummy_buffer[32];
2342 unsigned long tag_len = 0;
2343 gcm_done(&context->crypto.ctx_remote.
2344 aes_gcm_remote, dummy_buffer,
2346 gcm_done(&context->crypto.ctx_local.
2347 aes_gcm_local, dummy_buffer,
2351 context->crypto.created = 0;
2353 int is_aead = tls_is_aead(context);
2354 int cipherID = find_cipher("aes");
2355 DEBUG_PRINT("Using cipher ID: %x\n", (int) context->cipher);
2357 unsigned int counter = 1;
2359 chacha_keysetup(&context->crypto.ctx_local.chacha_local,
2360 localkey, key_length * 8);
2361 chacha_ivsetup_96bitnonce(&context->crypto.ctx_local.
2362 chacha_local, localiv,
2363 (unsigned char *) &counter);
2365 chacha_keysetup(&context->crypto.ctx_remote.chacha_remote,
2366 remotekey, key_length * 8);
2367 chacha_ivsetup_96bitnonce(&context->crypto.ctx_remote.
2368 chacha_remote, remoteiv,
2369 (unsigned char *) &counter);
2371 context->crypto.created = 3;
2375 gcm_init(&context->crypto.ctx_local.aes_gcm_local,
2376 cipherID, localkey, key_length);
2378 gcm_init(&context->crypto.ctx_remote.aes_gcm_remote,
2379 cipherID, remotekey, key_length);
2382 return TLS_GENERIC_ERROR;
2384 context->crypto.created = 2;
2387 cbc_start(cipherID, localiv, localkey, key_length, 0,
2388 &context->crypto.ctx_local.aes_local);
2390 cbc_start(cipherID, remoteiv, remotekey, key_length, 0,
2391 &context->crypto.ctx_remote.aes_remote);
2394 return TLS_GENERIC_ERROR;
2396 context->crypto.created = 1;
2402 static void tls_crypto_done(struct TLSContext *context) {
2403 unsigned char dummy_buffer[32];
2404 unsigned long tag_len = 0;
2406 switch (context->crypto.created) {
2408 cbc_done(&context->crypto.ctx_remote.aes_remote);
2409 cbc_done(&context->crypto.ctx_local.aes_local);
2412 gcm_done(&context->crypto.ctx_remote.aes_gcm_remote,
2413 dummy_buffer, &tag_len);
2414 gcm_done(&context->crypto.ctx_local.aes_gcm_local,
2415 dummy_buffer, &tag_len);
2418 context->crypto.created = 0;
2421 int tls_packet_append(struct TLSPacket *packet, const unsigned char *buf,
2425 if (!packet || packet->broken) {
2433 unsigned int new_len = packet->len + len;
2435 if (new_len > packet->size) {
2436 packet->size = (new_len / TLS_BLOB_INCREMENT + 1) *
2438 new = TLS_REALLOC(packet->buf, packet->size);
2449 memcpy(packet->buf + packet->len, buf, len);
2450 packet->len = new_len;
2454 int tls_packet_uint8(struct TLSPacket *packet, unsigned char i) {
2455 return tls_packet_append(packet, &i, 1);
2458 int tls_packet_uint16(struct TLSPacket *packet, unsigned short i) {
2459 unsigned short ni = htons(i);
2460 return tls_packet_append(packet, (unsigned char *) &ni, 2);
2463 int tls_packet_uint32(struct TLSPacket *packet, unsigned int i) {
2464 unsigned int ni = htonl(i);
2465 return tls_packet_append(packet, (unsigned char *) &ni, 4);
2468 int tls_packet_uint24(struct TLSPacket *packet, unsigned int i) {
2469 unsigned char buf[3];
2470 buf[0] = (i >> 16) & 0xff;
2471 buf[1] = (i >> 8) & 0xff;
2472 buf[2] = (i >> 0) & 0xff;
2474 return tls_packet_append(packet, buf, 3);
2477 int tls_random(unsigned char *key, int len) {
2479 for (int i = 0; i < len; i++) {
2480 unsigned int v = arc4random() % 0x100;
2485 /* TODO use open and read */
2486 FILE *fp = fopen("/dev/urandom", "r");
2488 int key_len = fread(key, 1, len, fp);
2497 int tls_established(struct TLSContext *context) {
2498 return context && context->connection_status == TLS_CONNECTED;
2501 void tls_read_clear(struct TLSContext *context) {
2503 tls_buffer_free(&context->application_buffer);
2507 struct TLSContext *tls_create_context(int is_server, unsigned short version) {
2508 struct TLSContext zero = {0};
2510 struct TLSContext *context = 0;
2512 if (version == TLS_V13 && !is_server) {
2513 /* TLS 1.3 clients not supported */
2521 context = malloc(sizeof *context);
2527 ver = version - 0x0201;
2531 context->is_server = is_server;
2532 context->version = version;
2533 context->tlsver = ver;
2534 context->hs_index = -1;
2535 /* set up output buffer */
2536 tls_buffer_init(&context->output_buffer, 0);
2537 tls_buffer_init(&context->input_buffer, 0);
2538 tls_buffer_init(&context->cached_handshake, 0);
2539 tls_buffer_init(&context->application_buffer, 0);
2544 struct TLSContext *tls_accept(struct TLSContext *context) {
2545 if (!context || !context->is_server) {
2549 struct TLSContext *child = malloc(sizeof *child);
2551 memset(child, 0, sizeof(struct TLSContext));
2552 child->is_server = 1;
2553 child->is_child = 1;
2554 child->version = context->version;
2555 child->certificates = context->certificates;
2556 child->certificates_count = context->certificates_count;
2557 child->private_key = context->private_key;
2558 child->ec_private_key = context->ec_private_key;
2559 child->root_certificates = context->root_certificates;
2560 child->root_count = context->root_count;
2561 child->default_dhe_p = context->default_dhe_p;
2562 child->default_dhe_g = context->default_dhe_g;
2563 child->curve = context->curve;
2564 child->alpn = context->alpn;
2565 child->alpn_count = context->alpn_count;
2570 int tls_add_alpn(struct TLSContext *context, const char *alpn) {
2573 if (!context || !alpn || !alpn[0]
2574 || (context->is_server && context->is_child)) {
2575 return TLS_GENERIC_ERROR;
2578 int len = strlen(alpn);
2579 if (tls_alpn_contains(context, alpn, len)) {
2583 new = TLS_REALLOC(context->alpn, (context->alpn_count + 1) *
2586 context->alpn = new;
2588 free(context->alpn);
2590 context->alpn_count = 0;
2591 return TLS_NO_MEMORY;
2593 char *alpn_ref = malloc(len + 1);
2594 context->alpn[context->alpn_count] = alpn_ref;
2596 memcpy(alpn_ref, alpn, len);
2598 context->alpn_count++;
2600 return TLS_NO_MEMORY;
2605 int tls_alpn_contains(struct TLSContext *context, const char *alpn,
2606 unsigned char alpn_size) {
2609 if (!context || !alpn || !alpn_size || !context->alpn) {
2613 for (i = 0; i < context->alpn_count; i++) {
2614 const char *alpn_local = context->alpn[i];
2616 int len = strlen(alpn_local);
2617 if (alpn_size == len) {
2618 if (!memcmp(alpn_local, alpn, alpn_size)) {
2628 void tls_destroy_context(struct TLSContext *context) {
2635 if (!context->is_child) {
2636 if (context->certificates) {
2637 for (i = 0; i < context->certificates_count; i++) {
2638 tls_destroy_certificate(context->
2642 if (context->root_certificates) {
2643 for (i = 0; i < context->root_count; i++) {
2644 tls_destroy_certificate(context->
2645 root_certificates[i]);
2647 free(context->root_certificates);
2648 context->root_certificates = NULL;
2650 if (context->private_key) {
2651 tls_destroy_certificate(context->private_key);
2653 if (context->ec_private_key) {
2654 tls_destroy_certificate(context->ec_private_key);
2656 free(context->certificates);
2657 free(context->default_dhe_p);
2658 free(context->default_dhe_g);
2659 if (context->alpn) {
2660 for (i = 0; i < context->alpn_count; i++) {
2661 free(context->alpn[i]);
2663 free(context->alpn);
2667 if (context->client_certificates) {
2668 for (i = 0; i < context->client_certificates_count; i++) {
2669 tls_destroy_certificate(context->
2670 client_certificates[i]);
2672 free(context->client_certificates);
2675 context->client_certificates = NULL;
2676 free(context->master_key);
2677 free(context->premaster_key);
2679 if (context->crypto.created) {
2680 tls_crypto_done(context);
2683 tls_done_hash(context, NULL);
2684 tls_destroy_hash(context);
2686 tls_buffer_free(&context->output_buffer);
2687 tls_buffer_free(&context->input_buffer);
2688 tls_buffer_free(&context->application_buffer);
2689 tls_buffer_free(&context->cached_handshake);
2690 //free(context->cached_handshake);
2693 tls_dhe_free(context);
2694 tls_ecc_dhe_free(context);
2695 free(context->negotiated_alpn);
2696 free(context->finished_key);
2697 free(context->remote_finished_key);
2698 free(context->server_finished_hash);
2702 int tls_cipher_is_ephemeral(struct TLSContext *context) {
2707 switch (context->cipher) {
2708 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2709 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2710 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2711 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
2712 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2713 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
