pd.if.org Git - zpackage/blob - crypto/tlse.c

   1 #define _POSIX_C_SOURCE 200809L
   2
   3 #include <fcntl.h>
   4 #include <stdint.h>
   5 #include <stdio.h>
   6 #include <stdlib.h>
   7 #include <string.h>
   8 #include <strings.h>
   9 #include <sys/mman.h>
  10 #include <sys/stat.h>
  11 #include <time.h>
  12
  13 #include <sys/socket.h>
  14 #include <arpa/inet.h>
  15 #include <unistd.h>
  16
  17 #include <errno.h>
  18
  19 #include "tomcrypt.h"
  20
  21 #define mp_init(a)                           ltc_mp.init(a)
  22 #define mp_init_multi                        ltc_init_multi
  23 #define mp_clear(a)                          ltc_mp.deinit(a)
  24 #define mp_clear_multi                       ltc_deinit_multi
  25 #define mp_count_bits(a)                     ltc_mp.count_bits(a)
  26 #define mp_read_radix(a, b, c)               ltc_mp.read_radix(a, b, c)
  27 #define mp_unsigned_bin_size(a)              ltc_mp.unsigned_size(a)
  28 #define mp_to_unsigned_bin(a, b)             ltc_mp.unsigned_write(a, b)
  29 #define mp_read_unsigned_bin(a, b, c)        ltc_mp.unsigned_read(a, b, c)
  30 #define mp_exptmod(a, b, c, d)               ltc_mp.exptmod(a, b, c, d)
  31 #define mp_add(a, b, c)                      ltc_mp.add(a, b, c)
  32 #define mp_mul(a, b, c)                      ltc_mp.mul(a, b, c)
  33 #define mp_cmp(a, b)                         ltc_mp.compare(a, b)
  34 #define mp_cmp_d(a, b)                       ltc_mp.compare_d(a, b)
  35 #define mp_sqr(a, b)                         ltc_mp.sqr(a, b)
  36 #define mp_mod(a, b, c)                      ltc_mp.mpdiv(a, b, NULL, c)
  37 #define mp_sub(a, b, c)                      ltc_mp.sub(a, b, c)
  38 #define mp_set(a, b)                         ltc_mp.set_int(a, b)
  39
  40 #if (CRYPT <= 0x0117)
  41 #define LTC_PKCS_1_EMSA LTC_LTC_PKCS_1_EMSA
  42 #define LTC_PKCS_1_V1_5 LTC_LTC_PKCS_1_V1_5
  43 #define LTC_PKCS_1_PSS LTC_LTC_PKCS_1_PSS
  44 #endif
  45
  46 #include "tlse.h"
  47 #include "chacha.h"
  48 #include "buffer.h"
  49
  50 #define TLS_DH_DEFAULT_P            "87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597"
  51 #define TLS_DH_DEFAULT_G            "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"
  52 #define TLS_DHE_KEY_SIZE          2048
  53
  54 #ifndef htonll
  55 #define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
  56 #endif
  57
  58 #ifndef ntohll
  59 #define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
  60 #endif
  61
  62 #define CHECK_HANDSHAKE_STATE(context, n, limit)  { if (context->hs_messages[n] >= limit) { DEBUG_PRINT("* UNEXPECTED MESSAGE (%i)\n", (int)n); payload_res = TLS_UNEXPECTED_MESSAGE; break; } context->hs_messages[n]++; }
  63
  64 #ifdef DEBUG
  65 int tls_indent = 0;
  66 int tls_indent_i = 0;
  67 #endif
  68
  69 //#define MARK
  70 typedef enum {
  71         KEA_dhe_dss,
  72         KEA_dhe_rsa,
  73         KEA_dh_anon,
  74         KEA_rsa,
  75         KEA_dh_dss,
  76         KEA_dh_rsa,
  77         KEA_ec_diffie_hellman
  78 } KeyExchangeAlgorithm;
  79
  80 typedef enum {
  81         rsa_sign = 1,
  82         dss_sign = 2,
  83         rsa_fixed_dh = 3,
  84         dss_fixed_dh = 4,
  85         rsa_ephemeral_dh_RESERVED = 5,
  86         dss_ephemeral_dh_RESERVED = 6,
  87         fortezza_dms_RESERVED = 20,
  88         ecdsa_sign = 64,
  89         rsa_fixed_ecdh = 65,
  90         ecdsa_fixed_ecdh = 66
  91 } TLSClientCertificateType;
  92
  93 typedef enum {
  94         none = 0,
  95         md5 = 1,
  96         sha1 = 2,
  97         sha224 = 3,
  98         sha256 = 4,
  99         sha384 = 5,
 100         sha512 = 6,
 101         _md5_sha1 = 255
 102 } TLSHashAlgorithm;
 103
 104 typedef enum {
 105         anonymous = 0,
 106         rsa = 1,
 107         dsa = 2,
 108         ecdsa = 3
 109 } TLSSignatureAlgorithm;
 110
 111 struct OID_chain {
 112         void *top;
 113         unsigned char *oid;
 114 };
 115
 116 typedef ssize_t (*tls_recv_func)(int sockfd, void *buf, size_t len,
 117                                  int flags);
 118 typedef ssize_t (*tls_send_func)(int sockfd, const void *buf, size_t len,
 119                                  int flags);
 120
 121 static const unsigned int version_id[] = { 1, 1, 1, 0 };
 122 static const unsigned int pk_id[] = { 1, 1, 7, 0 };
 123 static const unsigned int serial_id[] = { 1, 1, 2, 1, 0 };
 124 static const unsigned int issurer_id[] = { 1, 1, 4, 0 };
 125 static const unsigned int owner_id[] = { 1, 1, 6, 0 };
 126 static const unsigned int validity_id[] = { 1, 1, 5, 0 };
 127 static const unsigned int algorithm_id[] = { 1, 1, 3, 0 };
 128 static const unsigned int sign_id[] = { 1, 3, 2, 1, 0 };
 129 static const unsigned int sign_id2[] = { 1, 3, 2, 2, 0 };
 130 static const unsigned int priv_id[] = { 1, 4, 0 };
 131 static const unsigned int priv_der_id[] = { 1, 3, 1, 0 };
 132 static const unsigned int ecc_priv_id[] = { 1, 2, 0 };
 133
 134 static const unsigned char country_oid[] = { 0x55, 0x04, 0x06, 0x00 };
 135 static const unsigned char state_oid[] = { 0x55, 0x04, 0x08, 0x00 };
 136 static const unsigned char location_oid[] = { 0x55, 0x04, 0x07, 0x00 };
 137 static const unsigned char entity_oid[] = { 0x55, 0x04, 0x0A, 0x00 };
 138 static const unsigned char subject_oid[] = { 0x55, 0x04, 0x03, 0x00 };
 139 static const unsigned char san_oid[] = { 0x55, 0x1D, 0x11, 0x00 };
 140 static const unsigned char ocsp_oid[] =
 141     { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x00 };
 142
 143 static const unsigned char TLS_RSA_SIGN_RSA_OID[] =
 144     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x00 };
 145 static const unsigned char TLS_RSA_SIGN_MD5_OID[] =
 146     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04, 0x00 };
 147 static const unsigned char TLS_RSA_SIGN_SHA1_OID[] =
 148     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x00 };
 149 static const unsigned char TLS_RSA_SIGN_SHA256_OID[] =
 150     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x00 };
 151 static const unsigned char TLS_RSA_SIGN_SHA384_OID[] =
 152     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, 0x00 };
 153 static const unsigned char TLS_RSA_SIGN_SHA512_OID[] =
 154     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, 0x00 };
 155
 156 #if 0
 157 static const unsigned char TLS_ECDSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x01, 0x05, 0x00, 0x00};
 158 static const unsigned char TLS_ECDSA_SIGN_SHA224_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x01, 0x05, 0x00, 0x00};
 159 static const unsigned char TLS_ECDSA_SIGN_SHA256_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x05, 0x00, 0x00};
 160 static const unsigned char TLS_ECDSA_SIGN_SHA384_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, 0x05, 0x00, 0x00};
 161 static const unsigned char TLS_ECDSA_SIGN_SHA512_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, 0x05, 0x00, 0x00};
 162 #endif
 163
 164 static const unsigned char TLS_EC_PUBLIC_KEY_OID[] =
 165     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x00 };
 166
 167 static const unsigned char TLS_EC_prime192v1_OID[] =
 168     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x01, 0x00 };
 169 static const unsigned char TLS_EC_prime192v2_OID[] =
 170     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x02, 0x00 };
 171 static const unsigned char TLS_EC_prime192v3_OID[] =
 172     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x03, 0x00 };
 173 static const unsigned char TLS_EC_prime239v1_OID[] =
 174     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x04, 0x00 };
 175 static const unsigned char TLS_EC_prime239v2_OID[] =
 176     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x05, 0x00 };
 177 static const unsigned char TLS_EC_prime239v3_OID[] =
 178     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x06, 0x00 };
 179 static const unsigned char TLS_EC_prime256v1_OID[] =
 180     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x00 };
 181
 182 #define TLS_EC_secp256r1_OID    TLS_EC_prime256v1_OID
 183 static const unsigned char TLS_EC_secp224r1_OID[] =
 184     { 0x2B, 0x81, 0x04, 0x00, 0x21, 0x00 };
 185 static const unsigned char TLS_EC_secp384r1_OID[] =
 186     { 0x2B, 0x81, 0x04, 0x00, 0x22, 0x00 };
 187 static const unsigned char TLS_EC_secp521r1_OID[] =
 188     { 0x2B, 0x81, 0x04, 0x00, 0x23, 0x00 };
 189
 190 int tls_random(unsigned char *key, int len);
 191 void tls_destroy_packet(struct TLSPacket *packet);
 192 struct TLSPacket *tls_build_hello(struct TLSContext *context,
 193                                   int tls13_downgrade);
 194
 195 /* not supported */
 196 #if 0
 197 static unsigned char TLS_DSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x52, 0xCE, 0x38, 0x04, 0x03, 0x00};
 198 #endif
 199
 200 static uint16_t get16(const unsigned char *buf) {
 201         uint16_t res;
 202
 203         res = ((*buf) << 8) + (*(buf+1));
 204         return res;
 205 }
 206
 207 static uint32_t get24(const unsigned char *buf) {
 208         uint32_t res;
 209
 210         res = (buf[0] << 16) + (buf[1] << 8) + buf[2];
 211         return res;
 212 }
 213
 214 #ifdef DEBUG
 215 static char *packet_content_type(int type) {
 216         switch (type) {
 217                 case 20: return "change_cipher_spec"; break;
 218                 case 21: return "alert"; break;
 219                 case 22: return "handshake"; break;
 220                 case 23: return "application_data"; break;
 221                 default: break;
 222         }
 223         return "unknown content type";
 224 }
 225
 226 static char *packet_handshake_type(int type) {
 227         switch (type) {
 228                 case 0: return "hello_request"; break;
 229                 case 1: return "client_hello"; break;
 230                 case 2: return "server_hello"; break;
 231                 case 11: return "certificate"; break;
 232                 case 12: return "server_key_exchange"; break;
 233                 case 13: return "certificate_request"; break;
 234                 case 14: return "server_hello_done"; break;
 235                 case 15: return "certificate_verify"; break;
 236                 case 16: return "client_key_exchange"; break;
 237                 case 20: return "finished"; break;
 238                 default: break;
 239         }
 240         return "unknown handshake type";
 241 }
 242 #endif
 243
 244 size_t tls_queue_packet(struct TLSPacket *packet) {
 245         ENTER;
 246         if (!packet) {
 247                 LEAVE;
 248                 return -1;
 249         }
 250
 251         struct TLSContext *context = packet->context;
 252
 253         if (!context) {
 254                 LEAVE;
 255                 return -1;
 256         }
 257
 258         DEBUG_PRINTLN("sending packet type %d %s\n", (int)packet->buf[0],
 259                         packet_content_type(packet->buf[0]));
 260         if (packet->buf[0] == 22) {
 261                 DEBUG_PRINTLN("handshake type %d %s\n", (int)packet->buf[5],
 262                                 packet_handshake_type(packet->buf[5])
 263                                 );
 264         }
 265         tls_buffer_append(&context->output_buffer, packet->buf, packet->len);
 266         tls_destroy_packet(packet);
 267         LEAVE;
 268         return context->output_buffer.len;
 269 }
 270
 271 static void tls_send_change_cipher_spec(struct TLSContext *context) {
 272         ENTER;
 273         struct TLSPacket *packet =
 274             tls_create_packet(context, TLS_CHANGE_CIPHER, context->version,
 275                               64);
 276         tls_packet_uint8(packet, 1);
 277         tls_packet_update(packet);
 278         context->local_sequence_number = 0;
 279         tls_queue_packet(packet);
 280         LEAVE;
 281         return;
 282 }
 283
 284 static void tls_send_encrypted_extensions(struct TLSContext *context) {
 285         struct TLSPacket *packet =
 286             tls_create_packet(context, TLS_HANDSHAKE, context->version, 3);
 287         tls_packet_uint8(packet, 0x08);
 288
 289         if (context->negotiated_alpn) {
 290                 int alpn_negotiated_len = strlen(context->negotiated_alpn);
 291                 int alpn_len = alpn_negotiated_len + 1;
 292
 293                 tls_packet_uint24(packet, alpn_len + 8);
 294                 tls_packet_uint16(packet, alpn_len + 6);
 295                 tls_packet_uint16(packet, 0x10);
 296                 tls_packet_uint16(packet, alpn_len + 2);
 297                 tls_packet_uint16(packet, alpn_len);
 298
 299                 tls_packet_uint8(packet, alpn_negotiated_len);
 300                 tls_packet_append(packet, (unsigned char *) context->
 301                                 negotiated_alpn, alpn_negotiated_len);
 302         } else {
 303                 tls_packet_uint24(packet, 2);
 304                 tls_packet_uint16(packet, 0);
 305         }
 306         tls_packet_update(packet);
 307         tls_queue_packet(packet);
 308         return;
 309 }
 310
 311 static void tls_send_done(struct TLSContext *context) {
 312         struct TLSPacket *packet =
 313             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 314         tls_packet_uint8(packet, 0x0E);
 315         tls_packet_uint24(packet, 0);
 316         tls_packet_update(packet);
 317         tls_queue_packet(packet);
 318         return;
 319 }
 320
 321 static void tls_send_certificate(struct TLSContext *context) {
 322         int i;
 323         unsigned int all_certificate_size = 0;
 324         int certificates_count;
 325         struct TLSCertificate **certificates;
 326
 327         ENTER;
 328         if (context->is_server) {
 329                 certificates_count = context->certificates_count;
 330                 certificates = context->certificates;
 331         } else {
 332                 certificates_count = context->client_certificates_count;
 333                 certificates = context->client_certificates;
 334         }
 335
 336         int delta = 3;
 337         if (context->tlsver == TLS_VERSION13) {
 338                 delta = 5;
 339         }
 340
 341         int is_ecdsa = tls_is_ecdsa(context);
 342         /* TODO can do one loop and test for ecdsa inside loop */
 343         if (is_ecdsa) {
 344                 for (i = 0; i < certificates_count; i++) {
 345                         struct TLSCertificate *cert = certificates[i];
 346                         if (cert && cert->der_len && cert->ec_algorithm) {
 347                                 all_certificate_size += cert->der_len + delta;
 348                         }
 349                 }
 350         } else {
 351                 for (i = 0; i < certificates_count; i++) {
 352                         struct TLSCertificate *cert = certificates[i];
 353                         if (cert && cert->der_len && !cert->ec_algorithm) {
 354                                 all_certificate_size += cert->der_len + delta;
 355                         }
 356                 }
 357         }
 358
 359         for (i = 0; i < certificates_count; i++) {
 360                 struct TLSCertificate *cert = certificates[i];
 361                 if (cert && cert->der_len) {
 362                         all_certificate_size += cert->der_len + delta;
 363                 }
 364         }
 365
 366         if (!all_certificate_size) {
 367                 DEBUG_PRINT("NO CERTIFICATE SET\n");
 368         }
 369
 370         struct TLSPacket *packet = tls_create_packet(context, TLS_HANDSHAKE,
 371                         context->version, 0);
 372         tls_packet_uint8(packet, 0x0B);
 373
 374         if (all_certificate_size) {
 375                 /* context */
 376                 if (context->tlsver == TLS_VERSION13) {
 377                         tls_packet_uint24(packet, all_certificate_size + 4);
 378                         tls_packet_uint8(packet, 0);
 379                 } else {
 380                         tls_packet_uint24(packet, all_certificate_size + 3);
 381                 }
 382
 383                 tls_packet_uint24(packet, all_certificate_size);
 384
 385                 for (i = 0; i < certificates_count; i++) {
 386                         struct TLSCertificate *cert = certificates[i];
 387                         if (cert && cert->der_len) {
 388                                 /* is RSA certificate ? */
 389                                 if (is_ecdsa && !cert->ec_algorithm) {
 390                                         continue;
 391                                 }
 392                                 /* is ECC certificate ? */
 393                                 if (!is_ecdsa && cert->ec_algorithm) {
 394                                         continue;
 395                                 }
 396                                 /* 2 times -> one certificate */
 397                                 tls_packet_uint24(packet, cert->der_len);
 398                                 tls_packet_append(packet, cert->der_bytes,
 399                                                   cert->der_len);
 400                                 /* extension */
 401                                 if (context->tlsver == TLS_VERSION13) {
 402                                         tls_packet_uint16(packet, 0);
 403                                 }
 404                         }
 405                 }
 406         } else {
 407                 tls_packet_uint24(packet, all_certificate_size);
 408                 if (context->tlsver == TLS_VERSION13) {
 409                         tls_packet_uint8(packet, 0);
 410                 }
 411
 412         }
 413         tls_packet_update(packet);
 414         tls_queue_packet(packet);
 415         LEAVE;
 416         return;
 417 }
 418
 419 int tls_supported_version(uint16_t ver) {
 420         switch (ver) {
 421                 case TLS_V12:
 422                 case TLS_V13:
 423                         break;
 424                 default:
 425                         DEBUG_PRINT("UNSUPPORTED TLS VERSION %x\n", (int)ver);
 426                         return 0;
 427         }
 428         return 1;
 429 }
 430
 431 void tls_set_packet_length(struct TLSPacket *packet, uint32_t length) {
 432         int offset = packet->payload_pos;
 433         packet->buf[offset] = (length >> 16) & 0xff;
 434         packet->buf[offset+1] = (length >> 8) & 0xff;
 435         packet->buf[offset+2] = (length >> 0) & 0xff;
 436 }
 437
 438 static void tls_init() {
 439         static int loaded = 0;
 440         if (loaded) {
 441                 return;
 442         }
 443
 444         DEBUG_PRINT("Initializing dependencies\n");
 445         loaded = 1;
 446 #ifdef LTM_DESC
 447         ltc_mp = ltm_desc;
 448 #else
 449 #ifdef TFM_DESC
 450         ltc_mp = tfm_desc;
 451 #endif
 452 #endif
 453         /* TODO remove these */
 454 #if 0
 455         register_hash(&md5_desc);
 456         register_hash(&sha1_desc);
 457 #endif
 458
 459         register_hash(&sha256_desc);
 460         register_hash(&sha384_desc);
 461         register_hash(&sha512_desc);
 462
 463         register_prng(&sprng_desc);
 464
 465         register_cipher(&aes_desc);
 466
 467         tls_ecc_init_curves();
 468 }
 469
 470 static unsigned char *decrypt_rsa(struct TLSContext *context,
 471                                         const unsigned char *buffer,
 472                                         unsigned int len,
 473                                         unsigned int *size) {
 474         *size = 0;
 475         if (!len || !context || !context->private_key
 476             || !context->private_key->der_bytes
 477             || !context->private_key->der_len) {
 478                 DEBUG_PRINT("No private key set\n");
 479                 return NULL;
 480         }
 481         rsa_key key;
 482         int err;
 483         err = rsa_import(context->private_key->der_bytes,
 484                         context->private_key->der_len, &key);
 485
 486         if (err) {
 487                 DEBUG_PRINT("Error importing RSA key (code: %i)\n", err);
 488                 return NULL;
 489         }
 490
 491         unsigned char *out = malloc(len);
 492         unsigned long out_size = len;
 493         int hash_idx = find_hash("sha256");
 494         int res = 0;
 495         err = rsa_decrypt_key_ex(buffer, len, out, &out_size, (unsigned char *)
 496                         "Concept", 7, hash_idx, LTC_PKCS_1_V1_5, &res, &key);
 497         rsa_free(&key);
 498
 499         if (err || !out_size) {
 500                 DEBUG_PRINT("RSA DECRYPT ERROR\n");
 501                 free(out);
 502                 return NULL;
 503         }
 504         *size = (unsigned int) out_size;
 505         return out;
 506 }
 507
 508 static int verify_rsa(struct TLSContext *context, unsigned int hash_type, const
 509                 unsigned char *buffer, unsigned int len, const unsigned char
 510                 *message, unsigned long message_len) {
 511         rsa_key key;
 512         int err;
 513
 514         if (len == 0) {
 515                 return TLS_GENERIC_ERROR;
 516         }
 517
 518         struct TLSCertificate **cert;
 519         int count;
 520
 521         if (context->is_server) {
 522                 cert = context->client_certificates;
 523                 count = context->client_certificates_count;
 524         } else {
 525                 cert = context->certificates;
 526                 count = context->certificates_count;
 527         }
 528
 529         if (count == 0 || !cert) {
 530                 return TLS_GENERIC_ERROR;
 531         }
 532
 533         err = rsa_import(cert[0]->der_bytes, cert[0]->der_len, &key);
 534
 535         if (err) {
 536                 DEBUG_PRINT("Error importing RSA certificate (code: %i)\n",
 537                             err);
 538                 return TLS_GENERIC_ERROR;
 539         }
 540         int hash_idx = -1;
 541         unsigned char hash[TLS_MAX_HASH_LEN];
 542         unsigned long hash_len;
 543         hash_len = (unsigned long)sizeof hash;
 544
 545         switch (hash_type) {
 546                 case md5:
 547                         hash_idx = find_hash("md5");
 548                         break;
 549                 case sha1:
 550                         hash_idx = find_hash("sha1");
 551                         break;
 552                 case sha256:
 553                         hash_idx = find_hash("sha256");
 554                         break;
 555                 case sha384:
 556                         hash_idx = find_hash("sha384");
 557                         break;
 558                 case sha512:
 559                         hash_idx = find_hash("sha512");
 560                         break;
 561         }
 562         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 563         if (hash_idx < 0 || err) {
 564                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 565                 return TLS_GENERIC_ERROR;
 566         }
 567         int rsa_stat = 0;
 568         if (context->tlsver == TLS_VERSION13) {
 569                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 570                                 LTC_PKCS_1_PSS, hash_idx, 0, &rsa_stat, &key);
 571         } else {
 572                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 573                                 LTC_PKCS_1_V1_5, hash_idx, 0, &rsa_stat, &key);
 574         }
 575         rsa_free(&key);
 576         if (err) {
 577                 return 0;
 578         }
 579         return rsa_stat;
 580 }
 581
 582 static int sign_rsa(struct TLSContext *context, unsigned int hash_type, const
 583                 unsigned char *message, unsigned int message_len, unsigned char
 584                 *out, unsigned long *outlen) {
 585         rsa_key key;
 586         int err;
 587         int hash_index = -1;
 588         unsigned char hash[TLS_MAX_HASH_LEN];
 589         unsigned long hash_len = 0;
 590         //hash_state state;
 591
 592         if (!outlen || !context || !out || !context->private_key
 593             || !context->private_key->der_bytes
 594             || !context->private_key->der_len) {
 595                 DEBUG_PRINT("No private key set\n");
 596                 return TLS_GENERIC_ERROR;
 597         }
 598
 599         err = rsa_import(context->private_key->der_bytes,
 600                         context->private_key->der_len, &key);
 601
 602         if (err) {
 603                 DEBUG_PRINT("Error %d importing RSA certificate", err);
 604                 return TLS_GENERIC_ERROR;
 605         }
 606
 607         switch (hash_type) {
 608                 case sha1:
 609                         hash_index = find_hash("sha1");
 610                         hash_len = 20;
 611                         break;
 612                 case sha256:
 613                         hash_index = find_hash("sha256");
 614                         hash_len = 32;
 615                         break;
 616                 case sha384:
 617                         hash_index = find_hash("sha384");
 618                         hash_len = 48;
 619                         break;
 620                 case sha512:
 621                         hash_index = find_hash("sha512");
 622                         hash_len = 64;
 623                         break;
 624                 case md5:
 625                 case _md5_sha1:
 626                         hash_index = find_hash("md5");
 627                         hash_len = 16;
 628                         break;
 629         }
 630
 631         if (hash_index < 0 || err) {
 632                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 633                 return TLS_GENERIC_ERROR;
 634         }
 635
 636         hash_memory(hash_index, message, message_len, hash, &hash_len);
 637
 638         if (hash_type == _md5_sha1) {
 639                 unsigned long hlen = 20;
 640                 hash_index = find_hash("sha1");
 641                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 642                 hash_len += hlen;
 643         }
 644
 645         //err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 646
 647         if (context->tlsver == TLS_VERSION13) {
 648                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 649                                 LTC_PKCS_1_PSS, NULL, find_prng("sprng"),
 650                                 hash_index, hash_type == sha256 ? 32 : 48, &key);
 651         } else {
 652                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 653                                 LTC_PKCS_1_V1_5, NULL, find_prng("sprng"),
 654                                 hash_index, 0, &key);
 655         }
 656
 657         rsa_free(&key);
 658         if (err) {
 659                 return 0;
 660         }
 661
 662         return 1;
 663 }
 664
 665 static int tls_is_point(ecc_key * key) {
 666         void *prime, *b, *t1, *t2;
 667         int err;
 668
 669         if ((err = mp_init_multi(&prime, &b, &t1, &t2, NULL)) != CRYPT_OK) {
 670                 return err;
 671         }
 672
 673         /* load prime and b */
 674         if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) {
 675                 goto error;
 676         }
 677         if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) {
 678                 goto error;
 679         }
 680
 681         /* compute y^2 */
 682         if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) {
 683                 goto error;
 684         }
 685
 686         /* compute x^3 */
 687         if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) {
 688                 goto error;
 689         }
 690         if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) {
 691                 goto error;
 692         }
 693         if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) {
 694                 goto error;
 695         }
 696
 697         /* compute y^2 - x^3 */
 698         if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) {
 699                 goto error;
 700         }
 701
 702         /* compute y^2 - x^3 + 3x */
 703         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 704                 goto error;
 705         }
 706         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 707                 goto error;
 708         }
 709         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 710                 goto error;
 711         }
 712         if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) {
 713                 goto error;
 714         }
 715         while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
 716                 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) {
 717                         goto error;
 718                 }
 719         }
 720         while (mp_cmp(t1, prime) != LTC_MP_LT) {
 721                 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) {
 722                         goto error;
 723                 }
 724         }
 725
 726         /* compare to b */
 727         if (mp_cmp(t1, b) != LTC_MP_EQ) {
 728                 err = CRYPT_INVALID_PACKET;
 729         } else {
 730                 err = CRYPT_OK;
 731         }
 732
 733       error:
 734         mp_clear_multi(prime, b, t1, t2, NULL);
 735         return err;
 736 }
 737
 738 static int tls_ecc_import_key(const unsigned char *private_key,
 739                                 int private_len,
 740                                 const unsigned char *public_key,
 741                                 int public_len, ecc_key *key,
 742                                 const ltc_ecc_set_type *dp) {
 743         int err;
 744
 745         if (!key || !ltc_mp.name) {
 746                 return CRYPT_MEM;
 747         }
 748
 749         key->type = PK_PRIVATE;
 750
 751         if (mp_init_multi
 752             (&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k,
 753              NULL) != CRYPT_OK)
 754                 return CRYPT_MEM;
 755
 756         if (public_len && !public_key[0]) {
 757                 public_key++;
 758                 public_len--;
 759         }
 760         if ((err = mp_read_unsigned_bin(key->pubkey.x,
 761                                   (unsigned char *) public_key + 1,
 762                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 763                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 764                                key->k, NULL);
 765                 return err;
 766         }
 767
 768         if ((err = mp_read_unsigned_bin(key->pubkey.y,
 769                                   (unsigned char *) public_key + 1 +
 770                                   ((public_len - 1) >> 1),
 771                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 772                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 773                                key->k, NULL);
 774                 return err;
 775         }
 776
 777         if ((err =
 778              mp_read_unsigned_bin(key->k, (unsigned char *) private_key,
 779                                   private_len)) != CRYPT_OK) {
 780                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 781                                key->k, NULL);
 782                 return err;
 783         }
 784
 785         key->idx = -1;
 786         key->dp = dp;
 787
 788         /* set z */
 789         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
 790                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 791                                key->k, NULL);
 792                 return err;
 793         }
 794
 795         /* is it a point on the curve?  */
 796         if ((err = tls_is_point(key)) != CRYPT_OK) {
 797                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
 798                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 799                                key->k, NULL);
 800                 return err;
 801         }
 802
 803         /* we're good */
 804         return CRYPT_OK;
 805 }
 806
 807 static int sign_ecdsa(struct TLSContext *context,
 808                             unsigned int hash_type,
 809                             const unsigned char *message,
 810                             unsigned int message_len, unsigned char *out,
 811                             unsigned long *outlen) {
 812         if (!outlen || !context || !out || !outlen
 813             || !context->ec_private_key
 814             || !context->ec_private_key->priv
 815             || !context->ec_private_key->priv_len
 816             || !context->ec_private_key->pk
 817             || !context->ec_private_key->pk_len) {
 818                 DEBUG_PRINT("No private ECDSA key set\n");
 819                 return TLS_GENERIC_ERROR;
 820         }
 821
 822         const struct ECCCurveParameters *curve = NULL;
 823
 824         switch (context->ec_private_key->ec_algorithm) {
 825                 case 19:
 826                         curve = &secp192r1;
 827                         break;
 828                 case 20:
 829                         curve = &secp224k1;
 830                         break;
 831                 case 21:
 832                         curve = &secp224r1;
 833                         break;
 834                 case 22:
 835                         curve = &secp256k1;
 836                         break;
 837                 case 23:
