1 #define _POSIX_C_SOURCE 200809L
13 #include <sys/socket.h>
14 #include <arpa/inet.h>
21 #define mp_init(a) ltc_mp.init(a)
22 #define mp_init_multi ltc_init_multi
23 #define mp_clear(a) ltc_mp.deinit(a)
24 #define mp_clear_multi ltc_deinit_multi
25 #define mp_count_bits(a) ltc_mp.count_bits(a)
26 #define mp_read_radix(a, b, c) ltc_mp.read_radix(a, b, c)
27 #define mp_unsigned_bin_size(a) ltc_mp.unsigned_size(a)
28 #define mp_to_unsigned_bin(a, b) ltc_mp.unsigned_write(a, b)
29 #define mp_read_unsigned_bin(a, b, c) ltc_mp.unsigned_read(a, b, c)
30 #define mp_exptmod(a, b, c, d) ltc_mp.exptmod(a, b, c, d)
31 #define mp_add(a, b, c) ltc_mp.add(a, b, c)
32 #define mp_mul(a, b, c) ltc_mp.mul(a, b, c)
33 #define mp_cmp(a, b) ltc_mp.compare(a, b)
34 #define mp_cmp_d(a, b) ltc_mp.compare_d(a, b)
35 #define mp_sqr(a, b) ltc_mp.sqr(a, b)
36 #define mp_mod(a, b, c) ltc_mp.mpdiv(a, b, NULL, c)
37 #define mp_sub(a, b, c) ltc_mp.sub(a, b, c)
38 #define mp_set(a, b) ltc_mp.set_int(a, b)
41 #define LTC_PKCS_1_EMSA LTC_LTC_PKCS_1_EMSA
42 #define LTC_PKCS_1_V1_5 LTC_LTC_PKCS_1_V1_5
43 #define LTC_PKCS_1_PSS LTC_LTC_PKCS_1_PSS
50 #define TLS_DH_DEFAULT_P "87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597"
51 #define TLS_DH_DEFAULT_G "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"
52 #define TLS_DHE_KEY_SIZE 2048
55 #define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
59 #define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
62 #define CHECK_HANDSHAKE_STATE(context, n, limit) { if (context->hs_messages[n] >= limit) { DEBUG_PRINT("* UNEXPECTED MESSAGE (%i)\n", (int)n); payload_res = TLS_UNEXPECTED_MESSAGE; break; } context->hs_messages[n]++; }
78 } KeyExchangeAlgorithm;
85 rsa_ephemeral_dh_RESERVED = 5,
86 dss_ephemeral_dh_RESERVED = 6,
87 fortezza_dms_RESERVED = 20,
91 } TLSClientCertificateType;
109 } TLSSignatureAlgorithm;
116 typedef ssize_t (*tls_recv_func)(int sockfd, void *buf, size_t len,
118 typedef ssize_t (*tls_send_func)(int sockfd, const void *buf, size_t len,
121 static const unsigned int version_id[] = { 1, 1, 1, 0 };
122 static const unsigned int pk_id[] = { 1, 1, 7, 0 };
123 static const unsigned int serial_id[] = { 1, 1, 2, 1, 0 };
124 static const unsigned int issurer_id[] = { 1, 1, 4, 0 };
125 static const unsigned int owner_id[] = { 1, 1, 6, 0 };
126 static const unsigned int validity_id[] = { 1, 1, 5, 0 };
127 static const unsigned int algorithm_id[] = { 1, 1, 3, 0 };
128 static const unsigned int sign_id[] = { 1, 3, 2, 1, 0 };
129 static const unsigned int sign_id2[] = { 1, 3, 2, 2, 0 };
130 static const unsigned int priv_id[] = { 1, 4, 0 };
131 static const unsigned int priv_der_id[] = { 1, 3, 1, 0 };
132 static const unsigned int ecc_priv_id[] = { 1, 2, 0 };
134 static const unsigned char country_oid[] = { 0x55, 0x04, 0x06, 0x00 };
135 static const unsigned char state_oid[] = { 0x55, 0x04, 0x08, 0x00 };
136 static const unsigned char location_oid[] = { 0x55, 0x04, 0x07, 0x00 };
137 static const unsigned char entity_oid[] = { 0x55, 0x04, 0x0A, 0x00 };
138 static const unsigned char subject_oid[] = { 0x55, 0x04, 0x03, 0x00 };
139 static const unsigned char san_oid[] = { 0x55, 0x1D, 0x11, 0x00 };
140 static const unsigned char ocsp_oid[] =
141 { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x00 };
143 static const unsigned char TLS_RSA_SIGN_RSA_OID[] =
144 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x00 };
145 static const unsigned char TLS_RSA_SIGN_MD5_OID[] =
146 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04, 0x00 };
147 static const unsigned char TLS_RSA_SIGN_SHA1_OID[] =
148 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x00 };
149 static const unsigned char TLS_RSA_SIGN_SHA256_OID[] =
150 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x00 };
151 static const unsigned char TLS_RSA_SIGN_SHA384_OID[] =
152 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, 0x00 };
153 static const unsigned char TLS_RSA_SIGN_SHA512_OID[] =
154 { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, 0x00 };
157 static const unsigned char TLS_ECDSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x01, 0x05, 0x00, 0x00};
158 static const unsigned char TLS_ECDSA_SIGN_SHA224_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x01, 0x05, 0x00, 0x00};
159 static const unsigned char TLS_ECDSA_SIGN_SHA256_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x05, 0x00, 0x00};
160 static const unsigned char TLS_ECDSA_SIGN_SHA384_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, 0x05, 0x00, 0x00};
161 static const unsigned char TLS_ECDSA_SIGN_SHA512_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, 0x05, 0x00, 0x00};
164 static const unsigned char TLS_EC_PUBLIC_KEY_OID[] =
165 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x00 };
167 static const unsigned char TLS_EC_prime192v1_OID[] =
168 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x01, 0x00 };
169 static const unsigned char TLS_EC_prime192v2_OID[] =
170 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x02, 0x00 };
171 static const unsigned char TLS_EC_prime192v3_OID[] =
172 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x03, 0x00 };
173 static const unsigned char TLS_EC_prime239v1_OID[] =
174 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x04, 0x00 };
175 static const unsigned char TLS_EC_prime239v2_OID[] =
176 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x05, 0x00 };
177 static const unsigned char TLS_EC_prime239v3_OID[] =
178 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x06, 0x00 };
179 static const unsigned char TLS_EC_prime256v1_OID[] =
180 { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x00 };
182 #define TLS_EC_secp256r1_OID TLS_EC_prime256v1_OID
183 static const unsigned char TLS_EC_secp224r1_OID[] =
184 { 0x2B, 0x81, 0x04, 0x00, 0x21, 0x00 };
185 static const unsigned char TLS_EC_secp384r1_OID[] =
186 { 0x2B, 0x81, 0x04, 0x00, 0x22, 0x00 };
187 static const unsigned char TLS_EC_secp521r1_OID[] =
188 { 0x2B, 0x81, 0x04, 0x00, 0x23, 0x00 };
190 int tls_random(unsigned char *key, int len);
191 void tls_destroy_packet(struct TLSPacket *packet);
192 struct TLSPacket *tls_build_hello(struct TLSContext *context,
193 int tls13_downgrade);
197 static unsigned char TLS_DSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x52, 0xCE, 0x38, 0x04, 0x03, 0x00};
200 static uint16_t get16(const unsigned char *buf) {
203 res = ((*buf) << 8) + (*(buf+1));
207 static uint32_t get24(const unsigned char *buf) {
210 res = (buf[0] << 16) + (buf[1] << 8) + buf[2];
215 static char *packet_content_type(int type) {
217 case 20: return "change_cipher_spec"; break;
218 case 21: return "alert"; break;
219 case 22: return "handshake"; break;
220 case 23: return "application_data"; break;
223 return "unknown content type";
226 static char *packet_handshake_type(int type) {
228 case 0: return "hello_request"; break;
229 case 1: return "client_hello"; break;
230 case 2: return "server_hello"; break;
231 case 11: return "certificate"; break;
232 case 12: return "server_key_exchange"; break;
233 case 13: return "certificate_request"; break;
234 case 14: return "server_hello_done"; break;
235 case 15: return "certificate_verify"; break;
236 case 16: return "client_key_exchange"; break;
237 case 20: return "finished"; break;
240 return "unknown handshake type";
244 size_t tls_queue_packet(struct TLSPacket *packet) {
251 struct TLSContext *context = packet->context;
258 DEBUG_PRINTLN("sending packet type %d %s\n", (int)packet->buf[0],
259 packet_content_type(packet->buf[0]));
260 if (packet->buf[0] == 22) {
261 DEBUG_PRINTLN("handshake type %d %s\n", (int)packet->buf[5],
262 packet_handshake_type(packet->buf[5])
265 tls_buffer_append(&context->output_buffer, packet->buf, packet->len);
266 tls_destroy_packet(packet);
268 return context->output_buffer.len;
271 static void tls_send_change_cipher_spec(struct TLSContext *context) {
273 struct TLSPacket *packet =
274 tls_create_packet(context, TLS_CHANGE_CIPHER, context->version,
276 tls_packet_uint8(packet, 1);
277 tls_packet_update(packet);
278 context->local_sequence_number = 0;
279 tls_queue_packet(packet);
284 static void tls_send_encrypted_extensions(struct TLSContext *context) {
285 struct TLSPacket *packet =
286 tls_create_packet(context, TLS_HANDSHAKE, context->version, 3);
287 tls_packet_uint8(packet, 0x08);
289 if (context->negotiated_alpn) {
290 int alpn_negotiated_len = strlen(context->negotiated_alpn);
291 int alpn_len = alpn_negotiated_len + 1;
293 tls_packet_uint24(packet, alpn_len + 8);
294 tls_packet_uint16(packet, alpn_len + 6);
295 tls_packet_uint16(packet, 0x10);
296 tls_packet_uint16(packet, alpn_len + 2);
297 tls_packet_uint16(packet, alpn_len);
299 tls_packet_uint8(packet, alpn_negotiated_len);
300 tls_packet_append(packet, (unsigned char *) context->
301 negotiated_alpn, alpn_negotiated_len);
303 tls_packet_uint24(packet, 2);
304 tls_packet_uint16(packet, 0);
306 tls_packet_update(packet);
307 tls_queue_packet(packet);
311 static void tls_send_done(struct TLSContext *context) {
312 struct TLSPacket *packet =
313 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
314 tls_packet_uint8(packet, 0x0E);
315 tls_packet_uint24(packet, 0);
316 tls_packet_update(packet);
317 tls_queue_packet(packet);
321 static void tls_send_certificate(struct TLSContext *context) {
323 unsigned int all_certificate_size = 0;
324 int certificates_count;
325 struct TLSCertificate **certificates;
328 if (context->is_server) {
329 certificates_count = context->certificates_count;
330 certificates = context->certificates;
332 certificates_count = context->client_certificates_count;
333 certificates = context->client_certificates;
337 if (context->tlsver == TLS_VERSION13) {
341 int is_ecdsa = tls_is_ecdsa(context);
342 /* TODO can do one loop and test for ecdsa inside loop */
344 for (i = 0; i < certificates_count; i++) {
345 struct TLSCertificate *cert = certificates[i];
346 if (cert && cert->der_len && cert->ec_algorithm) {
347 all_certificate_size += cert->der_len + delta;
351 for (i = 0; i < certificates_count; i++) {
352 struct TLSCertificate *cert = certificates[i];
353 if (cert && cert->der_len && !cert->ec_algorithm) {
354 all_certificate_size += cert->der_len + delta;
359 for (i = 0; i < certificates_count; i++) {
360 struct TLSCertificate *cert = certificates[i];
361 if (cert && cert->der_len) {
362 all_certificate_size += cert->der_len + delta;
366 if (!all_certificate_size) {
367 DEBUG_PRINT("NO CERTIFICATE SET\n");
370 struct TLSPacket *packet = tls_create_packet(context, TLS_HANDSHAKE,
371 context->version, 0);
372 tls_packet_uint8(packet, 0x0B);
374 if (all_certificate_size) {
376 if (context->tlsver == TLS_VERSION13) {
377 tls_packet_uint24(packet, all_certificate_size + 4);
378 tls_packet_uint8(packet, 0);
380 tls_packet_uint24(packet, all_certificate_size + 3);
383 tls_packet_uint24(packet, all_certificate_size);
385 for (i = 0; i < certificates_count; i++) {
386 struct TLSCertificate *cert = certificates[i];
387 if (cert && cert->der_len) {
388 /* is RSA certificate ? */
389 if (is_ecdsa && !cert->ec_algorithm) {
392 /* is ECC certificate ? */
393 if (!is_ecdsa && cert->ec_algorithm) {
396 /* 2 times -> one certificate */
397 tls_packet_uint24(packet, cert->der_len);
398 tls_packet_append(packet, cert->der_bytes,
401 if (context->tlsver == TLS_VERSION13) {
402 tls_packet_uint16(packet, 0);
407 tls_packet_uint24(packet, all_certificate_size);
408 if (context->tlsver == TLS_VERSION13) {
409 tls_packet_uint8(packet, 0);
413 tls_packet_update(packet);
414 tls_queue_packet(packet);
419 int tls_supported_version(uint16_t ver) {
425 DEBUG_PRINT("UNSUPPORTED TLS VERSION %x\n", (int)ver);
431 void tls_set_packet_length(struct TLSPacket *packet, uint32_t length) {
432 int offset = packet->payload_pos;
433 packet->buf[offset] = (length >> 16) & 0xff;
434 packet->buf[offset+1] = (length >> 8) & 0xff;
435 packet->buf[offset+2] = (length >> 0) & 0xff;
438 static void tls_init() {
439 static int loaded = 0;
444 DEBUG_PRINT("Initializing dependencies\n");
453 /* TODO remove these */
455 register_hash(&md5_desc);
456 register_hash(&sha1_desc);
459 register_hash(&sha256_desc);
460 register_hash(&sha384_desc);
461 register_hash(&sha512_desc);
463 register_prng(&sprng_desc);
465 register_cipher(&aes_desc);
467 tls_ecc_init_curves();
470 static unsigned char *decrypt_rsa(struct TLSContext *context,
471 const unsigned char *buffer,
473 unsigned int *size) {
475 if (!len || !context || !context->private_key
476 || !context->private_key->der_bytes
477 || !context->private_key->der_len) {
478 DEBUG_PRINT("No private key set\n");
483 err = rsa_import(context->private_key->der_bytes,
484 context->private_key->der_len, &key);
487 DEBUG_PRINT("Error importing RSA key (code: %i)\n", err);
491 unsigned char *out = malloc(len);
492 unsigned long out_size = len;
493 int hash_idx = find_hash("sha256");
495 err = rsa_decrypt_key_ex(buffer, len, out, &out_size, (unsigned char *)
496 "Concept", 7, hash_idx, LTC_PKCS_1_V1_5, &res, &key);
499 if (err || !out_size) {
500 DEBUG_PRINT("RSA DECRYPT ERROR\n");
504 *size = (unsigned int) out_size;
508 static int verify_rsa(struct TLSContext *context, unsigned int hash_type, const
509 unsigned char *buffer, unsigned int len, const unsigned char
510 *message, unsigned long message_len) {
515 return TLS_GENERIC_ERROR;
518 struct TLSCertificate **cert;
521 if (context->is_server) {
522 cert = context->client_certificates;
523 count = context->client_certificates_count;
525 cert = context->certificates;
526 count = context->certificates_count;
529 if (count == 0 || !cert) {
530 return TLS_GENERIC_ERROR;
533 err = rsa_import(cert[0]->der_bytes, cert[0]->der_len, &key);
536 DEBUG_PRINT("Error importing RSA certificate (code: %i)\n",
538 return TLS_GENERIC_ERROR;
541 unsigned char hash[TLS_MAX_HASH_LEN];
542 unsigned long hash_len;
543 hash_len = (unsigned long)sizeof hash;
547 hash_idx = find_hash("md5");
550 hash_idx = find_hash("sha1");
553 hash_idx = find_hash("sha256");
556 hash_idx = find_hash("sha384");
559 hash_idx = find_hash("sha512");
562 err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
563 if (hash_idx < 0 || err) {
564 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
565 return TLS_GENERIC_ERROR;
568 if (context->tlsver == TLS_VERSION13) {
569 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
570 LTC_PKCS_1_PSS, hash_idx, 0, &rsa_stat, &key);
572 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
573 LTC_PKCS_1_V1_5, hash_idx, 0, &rsa_stat, &key);
582 static int sign_rsa(struct TLSContext *context, unsigned int hash_type, const
583 unsigned char *message, unsigned int message_len, unsigned char
584 *out, unsigned long *outlen) {
588 unsigned char hash[TLS_MAX_HASH_LEN];
589 unsigned long hash_len = 0;
592 if (!outlen || !context || !out || !context->private_key
593 || !context->private_key->der_bytes
594 || !context->private_key->der_len) {
595 DEBUG_PRINT("No private key set\n");
596 return TLS_GENERIC_ERROR;
599 err = rsa_import(context->private_key->der_bytes,
600 context->private_key->der_len, &key);
603 DEBUG_PRINT("Error %d importing RSA certificate", err);
604 return TLS_GENERIC_ERROR;
609 hash_index = find_hash("sha1");
613 hash_index = find_hash("sha256");
617 hash_index = find_hash("sha384");
621 hash_index = find_hash("sha512");
626 hash_index = find_hash("md5");
631 if (hash_index < 0 || err) {
632 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
633 return TLS_GENERIC_ERROR;
636 hash_memory(hash_index, message, message_len, hash, &hash_len);
638 if (hash_type == _md5_sha1) {
639 unsigned long hlen = 20;
640 hash_index = find_hash("sha1");
641 hash_memory(hash_index, message, message_len, hash+16, &hlen);
645 //err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
647 if (context->tlsver == TLS_VERSION13) {
648 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
649 LTC_PKCS_1_PSS, NULL, find_prng("sprng"),
650 hash_index, hash_type == sha256 ? 32 : 48, &key);
652 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
653 LTC_PKCS_1_V1_5, NULL, find_prng("sprng"),
654 hash_index, 0, &key);
665 static int tls_is_point(ecc_key * key) {
666 void *prime, *b, *t1, *t2;
669 if ((err = mp_init_multi(&prime, &b, &t1, &t2, NULL)) != CRYPT_OK) {
673 /* load prime and b */
674 if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) {
677 if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) {
682 if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) {
687 if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) {
690 if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) {
693 if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) {
697 /* compute y^2 - x^3 */
698 if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) {
702 /* compute y^2 - x^3 + 3x */
703 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
706 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
709 if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
712 if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) {
715 while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
716 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) {
720 while (mp_cmp(t1, prime) != LTC_MP_LT) {
721 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) {
727 if (mp_cmp(t1, b) != LTC_MP_EQ) {
728 err = CRYPT_INVALID_PACKET;
734 mp_clear_multi(prime, b, t1, t2, NULL);
738 static int tls_ecc_import_key(const unsigned char *private_key,
740 const unsigned char *public_key,
741 int public_len, ecc_key *key,
742 const ltc_ecc_set_type *dp) {
745 if (!key || !ltc_mp.name) {
749 key->type = PK_PRIVATE;
752 (&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k,
756 if (public_len && !public_key[0]) {
760 if ((err = mp_read_unsigned_bin(key->pubkey.x,
761 (unsigned char *) public_key + 1,
762 (public_len - 1) >> 1)) != CRYPT_OK) {
763 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
768 if ((err = mp_read_unsigned_bin(key->pubkey.y,
769 (unsigned char *) public_key + 1 +
770 ((public_len - 1) >> 1),
771 (public_len - 1) >> 1)) != CRYPT_OK) {
772 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
778 mp_read_unsigned_bin(key->k, (unsigned char *) private_key,
779 private_len)) != CRYPT_OK) {
780 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
789 if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
790 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
795 /* is it a point on the curve? */
796 if ((err = tls_is_point(key)) != CRYPT_OK) {
797 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
798 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
807 static int sign_ecdsa(struct TLSContext *context,
808 unsigned int hash_type,
809 const unsigned char *message,
810 unsigned int message_len, unsigned char *out,
811 unsigned long *outlen) {
812 if (!outlen || !context || !out || !outlen
813 || !context->ec_private_key
814 || !context->ec_private_key->priv
815 || !context->ec_private_key->priv_len
816 || !context->ec_private_key->pk
817 || !context->ec_private_key->pk_len) {