2714 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2716 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2717 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2718 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2719 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2720 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
2721 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2722 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2723 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2724 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2725 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2726 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2727 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2728 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2730 case TLS_AES_128_GCM_SHA256:
2731 case TLS_CHACHA20_POLY1305_SHA256:
2732 case TLS_AES_128_CCM_SHA256:
2733 case TLS_AES_128_CCM_8_SHA256:
2734 case TLS_AES_256_GCM_SHA384:
2743 int tls_is_ecdsa(struct TLSContext *context) {
2748 switch (context->cipher) {
2749 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2750 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2751 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2752 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2753 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2754 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2755 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2759 if (context->ec_private_key) {
2766 static void tls_send_server_key_exchange(struct TLSContext *context,
2768 if (!context->is_server) {
2770 ("CANNOT BUILD SERVER KEY EXCHANGE MESSAGE FOR CLIENTS\n");
2774 struct TLSPacket *packet =
2775 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
2776 tls_packet_uint8(packet, 0x0C);
2777 unsigned char dummy[3];
2778 tls_packet_append(packet, dummy, 3);
2779 int start_len = packet->len;
2781 if (method == KEA_dhe_rsa) {
2782 tls_dhe_create(context);
2784 const char *default_dhe_p = context->default_dhe_p;
2785 const char *default_dhe_g = context->default_dhe_g;
2787 if (!default_dhe_p || !default_dhe_g) {
2788 default_dhe_p = TLS_DH_DEFAULT_P;
2789 default_dhe_g = TLS_DH_DEFAULT_G;
2790 key_size = TLS_DHE_KEY_SIZE / 8;
2792 key_size = strlen(default_dhe_p);
2794 if (tls_dh_make_key(key_size, context->dhe, default_dhe_p,
2795 default_dhe_g, 0, 0)) {
2796 DEBUG_PRINT("ERROR CREATING DHE KEY\n");
2799 context->dhe = NULL;
2800 /* TODO set error */
2804 unsigned char dh_Ys[0xFFF];
2805 unsigned char dh_p[0xFFF];
2806 unsigned char dh_g[0xFFF];
2807 unsigned long dh_p_len = sizeof(dh_p);
2808 unsigned long dh_g_len = sizeof(dh_g);
2809 unsigned long dh_Ys_len = sizeof(dh_Ys);
2811 if (tls_dh_export_pqY
2812 (dh_p, &dh_p_len, dh_g, &dh_g_len, dh_Ys, &dh_Ys_len,
2814 DEBUG_PRINT("ERROR EXPORTING DHE KEY\n");
2816 /* TODO set error */
2820 DEBUG_PRINT("LEN: %lu (%lu, %lu)\n", dh_Ys_len, dh_p_len,
2822 DEBUG_DUMP_HEX_LABEL("DHE PK", dh_Ys, dh_Ys_len);
2823 DEBUG_DUMP_HEX_LABEL("DHE P", dh_p, dh_p_len);
2824 DEBUG_DUMP_HEX_LABEL("DHE G", dh_g, dh_g_len);
2826 tls_packet_uint16(packet, dh_p_len);
2827 tls_packet_append(packet, dh_p, dh_p_len);
2829 tls_packet_uint16(packet, dh_g_len);
2830 tls_packet_append(packet, dh_g, dh_g_len);
2832 tls_packet_uint16(packet, dh_Ys_len);
2833 tls_packet_append(packet, dh_Ys, dh_Ys_len);
2837 } else if (method == KEA_ec_diffie_hellman) {
2838 /* 3 = named curve */
2839 if (!context->curve) {
2840 context->curve = tls_ecc_default_curve;
2842 tls_packet_uint8(packet, 3);
2843 tls_packet_uint16(packet, context->curve->iana);
2844 tls_ecc_dhe_create(context);
2846 ltc_ecc_set_type *dp =
2847 (ltc_ecc_set_type *) & context->curve->dp;
2849 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
2851 free(context->ecc_dhe);
2852 context->ecc_dhe = NULL;
2853 DEBUG_PRINT("Error generating ECC key\n");
2855 /* TODO set error */
2858 unsigned char out[TLS_MAX_RSA_KEY];
2859 unsigned long out_len = TLS_MAX_RSA_KEY;
2860 if (ecc_ansi_x963_export(context->ecc_dhe, out, &out_len)) {
2861 DEBUG_PRINT("Error exporting ECC key\n");
2866 tls_packet_uint8(packet, out_len);
2867 tls_packet_append(packet, out, out_len);
2871 DEBUG_PRINT("Unsupported ephemeral method: %i\n", method);
2876 unsigned int params_len = packet->len - start_len;
2877 unsigned int message_len =
2878 params_len + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
2879 unsigned char *message = malloc(message_len);
2881 unsigned char out[TLS_MAX_RSA_KEY];
2882 unsigned long out_len = TLS_MAX_RSA_KEY;
2886 hash_algorithm = sha256;
2888 if (tls_is_ecdsa(context)) {
2889 hash_algorithm = sha512;
2890 tls_packet_uint8(packet, hash_algorithm);
2891 tls_packet_uint8(packet, ecdsa);
2893 tls_packet_uint8(packet, hash_algorithm);
2894 tls_packet_uint8(packet, rsa_sign);
2897 memcpy(message, context->remote_random,
2898 TLS_CLIENT_RANDOM_SIZE);
2899 memcpy(message + TLS_CLIENT_RANDOM_SIZE, context->local_random,
2900 TLS_SERVER_RANDOM_SIZE);
2901 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
2902 TLS_SERVER_RANDOM_SIZE, packet->buf +
2903 start_len, params_len);
2904 if (tls_is_ecdsa(context)) {
2905 if (sign_ecdsa(context, hash_algorithm, message,
2906 message_len, out, &out_len) ==
2909 ("Signing OK! (ECDSA, length %lu)\n",
2911 tls_packet_uint16(packet, out_len);
2912 tls_packet_append(packet, out, out_len);
2915 if (sign_rsa(context, hash_algorithm, message, message_len,
2916 out, &out_len) == 1) {
2917 DEBUG_PRINT("Signing OK! (length %lu)\n", out_len);
2918 tls_packet_uint16(packet, out_len);
2919 tls_packet_append(packet, out, out_len);
2923 if (!packet->broken && packet->buf) {
2924 tls_set_packet_length(packet, packet->len - start_len);
2926 tls_packet_update(packet);
2927 tls_queue_packet(packet);
2932 void _private_tls_set_session_id(struct TLSContext *context) {
2933 if (context->tlsver == TLS_VERSION13
2934 && context->session_size == TLS_MAX_SESSION_ID) {
2938 if (tls_random(context->session, TLS_MAX_SESSION_ID)) {
2939 context->session_size = TLS_MAX_SESSION_ID;
2941 context->session_size = 0;
2946 struct TLSPacket *tls_certificate_request(struct TLSContext *context) {
2947 if (!context || !context->is_server) {
2951 unsigned short packet_version = context->version;
2952 struct TLSPacket *packet =
2953 tls_create_packet(context, TLS_HANDSHAKE, packet_version, 0);
2959 /* cert request and size placeholder */
2960 unsigned char dummy[] = { 0x0d, 0, 0, 0 };
2961 tls_packet_append(packet, dummy, sizeof dummy);
2963 int start_len = packet->len;
2965 if (context->tlsver == TLS_VERSION13) {
2966 /* certificate request context */
2967 tls_packet_uint8(packet, 0);
2969 tls_packet_uint16(packet, 18);
2970 /* signature algorithms */
2971 tls_packet_uint16(packet, 0x0D);
2972 tls_packet_uint16(packet, 14);
2973 tls_packet_uint16(packet, 12);
2976 tls_packet_uint16(packet, 0x0401);
2978 tls_packet_uint16(packet, 0x0501);
2980 tls_packet_uint16(packet, 0x0601);
2983 /* ecdsa_secp256r1_sha256 */
2984 tls_packet_uint16(packet, 0x0403);
2985 /* ecdsa_secp384r1_sha384 */
2986 tls_packet_uint16(packet, 0x0503);
2987 /* ecdsa_secp521r1_sha512 */
2988 tls_packet_uint16(packet, 0x0604);
2989 /* rsa_pss_rsae_sha256 */
2990 tls_packet_uint16(packet, 0x0804);
2991 /* rsa_pss_rsae_sha384 */
2992 tls_packet_uint16(packet, 0x0805);
2993 /* rsa_pss_rsae_sha512 */
2994 tls_packet_uint16(packet, 0x0806);
2996 tls_packet_uint8(packet, 1);
2997 tls_packet_uint8(packet, rsa_sign);
2998 if (context->version == TLS_V12) {
2999 /* 10 pairs or 2 bytes */
3000 tls_packet_uint16(packet, 10);
3001 tls_packet_uint8(packet, sha256);
3002 tls_packet_uint8(packet, rsa);
3003 tls_packet_uint8(packet, sha1);
3004 tls_packet_uint8(packet, rsa);
3005 tls_packet_uint8(packet, sha384);
3006 tls_packet_uint8(packet, rsa);
3007 tls_packet_uint8(packet, sha512);
3008 tls_packet_uint8(packet, rsa);
3009 tls_packet_uint8(packet, md5);
3010 tls_packet_uint8(packet, rsa);
3012 /* no DistinguishedName yet */
3013 tls_packet_uint16(packet, 0);
3015 if (!packet->broken) {
3016 tls_set_packet_length(packet, packet->len - start_len);
3018 tls_packet_update(packet);
3022 int tls_parse_key_share(struct TLSContext *context, const unsigned char *buf,
3025 struct ECCCurveParameters *curve = 0;
3026 struct DHKey *dhkey = 0;
3027 int dhe_key_size = 0;
3028 const unsigned char *buffer = NULL;
3029 unsigned char *out2;
3030 unsigned long out_size;
3033 while (buf_len >= 4) {
3034 uint16_t named_group = get16(&buf[i]);