 838                         curve = &secp256r1;
 839                         break;
 840                 case 24:
 841                         curve = &secp384r1;
 842                         break;
 843                 case 25:
 844                         curve = &secp521r1;
 845                         break;
 846                 default:
 847                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
 848         }
 849
 850         if (!curve) {
 851                 return TLS_GENERIC_ERROR;
 852         }
 853
 854         ecc_key key;
 855         int err;
 856
 857         ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&curve->dp;
 858
 859         /* broken ... fix this */
 860         err = tls_ecc_import_key(context->ec_private_key->priv,
 861                         context->ec_private_key->priv_len,
 862                         context->ec_private_key->pk,
 863                         context->ec_private_key->pk_len, &key, dp);
 864
 865         if (err) {
 866                 DEBUG_PRINT("Error importing ECC certificate (code: %i)\n",
 867                             (int) err);
 868                 return TLS_GENERIC_ERROR;
 869         }
 870
 871         unsigned char hash[TLS_MAX_HASH_LEN];
 872         unsigned long hash_len = 0;
 873         int hash_index;
 874
 875         switch (hash_type) {
 876                 case sha1:
 877                         hash_index = find_hash("sha1");
 878                         hash_len = 20;
 879                         break;
 880                 case sha256:
 881                         hash_index = find_hash("sha256");
 882                         hash_len = 32;
 883                         break;
 884                 case sha384:
 885                         hash_index = find_hash("sha384");
 886                         hash_len = 48;
 887                         break;
 888                 case sha512:
 889                         hash_index = find_hash("sha512");
 890                         hash_len = 64;
 891                         break;
 892                 case md5:
 893                 case _md5_sha1:
 894                         hash_index = find_hash("md5");
 895                         hash_len = 16;
 896                         break;
 897         }
 898
 899         hash_memory(hash_index, message, message_len, hash, &hash_len);
 900
 901         if (hash_type == _md5_sha1) {
 902                 unsigned long hlen = 20;
 903                 hash_index = find_hash("sha1");
 904                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 905                 hash_len += hlen;
 906         }
 907
 908         if (err) {
 909                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 910                 return TLS_GENERIC_ERROR;
 911         }
 912         /* "Let z be the Ln leftmost bits of e, where Ln is the bit length of
 913          * the group order n." */
 914         if ((int)hash_len > curve->size) {
 915                 hash_len = curve->size;
 916         }
 917         err = ecc_sign_hash(hash, hash_len, out, outlen, NULL,
 918                         find_prng("sprng"), &key);
 919         DEBUG_DUMP_HEX_LABEL("ECC SIGNATURE", out, *outlen);
 920         ecc_free(&key);
 921
 922         return err ? 0 : 1;
 923 }
 924
 925 static void tls_send_certificate_verify(struct TLSContext *context) {
 926         struct TLSPacket *packet =
 927             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 928         /* certificate verify */
 929         tls_packet_uint8(packet, 0x0F);
 930         tls_packet_uint24(packet, 0);
 931
 932         unsigned char out[TLS_MAX_RSA_KEY];
 933         unsigned long out_len = TLS_MAX_RSA_KEY;
 934
 935         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
 936         int signing_data_len;
 937
 938         /* first 64 bytes to 0x20 (32) */
 939         memset(signing_data, 0x20, 64);
 940         /* context string 33 bytes */
 941         if (context->is_server) {
 942                 memcpy(signing_data + 64, "TLS 1.3, server CertificateVerify",
 943                                 33);
 944         } else {
 945                 memcpy(signing_data + 64, "TLS 1.3, client CertificateVerify",
 946                                 33);
 947         }
 948         /* a single 0 byte separator */
 949         signing_data[97] = 0;
 950         signing_data_len = 98;
 951
 952         signing_data_len += tls_get_hash(context, signing_data + 98);
 953         DEBUG_DUMP_HEX_LABEL("verify data", signing_data, signing_data_len);
 954         int hash_algorithm = sha256;
 955         if (tls_is_ecdsa(context)) {
 956                 switch (context->ec_private_key->ec_algorithm) {
 957                         case 23:
 958                                 /* secp256r1 + sha256 */
 959                                 tls_packet_uint16(packet, 0x0403);
 960                                 break;
 961                         case 24:
 962                                 /* secp384r1 + sha384 */
 963                                 tls_packet_uint16(packet, 0x0503);
 964                                 hash_algorithm = sha384;
 965                                 break;
 966                         case 25:
 967                                 /* secp521r1 + sha512 */
 968                                 tls_packet_uint16(packet, 0x0603);
 969                                 hash_algorithm = sha512;
 970                                 break;
 971                         default:
 972                                 DEBUG_PRINT("UNSUPPORTED CURVE (SIGNING)\n");
 973                                 packet->broken = 1;
 974                                 /* TODO error */
 975                                 return;
 976                 }
 977         } else {
 978                 tls_packet_uint16(packet, 0x0804);
 979         }
 980
 981         int packet_size = 2;
 982
 983         if (tls_is_ecdsa(context)) {
 984                 if (sign_ecdsa(context, hash_algorithm, signing_data,
 985                                         signing_data_len, out, &out_len) == 1)
 986                 {
 987                         DEBUG_PRINT
 988                             ("ECDSA signing OK! (ECDSA, length %lu)\n",
 989                              out_len);
 990                         tls_packet_uint16(packet, out_len);
 991                         tls_packet_append(packet, out, out_len);
 992                         packet_size += out_len + 2;
 993                 }
 994         } else if (sign_rsa(context, hash_algorithm, signing_data,
 995                                 signing_data_len, out, &out_len) == 1) {
 996                 DEBUG_PRINT("RSA signing OK! (length %lu)\n", out_len);
 997                 tls_packet_uint16(packet, out_len);
 998                 tls_packet_append(packet, out, out_len);
 999                 packet_size += out_len + 2;
1000         }
1001
1002         tls_set_packet_length(packet, packet_size);
1003
1004         tls_packet_update(packet);
1005         tls_queue_packet(packet);
1006         return;
1007 }
1008
1009 static int tls_ecc_import_pk(const unsigned char *public_key,
1010                                int public_len, ecc_key * key,
1011                                const ltc_ecc_set_type * dp) {
1012         int err;
1013
1014         if (!key || !ltc_mp.name) {
1015                 return CRYPT_MEM;
1016         }
1017
1018         key->type = PK_PUBLIC;
1019
1020         if (mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z,
1021                                 &key->k, NULL) != CRYPT_OK) {
1022                 return CRYPT_MEM;
1023         }
1024
1025         if (public_len && !public_key[0]) {
1026                 public_key++;
1027                 public_len--;
1028         }
1029         if ((err = mp_read_unsigned_bin(key->pubkey.x,
1030                                   (unsigned char *) public_key + 1,
1031                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1032                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1033                                key->k, NULL);
1034                 return err;
1035         }
1036
1037         if ((err = mp_read_unsigned_bin(key->pubkey.y,
1038                                   (unsigned char *) public_key + 1 +
1039                                   ((public_len - 1) >> 1),
1040                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1041                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1042                                key->k, NULL);
1043                 return err;
1044         }
1045
1046         key->idx = -1;
1047         key->dp = dp;
1048
1049         /* set z */
1050         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
1051                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1052                                key->k, NULL);
1053                 return err;
1054         }
1055
1056         /* is it a point on the curve?  */
1057         if ((err = tls_is_point(key)) != CRYPT_OK) {
1058                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
1059                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1060                                key->k, NULL);
1061                 return err;
1062         }
1063
1064         /* we're good */
1065         return CRYPT_OK;
1066 }
1067
1068 static int tls_verify_ecdsa(struct TLSContext *context,
1069                               unsigned int hash_type,
1070                               const unsigned char *buffer,
1071                               unsigned int len,
1072                               const unsigned char *message,
1073                               unsigned int message_len,
1074                               const struct ECCCurveParameters *curve_hint)
1075 {
1076         ecc_key key;
1077         int err;
1078
1079         if (!curve_hint) {
1080                 curve_hint = context->curve;
1081         }
1082
1083         if (len == 0) {
1084                 return TLS_GENERIC_ERROR;
1085         }
1086
1087         struct TLSCertificate **cert;
1088         int count;
1089
1090         if (context->is_server) {
1091                 cert = context->client_certificates;
1092                 count = context->client_certificates_count;
1093         } else {
1094                 cert = context->certificates;
1095                 count = context->certificates_count;
1096         }
1097
1098         if (count == 0 || !cert || !cert[0] || !cert[0]->pk ||
1099                         !cert[0]->pk_len) {
1100                 return TLS_GENERIC_ERROR;
1101         }
1102
1103         err = tls_ecc_import_pk(cert[0]->pk, cert[0]->pk_len, &key,
1104                         (ltc_ecc_set_type *)&curve_hint->dp);
1105
1106         if (err) {
1107                 DEBUG_PRINT("Error importing ECC certificate (code: %i)", err);
1108                 return TLS_GENERIC_ERROR;
1109         }
1110
1111         int hash_idx = -1;
1112         unsigned char hash[TLS_MAX_HASH_LEN];
1113         unsigned long hash_len = 0;
1114
1115         switch (hash_type) {
1116                 case md5:
1117                         hash_idx = find_hash("md5");
1118                         hash_len = 16;
1119                         break;
1120                 case sha1:
1121                         hash_idx = find_hash("sha1");
1122                         hash_len = 20;
1123                         break;
1124                 case sha256:
1125                         hash_idx = find_hash("sha256");
1126                         hash_len = 32;
1127                         break;
1128                 case sha384:
1129                         hash_idx = find_hash("sha384");
1130                         hash_len = 48;
1131                         break;
1132                 case sha512:
1133                         hash_idx = find_hash("sha512");
1134                         hash_len = 64;
1135                         break;
1136         }
1137
1138         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
1139
1140         if (hash_idx < 0 || err) {
1141                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
1142                 return TLS_GENERIC_ERROR;
1143         }
1144
1145         int ecc_stat = 0;
1146         err = ecc_verify_hash(buffer, len, hash, hash_len, &ecc_stat, &key);
1147         ecc_free(&key);
1148         if (err) {
1149                 return 0;
1150         }
1151         return ecc_stat;
1152 }
1153
1154 static void prf_helper(int hash_idx, unsigned long dlen,
1155                              unsigned char *output, unsigned int outlen,
1156                              const unsigned char *secret,
1157                              const unsigned int secret_len,
1158                              const unsigned char *label,
1159                              unsigned int label_len, unsigned char *seed,
1160                              unsigned int seed_len, unsigned char *seed_b,
1161                              unsigned int seed_b_len) {
1162         unsigned char digest_out0[TLS_MAX_HASH_LEN];
1163         unsigned char digest_out1[TLS_MAX_HASH_LEN];
1164         unsigned int i;
1165         hmac_state hmac;
1166
1167         hmac_init(&hmac, hash_idx, secret, secret_len);
1168         hmac_process(&hmac, label, label_len);
1169
1170         hmac_process(&hmac, seed, seed_len);
1171         if (seed_b && seed_b_len) {
1172                 hmac_process(&hmac, seed_b, seed_b_len);
1173         }
1174         hmac_done(&hmac, digest_out0, &dlen);
1175         int idx = 0;
1176         while (outlen) {
1177                 hmac_init(&hmac, hash_idx, secret, secret_len);
1178                 hmac_process(&hmac, digest_out0, dlen);
1179                 hmac_process(&hmac, label, label_len);
1180                 hmac_process(&hmac, seed, seed_len);
1181                 if (seed_b && seed_b_len) {
1182                         hmac_process(&hmac, seed_b, seed_b_len);
1183                 }
1184                 hmac_done(&hmac, digest_out1, &dlen);
1185
1186                 unsigned int copylen = outlen;
1187                 if (copylen > dlen) {
1188                         copylen = dlen;
1189                 }
1190
1191                 for (i = 0; i < copylen; i++) {
1192                         output[idx++] ^= digest_out1[i];
1193                         outlen--;
1194                 }
1195
1196                 if (!outlen) {
1197                         break;
1198                 }
1199
1200                 hmac_init(&hmac, hash_idx, secret, secret_len);
1201                 hmac_process(&hmac, digest_out0, dlen);
1202                 hmac_done(&hmac, digest_out0, &dlen);
1203         }
1204 }
1205
1206 static void tls_prf(struct TLSContext *context,
1207                       unsigned char *output, unsigned int outlen,
1208                       const unsigned char *secret,
1209                       const unsigned int secret_len,
1210                       const unsigned char *label, unsigned int label_len,
1211                       unsigned char *seed, unsigned int seed_len,
1212                       unsigned char *seed_b, unsigned int seed_b_len) {
1213         if (!secret || !secret_len) {
1214                 DEBUG_PRINT("NULL SECRET\n");
1215                 return;
1216         }
1217
1218         /* TODO I don't think this is right, wouldn't use md5 for tls v1.3 */
1219         if (context->version != TLS_V12) {
1220                 int md5_hash_idx = find_hash("md5");
1221                 int sha1_hash_idx = find_hash("sha1");
1222                 int half_secret = (secret_len + 1) / 2;
1223
1224                 memset(output, 0, outlen);
1225                 prf_helper(md5_hash_idx, 16, output, outlen, secret,
1226                                 half_secret, label, label_len, seed, seed_len,
1227                                 seed_b, seed_b_len);
1228                 prf_helper(sha1_hash_idx, 20, output, outlen, secret +
1229                                 (secret_len - half_secret), secret_len -
1230                                 half_secret, label, label_len, seed, seed_len,
1231                                 seed_b, seed_b_len);
1232         } else {
1233                 /* sha256_hmac */
1234                 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1235                 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1236                 unsigned long dlen = 32;
1237                 int hash_idx;
1238                 unsigned int mac_length = tls_mac_length(context);
1239
1240                 if (mac_length == TLS_SHA384_MAC_SIZE) {
1241                         hash_idx = find_hash("sha384");
1242                         dlen = mac_length;
1243                 } else {
1244                         hash_idx = find_hash("sha256");
1245                 }
1246
1247                 unsigned int i;
1248
1249                 hmac_state hmac;
1250                 hmac_init(&hmac, hash_idx, secret, secret_len);
1251                 hmac_process(&hmac, label, label_len);
1252                 hmac_process(&hmac, seed, seed_len);
1253                 if (seed_b && seed_b_len) {
1254                         hmac_process(&hmac, seed_b, seed_b_len);
1255                 }
1256                 hmac_done(&hmac, digest_out0, &dlen);
1257
1258                 int idx = 0;
1259                 while (outlen) {
1260                         hmac_init(&hmac, hash_idx, secret, secret_len);
1261                         hmac_process(&hmac, digest_out0, dlen);
1262                         hmac_process(&hmac, label, label_len);
1263                         hmac_process(&hmac, seed, seed_len);
1264                         if (seed_b && seed_b_len) {
1265                                 hmac_process(&hmac, seed_b, seed_b_len);
1266                         }
1267                         hmac_done(&hmac, digest_out1, &dlen);
1268
1269                         unsigned int copylen = outlen;
1270                         if (copylen > dlen) {
1271                                 copylen = (unsigned int) dlen;
1272                         }
1273
1274                         for (i = 0; i < copylen; i++) {
1275                                 output[idx++] = digest_out1[i];
1276                                 outlen--;
1277                         }
1278
1279                         if (!outlen) {
1280                                 break;
1281                         }
1282
1283                         hmac_init(&hmac, hash_idx, secret, secret_len);
1284                         hmac_process(&hmac, digest_out0, dlen);
1285                         hmac_done(&hmac, digest_out0, &dlen);
1286                 }
1287         }
1288 }
1289
1290 static void tls_send_finished(struct TLSContext *context) {
1291         ENTER;
1292         struct TLSPacket *packet =
1293             tls_create_packet(context, TLS_HANDSHAKE, context->version,
1294                               TLS_MIN_FINISHED_OPAQUE_LEN + 64);
1295         tls_packet_uint8(packet, 20);
1296
1297         if (context->tlsver == TLS_VERSION13) {
1298                 tls_packet_uint24(packet, tls_mac_length(context));
1299         } else {
1300                 tls_packet_uint24(packet, TLS_MIN_FINISHED_OPAQUE_LEN);
1301         }
1302
1303         /* verify */
1304         unsigned char hash[TLS_MAX_HASH_SIZE];
1305         unsigned long out_size = TLS_MIN_FINISHED_OPAQUE_LEN;
1306         unsigned char out[TLS_MAX_HASH_SIZE];
1307         unsigned int hash_len;
1308
1309         int context_is_v13 = 0;
1310
1311         if (packet->context->tlsver == TLS_VERSION13) {
1312                 context_is_v13 = 1;
1313         }
1314
1315         /* server verifies client's message */
1316         if (context->is_server) {
1317                 if (context_is_v13) {
1318                         hash_len = tls_get_hash(context, hash);
1319                         if (!context->finished_key || !hash_len) {
1320                                 DEBUG_PRINT
1321                                     ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
1322
1323                                 /* TODO probably need to terminate */
1324                                 tls_destroy_packet(packet);
1325                                 LEAVE;
1326                                 return;
1327                         }
1328
1329                         DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
1330                         DEBUG_DUMP_HEX_LABEL("HS FINISH",
1331                                              context->finished_key,
1332                                              hash_len);
1333
1334                         out_size = hash_len;
1335                         hmac_state hmac;
1336                         hmac_init(&hmac, tls_get_hash_idx(context),
1337                                         context->finished_key, hash_len);
1338                         hmac_process(&hmac, hash, hash_len);
1339                         hmac_done(&hmac, out, &out_size);
1340                 } else {
1341                         hash_len = tls_done_hash(context, hash);
1342                         tls_prf(context, out,
1343                                          TLS_MIN_FINISHED_OPAQUE_LEN,
1344                                          context->master_key,
1345                                          context->master_key_len,
1346                                          (unsigned char *)
1347                                          "server finished", 15, hash,
1348                                          hash_len, NULL, 0);
1349                         tls_destroy_hash(context);
1350                 }
1351         } else {
1352                 /* client */
1353                 hash_len = tls_get_hash(context, hash);
1354                 tls_prf(context, out, TLS_MIN_FINISHED_OPAQUE_LEN,
1355                                  context->master_key,
1356                                  context->master_key_len,
1357                                  (unsigned char *) "client finished", 15,
1358                                  hash, hash_len, NULL, 0);
1359         }
1360
1361         tls_packet_append(packet, out, out_size);
1362         tls_packet_update(packet);
1363         DEBUG_DUMP_HEX_LABEL("VERIFY DATA", out, out_size);
1364         tls_queue_packet(packet);
1365         LEAVE;
1366         return;
1367 }
1368
1369 static int tls_key_length(struct TLSContext *context) {
1370         switch (context->cipher) {
1371                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1372                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1373                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1374                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1375                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1376                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1377                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1378                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1379                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1380                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1381                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1382                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1383                 case TLS_AES_128_GCM_SHA256:
1384                         return 16;
1385                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1386                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1387                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1388                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1389                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1390                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1391                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1392                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1393                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1394                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1395                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1396                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1397                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1398                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1399                 case TLS_AES_256_GCM_SHA384:
1400                 case TLS_CHACHA20_POLY1305_SHA256:
1401                         return 32;
1402         }
1403         return 0;
1404 }
1405
1406 /* 0 is none, 1 is GCM?, 2 is chacha */
1407 int tls_is_aead(struct TLSContext *context) {
1408         switch (context->cipher) {
1409                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1410                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1411                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1412                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1413                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1414                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1415                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1416                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1417                 case TLS_AES_128_GCM_SHA256:
1418                 case TLS_AES_256_GCM_SHA384:
1419                         return 1;
1420                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1421                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1422                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1423                 case TLS_CHACHA20_POLY1305_SHA256:
1424                         return 2;
1425         }
1426         return 0;
1427 }
1428
1429 int tls_mac_length(struct TLSContext *context) {
1430         switch (context->cipher) {
1431                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1432                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1433                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1434                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1435                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1436                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1437                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1438                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1439                         return TLS_SHA1_MAC_SIZE;
1440                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1441                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1442                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1443                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1444                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1445                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1446                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1447                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1448                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1449                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1450                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1451                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1452                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1453                 case TLS_AES_128_GCM_SHA256:
1454                 case TLS_CHACHA20_POLY1305_SHA256:
1455                 case TLS_AES_128_CCM_SHA256:
1456                 case TLS_AES_128_CCM_8_SHA256:
1457                         return TLS_SHA256_MAC_SIZE;
1458                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1459                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1460                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1461                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1462                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1463                 case TLS_AES_256_GCM_SHA384:
1464                         return TLS_SHA384_MAC_SIZE;
1465         }
1466         return 0;
1467 }
1468
1469 int _private_tls13_key(struct TLSContext *context, int handshake) {
1470         int key_length = tls_key_length(context);
1471         int mac_length = tls_mac_length(context);
1472
1473         if (!context->premaster_key || !context->premaster_key_len) {
1474                 return 0;
1475         }
1476
1477         if (!key_length || !mac_length) {
1478                 DEBUG_PRINT
1479                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1480                      key_length, mac_length);
1481                 return 0;
1482         }
1483
1484         unsigned char *clientkey = NULL;
1485         unsigned char *serverkey = NULL;
1486         unsigned char *clientiv = NULL;
1487         unsigned char *serveriv = NULL;
1488         int is_aead = tls_is_aead(context);
1489
1490         unsigned char local_keybuffer[TLS_V13_MAX_KEY_SIZE];
1491         unsigned char local_ivbuffer[TLS_V13_MAX_IV_SIZE];
1492         unsigned char remote_keybuffer[TLS_V13_MAX_KEY_SIZE];
1493         unsigned char remote_ivbuffer[TLS_V13_MAX_IV_SIZE];
1494
1495         unsigned char prk[TLS_MAX_HASH_SIZE];
1496         unsigned char hash[TLS_MAX_HASH_SIZE];
1497         static unsigned char earlysecret[TLS_MAX_HASH_SIZE];
1498
1499         const char *server_key = "s ap traffic";
1500         const char *client_key = "c ap traffic";
1501         if (handshake) {
1502                 server_key = "s hs traffic";
1503                 client_key = "c hs traffic";
1504         }
1505
1506         unsigned char salt[TLS_MAX_HASH_SIZE];
1507
1508         hash_state md;
1509         /* TODO what is the point of this ? */
1510         if (mac_length == TLS_SHA384_MAC_SIZE) {
1511                 sha384_init(&md);
1512                 sha384_done(&md, hash);
1513         } else {
1514                 sha256_init(&md);
1515                 sha256_done(&md, hash);
1516         }
1517         /* extract secret "early" */
1518         if (context->master_key && context->master_key_len && !handshake) {
1519                 DEBUG_DUMP_HEX_LABEL("USING PREVIOUS SECRET",
1520                                      context->master_key,
1521                                      context->master_key_len);
1522                 tls_hkdf_expand_label(mac_length, salt, mac_length,
1523                                 context->master_key, context->master_key_len,
1524                                 "derived", 7, hash, mac_length);
1525                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1526                 tls_hkdf_extract(mac_length, prk, mac_length, salt, mac_length,
1527                                 earlysecret, mac_length);
1528         } else {
1529                 tls_hkdf_extract(mac_length, prk, mac_length, NULL, 0,
1530                                 earlysecret, mac_length);
1531                 /* derive secret for handshake "tls13 derived": */
1532                 DEBUG_DUMP_HEX_LABEL("null hash", hash, mac_length);
1533                 tls_hkdf_expand_label(mac_length, salt, mac_length, prk,
1534                                 mac_length, "derived", 7, hash, mac_length);
1535                 /* extract secret "handshake": */
1536                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1537                 tls_hkdf_extract(mac_length, prk, mac_length,
1538                                           salt, mac_length,
1539                                           context->premaster_key,
1540                                           context->premaster_key_len);
1541         }
1542
1543         if (!is_aead) {
1544                 DEBUG_PRINT("KEY EXPANSION FAILED, NON AEAD CIPHER\n");
1545                 return 0;
1546         }
1547
1548         unsigned char secret[TLS_MAX_MAC_SIZE];
1549         unsigned char hs_secret[TLS_MAX_HASH_SIZE];
1550
1551         int hash_size;
1552         if (handshake) {
1553                 hash_size = tls_get_hash(context, hash);
1554         } else {
1555                 hash_size = tls_done_hash(context, hash);
1556         }
1557
1558         DEBUG_DUMP_HEX_LABEL("messages hash", hash, hash_size);
1559
1560         if (context->is_server) {
1561                 tls_hkdf_expand_label(mac_length, hs_secret, mac_length, prk,
1562                                 mac_length, server_key, 12, context->
1563                                 server_finished_hash ?  context->
1564                                 server_finished_hash : hash, hash_size);
1565                 DEBUG_DUMP_HEX_LABEL(server_key, hs_secret, mac_length);
1566                 serverkey = local_keybuffer;
1567                 serveriv = local_ivbuffer;
1568                 clientkey = remote_keybuffer;
1569                 clientiv = remote_ivbuffer;
1570         } else {
1571                 tls_hkdf_expand_label(mac_length, hs_secret,
1572                                                mac_length, prk, mac_length,
1573                                                client_key, 12,
1574                                                context->
1575                                                server_finished_hash ?