818 DEBUG_PRINT("No private ECDSA key set\n");
819 return TLS_GENERIC_ERROR;
822 const struct ECCCurveParameters *curve = NULL;
824 switch (context->ec_private_key->ec_algorithm) {
847 DEBUG_PRINT("UNSUPPORTED CURVE\n");
851 return TLS_GENERIC_ERROR;
857 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&curve->dp;
859 /* broken ... fix this */
860 err = tls_ecc_import_key(context->ec_private_key->priv,
861 context->ec_private_key->priv_len,
862 context->ec_private_key->pk,
863 context->ec_private_key->pk_len, &key, dp);
866 DEBUG_PRINT("Error importing ECC certificate (code: %i)\n",
868 return TLS_GENERIC_ERROR;
871 unsigned char hash[TLS_MAX_HASH_LEN];
872 unsigned long hash_len = 0;
877 hash_index = find_hash("sha1");
881 hash_index = find_hash("sha256");
885 hash_index = find_hash("sha384");
889 hash_index = find_hash("sha512");
894 hash_index = find_hash("md5");
899 hash_memory(hash_index, message, message_len, hash, &hash_len);
901 if (hash_type == _md5_sha1) {
902 unsigned long hlen = 20;
903 hash_index = find_hash("sha1");
904 hash_memory(hash_index, message, message_len, hash+16, &hlen);
909 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
910 return TLS_GENERIC_ERROR;
912 /* "Let z be the Ln leftmost bits of e, where Ln is the bit length of
913 * the group order n." */
914 if ((int)hash_len > curve->size) {
915 hash_len = curve->size;
917 err = ecc_sign_hash(hash, hash_len, out, outlen, NULL,
918 find_prng("sprng"), &key);
919 DEBUG_DUMP_HEX_LABEL("ECC SIGNATURE", out, *outlen);
925 static void tls_send_certificate_verify(struct TLSContext *context) {
926 struct TLSPacket *packet =
927 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
928 /* certificate verify */
929 tls_packet_uint8(packet, 0x0F);
930 tls_packet_uint24(packet, 0);
932 unsigned char out[TLS_MAX_RSA_KEY];
933 unsigned long out_len = TLS_MAX_RSA_KEY;
935 unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
936 int signing_data_len;
938 /* first 64 bytes to 0x20 (32) */
939 memset(signing_data, 0x20, 64);
940 /* context string 33 bytes */
941 if (context->is_server) {
942 memcpy(signing_data + 64, "TLS 1.3, server CertificateVerify",
945 memcpy(signing_data + 64, "TLS 1.3, client CertificateVerify",
948 /* a single 0 byte separator */
949 signing_data[97] = 0;
950 signing_data_len = 98;
952 signing_data_len += tls_get_hash(context, signing_data + 98);
953 DEBUG_DUMP_HEX_LABEL("verify data", signing_data, signing_data_len);
954 int hash_algorithm = sha256;
955 if (tls_is_ecdsa(context)) {
956 switch (context->ec_private_key->ec_algorithm) {
958 /* secp256r1 + sha256 */
959 tls_packet_uint16(packet, 0x0403);
962 /* secp384r1 + sha384 */
963 tls_packet_uint16(packet, 0x0503);
964 hash_algorithm = sha384;
967 /* secp521r1 + sha512 */
968 tls_packet_uint16(packet, 0x0603);
969 hash_algorithm = sha512;
972 DEBUG_PRINT("UNSUPPORTED CURVE (SIGNING)\n");
978 tls_packet_uint16(packet, 0x0804);
983 if (tls_is_ecdsa(context)) {
984 if (sign_ecdsa(context, hash_algorithm, signing_data,
985 signing_data_len, out, &out_len) == 1)
988 ("ECDSA signing OK! (ECDSA, length %lu)\n",
990 tls_packet_uint16(packet, out_len);
991 tls_packet_append(packet, out, out_len);
992 packet_size += out_len + 2;
994 } else if (sign_rsa(context, hash_algorithm, signing_data,
995 signing_data_len, out, &out_len) == 1) {
996 DEBUG_PRINT("RSA signing OK! (length %lu)\n", out_len);
997 tls_packet_uint16(packet, out_len);
998 tls_packet_append(packet, out, out_len);
999 packet_size += out_len + 2;
1002 tls_set_packet_length(packet, packet_size);
1004 tls_packet_update(packet);
1005 tls_queue_packet(packet);
1009 static int tls_ecc_import_pk(const unsigned char *public_key,
1010 int public_len, ecc_key * key,
1011 const ltc_ecc_set_type * dp) {
1014 if (!key || !ltc_mp.name) {
1018 key->type = PK_PUBLIC;
1020 if (mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z,
1021 &key->k, NULL) != CRYPT_OK) {
1025 if (public_len && !public_key[0]) {
1029 if ((err = mp_read_unsigned_bin(key->pubkey.x,
1030 (unsigned char *) public_key + 1,
1031 (public_len - 1) >> 1)) != CRYPT_OK) {
1032 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1037 if ((err = mp_read_unsigned_bin(key->pubkey.y,
1038 (unsigned char *) public_key + 1 +
1039 ((public_len - 1) >> 1),
1040 (public_len - 1) >> 1)) != CRYPT_OK) {
1041 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1050 if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
1051 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1056 /* is it a point on the curve? */
1057 if ((err = tls_is_point(key)) != CRYPT_OK) {
1058 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
1059 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1068 static int tls_verify_ecdsa(struct TLSContext *context,
1069 unsigned int hash_type,
1070 const unsigned char *buffer,
1072 const unsigned char *message,
1073 unsigned int message_len,
1074 const struct ECCCurveParameters *curve_hint)
1080 curve_hint = context->curve;
1084 return TLS_GENERIC_ERROR;
1087 struct TLSCertificate **cert;
1090 if (context->is_server) {
1091 cert = context->client_certificates;
1092 count = context->client_certificates_count;
1094 cert = context->certificates;
1095 count = context->certificates_count;
1098 if (count == 0 || !cert || !cert[0] || !cert[0]->pk ||
1100 return TLS_GENERIC_ERROR;
1103 err = tls_ecc_import_pk(cert[0]->pk, cert[0]->pk_len, &key,
1104 (ltc_ecc_set_type *)&curve_hint->dp);
1107 DEBUG_PRINT("Error importing ECC certificate (code: %i)", err);
1108 return TLS_GENERIC_ERROR;
1112 unsigned char hash[TLS_MAX_HASH_LEN];
1113 unsigned long hash_len = 0;
1115 switch (hash_type) {
1117 hash_idx = find_hash("md5");
1121 hash_idx = find_hash("sha1");
1125 hash_idx = find_hash("sha256");
1129 hash_idx = find_hash("sha384");
1133 hash_idx = find_hash("sha512");
1138 err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
1140 if (hash_idx < 0 || err) {
1141 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
1142 return TLS_GENERIC_ERROR;
1146 err = ecc_verify_hash(buffer, len, hash, hash_len, &ecc_stat, &key);
1154 static void prf_helper(int hash_idx, unsigned long dlen,
1155 unsigned char *output, unsigned int outlen,
1156 const unsigned char *secret,
1157 const unsigned int secret_len,
1158 const unsigned char *label,
1159 unsigned int label_len, unsigned char *seed,
1160 unsigned int seed_len, unsigned char *seed_b,
1161 unsigned int seed_b_len) {
1162 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1163 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1167 hmac_init(&hmac, hash_idx, secret, secret_len);
1168 hmac_process(&hmac, label, label_len);
1170 hmac_process(&hmac, seed, seed_len);
1171 if (seed_b && seed_b_len) {
1172 hmac_process(&hmac, seed_b, seed_b_len);
1174 hmac_done(&hmac, digest_out0, &dlen);
1177 hmac_init(&hmac, hash_idx, secret, secret_len);
1178 hmac_process(&hmac, digest_out0, dlen);
1179 hmac_process(&hmac, label, label_len);
1180 hmac_process(&hmac, seed, seed_len);
1181 if (seed_b && seed_b_len) {
1182 hmac_process(&hmac, seed_b, seed_b_len);
1184 hmac_done(&hmac, digest_out1, &dlen);
1186 unsigned int copylen = outlen;
1187 if (copylen > dlen) {
1191 for (i = 0; i < copylen; i++) {
1192 output[idx++] ^= digest_out1[i];
1200 hmac_init(&hmac, hash_idx, secret, secret_len);
1201 hmac_process(&hmac, digest_out0, dlen);
1202 hmac_done(&hmac, digest_out0, &dlen);
1206 static void tls_prf(struct TLSContext *context,
1207 unsigned char *output, unsigned int outlen,
1208 const unsigned char *secret,
1209 const unsigned int secret_len,
1210 const unsigned char *label, unsigned int label_len,
1211 unsigned char *seed, unsigned int seed_len,
1212 unsigned char *seed_b, unsigned int seed_b_len) {
1213 if (!secret || !secret_len) {
1214 DEBUG_PRINT("NULL SECRET\n");
1218 /* TODO I don't think this is right, wouldn't use md5 for tls v1.3 */
1219 if (context->version != TLS_V12) {
1220 int md5_hash_idx = find_hash("md5");
1221 int sha1_hash_idx = find_hash("sha1");
1222 int half_secret = (secret_len + 1) / 2;
1224 memset(output, 0, outlen);
1225 prf_helper(md5_hash_idx, 16, output, outlen, secret,
1226 half_secret, label, label_len, seed, seed_len,
1227 seed_b, seed_b_len);
1228 prf_helper(sha1_hash_idx, 20, output, outlen, secret +
1229 (secret_len - half_secret), secret_len -
1230 half_secret, label, label_len, seed, seed_len,
1231 seed_b, seed_b_len);
1234 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1235 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1236 unsigned long dlen = 32;
1238 unsigned int mac_length = tls_mac_length(context);
1240 if (mac_length == TLS_SHA384_MAC_SIZE) {
1241 hash_idx = find_hash("sha384");
1244 hash_idx = find_hash("sha256");
1250 hmac_init(&hmac, hash_idx, secret, secret_len);
1251 hmac_process(&hmac, label, label_len);
1252 hmac_process(&hmac, seed, seed_len);
1253 if (seed_b && seed_b_len) {
1254 hmac_process(&hmac, seed_b, seed_b_len);
1256 hmac_done(&hmac, digest_out0, &dlen);
1260 hmac_init(&hmac, hash_idx, secret, secret_len);
1261 hmac_process(&hmac, digest_out0, dlen);
1262 hmac_process(&hmac, label, label_len);
1263 hmac_process(&hmac, seed, seed_len);
1264 if (seed_b && seed_b_len) {
1265 hmac_process(&hmac, seed_b, seed_b_len);
1267 hmac_done(&hmac, digest_out1, &dlen);
1269 unsigned int copylen = outlen;
1270 if (copylen > dlen) {
1271 copylen = (unsigned int) dlen;
1274 for (i = 0; i < copylen; i++) {
1275 output[idx++] = digest_out1[i];
1283 hmac_init(&hmac, hash_idx, secret, secret_len);
1284 hmac_process(&hmac, digest_out0, dlen);
1285 hmac_done(&hmac, digest_out0, &dlen);
1290 static void tls_send_finished(struct TLSContext *context) {
1292 struct TLSPacket *packet =
1293 tls_create_packet(context, TLS_HANDSHAKE, context->version,
1294 TLS_MIN_FINISHED_OPAQUE_LEN + 64);
1295 tls_packet_uint8(packet, 20);
1297 if (context->tlsver == TLS_VERSION13) {
1298 tls_packet_uint24(packet, tls_mac_length(context));
1300 tls_packet_uint24(packet, TLS_MIN_FINISHED_OPAQUE_LEN);
1304 unsigned char hash[TLS_MAX_HASH_SIZE];
1305 unsigned long out_size = TLS_MIN_FINISHED_OPAQUE_LEN;
1306 unsigned char out[TLS_MAX_HASH_SIZE];
1307 unsigned int hash_len;
1309 int context_is_v13 = 0;
1311 if (packet->context->tlsver == TLS_VERSION13) {
1315 /* server verifies client's message */
1316 if (context->is_server) {
1317 if (context_is_v13) {
1318 hash_len = tls_get_hash(context, hash);
1319 if (!context->finished_key || !hash_len) {
1321 ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
1323 /* TODO probably need to terminate */
1324 tls_destroy_packet(packet);
1329 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
1330 DEBUG_DUMP_HEX_LABEL("HS FINISH",
1331 context->finished_key,
1334 out_size = hash_len;
1336 hmac_init(&hmac, tls_get_hash_idx(context),
1337 context->finished_key, hash_len);
1338 hmac_process(&hmac, hash, hash_len);
1339 hmac_done(&hmac, out, &out_size);
1341 hash_len = tls_done_hash(context, hash);
1342 tls_prf(context, out,
1343 TLS_MIN_FINISHED_OPAQUE_LEN,
1344 context->master_key,
1345 context->master_key_len,
1347 "server finished", 15, hash,
1349 tls_destroy_hash(context);
1353 hash_len = tls_get_hash(context, hash);
1354 tls_prf(context, out, TLS_MIN_FINISHED_OPAQUE_LEN,
1355 context->master_key,
1356 context->master_key_len,
1357 (unsigned char *) "client finished", 15,
1358 hash, hash_len, NULL, 0);
1361 tls_packet_append(packet, out, out_size);
1362 tls_packet_update(packet);
1363 DEBUG_DUMP_HEX_LABEL("VERIFY DATA", out, out_size);
1364 tls_queue_packet(packet);
1369 static int tls_key_length(struct TLSContext *context) {
1370 switch (context->cipher) {
1371 case TLS_RSA_WITH_AES_128_CBC_SHA:
1372 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1373 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1374 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1375 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1376 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1377 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1378 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1379 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1380 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1381 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1382 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1383 case TLS_AES_128_GCM_SHA256:
1385 case TLS_RSA_WITH_AES_256_CBC_SHA:
1386 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1387 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1388 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1389 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1390 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1391 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1392 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1393 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1394 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1395 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1396 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1397 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1398 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1399 case TLS_AES_256_GCM_SHA384:
1400 case TLS_CHACHA20_POLY1305_SHA256:
1406 /* 0 is none, 1 is GCM?, 2 is chacha */
1407 int tls_is_aead(struct TLSContext *context) {
1408 switch (context->cipher) {
1409 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1410 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1411 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1412 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1413 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1414 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1415 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1416 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1417 case TLS_AES_128_GCM_SHA256:
1418 case TLS_AES_256_GCM_SHA384:
1420 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1421 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1422 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1423 case TLS_CHACHA20_POLY1305_SHA256:
1429 int tls_mac_length(struct TLSContext *context) {
1430 switch (context->cipher) {
1431 case TLS_RSA_WITH_AES_128_CBC_SHA:
1432 case TLS_RSA_WITH_AES_256_CBC_SHA:
1433 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1434 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1435 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1436 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1437 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1438 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1439 return TLS_SHA1_MAC_SIZE;
1440 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1441 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1442 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1443 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1444 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1445 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1446 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1447 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1448 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1449 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1450 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1451 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1452 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1453 case TLS_AES_128_GCM_SHA256:
1454 case TLS_CHACHA20_POLY1305_SHA256:
1455 case TLS_AES_128_CCM_SHA256:
1456 case TLS_AES_128_CCM_8_SHA256:
1457 return TLS_SHA256_MAC_SIZE;
1458 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1459 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1460 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1461 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1462 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1463 case TLS_AES_256_GCM_SHA384:
1464 return TLS_SHA384_MAC_SIZE;
1469 int _private_tls13_key(struct TLSContext *context, int handshake) {
1470 int key_length = tls_key_length(context);
1471 int mac_length = tls_mac_length(context);
1473 if (!context->premaster_key || !context->premaster_key_len) {
1477 if (!key_length || !mac_length) {
1479 ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1480 key_length, mac_length);
1484 unsigned char *clientkey = NULL;
1485 unsigned char *serverkey = NULL;
1486 unsigned char *clientiv = NULL;
1487 unsigned char *serveriv = NULL;
1488 int is_aead = tls_is_aead(context);
1490 unsigned char local_keybuffer[TLS_V13_MAX_KEY_SIZE];
1491 unsigned char local_ivbuffer[TLS_V13_MAX_IV_SIZE];
1492 unsigned char remote_keybuffer[TLS_V13_MAX_KEY_SIZE];
1493 unsigned char remote_ivbuffer[TLS_V13_MAX_IV_SIZE];
1495 unsigned char prk[TLS_MAX_HASH_SIZE];
1496 unsigned char hash[TLS_MAX_HASH_SIZE];
1497 static unsigned char earlysecret[TLS_MAX_HASH_SIZE];
1499 const char *server_key = "s ap traffic";
1500 const char *client_key = "c ap traffic";
1502 server_key = "s hs traffic";
1503 client_key = "c hs traffic";
1506 unsigned char salt[TLS_MAX_HASH_SIZE];
1509 /* TODO what is the point of this ? */
1510 if (mac_length == TLS_SHA384_MAC_SIZE) {
1512 sha384_done(&md, hash);
1515 sha256_done(&md, hash);
1517 /* extract secret "early" */
1518 if (context->master_key && context->master_key_len && !handshake) {
1519 DEBUG_DUMP_HEX_LABEL("USING PREVIOUS SECRET",
1520 context->master_key,
1521 context->master_key_len);
1522 tls_hkdf_expand_label(mac_length, salt, mac_length,
1523 context->master_key, context->master_key_len,
1524 "derived", 7, hash, mac_length);
1525 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1526 tls_hkdf_extract(mac_length, prk, mac_length, salt, mac_length,
1527 earlysecret, mac_length);
1529 tls_hkdf_extract(mac_length, prk, mac_length, NULL, 0,
1530 earlysecret, mac_length);
1531 /* derive secret for handshake "tls13 derived": */
1532 DEBUG_DUMP_HEX_LABEL("null hash", hash, mac_length);
1533 tls_hkdf_expand_label(mac_length, salt, mac_length, prk,
1534 mac_length, "derived", 7, hash, mac_length);
1535 /* extract secret "handshake": */
1536 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1537 tls_hkdf_extract(mac_length, prk, mac_length,
1539 context->premaster_key,
1540 context->premaster_key_len);
1544 DEBUG_PRINT("KEY EXPANSION FAILED, NON AEAD CIPHER\n");
1548 unsigned char secret[TLS_MAX_MAC_SIZE];
1549 unsigned char hs_secret[TLS_MAX_HASH_SIZE];
1553 hash_size = tls_get_hash(context, hash);
1555 hash_size = tls_done_hash(context, hash);
1558 DEBUG_DUMP_HEX_LABEL("messages hash", hash, hash_size);
1560 if (context->is_server) {
1561 tls_hkdf_expand_label(mac_length, hs_secret, mac_length, prk,
1562 mac_length, server_key, 12, context->
1563 server_finished_hash ? context->
1564 server_finished_hash : hash, hash_size);
1565 DEBUG_DUMP_HEX_LABEL(server_key, hs_secret, mac_length);
1566 serverkey = local_keybuffer;
1567 serveriv = local_ivbuffer;
1568 clientkey = remote_keybuffer;
1569 clientiv = remote_ivbuffer;
1571 tls_hkdf_expand_label(mac_length, hs_secret,
1572 mac_length, prk, mac_length,
1575 server_finished_hash ?