3038 key_size = get16(&buf[i]);
3042 if (key_size > buf_len) {
3043 return TLS_BROKEN_PACKET;
3046 switch (named_group) {
3050 DEBUG_PRINT("KEY SHARE => secp256r1\n");
3057 DEBUG_PRINT("KEY SHARE => secp384r1\n");
3065 if (key_size != 32) {
3067 ("INVALID x25519 KEY SIZE (%i)\n",
3071 curve = &curve25519;
3073 DEBUG_PRINT("KEY SHARE => x25519\n");
3083 dhe_key_size = 2048;
3087 dhe_key_size = 3072;
3091 dhe_key_size = 4096;
3095 dhe_key_size = 6144;
3099 dhe_key_size = 8192;
3103 buf_len -= key_size;
3107 context->curve = curve;
3109 if (curve == &curve25519) {
3110 if (!tls_random(context->local_random,
3111 TLS_SERVER_RANDOM_SIZE)) {
3112 return TLS_GENERIC_ERROR;
3115 unsigned char secret[32];
3116 static const unsigned char basepoint[32] = { 9 };
3118 tls_random(secret, 32);
3124 /* use finished key to store public key */
3125 free(context->finished_key);
3126 context->finished_key = malloc(32);
3127 if (!context->finished_key) {
3128 return TLS_GENERIC_ERROR;
3131 x25519(context->finished_key, secret, basepoint);
3133 free(context->premaster_key);
3134 context->premaster_key = malloc(32);
3136 if (!context->premaster_key) {
3137 return TLS_GENERIC_ERROR;
3140 x25519(context->premaster_key, secret, buffer);
3141 context->premaster_key_len = 32;
3146 tls_ecc_dhe_create(context);
3147 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&context->curve->dp;
3149 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
3151 free(context->ecc_dhe);
3152 context->ecc_dhe = NULL;
3153 DEBUG_PRINT("Error generating ECC DHE key\n");
3154 return TLS_GENERIC_ERROR;
3157 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE)) {
3158 return TLS_GENERIC_ERROR;
3162 memset(&client_key, 0, sizeof client_key);
3163 if (ecc_ansi_x963_import_ex
3164 (buffer, key_size, &client_key, dp)) {
3165 DEBUG_PRINT("Error importing ECC DHE key\n");
3166 return TLS_GENERIC_ERROR;
3168 out2 = malloc(key_size);
3169 out_size = key_size;
3171 int err = ecc_shared_secret(context->ecc_dhe, &client_key,
3173 ecc_free(&client_key);
3176 DEBUG_PRINT("ECC DHE DECRYPT ERROR %i\n", err);
3178 return TLS_GENERIC_ERROR;
3181 DEBUG_PRINT("OUT_SIZE: %lu\n", out_size);
3182 DEBUG_DUMP_HEX_LABEL("ECC DHE", out2, out_size);
3184 free(context->premaster_key);
3185 context->premaster_key = out2;
3186 context->premaster_key_len = out_size;
3189 tls_dhe_create(context);
3190 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE))
3192 return TLS_GENERIC_ERROR;
3195 if (tls_dh_make_key(dhe_key_size / 8, context->dhe,
3196 (const char *)dhkey->p, (const char *)dhkey->g, 0, 0)) {
3198 context->dhe = NULL;
3199 DEBUG_PRINT("Error generating DHE key\n");
3200 return TLS_GENERIC_ERROR;
3203 unsigned int dhe_out_size;
3204 out2 = tls_decrypt_dhe(context, buffer, key_size,
3207 DEBUG_PRINT("Error generating DHE shared key\n");
3208 return TLS_GENERIC_ERROR;
3211 free(context->premaster_key);
3212 context->premaster_key = out2;
3213 context->premaster_key_len = dhe_out_size;
3215 context->dhe->iana = dhkey->iana;
3219 DEBUG_PRINT("NO COMMON KEY SHARE SUPPORTED\n");
3220 return TLS_NO_COMMON_CIPHER;
3223 int tls_parse_certificate(struct TLSContext *context,
3224 const unsigned char *buf, int buf_len,
3228 return TLS_NEED_MORE_DATA;
3231 int size = get24(buf);
3233 /* not enough data, so just consume all of it */
3238 res += 3; /* skip over the size field */
3240 if (context->tlsver == TLS_VERSION13) {
3241 int context_size = buf[res];
3245 res += context_size;
3249 if (buf_len - res < size) {
3250 return TLS_NEED_MORE_DATA;
3254 int valid_certificate = 0;
3257 if (buf_len - res < 3) {
3258 return TLS_NEED_MORE_DATA;
3260 int certificate_size = get24(buf+res);
3262 if (buf_len - res < certificate_size) {
3263 return TLS_NEED_MORE_DATA;
3266 int certificates_in_chain = 0;
3268 unsigned int remaining = certificate_size;
3270 if (remaining <= 3) {
3273 certificates_in_chain++;
3274 unsigned int certificate_size2 = get24(buf+res2);
3277 if (certificate_size2 > remaining) {
3279 ("Invalid certificate size (%i from %i bytes remaining)\n",
3280 certificate_size2, remaining);
3283 remaining -= certificate_size2;
3285 struct TLSCertificate *cert = asn1_parse(context,
3291 if (certificate_size2) {
3293 malloc(certificate_size2);
3302 /* valid certificate */
3305 valid_certificate = 1;
3308 TLS_REALLOC(context->
3309 client_certificates,
3311 client_certificates_count
3320 client_certificates);
3322 client_certificates =
3324 return TLS_NO_MEMORY;
3327 context->client_certificates = new;
3330 [context->client_certificates_count]
3333 client_certificates_count++;
3337 TLS_REALLOC(context->
3349 context->certificates = 0;
3350 return TLS_NO_MEMORY;
3352 context->certificates = new;
3353 context->certificates[context->
3356 context->certificates_count++;
3357 if ((cert->pk) || (cert->priv))
3358 valid_certificate = 1;
3359 else if (!context->is_server)
3360 valid_certificate = 1;
3363 res2 += certificate_size2;
3365 if (context->tlsver == TLS_VERSION13) {
3366 if (remaining >= 2) {
3367 /* ignore extensions */
3369 uint16_t size = get16(&buf[res2]);
3370 if (size && size >= remaining) {
3376 } while (remaining > 0);
3378 DEBUG_PRINT("Extra %i bytes after certificate\n",
3381 size -= certificate_size + 3;
3382 res += certificate_size;
3384 if (!valid_certificate) {
3386 return TLS_UNSUPPORTED_CERTIFICATE;
3388 if (res != buf_len) {
3389 DEBUG_PRINT("Warning: %i bytes read from %i byte buffer\n",
3390 (int) res, (int) buf_len);
3395 static int parse_dh( const unsigned char *buf, int buf_len, const unsigned char
3396 **out, int *out_size) {
3401 return TLS_NEED_MORE_DATA;
3403 uint16_t size = get16(buf);
3405 if (buf_len - res < size) {
3406 return TLS_NEED_MORE_DATA;
3408 DEBUG_DUMP_HEX(&buf[res], size);
3415 static int tls_parse_random(struct TLSContext *context,
3416 const unsigned char *buf, int buf_len) {
3418 int ephemeral = tls_cipher_is_ephemeral(context);
3420 if (ephemeral == 2) {
3422 return TLS_NEED_MORE_DATA;
3428 return TLS_NEED_MORE_DATA;
3434 if (buf_len - res < size) {
3435 return TLS_NEED_MORE_DATA;
3437 unsigned int out_len = 0;
3438 unsigned char *random = NULL;
3439 switch (ephemeral) {
3441 random = tls_decrypt_dhe(context, &buf[res], size, &out_len,
3445 random = tls_decrypt_ecc_dhe(context, &buf[res], size,
3449 random = decrypt_rsa(context, &buf[res], size,
3453 if (random && out_len > 2) {
3454 /* *(unsigned short *)&random[0] = htons(context->version); */
3455 DEBUG_DUMP_HEX_LABEL("PRE MASTER KEY", random, out_len);
3456 free(context->premaster_key);
3457 context->premaster_key = random;
3458 context->premaster_key_len = out_len;
3459 tls_compute_key(context, 48);
3468 static const unsigned char *parse_signature(const unsigned char *buf, int
3469 buf_len, int *hash_algorithm, int *sign_algorithm, int
3470 *sig_size, int *offset) {
3475 *hash_algorithm = _md5_sha1;
3476 *sign_algorithm = rsa_sign;
3478 *hash_algorithm = buf[res];
3480 *sign_algorithm = buf[res];
3482 uint16_t size = get16(&buf[res]);
3484 if (buf_len - res < size) {
3487 DEBUG_DUMP_HEX(&buf[res], size);
3489 *offset = res + size;
3493 int tls_parse_server_key_exchange(struct TLSContext *context,
3494 const unsigned char *buf, int buf_len) {
3498 return TLS_NEED_MORE_DATA;
3500 int size = get24(buf);
3502 const unsigned char *packet_ref = buf + res;
3503 if (buf_len - res < size) {
3504 return TLS_NEED_MORE_DATA;
3511 unsigned char has_ds_params = 0;
3513 const struct ECCCurveParameters *curve = NULL;
3514 const unsigned char *pk_key = NULL;
3515 int ephemeral = tls_cipher_is_ephemeral(context);
3517 if (ephemeral == 1) {
3520 if (buf[res++] != 3) {
3522 /* any other method is not supported */
3525 if (buf_len - res < 3) {
3526 return TLS_NEED_MORE_DATA;
3528 int iana_n = get16(&buf[res]);
3530 key_size = buf[res];
3532 if (buf_len - res < key_size) {
3533 return TLS_NEED_MORE_DATA;
3535 DEBUG_PRINT("IANA CURVE NUMBER: %i\n", iana_n);
3559 DEBUG_PRINT("UNSUPPORTED CURVE\n");
3560 return TLS_GENERIC_ERROR;
3564 context->curve = curve;
3568 const unsigned char *dh_p = NULL;
3570 const unsigned char *dh_g = NULL;
3572 const unsigned char *dh_Ys = NULL;
3575 if (has_ds_params) {
3576 DEBUG_PRINT(" dh_p: ");
3577 dh_res = parse_dh(&buf[res], buf_len - res, &dh_p, &dh_p_len);
3579 return TLS_BROKEN_PACKET;
3584 DEBUG_PRINT(" dh_q: ");
3585 dh_res = parse_dh(&buf[res], buf_len - res, &dh_g, &dh_g_len);