1576                                                context->
1577                                                server_finished_hash : hash,
1578                                                hash_size);
1579                 serverkey = remote_keybuffer;
1580                 serveriv = remote_ivbuffer;
1581                 clientkey = local_keybuffer;
1582                 clientiv = local_ivbuffer;
1583         }
1584
1585         int iv_length = TLS_13_AES_GCM_IV_LENGTH;
1586         if (is_aead == 2) {
1587                 iv_length = TLS_CHACHA20_IV_LENGTH;
1588         }
1589
1590         tls_hkdf_expand_label(mac_length, local_keybuffer, key_length,
1591                         hs_secret, mac_length, "key", 3, NULL, 0);
1592         tls_hkdf_expand_label(mac_length, local_ivbuffer, iv_length, hs_secret,
1593                         mac_length, "iv", 2, NULL, 0);
1594
1595         tls_hkdf_expand_label(mac_length, secret,
1596                         mac_length, prk, mac_length,
1597                         context->is_server ? client_key : server_key,
1598                         12,
1599                         context->server_finished_hash ?
1600                         context->server_finished_hash :
1601                         hash,
1602                         hash_size);
1603
1604         tls_hkdf_expand_label(mac_length, remote_keybuffer, key_length, secret,
1605                         mac_length, "key", 3, NULL, 0);
1606         tls_hkdf_expand_label(mac_length, remote_ivbuffer, iv_length, secret,
1607                         mac_length, "iv", 2, NULL, 0);
1608
1609         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1610         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1611         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1612         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1613         free(context->finished_key);
1614         free(context->remote_finished_key);
1615
1616         if (handshake) {
1617                 context->finished_key = malloc(mac_length);
1618                 context->remote_finished_key = malloc(mac_length);
1619
1620                 if (context->finished_key) {
1621                         tls_hkdf_expand_label(mac_length,
1622                                         context->finished_key, mac_length,
1623                                         hs_secret, mac_length, "finished", 8,
1624                                         NULL, 0);
1625                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1626                                         mac_length);
1627                 }
1628
1629                 if (context->remote_finished_key) {
1630                         tls_hkdf_expand_label(mac_length,
1631                                         context->remote_finished_key,
1632                                         mac_length, secret, mac_length,
1633                                         "finished", 8, NULL, 0);
1634                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1635                                         mac_length);
1636                 }
1637         } else {
1638                 context->finished_key = NULL;
1639                 context->remote_finished_key = NULL;
1640                 free(context->server_finished_hash);
1641                 context->server_finished_hash = NULL;
1642         }
1643
1644         if (context->is_server) {
1645                 if (is_aead == 2) {
1646                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1647                                         clientiv, iv_length);
1648                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1649                                         serveriv, iv_length);
1650                 } else if (is_aead) {
1651                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1652                                         clientiv, iv_length);
1653                         memcpy(context->crypto.ctx_local_mac.local_iv,
1654                                         serveriv, iv_length);
1655                 }
1656                 if (tls_crypto_create(context, key_length,
1657                                         serverkey, serveriv, clientkey,
1658                                         clientiv)) {
1659                         return 0;
1660                 }
1661         } else {
1662                 if (is_aead == 2) {
1663                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1664                                clientiv, iv_length);
1665                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1666                                serveriv, iv_length);
1667                 } else if (is_aead) {
1668                         memcpy(context->crypto.ctx_local_mac.local_iv,
1669                                         clientiv, iv_length);
1670                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1671                                         serveriv, iv_length);
1672                 }
1673
1674                 if (tls_crypto_create(context, key_length,
1675                                         clientkey, clientiv, serverkey,
1676                                         serveriv)) {
1677                         return 0;
1678                 }
1679         }
1680
1681         context->crypto.created = 1 + is_aead;
1682
1683         free(context->master_key);
1684         context->master_key = malloc(mac_length);
1685         if (context->master_key) {
1686                 memcpy(context->master_key, prk, mac_length);
1687                 context->master_key_len = mac_length;
1688         }
1689         context->local_sequence_number = 0;
1690         context->remote_sequence_number = 0;
1691
1692         /*
1693          * extract client_mac_key(mac_key_length)
1694          * extract server_mac_key(mac_key_length)
1695          * extract client_key(enc_key_length)
1696          * extract server_key(enc_key_length)
1697          * extract client_iv(fixed_iv_lengh)
1698          * extract server_iv(fixed_iv_length)
1699          */
1700         return 1;
1701 }
1702
1703 static int tls_expand_key(struct TLSContext *context) {
1704         unsigned char key[TLS_MAX_KEY_EXPANSION_SIZE];
1705         if (context->tlsver == TLS_VERSION13) {
1706                 return 0;
1707         }
1708
1709         if (!context->master_key || !context->master_key_len) {
1710                 return 0;
1711         }
1712
1713         int key_length = tls_key_length(context);
1714         int mac_length = tls_mac_length(context);
1715
1716         if (!key_length || !mac_length) {
1717                 DEBUG_PRINT
1718                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1719                      key_length, mac_length);
1720                 return 0;
1721         }
1722         unsigned char *clientkey = NULL;
1723         unsigned char *serverkey = NULL;
1724         unsigned char *clientiv = NULL;
1725         unsigned char *serveriv = NULL;
1726         int iv_length = TLS_AES_IV_LENGTH;
1727         int is_aead = tls_is_aead(context);
1728
1729         if (context->is_server) {
1730                 tls_prf(context, key, sizeof(key),
1731                                  context->master_key, context->master_key_len,
1732                                  (unsigned char *) "key expansion", 13,
1733                                  context->local_random, TLS_SERVER_RANDOM_SIZE,
1734                                  context->remote_random,
1735                                  TLS_CLIENT_RANDOM_SIZE);
1736         } else {
1737                 tls_prf(context, key, sizeof(key),
1738                                  context->master_key,
1739                                  context->master_key_len,
1740                                  (unsigned char *) "key expansion", 13,
1741                                  context->remote_random,
1742                                  TLS_SERVER_RANDOM_SIZE,
1743                                  context->local_random,
1744                                  TLS_CLIENT_RANDOM_SIZE);
1745         }
1746
1747         DEBUG_DUMP_HEX_LABEL("LOCAL RANDOM ", context->local_random,
1748                              TLS_SERVER_RANDOM_SIZE);
1749         DEBUG_DUMP_HEX_LABEL("REMOTE RANDOM", context->remote_random,
1750                              TLS_CLIENT_RANDOM_SIZE);
1751         DEBUG_PRINT("\n=========== EXPANSION ===========\n");
1752         DEBUG_DUMP_HEX(key, TLS_MAX_KEY_EXPANSION_SIZE);
1753         DEBUG_PRINT("\n");
1754
1755         int pos = 0;
1756         if (is_aead == 2) {
1757                 iv_length = TLS_CHACHA20_IV_LENGTH;
1758         } else {
1759                 if (is_aead) {
1760                         iv_length = TLS_AES_GCM_IV_LENGTH;
1761                 } else {
1762                         if (context->is_server) {
1763                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1764                                                 &key[pos], mac_length);
1765                                 pos += mac_length;
1766                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1767                                                 &key[pos], mac_length);
1768                                 pos += mac_length;
1769                         } else {
1770                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1771                                                 &key[pos], mac_length);
1772                                 pos += mac_length;
1773                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1774                                                 &key[pos], mac_length);
1775                                 pos += mac_length;
1776                         }
1777                 }
1778         }
1779
1780         clientkey = &key[pos];
1781         pos += key_length;
1782         serverkey = &key[pos];
1783         pos += key_length;
1784         clientiv = &key[pos];
1785         pos += iv_length;
1786         serveriv = &key[pos];
1787         pos += iv_length;
1788         DEBUG_PRINT("EXPANSION %i/%i\n", (int) pos,
1789                         (int) TLS_MAX_KEY_EXPANSION_SIZE);
1790         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1791         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1792 #if 0
1793         DEBUG_DUMP_HEX_LABEL("CLIENT MAC KEY",
1794                         context->is_server ? context->crypto.
1795                         ctx_remote_mac.remote_mac : context->
1796                         crypto.ctx_local_mac.local_mac,
1797                         mac_length);
1798 #endif
1799         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1800         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1801 #if 0
1802         DEBUG_DUMP_HEX_LABEL("SERVER MAC KEY",
1803                         context->is_server ? context->crypto.
1804                         ctx_local_mac.local_mac : context->crypto.
1805                         ctx_remote_mac.remote_mac, mac_length);
1806 #endif
1807         if (context->is_server) {
1808                 if (is_aead == 2) {
1809                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1810                                         clientiv, iv_length);
1811                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1812                                         serveriv, iv_length);
1813                 } else {
1814                         if (is_aead) {
1815                                 memcpy(context->crypto.ctx_remote_mac.
1816                                                 remote_aead_iv, clientiv, iv_length);
1817                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1818                                                 serveriv, iv_length);
1819                         }
1820                 }
1821
1822                 if (tls_crypto_create(context, key_length,
1823                                         serverkey, serveriv, clientkey,
1824                                         clientiv)) {
1825                         return 0;
1826                 }
1827         } else {
1828                 if (is_aead == 2) {
1829                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1830                                         clientiv, iv_length);
1831                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1832                                         serveriv, iv_length);
1833                 } else {
1834                         if (is_aead) {
1835                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1836                                                 clientiv, iv_length);
1837                                 memcpy(context->crypto.ctx_remote_mac.
1838                                                 remote_aead_iv, serveriv, iv_length);
1839                         }
1840                 }
1841
1842                 if (tls_crypto_create(context, key_length,
1843                                         clientkey, clientiv, serverkey,
1844                                         serveriv)) {
1845                         return 0;
1846                 }
1847         }
1848
1849         /*
1850          * extract client_mac_key(mac_key_length)
1851          * extract server_mac_key(mac_key_length)
1852          * extract client_key(enc_key_length)
1853          * extract server_key(enc_key_length)
1854          * extract client_iv(fixed_iv_lengh)
1855          * extract server_iv(fixed_iv_length)
1856          */
1857         return 1;
1858 }
1859
1860 int tls_compute_key(struct TLSContext *context, unsigned int key_len) {
1861         if (context->tlsver == TLS_VERSION13) {
1862                 return 0;
1863         }
1864
1865         if (!context->premaster_key || !context->premaster_key_len
1866             || key_len < 48) {
1867                 DEBUG_PRINT("CANNOT COMPUTE MASTER SECRET\n");
1868                 return 0;
1869         }
1870
1871         unsigned char master_secret_label[] = "master secret";
1872 #ifdef TLS_CHECK_PREMASTER_KEY
1873         if (!tls_cipher_is_ephemeral(context)) {
1874                 uint16_t version = get16(context->premaster_key);
1875                 /* this check is not true for DHE/ECDHE ciphers */
1876                 if (context->version > version) {
1877                         DEBUG_PRINT("Mismatch protocol version 0x(%x)\n",
1878                                     version);
1879                         return 0;
1880                 }
1881         }
1882 #endif
1883         free(context->master_key);
1884         context->master_key_len = 0;
1885         context->master_key = NULL;
1886
1887         context->master_key = malloc(key_len);
1888         if (!context->master_key) {
1889                 return 0;
1890         }
1891
1892         context->master_key_len = key_len;
1893         if (context->is_server) {
1894                 tls_prf(context,
1895                                 context->master_key,
1896                                 context->master_key_len,
1897                                 context->premaster_key,
1898                                 context->premaster_key_len,
1899                                 master_secret_label, 13,
1900                                 context->remote_random,
1901                                 TLS_CLIENT_RANDOM_SIZE,
1902                                 context->local_random,
1903                                 TLS_SERVER_RANDOM_SIZE);
1904         } else {
1905                 tls_prf(context,
1906                                 context->master_key,
1907                                 context->master_key_len,
1908                                 context->premaster_key,
1909                                 context->premaster_key_len,
1910                                 master_secret_label, 13,
1911                                 context->local_random,
1912                                 TLS_CLIENT_RANDOM_SIZE,
1913                                 context->remote_random,
1914                                 TLS_SERVER_RANDOM_SIZE);
1915         }
1916         free(context->premaster_key);
1917         context->premaster_key = NULL;
1918         context->premaster_key_len = 0;
1919         DEBUG_PRINT("\n=========== Master key ===========\n");
1920         DEBUG_DUMP_HEX(context->master_key,
1921                         context->master_key_len);
1922         DEBUG_PRINT("\n");
1923         tls_expand_key(context);
1924         return 1;
1925 }
1926
1927 int _is_oid(const unsigned char *oid, const unsigned char *compare_to,
1928             int compare_to_len) {
1929         int i = 0;
1930         while ((oid[i]) && (i < compare_to_len)) {
1931                 if (oid[i] != compare_to[i])
1932                         return 0;
1933
1934                 i++;
1935         }
1936         return 1;
1937 }
1938
1939 int _is_oid2(const unsigned char *oid, const unsigned char *compare_to,
1940              int compare_to_len, int oid_len) {
1941         int i = 0;
1942         if (oid_len < compare_to_len) {
1943                 compare_to_len = oid_len;
1944         }
1945
1946         while (i < compare_to_len) {
1947                 if (oid[i] != compare_to[i]) {
1948                         return 0;
1949                 }
1950
1951                 i++;
1952         }
1953         return 1;
1954 }
1955
1956 struct TLSCertificate *tls_create_certificate() {
1957         struct TLSCertificate zero = { 0 };
1958         struct TLSCertificate *cert = malloc(sizeof *cert);
1959         if (cert) {
1960                 *cert = zero;
1961         }
1962         cert->not_before[0] = 0;
1963         cert->not_after[0] = 0;
1964
1965         return cert;
1966 }
1967
1968 int tls_certificate_valid_subject_name(const unsigned char *cert_subject,
1969                                        const char *subject) {
1970         /* no subjects ... */
1971         if ((!cert_subject || !cert_subject[0]) && (!subject || !subject[0])) {
1972                 return 0;
1973         }
1974
1975         if (!subject || !subject[0]) {
1976                 return bad_certificate;
1977         }
1978
1979         if (!cert_subject || !cert_subject[0]) {
1980                 return bad_certificate;
1981         }
1982
1983         /* exact match */
1984         if (!strcmp((const char *) cert_subject, subject)) {
1985                 return 0;
1986         }
1987
1988         const char *wildcard = strchr((const char *) cert_subject, '*');
1989         if (wildcard) {
1990                 /* 6.4.3 (1) The client SHOULD NOT attempt to match a presented
1991                  * identifier in which the wildcard character comprises a label
1992                  * other than the left-most label
1993                  */
1994                 if (!wildcard[1]) {
1995                         /* subject is [*]
1996                          * or
1997                          * subject is [something*] .. invalid
1998                          */
1999                         return bad_certificate;
2000                 }
2001                 wildcard++;
2002                 const char *match = strstr(subject, wildcard);
2003                 if ((!match) && (wildcard[0] == '.')) {
2004                         /* check *.domain.com against domain.com */
2005                         wildcard++;
2006                         if (!strcasecmp(subject, wildcard))
2007                                 return 0;
2008                 }
2009                 if (match) {
2010                         unsigned long offset = (unsigned long) match -
2011                                 (unsigned long) subject;
2012                         if (offset) {
2013                                 /* check for foo.*.domain.com against *.domain.com (invalid) */
2014                                 if (memchr(subject, '.', offset))
2015                                         return bad_certificate;
2016                         }
2017                         /* check if exact match */
2018                         if (!strcasecmp(match, wildcard)) {
2019                                 return 0;
2020                         }
2021                 }
2022         }
2023
2024         return bad_certificate;
2025 }
2026
2027 int tls_certificate_valid_subject(struct TLSCertificate *cert,
2028                                   const char *subject) {
2029         int i;
2030         if (!cert) {
2031                 return certificate_unknown;
2032         }
2033
2034         int err = tls_certificate_valid_subject_name(cert->subject, subject);
2035         if (err && cert->san) {
2036                 for (i = 0; i < cert->san_length; i++) {
2037                         err = tls_certificate_valid_subject_name(cert->san[i],
2038                                         subject);
2039                         if (!err) {
2040                                 return err;
2041                         }
2042                 }
2043         }
2044         return err;
2045 }
2046
2047 int tls_certificate_is_valid(struct TLSCertificate *cert) {
2048         if (!cert) {
2049                 return certificate_unknown;
2050         }
2051
2052         char ts[16]; /* YYYYMMDDHHMMSSZ */
2053         time_t t = time(NULL);
2054         struct tm *utc = gmtime(&t);
2055
2056         if (utc) {
2057                 strftime(ts, sizeof ts, "%Y%m%d%H%M%SZ", utc);
2058
2059                 if (strcmp(cert->not_before, ts) > 0) {
2060                         DEBUG_PRINT
2061                             ("Certificate is not yet valid, now: %s (validity: %s - %s)\n",
2062                              ts, cert->not_before, cert->not_after);
2063                         return certificate_expired;
2064                 }
2065
2066                 if (strcmp(cert->not_after, ts) < 0) {
2067                         DEBUG_PRINT
2068                             ("Expired certificate, now: %s (validity: %s - %s)\n",
2069                              ts, cert->not_before, cert->not_after);
2070                         return certificate_expired;
2071                 }
2072                 DEBUG_PRINT("Valid certificate, now: %s (validity: %s - %s)\n",
2073                                 ts, cert->not_before,
2074                                 cert->not_after);
2075         }
2076         return 0;
2077 }
2078
2079 void tls_certificate_set_copy(unsigned char **member,
2080                               const unsigned char *val, int len) {
2081         if (!member) {
2082                 return;
2083         }
2084
2085         free(*member);
2086
2087         if (len) {
2088                 *member = malloc(len + 1);
2089                 if (*member) {
2090                         memcpy(*member, val, len);
2091                         (*member)[len] = 0;
2092                 }
2093         } else {
2094                 *member = NULL;
2095         }
2096 }
2097
2098 void tls_certificate_set_copy_date(unsigned char *member,
2099                                    const unsigned char *val, int len) {
2100
2101         if (len > 4) {
2102                 if (val[0] >= '5') {
2103                         member[0] = '1';
2104                         member[1] = '9';
2105                 } else {
2106                         member[0] = '2';
2107                         member[1] = '0';
2108                 }
2109                 memcpy(member + 2, val, len);
2110                 member[len] = 0;
2111         } else {
2112                 member[0] = 0;
2113         }
2114 }
2115
2116 void tls_certificate_set_key(struct TLSCertificate *cert,
2117                              const unsigned char *val, int len) {
2118         if (!val[0] && len % 2) {
2119                 val++;
2120                 len--;
2121         }
2122         tls_certificate_set_copy(&cert->pk, val, len);
2123         if (cert->pk) {
2124                 cert->pk_len = len;
2125         }
2126 }
2127
2128 void tls_certificate_set_priv(struct TLSCertificate *cert,
2129                               const unsigned char *val, int len) {
2130         tls_certificate_set_copy(&cert->priv, val, len);
2131         if (cert->priv) {
2132                 cert->priv_len = len;
2133         }
2134 }
2135
2136 void tls_certificate_set_sign_key(struct TLSCertificate *cert,
2137                                   const unsigned char *val, int len) {
2138         if (!val[0] && len % 2) {
2139                 val++;
2140                 len--;
2141         }
2142         tls_certificate_set_copy(&cert->sign_key, val, len);
2143         if (cert->sign_key) {
2144                 cert->sign_len = len;
2145         }
2146 }
2147
2148 void tls_certificate_set_exponent(struct TLSCertificate *cert,
2149                                   const unsigned char *val, int len) {
2150         tls_certificate_set_copy(&cert->exponent, val, len);
2151         if (cert->exponent) {
2152                 cert->exponent_len = len;
2153         }
2154 }
2155
2156 void tls_certificate_set_serial(struct TLSCertificate *cert,
2157                                 const unsigned char *val, int len) {
2158         tls_certificate_set_copy(&cert->serial_number, val, len);
2159         if (cert->serial_number) {
2160                 cert->serial_len = len;
2161         }
2162 }
2163
2164 void tls_certificate_set_algorithm(unsigned int *algorithm,
2165                                    const unsigned char *val, int len) {
2166         if (len == 7 && _is_oid(val, TLS_EC_PUBLIC_KEY_OID, 7)) {
2167                 *algorithm = TLS_EC_PUBLIC_KEY;
2168                 return;
2169         }
2170
2171         if (len == 8) {
2172                 if (_is_oid(val, TLS_EC_prime192v1_OID, len)) {
2173                         *algorithm = TLS_EC_prime192v1;
2174                         return;
2175                 }
2176                 if (_is_oid(val, TLS_EC_prime192v2_OID, len)) {
2177                         *algorithm = TLS_EC_prime192v2;
2178                         return;
2179                 }
2180                 if (_is_oid(val, TLS_EC_prime192v3_OID, len)) {
2181                         *algorithm = TLS_EC_prime192v3;
2182                         return;
2183                 }
2184                 if (_is_oid(val, TLS_EC_prime239v1_OID, len)) {
2185                         *algorithm = TLS_EC_prime239v1;
2186                         return;
2187                 }
2188                 if (_is_oid(val, TLS_EC_prime239v2_OID, len)) {
2189                         *algorithm = TLS_EC_prime239v2;
2190                         return;
2191                 }
2192                 if (_is_oid(val, TLS_EC_prime239v3_OID, len)) {
2193                         *algorithm = TLS_EC_prime239v3;
2194                         return;
2195                 }
2196                 if (_is_oid(val, TLS_EC_prime256v1_OID, len)) {
2197                         *algorithm = TLS_EC_prime256v1;
2198                         return;
2199                 }
2200         }
2201         if (len == 5) {
2202                 if (_is_oid2
2203                     (val, TLS_EC_secp224r1_OID, len,
2204                      sizeof(TLS_EC_secp224r1_OID) - 1)) {
2205                         *algorithm = TLS_EC_secp224r1;
2206                         return;
2207                 }
2208                 if (_is_oid2
2209                     (val, TLS_EC_secp384r1_OID, len,
2210                      sizeof(TLS_EC_secp384r1_OID) - 1)) {
2211                         *algorithm = TLS_EC_secp384r1;
2212                         return;
2213                 }
2214                 if (_is_oid2
2215                     (val, TLS_EC_secp521r1_OID, len,
2216                      sizeof(TLS_EC_secp521r1_OID) - 1)) {
2217                         *algorithm = TLS_EC_secp521r1;
2218                         return;
2219                 }
2220         }
2221         if (len != 9) {
2222                 return;
2223         }
2224
2225         if (_is_oid(val, TLS_RSA_SIGN_SHA256_OID, 9)) {
2226                 *algorithm = TLS_RSA_SIGN_SHA256;
2227                 return;
2228         }
2229
2230         if (_is_oid(val, TLS_RSA_SIGN_RSA_OID, 9)) {
2231                 *algorithm = TLS_RSA_SIGN_RSA;
2232                 return;
2233         }
2234
2235         if (_is_oid(val, TLS_RSA_SIGN_SHA1_OID, 9)) {
2236                 *algorithm = TLS_RSA_SIGN_SHA1;
2237                 return;
2238         }
2239
2240         if (_is_oid(val, TLS_RSA_SIGN_SHA512_OID, 9)) {
2241                 *algorithm = TLS_RSA_SIGN_SHA512;
2242                 return;
2243         }
2244
2245         if (_is_oid(val, TLS_RSA_SIGN_SHA384_OID, 9)) {
2246                 *algorithm = TLS_RSA_SIGN_SHA384;
2247                 return;
2248         }
2249
2250         if (_is_oid(val, TLS_RSA_SIGN_MD5_OID, 9)) {
2251                 *algorithm = TLS_RSA_SIGN_MD5;
2252                 return;
2253         }
2254 }
2255
2256 void tls_destroy_certificate(struct TLSCertificate *cert) {
2257         if (cert) {
2258                 int i;
2259                 free(cert->exponent);
2260                 free(cert->pk);
2261                 free(cert->issuer_country);
2262                 free(cert->issuer_state);
2263                 free(cert->issuer_location);
2264                 free(cert->issuer_entity);
2265                 free(cert->issuer_subject);
2266                 free(cert->country);
2267                 free(cert->state);
2268                 free(cert->location);
2269                 free(cert->subject);
2270                 for (i = 0; i < cert->san_length; i++) {
2271                         free(cert->san[i]);
2272                 }
2273                 free(cert->san);
2274                 free(cert->ocsp);
2275                 free(cert->serial_number);
2276                 free(cert->entity);
2277                 cert->not_before[0] = 0;
2278                 cert->not_after[0] = 0;
2279                 free(cert->sign_key);
2280                 free(cert->priv);
2281                 free(cert->der_bytes);
2282                 free(cert->bytes);
2283                 free(cert->fingerprint);
2284                 free(cert);
2285         }
2286 }
2287
2288 struct TLSPacket *tls_create_packet(struct TLSContext *context,
2289                                     unsigned char type,
2290                                     unsigned short version,
2291                                     int payload_size_hint) {
2292         struct TLSPacket *packet = malloc(sizeof *packet);
2293         if (!packet) {
2294                 return NULL;
2295         }
2296         packet->broken = 0;
2297         if (payload_size_hint > 0) {
2298                 packet->size = payload_size_hint + 10;
2299         } else {
2300                 packet->size = TLS_BLOB_INCREMENT;
2301         }
2302         packet->buf = malloc(packet->size);
2303         memset(packet->buf, 0, packet->size);
2304         packet->context = context;
2305         if (!packet->buf) {
2306                 free(packet);
2307                 return NULL;
2308         }
2309         if (context) {
2310                 packet->payload_pos = 6;
2311                 packet->len = packet->payload_pos - 1;
2312         } else {
2313                 packet->len = 5;
2314         }
2315         packet->buf[0] = type;
2316
2317         /* big endian protocol version */
2318         packet->buf[1] = version >> 8;
2319         packet->buf[2] = version & 0xff;
2320         if (version == TLS_V13) {
2321                 packet->buf[2] = 0x04;
2322         }
2323
2324         return packet;
2325 }
2326
2327 void tls_destroy_packet(struct TLSPacket *packet) {
2328         if (packet) {
2329                 if (packet->buf) {
2330                         free(packet->buf);
2331                 }
2332                 free(packet);
2333         }
2334 }
2335
2336 int tls_crypto_create(struct TLSContext *context, int key_length,
2337                                unsigned char *localkey,
2338                                unsigned char *localiv,
2339                                unsigned char *remotekey,
2340                                unsigned char *remoteiv) {
2341         if (context->crypto.created) {
2342                 if (context->crypto.created == 1) {
2343                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2344                         cbc_done(&context->crypto.ctx_local.aes_local);
2345                 } else {
2346                         if (context->crypto.created == 2) {
2347                                 unsigned char dummy_buffer[32];
2348                                 unsigned long tag_len = 0;
2349                                 gcm_done(&context->crypto.ctx_remote.