1577 server_finished_hash : hash,
1579 serverkey = remote_keybuffer;
1580 serveriv = remote_ivbuffer;
1581 clientkey = local_keybuffer;
1582 clientiv = local_ivbuffer;
1585 int iv_length = TLS_13_AES_GCM_IV_LENGTH;
1587 iv_length = TLS_CHACHA20_IV_LENGTH;
1590 tls_hkdf_expand_label(mac_length, local_keybuffer, key_length,
1591 hs_secret, mac_length, "key", 3, NULL, 0);
1592 tls_hkdf_expand_label(mac_length, local_ivbuffer, iv_length, hs_secret,
1593 mac_length, "iv", 2, NULL, 0);
1595 tls_hkdf_expand_label(mac_length, secret,
1596 mac_length, prk, mac_length,
1597 context->is_server ? client_key : server_key,
1599 context->server_finished_hash ?
1600 context->server_finished_hash :
1604 tls_hkdf_expand_label(mac_length, remote_keybuffer, key_length, secret,
1605 mac_length, "key", 3, NULL, 0);
1606 tls_hkdf_expand_label(mac_length, remote_ivbuffer, iv_length, secret,
1607 mac_length, "iv", 2, NULL, 0);
1609 DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1610 DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1611 DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1612 DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1613 free(context->finished_key);
1614 free(context->remote_finished_key);
1617 context->finished_key = malloc(mac_length);
1618 context->remote_finished_key = malloc(mac_length);
1620 if (context->finished_key) {
1621 tls_hkdf_expand_label(mac_length,
1622 context->finished_key, mac_length,
1623 hs_secret, mac_length, "finished", 8,
1625 DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1629 if (context->remote_finished_key) {
1630 tls_hkdf_expand_label(mac_length,
1631 context->remote_finished_key,
1632 mac_length, secret, mac_length,
1633 "finished", 8, NULL, 0);
1634 DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1638 context->finished_key = NULL;
1639 context->remote_finished_key = NULL;
1640 free(context->server_finished_hash);
1641 context->server_finished_hash = NULL;
1644 if (context->is_server) {
1646 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1647 clientiv, iv_length);
1648 memcpy(context->crypto.ctx_local_mac.local_nonce,
1649 serveriv, iv_length);
1650 } else if (is_aead) {
1651 memcpy(context->crypto.ctx_remote_mac.remote_iv,
1652 clientiv, iv_length);
1653 memcpy(context->crypto.ctx_local_mac.local_iv,
1654 serveriv, iv_length);
1656 if (tls_crypto_create(context, key_length,
1657 serverkey, serveriv, clientkey,
1663 memcpy(context->crypto.ctx_local_mac.local_nonce,
1664 clientiv, iv_length);
1665 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1666 serveriv, iv_length);
1667 } else if (is_aead) {
1668 memcpy(context->crypto.ctx_local_mac.local_iv,
1669 clientiv, iv_length);
1670 memcpy(context->crypto.ctx_remote_mac.remote_iv,
1671 serveriv, iv_length);
1674 if (tls_crypto_create(context, key_length,
1675 clientkey, clientiv, serverkey,
1681 context->crypto.created = 1 + is_aead;
1683 free(context->master_key);
1684 context->master_key = malloc(mac_length);
1685 if (context->master_key) {
1686 memcpy(context->master_key, prk, mac_length);
1687 context->master_key_len = mac_length;
1689 context->local_sequence_number = 0;
1690 context->remote_sequence_number = 0;
1693 * extract client_mac_key(mac_key_length)
1694 * extract server_mac_key(mac_key_length)
1695 * extract client_key(enc_key_length)
1696 * extract server_key(enc_key_length)
1697 * extract client_iv(fixed_iv_lengh)
1698 * extract server_iv(fixed_iv_length)
1703 static int tls_expand_key(struct TLSContext *context) {
1704 unsigned char key[TLS_MAX_KEY_EXPANSION_SIZE];
1705 if (context->tlsver == TLS_VERSION13) {
1709 if (!context->master_key || !context->master_key_len) {
1713 int key_length = tls_key_length(context);
1714 int mac_length = tls_mac_length(context);
1716 if (!key_length || !mac_length) {
1718 ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1719 key_length, mac_length);
1722 unsigned char *clientkey = NULL;
1723 unsigned char *serverkey = NULL;
1724 unsigned char *clientiv = NULL;
1725 unsigned char *serveriv = NULL;
1726 int iv_length = TLS_AES_IV_LENGTH;
1727 int is_aead = tls_is_aead(context);
1729 if (context->is_server) {
1730 tls_prf(context, key, sizeof(key),
1731 context->master_key, context->master_key_len,
1732 (unsigned char *) "key expansion", 13,
1733 context->local_random, TLS_SERVER_RANDOM_SIZE,
1734 context->remote_random,
1735 TLS_CLIENT_RANDOM_SIZE);
1737 tls_prf(context, key, sizeof(key),
1738 context->master_key,
1739 context->master_key_len,
1740 (unsigned char *) "key expansion", 13,
1741 context->remote_random,
1742 TLS_SERVER_RANDOM_SIZE,
1743 context->local_random,
1744 TLS_CLIENT_RANDOM_SIZE);
1747 DEBUG_DUMP_HEX_LABEL("LOCAL RANDOM ", context->local_random,
1748 TLS_SERVER_RANDOM_SIZE);
1749 DEBUG_DUMP_HEX_LABEL("REMOTE RANDOM", context->remote_random,
1750 TLS_CLIENT_RANDOM_SIZE);
1751 DEBUG_PRINT("\n=========== EXPANSION ===========\n");
1752 DEBUG_DUMP_HEX(key, TLS_MAX_KEY_EXPANSION_SIZE);
1757 iv_length = TLS_CHACHA20_IV_LENGTH;
1760 iv_length = TLS_AES_GCM_IV_LENGTH;
1762 if (context->is_server) {
1763 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1764 &key[pos], mac_length);
1766 memcpy(context->crypto.ctx_local_mac.local_mac,
1767 &key[pos], mac_length);
1770 memcpy(context->crypto.ctx_local_mac.local_mac,
1771 &key[pos], mac_length);
1773 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1774 &key[pos], mac_length);
1780 clientkey = &key[pos];
1782 serverkey = &key[pos];
1784 clientiv = &key[pos];
1786 serveriv = &key[pos];
1788 DEBUG_PRINT("EXPANSION %i/%i\n", (int) pos,
1789 (int) TLS_MAX_KEY_EXPANSION_SIZE);
1790 DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1791 DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1793 DEBUG_DUMP_HEX_LABEL("CLIENT MAC KEY",
1794 context->is_server ? context->crypto.
1795 ctx_remote_mac.remote_mac : context->
1796 crypto.ctx_local_mac.local_mac,
1799 DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1800 DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1802 DEBUG_DUMP_HEX_LABEL("SERVER MAC KEY",
1803 context->is_server ? context->crypto.
1804 ctx_local_mac.local_mac : context->crypto.
1805 ctx_remote_mac.remote_mac, mac_length);
1807 if (context->is_server) {
1809 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1810 clientiv, iv_length);
1811 memcpy(context->crypto.ctx_local_mac.local_nonce,
1812 serveriv, iv_length);
1815 memcpy(context->crypto.ctx_remote_mac.
1816 remote_aead_iv, clientiv, iv_length);
1817 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1818 serveriv, iv_length);
1822 if (tls_crypto_create(context, key_length,
1823 serverkey, serveriv, clientkey,
1829 memcpy(context->crypto.ctx_local_mac.local_nonce,
1830 clientiv, iv_length);
1831 memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1832 serveriv, iv_length);
1835 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1836 clientiv, iv_length);
1837 memcpy(context->crypto.ctx_remote_mac.