3588 return TLS_BROKEN_PACKET;
3593 DEBUG_PRINT(" dh_Ys: ");
3594 dh_res = parse_dh(&buf[res], buf_len - res, &dh_Ys,
3598 return TLS_BROKEN_PACKET;
3606 int packet_size = res - 3;
3608 DEBUG_PRINT(" SIGNATURE (%i/%i/%i): ", packet_size,
3610 const unsigned char *signature =
3611 parse_signature(&buf[res], buf_len - res, &hash_algorithm,
3612 &sign_algorithm, &sign_size, &offset);
3614 if (sign_size <= 0 || !signature) {
3615 return TLS_BROKEN_PACKET;
3618 /* check signature */
3619 unsigned int message_len =
3620 packet_size + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
3621 unsigned char *message = malloc(message_len);
3623 memcpy(message, context->local_random, TLS_CLIENT_RANDOM_SIZE);
3624 memcpy(message + TLS_CLIENT_RANDOM_SIZE,
3625 context->remote_random, TLS_SERVER_RANDOM_SIZE);
3626 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
3627 TLS_SERVER_RANDOM_SIZE, packet_ref, packet_size);
3628 if (tls_is_ecdsa(context)) {
3629 if (tls_verify_ecdsa
3630 (context, hash_algorithm, signature, sign_size,
3631 message, message_len, NULL) != 1) {
3633 ("ECC Server signature FAILED!\n");
3635 return TLS_BROKEN_PACKET;
3639 if (verify_rsa(context, hash_algorithm, signature,
3641 message_len) != 1) {
3642 DEBUG_PRINT("Server signature FAILED!\n");
3644 return TLS_BROKEN_PACKET;
3650 if (buf_len - res) {
3651 DEBUG_PRINT("EXTRA %i BYTES AT THE END OF MESSAGE\n",
3653 DEBUG_DUMP_HEX(&buf[res], buf_len - res);
3657 if (ephemeral == 1) {
3658 tls_dhe_create(context);
3659 DEBUG_DUMP_HEX_LABEL("DHP", dh_p, dh_p_len);
3660 DEBUG_DUMP_HEX_LABEL("DHG", dh_g, dh_g_len);
3661 int dhe_key_size = dh_p_len;
3662 if (dh_g_len > dh_p_len) {
3663 dhe_key_size = dh_g_len;
3666 if (tls_dh_make_key(dhe_key_size, context->dhe, (const char *)
3667 dh_p, (const char *) dh_g, dh_p_len,
3669 DEBUG_PRINT("ERROR CREATING DHE KEY\n");
3671 context->dhe = NULL;
3672 return TLS_GENERIC_ERROR;
3675 unsigned int dh_key_size = 0;
3676 unsigned char *key = tls_decrypt_dhe(context, dh_Ys, dh_Ys_len,
3678 DEBUG_DUMP_HEX_LABEL("DH COMMON SECRET", key, dh_key_size);
3679 if (key && dh_key_size) {
3680 free(context->premaster_key);
3681 context->premaster_key = key;
3682 context->premaster_key_len = dh_key_size;
3684 } else if (ephemeral == 2 && curve && pk_key && key_size) {
3685 tls_ecc_dhe_create(context);
3687 ltc_ecc_set_type *dp = (ltc_ecc_set_type *) & curve->dp;
3689 (NULL, find_prng("sprng"), context->ecc_dhe, dp)) {
3690 free(context->ecc_dhe);
3691 context->ecc_dhe = NULL;
3692 DEBUG_PRINT("Error generating ECC key\n");
3693 return TLS_GENERIC_ERROR;
3696 free(context->premaster_key);
3697 context->premaster_key_len = 0;
3699 unsigned int out_len = 0;
3700 context->premaster_key =
3701 tls_decrypt_ecc_dhe(context, pk_key, key_size,
3703 if (context->premaster_key) {
3704 context->premaster_key_len = out_len;
3711 int tls_parse_client_key_exchange(struct TLSContext *context,
3712 const unsigned char *buf, int buf_len) {
3713 if (context->connection_status != 1) {
3715 ("UNEXPECTED CLIENT KEY EXCHANGE MESSAGE (connections status: %i)\n",
3716 (int) context->connection_status);
3717 return TLS_UNEXPECTED_MESSAGE;
3723 return TLS_NEED_MORE_DATA;
3725 int size = get24(buf);
3728 if (buf_len - res < size) {
3729 return TLS_NEED_MORE_DATA;
3736 dh_res = tls_parse_random(context, &buf[res], size);
3738 DEBUG_PRINT("broken key\n");
3739 return TLS_BROKEN_PACKET;
3744 context->connection_status = 2;
3748 static int tls_parse_server_hello_done(const unsigned char *buf, int buf_len) {
3751 return TLS_NEED_MORE_DATA;
3753 int size = get24(buf);
3756 if (buf_len - res < size) {
3757 return TLS_NEED_MORE_DATA;
3765 int tls_parse_finished(struct TLSContext *context,
3766 const unsigned char *buf, int buf_len,
3767 unsigned int *write_packets) {
3768 if (context->connection_status < 2
3769 || context->connection_status == TLS_CONNECTED) {
3770 DEBUG_PRINT("UNEXPECTED FINISHED MESSAGE\n");
3771 return TLS_UNEXPECTED_MESSAGE;
3777 return TLS_NEED_MORE_DATA;
3779 int size = get24(buf);
3782 if (size < TLS_MIN_FINISHED_OPAQUE_LEN) {
3783 DEBUG_PRINT("Invalid finished packet size: %i\n", size);
3784 return TLS_BROKEN_PACKET;
3787 if (buf_len - res < size) {
3788 return TLS_NEED_MORE_DATA;
3791 unsigned char hash[TLS_MAX_SHA_SIZE];
3792 unsigned int hash_len = tls_get_hash(context, hash);
3794 if (context->tlsver == TLS_VERSION13) {
3795 unsigned char hash_out[TLS_MAX_SHA_SIZE];
3796 unsigned long out_size = TLS_MAX_SHA_SIZE;
3797 if (!context->remote_finished_key || !hash_len) {
3799 ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
3800 return TLS_NOT_VERIFIED;
3803 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
3804 DEBUG_DUMP_HEX_LABEL("HS FINISH", context->remote_finished_key,
3807 out_size = hash_len;
3809 hmac_init(&hmac, tls_get_hash_idx(context),
3810 context->remote_finished_key, hash_len);
3811 hmac_process(&hmac, hash, hash_len);
3812 hmac_done(&hmac, hash_out, &out_size);
3814 if (size != (int)out_size || memcmp(hash_out, &buf[res], size)) {
3816 ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3817 (int) context->local_sequence_number,
3818 (int) context->remote_sequence_number);
3819 DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3821 DEBUG_DUMP_HEX_LABEL("VERIFY", hash_out, out_size);
3822 return TLS_NOT_VERIFIED;
3824 if (context->is_server) {
3825 context->connection_status = TLS_CONNECTED;
3827 _private_tls13_key(context, 0);
3828 context->local_sequence_number = 0;
3829 context->remote_sequence_number = 0;
3832 /* TODO client verify */
3835 unsigned char *out = malloc(size);
3837 DEBUG_PRINT("Error in malloc (%i bytes)\n",
3839 return TLS_NO_MEMORY;
3842 /* server verifies client's message */
3843 if (context->is_server) {
3844 tls_prf(context, out, size,
3845 context->master_key,
3846 context->master_key_len,
3848 "client finished", 15, hash,
3851 tls_prf(context, out, size,
3852 context->master_key,
3853 context->master_key_len,
3855 "server finished", 15, hash,
3859 if (memcmp(out, &buf[res], size)) {
3862 ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3863 (int) context->local_sequence_number,
3864 (int) context->remote_sequence_number);
3865 DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3867 DEBUG_DUMP_HEX_LABEL("VERIFY", out, size);
3868 return TLS_NOT_VERIFIED;
3873 if (context->is_server) {
3876 context->connection_status = TLS_CONNECTED;
3879 // fprintf(stderr, "set conn status = %d\n", context->connection_status);
3886 int tls_parse_verify_tls13(struct TLSContext *context,
3887 const unsigned char *buf, int buf_len) {
3889 return TLS_NEED_MORE_DATA;
3891 int size = get24(buf);
3897 unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
3898 int signing_data_len;
3900 /* first 64 bytes to 0x20 (32) */
3901 memset(signing_data, 0x20, 64);
3902 /* context string 33 bytes */
3903 if (context->is_server) {
3904 memcpy(signing_data + 64,
3905 "TLS 1.3, server CertificateVerify", 33);
3907 memcpy(signing_data + 64,
3908 "TLS 1.3, client CertificateVerify", 33);
3911 /* a single 0 byte separator */
3912 signing_data[97] = 0;
3913 signing_data_len = 98;
3915 signing_data_len += tls_get_hash(context, signing_data + 98);
3916 DEBUG_DUMP_HEX_LABEL("signature data", signing_data, signing_data_len);
3917 uint16_t signature = get16(&buf[3]);
3918 uint16_t signature_size = get16(&buf[5]);
3920 if (buf_len < size + 7) {
3921 return TLS_NEED_MORE_DATA;
3923 switch (signature) {
3925 /* secp256r1 + sha256 */
3927 tls_verify_ecdsa(context, sha256, buf + 7,
3928 signature_size, signing_data,
3933 /* secp384r1 + sha384 */
3934 valid = tls_verify_ecdsa(context, sha384, buf + 7,
3935 signature_size, signing_data,
3936 signing_data_len, &secp384r1);
3939 /* secp521r1 + sha512 */
3940 valid = tls_verify_ecdsa(context, sha512, buf + 7,
3941 signature_size, signing_data,
3942 signing_data_len, &secp521r1);
3945 valid = verify_rsa(context, sha256, buf + 7,
3946 signature_size, signing_data,
3950 DEBUG_PRINT("Unsupported signature: %x\n",
3952 return TLS_UNSUPPORTED_CERTIFICATE;
3955 DEBUG_PRINT("Signature FAILED!\n");
3956 return TLS_DECRYPTION_FAILED;
3961 int tls_parse_verify(struct TLSContext *context, const unsigned char *buf,
3963 if (context->tlsver == TLS_VERSION13) {
3964 return tls_parse_verify_tls13(context, buf, buf_len);
3968 return TLS_BAD_CERTIFICATE;