2350                                          aes_gcm_remote, dummy_buffer,
2351                                          &tag_len);
2352                                 gcm_done(&context->crypto.ctx_local.
2353                                          aes_gcm_local, dummy_buffer,
2354                                          &tag_len);
2355                         }
2356                 }
2357                 context->crypto.created = 0;
2358         }
2359         int is_aead = tls_is_aead(context);
2360         int cipherID = find_cipher("aes");
2361         DEBUG_PRINT("Using cipher ID: %x\n", (int) context->cipher);
2362         if (is_aead == 2) {
2363                 unsigned int counter = 1;
2364
2365                 chacha_keysetup(&context->crypto.ctx_local.chacha_local,
2366                                 localkey, key_length * 8);
2367                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_local.
2368                                           chacha_local, localiv,
2369                                           (unsigned char *) &counter);
2370
2371                 chacha_keysetup(&context->crypto.ctx_remote.chacha_remote,
2372                                 remotekey, key_length * 8);
2373                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_remote.
2374                                           chacha_remote, remoteiv,
2375                                           (unsigned char *) &counter);
2376
2377                 context->crypto.created = 3;
2378         } else {
2379                 if (is_aead) {
2380                         int res1 =
2381                                 gcm_init(&context->crypto.ctx_local.aes_gcm_local,
2382                                                 cipherID, localkey, key_length);
2383                         int res2 =
2384                                 gcm_init(&context->crypto.ctx_remote.aes_gcm_remote,
2385                                                 cipherID, remotekey, key_length);
2386
2387                         if (res1 || res2) {
2388                                 return TLS_GENERIC_ERROR;
2389                         }
2390                         context->crypto.created = 2;
2391                 } else {
2392                         int res1 =
2393                                 cbc_start(cipherID, localiv, localkey, key_length, 0,
2394                                                 &context->crypto.ctx_local.aes_local);
2395                         int res2 =
2396                                 cbc_start(cipherID, remoteiv, remotekey, key_length, 0,
2397                                                 &context->crypto.ctx_remote.aes_remote);
2398
2399                         if (res1 || res2) {
2400                                 return TLS_GENERIC_ERROR;
2401                         }
2402                         context->crypto.created = 1;
2403                 }
2404         }
2405         return 0;
2406 }
2407
2408 static void tls_crypto_done(struct TLSContext *context) {
2409         unsigned char dummy_buffer[32];
2410         unsigned long tag_len = 0;
2411
2412         switch (context->crypto.created) {
2413                 case 1:
2414                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2415                         cbc_done(&context->crypto.ctx_local.aes_local);
2416                         break;
2417                 case 2:
2418                         gcm_done(&context->crypto.ctx_remote.aes_gcm_remote,
2419                                         dummy_buffer, &tag_len);
2420                         gcm_done(&context->crypto.ctx_local.aes_gcm_local,
2421                                         dummy_buffer, &tag_len);
2422                         break;
2423         }
2424         context->crypto.created = 0;
2425 }
2426
2427 int tls_packet_append(struct TLSPacket *packet, const unsigned char *buf,
2428                       unsigned int len) {
2429         void *new;
2430
2431         if (!packet || packet->broken) {
2432                 return -1;
2433         }
2434
2435         if (!len) {
2436                 return 0;
2437         }
2438
2439         unsigned int new_len = packet->len + len;
2440
2441         if (new_len > packet->size) {
2442                 packet->size = (new_len / TLS_BLOB_INCREMENT + 1) *
2443                         TLS_BLOB_INCREMENT;
2444                 new = TLS_REALLOC(packet->buf, packet->size);
2445                 if (new) {
2446                         packet->buf = new;
2447                 } else {
2448                         free(packet->buf);
2449                         packet->size = 0;
2450                         packet->len = 0;
2451                         packet->broken = 1;
2452                         return -1;
2453                 }
2454         }
2455         memcpy(packet->buf + packet->len, buf, len);
2456         packet->len = new_len;
2457         return new_len;
2458 }
2459
2460 int tls_packet_uint8(struct TLSPacket *packet, unsigned char i) {
2461         return tls_packet_append(packet, &i, 1);
2462 }
2463
2464 int tls_packet_uint16(struct TLSPacket *packet, unsigned short i) {
2465         unsigned short ni = htons(i);
2466         return tls_packet_append(packet, (unsigned char *) &ni, 2);
2467 }
2468
2469 int tls_packet_uint32(struct TLSPacket *packet, unsigned int i) {
2470         unsigned int ni = htonl(i);
2471         return tls_packet_append(packet, (unsigned char *) &ni, 4);
2472 }
2473
2474 int tls_packet_uint24(struct TLSPacket *packet, unsigned int i) {
2475         unsigned char buf[3];
2476         buf[0] = (i >> 16) & 0xff;
2477         buf[1] = (i >> 8) & 0xff;
2478         buf[2] = (i >> 0) & 0xff;
2479
2480         return tls_packet_append(packet, buf, 3);
2481 }
2482
2483 int tls_random(unsigned char *key, int len) {
2484 #ifdef __APPLE__
2485         for (int i = 0; i < len; i++) {
2486                 unsigned int v = arc4random() % 0x100;
2487                 key[i] = (char) v;
2488         }
2489         return 1;
2490 #else
2491         /* TODO use open and read */
2492         FILE *fp = fopen("/dev/urandom", "r");
2493         if (fp) {
2494                 int key_len = fread(key, 1, len, fp);
2495                 fclose(fp);
2496                 if (key_len == len)
2497                         return 1;
2498         }
2499 #endif
2500         return 0;
2501 }
2502
2503 int tls_established(struct TLSContext *context) {
2504         return context && context->connection_status == TLS_CONNECTED;
2505 }
2506
2507 void tls_read_clear(struct TLSContext *context) {
2508         if (context) {
2509                tls_buffer_free(&context->application_buffer);
2510         }
2511 }
2512
2513 struct TLSContext *tls_create_context(int is_server, unsigned short version) {
2514         struct TLSContext zero = {0};
2515         uint16_t ver = 0;
2516         struct TLSContext *context = 0;
2517
2518         if (version == TLS_V13 && !is_server) {
2519                 /* TLS 1.3 clients not supported */
2520                 return NULL;
2521         }
2522
2523         tls_init();
2524         switch (version) {
2525                 case TLS_V13:
2526                 case TLS_V12:
2527                         context = malloc(sizeof *context);
2528                         break;
2529                 default:
2530                         return NULL;
2531         }
2532
2533         ver = version - 0x0201;
2534
2535         if (context) {
2536                 *context = zero;
2537                 context->is_server = is_server;
2538                 context->version = version;
2539                 context->tlsver = ver;
2540                 context->hs_index = -1;
2541                 /* set up output buffer */
2542                 tls_buffer_init(&context->output_buffer, 0);
2543                 tls_buffer_init(&context->input_buffer, 0);
2544                 tls_buffer_init(&context->cached_handshake, 0);
2545                 tls_buffer_init(&context->application_buffer, 0);
2546         }
2547         return context;
2548 }
2549
2550 struct TLSContext *tls_accept(struct TLSContext *context) {
2551         if (!context || !context->is_server) {
2552                 return NULL;
2553         }
2554
2555         struct TLSContext *child = malloc(sizeof *child);
2556         if (child) {
2557                 memset(child, 0, sizeof(struct TLSContext));
2558                 child->is_server = 1;
2559                 child->is_child = 1;
2560                 child->version = context->version;
2561                 child->certificates = context->certificates;
2562                 child->certificates_count = context->certificates_count;
2563                 child->private_key = context->private_key;
2564                 child->ec_private_key = context->ec_private_key;
2565                 child->root_certificates = context->root_certificates;
2566                 child->root_count = context->root_count;
2567                 child->default_dhe_p = context->default_dhe_p;
2568                 child->default_dhe_g = context->default_dhe_g;
2569                 child->curve = context->curve;
2570                 child->alpn = context->alpn;
2571                 child->alpn_count = context->alpn_count;
2572         }
2573         return child;
2574 }
2575
2576 int tls_add_alpn(struct TLSContext *context, const char *alpn) {
2577         void *new;
2578
2579         if (!context || !alpn || !alpn[0]
2580             || (context->is_server && context->is_child)) {
2581                 return TLS_GENERIC_ERROR;
2582         }
2583
2584         int len = strlen(alpn);
2585         if (tls_alpn_contains(context, alpn, len)) {
2586                 return 0;
2587         }
2588
2589         new = TLS_REALLOC(context->alpn, (context->alpn_count + 1) *
2590                         sizeof(char *));
2591         if (new) {
2592                 context->alpn = new;
2593         } else {
2594                 free(context->alpn);
2595                 context->alpn = 0;
2596                 context->alpn_count = 0;
2597                 return TLS_NO_MEMORY;
2598         }
2599         char *alpn_ref = malloc(len + 1);
2600         context->alpn[context->alpn_count] = alpn_ref;
2601         if (alpn_ref) {
2602                 memcpy(alpn_ref, alpn, len);
2603                 alpn_ref[len] = 0;
2604                 context->alpn_count++;
2605         } else {
2606                 return TLS_NO_MEMORY;
2607         }
2608         return 0;
2609 }
2610
2611 int tls_alpn_contains(struct TLSContext *context, const char *alpn,
2612                       unsigned char alpn_size) {
2613         int i;
2614
2615         if (!context || !alpn || !alpn_size || !context->alpn) {
2616                 return 0;
2617         }
2618
2619         for (i = 0; i < context->alpn_count; i++) {
2620                 const char *alpn_local = context->alpn[i];
2621                 if (alpn_local) {
2622                         int len = strlen(alpn_local);
2623                         if (alpn_size == len) {
2624                                 if (!memcmp(alpn_local, alpn, alpn_size)) {
2625                                         return 1;
2626                                 }
2627                         }
2628                 }
2629         }
2630
2631         return 0;
2632 }
2633
2634 void tls_destroy_context(struct TLSContext *context) {
2635         int i;
2636
2637         if (!context) {
2638                 return;
2639         }
2640
2641         if (!context->is_child) {
2642                 if (context->certificates) {
2643                         for (i = 0; i < context->certificates_count; i++) {
2644                                 tls_destroy_certificate(context->
2645                                                         certificates[i]);
2646                         }
2647                 }
2648                 if (context->root_certificates) {
2649                         for (i = 0; i < context->root_count; i++) {
2650                                 tls_destroy_certificate(context->
2651                                                         root_certificates[i]);
2652                         }
2653                         free(context->root_certificates);
2654                         context->root_certificates = NULL;
2655                 }
2656                 if (context->private_key) {
2657                         tls_destroy_certificate(context->private_key);
2658                 }
2659                 if (context->ec_private_key) {
2660                         tls_destroy_certificate(context->ec_private_key);
2661                 }
2662                 free(context->certificates);
2663                 free(context->default_dhe_p);
2664                 free(context->default_dhe_g);
2665                 if (context->alpn) {
2666                         for (i = 0; i < context->alpn_count; i++) {
2667                                 free(context->alpn[i]);
2668                         }
2669                         free(context->alpn);
2670                 }
2671         }
2672
2673         if (context->client_certificates) {
2674                 for (i = 0; i < context->client_certificates_count; i++) {
2675                         tls_destroy_certificate(context->
2676                                                 client_certificates[i]);
2677                 }
2678                 free(context->client_certificates);
2679         }
2680
2681         context->client_certificates = NULL;
2682         free(context->master_key);
2683         free(context->premaster_key);
2684
2685         if (context->crypto.created) {
2686                 tls_crypto_done(context);
2687         }
2688
2689         tls_done_hash(context, NULL);
2690         tls_destroy_hash(context);
2691
2692         tls_buffer_free(&context->output_buffer);
2693         tls_buffer_free(&context->input_buffer);
2694         tls_buffer_free(&context->application_buffer);
2695         tls_buffer_free(&context->cached_handshake);
2696         //free(context->cached_handshake);
2697
2698         free(context->sni);
2699         tls_dhe_free(context);
2700         tls_ecc_dhe_free(context);
2701         free(context->negotiated_alpn);
2702         free(context->finished_key);
2703         free(context->remote_finished_key);
2704         free(context->server_finished_hash);
2705         free(context);
2706 }
2707
2708 int tls_cipher_is_ephemeral(struct TLSContext *context) {
2709         if (!context) {
2710                 return 0;
2711         }
2712
2713         switch (context->cipher) {
2714                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2715                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2716                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2717                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
2718                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2719                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
2720                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2721                         return 1;
2722                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2723                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2724                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2725                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2726                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
2727                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2728                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2729                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2730                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2731                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2732                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2733                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2734                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2735                         return 2;
2736                 case TLS_AES_128_GCM_SHA256:
2737                 case TLS_CHACHA20_POLY1305_SHA256:
2738                 case TLS_AES_128_CCM_SHA256:
2739                 case TLS_AES_128_CCM_8_SHA256:
2740                 case TLS_AES_256_GCM_SHA384:
2741                         if (context->dhe) {
2742                                 return 1;
2743                         }
2744                         return 2;
2745         }
2746         return 0;
2747 }
2748
2749 int tls_is_ecdsa(struct TLSContext *context) {
2750         if (!context) {
2751                 return 0;
2752         }
2753
2754         switch (context->cipher) {
2755                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2756                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2757                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2758                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2759                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2760                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2761                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2762                         return 1;
2763         }
2764
2765         if (context->ec_private_key) {
2766                 return 1;
2767         }
2768
2769         return 0;
2770 }
2771
2772 static void tls_send_server_key_exchange(struct TLSContext *context,
2773                                                 int method) {
2774         if (!context->is_server) {
2775                 DEBUG_PRINT
2776                     ("CANNOT BUILD SERVER KEY EXCHANGE MESSAGE FOR CLIENTS\n");
2777                 return;
2778         }
2779
2780         struct TLSPacket *packet =
2781             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
2782         tls_packet_uint8(packet, 0x0C);
2783         unsigned char dummy[3];
2784         tls_packet_append(packet, dummy, 3);
2785         int start_len = packet->len;
2786
2787         if (method == KEA_dhe_rsa) {
2788                 tls_dhe_create(context);
2789
2790                 const char *default_dhe_p = context->default_dhe_p;
2791                 const char *default_dhe_g = context->default_dhe_g;
2792                 int key_size;
2793                 if (!default_dhe_p || !default_dhe_g) {
2794                         default_dhe_p = TLS_DH_DEFAULT_P;
2795                         default_dhe_g = TLS_DH_DEFAULT_G;
2796                         key_size = TLS_DHE_KEY_SIZE / 8;
2797                 } else {
2798                         key_size = strlen(default_dhe_p);
2799                 }
2800                 if (tls_dh_make_key(key_size, context->dhe, default_dhe_p,
2801                                         default_dhe_g, 0, 0)) {
2802                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
2803                         free(packet);
2804                         free(context->dhe);
2805                         context->dhe = NULL;
2806                         /* TODO set error */
2807                         return;
2808                 }
2809
2810                 unsigned char dh_Ys[0xFFF];
2811                 unsigned char dh_p[0xFFF];
2812                 unsigned char dh_g[0xFFF];
2813                 unsigned long dh_p_len = sizeof(dh_p);
2814                 unsigned long dh_g_len = sizeof(dh_g);
2815                 unsigned long dh_Ys_len = sizeof(dh_Ys);
2816
2817                 if (tls_dh_export_pqY
2818                     (dh_p, &dh_p_len, dh_g, &dh_g_len, dh_Ys, &dh_Ys_len,
2819                      context->dhe)) {
2820                         DEBUG_PRINT("ERROR EXPORTING DHE KEY\n");
2821                         free(packet);
2822                         /* TODO set error */
2823                         return;
2824                 }
2825
2826                 DEBUG_PRINT("LEN: %lu (%lu, %lu)\n", dh_Ys_len, dh_p_len,
2827                             dh_g_len);
2828                 DEBUG_DUMP_HEX_LABEL("DHE PK", dh_Ys, dh_Ys_len);
2829                 DEBUG_DUMP_HEX_LABEL("DHE P", dh_p, dh_p_len);
2830                 DEBUG_DUMP_HEX_LABEL("DHE G", dh_g, dh_g_len);
2831
2832                 tls_packet_uint16(packet, dh_p_len);
2833                 tls_packet_append(packet, dh_p, dh_p_len);
2834
2835                 tls_packet_uint16(packet, dh_g_len);
2836                 tls_packet_append(packet, dh_g, dh_g_len);
2837
2838                 tls_packet_uint16(packet, dh_Ys_len);
2839                 tls_packet_append(packet, dh_Ys, dh_Ys_len);
2840                 /* dh_p */
2841                 /* dh_g */
2842                 /* dh_Ys */
2843         } else if (method == KEA_ec_diffie_hellman) {
2844                 /* 3 = named curve */
2845                 if (!context->curve) {
2846                         context->curve = tls_ecc_default_curve;
2847                 }
2848                 tls_packet_uint8(packet, 3);
2849                 tls_packet_uint16(packet, context->curve->iana);
2850                 tls_ecc_dhe_create(context);
2851
2852                 ltc_ecc_set_type *dp =
2853                     (ltc_ecc_set_type *) & context->curve->dp;
2854
2855                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
2856                                         dp)) {
2857                         free(context->ecc_dhe);
2858                         context->ecc_dhe = NULL;
2859                         DEBUG_PRINT("Error generating ECC key\n");
2860                         free(packet);
2861                         /* TODO set error */
2862                         return;
2863                 }
2864                 unsigned char out[TLS_MAX_RSA_KEY];
2865                 unsigned long out_len = TLS_MAX_RSA_KEY;
2866                 if (ecc_ansi_x963_export(context->ecc_dhe, out, &out_len)) {
2867                         DEBUG_PRINT("Error exporting ECC key\n");
2868                         free(packet);
2869                         /* TODO abort */
2870                         return;
2871                 }
2872                 tls_packet_uint8(packet, out_len);
2873                 tls_packet_append(packet, out, out_len);
2874         } else {
2875                 /* TODO abort */
2876                 free(packet);
2877                 DEBUG_PRINT("Unsupported ephemeral method: %i\n", method);
2878                 return;
2879         }
2880
2881         /* signature */
2882         unsigned int params_len = packet->len - start_len;
2883         unsigned int message_len =
2884             params_len + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
2885         unsigned char *message = malloc(message_len);
2886         if (message) {
2887                 unsigned char out[TLS_MAX_RSA_KEY];
2888                 unsigned long out_len = TLS_MAX_RSA_KEY;
2889
2890                 int hash_algorithm;
2891
2892                 hash_algorithm = sha256;
2893
2894                 if (tls_is_ecdsa(context)) {
2895                         hash_algorithm = sha512;
2896                         tls_packet_uint8(packet, hash_algorithm);
2897                         tls_packet_uint8(packet, ecdsa);
2898                 } else {
2899                         tls_packet_uint8(packet, hash_algorithm);
2900                         tls_packet_uint8(packet, rsa_sign);
2901                 }
2902
2903                 memcpy(message, context->remote_random,
2904                                 TLS_CLIENT_RANDOM_SIZE);
2905                 memcpy(message + TLS_CLIENT_RANDOM_SIZE, context->local_random,
2906                                 TLS_SERVER_RANDOM_SIZE);
2907                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
2908                                 TLS_SERVER_RANDOM_SIZE, packet->buf +
2909                                 start_len, params_len);
2910                 if (tls_is_ecdsa(context)) {
2911                         if (sign_ecdsa(context, hash_algorithm, message,
2912                                                 message_len, out, &out_len) ==
2913                                         1) {
2914                                 DEBUG_PRINT
2915                                     ("Signing OK! (ECDSA, length %lu)\n",
2916                                      out_len);
2917                                 tls_packet_uint16(packet, out_len);
2918                                 tls_packet_append(packet, out, out_len);
2919                         }
2920                 } else
2921                 if (sign_rsa(context, hash_algorithm, message, message_len,
2922                                         out, &out_len) == 1) {
2923                         DEBUG_PRINT("Signing OK! (length %lu)\n", out_len);
2924                         tls_packet_uint16(packet, out_len);
2925                         tls_packet_append(packet, out, out_len);
2926                 }
2927                 free(message);
2928         }
2929         if (!packet->broken && packet->buf) {
2930                 tls_set_packet_length(packet, packet->len - start_len);
2931         }
2932         tls_packet_update(packet);
2933         tls_queue_packet(packet);
2934         return;
2935 }
2936
2937 #if 0
2938 void _private_tls_set_session_id(struct TLSContext *context) {
2939         if (context->tlsver == TLS_VERSION13
2940                         && context->session_size == TLS_MAX_SESSION_ID) {
2941                 return;
2942         }
2943
2944         if (tls_random(context->session, TLS_MAX_SESSION_ID)) {
2945                 context->session_size = TLS_MAX_SESSION_ID;
2946         } else {
2947                 context->session_size = 0;
2948         }
2949 }
2950 #endif
2951
2952 struct TLSPacket *tls_certificate_request(struct TLSContext *context) {
2953         if (!context || !context->is_server) {
2954                 return NULL;
2955         }
2956
2957         unsigned short packet_version = context->version;
2958         struct TLSPacket *packet =
2959             tls_create_packet(context, TLS_HANDSHAKE, packet_version, 0);
2960
2961         if (!packet) {
2962                 return NULL;
2963         }
2964
2965         /* cert request and size placeholder */
2966         unsigned char dummy[] = { 0x0d, 0, 0, 0 };
2967         tls_packet_append(packet, dummy, sizeof dummy);
2968
2969         int start_len = packet->len;
2970
2971         if (context->tlsver == TLS_VERSION13) {
2972                 /* certificate request context */
2973                 tls_packet_uint8(packet, 0);
2974                 /* extensions */
2975                 tls_packet_uint16(packet, 18);
2976                 /* signature algorithms */
2977                 tls_packet_uint16(packet, 0x0D);
2978                 tls_packet_uint16(packet, 14);
2979                 tls_packet_uint16(packet, 12);
2980 #if 0
2981                 rsa_pkcs1_sha256
2982                         tls_packet_uint16(packet, 0x0401);
2983                 rsa_pkcs1_sha384
2984                         tls_packet_uint16(packet, 0x0501);
2985                 rsa_pkcs1_sha512
2986                         tls_packet_uint16(packet, 0x0601);
2987 #endif
2988
2989                 /* ecdsa_secp256r1_sha256 */
2990                 tls_packet_uint16(packet, 0x0403);
2991                 /* ecdsa_secp384r1_sha384 */
2992                 tls_packet_uint16(packet, 0x0503);
2993                 /* ecdsa_secp521r1_sha512 */
2994                 tls_packet_uint16(packet, 0x0604);
2995                 /* rsa_pss_rsae_sha256 */
2996                 tls_packet_uint16(packet, 0x0804);
2997                 /* rsa_pss_rsae_sha384 */
2998                 tls_packet_uint16(packet, 0x0805);
2999                 /* rsa_pss_rsae_sha512 */
3000                 tls_packet_uint16(packet, 0x0806);
3001         } else {
3002                 tls_packet_uint8(packet, 1);
3003                 tls_packet_uint8(packet, rsa_sign);
3004                 if (context->version == TLS_V12) {
3005                         /* 10 pairs or 2 bytes */
3006                         tls_packet_uint16(packet, 10);
3007                         tls_packet_uint8(packet, sha256);
3008                         tls_packet_uint8(packet, rsa);
3009                         tls_packet_uint8(packet, sha1);
3010                         tls_packet_uint8(packet, rsa);
3011                         tls_packet_uint8(packet, sha384);
3012                         tls_packet_uint8(packet, rsa);
3013                         tls_packet_uint8(packet, sha512);
3014                         tls_packet_uint8(packet, rsa);
3015                         tls_packet_uint8(packet, md5);
3016                         tls_packet_uint8(packet, rsa);
3017                 }
3018                 /* no DistinguishedName yet */
3019                 tls_packet_uint16(packet, 0);
3020         }
3021         if (!packet->broken) {
3022                 tls_set_packet_length(packet, packet->len - start_len);
3023         }
3024         tls_packet_update(packet);
3025         return packet;
3026 }
3027
3028 int tls_parse_key_share(struct TLSContext *context, const unsigned char *buf,
3029                 int buf_len) {
3030         int i = 0;
3031         struct ECCCurveParameters *curve = 0;
3032         struct DHKey *dhkey = 0;
3033         int dhe_key_size = 0;
3034         const unsigned char *buffer = NULL;
3035         unsigned char *out2;
3036         unsigned long out_size;
3037         uint16_t key_size;
3038
3039         while (buf_len >= 4) {
3040                 uint16_t named_group = get16(&buf[i]);
3041                 i += 2;
3042                 buf_len -= 2;
3043
3044                 key_size = get16(&buf[i]);
3045                 i += 2;
3046                 buf_len -= 2;
3047
3048                 if (key_size > buf_len) {
3049                         return TLS_BROKEN_PACKET;
3050                 }
3051
3052                 switch (named_group) {
3053                         case 0x0017:
3054                                 curve = &secp256r1;
3055                                 buffer = &buf[i];
3056                                 DEBUG_PRINT("KEY SHARE => secp256r1\n");
3057                                 buf_len = 0;
3058                                 continue;
3059                         case 0x0018:
3060                                 /* secp384r1 */
3061                                 curve = &secp384r1;
3062                                 buffer = &buf[i];
3063                                 DEBUG_PRINT("KEY SHARE => secp384r1\n");
3064                                 buf_len = 0;
3065                                 continue;
3066                         case 0x0019:
3067                                 /* secp521r1 */
3068                                 break;
3069                         case 0x001D:
3070                                 /* x25519 */
3071                                 if (key_size != 32) {
3072                                         DEBUG_PRINT
3073                                                 ("INVALID x25519 KEY SIZE (%i)\n",
3074                                                  key_size);
3075                                         continue;
3076                                 }
3077                                 curve = &curve25519;
3078                                 buffer = &buf[i];
3079                                 DEBUG_PRINT("KEY SHARE => x25519\n");
3080                                 buf_len = 0;
3081                                 continue;
3082                                 break;
3083
3084                         case 0x001E:
3085                                 /* x448 */
3086                                 break;
3087                         case 0x0100:
3088                                 dhkey = &ffdhe2048;
3089                                 dhe_key_size = 2048;
3090                                 break;
3091                         case 0x0101:
3092                                 dhkey = &ffdhe3072;
3093                                 dhe_key_size = 3072;
3094                                 break;