1838 remote_aead_iv, serveriv, iv_length);
1842 if (tls_crypto_create(context, key_length,
1843 clientkey, clientiv, serverkey,
1850 * extract client_mac_key(mac_key_length)
1851 * extract server_mac_key(mac_key_length)
1852 * extract client_key(enc_key_length)
1853 * extract server_key(enc_key_length)
1854 * extract client_iv(fixed_iv_lengh)
1855 * extract server_iv(fixed_iv_length)
1860 int tls_compute_key(struct TLSContext *context, unsigned int key_len) {
1861 if (context->tlsver == TLS_VERSION13) {
1865 if (!context->premaster_key || !context->premaster_key_len
1867 DEBUG_PRINT("CANNOT COMPUTE MASTER SECRET\n");
1871 unsigned char master_secret_label[] = "master secret";
1872 #ifdef TLS_CHECK_PREMASTER_KEY
1873 if (!tls_cipher_is_ephemeral(context)) {
1874 uint16_t version = get16(context->premaster_key);
1875 /* this check is not true for DHE/ECDHE ciphers */
1876 if (context->version > version) {
1877 DEBUG_PRINT("Mismatch protocol version 0x(%x)\n",
1883 free(context->master_key);
1884 context->master_key_len = 0;
1885 context->master_key = NULL;
1887 context->master_key = malloc(key_len);
1888 if (!context->master_key) {
1892 context->master_key_len = key_len;
1893 if (context->is_server) {
1895 context->master_key,
1896 context->master_key_len,
1897 context->premaster_key,
1898 context->premaster_key_len,
1899 master_secret_label, 13,
1900 context->remote_random,
1901 TLS_CLIENT_RANDOM_SIZE,
1902 context->local_random,
1903 TLS_SERVER_RANDOM_SIZE);
1906 context->master_key,
1907 context->master_key_len,
1908 context->premaster_key,
1909 context->premaster_key_len,
1910 master_secret_label, 13,
1911 context->local_random,
1912 TLS_CLIENT_RANDOM_SIZE,
1913 context->remote_random,
1914 TLS_SERVER_RANDOM_SIZE);
1916 free(context->premaster_key);
1917 context->premaster_key = NULL;
1918 context->premaster_key_len = 0;
1919 DEBUG_PRINT("\n=========== Master key ===========\n");
1920 DEBUG_DUMP_HEX(context->master_key,
1921 context->master_key_len);
1923 tls_expand_key(context);
1927 int _is_oid(const unsigned char *oid, const unsigned char *compare_to,
1928 int compare_to_len) {
1930 while ((oid[i]) && (i < compare_to_len)) {
1931 if (oid[i] != compare_to[i])
1939 int _is_oid2(const unsigned char *oid, const unsigned char *compare_to,
1940 int compare_to_len, int oid_len) {
1942 if (oid_len < compare_to_len) {
1943 compare_to_len = oid_len;
1946 while (i < compare_to_len) {
1947 if (oid[i] != compare_to[i]) {
1956 struct TLSCertificate *tls_create_certificate() {
1957 struct TLSCertificate zero = { 0 };
1958 struct TLSCertificate *cert = malloc(sizeof *cert);
1962 cert->not_before[0] = 0;
1963 cert->not_after[0] = 0;
1968 int tls_certificate_valid_subject_name(const unsigned char *cert_subject,
1969 const char *subject) {
1970 /* no subjects ... */
1971 if ((!cert_subject || !cert_subject[0]) && (!subject || !subject[0])) {
1975 if (!subject || !subject[0]) {
1976 return bad_certificate;
1979 if (!cert_subject || !cert_subject[0]) {
1980 return bad_certificate;
1984 if (!strcmp((const char *) cert_subject, subject)) {
1988 const char *wildcard = strchr((const char *) cert_subject, '*');
1990 /* 6.4.3 (1) The client SHOULD NOT attempt to match a presented
1991 * identifier in which the wildcard character comprises a label
1992 * other than the left-most label
1997 * subject is [something*] .. invalid
1999 return bad_certificate;
2002 const char *match = strstr(subject, wildcard);
2003 if ((!match) && (wildcard[0] == '.')) {
2004 /* check *.domain.com against domain.com */
2006 if (!strcasecmp(subject, wildcard))
2010 unsigned long offset = (unsigned long) match -
2011 (unsigned long) subject;
2013 /* check for foo.*.domain.com against *.domain.com (invalid) */
2014 if (memchr(subject, '.', offset))
2015 return bad_certificate;
2017 /* check if exact match */
2018 if (!strcasecmp(match, wildcard)) {
2024 return bad_certificate;
2027 int tls_certificate_valid_subject(struct TLSCertificate *cert,
2028 const char *subject) {
2031 return certificate_unknown;
2034 int err = tls_certificate_valid_subject_name(cert->subject, subject);
2035 if (err && cert->san) {
2036 for (i = 0; i < cert->san_length; i++) {
2037 err = tls_certificate_valid_subject_name(cert->san[i],
2047 int tls_certificate_is_valid(struct TLSCertificate *cert) {
2049 return certificate_unknown;
2052 char ts[16]; /* YYYYMMDDHHMMSSZ */
2053 time_t t = time(NULL);
2054 struct tm *utc = gmtime(&t);
2057 strftime(ts, sizeof ts, "%Y%m%d%H%M%SZ", utc);
2059 if (strcmp(cert->not_before, ts) > 0) {
2061 ("Certificate is not yet valid, now: %s (validity: %s - %s)\n",
2062 ts, cert->not_before, cert->not_after);
2063 return certificate_expired;
2066 if (strcmp(cert->not_after, ts) < 0) {
2068 ("Expired certificate, now: %s (validity: %s - %s)\n",
2069 ts, cert->not_before, cert->not_after);
2070 return certificate_expired;
2072 DEBUG_PRINT("Valid certificate, now: %s (validity: %s - %s)\n",
2073 ts, cert->not_before,
2079 void tls_certificate_set_copy(unsigned char **member,
2080 const unsigned char *val, int len) {
2088 *member = malloc(len + 1);
2090 memcpy(*member, val, len);
2098 void tls_certificate_set_copy_date(unsigned char *member,
2099 const unsigned char *val, int len) {
2102 if (val[0] >= '5') {
2109 memcpy(member + 2, val, len);
2116 void tls_certificate_set_key(struct TLSCertificate *cert,
2117 const unsigned char *val, int len) {
2118 if (!val[0] && len % 2) {
2122 tls_certificate_set_copy(&cert->pk, val, len);
2128 void tls_certificate_set_priv(struct TLSCertificate *cert,
2129 const unsigned char *val, int len) {
2130 tls_certificate_set_copy(&cert->priv, val, len);
2132 cert->priv_len = len;
2136 void tls_certificate_set_sign_key(struct TLSCertificate *cert,
2137 const unsigned char *val, int len) {
2138 if (!val[0] && len % 2) {
2142 tls_certificate_set_copy(&cert->sign_key, val, len);
2143 if (cert->sign_key) {
2144 cert->sign_len = len;
2148 void tls_certificate_set_exponent(struct TLSCertificate *cert,
2149 const unsigned char *val, int len) {
2150 tls_certificate_set_copy(&cert->exponent, val, len);
2151 if (cert->exponent) {
2152 cert->exponent_len = len;
2156 void tls_certificate_set_serial(struct TLSCertificate *cert,
2157 const unsigned char *val, int len) {
2158 tls_certificate_set_copy(&cert->serial_number, val, len);
2159 if (cert->serial_number) {
2160 cert->serial_len = len;
2164 void tls_certificate_set_algorithm(unsigned int *algorithm,
2165 const unsigned char *val, int len) {
2166 if (len == 7 && _is_oid(val, TLS_EC_PUBLIC_KEY_OID, 7)) {
2167 *algorithm = TLS_EC_PUBLIC_KEY;
2172 if (_is_oid(val, TLS_EC_prime192v1_OID, len)) {
2173 *algorithm = TLS_EC_prime192v1;
2176 if (_is_oid(val, TLS_EC_prime192v2_OID, len)) {
2177 *algorithm = TLS_EC_prime192v2;
2180 if (_is_oid(val, TLS_EC_prime192v3_OID, len)) {
2181 *algorithm = TLS_EC_prime192v3;
2184 if (_is_oid(val, TLS_EC_prime239v1_OID, len)) {
2185 *algorithm = TLS_EC_prime239v1;
2188 if (_is_oid(val, TLS_EC_prime239v2_OID, len)) {
2189 *algorithm = TLS_EC_prime239v2;
2192 if (_is_oid(val, TLS_EC_prime239v3_OID, len)) {
2193 *algorithm = TLS_EC_prime239v3;
2196 if (_is_oid(val, TLS_EC_prime256v1_OID, len)) {
2197 *algorithm = TLS_EC_prime256v1;
2203 (val, TLS_EC_secp224r1_OID, len,
2204 sizeof(TLS_EC_secp224r1_OID) - 1)) {
2205 *algorithm = TLS_EC_secp224r1;
2209 (val, TLS_EC_secp384r1_OID, len,
2210 sizeof(TLS_EC_secp384r1_OID) - 1)) {
2211 *algorithm = TLS_EC_secp384r1;
2215 (val, TLS_EC_secp521r1_OID, len,
2216 sizeof(TLS_EC_secp521r1_OID) - 1)) {
2217 *algorithm = TLS_EC_secp521r1;
2225 if (_is_oid(val, TLS_RSA_SIGN_SHA256_OID, 9)) {
2226 *algorithm = TLS_RSA_SIGN_SHA256;
2230 if (_is_oid(val, TLS_RSA_SIGN_RSA_OID, 9)) {
2231 *algorithm = TLS_RSA_SIGN_RSA;
2235 if (_is_oid(val, TLS_RSA_SIGN_SHA1_OID, 9)) {
2236 *algorithm = TLS_RSA_SIGN_SHA1;
2240 if (_is_oid(val, TLS_RSA_SIGN_SHA512_OID, 9)) {
2241 *algorithm = TLS_RSA_SIGN_SHA512;
2245 if (_is_oid(val, TLS_RSA_SIGN_SHA384_OID, 9)) {
2246 *algorithm = TLS_RSA_SIGN_SHA384;
2250 if (_is_oid(val, TLS_RSA_SIGN_MD5_OID, 9)) {
2251 *algorithm = TLS_RSA_SIGN_MD5;
2256 void tls_destroy_certificate(struct TLSCertificate *cert) {
2259 free(cert->exponent);
2261 free(cert->issuer_country);
2262 free(cert->issuer_state);
2263 free(cert->issuer_location);
2264 free(cert->issuer_entity);
2265 free(cert->issuer_subject);
2266 free(cert->country);
2268 free(cert->location);
2269 free(cert->subject);
2270 for (i = 0; i < cert->san_length; i++) {
2275 free(cert->serial_number);
2277 cert->not_before[0] = 0;
2278 cert->not_after[0] = 0;
2279 free(cert->sign_key);
2281 free(cert->der_bytes);
2283 free(cert->fingerprint);
2288 struct TLSPacket *tls_create_packet(struct TLSContext *context,
2290 unsigned short version,
2291 int payload_size_hint) {
2292 struct TLSPacket *packet = malloc(sizeof *packet);
2297 if (payload_size_hint > 0) {
2298 packet->size = payload_size_hint + 10;
2300 packet->size = TLS_BLOB_INCREMENT;
2302 packet->buf = malloc(packet->size);
2303 memset(packet->buf, 0, packet->size);
2304 packet->context = context;
2310 packet->payload_pos = 6;
2311 packet->len = packet->payload_pos - 1;
2315 packet->buf[0] = type;
2317 /* big endian protocol version */
2318 packet->buf[1] = version >> 8;
2319 packet->buf[2] = version & 0xff;
2320 if (version == TLS_V13) {
2321 packet->buf[2] = 0x04;
2327 void tls_destroy_packet(struct TLSPacket *packet) {
2336 int tls_crypto_create(struct TLSContext *context, int key_length,
2337 unsigned char *localkey,
2338 unsigned char *localiv,
2339 unsigned char *remotekey,
2340 unsigned char *remoteiv) {
2341 if (context->crypto.created) {
2342 if (context->crypto.created == 1) {
2343 cbc_done(&context->crypto.ctx_remote.aes_remote);
2344 cbc_done(&context->crypto.ctx_local.aes_local);
2346 if (context->crypto.created == 2) {
2347 unsigned char dummy_buffer[32];
2348 unsigned long tag_len = 0;
2349 gcm_done(&context->crypto.ctx_remote.
2350 aes_gcm_remote, dummy_buffer,
2352 gcm_done(&context->crypto.ctx_local.
2353 aes_gcm_local, dummy_buffer,
2357 context->crypto.created = 0;
2359 int is_aead = tls_is_aead(context);
2360 int cipherID = find_cipher("aes");
2361 DEBUG_PRINT("Using cipher ID: %x\n", (int) context->cipher);
2363 unsigned int counter = 1;
2365 chacha_keysetup(&context->crypto.ctx_local.chacha_local,
2366 localkey, key_length * 8);
2367 chacha_ivsetup_96bitnonce(&context->crypto.ctx_local.
2368 chacha_local, localiv,
2369 (unsigned char *) &counter);
2371 chacha_keysetup(&context->crypto.ctx_remote.chacha_remote,
2372 remotekey, key_length * 8);
2373 chacha_ivsetup_96bitnonce(&context->crypto.ctx_remote.
2374 chacha_remote, remoteiv,
2375 (unsigned char *) &counter);
2377 context->crypto.created = 3;
2381 gcm_init(&context->crypto.ctx_local.aes_gcm_local,
2382 cipherID, localkey, key_length);
2384 gcm_init(&context->crypto.ctx_remote.aes_gcm_remote,
2385 cipherID, remotekey, key_length);
2388 return TLS_GENERIC_ERROR;
2390 context->crypto.created = 2;
2393 cbc_start(cipherID, localiv, localkey, key_length, 0,
2394 &context->crypto.ctx_local.aes_local);
2396 cbc_start(cipherID, remoteiv, remotekey, key_length, 0,
2397 &context->crypto.ctx_remote.aes_remote);
2400 return TLS_GENERIC_ERROR;
2402 context->crypto.created = 1;
2408 static void tls_crypto_done(struct TLSContext *context) {
2409 unsigned char dummy_buffer[32];
2410 unsigned long tag_len = 0;
2412 switch (context->crypto.created) {
2414 cbc_done(&context->crypto.ctx_remote.aes_remote);
2415 cbc_done(&context->crypto.ctx_local.aes_local);
2418 gcm_done(&context->crypto.ctx_remote.aes_gcm_remote,
2419 dummy_buffer, &tag_len);
2420 gcm_done(&context->crypto.ctx_local.aes_gcm_local,
2421 dummy_buffer, &tag_len);
2424 context->crypto.created = 0;
2427 int tls_packet_append(struct TLSPacket *packet, const unsigned char *buf,
2431 if (!packet || packet->broken) {
2439 unsigned int new_len = packet->len + len;
2441 if (new_len > packet->size) {
2442 packet->size = (new_len / TLS_BLOB_INCREMENT + 1) *
2444 new = TLS_REALLOC(packet->buf, packet->size);
2455 memcpy(packet->buf + packet->len, buf, len);
2456 packet->len = new_len;
2460 int tls_packet_uint8(struct TLSPacket *packet, unsigned char i) {
2461 return tls_packet_append(packet, &i, 1);
2464 int tls_packet_uint16(struct TLSPacket *packet, unsigned short i) {
2465 unsigned short ni = htons(i);
2466 return tls_packet_append(packet, (unsigned char *) &ni, 2);
2469 int tls_packet_uint32(struct TLSPacket *packet, unsigned int i) {
2470 unsigned int ni = htonl(i);
2471 return tls_packet_append(packet, (unsigned char *) &ni, 4);
2474 int tls_packet_uint24(struct TLSPacket *packet, unsigned int i) {
2475 unsigned char buf[3];
2476 buf[0] = (i >> 16) & 0xff;
2477 buf[1] = (i >> 8) & 0xff;
2478 buf[2] = (i >> 0) & 0xff;
2480 return tls_packet_append(packet, buf, 3);
2483 int tls_random(unsigned char *key, int len) {
2485 for (int i = 0; i < len; i++) {
2486 unsigned int v = arc4random() % 0x100;
2491 /* TODO use open and read */
2492 FILE *fp = fopen("/dev/urandom", "r");
2494 int key_len = fread(key, 1, len, fp);
2503 int tls_established(struct TLSContext *context) {
2504 return context && context->connection_status == TLS_CONNECTED;
2507 void tls_read_clear(struct TLSContext *context) {
2509 tls_buffer_free(&context->application_buffer);
2513 struct TLSContext *tls_create_context(int is_server, unsigned short version) {
2514 struct TLSContext zero = {0};
2516 struct TLSContext *context = 0;
2518 if (version == TLS_V13 && !is_server) {
2519 /* TLS 1.3 clients not supported */
2527 context = malloc(sizeof *context);
2533 ver = version - 0x0201;
2537 context->is_server = is_server;
2538 context->version = version;
2539 context->tlsver = ver;
2540 context->hs_index = -1;
2541 /* set up output buffer */
2542 tls_buffer_init(&context->output_buffer, 0);
2543 tls_buffer_init(&context->input_buffer, 0);
2544 tls_buffer_init(&context->cached_handshake, 0);
2545 tls_buffer_init(&context->application_buffer, 0);
2550 struct TLSContext *tls_accept(struct TLSContext *context) {
2551 if (!context || !context->is_server) {
2555 struct TLSContext *child = malloc(sizeof *child);
2557 memset(child, 0, sizeof(struct TLSContext));
2558 child->is_server = 1;
2559 child->is_child = 1;
2560 child->version = context->version;
2561 child->certificates = context->certificates;
2562 child->certificates_count = context->certificates_count;
2563 child->private_key = context->private_key;
2564 child->ec_private_key = context->ec_private_key;
2565 child->root_certificates = context->root_certificates;
2566 child->root_count = context->root_count;
2567 child->default_dhe_p = context->default_dhe_p;
2568 child->default_dhe_g = context->default_dhe_g;
2569 child->curve = context->curve;
2570 child->alpn = context->alpn;
2571 child->alpn_count = context->alpn_count;
2576 int tls_add_alpn(struct TLSContext *context, const char *alpn) {