3971 int bytes_to_follow = get24(buf);
3973 if (buf_len - 3 < bytes_to_follow) {
3974 return TLS_BAD_CERTIFICATE;
3979 unsigned int hash = buf[3];
3980 unsigned int algorithm = buf[4];
3981 if (algorithm != rsa) {
3982 return TLS_UNSUPPORTED_CERTIFICATE;
3984 uint16_t size = get16(&buf[5]);
3985 if (bytes_to_follow - 4 < size) {
3986 return TLS_BAD_CERTIFICATE;
3988 DEBUG_PRINT("ALGORITHM %i/%i (%i)\n", hash, algorithm, (int) size);
3989 DEBUG_DUMP_HEX_LABEL("VERIFY", &buf[7], bytes_to_follow - 7);
3991 res = verify_rsa(context, hash, &buf[7], size,
3992 context->cached_handshake.buffer,
3993 context->cached_handshake.len);
3995 tls_buffer_free(&context->cached_handshake);
3997 DEBUG_PRINT("Signature OK\n");
3998 context->client_verified = 1;
4000 DEBUG_PRINT("Signature FAILED\n");
4001 context->client_verified = 0;
4006 /* TODO This is actually a parse a handshake message */
4007 int tls_parse_payload(struct TLSContext *context, const unsigned char *buf,
4010 int orig_len = buf_len;
4013 if (context->connection_status == TLS_CONNECTED) {
4014 if (context->version == TLS_V13) {
4015 tls_alert(context, 1, unexpected_message);
4017 tls_alert(context, 0, no_renegotiation_RESERVED);
4023 while (buf_len >= 4 && !context->critical_error) {
4024 int payload_res = 0;
4025 //unsigned char update_hash = 1;
4026 unsigned char type = buf[0];
4027 unsigned int write_packets = 0;
4028 int certificate_verify_alert = no_error;
4029 int payload_size = get24(buf+1) + 3;
4030 if (buf_len < payload_size + 1) {
4031 return TLS_NEED_MORE_DATA;
4036 CHECK_HANDSHAKE_STATE(context, 0, 1);
4038 (" => HELLO REQUEST (RENEGOTIATION?)\n");
4039 if (context->is_server) {
4040 payload_res = TLS_UNEXPECTED_MESSAGE;
4042 if (context->connection_status == TLS_CONNECTED) {
4044 payload_res = TLS_NO_RENEGOTIATION;
4046 payload_res = TLS_UNEXPECTED_MESSAGE;
4053 CHECK_HANDSHAKE_STATE(context, 1, 1);
4054 DEBUG_PRINT(" => CLIENT HELLO\n");
4055 if (context->is_server) {
4057 tls_parse_client_hello(context,
4062 payload_res = TLS_UNEXPECTED_MESSAGE;
4067 CHECK_HANDSHAKE_STATE(context, 2, 1);
4068 DEBUG_PRINT(" => SERVER HELLO\n");
4069 if (context->is_server) {
4070 payload_res = TLS_UNEXPECTED_MESSAGE;
4073 payload_res = tls_parse_server_hello(context, buf + 1, payload_size);
4077 /* hello verify request */
4078 DEBUG_PRINT(" => VERIFY REQUEST\n");
4079 CHECK_HANDSHAKE_STATE(context, 3, 1);
4080 payload_res = TLS_UNEXPECTED_MESSAGE;
4084 CHECK_HANDSHAKE_STATE(context, 4, 1);
4085 DEBUG_PRINT(" => CERTIFICATE\n");
4086 if (context->tlsver == TLS_VERSION13) {
4087 if (context->connection_status == 2) {
4089 tls_parse_certificate(context,
4094 if (context->is_server) {
4095 if (context->certificate_verify && context->client_certificates_count) {
4096 certificate_verify_alert
4098 context->certificate_verify(context,
4099 context->client_certificates,
4100 context->client_certificates_count);
4102 /* empty certificates are permitted for client */
4103 if (payload_res <= 0) {
4109 TLS_UNEXPECTED_MESSAGE;
4111 if (context->connection_status == 1) {
4112 if (context->is_server) {
4113 /* client certificate */
4115 tls_parse_certificate(context,
4119 if (context->certificate_verify && context->client_certificates_count) {
4120 certificate_verify_alert =
4121 context->certificate_verify
4124 client_certificates,
4126 client_certificates_count);
4128 /* empty certificates are permitted for client */
4129 if (payload_res <= 0)
4133 tls_parse_certificate(context,
4137 if (certificate_verify && context->certificates_count) {
4138 certificate_verify_alert =
4139 context->certificate_verify
4141 context->certificates,
4143 certificates_count);
4147 payload_res = TLS_UNEXPECTED_MESSAGE;
4151 /* server key exchange */
4152 CHECK_HANDSHAKE_STATE(context, 5, 1);
4153 DEBUG_PRINT(" => SERVER KEY EXCHANGE\n");
4154 if (context->is_server) {
4155 payload_res = TLS_UNEXPECTED_MESSAGE;
4158 tls_parse_server_key_exchange(context,
4164 /* certificate request */
4165 CHECK_HANDSHAKE_STATE(context, 6, 1);
4166 /* server to client */
4167 if (context->is_server) {
4168 payload_res = TLS_UNEXPECTED_MESSAGE;
4170 context->client_verified = 2;
4172 DEBUG_PRINT(" => CERTIFICATE REQUEST\n");
4175 /* server hello done */
4176 CHECK_HANDSHAKE_STATE(context, 7, 1);
4177 DEBUG_PRINT(" => SERVER HELLO DONE\n");
4178 if (context->is_server) {
4179 payload_res = TLS_UNEXPECTED_MESSAGE;
4182 tls_parse_server_hello_done(
4185 if (payload_res > 0) {
4191 /* certificate verify */
4192 CHECK_HANDSHAKE_STATE(context, 8, 1);
4193 DEBUG_PRINT(" => CERTIFICATE VERIFY\n");
4194 if (context->connection_status == 2) {
4196 tls_parse_verify(context, buf + 1,
4199 payload_res = TLS_UNEXPECTED_MESSAGE;
4203 /* client key exchange */
4204 CHECK_HANDSHAKE_STATE(context, 9, 1);
4205 DEBUG_PRINT(" => CLIENT KEY EXCHANGE\n");
4206 if (context->is_server) {
4208 tls_parse_client_key_exchange(context,
4212 payload_res = TLS_UNEXPECTED_MESSAGE;
4217 tls_buffer_free(&context->cached_handshake);
4218 CHECK_HANDSHAKE_STATE(context, 10, 1);
4219 DEBUG_PRINT(" => FINISHED\n");
4220 payload_res = tls_parse_finished(context,
4221 buf + 1, payload_size,
4223 if (payload_res > 0) {
4224 memset(context->hs_messages, 0,
4225 sizeof(context->hs_messages));
4230 (" => NOT UNDERSTOOD PAYLOAD TYPE: %x\n",
4232 return TLS_NOT_UNDERSTOOD;
4235 //if (type != 0x00 && update_hash) {
4237 tls_update_hash(context, buf, payload_size + 1);
4240 if (certificate_verify_alert != no_error) {
4241 tls_alert(context, 1, certificate_verify_alert);
4242 context->critical_error = 1;
4245 if (payload_res < 0) {
4246 switch (payload_res) {
4247 case TLS_UNEXPECTED_MESSAGE:
4248 tls_alert(context, 1, unexpected_message);
4250 case TLS_COMPRESSION_NOT_SUPPORTED:
4251 tls_alert(context, 1, decompression_failure_RESERVED);
4253 case TLS_BROKEN_PACKET:
4254 tls_alert(context, 1, decode_error);
4257 tls_alert(context, 1, internal_error);
4259 case TLS_NOT_VERIFIED:
4260 tls_alert(context, 1, bad_record_mac);
4262 case TLS_BAD_CERTIFICATE:
4263 if (context->is_server) {
4264 /* bad client certificate, continue */
4265 tls_alert(context, 0, bad_certificate);
4268 tls_alert(context, 1, bad_certificate);
4271 case TLS_UNSUPPORTED_CERTIFICATE:
4272 tls_alert(context, 1, unsupported_certificate);
4274 case TLS_NO_COMMON_CIPHER:
4275 tls_alert(context, 1, insufficient_security);
4277 case TLS_NOT_UNDERSTOOD:
4278 tls_alert(context, 1, internal_error);
4280 case TLS_NO_RENEGOTIATION:
4281 tls_alert(context, 0, no_renegotiation_RESERVED);
4284 case TLS_DECRYPTION_FAILED:
4285 tls_alert(context, 1, decryption_failed_RESERVED);
4288 if (payload_res < 0) {
4293 if (certificate_verify_alert != no_error) {
4294 payload_res = TLS_BAD_CERTIFICATE;
4297 /* except renegotiation */
4298 struct TLSPacket *pkt;
4299 switch (write_packets) {
4301 if (context->client_verified == 2) {
4302 tls_send_certificate(context);
4303 context->client_verified = 0;
4306 /* client handshake */
4307 tls_send_client_key_exchange(context);
4308 tls_send_change_cipher_spec(context);
4310 context->cipher_spec_set = 1;
4311 context->local_sequence_number = 0;
4313 tls_send_finished(context);
4315 context->cipher_spec_set = 0;
4318 /* server handshake */
4319 DEBUG_PRINT("<= SENDING SERVER HELLO\n");
4320 if (context->connection_status == 3) {
4321 context->connection_status = 2;
4323 (tls_build_hello(context, 0));
4324 tls_send_change_cipher_spec(context);
4325 _private_tls13_key(context, 1);
4326 context->cipher_spec_set = 1;
4328 ("<= SENDING ENCRYPTED EXTENSIONS\n");
4329 tls_send_encrypted_extensions(context);
4331 if (context->request_client_certificate) {
4333 ("<= SENDING CERTIFICATE REQUEST\n");
4335 (tls_certificate_request
4339 tls_send_certificate(context);
4341 tls_send_certificate_verify(context);
4343 tls_send_finished(context);
4346 free(context->server_finished_hash);
4348 context->server_finished_hash =
4349 malloc(tls_mac_length(context));
4351 if (context->server_finished_hash) {
4352 tls_get_hash(context,
4353 context->server_finished_hash);
4358 tls_queue_packet(tls_build_hello(context, 0));
4359 DEBUG_PRINT("<= SENDING CERTIFICATE\n");
4360 tls_send_certificate(context);
4362 int ephemeral_cipher =
4363 tls_cipher_is_ephemeral(context);
4364 if (ephemeral_cipher) {
4366 ("<= SENDING EPHEMERAL DH KEY\n");
4367 tls_send_server_key_exchange(context,
4368 ephemeral_cipher == 1 ?