3095                         case 0x0102:
3096                                 dhkey = &ffdhe4096;
3097                                 dhe_key_size = 4096;
3098                                 break;
3099                         case 0x0103:
3100                                 dhkey = &ffdhe6144;
3101                                 dhe_key_size = 6144;
3102                                 break;
3103                         case 0x0104:
3104                                 dhkey = &ffdhe8192;
3105                                 dhe_key_size = 8192;
3106                                 break;
3107                 }
3108                 i += key_size;
3109                 buf_len -= key_size;
3110         }
3111
3112         if (curve) {
3113                 context->curve = curve;
3114
3115                 if (curve == &curve25519) {
3116                         if (!tls_random(context->local_random,
3117                              TLS_SERVER_RANDOM_SIZE)) {
3118                                 return TLS_GENERIC_ERROR;
3119                         }
3120
3121                         unsigned char secret[32];
3122                         static const unsigned char basepoint[32] = { 9 };
3123
3124                         tls_random(secret, 32);
3125
3126                         secret[0] &= 248;
3127                         secret[31] &= 127;
3128                         secret[31] |= 64;
3129
3130                         /* use finished key to store public key */
3131                         free(context->finished_key);
3132                         context->finished_key = malloc(32);
3133                         if (!context->finished_key) {
3134                                 return TLS_GENERIC_ERROR;
3135                         }
3136
3137                         x25519(context->finished_key, secret, basepoint);
3138
3139                         free(context->premaster_key);
3140                         context->premaster_key = malloc(32);
3141
3142                         if (!context->premaster_key) {
3143                                 return TLS_GENERIC_ERROR;
3144                         }
3145
3146                         x25519(context->premaster_key, secret, buffer);
3147                         context->premaster_key_len = 32;
3148
3149                         return 0;
3150                 }
3151
3152                 tls_ecc_dhe_create(context);
3153                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&context->curve->dp;
3154
3155                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
3156                                         dp)) {
3157                         free(context->ecc_dhe);
3158                         context->ecc_dhe = NULL;
3159                         DEBUG_PRINT("Error generating ECC DHE key\n");
3160                         return TLS_GENERIC_ERROR;
3161                 }
3162
3163                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE)) {
3164                         return TLS_GENERIC_ERROR;
3165                 }
3166
3167                 ecc_key client_key;
3168                 memset(&client_key, 0, sizeof client_key);
3169                 if (ecc_ansi_x963_import_ex
3170                     (buffer, key_size, &client_key, dp)) {
3171                         DEBUG_PRINT("Error importing ECC DHE key\n");
3172                         return TLS_GENERIC_ERROR;
3173                 }
3174                 out2 = malloc(key_size);
3175                 out_size = key_size;
3176
3177                 int err = ecc_shared_secret(context->ecc_dhe, &client_key,
3178                                 out2, &out_size);
3179                 ecc_free(&client_key);
3180
3181                 if (err) {
3182                         DEBUG_PRINT("ECC DHE DECRYPT ERROR %i\n", err);
3183                         free(out2);
3184                         return TLS_GENERIC_ERROR;
3185                 }
3186
3187                 DEBUG_PRINT("OUT_SIZE: %lu\n", out_size);
3188                 DEBUG_DUMP_HEX_LABEL("ECC DHE", out2, out_size);
3189
3190                 free(context->premaster_key);
3191                 context->premaster_key = out2;
3192                 context->premaster_key_len = out_size;
3193                 return 0;
3194         } else if (dhkey) {
3195                 tls_dhe_create(context);
3196                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE))
3197                 {
3198                         return TLS_GENERIC_ERROR;
3199                 }
3200
3201                 if (tls_dh_make_key(dhe_key_size / 8, context->dhe,
3202                      (const char *)dhkey->p, (const char *)dhkey->g, 0, 0)) {
3203                         free(context->dhe);
3204                         context->dhe = NULL;
3205                         DEBUG_PRINT("Error generating DHE key\n");
3206                         return TLS_GENERIC_ERROR;
3207                 }
3208
3209                 unsigned int dhe_out_size;
3210                 out2 = tls_decrypt_dhe(context, buffer, key_size,
3211                                 &dhe_out_size, 0);
3212                 if (!out2) {
3213                         DEBUG_PRINT("Error generating DHE shared key\n");
3214                         return TLS_GENERIC_ERROR;
3215                 }
3216
3217                 free(context->premaster_key);
3218                 context->premaster_key = out2;
3219                 context->premaster_key_len = dhe_out_size;
3220                 if (context->dhe) {
3221                         context->dhe->iana = dhkey->iana;
3222                 }
3223                 return 0;
3224         }
3225         DEBUG_PRINT("NO COMMON KEY SHARE SUPPORTED\n");
3226         return TLS_NO_COMMON_CIPHER;
3227 }
3228
3229 int tls_parse_certificate(struct TLSContext *context,
3230                           const unsigned char *buf, int buf_len,
3231                           int is_client) {
3232         int res = 0;
3233         if (buf_len < 3) {
3234                 return TLS_NEED_MORE_DATA;
3235         }
3236
3237         int size = get24(buf);
3238
3239         /* not enough data, so just consume all of it */
3240         if (size <= 4) {
3241                 return 3 + size;
3242         }
3243
3244         res += 3; /* skip over the size field */
3245
3246         if (context->tlsver == TLS_VERSION13) {
3247                 int context_size = buf[res];
3248                 res++;
3249                 /* must be 0 */
3250                 if (context_size) {
3251                         res += context_size;
3252                 }
3253         }
3254
3255         if (buf_len - res < size) {
3256                 return TLS_NEED_MORE_DATA;
3257         }
3258
3259         int idx = 0;
3260         int valid_certificate = 0;
3261         while (size > 0) {
3262                 idx++;
3263                 if (buf_len - res < 3) {
3264                         return TLS_NEED_MORE_DATA;
3265                 }
3266                 int certificate_size = get24(buf+res);
3267                 res += 3;
3268                 if (buf_len - res < certificate_size) {
3269                         return TLS_NEED_MORE_DATA;
3270                 }
3271                 /* load chain */
3272                 int certificates_in_chain = 0;
3273                 int res2 = res;
3274                 unsigned int remaining = certificate_size;
3275                 do {
3276                         if (remaining <= 3) {
3277                                 break;
3278                         }
3279                         certificates_in_chain++;
3280                         unsigned int certificate_size2 = get24(buf+res2);
3281                         res2 += 3;
3282                         remaining -= 3;
3283                         if (certificate_size2 > remaining) {
3284                                 DEBUG_PRINT
3285                                     ("Invalid certificate size (%i from %i bytes remaining)\n",
3286                                      certificate_size2, remaining);
3287                                 break;
3288                         }
3289                         remaining -= certificate_size2;
3290
3291                         struct TLSCertificate *cert = asn1_parse(context,
3292                                                                  &buf
3293                                                                  [res2],
3294                                                                  certificate_size2,
3295                                                                  is_client);
3296                         if (cert) {
3297                                 if (certificate_size2) {
3298                                         cert->bytes =
3299                                             malloc(certificate_size2);
3300                                         if (cert->bytes) {
3301                                                 cert->len =
3302                                                     certificate_size2;
3303                                                 memcpy(cert->bytes,
3304                                                        &buf[res2],
3305                                                        certificate_size2);
3306                                         }
3307                                 }
3308                                 /* valid certificate */
3309                                 if (is_client) {
3310                                         void *new;
3311                                         valid_certificate = 1;
3312
3313                                         new =
3314                                             TLS_REALLOC(context->
3315                                                         client_certificates,
3316                                                         (context->
3317                                                          client_certificates_count
3318                                                          +
3319                                                          1) *
3320                                                         sizeof(struct
3321                                                                TLSCertificate
3322                                                                *));
3323
3324                                         if (!new) {
3325                                                 free(context->
3326                                                          client_certificates);
3327                                                 context->
3328                                                     client_certificates =
3329                                                     0;
3330                                                 return TLS_NO_MEMORY;
3331                                         }
3332
3333                                         context->client_certificates = new;
3334                                         context->
3335                                             client_certificates
3336                                             [context->client_certificates_count]
3337                                             = cert;
3338                                         context->
3339                                             client_certificates_count++;
3340                                 } else {
3341                                         void *new;
3342                                         new =
3343                                             TLS_REALLOC(context->
3344                                                         certificates,
3345                                                         (context->
3346                                                          certificates_count
3347                                                          +
3348                                                          1) *
3349                                                         sizeof(struct
3350                                                                TLSCertificate
3351                                                                *));
3352                                         if (!new) {
3353                                                 free(context->
3354                                                          certificates);
3355                                                 context->certificates = 0;
3356                                                 return TLS_NO_MEMORY;
3357                                         }
3358                                         context->certificates = new;
3359                                         context->certificates[context->
3360                                                               certificates_count]
3361                                             = cert;
3362                                         context->certificates_count++;
3363                                         if ((cert->pk) || (cert->priv))
3364                                                 valid_certificate = 1;
3365                                         else if (!context->is_server)
3366                                                 valid_certificate = 1;
3367                                 }
3368                         }
3369                         res2 += certificate_size2;
3370                         /* extension */
3371                         if (context->tlsver == TLS_VERSION13) {
3372                                 if (remaining >= 2) {
3373                                         /* ignore extensions */
3374                                         remaining -= 2;
3375                                         uint16_t size = get16(&buf[res2]);
3376                                         if (size && size >= remaining) {
3377                                                 res2 += size;
3378                                                 remaining -= size;
3379                                         }
3380                                 }
3381                         }
3382                 } while (remaining > 0);
3383                 if (remaining) {
3384                         DEBUG_PRINT("Extra %i bytes after certificate\n",
3385                                     remaining);
3386                 }
3387                 size -= certificate_size + 3;
3388                 res += certificate_size;
3389         }
3390         if (!valid_certificate) {
3391                 MARK;
3392                 return TLS_UNSUPPORTED_CERTIFICATE;
3393         }
3394         if (res != buf_len) {
3395                 DEBUG_PRINT("Warning: %i bytes read from %i byte buffer\n",
3396                             (int) res, (int) buf_len);
3397         }
3398         return res;
3399 }
3400
3401 static int parse_dh( const unsigned char *buf, int buf_len, const unsigned char
3402                 **out, int *out_size) {
3403         int res = 0;
3404         *out = NULL;
3405         *out_size = 0;
3406         if (buf_len < 2) {
3407                 return TLS_NEED_MORE_DATA;
3408         }
3409         uint16_t size = get16(buf);
3410         res += 2;
3411         if (buf_len - res < size) {
3412                 return TLS_NEED_MORE_DATA;
3413         }
3414         DEBUG_DUMP_HEX(&buf[res], size);
3415         *out = &buf[res];
3416         *out_size = size;
3417         res += size;
3418         return res;
3419 }
3420
3421 static int tls_parse_random(struct TLSContext *context,
3422                               const unsigned char *buf, int buf_len) {
3423         int res = 0;
3424         int ephemeral = tls_cipher_is_ephemeral(context);
3425         uint16_t size;
3426         if (ephemeral == 2) {
3427                 if (buf_len < 1) {
3428                         return TLS_NEED_MORE_DATA;
3429                 }
3430                 size = buf[0];
3431                 res += 1;
3432         } else {
3433                 if (buf_len < 2) {
3434                         return TLS_NEED_MORE_DATA;
3435                 }
3436                 size = get16(buf);
3437                 res += 2;
3438         }
3439
3440         if (buf_len - res < size) {
3441                 return TLS_NEED_MORE_DATA;
3442         }
3443         unsigned int out_len = 0;
3444         unsigned char *random = NULL;
3445         switch (ephemeral) {
3446                 case 1:
3447                         random = tls_decrypt_dhe(context, &buf[res], size, &out_len,
3448                                         1);
3449                         break;
3450                 case 2:
3451                         random = tls_decrypt_ecc_dhe(context, &buf[res], size,
3452                                         &out_len, 1);
3453                         break;
3454                 default:
3455                         random = decrypt_rsa(context, &buf[res], size,
3456                                         &out_len);
3457         }
3458
3459         if (random && out_len > 2) {
3460                 /* *(unsigned short *)&random[0] = htons(context->version); */
3461                 DEBUG_DUMP_HEX_LABEL("PRE MASTER KEY", random, out_len);
3462                 free(context->premaster_key);
3463                 context->premaster_key = random;
3464                 context->premaster_key_len = out_len;
3465                 tls_compute_key(context, 48);
3466         } else {
3467                 free(random);
3468                 return 0;
3469         }
3470         res += size;
3471         return res;
3472 }
3473
3474 static const unsigned char *parse_signature(const unsigned char *buf, int
3475                 buf_len, int *hash_algorithm, int *sign_algorithm, int
3476                 *sig_size, int *offset) {
3477         int res = 0;
3478         if (buf_len < 2) {
3479                 return NULL;
3480         }
3481         *hash_algorithm = _md5_sha1;
3482         *sign_algorithm = rsa_sign;
3483         *sig_size = 0;
3484         *hash_algorithm = buf[res];
3485         res++;
3486         *sign_algorithm = buf[res];
3487         res++;
3488         uint16_t size = get16(&buf[res]);
3489         res += 2;
3490         if (buf_len - res < size) {
3491                 return NULL;
3492         }
3493         DEBUG_DUMP_HEX(&buf[res], size);
3494         *sig_size = size;
3495         *offset = res + size;
3496         return &buf[res];
3497 }
3498
3499 int tls_parse_server_key_exchange(struct TLSContext *context,
3500                                   const unsigned char *buf, int buf_len) {
3501         int res = 0;
3502         int dh_res = 0;
3503         if (buf_len < 3) {
3504                 return TLS_NEED_MORE_DATA;
3505         }
3506         int size = get24(buf);
3507         res += 3;
3508         const unsigned char *packet_ref = buf + res;
3509         if (buf_len - res < size) {
3510                 return TLS_NEED_MORE_DATA;
3511         }
3512
3513         if (!size) {
3514                 return res;
3515         }
3516
3517         unsigned char has_ds_params = 0;
3518         int key_size = 0;
3519         const struct ECCCurveParameters *curve = NULL;
3520         const unsigned char *pk_key = NULL;
3521         int ephemeral = tls_cipher_is_ephemeral(context);
3522         if (ephemeral) {
3523                 if (ephemeral == 1) {
3524                         has_ds_params = 1;
3525                 } else {
3526                         if (buf[res++] != 3) {
3527                                 /* named curve */
3528                                 /* any other method is not supported */
3529                                 return 0;
3530                         }
3531                         if (buf_len - res < 3) {
3532                                 return TLS_NEED_MORE_DATA;
3533                         }
3534                         int iana_n = get16(&buf[res]);
3535                         res += 2;
3536                         key_size = buf[res];
3537                         res++;
3538                         if (buf_len - res < key_size) {
3539                                 return TLS_NEED_MORE_DATA;
3540                         }
3541                         DEBUG_PRINT("IANA CURVE NUMBER: %i\n", iana_n);
3542                         switch (iana_n) {
3543                                 case 19:
3544                                         curve = &secp192r1;
3545                                         break;
3546                                 case 20:
3547                                         curve = &secp224k1;
3548                                         break;
3549                                 case 21:
3550                                         curve = &secp224r1;
3551                                         break;
3552                                 case 22:
3553                                         curve = &secp256k1;
3554                                         break;
3555                                 case 23:
3556                                         curve = &secp256r1;
3557                                         break;
3558                                 case 24:
3559                                         curve = &secp384r1;
3560                                         break;
3561                                 case 25:
3562                                         curve = &secp521r1;
3563                                         break;
3564                                 default:
3565                                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
3566                                         return TLS_GENERIC_ERROR;
3567                         }
3568                         pk_key = &buf[res];
3569                         res += key_size;
3570                         context->curve = curve;
3571                 }
3572         }
3573
3574         const unsigned char *dh_p = NULL;
3575         int dh_p_len = 0;
3576         const unsigned char *dh_g = NULL;
3577         int dh_g_len = 0;
3578         const unsigned char *dh_Ys = NULL;
3579         int dh_Ys_len = 0;
3580
3581         if (has_ds_params) {
3582                 DEBUG_PRINT("          dh_p: ");
3583                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_p, &dh_p_len);
3584                 if (dh_res <= 0) {
3585                         return TLS_BROKEN_PACKET;
3586                 }
3587                 res += dh_res;
3588                 DEBUG_PRINT("\n");
3589
3590                 DEBUG_PRINT("          dh_q: ");
3591                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_g, &dh_g_len);
3592                 if (dh_res <= 0) {
3593                 MARK;
3594                         return TLS_BROKEN_PACKET;
3595                 }
3596                 res += dh_res;
3597                 DEBUG_PRINT("\n");
3598
3599                 DEBUG_PRINT("          dh_Ys: ");
3600                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_Ys,
3601                                 &dh_Ys_len);
3602                 if (dh_res <= 0) {
3603                 MARK;
3604                         return TLS_BROKEN_PACKET;
3605                 }
3606                 res += dh_res;
3607                 DEBUG_PRINT("\n");
3608         }
3609         int sign_size;
3610         int hash_algorithm;
3611         int sign_algorithm;
3612         int packet_size = res - 3;
3613         int offset = 0;
3614         DEBUG_PRINT("          SIGNATURE (%i/%i/%i): ", packet_size,
3615                     dh_res, key_size);
3616         const unsigned char *signature =
3617             parse_signature(&buf[res], buf_len - res, &hash_algorithm,
3618                             &sign_algorithm, &sign_size, &offset);
3619         DEBUG_PRINT("\n");
3620         if (sign_size <= 0 || !signature) {
3621                 return TLS_BROKEN_PACKET;
3622         }
3623         res += offset;
3624         /* check signature */
3625         unsigned int message_len =
3626             packet_size + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
3627         unsigned char *message = malloc(message_len);
3628         if (message) {
3629                 memcpy(message, context->local_random, TLS_CLIENT_RANDOM_SIZE);
3630                 memcpy(message + TLS_CLIENT_RANDOM_SIZE,
3631                        context->remote_random, TLS_SERVER_RANDOM_SIZE);
3632                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
3633                        TLS_SERVER_RANDOM_SIZE, packet_ref, packet_size);
3634                 if (tls_is_ecdsa(context)) {
3635                         if (tls_verify_ecdsa
3636                             (context, hash_algorithm, signature, sign_size,
3637                              message, message_len, NULL) != 1) {
3638                                 DEBUG_PRINT
3639                                     ("ECC Server signature FAILED!\n");
3640                                 free(message);
3641                                 return TLS_BROKEN_PACKET;
3642                         }
3643                 } else
3644                 {
3645                         if (verify_rsa(context, hash_algorithm, signature,
3646                                                 sign_size, message,
3647                                                 message_len) != 1) {
3648                                 DEBUG_PRINT("Server signature FAILED!\n");
3649                                 free(message);
3650                                 return TLS_BROKEN_PACKET;
3651                         }
3652                 }
3653                 free(message);
3654         }
3655
3656         if (buf_len - res) {
3657                 DEBUG_PRINT("EXTRA %i BYTES AT THE END OF MESSAGE\n",
3658                             buf_len - res);
3659                 DEBUG_DUMP_HEX(&buf[res], buf_len - res);
3660                 DEBUG_PRINT("\n");
3661         }
3662
3663         if (ephemeral == 1) {
3664                 tls_dhe_create(context);
3665                 DEBUG_DUMP_HEX_LABEL("DHP", dh_p, dh_p_len);
3666                 DEBUG_DUMP_HEX_LABEL("DHG", dh_g, dh_g_len);
3667                 int dhe_key_size = dh_p_len;
3668                 if (dh_g_len > dh_p_len) {
3669                         dhe_key_size = dh_g_len;
3670                 }
3671
3672                 if (tls_dh_make_key(dhe_key_size, context->dhe, (const char *)
3673                                         dh_p, (const char *) dh_g, dh_p_len,
3674                                         dh_g_len)) {
3675                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
3676                         free(context->dhe);
3677                         context->dhe = NULL;
3678                         return TLS_GENERIC_ERROR;
3679                 }
3680
3681                 unsigned int dh_key_size = 0;
3682                 unsigned char *key = tls_decrypt_dhe(context, dh_Ys, dh_Ys_len,
3683                                 &dh_key_size, 0);
3684                 DEBUG_DUMP_HEX_LABEL("DH COMMON SECRET", key, dh_key_size);
3685                 if (key && dh_key_size) {
3686                         free(context->premaster_key);
3687                         context->premaster_key = key;
3688                         context->premaster_key_len = dh_key_size;
3689                 }
3690         } else if (ephemeral == 2 && curve && pk_key && key_size) {
3691                 tls_ecc_dhe_create(context);
3692
3693                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *) & curve->dp;
3694                 if (ecc_make_key_ex
3695                     (NULL, find_prng("sprng"), context->ecc_dhe, dp)) {
3696                         free(context->ecc_dhe);
3697                         context->ecc_dhe = NULL;
3698                         DEBUG_PRINT("Error generating ECC key\n");
3699                         return TLS_GENERIC_ERROR;
3700                 }
3701
3702                 free(context->premaster_key);
3703                 context->premaster_key_len = 0;
3704
3705                 unsigned int out_len = 0;
3706                 context->premaster_key =
3707                     tls_decrypt_ecc_dhe(context, pk_key, key_size,
3708                                                  &out_len, 0);
3709                 if (context->premaster_key) {
3710                         context->premaster_key_len = out_len;
3711                 }
3712         }
3713
3714         return res;
3715 }
3716
3717 int tls_parse_client_key_exchange(struct TLSContext *context,
3718                                   const unsigned char *buf, int buf_len) {
3719         if (context->connection_status != 1) {
3720                 DEBUG_PRINT
3721                     ("UNEXPECTED CLIENT KEY EXCHANGE MESSAGE (connections status: %i)\n",
3722                      (int) context->connection_status);
3723                 return TLS_UNEXPECTED_MESSAGE;
3724         }
3725
3726         int res = 0;
3727         int dh_res = 0;
3728         if (buf_len < 3) {
3729                 return TLS_NEED_MORE_DATA;
3730         }
3731         int size = get24(buf);
3732         res += 3;
3733
3734         if (buf_len - res < size) {
3735                 return TLS_NEED_MORE_DATA;
3736         }
3737
3738         if (!size) {
3739                 return res;
3740         }
3741
3742         dh_res = tls_parse_random(context, &buf[res], size);
3743         if (dh_res <= 0) {
3744                 DEBUG_PRINT("broken key\n");
3745                 return TLS_BROKEN_PACKET;
3746         }
3747         DEBUG_PRINT("\n");
3748
3749         res += size;
3750         context->connection_status = 2;
3751         return res;
3752 }
3753
3754 static int tls_parse_server_hello_done(const unsigned char *buf, int buf_len) {
3755         int res = 0;
3756         if (buf_len < 3) {
3757                 return TLS_NEED_MORE_DATA;
3758         }
3759         int size = get24(buf);
3760         res += 3;
3761
3762         if (buf_len - res < size) {
3763                 return TLS_NEED_MORE_DATA;
3764         }
3765
3766                 MARK;
3767         res += size;
3768         return res;
3769 }
3770
3771 int tls_parse_finished(struct TLSContext *context,
3772                        const unsigned char *buf, int buf_len,
3773                        unsigned int *write_packets) {
3774         if (context->connection_status < 2
3775             || context->connection_status == TLS_CONNECTED) {
3776                 DEBUG_PRINT("UNEXPECTED FINISHED MESSAGE\n");
3777                 return TLS_UNEXPECTED_MESSAGE;
3778         }
3779
3780         int res = 0;
3781         *write_packets = 0;
3782         if (buf_len < 3) {
3783                 return TLS_NEED_MORE_DATA;
3784         }
3785         int size = get24(buf);
3786         res += 3;
3787
3788         if (size < TLS_MIN_FINISHED_OPAQUE_LEN) {
3789                 DEBUG_PRINT("Invalid finished packet size: %i\n", size);
3790                 return TLS_BROKEN_PACKET;
3791         }
3792
3793         if (buf_len - res < size) {
3794                 return TLS_NEED_MORE_DATA;
3795         }
3796
3797         unsigned char hash[TLS_MAX_SHA_SIZE];
3798         unsigned int hash_len = tls_get_hash(context, hash);
3799
3800         if (context->tlsver == TLS_VERSION13) {
3801                 unsigned char hash_out[TLS_MAX_SHA_SIZE];
3802                 unsigned long out_size = TLS_MAX_SHA_SIZE;
3803                 if (!context->remote_finished_key || !hash_len) {
3804                         DEBUG_PRINT
3805                             ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
3806                         return TLS_NOT_VERIFIED;
3807                 }
3808
3809                 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
3810                 DEBUG_DUMP_HEX_LABEL("HS FINISH", context->remote_finished_key,
3811                                 hash_len);
3812
3813                 out_size = hash_len;
3814                 hmac_state hmac;
3815                 hmac_init(&hmac, tls_get_hash_idx(context),
3816                           context->remote_finished_key, hash_len);
3817                 hmac_process(&hmac, hash, hash_len);