2579 if (!context || !alpn || !alpn[0]
2580 || (context->is_server && context->is_child)) {
2581 return TLS_GENERIC_ERROR;
2584 int len = strlen(alpn);
2585 if (tls_alpn_contains(context, alpn, len)) {
2589 new = TLS_REALLOC(context->alpn, (context->alpn_count + 1) *
2592 context->alpn = new;
2594 free(context->alpn);
2596 context->alpn_count = 0;
2597 return TLS_NO_MEMORY;
2599 char *alpn_ref = malloc(len + 1);
2600 context->alpn[context->alpn_count] = alpn_ref;
2602 memcpy(alpn_ref, alpn, len);
2604 context->alpn_count++;
2606 return TLS_NO_MEMORY;
2611 int tls_alpn_contains(struct TLSContext *context, const char *alpn,
2612 unsigned char alpn_size) {
2615 if (!context || !alpn || !alpn_size || !context->alpn) {
2619 for (i = 0; i < context->alpn_count; i++) {
2620 const char *alpn_local = context->alpn[i];
2622 int len = strlen(alpn_local);
2623 if (alpn_size == len) {
2624 if (!memcmp(alpn_local, alpn, alpn_size)) {
2634 void tls_destroy_context(struct TLSContext *context) {
2641 if (!context->is_child) {
2642 if (context->certificates) {
2643 for (i = 0; i < context->certificates_count; i++) {
2644 tls_destroy_certificate(context->
2648 if (context->root_certificates) {
2649 for (i = 0; i < context->root_count; i++) {
2650 tls_destroy_certificate(context->
2651 root_certificates[i]);
2653 free(context->root_certificates);
2654 context->root_certificates = NULL;
2656 if (context->private_key) {
2657 tls_destroy_certificate(context->private_key);
2659 if (context->ec_private_key) {
2660 tls_destroy_certificate(context->ec_private_key);
2662 free(context->certificates);
2663 free(context->default_dhe_p);
2664 free(context->default_dhe_g);
2665 if (context->alpn) {
2666 for (i = 0; i < context->alpn_count; i++) {
2667 free(context->alpn[i]);
2669 free(context->alpn);
2673 if (context->client_certificates) {
2674 for (i = 0; i < context->client_certificates_count; i++) {
2675 tls_destroy_certificate(context->
2676 client_certificates[i]);
2678 free(context->client_certificates);
2681 context->client_certificates = NULL;
2682 free(context->master_key);
2683 free(context->premaster_key);
2685 if (context->crypto.created) {
2686 tls_crypto_done(context);
2689 tls_done_hash(context, NULL);
2690 tls_destroy_hash(context);
2692 tls_buffer_free(&context->output_buffer);
2693 tls_buffer_free(&context->input_buffer);
2694 tls_buffer_free(&context->application_buffer);
2695 tls_buffer_free(&context->cached_handshake);
2696 //free(context->cached_handshake);
2699 tls_dhe_free(context);
2700 tls_ecc_dhe_free(context);
2701 free(context->negotiated_alpn);
2702 free(context->finished_key);
2703 free(context->remote_finished_key);
2704 free(context->server_finished_hash);
2708 int tls_cipher_is_ephemeral(struct TLSContext *context) {
2713 switch (context->cipher) {
2714 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2715 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2716 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2717 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
2718 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2719 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
2720 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2722 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2723 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2724 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2725 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2726 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
2727 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2728 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2729 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2730 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2731 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2732 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2733 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2734 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2736 case TLS_AES_128_GCM_SHA256:
2737 case TLS_CHACHA20_POLY1305_SHA256:
2738 case TLS_AES_128_CCM_SHA256:
2739 case TLS_AES_128_CCM_8_SHA256:
2740 case TLS_AES_256_GCM_SHA384:
2749 int tls_is_ecdsa(struct TLSContext *context) {
2754 switch (context->cipher) {
2755 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2756 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2757 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2758 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2759 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2760 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2761 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2765 if (context->ec_private_key) {
2772 static void tls_send_server_key_exchange(struct TLSContext *context,
2774 if (!context->is_server) {
2776 ("CANNOT BUILD SERVER KEY EXCHANGE MESSAGE FOR CLIENTS\n");
2780 struct TLSPacket *packet =
2781 tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
2782 tls_packet_uint8(packet, 0x0C);
2783 unsigned char dummy[3];
2784 tls_packet_append(packet, dummy, 3);
2785 int start_len = packet->len;
2787 if (method == KEA_dhe_rsa) {
2788 tls_dhe_create(context);
2790 const char *default_dhe_p = context->default_dhe_p;
2791 const char *default_dhe_g = context->default_dhe_g;
2793 if (!default_dhe_p || !default_dhe_g) {
2794 default_dhe_p = TLS_DH_DEFAULT_P;
2795 default_dhe_g = TLS_DH_DEFAULT_G;
2796 key_size = TLS_DHE_KEY_SIZE / 8;
2798 key_size = strlen(default_dhe_p);
2800 if (tls_dh_make_key(key_size, context->dhe, default_dhe_p,
2801 default_dhe_g, 0, 0)) {
2802 DEBUG_PRINT("ERROR CREATING DHE KEY\n");
2805 context->dhe = NULL;
2806 /* TODO set error */
2810 unsigned char dh_Ys[0xFFF];
2811 unsigned char dh_p[0xFFF];
2812 unsigned char dh_g[0xFFF];
2813 unsigned long dh_p_len = sizeof(dh_p);
2814 unsigned long dh_g_len = sizeof(dh_g);
2815 unsigned long dh_Ys_len = sizeof(dh_Ys);
2817 if (tls_dh_export_pqY
2818 (dh_p, &dh_p_len, dh_g, &dh_g_len, dh_Ys, &dh_Ys_len,
2820 DEBUG_PRINT("ERROR EXPORTING DHE KEY\n");
2822 /* TODO set error */
2826 DEBUG_PRINT("LEN: %lu (%lu, %lu)\n", dh_Ys_len, dh_p_len,
2828 DEBUG_DUMP_HEX_LABEL("DHE PK", dh_Ys, dh_Ys_len);
2829 DEBUG_DUMP_HEX_LABEL("DHE P", dh_p, dh_p_len);
2830 DEBUG_DUMP_HEX_LABEL("DHE G", dh_g, dh_g_len);
2832 tls_packet_uint16(packet, dh_p_len);
2833 tls_packet_append(packet, dh_p, dh_p_len);
2835 tls_packet_uint16(packet, dh_g_len);
2836 tls_packet_append(packet, dh_g, dh_g_len);
2838 tls_packet_uint16(packet, dh_Ys_len);
2839 tls_packet_append(packet, dh_Ys, dh_Ys_len);
2843 } else if (method == KEA_ec_diffie_hellman) {
2844 /* 3 = named curve */
2845 if (!context->curve) {
2846 context->curve = tls_ecc_default_curve;
2848 tls_packet_uint8(packet, 3);
2849 tls_packet_uint16(packet, context->curve->iana);
2850 tls_ecc_dhe_create(context);
2852 ltc_ecc_set_type *dp =
2853 (ltc_ecc_set_type *) & context->curve->dp;
2855 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
2857 free(context->ecc_dhe);
2858 context->ecc_dhe = NULL;
2859 DEBUG_PRINT("Error generating ECC key\n");
2861 /* TODO set error */
2864 unsigned char out[TLS_MAX_RSA_KEY];
2865 unsigned long out_len = TLS_MAX_RSA_KEY;
2866 if (ecc_ansi_x963_export(context->ecc_dhe, out, &out_len)) {
2867 DEBUG_PRINT("Error exporting ECC key\n");
2872 tls_packet_uint8(packet, out_len);
2873 tls_packet_append(packet, out, out_len);
2877 DEBUG_PRINT("Unsupported ephemeral method: %i\n", method);
2882 unsigned int params_len = packet->len - start_len;
2883 unsigned int message_len =
2884 params_len + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
2885 unsigned char *message = malloc(message_len);
2887 unsigned char out[TLS_MAX_RSA_KEY];
2888 unsigned long out_len = TLS_MAX_RSA_KEY;
2892 hash_algorithm = sha256;
2894 if (tls_is_ecdsa(context)) {
2895 hash_algorithm = sha512;
2896 tls_packet_uint8(packet, hash_algorithm);
2897 tls_packet_uint8(packet, ecdsa);
2899 tls_packet_uint8(packet, hash_algorithm);
2900 tls_packet_uint8(packet, rsa_sign);
2903 memcpy(message, context->remote_random,
2904 TLS_CLIENT_RANDOM_SIZE);
2905 memcpy(message + TLS_CLIENT_RANDOM_SIZE, context->local_random,
2906 TLS_SERVER_RANDOM_SIZE);
2907 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
2908 TLS_SERVER_RANDOM_SIZE, packet->buf +
2909 start_len, params_len);
2910 if (tls_is_ecdsa(context)) {
2911 if (sign_ecdsa(context, hash_algorithm, message,
2912 message_len, out, &out_len) ==
2915 ("Signing OK! (ECDSA, length %lu)\n",
2917 tls_packet_uint16(packet, out_len);
2918 tls_packet_append(packet, out, out_len);
2921 if (sign_rsa(context, hash_algorithm, message, message_len,
2922 out, &out_len) == 1) {
2923 DEBUG_PRINT("Signing OK! (length %lu)\n", out_len);
2924 tls_packet_uint16(packet, out_len);
2925 tls_packet_append(packet, out, out_len);
2929 if (!packet->broken && packet->buf) {
2930 tls_set_packet_length(packet, packet->len - start_len);
2932 tls_packet_update(packet);
2933 tls_queue_packet(packet);
2938 void _private_tls_set_session_id(struct TLSContext *context) {
2939 if (context->tlsver == TLS_VERSION13
2940 && context->session_size == TLS_MAX_SESSION_ID) {
2944 if (tls_random(context->session, TLS_MAX_SESSION_ID)) {
2945 context->session_size = TLS_MAX_SESSION_ID;
2947 context->session_size = 0;
2952 struct TLSPacket *tls_certificate_request(struct TLSContext *context) {
2953 if (!context || !context->is_server) {
2957 unsigned short packet_version = context->version;
2958 struct TLSPacket *packet =
2959 tls_create_packet(context, TLS_HANDSHAKE, packet_version, 0);
2965 /* cert request and size placeholder */
2966 unsigned char dummy[] = { 0x0d, 0, 0, 0 };
2967 tls_packet_append(packet, dummy, sizeof dummy);
2969 int start_len = packet->len;
2971 if (context->tlsver == TLS_VERSION13) {
2972 /* certificate request context */
2973 tls_packet_uint8(packet, 0);
2975 tls_packet_uint16(packet, 18);
2976 /* signature algorithms */
2977 tls_packet_uint16(packet, 0x0D);
2978 tls_packet_uint16(packet, 14);
2979 tls_packet_uint16(packet, 12);
2982 tls_packet_uint16(packet, 0x0401);
2984 tls_packet_uint16(packet, 0x0501);
2986 tls_packet_uint16(packet, 0x0601);
2989 /* ecdsa_secp256r1_sha256 */
2990 tls_packet_uint16(packet, 0x0403);
2991 /* ecdsa_secp384r1_sha384 */
2992 tls_packet_uint16(packet, 0x0503);
2993 /* ecdsa_secp521r1_sha512 */
2994 tls_packet_uint16(packet, 0x0604);
2995 /* rsa_pss_rsae_sha256 */
2996 tls_packet_uint16(packet, 0x0804);
2997 /* rsa_pss_rsae_sha384 */
2998 tls_packet_uint16(packet, 0x0805);
2999 /* rsa_pss_rsae_sha512 */
3000 tls_packet_uint16(packet, 0x0806);
3002 tls_packet_uint8(packet, 1);
3003 tls_packet_uint8(packet, rsa_sign);
3004 if (context->version == TLS_V12) {
3005 /* 10 pairs or 2 bytes */
3006 tls_packet_uint16(packet, 10);
3007 tls_packet_uint8(packet, sha256);
3008 tls_packet_uint8(packet, rsa);
3009 tls_packet_uint8(packet, sha1);
3010 tls_packet_uint8(packet, rsa);
3011 tls_packet_uint8(packet, sha384);
3012 tls_packet_uint8(packet, rsa);
3013 tls_packet_uint8(packet, sha512);
3014 tls_packet_uint8(packet, rsa);
3015 tls_packet_uint8(packet, md5);
3016 tls_packet_uint8(packet, rsa);
3018 /* no DistinguishedName yet */
3019 tls_packet_uint16(packet, 0);
3021 if (!packet->broken) {
3022 tls_set_packet_length(packet, packet->len - start_len);
3024 tls_packet_update(packet);
3028 int tls_parse_key_share(struct TLSContext *context, const unsigned char *buf,
3031 struct ECCCurveParameters *curve = 0;
3032 struct DHKey *dhkey = 0;
3033 int dhe_key_size = 0;
3034 const unsigned char *buffer = NULL;
3035 unsigned char *out2;
3036 unsigned long out_size;
3039 while (buf_len >= 4) {
3040 uint16_t named_group = get16(&buf[i]);
3044 key_size = get16(&buf[i]);
3048 if (key_size > buf_len) {
3049 return TLS_BROKEN_PACKET;
3052 switch (named_group) {
3056 DEBUG_PRINT("KEY SHARE => secp256r1\n");
3063 DEBUG_PRINT("KEY SHARE => secp384r1\n");
3071 if (key_size != 32) {
3073 ("INVALID x25519 KEY SIZE (%i)\n",
3077 curve = &curve25519;
3079 DEBUG_PRINT("KEY SHARE => x25519\n");
3089 dhe_key_size = 2048;
3093 dhe_key_size = 3072;
3097 dhe_key_size = 4096;
3101 dhe_key_size = 6144;
3105 dhe_key_size = 8192;
3109 buf_len -= key_size;
3113 context->curve = curve;
3115 if (curve == &curve25519) {
3116 if (!tls_random(context->local_random,
3117 TLS_SERVER_RANDOM_SIZE)) {
3118 return TLS_GENERIC_ERROR;
3121 unsigned char secret[32];
3122 static const unsigned char basepoint[32] = { 9 };
3124 tls_random(secret, 32);
3130 /* use finished key to store public key */
3131 free(context->finished_key);
3132 context->finished_key = malloc(32);
3133 if (!context->finished_key) {
3134 return TLS_GENERIC_ERROR;
3137 x25519(context->finished_key, secret, basepoint);
3139 free(context->premaster_key);
3140 context->premaster_key = malloc(32);
3142 if (!context->premaster_key) {
3143 return TLS_GENERIC_ERROR;
3146 x25519(context->premaster_key, secret, buffer);
3147 context->premaster_key_len = 32;
3152 tls_ecc_dhe_create(context);
3153 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&context->curve->dp;
3155 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
3157 free(context->ecc_dhe);
3158 context->ecc_dhe = NULL;
3159 DEBUG_PRINT("Error generating ECC DHE key\n");
3160 return TLS_GENERIC_ERROR;
3163 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE)) {
3164 return TLS_GENERIC_ERROR;
3168 memset(&client_key, 0, sizeof client_key);
3169 if (ecc_ansi_x963_import_ex
3170 (buffer, key_size, &client_key, dp)) {
3171 DEBUG_PRINT("Error importing ECC DHE key\n");
3172 return TLS_GENERIC_ERROR;
3174 out2 = malloc(key_size);
3175 out_size = key_size;
3177 int err = ecc_shared_secret(context->ecc_dhe, &client_key,
3179 ecc_free(&client_key);
3182 DEBUG_PRINT("ECC DHE DECRYPT ERROR %i\n", err);
3184 return TLS_GENERIC_ERROR;
3187 DEBUG_PRINT("OUT_SIZE: %lu\n", out_size);
3188 DEBUG_DUMP_HEX_LABEL("ECC DHE", out2, out_size);
3190 free(context->premaster_key);
3191 context->premaster_key = out2;
3192 context->premaster_key_len = out_size;
3195 tls_dhe_create(context);
3196 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE))
3198 return TLS_GENERIC_ERROR;
3201 if (tls_dh_make_key(dhe_key_size / 8, context->dhe,
3202 (const char *)dhkey->p, (const char *)dhkey->g, 0, 0)) {
3204 context->dhe = NULL;
3205 DEBUG_PRINT("Error generating DHE key\n");
3206 return TLS_GENERIC_ERROR;
3209 unsigned int dhe_out_size;
3210 out2 = tls_decrypt_dhe(context, buffer, key_size,
3213 DEBUG_PRINT("Error generating DHE shared key\n");
3214 return TLS_GENERIC_ERROR;
3217 free(context->premaster_key);
3218 context->premaster_key = out2;
3219 context->premaster_key_len = dhe_out_size;
3221 context->dhe->iana = dhkey->iana;
3225 DEBUG_PRINT("NO COMMON KEY SHARE SUPPORTED\n");
3226 return TLS_NO_COMMON_CIPHER;
3229 int tls_parse_certificate(struct TLSContext *context,
3230 const unsigned char *buf, int buf_len,
3234 return TLS_NEED_MORE_DATA;
3237 int size = get24(buf);