4370 KEA_ec_diffie_hellman);
4372 if (context->request_client_certificate) {
4374 ("<= SENDING CERTIFICATE REQUEST\n");
4376 (tls_certificate_request
4379 tls_send_done(context);
4383 tls_send_change_cipher_spec(context);
4384 tls_send_finished(context);
4385 context->connection_status = TLS_CONNECTED;
4392 /* hello retry request */
4393 DEBUG_PRINT("<= SENDING HELLO RETRY REQUEST\n");
4394 pkt = tls_build_hello(context, 0);
4395 tls_queue_packet(pkt);
4399 buf += payload_size;
4400 buf_len -= payload_size;
4406 unsigned int asn1_get_len(const unsigned char *buffer, int buf_len,
4407 unsigned int *octets) {
4414 unsigned char size = buffer[0];
4417 *octets = size & 0x7F;
4418 if ((int) *octets > buf_len - 1) {
4422 unsigned int ref_octets = *octets;
4426 if ((int) *octets > buf_len - 1) {
4429 unsigned int long_size = 0;
4430 unsigned int coef = 1;
4432 for (i = ref_octets; i > 0; i--) {
4433 long_size += buffer[i] * coef;
4443 void print_index(const unsigned int *fields) {
4449 DEBUG_PRINT("%i", fields[i]);
4458 int _is_field(const unsigned int *fields, const unsigned int *prefix) {
4461 if (fields[i] != prefix[i]) {
4469 static int tls_hash_len(int algorithm) {
4470 switch (algorithm) {
4471 case TLS_RSA_SIGN_MD5:
4473 case TLS_RSA_SIGN_SHA1:
4475 case TLS_RSA_SIGN_SHA256:
4477 case TLS_RSA_SIGN_SHA384:
4479 case TLS_RSA_SIGN_SHA512:
4485 static unsigned char *tls_compute_hash(int algorithm, const unsigned char
4486 *message, unsigned int message_len) {
4487 unsigned char *hash = NULL;
4489 int hash_index = -1;
4490 unsigned long hash_len = 0;
4492 if (!message || !message_len) {
4496 switch (algorithm) {
4497 case TLS_RSA_SIGN_MD5:
4498 DEBUG_PRINT("SIGN MD5\n");
4499 hash_index = find_hash("md5");
4502 case TLS_RSA_SIGN_SHA1:
4503 DEBUG_PRINT("SIGN SHA1\n");
4504 hash_index = find_hash("sha1");
4507 case TLS_RSA_SIGN_SHA256:
4508 DEBUG_PRINT("SIGN SHA256\n");
4509 hash_index = find_hash("sha256");
4512 case TLS_RSA_SIGN_SHA384:
4513 DEBUG_PRINT("SIGN SHA384\n");
4514 hash_index = find_hash("sha384");
4517 case TLS_RSA_SIGN_SHA512:
4518 DEBUG_PRINT("SIGN SHA512\n");
4519 hash_index = find_hash("sha512");
4523 DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4528 hash = malloc(hash_len);
4533 err = hash_memory(hash_index, message, message_len, hash, &hash_len);
4540 int tls_certificate_verify_signature(struct TLSCertificate *cert,
4541 struct TLSCertificate *parent) {
4542 if (!cert || !parent || !cert->sign_key
4543 || !cert->fingerprint || !cert->sign_len
4544 || !parent->der_bytes || !parent->der_len) {
4545 DEBUG_PRINT("CANNOT VERIFY SIGNATURE ");
4547 DEBUG_PRINT("!cert ");
4549 if (!cert->sign_key) {
4550 DEBUG_PRINT("!cert->sign_key ");
4552 if (!cert->fingerprint) {
4553 DEBUG_PRINT("!cert->fingerprint ");
4555 if (!cert->sign_len) {
4556 DEBUG_PRINT("!cert->sign_len ");
4561 DEBUG_PRINT("!parent ");
4563 if (!parent->der_bytes) {
4564 DEBUG_PRINT("!parent->der_bytes ");
4566 if (!parent->der_len) {
4567 DEBUG_PRINT("!parent->der_len ");
4574 DEBUG_PRINT("checking alg\n");
4575 int hash_len = tls_hash_len(cert->algorithm);
4576 if (hash_len <= 0) {
4581 switch (cert->algorithm) {
4582 case TLS_RSA_SIGN_MD5:
4583 hash_index = find_hash("md5");
4585 case TLS_RSA_SIGN_SHA1:
4586 hash_index = find_hash("sha1");
4588 case TLS_RSA_SIGN_SHA256:
4589 hash_index = find_hash("sha256");
4591 case TLS_RSA_SIGN_SHA384:
4592 hash_index = find_hash("sha384");
4594 case TLS_RSA_SIGN_SHA512:
4595 hash_index = find_hash("sha512");
4598 DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4603 DEBUG_PRINTLN("rsa_import(%p, %d, %p)\n", parent->der_bytes,
4604 parent->der_len, &key);
4605 int err = rsa_import(parent->der_bytes, parent->der_len, &key);
4608 ("Error importing RSA certificate (code: %i)\n", err);
4609 DEBUG_PRINT("Message: %s\n", error_to_string(err));
4610 DEBUG_DUMP_HEX_LABEL("CERTIFICATE", parent->der_bytes,
4615 unsigned char *signature = cert->sign_key;
4616 int signature_len = cert->sign_len;
4617 if (!signature[0]) {
4622 err = rsa_verify_hash_ex(signature, signature_len, cert->fingerprint,
4623 hash_len, LTC_PKCS_1_V1_5, hash_index, 0, &rsa_stat,
4628 DEBUG_PRINT("HASH VERIFY ERROR %i\n", err);
4631 DEBUG_PRINT("CERTIFICATE VALIDATION: %i\n", rsa_stat);
4635 int tls_certificate_chain_is_valid(struct TLSCertificate **certificates,
4637 if (!certificates || !len) {
4638 return bad_certificate;
4642 DEBUG_PRINT("verifying %i length cert chain\n", len);
4645 /* expired certificate or not yet valid ? */
4646 if (tls_certificate_is_valid(certificates[0])) {
4647 return bad_certificate;
4651 for (i = 0; i < len; i++) {
4652 /* certificate in chain is expired ? */
4653 if (tls_certificate_is_valid(certificates[i + 1])) {
4654 return bad_certificate;
4657 if (!tls_certificate_verify_signature(certificates[i],
4658 certificates[i + 1])) {
4660 ("tls_certificate_verify_signature certs[%d], certs[%d+1] failed\n",
4662 return bad_certificate;
4669 int tls_certificate_chain_is_valid_root(struct TLSContext *context, struct
4670 TLSCertificate **certificates, int len) {
4673 if (!certificates || !len || !context->root_certificates
4674 || !context->root_count) {
4675 return bad_certificate;
4677 for (i = 0; i < len; i++) {
4678 for (j = 0; j < context->root_count; j++) {
4679 /* check if root certificate expired */
4680 if (tls_certificate_is_valid
4681 (context->root_certificates[j])) {
4684 /* if any root validates any certificate in the chain,
4685 * then is root validated */
4686 if (tls_certificate_verify_signature(certificates[i],
4687 context->root_certificates[j]))
4693 return bad_certificate;
4696 int _private_is_oid(struct OID_chain *ref_chain,
4697 const unsigned char *looked_oid, int looked_oid_len) {
4699 if (ref_chain->oid) {
4701 (ref_chain->oid, looked_oid, 16,
4706 ref_chain = (struct OID_chain *) ref_chain->top;
4711 int _private_asn1_parse(struct TLSContext *context,
4712 struct TLSCertificate *cert,
4713 const unsigned char *buffer, int size, int level,
4714 unsigned int *fields, unsigned char *has_key,
4715 int client_cert, unsigned char *top_oid,
4716 struct OID_chain *chain) {
4717 struct OID_chain local_chain;
4718 DEBUG_INDEX(fields);
4720 local_chain.top = chain;
4724 unsigned char oid[16];
4726 local_chain.oid = oid;
4730 unsigned char local_has_key = 0;
4731 const unsigned char *cert_data = NULL;
4732 unsigned int cert_len = 0;
4733 while (pos < size) {
4734 unsigned int start_pos = pos;
4735 if (size - pos < 2) {
4736 return TLS_NEED_MORE_DATA;
4738 unsigned char first = buffer[pos++];
4739 unsigned char type = first & 0x1F;
4740 unsigned char constructed = first & 0x20;
4741 unsigned char element_class = first >> 6;
4745 if (level <= TLS_ASN1_MAXLEVEL) {
4746 fields[level - 1] = idx;
4748 DEBUG_INDEX(fields);
4750 int length = asn1_get_len((unsigned char *) &buffer[pos], size
4752 DEBUG_PRINT("asn1_get_len = %u\n", length);
4753 if ((octets > 4) || (octets > size - pos)) {
4755 ("CANNOT READ CERTIFICATE octets = %d, size = %d pos = %d, size - pos = %d\n",
4756 octets, size, pos, size - pos);
4761 if (size - pos < length) {
4762 return TLS_NEED_MORE_DATA;
4765 /*DEBUG_PRINT("FIRST: %x => %x (%i)\n", (int)first, (int)type, length); */
4767 /*DEBUG_PRINT("%2i: ", level); */
4769 DEBUG_INDEX(fields);
4771 for (i1 = 1; i1 < level; i1++) {
4776 if (length && constructed) {
4779 DEBUG_PRINT("CONSTRUCTED BITSTREAM\n");
4782 DEBUG_PRINT("SEQUENCE\n");
4783 if ((level == 2) && (idx == 1)) {
4785 length + (pos - start_pos);
4786 cert_data = &buffer[start_pos];
4788 /* private key on server or public key on client */
4790 && (_is_field(fields, priv_der_id))) {