3818                 hmac_done(&hmac, hash_out, &out_size);
3819
3820                 if (size != (int)out_size || memcmp(hash_out, &buf[res], size)) {
3821                         DEBUG_PRINT
3822                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3823                              (int) context->local_sequence_number,
3824                              (int) context->remote_sequence_number);
3825                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3826                                              size);
3827                         DEBUG_DUMP_HEX_LABEL("VERIFY", hash_out, out_size);
3828                         return TLS_NOT_VERIFIED;
3829                 }
3830                 if (context->is_server) {
3831                         context->connection_status = TLS_CONNECTED;
3832                         res += size;
3833                         _private_tls13_key(context, 0);
3834                         context->local_sequence_number = 0;
3835                         context->remote_sequence_number = 0;
3836                         return res;
3837                 }
3838                 /* TODO client verify */
3839         } else {
3840                 /* verify */
3841                 unsigned char *out = malloc(size);
3842                 if (!out) {
3843                         DEBUG_PRINT("Error in malloc (%i bytes)\n",
3844                                     (int) size);
3845                         return TLS_NO_MEMORY;
3846                 }
3847
3848                 /* server verifies client's message */
3849                 if (context->is_server) {
3850                         tls_prf(context, out, size,
3851                                          context->master_key,
3852                                          context->master_key_len,
3853                                          (unsigned char *)
3854                                          "client finished", 15, hash,
3855                                          hash_len, NULL, 0);
3856                 } else {
3857                         tls_prf(context, out, size,
3858                                          context->master_key,
3859                                          context->master_key_len,
3860                                          (unsigned char *)
3861                                          "server finished", 15, hash,
3862                                          hash_len, NULL, 0);
3863                 }
3864
3865                 if (memcmp(out, &buf[res], size)) {
3866                         free(out);
3867                         DEBUG_PRINT
3868                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3869                              (int) context->local_sequence_number,
3870                              (int) context->remote_sequence_number);
3871                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3872                                              size);
3873                         DEBUG_DUMP_HEX_LABEL("VERIFY", out, size);
3874                         return TLS_NOT_VERIFIED;
3875                 }
3876                 free(out);
3877         }
3878
3879         if (context->is_server) {
3880                 *write_packets = 3;
3881         } else {
3882                 context->connection_status = TLS_CONNECTED;
3883         }
3884
3885         // fprintf(stderr, "set conn status = %d\n", context->connection_status);
3886
3887                 MARK;
3888         res += size;
3889         return res;
3890 }
3891
3892 int tls_parse_verify_tls13(struct TLSContext *context,
3893                            const unsigned char *buf, int buf_len) {
3894         if (buf_len < 7) {
3895                 return TLS_NEED_MORE_DATA;
3896         }
3897         int size = get24(buf);
3898
3899         if (size < 2) {
3900                 return buf_len;
3901         }
3902
3903         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
3904         int signing_data_len;
3905
3906         /* first 64 bytes to 0x20 (32) */
3907         memset(signing_data, 0x20, 64);
3908         /* context string 33 bytes */
3909         if (context->is_server) {
3910                 memcpy(signing_data + 64,
3911                        "TLS 1.3, server CertificateVerify", 33);
3912         } else {
3913                 memcpy(signing_data + 64,
3914                        "TLS 1.3, client CertificateVerify", 33);
3915         }
3916
3917         /* a single 0 byte separator */
3918         signing_data[97] = 0;
3919         signing_data_len = 98;
3920
3921         signing_data_len += tls_get_hash(context, signing_data + 98);
3922         DEBUG_DUMP_HEX_LABEL("signature data", signing_data, signing_data_len);
3923         uint16_t signature = get16(&buf[3]);
3924         uint16_t signature_size = get16(&buf[5]);
3925         int valid = 0;
3926         if (buf_len < size + 7) {
3927                 return TLS_NEED_MORE_DATA;
3928         }
3929         switch (signature) {
3930                 case 0x0403:
3931                         /* secp256r1 + sha256 */
3932                         valid =
3933                                 tls_verify_ecdsa(context, sha256, buf + 7,
3934                                                 signature_size, signing_data,
3935                                                 signing_data_len,
3936                                                 &secp256r1);
3937                         break;
3938                 case 0x0503:
3939                         /* secp384r1 + sha384 */
3940                         valid = tls_verify_ecdsa(context, sha384, buf + 7,
3941                                         signature_size, signing_data,
3942                                         signing_data_len, &secp384r1);
3943                         break;
3944                 case 0x0603:
3945                         /* secp521r1 + sha512 */
3946                         valid = tls_verify_ecdsa(context, sha512, buf + 7,
3947                                         signature_size, signing_data,
3948                                         signing_data_len, &secp521r1);
3949                         break;
3950                 case 0x0804:
3951                         valid = verify_rsa(context, sha256, buf + 7,
3952                                         signature_size, signing_data,
3953                                         signing_data_len);
3954                         break;
3955                 default:
3956                         DEBUG_PRINT("Unsupported signature: %x\n",
3957                                         (int) signature);
3958                         return TLS_UNSUPPORTED_CERTIFICATE;
3959         }
3960         if (valid != 1) {
3961                 DEBUG_PRINT("Signature FAILED!\n");
3962                 return TLS_DECRYPTION_FAILED;
3963         }
3964         return buf_len;
3965 }
3966
3967 int tls_parse_verify(struct TLSContext *context, const unsigned char *buf,
3968                      int buf_len) {
3969         if (context->tlsver == TLS_VERSION13) {
3970                 return tls_parse_verify_tls13(context, buf, buf_len);
3971         }
3972
3973         if (buf_len < 7) {
3974                 return TLS_BAD_CERTIFICATE;
3975         }
3976
3977         int bytes_to_follow = get24(buf);
3978
3979         if (buf_len - 3 < bytes_to_follow) {
3980                 return TLS_BAD_CERTIFICATE;
3981         }
3982
3983         int res = -1;
3984
3985         unsigned int hash = buf[3];
3986         unsigned int algorithm = buf[4];
3987         if (algorithm != rsa) {
3988                 return TLS_UNSUPPORTED_CERTIFICATE;
3989         }
3990         uint16_t size = get16(&buf[5]);
3991         if (bytes_to_follow - 4 < size) {
3992                 return TLS_BAD_CERTIFICATE;
3993         }
3994         DEBUG_PRINT("ALGORITHM %i/%i (%i)\n", hash, algorithm, (int) size);
3995         DEBUG_DUMP_HEX_LABEL("VERIFY", &buf[7], bytes_to_follow - 7);
3996
3997         res = verify_rsa(context, hash, &buf[7], size,
3998                         context->cached_handshake.buffer,
3999                         context->cached_handshake.len);
4000
4001         tls_buffer_free(&context->cached_handshake);
4002         if (res == 1) {
4003                 DEBUG_PRINT("Signature OK\n");
4004                 context->client_verified = 1;
4005         } else {
4006                 DEBUG_PRINT("Signature FAILED\n");
4007                 context->client_verified = 0;
4008         }
4009         return 1;
4010 }
4011
4012 /* TODO This is actually a parse a handshake message */
4013 int tls_parse_payload(struct TLSContext *context, const unsigned char *buf,
4014                       int buf_len) {
4015         ENTER;
4016         int orig_len = buf_len;
4017
4018
4019         if (context->connection_status == TLS_CONNECTED) {
4020                 if (context->version == TLS_V13) {
4021                         tls_alert(context, 1, unexpected_message);
4022                 } else {
4023                         tls_alert(context, 0, no_renegotiation_RESERVED);
4024                 }
4025
4026                 return 1;
4027         }
4028
4029         while (buf_len >= 4 && !context->critical_error) {
4030                 int payload_res = 0;
4031                 //unsigned char update_hash = 1;
4032                 unsigned char type = buf[0];
4033                 unsigned int write_packets = 0;
4034                 int certificate_verify_alert = no_error;
4035                 int payload_size = get24(buf+1) + 3;
4036                 if (buf_len < payload_size + 1) {
4037                         return TLS_NEED_MORE_DATA;
4038                 }
4039                 switch (type) {
4040                         case 0x00:
4041                                 /* hello request */
4042                                 CHECK_HANDSHAKE_STATE(context, 0, 1);
4043                                 DEBUG_PRINT
4044                                         (" => HELLO REQUEST (RENEGOTIATION?)\n");
4045                                 if (context->is_server) {
4046                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4047                                 } else {
4048                                         if (context->connection_status == TLS_CONNECTED) {
4049                                                 /* renegotiation */
4050                                                 payload_res = TLS_NO_RENEGOTIATION;
4051                                         } else {
4052                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4053                                         }
4054                                 }
4055                                 /* no payload */
4056                                 break;
4057                         case 0x01:
4058                                 /* client hello */
4059                                 CHECK_HANDSHAKE_STATE(context, 1, 1);
4060                                 DEBUG_PRINT(" => CLIENT HELLO\n");
4061                                 if (context->is_server) {
4062                                         payload_res =
4063                                                 tls_parse_client_hello(context,
4064                                                                 buf + 1,
4065                                                                 payload_size,
4066                                                                 &write_packets);
4067                                 } else {
4068                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4069                                 }
4070                                 break;
4071                         case 0x02:
4072                                 /* server hello */
4073                                 CHECK_HANDSHAKE_STATE(context, 2, 1);
4074                                 DEBUG_PRINT(" => SERVER HELLO\n");
4075                                 if (context->is_server) {
4076                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4077                                 } else {
4078                                         write_packets = 0;
4079                                         payload_res = tls_parse_server_hello(context, buf + 1, payload_size);
4080                                 }
4081                                 break;
4082                         case 0x03:
4083                                 /* hello verify request */
4084                                 DEBUG_PRINT(" => VERIFY REQUEST\n");
4085                                 CHECK_HANDSHAKE_STATE(context, 3, 1);
4086                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4087                                 break;
4088                         case 0x0B:
4089                                 /* certificate */
4090                                 CHECK_HANDSHAKE_STATE(context, 4, 1);
4091                                 DEBUG_PRINT(" => CERTIFICATE\n");
4092                                 if (context->tlsver == TLS_VERSION13) {
4093                                         if (context->connection_status == 2) {
4094                                                 payload_res =
4095                                                         tls_parse_certificate(context,
4096                                                                         buf + 1,
4097                                                                         payload_size,
4098                                                                         context->
4099                                                                         is_server);
4100                                                 if (context->is_server) {
4101                                                         if (context->certificate_verify && context->client_certificates_count) {
4102                                                                 certificate_verify_alert
4103                                                                         =
4104                                                                         context->certificate_verify(context,
4105                                                                          context->client_certificates,
4106                                                                          context->client_certificates_count);
4107                                                         }
4108                                                         /* empty certificates are permitted for client */
4109                                                         if (payload_res <= 0) {
4110                                                                 payload_res = 1;
4111                                                         }
4112                                                 }
4113                                         } else
4114                                                 payload_res =
4115                                                         TLS_UNEXPECTED_MESSAGE;
4116                                 } else
4117                                         if (context->connection_status == 1) {
4118                                                 if (context->is_server) {
4119                                                         /* client certificate */
4120                                                         payload_res =
4121                                                                 tls_parse_certificate(context,
4122                                                                                 buf + 1,
4123                                                                                 payload_size,
4124                                                                                 1);
4125                                                         if (context->certificate_verify && context->client_certificates_count) {
4126                                                                 certificate_verify_alert =
4127                                                                         context->certificate_verify
4128                                                                         (context,
4129                                                                          context->
4130                                                                          client_certificates,
4131                                                                          context->
4132                                                                          client_certificates_count);
4133                                                         }
4134                                                         /* empty certificates are permitted for client */
4135                                                         if (payload_res <= 0)
4136                                                                 payload_res = 1;
4137                                                 } else {
4138                                                         payload_res =
4139                                                                 tls_parse_certificate(context,
4140                                                                                 buf + 1,
4141                                                                                 payload_size,
4142                                                                                 0);
4143                                                         if (certificate_verify && context->certificates_count) {
4144                                                                 certificate_verify_alert =
4145                                                                         context->certificate_verify
4146                                                                         (context,
4147                                                                          context->certificates,
4148                                                                          context->
4149                                                                          certificates_count);
4150                                                         }
4151                                                 }
4152                                         } else {
4153                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4154                                         }
4155                                 break;
4156                         case 0x0C:
4157                                 /* server key exchange */
4158                                 CHECK_HANDSHAKE_STATE(context, 5, 1);
4159                                 DEBUG_PRINT(" => SERVER KEY EXCHANGE\n");
4160                                 if (context->is_server) {
4161                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4162                                 } else {
4163                                         payload_res =
4164                                                 tls_parse_server_key_exchange(context,
4165                                                                 buf + 1,
4166                                                                 payload_size);
4167                                 }
4168                                 break;
4169                         case 0x0D:
4170                                 /* certificate request */
4171                                 CHECK_HANDSHAKE_STATE(context, 6, 1);
4172                                 /* server to client */
4173                                 if (context->is_server) {
4174                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4175                                 } else {
4176                                         context->client_verified = 2;
4177                                 }
4178                                 DEBUG_PRINT(" => CERTIFICATE REQUEST\n");
4179                                 break;
4180                         case 0x0E:
4181                                 /* server hello done */
4182                                 CHECK_HANDSHAKE_STATE(context, 7, 1);
4183                                 DEBUG_PRINT(" => SERVER HELLO DONE\n");
4184                                 if (context->is_server) {
4185                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4186                                 } else {
4187                                         payload_res =
4188                                                 tls_parse_server_hello_done(
4189                                                                 buf + 1,
4190                                                                 payload_size);
4191                                         if (payload_res > 0) {
4192                                                 write_packets = 1;
4193                                         }
4194                                 }
4195                                 break;
4196                         case 0x0F:
4197                                 /* certificate verify */
4198                                 CHECK_HANDSHAKE_STATE(context, 8, 1);
4199                                 DEBUG_PRINT(" => CERTIFICATE VERIFY\n");
4200                                 if (context->connection_status == 2) {
4201                                         payload_res =
4202                                                 tls_parse_verify(context, buf + 1,
4203                                                                 payload_size);
4204                                 } else {
4205                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4206                                 }
4207                                 break;
4208                         case 0x10:
4209                                 /* client key exchange */
4210                                 CHECK_HANDSHAKE_STATE(context, 9, 1);
4211                                 DEBUG_PRINT(" => CLIENT KEY EXCHANGE\n");
4212                                 if (context->is_server) {
4213                                         payload_res =
4214                                                 tls_parse_client_key_exchange(context,
4215                                                                 buf + 1,
4216                                                                 payload_size);
4217                                 } else {
4218                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4219                                 }
4220                                 break;
4221                         case 0x14:
4222                                 /* finished */
4223                                 tls_buffer_free(&context->cached_handshake);
4224                                 CHECK_HANDSHAKE_STATE(context, 10, 1);
4225                                 DEBUG_PRINT(" => FINISHED\n");
4226                                 payload_res = tls_parse_finished(context,
4227                                                 buf + 1, payload_size,
4228                                                 &write_packets);
4229                                 if (payload_res > 0) {
4230                                         memset(context->hs_messages, 0,
4231                                                         sizeof(context->hs_messages));
4232                                 }
4233                                 break;
4234                         default:
4235                                 DEBUG_PRINT
4236                                         (" => NOT UNDERSTOOD PAYLOAD TYPE: %x\n",
4237                                          (int) type);
4238                                 return TLS_NOT_UNDERSTOOD;
4239                 }
4240
4241                 //if (type != 0x00 && update_hash) {
4242                 if (type != 0x00) {
4243                         tls_update_hash(context, buf, payload_size + 1);
4244                 }
4245
4246                 if (certificate_verify_alert != no_error) {
4247                         MARK;
4248                         tls_alert(context, 1, certificate_verify_alert);
4249                         context->critical_error = 1;
4250                 }
4251
4252                 if (payload_res < 0) {
4253                         switch (payload_res) {
4254                                 case TLS_UNEXPECTED_MESSAGE:
4255                                         MARK;
4256                                         tls_alert(context, 1, unexpected_message);
4257                                         break;
4258                                 case TLS_COMPRESSION_NOT_SUPPORTED:
4259                                         MARK;
4260                                         tls_alert(context, 1, decompression_failure_RESERVED);
4261                                         break;
4262                                 case TLS_BROKEN_PACKET:
4263                                         MARK;
4264                                         tls_alert(context, 1, decode_error);
4265                                         break;
4266                                 case TLS_NO_MEMORY:
4267                                         MARK;
4268                                         tls_alert(context, 1, internal_error);
4269                                         break;
4270                                 case TLS_NOT_VERIFIED:
4271                                         MARK;
4272                                         tls_alert(context, 1, bad_record_mac);
4273                                         break;
4274                                 case TLS_BAD_CERTIFICATE:
4275                                         MARK;
4276                                         if (context->is_server) {
4277                                                 /* bad client certificate, continue */
4278                                                 tls_alert(context, 0, bad_certificate);
4279                                                 payload_res = 0;
4280                                         } else {
4281                                                 tls_alert(context, 1, bad_certificate);
4282                                         }
4283                                         break;
4284                                 case TLS_UNSUPPORTED_CERTIFICATE:
4285                                         MARK;
4286                                         tls_alert(context, 1, unsupported_certificate);
4287                                         break;
4288                                 case TLS_NO_COMMON_CIPHER:
4289                                         MARK;
4290                                         tls_alert(context, 1, insufficient_security);
4291                                         break;
4292                                 case TLS_NOT_UNDERSTOOD:
4293                                         MARK;
4294                                         tls_alert(context, 1, internal_error);
4295                                         break;
4296                                 case TLS_NO_RENEGOTIATION:
4297                                         MARK;
4298                                         tls_alert(context, 0, no_renegotiation_RESERVED);
4299                                         payload_res = 0;
4300                                         break;
4301                                 case TLS_DECRYPTION_FAILED:
4302                                         MARK;
4303                                         tls_alert(context, 1, decryption_failed_RESERVED);
4304                                         break;
4305                         }
4306                         if (payload_res < 0) {
4307                                 return payload_res;
4308                         }
4309                 }
4310
4311                 if (certificate_verify_alert != no_error) {
4312                         payload_res = TLS_BAD_CERTIFICATE;
4313                         /* TODO this is set but not used */
4314                 }
4315
4316                 /* except renegotiation */
4317                 struct TLSPacket *pkt;
4318                 switch (write_packets) {
4319                         case 1:
4320                                 if (context->client_verified == 2) {
4321                                         tls_send_certificate(context);
4322                                         context->client_verified = 0;
4323                                 }
4324
4325                                 /* client handshake */
4326                                 tls_send_client_key_exchange(context);
4327                                 tls_send_change_cipher_spec(context);
4328
4329                                 context->cipher_spec_set = 1;
4330                                 context->local_sequence_number = 0;
4331
4332                                 tls_send_finished(context);
4333
4334                                 context->cipher_spec_set = 0;
4335                                 break;
4336                         case 2:
4337                                 /* server handshake */
4338                                 DEBUG_PRINT("<= SENDING SERVER HELLO\n");
4339                                 if (context->connection_status == 3) {
4340                                         context->connection_status = 2;
4341                                         tls_queue_packet
4342                                                 (tls_build_hello(context, 0));
4343                                         tls_send_change_cipher_spec(context);
4344                                         _private_tls13_key(context, 1);
4345                                         context->cipher_spec_set = 1;
4346                                         DEBUG_PRINT
4347                                                 ("<= SENDING ENCRYPTED EXTENSIONS\n");
4348                                         tls_send_encrypted_extensions(context);
4349
4350                                         if (context->request_client_certificate) {
4351                                                 DEBUG_PRINT
4352                                                         ("<= SENDING CERTIFICATE REQUEST\n");
4353                                                 tls_queue_packet
4354                                                         (tls_certificate_request
4355                                                          (context));
4356                                         }
4357
4358                                         tls_send_certificate(context);
4359                                         tls_send_certificate_verify(context);
4360                                         tls_send_finished(context);
4361
4362                                         /* new key */
4363                                         free(context->server_finished_hash);
4364
4365                                         context->server_finished_hash =
4366                                                 malloc(tls_mac_length(context));
4367
4368                                         if (context->server_finished_hash) {
4369                                                 tls_get_hash(context,
4370                                                                 context->server_finished_hash);
4371                                         }
4372
4373                                         break;
4374                                 }
4375                                 tls_queue_packet(tls_build_hello(context, 0));
4376                                 DEBUG_PRINT("<= SENDING CERTIFICATE\n");
4377                                 tls_send_certificate(context);
4378
4379                                 int ephemeral_cipher =
4380                                         tls_cipher_is_ephemeral(context);
4381                                 if (ephemeral_cipher) {
4382                                         DEBUG_PRINT
4383                                                 ("<= SENDING EPHEMERAL DH KEY\n");
4384                                         tls_send_server_key_exchange(context,
4385                                                         ephemeral_cipher == 1 ?