3239 /* not enough data, so just consume all of it */
3244 res += 3; /* skip over the size field */
3246 if (context->tlsver == TLS_VERSION13) {
3247 int context_size = buf[res];
3251 res += context_size;
3255 if (buf_len - res < size) {
3256 return TLS_NEED_MORE_DATA;
3260 int valid_certificate = 0;
3263 if (buf_len - res < 3) {
3264 return TLS_NEED_MORE_DATA;
3266 int certificate_size = get24(buf+res);
3268 if (buf_len - res < certificate_size) {
3269 return TLS_NEED_MORE_DATA;
3272 int certificates_in_chain = 0;
3274 unsigned int remaining = certificate_size;
3276 if (remaining <= 3) {
3279 certificates_in_chain++;
3280 unsigned int certificate_size2 = get24(buf+res2);
3283 if (certificate_size2 > remaining) {
3285 ("Invalid certificate size (%i from %i bytes remaining)\n",
3286 certificate_size2, remaining);
3289 remaining -= certificate_size2;
3291 struct TLSCertificate *cert = asn1_parse(context,
3297 if (certificate_size2) {
3299 malloc(certificate_size2);
3308 /* valid certificate */
3311 valid_certificate = 1;
3314 TLS_REALLOC(context->
3315 client_certificates,
3317 client_certificates_count
3326 client_certificates);
3328 client_certificates =
3330 return TLS_NO_MEMORY;
3333 context->client_certificates = new;
3336 [context->client_certificates_count]
3339 client_certificates_count++;
3343 TLS_REALLOC(context->
3355 context->certificates = 0;
3356 return TLS_NO_MEMORY;
3358 context->certificates = new;
3359 context->certificates[context->
3362 context->certificates_count++;
3363 if ((cert->pk) || (cert->priv))
3364 valid_certificate = 1;
3365 else if (!context->is_server)
3366 valid_certificate = 1;
3369 res2 += certificate_size2;
3371 if (context->tlsver == TLS_VERSION13) {
3372 if (remaining >= 2) {
3373 /* ignore extensions */
3375 uint16_t size = get16(&buf[res2]);
3376 if (size && size >= remaining) {
3382 } while (remaining > 0);
3384 DEBUG_PRINT("Extra %i bytes after certificate\n",
3387 size -= certificate_size + 3;
3388 res += certificate_size;
3390 if (!valid_certificate) {
3392 return TLS_UNSUPPORTED_CERTIFICATE;
3394 if (res != buf_len) {
3395 DEBUG_PRINT("Warning: %i bytes read from %i byte buffer\n",
3396 (int) res, (int) buf_len);
3401 static int parse_dh( const unsigned char *buf, int buf_len, const unsigned char
3402 **out, int *out_size) {
3407 return TLS_NEED_MORE_DATA;
3409 uint16_t size = get16(buf);
3411 if (buf_len - res < size) {
3412 return TLS_NEED_MORE_DATA;
3414 DEBUG_DUMP_HEX(&buf[res], size);
3421 static int tls_parse_random(struct TLSContext *context,
3422 const unsigned char *buf, int buf_len) {
3424 int ephemeral = tls_cipher_is_ephemeral(context);
3426 if (ephemeral == 2) {
3428 return TLS_NEED_MORE_DATA;
3434 return TLS_NEED_MORE_DATA;
3440 if (buf_len - res < size) {
3441 return TLS_NEED_MORE_DATA;
3443 unsigned int out_len = 0;
3444 unsigned char *random = NULL;
3445 switch (ephemeral) {
3447 random = tls_decrypt_dhe(context, &buf[res], size, &out_len,
3451 random = tls_decrypt_ecc_dhe(context, &buf[res], size,
3455 random = decrypt_rsa(context, &buf[res], size,
3459 if (random && out_len > 2) {
3460 /* *(unsigned short *)&random[0] = htons(context->version); */
3461 DEBUG_DUMP_HEX_LABEL("PRE MASTER KEY", random, out_len);
3462 free(context->premaster_key);
3463 context->premaster_key = random;
3464 context->premaster_key_len = out_len;
3465 tls_compute_key(context, 48);
3474 static const unsigned char *parse_signature(const unsigned char *buf, int
3475 buf_len, int *hash_algorithm, int *sign_algorithm, int
3476 *sig_size, int *offset) {
3481 *hash_algorithm = _md5_sha1;
3482 *sign_algorithm = rsa_sign;
3484 *hash_algorithm = buf[res];
3486 *sign_algorithm = buf[res];
3488 uint16_t size = get16(&buf[res]);
3490 if (buf_len - res < size) {
3493 DEBUG_DUMP_HEX(&buf[res], size);
3495 *offset = res + size;
3499 int tls_parse_server_key_exchange(struct TLSContext *context,
3500 const unsigned char *buf, int buf_len) {
3504 return TLS_NEED_MORE_DATA;
3506 int size = get24(buf);
3508 const unsigned char *packet_ref = buf + res;
3509 if (buf_len - res < size) {
3510 return TLS_NEED_MORE_DATA;
3517 unsigned char has_ds_params = 0;
3519 const struct ECCCurveParameters *curve = NULL;
3520 const unsigned char *pk_key = NULL;
3521 int ephemeral = tls_cipher_is_ephemeral(context);
3523 if (ephemeral == 1) {
3526 if (buf[res++] != 3) {
3528 /* any other method is not supported */
3531 if (buf_len - res < 3) {
3532 return TLS_NEED_MORE_DATA;
3534 int iana_n = get16(&buf[res]);
3536 key_size = buf[res];
3538 if (buf_len - res < key_size) {
3539 return TLS_NEED_MORE_DATA;
3541 DEBUG_PRINT("IANA CURVE NUMBER: %i\n", iana_n);
3565 DEBUG_PRINT("UNSUPPORTED CURVE\n");
3566 return TLS_GENERIC_ERROR;
3570 context->curve = curve;
3574 const unsigned char *dh_p = NULL;
3576 const unsigned char *dh_g = NULL;
3578 const unsigned char *dh_Ys = NULL;
3581 if (has_ds_params) {
3582 DEBUG_PRINT(" dh_p: ");
3583 dh_res = parse_dh(&buf[res], buf_len - res, &dh_p, &dh_p_len);
3585 return TLS_BROKEN_PACKET;
3590 DEBUG_PRINT(" dh_q: ");
3591 dh_res = parse_dh(&buf[res], buf_len - res, &dh_g, &dh_g_len);
3594 return TLS_BROKEN_PACKET;
3599 DEBUG_PRINT(" dh_Ys: ");
3600 dh_res = parse_dh(&buf[res], buf_len - res, &dh_Ys,
3604 return TLS_BROKEN_PACKET;
3612 int packet_size = res - 3;
3614 DEBUG_PRINT(" SIGNATURE (%i/%i/%i): ", packet_size,
3616 const unsigned char *signature =
3617 parse_signature(&buf[res], buf_len - res, &hash_algorithm,
3618 &sign_algorithm, &sign_size, &offset);
3620 if (sign_size <= 0 || !signature) {
3621 return TLS_BROKEN_PACKET;
3624 /* check signature */
3625 unsigned int message_len =
3626 packet_size + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
3627 unsigned char *message = malloc(message_len);
3629 memcpy(message, context->local_random, TLS_CLIENT_RANDOM_SIZE);
3630 memcpy(message + TLS_CLIENT_RANDOM_SIZE,
3631 context->remote_random, TLS_SERVER_RANDOM_SIZE);
3632 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
3633 TLS_SERVER_RANDOM_SIZE, packet_ref, packet_size);
3634 if (tls_is_ecdsa(context)) {
3635 if (tls_verify_ecdsa
3636 (context, hash_algorithm, signature, sign_size,
3637 message, message_len, NULL) != 1) {
3639 ("ECC Server signature FAILED!\n");
3641 return TLS_BROKEN_PACKET;
3645 if (verify_rsa(context, hash_algorithm, signature,
3647 message_len) != 1) {
3648 DEBUG_PRINT("Server signature FAILED!\n");
3650 return TLS_BROKEN_PACKET;
3656 if (buf_len - res) {
3657 DEBUG_PRINT("EXTRA %i BYTES AT THE END OF MESSAGE\n",
3659 DEBUG_DUMP_HEX(&buf[res], buf_len - res);
3663 if (ephemeral == 1) {
3664 tls_dhe_create(context);
3665 DEBUG_DUMP_HEX_LABEL("DHP", dh_p, dh_p_len);
3666 DEBUG_DUMP_HEX_LABEL("DHG", dh_g, dh_g_len);
3667 int dhe_key_size = dh_p_len;
3668 if (dh_g_len > dh_p_len) {
3669 dhe_key_size = dh_g_len;
3672 if (tls_dh_make_key(dhe_key_size, context->dhe, (const char *)
3673 dh_p, (const char *) dh_g, dh_p_len,
3675 DEBUG_PRINT("ERROR CREATING DHE KEY\n");
3677 context->dhe = NULL;
3678 return TLS_GENERIC_ERROR;
3681 unsigned int dh_key_size = 0;
3682 unsigned char *key = tls_decrypt_dhe(context, dh_Ys, dh_Ys_len,
3684 DEBUG_DUMP_HEX_LABEL("DH COMMON SECRET", key, dh_key_size);
3685 if (key && dh_key_size) {
3686 free(context->premaster_key);
3687 context->premaster_key = key;
3688 context->premaster_key_len = dh_key_size;
3690 } else if (ephemeral == 2 && curve && pk_key && key_size) {
3691 tls_ecc_dhe_create(context);
3693 ltc_ecc_set_type *dp = (ltc_ecc_set_type *) & curve->dp;
3695 (NULL, find_prng("sprng"), context->ecc_dhe, dp)) {
3696 free(context->ecc_dhe);
3697 context->ecc_dhe = NULL;
3698 DEBUG_PRINT("Error generating ECC key\n");
3699 return TLS_GENERIC_ERROR;
3702 free(context->premaster_key);
3703 context->premaster_key_len = 0;
3705 unsigned int out_len = 0;
3706 context->premaster_key =
3707 tls_decrypt_ecc_dhe(context, pk_key, key_size,
3709 if (context->premaster_key) {
3710 context->premaster_key_len = out_len;
3717 int tls_parse_client_key_exchange(struct TLSContext *context,
3718 const unsigned char *buf, int buf_len) {
3719 if (context->connection_status != 1) {
3721 ("UNEXPECTED CLIENT KEY EXCHANGE MESSAGE (connections status: %i)\n",
3722 (int) context->connection_status);
3723 return TLS_UNEXPECTED_MESSAGE;
3729 return TLS_NEED_MORE_DATA;
3731 int size = get24(buf);
3734 if (buf_len - res < size) {
3735 return TLS_NEED_MORE_DATA;
3742 dh_res = tls_parse_random(context, &buf[res], size);
3744 DEBUG_PRINT("broken key\n");
3745 return TLS_BROKEN_PACKET;
3750 context->connection_status = 2;
3754 static int tls_parse_server_hello_done(const unsigned char *buf, int buf_len) {
3757 return TLS_NEED_MORE_DATA;
3759 int size = get24(buf);
3762 if (buf_len - res < size) {
3763 return TLS_NEED_MORE_DATA;
3771 int tls_parse_finished(struct TLSContext *context,
3772 const unsigned char *buf, int buf_len,
3773 unsigned int *write_packets) {
3774 if (context->connection_status < 2
3775 || context->connection_status == TLS_CONNECTED) {
3776 DEBUG_PRINT("UNEXPECTED FINISHED MESSAGE\n");
3777 return TLS_UNEXPECTED_MESSAGE;
3783 return TLS_NEED_MORE_DATA;
3785 int size = get24(buf);
3788 if (size < TLS_MIN_FINISHED_OPAQUE_LEN) {
3789 DEBUG_PRINT("Invalid finished packet size: %i\n", size);
3790 return TLS_BROKEN_PACKET;
3793 if (buf_len - res < size) {
3794 return TLS_NEED_MORE_DATA;
3797 unsigned char hash[TLS_MAX_SHA_SIZE];
3798 unsigned int hash_len = tls_get_hash(context, hash);
3800 if (context->tlsver == TLS_VERSION13) {
3801 unsigned char hash_out[TLS_MAX_SHA_SIZE];
3802 unsigned long out_size = TLS_MAX_SHA_SIZE;
3803 if (!context->remote_finished_key || !hash_len) {
3805 ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
3806 return TLS_NOT_VERIFIED;
3809 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
3810 DEBUG_DUMP_HEX_LABEL("HS FINISH", context->remote_finished_key,
3813 out_size = hash_len;
3815 hmac_init(&hmac, tls_get_hash_idx(context),
3816 context->remote_finished_key, hash_len);
3817 hmac_process(&hmac, hash, hash_len);
3818 hmac_done(&hmac, hash_out, &out_size);
3820 if (size != (int)out_size || memcmp(hash_out, &buf[res], size)) {
3822 ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3823 (int) context->local_sequence_number,
3824 (int) context->remote_sequence_number);
3825 DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3827 DEBUG_DUMP_HEX_LABEL("VERIFY", hash_out, out_size);
3828 return TLS_NOT_VERIFIED;
3830 if (context->is_server) {
3831 context->connection_status = TLS_CONNECTED;
3833 _private_tls13_key(context, 0);
3834 context->local_sequence_number = 0;
3835 context->remote_sequence_number = 0;
3838 /* TODO client verify */
3841 unsigned char *out = malloc(size);
3843 DEBUG_PRINT("Error in malloc (%i bytes)\n",
3845 return TLS_NO_MEMORY;
3848 /* server verifies client's message */
3849 if (context->is_server) {
3850 tls_prf(context, out, size,
3851 context->master_key,
3852 context->master_key_len,
3854 "client finished", 15, hash,
3857 tls_prf(context, out, size,
3858 context->master_key,
3859 context->master_key_len,
3861 "server finished", 15, hash,
3865 if (memcmp(out, &buf[res], size)) {
3868 ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3869 (int) context->local_sequence_number,
3870 (int) context->remote_sequence_number);
3871 DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3873 DEBUG_DUMP_HEX_LABEL("VERIFY", out, size);
3874 return TLS_NOT_VERIFIED;
3879 if (context->is_server) {
3882 context->connection_status = TLS_CONNECTED;
3885 // fprintf(stderr, "set conn status = %d\n", context->connection_status);
3892 int tls_parse_verify_tls13(struct TLSContext *context,
3893 const unsigned char *buf, int buf_len) {
3895 return TLS_NEED_MORE_DATA;
3897 int size = get24(buf);
3903 unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
3904 int signing_data_len;
3906 /* first 64 bytes to 0x20 (32) */
3907 memset(signing_data, 0x20, 64);
3908 /* context string 33 bytes */
3909 if (context->is_server) {
3910 memcpy(signing_data + 64,
3911 "TLS 1.3, server CertificateVerify", 33);
3913 memcpy(signing_data + 64,
3914 "TLS 1.3, client CertificateVerify", 33);
3917 /* a single 0 byte separator */
3918 signing_data[97] = 0;
3919 signing_data_len = 98;
3921 signing_data_len += tls_get_hash(context, signing_data + 98);
3922 DEBUG_DUMP_HEX_LABEL("signature data", signing_data, signing_data_len);
3923 uint16_t signature = get16(&buf[3]);
3924 uint16_t signature_size = get16(&buf[5]);
3926 if (buf_len < size + 7) {
3927 return TLS_NEED_MORE_DATA;
3929 switch (signature) {
3931 /* secp256r1 + sha256 */
3933 tls_verify_ecdsa(context, sha256, buf + 7,
3934 signature_size, signing_data,
3939 /* secp384r1 + sha384 */
3940 valid = tls_verify_ecdsa(context, sha384, buf + 7,
3941 signature_size, signing_data,
3942 signing_data_len, &secp384r1);
3945 /* secp521r1 + sha512 */
3946 valid = tls_verify_ecdsa(context, sha512, buf + 7,
3947 signature_size, signing_data,
3948 signing_data_len, &secp521r1);
3951 valid = verify_rsa(context, sha256, buf + 7,
3952 signature_size, signing_data,
3956 DEBUG_PRINT("Unsupported signature: %x\n",
3958 return TLS_UNSUPPORTED_CERTIFICATE;
3961 DEBUG_PRINT("Signature FAILED!\n");
3962 return TLS_DECRYPTION_FAILED;
3967 int tls_parse_verify(struct TLSContext *context, const unsigned char *buf,
3969 if (context->tlsver == TLS_VERSION13) {
3970 return tls_parse_verify_tls13(context, buf, buf_len);
3974 return TLS_BAD_CERTIFICATE;
3977 int bytes_to_follow = get24(buf);
3979 if (buf_len - 3 < bytes_to_follow) {
3980 return TLS_BAD_CERTIFICATE;
3985 unsigned int hash = buf[3];
3986 unsigned int algorithm = buf[4];
3987 if (algorithm != rsa) {
3988 return TLS_UNSUPPORTED_CERTIFICATE;
3990 uint16_t size = get16(&buf[5]);
3991 if (bytes_to_follow - 4 < size) {
3992 return TLS_BAD_CERTIFICATE;
3994 DEBUG_PRINT("ALGORITHM %i/%i (%i)\n", hash, algorithm, (int) size);
3995 DEBUG_DUMP_HEX_LABEL("VERIFY", &buf[7], bytes_to_follow - 7);
3997 res = verify_rsa(context, hash, &buf[7], size,
3998 context->cached_handshake.buffer,
3999 context->cached_handshake.len);
4001 tls_buffer_free(&context->cached_handshake);
4003 DEBUG_PRINT("Signature OK\n");
4004 context->client_verified = 1;
4006 DEBUG_PRINT("Signature FAILED\n");
4007 context->client_verified = 0;
4012 /* TODO This is actually a parse a handshake message */
4013 int tls_parse_payload(struct TLSContext *context, const unsigned char *buf,
4016 int orig_len = buf_len;
4019 if (context->connection_status == TLS_CONNECTED) {
4020 if (context->version == TLS_V13) {
4021 tls_alert(context, 1, unexpected_message);
4023 tls_alert(context, 0, no_renegotiation_RESERVED);
4029 while (buf_len >= 4 && !context->critical_error) {
4030 int payload_res = 0;
4031 //unsigned char update_hash = 1;
4032 unsigned char type = buf[0];
4033 unsigned int write_packets = 0;
4034 int certificate_verify_alert = no_error;
4035 int payload_size = get24(buf+1) + 3;