4791 free(cert->der_bytes);
4792 temp = length + (pos - start_pos);
4793 cert->der_bytes = malloc(temp);
4794 if (cert->der_bytes) {
4795 memcpy(cert->der_bytes,
4798 cert->der_len = temp;
4804 DEBUG_PRINT("EMBEDDED PDV\n");
4807 if (element_class == 0x02) {
4808 DEBUG_PRINT("CONTEXT-SPECIFIC\n");
4812 DEBUG_PRINT("CONSTRUCT TYPE %02X\n",(int)type);
4816 _private_asn1_parse(context, cert, &buffer[pos],
4817 length, level + 1, fields,
4818 &local_has_key, client_cert,
4819 top_oid, &local_chain);
4820 if (((local_has_key && context
4821 && (!context->is_server || client_cert))
4823 && (_is_field(fields, pk_id))) {
4824 free(cert->der_bytes);
4825 temp = length + (pos - start_pos);
4826 cert->der_bytes = malloc(temp);
4827 if (cert->der_bytes) {
4828 memcpy(cert->der_bytes,
4829 &buffer[start_pos], temp);
4830 cert->der_len = temp;
4838 /* end of content */
4839 DEBUG_PRINT("END OF CONTENT\n");
4845 DEBUG_PRINT("BOOLEAN: %i\n", temp);
4849 if (_is_field(fields, pk_id)) {
4855 tls_certificate_set_key
4856 (cert, &buffer[pos],
4858 } else if (idx == 2) {
4859 tls_certificate_set_exponent
4860 (cert, &buffer[pos],
4863 } else if (_is_field(fields, serial_id)) {
4864 tls_certificate_set_serial(cert,
4870 if (_is_field(fields, version_id)) {
4875 #ifdef TLS_X509_V1_SUPPORT
4883 unsigned int fields_temp[3];
4884 fields_temp[0] = fields[level - 2];
4885 fields_temp[1] = fields[level - 1];
4888 (fields_temp, priv_id)) {
4889 tls_certificate_set_priv
4890 (cert, &buffer[pos],
4894 DEBUG_PRINT("INTEGER(%i): ", length);
4895 DEBUG_DUMP_HEX(&buffer[pos], length);
4896 if ((chain) && (length > 2)) {
4899 sizeof(san_oid) - 1)) {
4903 TLS_REALLOC(cert->san,
4915 tls_certificate_set_copy
4922 (" => SUBJECT ALTERNATIVE NAME: %s",
4939 if (_is_field(fields, pk_id)) {
4944 DEBUG_PRINT("BITSTREAM(%i): ", length);
4945 DEBUG_DUMP_HEX(&buffer[pos], length);
4947 if (_is_field(fields, sign_id)
4948 || _is_field(fields, sign_id2)) {
4949 DEBUG_PRINT("set sign key\n");
4950 tls_certificate_set_sign_key(cert,
4954 } else if (cert->ec_algorithm
4955 && (_is_field(fields, pk_id))) {
4956 tls_certificate_set_key(cert,
4961 if (buffer[pos] == 0x00
4966 length - 1, level + 1,
4969 client_cert, top_oid,
4974 &buffer[pos], length,
4977 client_cert, top_oid,
4984 TLS_EC_prime256v1_OID,
4987 (TLS_EC_prime256v1) -
4995 TLS_EC_secp224r1_OID,
4998 (TLS_EC_secp224r1_OID)
5006 TLS_EC_secp384r1_OID,
5009 (TLS_EC_secp384r1_OID)
5017 TLS_EC_secp521r1_OID,
5020 (TLS_EC_secp521r1_OID)
5026 if ((cert->ec_algorithm)
5028 tls_certificate_set_key
5036 if (top_oid && _is_field(fields, ecc_priv_id)
5038 DEBUG_PRINT("BINARY STRING(%i): ",
5040 DEBUG_DUMP_HEX(&buffer[pos],
5043 tls_certificate_set_priv(cert,
5048 _private_asn1_parse(context, cert,
5060 DEBUG_PRINT("NULL\n");
5063 /* object identifier */
5064 if (_is_field(fields, pk_id)) {
5065 if (length == 8 || length == 5) {
5066 tls_certificate_set_algorithm
5067 (&cert->ec_algorithm,
5068 &buffer[pos], length);
5070 tls_certificate_set_algorithm
5071 (&cert->key_algorithm,
5072 &buffer[pos], length);
5075 if (_is_field(fields, algorithm_id))
5076 tls_certificate_set_algorithm
5078 &buffer[pos], length);
5080 DEBUG_PRINT("OBJECT IDENTIFIER(%i): ", length);
5081 DEBUG_DUMP_HEX(&buffer[pos], length);
5083 /* check previous oid */
5086 sizeof(ocsp_oid) - 1))
5087 tls_certificate_set_copy(&cert->ocsp,
5092 memcpy(oid, &buffer[pos], length);
5094 memcpy(oid, &buffer[pos], 16);
5097 memcpy(top_oid, oid, 16);
5100 DEBUG_PRINT("REAL NUMBER(%i): ", length);
5101 DEBUG_DUMP_HEX(&buffer[pos], length);
5106 DEBUG_PRINT("UTC TIME: [");
5107 DEBUG_DUMP(&buffer[pos], length);
5110 if (_is_field(fields, validity_id)) {
5112 tls_certificate_set_copy_date
5114 &buffer[pos], length);
5116 tls_certificate_set_copy_date
5118 &buffer[pos], length);
5123 /* generalized time */
5124 DEBUG_PRINT("GENERALIZED TIME: [");
5125 DEBUG_DUMP(&buffer[pos], length);
5129 /* printable string */
5140 if (_is_field(fields, issurer_id)) {
5141 if (_is_oid(oid, country_oid, 3)) {
5142 tls_certificate_set_copy
5143 (&cert->issuer_country,
5144 &buffer[pos], length);
5146 (oid, state_oid, 3)) {
5147 tls_certificate_set_copy
5148 (&cert->issuer_state,
5149 &buffer[pos], length);
5151 (oid, location_oid, 3)) {
5152 tls_certificate_set_copy
5155 &buffer[pos], length);
5157 (oid, entity_oid, 3)) {
5158 tls_certificate_set_copy
5159 (&cert->issuer_entity,
5160 &buffer[pos], length);
5162 (oid, subject_oid, 3)) {
5163 tls_certificate_set_copy
5164 (&cert->issuer_subject,
5165 &buffer[pos], length);
5167 } else if (_is_field(fields, owner_id)) {
5168 if (_is_oid(oid, country_oid, 3)) {
5169 tls_certificate_set_copy
5171 &buffer[pos], length);
5173 (oid, state_oid, 3)) {
5174 tls_certificate_set_copy
5176 &buffer[pos], length);
5178 (oid, location_oid, 3)) {
5179 tls_certificate_set_copy
5181 &buffer[pos], length);
5183 (oid, entity_oid, 3)) {
5184 tls_certificate_set_copy
5186 &buffer[pos], length);
5188 (oid, subject_oid, 3)) {
5189 tls_certificate_set_copy
5191 &buffer[pos], length);
5194 DEBUG_PRINT("STR: [");
5195 DEBUG_DUMP(&buffer[pos], length);
5199 DEBUG_PRINT("EMPTY SEQUENCE\n");
5202 DEBUG_PRINT("ENUMERATED(%i): ", length);
5203 DEBUG_DUMP_HEX(&buffer[pos], length);
5207 DEBUG_PRINT("========> NOT SUPPORTED %x\n",
5209 /* not supported / needed */
5216 if (cert_len && cert_data) {
5217 int h = find_hash("sha256");
5218 size_t len = sizeof cert->fp;
5219 hash_memory(h, cert_data,cert_len, cert->fp, &len);
5222 if (level == 2 && cert->sign_key && cert->sign_len
5223 && cert_len && cert_data) {
5224 free(cert->fingerprint);
5225 cert->fingerprint = tls_compute_hash(cert->algorithm,
5226 cert_data, cert_len);
5228 if (cert->fingerprint) {
5229 DEBUG_DUMP_HEX_LABEL("FINGERPRINT",
5231 tls_hash_len(cert->algorithm));
5238 struct TLSCertificate *asn1_parse(struct TLSContext *context,
5239 const unsigned char *buffer, int size,
5241 unsigned int fields[TLS_ASN1_MAXLEVEL] = { 0 };
5243 struct TLSCertificate *cert = tls_create_certificate();
5246 if (client_cert < 0) {
5249 unsigned char top_oid[16];
5250 memset(top_oid, 0, sizeof(top_oid));
5251 _private_asn1_parse(context, cert, buffer, size, 1,
5252 fields, NULL, client_cert,
5255 _private_asn1_parse(context, cert, buffer, size, 1,
5256 fields, NULL, client_cert,
5263 int tls_clear_certificates(struct TLSContext *tls) {
5266 if (!tls || !tls->is_server || tls->is_child) {
5267 return TLS_GENERIC_ERROR;
5270 if (tls->root_certificates) {
5271 for (i = 0; i < tls->root_count; i++) {
5272 tls_destroy_certificate(tls->root_certificates[i]);
5275 tls->root_certificates = NULL;
5276 tls->root_count = 0;
5278 if (tls->private_key) {
5279 tls_destroy_certificate(tls->private_key);
5281 tls->private_key = NULL;
5282 if (tls->ec_private_key) {
5283 tls_destroy_certificate(tls->ec_private_key);
5285 tls->ec_private_key = NULL;
5286 free(tls->certificates);
5287 tls->certificates = NULL;
5288 tls->certificates_count = 0;
5292 /* This is just a wrapper around parse message so we don't
5293 * call read more often than necessary. IOW, if there's
5294 * more than one record in the input buffer, process them all
5296 int tls_consume_stream(struct TLSContext *context) {
5298 return TLS_GENERIC_ERROR;
5301 if (context->critical_error) {
5302 return TLS_BROKEN_CONNECTION;
5305 size_t tls_buffer_len = context->input_buffer.len;
5306 unsigned char *buffer = context->input_buffer.buffer;
5308 unsigned int index = 0;
5311 int tls_header_size;
5312 int tls_size_offset;
5314 tls_size_offset = 3;
5315 tls_header_size = 5;
5317 while (tls_buffer_len >= 5) {
5320 length = get16(buffer + index + tls_size_offset)
