pd.if.org Git - zpackage/blob - crypto/tlse.c

   1 #define _POSIX_C_SOURCE 200809L
   2
   3 #include <fcntl.h>
   4 #include <stdint.h>
   5 #include <stdio.h>
   6 #include <stdlib.h>
   7 #include <string.h>
   8 #include <strings.h>
   9 #include <sys/mman.h>
  10 #include <sys/stat.h>
  11 #include <time.h>
  12
  13 #include <sys/socket.h>
  14 #include <arpa/inet.h>
  15 #include <unistd.h>
  16
  17 #include <errno.h>
  18
  19 #include "tomcrypt.h"
  20
  21 #define mp_init(a)                           ltc_mp.init(a)
  22 #define mp_init_multi                        ltc_init_multi
  23 #define mp_clear(a)                          ltc_mp.deinit(a)
  24 #define mp_clear_multi                       ltc_deinit_multi
  25 #define mp_count_bits(a)                     ltc_mp.count_bits(a)
  26 #define mp_read_radix(a, b, c)               ltc_mp.read_radix(a, b, c)
  27 #define mp_unsigned_bin_size(a)              ltc_mp.unsigned_size(a)
  28 #define mp_to_unsigned_bin(a, b)             ltc_mp.unsigned_write(a, b)
  29 #define mp_read_unsigned_bin(a, b, c)        ltc_mp.unsigned_read(a, b, c)
  30 #define mp_exptmod(a, b, c, d)               ltc_mp.exptmod(a, b, c, d)
  31 #define mp_add(a, b, c)                      ltc_mp.add(a, b, c)
  32 #define mp_mul(a, b, c)                      ltc_mp.mul(a, b, c)
  33 #define mp_cmp(a, b)                         ltc_mp.compare(a, b)
  34 #define mp_cmp_d(a, b)                       ltc_mp.compare_d(a, b)
  35 #define mp_sqr(a, b)                         ltc_mp.sqr(a, b)
  36 #define mp_mod(a, b, c)                      ltc_mp.mpdiv(a, b, NULL, c)
  37 #define mp_sub(a, b, c)                      ltc_mp.sub(a, b, c)
  38 #define mp_set(a, b)                         ltc_mp.set_int(a, b)
  39
  40 #if (CRYPT <= 0x0117)
  41 #define LTC_PKCS_1_EMSA LTC_LTC_PKCS_1_EMSA
  42 #define LTC_PKCS_1_V1_5 LTC_LTC_PKCS_1_V1_5
  43 #define LTC_PKCS_1_PSS LTC_LTC_PKCS_1_PSS
  44 #endif
  45
  46 #include "tlse.h"
  47 #include "chacha.h"
  48 #include "buffer.h"
  49
  50 #define TLS_DH_DEFAULT_P            "87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597"
  51 #define TLS_DH_DEFAULT_G            "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"
  52 #define TLS_DHE_KEY_SIZE          2048
  53
  54 #ifndef htonll
  55 #define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
  56 #endif
  57
  58 #ifndef ntohll
  59 #define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
  60 #endif
  61
  62 #define CHECK_HANDSHAKE_STATE(context, n, limit)  { if (context->hs_messages[n] >= limit) { DEBUG_PRINT("* UNEXPECTED MESSAGE (%i)\n", (int)n); payload_res = TLS_UNEXPECTED_MESSAGE; break; } context->hs_messages[n]++; }
  63
  64 #ifdef DEBUG
  65 int tls_indent = 0;
  66 int tls_indent_i = 0;
  67 #endif
  68
  69 //#define MARK
  70 typedef enum {
  71         KEA_dhe_dss,
  72         KEA_dhe_rsa,
  73         KEA_dh_anon,
  74         KEA_rsa,
  75         KEA_dh_dss,
  76         KEA_dh_rsa,
  77         KEA_ec_diffie_hellman
  78 } KeyExchangeAlgorithm;
  79
  80 typedef enum {
  81         rsa_sign = 1,
  82         dss_sign = 2,
  83         rsa_fixed_dh = 3,
  84         dss_fixed_dh = 4,
  85         rsa_ephemeral_dh_RESERVED = 5,
  86         dss_ephemeral_dh_RESERVED = 6,
  87         fortezza_dms_RESERVED = 20,
  88         ecdsa_sign = 64,
  89         rsa_fixed_ecdh = 65,
  90         ecdsa_fixed_ecdh = 66
  91 } TLSClientCertificateType;
  92
  93 typedef enum {
  94         none = 0,
  95         md5 = 1,
  96         sha1 = 2,
  97         sha224 = 3,
  98         sha256 = 4,
  99         sha384 = 5,
 100         sha512 = 6,
 101         _md5_sha1 = 255
 102 } TLSHashAlgorithm;
 103
 104 typedef enum {
 105         anonymous = 0,
 106         rsa = 1,
 107         dsa = 2,
 108         ecdsa = 3
 109 } TLSSignatureAlgorithm;
 110
 111 struct OID_chain {
 112         void *top;