4386                                                         KEA_dhe_rsa :
4387                                                         KEA_ec_diffie_hellman);
4388                                 }
4389                                 if (context->request_client_certificate) {
4390                                         DEBUG_PRINT
4391                                                 ("<= SENDING CERTIFICATE REQUEST\n");
4392                                         tls_queue_packet
4393                                                 (tls_certificate_request
4394                                                  (context));
4395                                 }
4396                                 tls_send_done(context);
4397                                 break;
4398                         case 3:
4399                                 /* finished */
4400                                 tls_send_change_cipher_spec(context);
4401                                 tls_send_finished(context);
4402                                 context->connection_status = TLS_CONNECTED;
4403                                 break;
4404                         case 4:
4405                                 /* dtls only */
4406                                 /* TODO error */
4407                                 break;
4408                         case 5:
4409                                 /* hello retry request */
4410                                 DEBUG_PRINT("<= SENDING HELLO RETRY REQUEST\n");
4411                                 pkt = tls_build_hello(context, 0);
4412                                 tls_queue_packet(pkt);
4413                                 break;
4414                 }
4415                 payload_size++;
4416                 buf += payload_size;
4417                 buf_len -= payload_size;
4418         }
4419         LEAVE;
4420         return orig_len;
4421 }
4422
4423 unsigned int asn1_get_len(const unsigned char *buffer, int buf_len,
4424                           unsigned int *octets) {
4425         *octets = 0;
4426
4427         if (buf_len < 1) {
4428                 return 0;
4429         }
4430
4431         unsigned char size = buffer[0];
4432         int i;
4433         if (size & 0x80) {
4434                 *octets = size & 0x7F;
4435                 if ((int) *octets > buf_len - 1) {
4436                         return 0;
4437                 }
4438                 /* max 32 bits */
4439                 unsigned int ref_octets = *octets;
4440                 if (*octets > 4) {
4441                         ref_octets = 4;
4442                 }
4443                 if ((int) *octets > buf_len - 1) {
4444                         return 0;
4445                 }
4446                 unsigned int long_size = 0;
4447                 unsigned int coef = 1;
4448
4449                 for (i = ref_octets; i > 0; i--) {
4450                         long_size += buffer[i] * coef;
4451                         coef *= 0x100;
4452                 }
4453                 ++*octets;
4454                 return long_size;
4455         }
4456         ++*octets;
4457         return size;
4458 }
4459
4460 void print_index(const unsigned int *fields) {
4461         int i = 0;
4462         while (fields[i]) {
4463                 if (i) {
4464                         DEBUG_PRINT(".");
4465                 }
4466                 DEBUG_PRINT("%i", fields[i]);
4467                 i++;
4468         }
4469         while (i < 6) {
4470                 DEBUG_PRINT("  ");
4471                 i++;
4472         }
4473 }
4474
4475 int _is_field(const unsigned int *fields, const unsigned int *prefix) {
4476         int i = 0;
4477         while (prefix[i]) {
4478                 if (fields[i] != prefix[i]) {
4479                         return 0;
4480                 }
4481                 i++;
4482         }
4483         return 1;
4484 }
4485
4486 static int tls_hash_len(int algorithm) {
4487         switch (algorithm) {
4488                 case TLS_RSA_SIGN_MD5:
4489                         return 16;
4490                 case TLS_RSA_SIGN_SHA1:
4491                         return 20;
4492                 case TLS_RSA_SIGN_SHA256:
4493                         return 32;
4494                 case TLS_RSA_SIGN_SHA384:
4495                         return 48;
4496                 case TLS_RSA_SIGN_SHA512:
4497                         return 64;
4498         }
4499         return 0;
4500 }
4501
4502 static unsigned char *tls_compute_hash(int algorithm, const unsigned char
4503                 *message, unsigned int message_len) {
4504         unsigned char *hash = NULL;
4505         int err;
4506         int hash_index = -1;
4507         unsigned long hash_len = 0;
4508
4509         if (!message || !message_len) {
4510                 return hash;
4511         }
4512
4513         switch (algorithm) {
4514                 case TLS_RSA_SIGN_MD5:
4515                         DEBUG_PRINT("SIGN MD5\n");
4516                         hash_index = find_hash("md5");
4517                         hash_len = 16;
4518                         break;
4519                 case TLS_RSA_SIGN_SHA1:
4520                         DEBUG_PRINT("SIGN SHA1\n");
4521                         hash_index = find_hash("sha1");
4522                         hash_len = 20;
4523                         break;
4524                 case TLS_RSA_SIGN_SHA256:
4525                         DEBUG_PRINT("SIGN SHA256\n");
4526                         hash_index = find_hash("sha256");
4527                         hash_len = 32;
4528                         break;
4529                 case TLS_RSA_SIGN_SHA384:
4530                         DEBUG_PRINT("SIGN SHA384\n");
4531                         hash_index = find_hash("sha384");
4532                         hash_len = 48;
4533                         break;
4534                 case TLS_RSA_SIGN_SHA512:
4535                         DEBUG_PRINT("SIGN SHA512\n");
4536                         hash_index = find_hash("sha512");
4537                         hash_len = 64;
4538                         break;
4539                 default:
4540                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4541                         return NULL;
4542                         break;
4543         }
4544
4545         hash = malloc(hash_len);
4546         if (!hash) {
4547                 return NULL;
4548         }
4549
4550         err = hash_memory(hash_index, message, message_len, hash, &hash_len);
4551         if (err) {
4552                 return NULL;
4553         }
4554         return hash;
4555 }
4556
4557 int tls_certificate_verify_signature(struct TLSCertificate *cert,
4558                                      struct TLSCertificate *parent) {
4559         if (!cert || !parent || !cert->sign_key
4560             || !cert->fingerprint || !cert->sign_len
4561             || !parent->der_bytes || !parent->der_len) {
4562                 DEBUG_PRINT("CANNOT VERIFY SIGNATURE ");
4563                 if (!cert) {
4564                         DEBUG_PRINT("!cert ");
4565                 } else {
4566                         if (!cert->sign_key) {
4567                                 DEBUG_PRINT("!cert->sign_key ");
4568                         }
4569                         if (!cert->fingerprint) {
4570                                 DEBUG_PRINT("!cert->fingerprint ");
4571                         }
4572                         if (!cert->sign_len) {
4573                                 DEBUG_PRINT("!cert->sign_len ");
4574                         }
4575                 }
4576
4577                 if (!parent) {
4578                         DEBUG_PRINT("!parent ");
4579                 } else {
4580                         if (!parent->der_bytes) {
4581                                 DEBUG_PRINT("!parent->der_bytes ");
4582                         }
4583                         if (!parent->der_len) {
4584                                 DEBUG_PRINT("!parent->der_len ");
4585                         }
4586                 }
4587                 DEBUG_PRINT("\n");
4588
4589                 return 0;
4590         }
4591         DEBUG_PRINT("checking alg\n");
4592         int hash_len = tls_hash_len(cert->algorithm);
4593         if (hash_len <= 0) {
4594                 return 0;
4595         }
4596
4597         int hash_index;
4598         switch (cert->algorithm) {
4599                 case TLS_RSA_SIGN_MD5:
4600                         hash_index = find_hash("md5");
4601                         break;
4602                 case TLS_RSA_SIGN_SHA1:
4603                         hash_index = find_hash("sha1");
4604                         break;
4605                 case TLS_RSA_SIGN_SHA256:
4606                         hash_index = find_hash("sha256");
4607                         break;
4608                 case TLS_RSA_SIGN_SHA384:
4609                         hash_index = find_hash("sha384");
4610                         break;
4611                 case TLS_RSA_SIGN_SHA512:
4612                         hash_index = find_hash("sha512");
4613                         break;
4614                 default:
4615                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4616                         return 0;
4617         }
4618
4619         rsa_key key;
4620         DEBUG_PRINTLN("rsa_import(%p, %d, %p)\n", parent->der_bytes,
4621                       parent->der_len, &key);
4622         int err = rsa_import(parent->der_bytes, parent->der_len, &key);
4623         if (err) {
4624                 DEBUG_PRINTLN
4625                     ("Error importing RSA certificate (code: %i)\n", err);
4626                 DEBUG_PRINT("Message: %s\n", error_to_string(err));
4627                 DEBUG_DUMP_HEX_LABEL("CERTIFICATE", parent->der_bytes,
4628                                      parent->der_len);
4629                 return 0;
4630         }
4631         int rsa_stat = 0;
4632         unsigned char *signature = cert->sign_key;
4633         int signature_len = cert->sign_len;
4634         if (!signature[0]) {
4635                 signature++;
4636                 signature_len--;
4637         }
4638
4639         err = rsa_verify_hash_ex(signature, signature_len, cert->fingerprint,
4640                         hash_len, LTC_PKCS_1_V1_5, hash_index, 0, &rsa_stat,
4641                         &key);
4642
4643         rsa_free(&key);
4644         if (err) {
4645                 DEBUG_PRINT("HASH VERIFY ERROR %i\n", err);
4646                 return 0;
4647         }
4648         DEBUG_PRINT("CERTIFICATE VALIDATION: %i\n", rsa_stat);
4649         return rsa_stat;
4650 }
4651
4652 int tls_certificate_chain_is_valid(struct TLSCertificate **certificates,
4653                                    int len) {
4654         if (!certificates || !len) {
4655                 return bad_certificate;
4656         }
4657
4658         int i;
4659         DEBUG_PRINT("verifying %i length cert chain\n", len);
4660         len--;
4661
4662         /* expired certificate or not yet valid ? */
4663         if (tls_certificate_is_valid(certificates[0])) {
4664                 return bad_certificate;
4665         }
4666
4667         /* check */
4668         for (i = 0; i < len; i++) {
4669                 /* certificate in chain is expired ? */
4670                 if (tls_certificate_is_valid(certificates[i + 1])) {
4671                         return bad_certificate;
4672                 }
4673
4674                 if (!tls_certificate_verify_signature(certificates[i],
4675                                         certificates[i + 1])) {
4676                         DEBUG_PRINT
4677                             ("tls_certificate_verify_signature certs[%d], certs[%d+1] failed\n",
4678                              i, i);
4679                         return bad_certificate;
4680                 }
4681
4682         }
4683         return 0;
4684 }
4685
4686 int tls_certificate_chain_is_valid_root(struct TLSContext *context, struct
4687                 TLSCertificate **certificates, int len) {
4688         int i, j;
4689
4690         if (!certificates || !len || !context->root_certificates
4691             || !context->root_count) {
4692                 return bad_certificate;
4693         }
4694         for (i = 0; i < len; i++) {
4695                 for (j = 0; j < context->root_count; j++) {
4696                         /* check if root certificate expired */
4697                         if (tls_certificate_is_valid
4698                             (context->root_certificates[j])) {
4699                                 continue;
4700                         }
4701                         /* if any root validates any certificate in the chain,
4702                          * then is root validated */
4703                         if (tls_certificate_verify_signature(certificates[i],
4704                                                 context->root_certificates[j]))
4705                         {
4706                                 return 0;
4707                         }
4708                 }
4709         }
4710         return bad_certificate;
4711 }
4712
4713 int _private_is_oid(struct OID_chain *ref_chain,
4714                     const unsigned char *looked_oid, int looked_oid_len) {
4715         while (ref_chain) {
4716                 if (ref_chain->oid) {
4717                         if (_is_oid2
4718                             (ref_chain->oid, looked_oid, 16,
4719                              looked_oid_len)) {
4720                                 return 1;
4721                         }
4722                 }
4723                 ref_chain = (struct OID_chain *) ref_chain->top;
4724         }
4725         return 0;
4726 }
4727
4728 int _private_asn1_parse(struct TLSContext *context,
4729                         struct TLSCertificate *cert,
4730                         const unsigned char *buffer, int size, int level,
4731                         unsigned int *fields, unsigned char *has_key,
4732                         int client_cert, unsigned char *top_oid,
4733                         struct OID_chain *chain) {
4734         struct OID_chain local_chain;
4735         DEBUG_INDEX(fields);
4736         DEBUG_PRINT("\n");
4737         local_chain.top = chain;
4738         int pos = 0;
4739         /* X.690 */
4740         int idx = 0;
4741         unsigned char oid[16];
4742         memset(oid, 0, 16);
4743         local_chain.oid = oid;
4744         if (has_key) {
4745                 *has_key = 0;
4746         }
4747         unsigned char local_has_key = 0;
4748         const unsigned char *cert_data = NULL;
4749         unsigned int cert_len = 0;
4750         while (pos < size) {
4751                 unsigned int start_pos = pos;
4752                 if (size - pos < 2) {
4753                         return TLS_NEED_MORE_DATA;
4754                 }
4755                 unsigned char first = buffer[pos++];
4756                 unsigned char type = first & 0x1F;
4757                 unsigned char constructed = first & 0x20;
4758                 unsigned char element_class = first >> 6;
4759                 int octets = 0;
4760                 unsigned int temp;
4761                 idx++;
4762                 if (level <= TLS_ASN1_MAXLEVEL) {
4763                         fields[level - 1] = idx;
4764                 }
4765                 DEBUG_INDEX(fields);
4766                 DEBUG_PRINT("\n");
4767                 int length = asn1_get_len((unsigned char *) &buffer[pos], size
4768                                 - pos, &octets);
4769                 DEBUG_PRINT("asn1_get_len = %u\n", length);
4770                 if ((octets > 4) || (octets > size - pos)) {
4771                         DEBUG_PRINT
4772                             ("CANNOT READ CERTIFICATE octets = %d, size = %d pos = %d, size - pos = %d\n",
4773                              octets, size, pos, size - pos);
4774                         return pos;
4775                 }
4776                 pos += octets;
4777
4778                 if (size - pos < length) {
4779                         return TLS_NEED_MORE_DATA;
4780                 }
4781
4782                 /*DEBUG_PRINT("FIRST: %x => %x (%i)\n", (int)first, (int)type, length); */
4783                 /* sequence */
4784                 /*DEBUG_PRINT("%2i: ", level); */
4785 #ifdef DEBUG
4786                 DEBUG_INDEX(fields);
4787                 int i1;
4788                 for (i1 = 1; i1 < level; i1++) {
4789                         DEBUG_PRINT("  ");
4790                 }
4791 #endif
4792
4793                 if (length && constructed) {
4794                         switch (type) {
4795                                 case 0x03:
4796                                         DEBUG_PRINT("CONSTRUCTED BITSTREAM\n");
4797                                         break;
4798                                 case 0x10:
4799                                 DEBUG_PRINT("SEQUENCE\n");
4800                                 if ((level == 2) && (idx == 1)) {
4801                                         cert_len =
4802                                             length + (pos - start_pos);
4803                                         cert_data = &buffer[start_pos];
4804                                 }
4805                                 /* private key on server or public key on client */
4806                                 if (!cert->version
4807                                     && (_is_field(fields, priv_der_id))) {
4808                                         free(cert->der_bytes);
4809                                         temp = length + (pos - start_pos);
4810                                         cert->der_bytes = malloc(temp);
4811                                         if (cert->der_bytes) {
4812                                                 memcpy(cert->der_bytes,
4813                                                        &buffer[start_pos],
4814                                                        temp);
4815                                                 cert->der_len = temp;
4816                                         } else
4817                                                 cert->der_len = 0;
4818                                 }
4819                                 break;
4820                         case 0x11:
4821                                 DEBUG_PRINT("EMBEDDED PDV\n");
4822                                 break;
4823                         case 0x00:
4824                                 if (element_class == 0x02) {
4825                                         DEBUG_PRINT("CONTEXT-SPECIFIC\n");
4826                                         break;
4827                                 }
4828                         default:
4829                                 DEBUG_PRINT("CONSTRUCT TYPE %02X\n",(int)type);
4830                         }
4831
4832                         local_has_key = 0;
4833                         _private_asn1_parse(context, cert, &buffer[pos],
4834                                             length, level + 1, fields,
4835                                             &local_has_key, client_cert,
4836                                             top_oid, &local_chain);
4837                         if (((local_has_key && context
4838                               && (!context->is_server || client_cert))
4839                              || !context)
4840                             && (_is_field(fields, pk_id))) {
4841                                 free(cert->der_bytes);
4842                                 temp = length + (pos - start_pos);
4843                                 cert->der_bytes = malloc(temp);
4844                                 if (cert->der_bytes) {
4845                                         memcpy(cert->der_bytes,
4846                                                &buffer[start_pos], temp);
4847                                         cert->der_len = temp;
4848                                 } else {
4849                                         cert->der_len = 0;
4850                                 }
4851                         }
4852                 } else {
4853                         switch (type) {
4854                         case 0x00:
4855                                 /* end of content */
4856                                 DEBUG_PRINT("END OF CONTENT\n");
4857                                 return pos;
4858                                 break;
4859                         case 0x01:
4860                                 /* boolean */
4861                                 temp = buffer[pos];
4862                                 DEBUG_PRINT("BOOLEAN: %i\n", temp);
4863                                 break;
4864                         case 0x02:
4865                                 /* integer */
4866                                 if (_is_field(fields, pk_id)) {
4867                                         if (has_key) {
4868                                                 *has_key = 1;
4869                                         }
4870
4871                                         if (idx == 1) {
4872                                                 tls_certificate_set_key
4873                                                     (cert, &buffer[pos],
4874                                                      length);
4875                                         } else if (idx == 2) {
4876                                                 tls_certificate_set_exponent
4877                                                     (cert, &buffer[pos],
4878                                                      length);
4879                                         }
4880                                 } else if (_is_field(fields, serial_id)) {
4881                                         tls_certificate_set_serial(cert,
4882                                                                    &buffer
4883                                                                    [pos],
4884                                                                    length);
4885                                 }
4886
4887                                 if (_is_field(fields, version_id)) {
4888                                         if (length == 1) {
4889                                                 cert->version =
4890                                                     buffer[pos];
4891                                         }
4892 #ifdef TLS_X509_V1_SUPPORT
4893                                         else {
4894                                                 cert->version = 0;
4895                                         }
4896                                         idx++;
4897 #endif
4898                                 }
4899                                 if (level >= 2) {
4900                                         unsigned int fields_temp[3];
4901                                         fields_temp[0] = fields[level - 2];
4902                                         fields_temp[1] = fields[level - 1];
4903                                         fields_temp[2] = 0;
4904                                         if (_is_field
4905                                             (fields_temp, priv_id)) {
4906                                                 tls_certificate_set_priv
4907                                                     (cert, &buffer[pos],
4908                                                      length);
4909                                         }
4910                                 }
4911                                 DEBUG_PRINT("INTEGER(%i): ", length);
4912                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4913                                 if ((chain) && (length > 2)) {
4914                                         if (_private_is_oid
4915                                             (chain, san_oid,
4916                                              sizeof(san_oid) - 1)) {
4917                                                 void *new;
4918
4919                                                 new =
4920                                                     TLS_REALLOC(cert->san,
4921                                                                 sizeof
4922                                                                 (unsigned
4923                                                                  char *) *
4924                                                                 (cert->
4925                                                                  san_length
4926                                                                  + 1));
4927                                                 if (new) {
4928                                                         cert->san = new;
4929                                                         cert->san[cert->
4930                                                                   san_length]
4931                                                             = NULL;
4932                                                         tls_certificate_set_copy
4933                                                             (&cert->
4934                                                              san[cert->
4935                                                                  san_length],
4936                                                              &buffer[pos],
4937                                                              length);
4938                                                         DEBUG_PRINT
4939                                                             (" => SUBJECT ALTERNATIVE NAME: %s",
4940                                                              cert->
4941                                                              san[cert->
4942                                                                  san_length]);
4943                                                         cert->san_length++;
4944                                                 } else {
4945                                                         free(cert->
4946                                                                  san);
4947                                                         cert->san = 0;
4948                                                         cert->san_length =
4949                                                             0;
4950                                                 }
4951                                         }
4952                                 }
4953                                 DEBUG_PRINT("\n");
4954                                 break;
4955                         case 0x03:
4956                                 if (_is_field(fields, pk_id)) {
4957                                         if (has_key)
4958                                                 *has_key = 1;
4959                                 }
4960                                 /* bitstream */
4961                                 DEBUG_PRINT("BITSTREAM(%i): ", length);
4962                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4963                                 DEBUG_PRINT("\n");
4964                                 if (_is_field(fields, sign_id)
4965                                     || _is_field(fields, sign_id2)) {
4966                                         DEBUG_PRINT("set sign key\n");
4967                                         tls_certificate_set_sign_key(cert,
4968                                                                      &buffer
4969                                                                      [pos],
4970                                                                      length);
4971                                 } else if (cert->ec_algorithm
4972                                            && (_is_field(fields, pk_id))) {
4973                                         tls_certificate_set_key(cert,
4974                                                                 &buffer
4975                                                                 [pos],
4976                                                                 length);
4977                                 } else {
4978                                         if (buffer[pos] == 0x00
4979                                             && length > 256) {
4980                                                 _private_asn1_parse
4981                                                     (context, cert,
4982                                                      &buffer[pos] + 1,
4983                                                      length - 1, level + 1,
4984                                                      fields,
4985                                                      &local_has_key,
4986                                                      client_cert, top_oid,
4987                                                      &local_chain);
4988                                         } else {
4989                                                 _private_asn1_parse
4990                                                     (context, cert,
4991                                                      &buffer[pos], length,
4992                                                      level + 1, fields,
4993                                                      &local_has_key,
4994                                                      client_cert, top_oid,
4995                                                      &local_chain);
4996                                         }
4997
4998                                         if (top_oid) {
4999                                                 if (_is_oid2
5000                                                     (top_oid,
5001                                                      TLS_EC_prime256v1_OID,
5002                                                      sizeof(oid),
5003                                                      sizeof
5004                                                      (TLS_EC_prime256v1) -
5005                                                      1)) {
5006                                                         cert->
5007                                                             ec_algorithm =
5008                                                             secp256r1.iana;
5009                                                 } else
5010                                                     if (_is_oid2
5011                                                         (top_oid,
5012                                                          TLS_EC_secp224r1_OID,
5013                                                          sizeof(oid),
5014                                                          sizeof
5015                                                          (TLS_EC_secp224r1_OID)
5016                                                          - 1)) {
5017                                                         cert->
5018                                                             ec_algorithm =
5019                                                             secp224r1.iana;
5020                                                 } else
5021                                                     if (_is_oid2
5022                                                         (top_oid,
5023                                                          TLS_EC_secp384r1_OID,
5024                                                          sizeof(oid),
5025                                                          sizeof
5026                                                          (TLS_EC_secp384r1_OID)
5027                                                          - 1)) {
5028                                                         cert->
5029                                                             ec_algorithm =
5030                                                             secp384r1.iana;
5031                                                 } else
5032                                                     if (_is_oid2