5323 if (length > tls_buffer_len) {
5324 /* record not complete */
5328 /* This is the only place tls_parse_message is called */
5329 int consumed = tls_parse_message(context, buffer+index, length);
5331 fprintf(stderr, "parse message error: %d\n", consumed);
5332 err_flag = consumed;
5336 tls_buffer_len -= length;
5337 if (context->critical_error) {
5338 err_flag = TLS_BROKEN_CONNECTION;
5343 if (err_flag || context->input_buffer.error) {
5344 if (!context->critical_error) {
5345 context->critical_error = 1;
5347 DEBUG_PRINT("ERROR IN CONSUME: %i\n", err_flag);
5348 tls_buffer_free(&context->input_buffer);
5351 tls_buffer_shift(&context->input_buffer, index);
5355 void tls_close_notify(struct TLSContext *context) {
5356 if (!context || context->critical_error) {
5359 context->critical_error = 1;
5360 DEBUG_PRINT("CLOSE\n");
5361 tls_alert(context, 0, close_notify);
5364 void tls_alert(struct TLSContext *context, int critical, int code) {
5369 struct TLSPacket *packet = tls_create_packet(context, TLS_ALERT,
5370 context->version, 0);
5371 tls_packet_uint8(packet, critical ? TLS_ALERT_CRITICAL :
5374 tls_packet_uint8(packet, code);
5375 tls_packet_update(packet);
5378 context->critical_error = 1;
5381 tls_queue_packet(packet);
5384 int tls_is_broken(struct TLSContext *context) {
5385 if (!context || context->critical_error) {
5391 /* TODO I don't see that this ever gets cleared */
5392 int tls_request_client_certificate(struct TLSContext *context) {
5393 if (!context || !context->is_server) {
5397 context->request_client_certificate = 1;
5401 int tls_client_verified(struct TLSContext *context) {
5402 if (!context || context->critical_error) {
5406 return context->client_verified == 1;
5409 int tls_sni_set(struct TLSContext *context, const char *sni) {
5410 if (!context || context->is_server || context->critical_error
5411 || context->connection_status != 0) {
5417 context->sni = sni ? strdup(sni) : 0;
5418 return context->sni ? 1 : 0;
5421 int tls_default_verify(struct TLSContext *context,
5422 struct TLSCertificate **certificate_chain, int len)
5427 if (certificate_chain) {
5428 for (i = 0; i < len; i++) {
5429 struct TLSCertificate *certificate =
5430 certificate_chain[i];
5431 /* check validity date */
5432 err = tls_certificate_is_valid(certificate);
5438 /* check if chain is valid */
5439 err = tls_certificate_chain_is_valid(certificate_chain, len);
5444 /* check certificate subject */
5445 if (!context->is_server && context->sni && len > 0
5446 && certificate_chain) {
5447 err = tls_certificate_valid_subject(certificate_chain[0],
5454 err = tls_certificate_chain_is_valid_root(context, certificate_chain,
5460 DEBUG_PRINT("Certificate OK\n");
5464 ssize_t tls_fsync(struct TLSContext *context) {
5467 ssize_t send_res = 0;
5469 unsigned char *buffer;
5470 tls_send_func write_cb = NULL;
5481 buffer = context->output_buffer.buffer;
5482 buflen = context->output_buffer.len;
5484 if (context->send) {
5485 write_cb = context->send;
5490 while (buflen > 0) {
5493 res = write_cb(fd, buffer+offset, buflen, 0);
5495 perror("send error");
5503 DEBUG_PRINT("sent %zd bytes\n", send_res);
5504 context->output_buffer.len = 0;
5508 void tls_free(struct TLSContext *context) {
5510 free(context->user_data);
5511 tls_destroy_context(context);
5515 int tls_set_fd(struct TLSContext *context, int socket) {
5517 return TLS_GENERIC_ERROR;
5519 context->fd = socket;
5523 int tls_load_root_file(struct TLSContext *context, const char *pem_filename) {
5534 fd = open(pem_filename, O_RDONLY);
5539 if (fstat(fd, &st) == -1) {
5544 addr = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
5545 if (addr == MAP_FAILED) {
5550 count = tls_load_root_certificates(context, addr, st.st_size);
5551 munmap(addr, st.st_size);
5557 void tls_set_verify(struct TLSContext *tls, tls_validation_function vfunc) {
5559 tls->certificate_verify = vfunc;
5563 static ssize_t tls_safe_read(struct TLSContext *tls) {
5564 tls_recv_func read_cb;
5568 if (!tls || tls->fd <= 0) {
5569 return TLS_GENERIC_ERROR;
5573 read_cb = tls->recv;
5579 bytes = read_cb(tls->fd, buffer, sizeof buffer, 0);
5581 tls_buffer_append(&tls->input_buffer, buffer, bytes);
5587 /* I think this is the server handshake */
5588 int SSL_accept(struct TLSContext *context) {
5589 ssize_t read_size = 0;
5591 if (!context || context->fd <= 0) {
5592 return TLS_GENERIC_ERROR;
5595 if (tls_established(context)) {
5600 while ((read_size = tls_safe_read(context)) > 0) {
5601 if (tls_consume_stream(context) >= 0) {
5602 ssize_t res = tls_fsync(context);
5607 if (tls_established(context)) {
5611 if (read_size <= 0) {
5612 return TLS_BROKEN_CONNECTION;
5617 /* TODO this is really do the handshake */
5618 int tls_connect(struct TLSContext *context) {
5623 if (!context || context->fd < 0 || context->critical_error) {
5626 } else if (context->fd < 0) {
5632 return TLS_GENERIC_ERROR;
5636 if (context->is_server) {
5637 return TLS_UNEXPECTED_MESSAGE;
5641 res = tls_queue_packet(tls_build_client_hello(context));
5649 res = tls_fsync(context);
5655 while ((read_size = tls_safe_read(context)) > 0) {
5656 if ((res = tls_consume_stream(context)) >= 0) {
5657 res = tls_fsync(context);
5663 if (tls_established(context)) {
5668 if (context->critical_error) {
5669 fprintf(stderr, "critical error: %d\n",
5670 context->critical_error);
5671 return TLS_GENERIC_ERROR;
5678 int tls_shutdown(struct TLSContext *tls) {
5679 if (!tls || tls->fd <= 0) {
5680 return TLS_GENERIC_ERROR;
5683 tls_close_notify(tls);
5687 /* TODO configure for maximum packet data length
5688 * max is 2^14 - 5 byte header - 32 byte mac - padding which depends
5689 * on the cipher (up to 255 bytes I think).
5691 ssize_t tls_write(struct TLSContext *context, const void *buf, size_t count) {
5693 return TLS_GENERIC_ERROR;
5695 if (context->connection_status != TLS_CONNECTED) {
5696 return TLS_UNEXPECTED_MESSAGE;
5698 if (count > TLS_MAXTLS_APP_SIZE) {
5699 count = TLS_MAXTLS_APP_SIZE;
5702 if (!buf || !count) {
5706 struct TLSPacket *packet = tls_create_packet(context,
5707 TLS_APPLICATION_DATA, context->version, count);
5708 tls_packet_append(packet, buf, count);
5709 tls_packet_update(packet);
5711 tls_queue_packet(packet);
5712 /* TODO think about this. context->sync with O_NONBLOCK might be a
5715 if (context->sync) {
5717 res = tls_fsync(context);
5725 static ssize_t tls_readbuf(struct TLSContext *tls, void *buf, size_t count) {
5726 if (count > tls->application_buffer.len) {
5727 count = tls->application_buffer.len;
5731 /* TODO should have a buffer read and shift */
5732 memcpy(buf, tls->application_buffer.buffer, count);
5733 tls_buffer_shift(&tls->application_buffer, count);
5739 ssize_t tls_read(struct TLSContext *context, void *buf, size_t count) {
5741 return TLS_GENERIC_ERROR;
5744 if (context->application_buffer.len) {
5745 return tls_readbuf(context, buf, count);
5748 if (context->fd <= 0 || context->critical_error) {
5749 return TLS_GENERIC_ERROR;
5752 if (!tls_established(context)) {
5753 return TLS_GENERIC_ERROR;
5756 if (context->application_buffer.len == 0 && !context->critical_error) {
5757 /* attempt to fill buffer, unless we're already in an error
5762 while ((read_size = tls_safe_read(context)) > 0) {
5763 if (tls_consume_stream(context) > 0) {
5767 if (context->critical_error
5768 && !context->application_buffer.len) {
5769 /* if there's a critical error, don't bail if
5770 * we managed to get some data
5772 return TLS_GENERIC_ERROR;
5776 if (read_size <= 0 && context->application_buffer.len == 0) {
5777 /* can return errors as for read(2) */
5782 return tls_readbuf(context, buf, count);