4036 if (buf_len < payload_size + 1) {
4037 return TLS_NEED_MORE_DATA;
4042 CHECK_HANDSHAKE_STATE(context, 0, 1);
4044 (" => HELLO REQUEST (RENEGOTIATION?)\n");
4045 if (context->is_server) {
4046 payload_res = TLS_UNEXPECTED_MESSAGE;
4048 if (context->connection_status == TLS_CONNECTED) {
4050 payload_res = TLS_NO_RENEGOTIATION;
4052 payload_res = TLS_UNEXPECTED_MESSAGE;
4059 CHECK_HANDSHAKE_STATE(context, 1, 1);
4060 DEBUG_PRINT(" => CLIENT HELLO\n");
4061 if (context->is_server) {
4063 tls_parse_client_hello(context,
4068 payload_res = TLS_UNEXPECTED_MESSAGE;
4073 CHECK_HANDSHAKE_STATE(context, 2, 1);
4074 DEBUG_PRINT(" => SERVER HELLO\n");
4075 if (context->is_server) {
4076 payload_res = TLS_UNEXPECTED_MESSAGE;
4079 payload_res = tls_parse_server_hello(context, buf + 1, payload_size);
4083 /* hello verify request */
4084 DEBUG_PRINT(" => VERIFY REQUEST\n");
4085 CHECK_HANDSHAKE_STATE(context, 3, 1);
4086 payload_res = TLS_UNEXPECTED_MESSAGE;
4090 CHECK_HANDSHAKE_STATE(context, 4, 1);
4091 DEBUG_PRINT(" => CERTIFICATE\n");
4092 if (context->tlsver == TLS_VERSION13) {
4093 if (context->connection_status == 2) {
4095 tls_parse_certificate(context,
4100 if (context->is_server) {
4101 if (context->certificate_verify && context->client_certificates_count) {
4102 certificate_verify_alert
4104 context->certificate_verify(context,
4105 context->client_certificates,
4106 context->client_certificates_count);
4108 /* empty certificates are permitted for client */
4109 if (payload_res <= 0) {
4115 TLS_UNEXPECTED_MESSAGE;
4117 if (context->connection_status == 1) {
4118 if (context->is_server) {
4119 /* client certificate */
4121 tls_parse_certificate(context,
4125 if (context->certificate_verify && context->client_certificates_count) {
4126 certificate_verify_alert =
4127 context->certificate_verify
4130 client_certificates,
4132 client_certificates_count);
4134 /* empty certificates are permitted for client */
4135 if (payload_res <= 0)
4139 tls_parse_certificate(context,
4143 if (certificate_verify && context->certificates_count) {
4144 certificate_verify_alert =
4145 context->certificate_verify
4147 context->certificates,
4149 certificates_count);
4153 payload_res = TLS_UNEXPECTED_MESSAGE;
4157 /* server key exchange */
4158 CHECK_HANDSHAKE_STATE(context, 5, 1);
4159 DEBUG_PRINT(" => SERVER KEY EXCHANGE\n");
4160 if (context->is_server) {
4161 payload_res = TLS_UNEXPECTED_MESSAGE;
4164 tls_parse_server_key_exchange(context,
4170 /* certificate request */
4171 CHECK_HANDSHAKE_STATE(context, 6, 1);
4172 /* server to client */
4173 if (context->is_server) {
4174 payload_res = TLS_UNEXPECTED_MESSAGE;
4176 context->client_verified = 2;
4178 DEBUG_PRINT(" => CERTIFICATE REQUEST\n");
4181 /* server hello done */
4182 CHECK_HANDSHAKE_STATE(context, 7, 1);
4183 DEBUG_PRINT(" => SERVER HELLO DONE\n");
4184 if (context->is_server) {
4185 payload_res = TLS_UNEXPECTED_MESSAGE;
4188 tls_parse_server_hello_done(
4191 if (payload_res > 0) {
4197 /* certificate verify */
4198 CHECK_HANDSHAKE_STATE(context, 8, 1);
4199 DEBUG_PRINT(" => CERTIFICATE VERIFY\n");
4200 if (context->connection_status == 2) {
4202 tls_parse_verify(context, buf + 1,
4205 payload_res = TLS_UNEXPECTED_MESSAGE;
4209 /* client key exchange */
4210 CHECK_HANDSHAKE_STATE(context, 9, 1);
4211 DEBUG_PRINT(" => CLIENT KEY EXCHANGE\n");
4212 if (context->is_server) {
4214 tls_parse_client_key_exchange(context,
4218 payload_res = TLS_UNEXPECTED_MESSAGE;
4223 tls_buffer_free(&context->cached_handshake);
4224 CHECK_HANDSHAKE_STATE(context, 10, 1);
4225 DEBUG_PRINT(" => FINISHED\n");
4226 payload_res = tls_parse_finished(context,
4227 buf + 1, payload_size,
4229 if (payload_res > 0) {
4230 memset(context->hs_messages, 0,
4231 sizeof(context->hs_messages));
4236 (" => NOT UNDERSTOOD PAYLOAD TYPE: %x\n",
4238 return TLS_NOT_UNDERSTOOD;
4241 //if (type != 0x00 && update_hash) {
4243 tls_update_hash(context, buf, payload_size + 1);
4246 if (certificate_verify_alert != no_error) {
4248 tls_alert(context, 1, certificate_verify_alert);
4249 context->critical_error = 1;
4252 if (payload_res < 0) {
4253 switch (payload_res) {
4254 case TLS_UNEXPECTED_MESSAGE:
4256 tls_alert(context, 1, unexpected_message);
4258 case TLS_COMPRESSION_NOT_SUPPORTED:
4260 tls_alert(context, 1, decompression_failure_RESERVED);
4262 case TLS_BROKEN_PACKET:
4264 tls_alert(context, 1, decode_error);
4268 tls_alert(context, 1, internal_error);
4270 case TLS_NOT_VERIFIED:
4272 tls_alert(context, 1, bad_record_mac);
4274 case TLS_BAD_CERTIFICATE:
4276 if (context->is_server) {
4277 /* bad client certificate, continue */
4278 tls_alert(context, 0, bad_certificate);
4281 tls_alert(context, 1, bad_certificate);
4284 case TLS_UNSUPPORTED_CERTIFICATE:
4286 tls_alert(context, 1, unsupported_certificate);
4288 case TLS_NO_COMMON_CIPHER:
4290 tls_alert(context, 1, insufficient_security);
4292 case TLS_NOT_UNDERSTOOD:
4294 tls_alert(context, 1, internal_error);
4296 case TLS_NO_RENEGOTIATION:
4298 tls_alert(context, 0, no_renegotiation_RESERVED);
4301 case TLS_DECRYPTION_FAILED:
4303 tls_alert(context, 1, decryption_failed_RESERVED);
4306 if (payload_res < 0) {
4311 if (certificate_verify_alert != no_error) {
4312 payload_res = TLS_BAD_CERTIFICATE;
4313 /* TODO this is set but not used */
4316 /* except renegotiation */
4317 struct TLSPacket *pkt;
4318 switch (write_packets) {
4320 if (context->client_verified == 2) {
4321 tls_send_certificate(context);
4322 context->client_verified = 0;
4325 /* client handshake */
4326 tls_send_client_key_exchange(context);
4327 tls_send_change_cipher_spec(context);
4329 context->cipher_spec_set = 1;
4330 context->local_sequence_number = 0;
4332 tls_send_finished(context);
4334 context->cipher_spec_set = 0;
4337 /* server handshake */
4338 DEBUG_PRINT("<= SENDING SERVER HELLO\n");
4339 if (context->connection_status == 3) {
4340 context->connection_status = 2;
4342 (tls_build_hello(context, 0));
4343 tls_send_change_cipher_spec(context);
4344 _private_tls13_key(context, 1);
4345 context->cipher_spec_set = 1;
4347 ("<= SENDING ENCRYPTED EXTENSIONS\n");
4348 tls_send_encrypted_extensions(context);
4350 if (context->request_client_certificate) {
4352 ("<= SENDING CERTIFICATE REQUEST\n");
4354 (tls_certificate_request
4358 tls_send_certificate(context);
4359 tls_send_certificate_verify(context);
4360 tls_send_finished(context);
4363 free(context->server_finished_hash);
4365 context->server_finished_hash =
4366 malloc(tls_mac_length(context));
4368 if (context->server_finished_hash) {
4369 tls_get_hash(context,
4370 context->server_finished_hash);
4375 tls_queue_packet(tls_build_hello(context, 0));
4376 DEBUG_PRINT("<= SENDING CERTIFICATE\n");
4377 tls_send_certificate(context);
4379 int ephemeral_cipher =
4380 tls_cipher_is_ephemeral(context);
4381 if (ephemeral_cipher) {
4383 ("<= SENDING EPHEMERAL DH KEY\n");
4384 tls_send_server_key_exchange(context,
4385 ephemeral_cipher == 1 ?
4387 KEA_ec_diffie_hellman);
4389 if (context->request_client_certificate) {
4391 ("<= SENDING CERTIFICATE REQUEST\n");
4393 (tls_certificate_request
4396 tls_send_done(context);
4400 tls_send_change_cipher_spec(context);
4401 tls_send_finished(context);
4402 context->connection_status = TLS_CONNECTED;
4409 /* hello retry request */
4410 DEBUG_PRINT("<= SENDING HELLO RETRY REQUEST\n");
4411 pkt = tls_build_hello(context, 0);
4412 tls_queue_packet(pkt);
4416 buf += payload_size;
4417 buf_len -= payload_size;
4423 unsigned int asn1_get_len(const unsigned char *buffer, int buf_len,
4424 unsigned int *octets) {
4431 unsigned char size = buffer[0];
4434 *octets = size & 0x7F;
4435 if ((int) *octets > buf_len - 1) {
4439 unsigned int ref_octets = *octets;
4443 if ((int) *octets > buf_len - 1) {
4446 unsigned int long_size = 0;
4447 unsigned int coef = 1;
4449 for (i = ref_octets; i > 0; i--) {
4450 long_size += buffer[i] * coef;
4460 void print_index(const unsigned int *fields) {
4466 DEBUG_PRINT("%i", fields[i]);
4475 int _is_field(const unsigned int *fields, const unsigned int *prefix) {
4478 if (fields[i] != prefix[i]) {
4486 static int tls_hash_len(int algorithm) {
4487 switch (algorithm) {
4488 case TLS_RSA_SIGN_MD5:
4490 case TLS_RSA_SIGN_SHA1:
4492 case TLS_RSA_SIGN_SHA256:
4494 case TLS_RSA_SIGN_SHA384:
4496 case TLS_RSA_SIGN_SHA512:
4502 static unsigned char *tls_compute_hash(int algorithm, const unsigned char
4503 *message, unsigned int message_len) {
4504 unsigned char *hash = NULL;
4506 int hash_index = -1;
4507 unsigned long hash_len = 0;
4509 if (!message || !message_len) {
4513 switch (algorithm) {
4514 case TLS_RSA_SIGN_MD5:
4515 DEBUG_PRINT("SIGN MD5\n");
4516 hash_index = find_hash("md5");
4519 case TLS_RSA_SIGN_SHA1:
4520 DEBUG_PRINT("SIGN SHA1\n");
4521 hash_index = find_hash("sha1");
4524 case TLS_RSA_SIGN_SHA256:
4525 DEBUG_PRINT("SIGN SHA256\n");
4526 hash_index = find_hash("sha256");
4529 case TLS_RSA_SIGN_SHA384:
4530 DEBUG_PRINT("SIGN SHA384\n");
4531 hash_index = find_hash("sha384");
4534 case TLS_RSA_SIGN_SHA512:
4535 DEBUG_PRINT("SIGN SHA512\n");
4536 hash_index = find_hash("sha512");
4540 DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4545 hash = malloc(hash_len);
4550 err = hash_memory(hash_index, message, message_len, hash, &hash_len);
4557 int tls_certificate_verify_signature(struct TLSCertificate *cert,
4558 struct TLSCertificate *parent) {
4559 if (!cert || !parent || !cert->sign_key
4560 || !cert->fingerprint || !cert->sign_len
4561 || !parent->der_bytes || !parent->der_len) {
4562 DEBUG_PRINT("CANNOT VERIFY SIGNATURE ");
4564 DEBUG_PRINT("!cert ");
4566 if (!cert->sign_key) {
4567 DEBUG_PRINT("!cert->sign_key ");
4569 if (!cert->fingerprint) {
4570 DEBUG_PRINT("!cert->fingerprint ");
4572 if (!cert->sign_len) {
4573 DEBUG_PRINT("!cert->sign_len ");
4578 DEBUG_PRINT("!parent ");
4580 if (!parent->der_bytes) {
4581 DEBUG_PRINT("!parent->der_bytes ");
4583 if (!parent->der_len) {
4584 DEBUG_PRINT("!parent->der_len ");
4591 DEBUG_PRINT("checking alg\n");
4592 int hash_len = tls_hash_len(cert->algorithm);
4593 if (hash_len <= 0) {
4598 switch (cert->algorithm) {
4599 case TLS_RSA_SIGN_MD5:
4600 hash_index = find_hash("md5");
4602 case TLS_RSA_SIGN_SHA1:
4603 hash_index = find_hash("sha1");
4605 case TLS_RSA_SIGN_SHA256:
4606 hash_index = find_hash("sha256");
4608 case TLS_RSA_SIGN_SHA384:
4609 hash_index = find_hash("sha384");
4611 case TLS_RSA_SIGN_SHA512:
4612 hash_index = find_hash("sha512");
4615 DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4620 DEBUG_PRINTLN("rsa_import(%p, %d, %p)\n", parent->der_bytes,
4621 parent->der_len, &key);
4622 int err = rsa_import(parent->der_bytes, parent->der_len, &key);
4625 ("Error importing RSA certificate (code: %i)\n", err);
4626 DEBUG_PRINT("Message: %s\n", error_to_string(err));
4627 DEBUG_DUMP_HEX_LABEL("CERTIFICATE", parent->der_bytes,
4632 unsigned char *signature = cert->sign_key;
4633 int signature_len = cert->sign_len;
4634 if (!signature[0]) {
4639 err = rsa_verify_hash_ex(signature, signature_len, cert->fingerprint,
4640 hash_len, LTC_PKCS_1_V1_5, hash_index, 0, &rsa_stat,
4645 DEBUG_PRINT("HASH VERIFY ERROR %i\n", err);
4648 DEBUG_PRINT("CERTIFICATE VALIDATION: %i\n", rsa_stat);
4652 int tls_certificate_chain_is_valid(struct TLSCertificate **certificates,
4654 if (!certificates || !len) {
4655 return bad_certificate;
4659 DEBUG_PRINT("verifying %i length cert chain\n", len);
4662 /* expired certificate or not yet valid ? */
4663 if (tls_certificate_is_valid(certificates[0])) {
4664 return bad_certificate;
4668 for (i = 0; i < len; i++) {
4669 /* certificate in chain is expired ? */
4670 if (tls_certificate_is_valid(certificates[i + 1])) {
4671 return bad_certificate;
4674 if (!tls_certificate_verify_signature(certificates[i],
4675 certificates[i + 1])) {
4677 ("tls_certificate_verify_signature certs[%d], certs[%d+1] failed\n",
4679 return bad_certificate;
4686 int tls_certificate_chain_is_valid_root(struct TLSContext *context, struct
4687 TLSCertificate **certificates, int len) {
4690 if (!certificates || !len || !context->root_certificates
4691 || !context->root_count) {
4692 return bad_certificate;
4694 for (i = 0; i < len; i++) {
4695 for (j = 0; j < context->root_count; j++) {
4696 /* check if root certificate expired */
4697 if (tls_certificate_is_valid
4698 (context->root_certificates[j])) {
4701 /* if any root validates any certificate in the chain,
4702 * then is root validated */
4703 if (tls_certificate_verify_signature(certificates[i],
4704 context->root_certificates[j]))
4710 return bad_certificate;
4713 int _private_is_oid(struct OID_chain *ref_chain,
4714 const unsigned char *looked_oid, int looked_oid_len) {
4716 if (ref_chain->oid) {
4718 (ref_chain->oid, looked_oid, 16,
4723 ref_chain = (struct OID_chain *) ref_chain->top;
4728 int _private_asn1_parse(struct TLSContext *context,
4729 struct TLSCertificate *cert,
4730 const unsigned char *buffer, int size, int level,
4731 unsigned int *fields, unsigned char *has_key,
4732 int client_cert, unsigned char *top_oid,
4733 struct OID_chain *chain) {
4734 struct OID_chain local_chain;
4735 DEBUG_INDEX(fields);
4737 local_chain.top = chain;
4741 unsigned char oid[16];
4743 local_chain.oid = oid;
4747 unsigned char local_has_key = 0;
4748 const unsigned char *cert_data = NULL;
4749 unsigned int cert_len = 0;
4750 while (pos < size) {
4751 unsigned int start_pos = pos;
4752 if (size - pos < 2) {
4753 return TLS_NEED_MORE_DATA;
4755 unsigned char first = buffer[pos++];
4756 unsigned char type = first & 0x1F;
4757 unsigned char constructed = first & 0x20;
4758 unsigned char element_class = first >> 6;
4762 if (level <= TLS_ASN1_MAXLEVEL) {
4763 fields[level - 1] = idx;
4765 DEBUG_INDEX(fields);
4767 int length = asn1_get_len((unsigned char *) &buffer[pos], size
4769 DEBUG_PRINT("asn1_get_len = %u\n", length);
4770 if ((octets > 4) || (octets > size - pos)) {
4772 ("CANNOT READ CERTIFICATE octets = %d, size = %d pos = %d, size - pos = %d\n",
4773 octets, size, pos, size - pos);
4778 if (size - pos < length) {
4779 return TLS_NEED_MORE_DATA;
4782 /*DEBUG_PRINT("FIRST: %x => %x (%i)\n", (int)first, (int)type, length); */
4784 /*DEBUG_PRINT("%2i: ", level); */
4786 DEBUG_INDEX(fields);
4788 for (i1 = 1; i1 < level; i1++) {
4793 if (length && constructed) {
4796 DEBUG_PRINT("CONSTRUCTED BITSTREAM\n");
4799 DEBUG_PRINT("SEQUENCE\n");
4800 if ((level == 2) && (idx == 1)) {
4802 length + (pos - start_pos);
4803 cert_data = &buffer[start_pos];
4805 /* private key on server or public key on client */
4807 && (_is_field(fields, priv_der_id))) {
4808 free(cert->der_bytes);
4809 temp = length + (pos - start_pos);
4810 cert->der_bytes = malloc(temp);
4811 if (cert->der_bytes) {
4812 memcpy(cert->der_bytes,
4815 cert->der_len = temp;
4821 DEBUG_PRINT("EMBEDDED PDV\n");
4824 if (element_class == 0x02) {
4825 DEBUG_PRINT("CONTEXT-SPECIFIC\n");
4829 DEBUG_PRINT("CONSTRUCT TYPE %02X\n",(int)type);