5033                                                         (top_oid,
5034                                                          TLS_EC_secp521r1_OID,
5035                                                          sizeof(oid),
5036                                                          sizeof
5037                                                          (TLS_EC_secp521r1_OID)
5038                                                          - 1)) {
5039                                                         cert->
5040                                                             ec_algorithm =
5041                                                             secp521r1.iana;
5042                                                 }
5043                                                 if ((cert->ec_algorithm)
5044                                                     && (!cert->pk))
5045                                                         tls_certificate_set_key
5046                                                             (cert,
5047                                                              &buffer[pos],
5048                                                              length);
5049                                         }
5050                                 }
5051                                 break;
5052                         case 0x04:
5053                                 if (top_oid && _is_field(fields, ecc_priv_id)
5054                                                 && !cert->priv) {
5055                                         DEBUG_PRINT("BINARY STRING(%i): ",
5056                                                     length);
5057                                         DEBUG_DUMP_HEX(&buffer[pos],
5058                                                        length);
5059                                         DEBUG_PRINT("\n");
5060                                         tls_certificate_set_priv(cert,
5061                                                                  &buffer
5062                                                                  [pos],
5063                                                                  length);
5064                                 } else {
5065                                         _private_asn1_parse(context, cert,
5066                                                             &buffer[pos],
5067                                                             length,
5068                                                             level + 1,
5069                                                             fields,
5070                                                             &local_has_key,
5071                                                             client_cert,
5072                                                             top_oid,
5073                                                             &local_chain);
5074                                 }
5075                                 break;
5076                         case 0x05:
5077                                 DEBUG_PRINT("NULL\n");
5078                                 break;
5079                         case 0x06:
5080                                 /* object identifier */
5081                                 if (_is_field(fields, pk_id)) {
5082                                         if (length == 8 || length == 5) {
5083                                                 tls_certificate_set_algorithm
5084                                                     (&cert->ec_algorithm,
5085                                                      &buffer[pos], length);
5086                                         } else {
5087                                                 tls_certificate_set_algorithm
5088                                                     (&cert->key_algorithm,
5089                                                      &buffer[pos], length);
5090                                         }
5091                                 }
5092                                 if (_is_field(fields, algorithm_id))
5093                                         tls_certificate_set_algorithm
5094                                             (&cert->algorithm,
5095                                              &buffer[pos], length);
5096
5097                                 DEBUG_PRINT("OBJECT IDENTIFIER(%i): ", length);
5098                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5099                                 DEBUG_PRINT("\n");
5100                                 /* check previous oid */
5101                                 if (_is_oid2
5102                                     (oid, ocsp_oid, 16,
5103                                      sizeof(ocsp_oid) - 1))
5104                                         tls_certificate_set_copy(&cert->ocsp,
5105                                                                  &buffer[pos],
5106                                                                  length);
5107
5108                                 if (length < 16) {
5109                                         memcpy(oid, &buffer[pos], length);
5110                                 } else {
5111                                         memcpy(oid, &buffer[pos], 16);
5112                                 }
5113                                 if (top_oid)
5114                                         memcpy(top_oid, oid, 16);
5115                                 break;
5116                         case 0x09:
5117                                 DEBUG_PRINT("REAL NUMBER(%i): ", length);
5118                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5119                                 DEBUG_PRINT("\n");
5120                                 break;
5121                         case 0x17:
5122                                 /* utc time */
5123                                 DEBUG_PRINT("UTC TIME: [");
5124                                 DEBUG_DUMP(&buffer[pos], length);
5125                                 DEBUG_PRINT("]\n");
5126
5127                                 if (_is_field(fields, validity_id)) {
5128                                         if (idx == 1) {
5129                                                 tls_certificate_set_copy_date
5130                                                     (cert->not_before,
5131                                                      &buffer[pos], length);
5132                                         } else {
5133                                                 tls_certificate_set_copy_date
5134                                                     (cert->not_after,
5135                                                      &buffer[pos], length);
5136                                         }
5137                                 }
5138                                 break;
5139                         case 0x18:
5140                                 /* generalized time */
5141                                 DEBUG_PRINT("GENERALIZED TIME: [");
5142                                 DEBUG_DUMP(&buffer[pos], length);
5143                                 DEBUG_PRINT("]\n");
5144                                 break;
5145                         case 0x13:
5146                                 /* printable string */
5147                         case 0x0C:
5148                         case 0x14:
5149                         case 0x15:
5150                         case 0x16:
5151                         case 0x19:
5152                         case 0x1A:
5153                         case 0x1B:
5154                         case 0x1C:
5155                         case 0x1D:
5156                         case 0x1E:
5157                                 if (_is_field(fields, issurer_id)) {
5158                                         if (_is_oid(oid, country_oid, 3)) {
5159                                                 tls_certificate_set_copy
5160                                                     (&cert->issuer_country,
5161                                                      &buffer[pos], length);
5162                                         } else if (_is_oid
5163                                                  (oid, state_oid, 3)) {
5164                                                 tls_certificate_set_copy
5165                                                     (&cert->issuer_state,
5166                                                      &buffer[pos], length);
5167                                         } else if (_is_oid
5168                                                  (oid, location_oid, 3)) {
5169                                                 tls_certificate_set_copy
5170                                                     (&cert->
5171                                                      issuer_location,
5172                                                      &buffer[pos], length);
5173                                         } else if (_is_oid
5174                                                  (oid, entity_oid, 3)) {
5175                                                 tls_certificate_set_copy
5176                                                     (&cert->issuer_entity,
5177                                                      &buffer[pos], length);
5178                                         } else if (_is_oid
5179                                                  (oid, subject_oid, 3)) {
5180                                                 tls_certificate_set_copy
5181                                                     (&cert->issuer_subject,
5182                                                      &buffer[pos], length);
5183                                         }
5184                                 } else if (_is_field(fields, owner_id)) {
5185                                         if (_is_oid(oid, country_oid, 3)) {
5186                                                 tls_certificate_set_copy
5187                                                     (&cert->country,
5188                                                      &buffer[pos], length);
5189                                         } else if (_is_oid
5190                                                  (oid, state_oid, 3)) {
5191                                                 tls_certificate_set_copy
5192                                                     (&cert->state,
5193                                                      &buffer[pos], length);
5194                                         } else if (_is_oid
5195                                                  (oid, location_oid, 3)) {
5196                                                 tls_certificate_set_copy
5197                                                     (&cert->location,
5198                                                      &buffer[pos], length);
5199                                         } else if (_is_oid
5200                                                  (oid, entity_oid, 3)) {
5201                                                 tls_certificate_set_copy
5202                                                     (&cert->entity,
5203                                                      &buffer[pos], length);
5204                                         } else if (_is_oid
5205                                                  (oid, subject_oid, 3)) {
5206                                                 tls_certificate_set_copy
5207                                                     (&cert->subject,
5208                                                      &buffer[pos], length);
5209                                         }
5210                                 }
5211                                 DEBUG_PRINT("STR: [");
5212                                 DEBUG_DUMP(&buffer[pos], length);
5213                                 DEBUG_PRINT("]\n");
5214                                 break;
5215                         case 0x10:
5216                                 DEBUG_PRINT("EMPTY SEQUENCE\n");
5217                                 break;
5218                         case 0xA:
5219                                 DEBUG_PRINT("ENUMERATED(%i): ", length);
5220                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5221                                 DEBUG_PRINT("\n");
5222                                 break;
5223                         default:
5224                                 DEBUG_PRINT("========> NOT SUPPORTED %x\n",
5225                                             (int) type);
5226                                 /* not supported / needed */
5227                                 break;
5228                         }
5229                 }
5230                 pos += length;
5231         }
5232
5233         if (cert_len && cert_data) {
5234                 int h = find_hash("sha256");
5235                 size_t len = sizeof cert->fp;
5236                 hash_memory(h, cert_data,cert_len, cert->fp, &len);
5237         }
5238
5239         if (level == 2 && cert->sign_key && cert->sign_len
5240             && cert_len && cert_data) {
5241                 free(cert->fingerprint);
5242                 cert->fingerprint = tls_compute_hash(cert->algorithm,
5243                                 cert_data, cert_len);
5244 #ifdef DEBUG
5245                 if (cert->fingerprint) {
5246                         DEBUG_DUMP_HEX_LABEL("FINGERPRINT",
5247                                              cert->fingerprint,
5248                                              tls_hash_len(cert->algorithm));
5249                 }
5250 #endif
5251         }
5252         return pos;
5253 }
5254
5255 struct TLSCertificate *asn1_parse(struct TLSContext *context,
5256                                   const unsigned char *buffer, int size,
5257                                   int client_cert) {
5258         unsigned int fields[TLS_ASN1_MAXLEVEL] = { 0 };
5259
5260         struct TLSCertificate *cert = tls_create_certificate();
5261
5262         if (cert) {
5263                 if (client_cert < 0) {
5264                         client_cert = 0;
5265                         /* private key */
5266                         unsigned char top_oid[16];
5267                         memset(top_oid, 0, sizeof(top_oid));
5268                         _private_asn1_parse(context, cert, buffer, size, 1,
5269                                             fields, NULL, client_cert,
5270                                             top_oid, NULL);
5271                 } else {
5272                         _private_asn1_parse(context, cert, buffer, size, 1,
5273                                             fields, NULL, client_cert,
5274                                             NULL, NULL);
5275                 }
5276         }
5277         return cert;
5278 }
5279
5280 int tls_clear_certificates(struct TLSContext *tls) {
5281         int i;
5282
5283         if (!tls || !tls->is_server || tls->is_child) {
5284                 return TLS_GENERIC_ERROR;
5285         }
5286
5287         if (tls->root_certificates) {
5288                 for (i = 0; i < tls->root_count; i++) {
5289                         tls_destroy_certificate(tls->root_certificates[i]);
5290                 }
5291         }
5292         tls->root_certificates = NULL;
5293         tls->root_count = 0;
5294
5295         if (tls->private_key) {
5296                 tls_destroy_certificate(tls->private_key);
5297         }
5298         tls->private_key = NULL;
5299         if (tls->ec_private_key) {
5300                 tls_destroy_certificate(tls->ec_private_key);
5301         }
5302         tls->ec_private_key = NULL;
5303         free(tls->certificates);
5304         tls->certificates = NULL;
5305         tls->certificates_count = 0;
5306         return 0;
5307 }
5308
5309 /* This is just a wrapper around parse message so we don't
5310  * call read more often than necessary.  IOW, if there's
5311  * more than one record in the input buffer, process them all
5312  */
5313 int tls_consume_stream(struct TLSContext *context) {
5314         if (!context) {
5315                 return TLS_GENERIC_ERROR;
5316         }
5317
5318         if (context->critical_error) {
5319                 return TLS_BROKEN_CONNECTION;
5320         }
5321
5322         size_t tls_buffer_len = context->input_buffer.len;
5323         unsigned char *buffer = context->input_buffer.buffer;
5324
5325         unsigned int index = 0;
5326         int err_flag = 0;
5327
5328         int tls_header_size;
5329         int tls_size_offset;
5330
5331         tls_size_offset = 3;
5332         tls_header_size = 5;
5333
5334         while (tls_buffer_len >= 5) {
5335                 uint16_t length;
5336
5337                 length = get16(buffer + index + tls_size_offset)
5338                     + tls_header_size;
5339
5340                 if (length > tls_buffer_len) {
5341                         /* record not complete */
5342                         break;
5343                 }
5344
5345                 /* This is the only place tls_parse_message is called */
5346                 int consumed = tls_parse_message(context, buffer+index, length);
5347                 if (consumed < 0) {
5348                         fprintf(stderr, "parse message error: %d\n", consumed);
5349                         err_flag = consumed;
5350                         break;
5351                 }
5352                 index += length;
5353                 tls_buffer_len -= length;
5354                 if (context->critical_error) {
5355                         err_flag = TLS_BROKEN_CONNECTION;
5356                         break;
5357                 }
5358         }
5359
5360         if (err_flag || context->input_buffer.error) {
5361                 if (!context->critical_error) {
5362                         context->critical_error = 1;
5363                 }
5364                 DEBUG_PRINT("ERROR IN CONSUME: %i\n", err_flag);
5365                 tls_buffer_free(&context->input_buffer);
5366                 return err_flag;
5367         }
5368         tls_buffer_shift(&context->input_buffer, index);
5369         return index;
5370 }
5371
5372 void tls_close_notify(struct TLSContext *context) {
5373         if (!context || context->critical_error) {
5374                 return;
5375         }
5376         context->critical_error = 1;
5377         DEBUG_PRINT("CLOSE\n");
5378         tls_alert(context, 0, close_notify);
5379 }
5380
5381 void tls_alert(struct TLSContext *context, int critical, int code) {
5382         if (!context) {
5383                 return;
5384         }
5385
5386         struct TLSPacket *packet = tls_create_packet(context, TLS_ALERT,
5387                         context->version, 0);
5388         tls_packet_uint8(packet, critical ? TLS_ALERT_CRITICAL :
5389                         TLS_ALERT_WARNING);
5390
5391         tls_packet_uint8(packet, code);
5392         tls_packet_update(packet);
5393
5394         if (critical) {
5395                 context->critical_error = 1;
5396         }
5397
5398         tls_queue_packet(packet);
5399 }
5400
5401 int tls_is_broken(struct TLSContext *context) {
5402         if (!context || context->critical_error) {
5403                 return 1;
5404         }
5405         return 0;
5406 }
5407
5408 /* TODO I don't see that this ever gets cleared */
5409 int tls_request_client_certificate(struct TLSContext *context) {
5410         if (!context || !context->is_server) {
5411                 return 0;
5412         }
5413
5414         context->request_client_certificate = 1;
5415         return 1;
5416 }
5417
5418 int tls_client_verified(struct TLSContext *context) {
5419         if (!context || context->critical_error) {
5420                 return 0;
5421         }
5422
5423         return context->client_verified == 1;
5424 }
5425
5426 int tls_sni_set(struct TLSContext *context, const char *sni) {
5427         if (!context || context->is_server || context->critical_error
5428             || context->connection_status != 0) {
5429                 return 0;
5430         }
5431
5432         free(context->sni);
5433         errno = 0;
5434         context->sni = sni ? strdup(sni) : 0;
5435         return context->sni ? 1 : 0;
5436 }
5437
5438 int tls_default_verify(struct TLSContext *context,
5439                        struct TLSCertificate **certificate_chain, int len)
5440 {
5441         int i;
5442         int err;
5443
5444         if (certificate_chain) {
5445                 for (i = 0; i < len; i++) {
5446                         struct TLSCertificate *certificate =
5447                             certificate_chain[i];
5448                         /* check validity date */
5449                         err = tls_certificate_is_valid(certificate);
5450                         if (err) {
5451                                 return err;
5452                         }
5453                 }
5454         }
5455         /* check if chain is valid */
5456         err = tls_certificate_chain_is_valid(certificate_chain, len);
5457         if (err) {
5458                 return err;
5459         }
5460
5461         /* check certificate subject */
5462         if (!context->is_server && context->sni && len > 0
5463             && certificate_chain) {
5464                 err = tls_certificate_valid_subject(certificate_chain[0],
5465                                 context->sni);
5466                 if (err) {
5467                         return err;
5468                 }
5469         }
5470
5471         err = tls_certificate_chain_is_valid_root(context, certificate_chain,
5472                                                 len);
5473         if (err) {
5474                 return err;
5475         }
5476
5477         DEBUG_PRINT("Certificate OK\n");
5478         return no_error;
5479 }
5480
5481 ssize_t tls_fsync(struct TLSContext *context) {
5482         size_t buflen = 0;
5483         size_t offset = 0;
5484         ssize_t send_res = 0;
5485         int fd;
5486         unsigned char *buffer;
5487         tls_send_func write_cb = NULL;
5488
5489         if (!context) {
5490                 return 0;
5491         }
5492
5493         fd = context->fd;
5494         if (fd < 0) {
5495                 return -1;
5496         }
5497
5498         buffer = context->output_buffer.buffer;
5499         buflen = context->output_buffer.len;
5500
5501         if (context->send) {
5502                 write_cb = context->send;
5503         } else {
5504                 write_cb = send;
5505         }
5506
5507         while (buflen > 0) {
5508                 ssize_t res;
5509                 errno = 0;
5510                 res = write_cb(fd, buffer+offset, buflen, 0);
5511                 if (res <= 0) {
5512                         perror("send error");
5513                         send_res = res;
5514                         break;
5515                 }
5516                 buflen -= res;
5517                 offset += res;
5518                 send_res += res;
5519         }
5520         DEBUG_PRINT("sent %zd bytes\n", send_res);
5521         context->output_buffer.len = 0;
5522         return send_res;
5523 }
5524
5525 void tls_free(struct TLSContext *context) {
5526         if (context) {
5527                 free(context->user_data);
5528                 tls_destroy_context(context);
5529         }
5530 }
5531
5532 int tls_set_fd(struct TLSContext *context, int socket) {
5533         if (!context) {
5534                 return TLS_GENERIC_ERROR;
5535         }
5536         context->fd = socket;
5537         return 0;
5538 }
5539
5540 int tls_load_root_file(struct TLSContext *context, const char *pem_filename) {
5541         int fd;
5542         struct stat st;
5543         void *addr;
5544
5545         if (!context) {
5546                 return -1;
5547         }
5548
5549         int count = -1;
5550
5551         fd = open(pem_filename, O_RDONLY);
5552         if (fd == -1) {
5553                 return -1;
5554         }
5555
5556         if (fstat(fd, &st) == -1) {
5557                 close(fd);
5558                 return -1;
5559         }
5560
5561         addr = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
5562         if (addr == MAP_FAILED) {
5563                 close(fd);
5564                 return -1;
5565         }
5566
5567         count = tls_load_root_certificates(context, addr, st.st_size);
5568         munmap(addr, st.st_size);
5569         close(fd);
5570
5571         return count;
5572 }
5573
5574 void tls_set_verify(struct TLSContext *tls, tls_validation_function vfunc) {
5575         if (tls) {
5576                 tls->certificate_verify = vfunc;
5577         }
5578 }
5579
5580 static ssize_t tls_safe_read(struct TLSContext *tls) {
5581         tls_recv_func read_cb;
5582         char buffer[8192];
5583         ssize_t bytes;
5584
5585         if (!tls || tls->fd <= 0) {
5586                 return TLS_GENERIC_ERROR;
5587         }
5588
5589         if (tls->recv) {
5590                 read_cb = tls->recv;
5591         } else {
5592                 read_cb = recv;
5593         }
5594
5595         errno = 0;
5596         bytes = read_cb(tls->fd, buffer, sizeof buffer, 0);
5597         if (bytes > 0) {
5598                 tls_buffer_append(&tls->input_buffer, buffer, bytes);
5599         }
5600
5601         return bytes;
5602 }
5603
5604 /* I think this is the server handshake */
5605 int SSL_accept(struct TLSContext *context) {
5606         ssize_t read_size = 0;
5607
5608         if (!context || context->fd <= 0) {
5609                 return TLS_GENERIC_ERROR;
5610         }
5611
5612         if (tls_established(context)) {
5613                 return 1;
5614         }
5615
5616         /* accept */
5617         while ((read_size = tls_safe_read(context)) > 0) {
5618                 if (tls_consume_stream(context) >= 0) {
5619                         ssize_t res = tls_fsync(context);
5620                         if (res < 0) {
5621                                 return res;
5622                         }
5623                 }
5624                 if (tls_established(context)) {
5625                         return 1;
5626                 }
5627         }
5628         if (read_size <= 0) {
5629                 return TLS_BROKEN_CONNECTION;
5630         }
5631         return 0;
5632 }
5633
5634 /* TODO this is really do the handshake */
5635 int tls_connect(struct TLSContext *context) {
5636         int res;
5637         ssize_t read_size;
5638
5639         MARK;
5640         if (!context || context->fd < 0 || context->critical_error) {
5641                 if (!context) {
5642                         MARK;
5643                 } else if (context->fd < 0) {
5644                         MARK;
5645                 } else {
5646                         MARK;
5647                 }
5648
5649                 return TLS_GENERIC_ERROR;
5650         }
5651
5652         MARK;
5653         if (context->is_server) {
5654                 return TLS_UNEXPECTED_MESSAGE;
5655         }
5656         MARK;
5657
5658         res = tls_queue_packet(tls_build_client_hello(context));
5659
5660         MARK;
5661         if (res < 0) {
5662                 return res;
5663         }
5664
5665         MARK;
5666         res = tls_fsync(context);
5667         MARK;
5668         if (res < 0) {
5669                 return res;
5670         }
5671
5672         while ((read_size = tls_safe_read(context)) > 0) {
5673                 if ((res = tls_consume_stream(context)) >= 0) {
5674                         res = tls_fsync(context);
5675                         if (res < 0) {
5676                                 return res;
5677                         }
5678                 }
5679         MARK;
5680                 if (tls_established(context)) {
5681                         MARK;
5682                         return 1;
5683                 }
5684         MARK;
5685                 if (context->critical_error) {
5686                         fprintf(stderr, "critical error: %d\n",
5687                                         context->critical_error);
5688                         return TLS_GENERIC_ERROR;
5689                 }
5690         }
5691         MARK;
5692         return read_size;
5693 }
5694
5695 int tls_shutdown(struct TLSContext *tls) {
5696         if (!tls || tls->fd <= 0) {
5697                 return TLS_GENERIC_ERROR;
5698         }
5699
5700         tls_close_notify(tls);
5701         return 0;
5702 }
5703
5704 /* TODO configure for maximum packet data length
5705  * max is 2^14 - 5 byte header - 32 byte mac - padding which depends
5706  * on the cipher (up to 255 bytes I think).
5707  */
5708 ssize_t tls_write(struct TLSContext *context, const void *buf, size_t count) {
5709         if (!context) {
5710                 return TLS_GENERIC_ERROR;
5711         }
5712         if (context->connection_status != TLS_CONNECTED) {
5713                 return TLS_UNEXPECTED_MESSAGE;
5714         }
5715         if (count > TLS_MAXTLS_APP_SIZE) {
5716                 count = TLS_MAXTLS_APP_SIZE;
5717         }
5718
5719         if (!buf || !count) {
5720                 return 0;
5721         }
5722
5723         struct TLSPacket *packet = tls_create_packet(context,
5724                         TLS_APPLICATION_DATA, context->version, count);
5725         tls_packet_append(packet, buf, count);
5726         tls_packet_update(packet);
5727
5728         tls_queue_packet(packet);
5729         /* TODO think about this.  context->sync with O_NONBLOCK might be a
5730          * problem
5731          */
5732         if (context->sync) {
5733                 ssize_t res;
5734                 res = tls_fsync(context);
5735                 if (res == -1) {
5736                         return res;
5737                 }
5738         }
5739         return count;
5740 }
5741
5742 static ssize_t tls_readbuf(struct TLSContext *tls, void *buf, size_t count) {
5743         if (count > tls->application_buffer.len) {
5744                 count = tls->application_buffer.len;
5745         }
5746
5747         if (count > 0) {
5748                 /* TODO should have a buffer read and shift */
5749                 memcpy(buf, tls->application_buffer.buffer, count);
5750                 tls_buffer_shift(&tls->application_buffer, count);
5751         }
5752
5753         return count;
5754 }
5755
5756 ssize_t tls_read(struct TLSContext *context, void *buf, size_t count) {
5757         if (!context) {
5758                 return TLS_GENERIC_ERROR;
5759         }
5760
5761         if (context->application_buffer.len) {
5762                 return tls_readbuf(context, buf, count);
5763         }
5764
5765         if (context->fd <= 0 || context->critical_error) {
5766                 return TLS_GENERIC_ERROR;
5767         }
5768
5769         if (!tls_established(context)) {
5770                 return TLS_GENERIC_ERROR;
5771         }
5772
5773         if (context->application_buffer.len == 0 && !context->critical_error) {
5774                 /* attempt to fill buffer, unless we're already in an error
5775                  * state
5776                  */
5777                 ssize_t read_size;
5778
5779                 while ((read_size = tls_safe_read(context)) > 0) {
5780                         if (tls_consume_stream(context) > 0) {
5781                                 tls_fsync(context);
5782                                 break;
5783                         }
5784                         if (context->critical_error
5785                             && !context->application_buffer.len) {
5786                                 /* if there's a critical error, don't bail if
5787                                  * we managed to get some data
5788                                  */
5789                                 return TLS_GENERIC_ERROR;
5790                         }
5791                 }
5792
5793                 if (read_size <= 0 && context->application_buffer.len == 0) {
5794                         /* can return errors as for read(2) */
5795                         return read_size;
5796                 }
5797         }
5798
5799         return tls_readbuf(context, buf, count);
5800 }