4833 _private_asn1_parse(context, cert, &buffer[pos],
4834 length, level + 1, fields,
4835 &local_has_key, client_cert,
4836 top_oid, &local_chain);
4837 if (((local_has_key && context
4838 && (!context->is_server || client_cert))
4840 && (_is_field(fields, pk_id))) {
4841 free(cert->der_bytes);
4842 temp = length + (pos - start_pos);
4843 cert->der_bytes = malloc(temp);
4844 if (cert->der_bytes) {
4845 memcpy(cert->der_bytes,
4846 &buffer[start_pos], temp);
4847 cert->der_len = temp;
4855 /* end of content */
4856 DEBUG_PRINT("END OF CONTENT\n");
4862 DEBUG_PRINT("BOOLEAN: %i\n", temp);
4866 if (_is_field(fields, pk_id)) {
4872 tls_certificate_set_key
4873 (cert, &buffer[pos],
4875 } else if (idx == 2) {
4876 tls_certificate_set_exponent
4877 (cert, &buffer[pos],
4880 } else if (_is_field(fields, serial_id)) {
4881 tls_certificate_set_serial(cert,
4887 if (_is_field(fields, version_id)) {
4892 #ifdef TLS_X509_V1_SUPPORT
4900 unsigned int fields_temp[3];
4901 fields_temp[0] = fields[level - 2];
4902 fields_temp[1] = fields[level - 1];
4905 (fields_temp, priv_id)) {
4906 tls_certificate_set_priv
4907 (cert, &buffer[pos],
4911 DEBUG_PRINT("INTEGER(%i): ", length);
4912 DEBUG_DUMP_HEX(&buffer[pos], length);
4913 if ((chain) && (length > 2)) {
4916 sizeof(san_oid) - 1)) {
4920 TLS_REALLOC(cert->san,
4932 tls_certificate_set_copy
4939 (" => SUBJECT ALTERNATIVE NAME: %s",
4956 if (_is_field(fields, pk_id)) {
4961 DEBUG_PRINT("BITSTREAM(%i): ", length);
4962 DEBUG_DUMP_HEX(&buffer[pos], length);
4964 if (_is_field(fields, sign_id)
4965 || _is_field(fields, sign_id2)) {
4966 DEBUG_PRINT("set sign key\n");
4967 tls_certificate_set_sign_key(cert,
4971 } else if (cert->ec_algorithm
4972 && (_is_field(fields, pk_id))) {
4973 tls_certificate_set_key(cert,
4978 if (buffer[pos] == 0x00
4983 length - 1, level + 1,
4986 client_cert, top_oid,
4991 &buffer[pos], length,
4994 client_cert, top_oid,
5001 TLS_EC_prime256v1_OID,
5004 (TLS_EC_prime256v1) -
5012 TLS_EC_secp224r1_OID,
5015 (TLS_EC_secp224r1_OID)
5023 TLS_EC_secp384r1_OID,
5026 (TLS_EC_secp384r1_OID)
5034 TLS_EC_secp521r1_OID,
5037 (TLS_EC_secp521r1_OID)
5043 if ((cert->ec_algorithm)
5045 tls_certificate_set_key
5053 if (top_oid && _is_field(fields, ecc_priv_id)
5055 DEBUG_PRINT("BINARY STRING(%i): ",
5057 DEBUG_DUMP_HEX(&buffer[pos],
5060 tls_certificate_set_priv(cert,
5065 _private_asn1_parse(context, cert,
5077 DEBUG_PRINT("NULL\n");
5080 /* object identifier */
5081 if (_is_field(fields, pk_id)) {
5082 if (length == 8 || length == 5) {
5083 tls_certificate_set_algorithm
5084 (&cert->ec_algorithm,
5085 &buffer[pos], length);
5087 tls_certificate_set_algorithm
5088 (&cert->key_algorithm,
5089 &buffer[pos], length);
5092 if (_is_field(fields, algorithm_id))
5093 tls_certificate_set_algorithm
5095 &buffer[pos], length);
5097 DEBUG_PRINT("OBJECT IDENTIFIER(%i): ", length);
5098 DEBUG_DUMP_HEX(&buffer[pos], length);
5100 /* check previous oid */
5103 sizeof(ocsp_oid) - 1))
5104 tls_certificate_set_copy(&cert->ocsp,
5109 memcpy(oid, &buffer[pos], length);
5111 memcpy(oid, &buffer[pos], 16);
5114 memcpy(top_oid, oid, 16);
5117 DEBUG_PRINT("REAL NUMBER(%i): ", length);
5118 DEBUG_DUMP_HEX(&buffer[pos], length);
5123 DEBUG_PRINT("UTC TIME: [");
5124 DEBUG_DUMP(&buffer[pos], length);
5127 if (_is_field(fields, validity_id)) {
5129 tls_certificate_set_copy_date
5131 &buffer[pos], length);
5133 tls_certificate_set_copy_date
5135 &buffer[pos], length);
5140 /* generalized time */
5141 DEBUG_PRINT("GENERALIZED TIME: [");
5142 DEBUG_DUMP(&buffer[pos], length);
5146 /* printable string */
5157 if (_is_field(fields, issurer_id)) {
5158 if (_is_oid(oid, country_oid, 3)) {
5159 tls_certificate_set_copy
5160 (&cert->issuer_country,
5161 &buffer[pos], length);
5163 (oid, state_oid, 3)) {
5164 tls_certificate_set_copy
5165 (&cert->issuer_state,
5166 &buffer[pos], length);
5168 (oid, location_oid, 3)) {
5169 tls_certificate_set_copy
5172 &buffer[pos], length);
5174 (oid, entity_oid, 3)) {
5175 tls_certificate_set_copy
5176 (&cert->issuer_entity,
5177 &buffer[pos], length);
5179 (oid, subject_oid, 3)) {
5180 tls_certificate_set_copy
5181 (&cert->issuer_subject,
5182 &buffer[pos], length);
5184 } else if (_is_field(fields, owner_id)) {
5185 if (_is_oid(oid, country_oid, 3)) {
5186 tls_certificate_set_copy
5188 &buffer[pos], length);
5190 (oid, state_oid, 3)) {
5191 tls_certificate_set_copy
5193 &buffer[pos], length);
5195 (oid, location_oid, 3)) {
5196 tls_certificate_set_copy
5198 &buffer[pos], length);
5200 (oid, entity_oid, 3)) {
5201 tls_certificate_set_copy
5203 &buffer[pos], length);
5205 (oid, subject_oid, 3)) {
5206 tls_certificate_set_copy
5208 &buffer[pos], length);
5211 DEBUG_PRINT("STR: [");
5212 DEBUG_DUMP(&buffer[pos], length);
5216 DEBUG_PRINT("EMPTY SEQUENCE\n");
5219 DEBUG_PRINT("ENUMERATED(%i): ", length);
5220 DEBUG_DUMP_HEX(&buffer[pos], length);
5224 DEBUG_PRINT("========> NOT SUPPORTED %x\n",
5226 /* not supported / needed */
5233 if (cert_len && cert_data) {
5234 int h = find_hash("sha256");
5235 size_t len = sizeof cert->fp;
5236 hash_memory(h, cert_data,cert_len, cert->fp, &len);
5239 if (level == 2 && cert->sign_key && cert->sign_len
5240 && cert_len && cert_data) {
5241 free(cert->fingerprint);
5242 cert->fingerprint = tls_compute_hash(cert->algorithm,
5243 cert_data, cert_len);
5245 if (cert->fingerprint) {
5246 DEBUG_DUMP_HEX_LABEL("FINGERPRINT",
5248 tls_hash_len(cert->algorithm));
5255 struct TLSCertificate *asn1_parse(struct TLSContext *context,
5256 const unsigned char *buffer, int size,
5258 unsigned int fields[TLS_ASN1_MAXLEVEL] = { 0 };
5260 struct TLSCertificate *cert = tls_create_certificate();
5263 if (client_cert < 0) {
5266 unsigned char top_oid[16];
5267 memset(top_oid, 0, sizeof(top_oid));
5268 _private_asn1_parse(context, cert, buffer, size, 1,
5269 fields, NULL, client_cert,
5272 _private_asn1_parse(context, cert, buffer, size, 1,
5273 fields, NULL, client_cert,
5280 int tls_clear_certificates(struct TLSContext *tls) {
5283 if (!tls || !tls->is_server || tls->is_child) {
5284 return TLS_GENERIC_ERROR;
5287 if (tls->root_certificates) {
5288 for (i = 0; i < tls->root_count; i++) {
5289 tls_destroy_certificate(tls->root_certificates[i]);
5292 tls->root_certificates = NULL;
5293 tls->root_count = 0;
5295 if (tls->private_key) {
5296 tls_destroy_certificate(tls->private_key);
5298 tls->private_key = NULL;
5299 if (tls->ec_private_key) {
5300 tls_destroy_certificate(tls->ec_private_key);
5302 tls->ec_private_key = NULL;
5303 free(tls->certificates);
5304 tls->certificates = NULL;
5305 tls->certificates_count = 0;
5309 /* This is just a wrapper around parse message so we don't
5310 * call read more often than necessary. IOW, if there's
5311 * more than one record in the input buffer, process them all
5313 int tls_consume_stream(struct TLSContext *context) {
5315 return TLS_GENERIC_ERROR;
5318 if (context->critical_error) {
5319 return TLS_BROKEN_CONNECTION;
5322 size_t tls_buffer_len = context->input_buffer.len;
5323 unsigned char *buffer = context->input_buffer.buffer;
5325 unsigned int index = 0;
5328 int tls_header_size;
5329 int tls_size_offset;
5331 tls_size_offset = 3;
5332 tls_header_size = 5;
5334 while (tls_buffer_len >= 5) {
5337 length = get16(buffer + index + tls_size_offset)
5340 if (length > tls_buffer_len) {
5341 /* record not complete */
5345 /* This is the only place tls_parse_message is called */
5346 int consumed = tls_parse_message(context, buffer+index, length);
5348 fprintf(stderr, "parse message error: %d\n", consumed);
5349 err_flag = consumed;
5353 tls_buffer_len -= length;
5354 if (context->critical_error) {
5355 err_flag = TLS_BROKEN_CONNECTION;
5360 if (err_flag || context->input_buffer.error) {
5361 if (!context->critical_error) {
5362 context->critical_error = 1;
5364 DEBUG_PRINT("ERROR IN CONSUME: %i\n", err_flag);
5365 tls_buffer_free(&context->input_buffer);
5368 tls_buffer_shift(&context->input_buffer, index);
5372 void tls_close_notify(struct TLSContext *context) {
5373 if (!context || context->critical_error) {
5376 context->critical_error = 1;
5377 DEBUG_PRINT("CLOSE\n");
5378 tls_alert(context, 0, close_notify);
5381 void tls_alert(struct TLSContext *context, int critical, int code) {
5386 struct TLSPacket *packet = tls_create_packet(context, TLS_ALERT,
5387 context->version, 0);
5388 tls_packet_uint8(packet, critical ? TLS_ALERT_CRITICAL :
5391 tls_packet_uint8(packet, code);
5392 tls_packet_update(packet);
5395 context->critical_error = 1;
5398 tls_queue_packet(packet);
5401 int tls_is_broken(struct TLSContext *context) {
5402 if (!context || context->critical_error) {
5408 /* TODO I don't see that this ever gets cleared */
5409 int tls_request_client_certificate(struct TLSContext *context) {
5410 if (!context || !context->is_server) {
5414 context->request_client_certificate = 1;
5418 int tls_client_verified(struct TLSContext *context) {
5419 if (!context || context->critical_error) {
5423 return context->client_verified == 1;
5426 int tls_sni_set(struct TLSContext *context, const char *sni) {
5427 if (!context || context->is_server || context->critical_error
5428 || context->connection_status != 0) {
5434 context->sni = sni ? strdup(sni) : 0;
5435 return context->sni ? 1 : 0;
5438 int tls_default_verify(struct TLSContext *context,
5439 struct TLSCertificate **certificate_chain, int len)
5444 if (certificate_chain) {
5445 for (i = 0; i < len; i++) {
5446 struct TLSCertificate *certificate =
5447 certificate_chain[i];
5448 /* check validity date */
5449 err = tls_certificate_is_valid(certificate);
5455 /* check if chain is valid */
5456 err = tls_certificate_chain_is_valid(certificate_chain, len);
5461 /* check certificate subject */
5462 if (!context->is_server && context->sni && len > 0
5463 && certificate_chain) {
5464 err = tls_certificate_valid_subject(certificate_chain[0],
5471 err = tls_certificate_chain_is_valid_root(context, certificate_chain,
5477 DEBUG_PRINT("Certificate OK\n");
5481 ssize_t tls_fsync(struct TLSContext *context) {
5484 ssize_t send_res = 0;
5486 unsigned char *buffer;
5487 tls_send_func write_cb = NULL;
5498 buffer = context->output_buffer.buffer;
5499 buflen = context->output_buffer.len;
5501 if (context->send) {
5502 write_cb = context->send;
5507 while (buflen > 0) {
5510 res = write_cb(fd, buffer+offset, buflen, 0);
5512 perror("send error");
5520 DEBUG_PRINT("sent %zd bytes\n", send_res);
5521 context->output_buffer.len = 0;
5525 void tls_free(struct TLSContext *context) {
5527 free(context->user_data);
5528 tls_destroy_context(context);
5532 int tls_set_fd(struct TLSContext *context, int socket) {
5534 return TLS_GENERIC_ERROR;
5536 context->fd = socket;
5540 int tls_load_root_file(struct TLSContext *context, const char *pem_filename) {
5551 fd = open(pem_filename, O_RDONLY);
5556 if (fstat(fd, &st) == -1) {
5561 addr = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
5562 if (addr == MAP_FAILED) {
5567 count = tls_load_root_certificates(context, addr, st.st_size);
5568 munmap(addr, st.st_size);
5574 void tls_set_verify(struct TLSContext *tls, tls_validation_function vfunc) {
5576 tls->certificate_verify = vfunc;
5580 static ssize_t tls_safe_read(struct TLSContext *tls) {
5581 tls_recv_func read_cb;
5585 if (!tls || tls->fd <= 0) {
5586 return TLS_GENERIC_ERROR;
5590 read_cb = tls->recv;
5596 bytes = read_cb(tls->fd, buffer, sizeof buffer, 0);
5598 tls_buffer_append(&tls->input_buffer, buffer, bytes);
5604 /* I think this is the server handshake */
5605 int SSL_accept(struct TLSContext *context) {
5606 ssize_t read_size = 0;
5608 if (!context || context->fd <= 0) {
5609 return TLS_GENERIC_ERROR;
5612 if (tls_established(context)) {
5617 while ((read_size = tls_safe_read(context)) > 0) {
5618 if (tls_consume_stream(context) >= 0) {
5619 ssize_t res = tls_fsync(context);
5624 if (tls_established(context)) {
5628 if (read_size <= 0) {
5629 return TLS_BROKEN_CONNECTION;
5634 /* TODO this is really do the handshake */
5635 int tls_connect(struct TLSContext *context) {
5640 if (!context || context->fd < 0 || context->critical_error) {
5643 } else if (context->fd < 0) {
5649 return TLS_GENERIC_ERROR;
5653 if (context->is_server) {
5654 return TLS_UNEXPECTED_MESSAGE;
5658 res = tls_queue_packet(tls_build_client_hello(context));
5666 res = tls_fsync(context);
5672 while ((read_size = tls_safe_read(context)) > 0) {
5673 if ((res = tls_consume_stream(context)) >= 0) {
5674 res = tls_fsync(context);
5680 if (tls_established(context)) {
5685 if (context->critical_error) {
5686 fprintf(stderr, "critical error: %d\n",
5687 context->critical_error);
5688 return TLS_GENERIC_ERROR;
5695 int tls_shutdown(struct TLSContext *tls) {
5696 if (!tls || tls->fd <= 0) {
5697 return TLS_GENERIC_ERROR;
5700 tls_close_notify(tls);
5704 /* TODO configure for maximum packet data length
5705 * max is 2^14 - 5 byte header - 32 byte mac - padding which depends
5706 * on the cipher (up to 255 bytes I think).
5708 ssize_t tls_write(struct TLSContext *context, const void *buf, size_t count) {
5710 return TLS_GENERIC_ERROR;
5712 if (context->connection_status != TLS_CONNECTED) {
5713 return TLS_UNEXPECTED_MESSAGE;
5715 if (count > TLS_MAXTLS_APP_SIZE) {
5716 count = TLS_MAXTLS_APP_SIZE;
5719 if (!buf || !count) {
5723 struct TLSPacket *packet = tls_create_packet(context,
5724 TLS_APPLICATION_DATA, context->version, count);
5725 tls_packet_append(packet, buf, count);
5726 tls_packet_update(packet);
5728 tls_queue_packet(packet);
5729 /* TODO think about this. context->sync with O_NONBLOCK might be a
5732 if (context->sync) {
5734 res = tls_fsync(context);
5742 static ssize_t tls_readbuf(struct TLSContext *tls, void *buf, size_t count) {
5743 if (count > tls->application_buffer.len) {
5744 count = tls->application_buffer.len;
5748 /* TODO should have a buffer read and shift */
5749 memcpy(buf, tls->application_buffer.buffer, count);
5750 tls_buffer_shift(&tls->application_buffer, count);
5756 ssize_t tls_read(struct TLSContext *context, void *buf, size_t count) {
5758 return TLS_GENERIC_ERROR;
5761 if (context->application_buffer.len) {
5762 return tls_readbuf(context, buf, count);
5765 if (context->fd <= 0 || context->critical_error) {
5766 return TLS_GENERIC_ERROR;
5769 if (!tls_established(context)) {
5770 return TLS_GENERIC_ERROR;
5773 if (context->application_buffer.len == 0 && !context->critical_error) {
5774 /* attempt to fill buffer, unless we're already in an error
5779 while ((read_size = tls_safe_read(context)) > 0) {
5780 if (tls_consume_stream(context) > 0) {
5784 if (context->critical_error
5785 && !context->application_buffer.len) {
5786 /* if there's a critical error, don't bail if
5787 * we managed to get some data
5789 return TLS_GENERIC_ERROR;
5793 if (read_size <= 0 && context->application_buffer.len == 0) {
5794 /* can return errors as for read(2) */
5799 return tls_readbuf(context, buf, count);