 113         unsigned char *oid;
 114 };
 115
 116 typedef ssize_t (*tls_recv_func)(int sockfd, void *buf, size_t len,
 117                                  int flags);
 118 typedef ssize_t (*tls_send_func)(int sockfd, const void *buf, size_t len,
 119                                  int flags);
 120
 121 static const unsigned int version_id[] = { 1, 1, 1, 0 };
 122 static const unsigned int pk_id[] = { 1, 1, 7, 0 };
 123 static const unsigned int serial_id[] = { 1, 1, 2, 1, 0 };
 124 static const unsigned int issurer_id[] = { 1, 1, 4, 0 };
 125 static const unsigned int owner_id[] = { 1, 1, 6, 0 };
 126 static const unsigned int validity_id[] = { 1, 1, 5, 0 };
 127 static const unsigned int algorithm_id[] = { 1, 1, 3, 0 };
 128 static const unsigned int sign_id[] = { 1, 3, 2, 1, 0 };
 129 static const unsigned int sign_id2[] = { 1, 3, 2, 2, 0 };
 130 static const unsigned int priv_id[] = { 1, 4, 0 };
 131 static const unsigned int priv_der_id[] = { 1, 3, 1, 0 };
 132 static const unsigned int ecc_priv_id[] = { 1, 2, 0 };
 133
 134 static const unsigned char country_oid[] = { 0x55, 0x04, 0x06, 0x00 };
 135 static const unsigned char state_oid[] = { 0x55, 0x04, 0x08, 0x00 };
 136 static const unsigned char location_oid[] = { 0x55, 0x04, 0x07, 0x00 };
 137 static const unsigned char entity_oid[] = { 0x55, 0x04, 0x0A, 0x00 };
 138 static const unsigned char subject_oid[] = { 0x55, 0x04, 0x03, 0x00 };
 139 static const unsigned char san_oid[] = { 0x55, 0x1D, 0x11, 0x00 };
 140 static const unsigned char ocsp_oid[] =
 141     { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x00 };
 142
 143 static const unsigned char TLS_RSA_SIGN_RSA_OID[] =
 144     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x00 };
 145 static const unsigned char TLS_RSA_SIGN_MD5_OID[] =
 146     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04, 0x00 };
 147 static const unsigned char TLS_RSA_SIGN_SHA1_OID[] =
 148     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x00 };
 149 static const unsigned char TLS_RSA_SIGN_SHA256_OID[] =
 150     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x00 };
 151 static const unsigned char TLS_RSA_SIGN_SHA384_OID[] =
 152     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, 0x00 };
 153 static const unsigned char TLS_RSA_SIGN_SHA512_OID[] =
 154     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, 0x00 };
 155
 156 #if 0
 157 static const unsigned char TLS_ECDSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x01, 0x05, 0x00, 0x00};
 158 static const unsigned char TLS_ECDSA_SIGN_SHA224_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x01, 0x05, 0x00, 0x00};
 159 static const unsigned char TLS_ECDSA_SIGN_SHA256_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x05, 0x00, 0x00};
 160 static const unsigned char TLS_ECDSA_SIGN_SHA384_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, 0x05, 0x00, 0x00};
 161 static const unsigned char TLS_ECDSA_SIGN_SHA512_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, 0x05, 0x00, 0x00};
 162 #endif
 163
 164 static const unsigned char TLS_EC_PUBLIC_KEY_OID[] =
 165     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x00 };
 166
 167 static const unsigned char TLS_EC_prime192v1_OID[] =
 168     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x01, 0x00 };
 169 static const unsigned char TLS_EC_prime192v2_OID[] =
 170     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x02, 0x00 };
 171 static const unsigned char TLS_EC_prime192v3_OID[] =
 172     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x03, 0x00 };
 173 static const unsigned char TLS_EC_prime239v1_OID[] =
 174     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x04, 0x00 };
 175 static const unsigned char TLS_EC_prime239v2_OID[] =
 176     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x05, 0x00 };
 177 static const unsigned char TLS_EC_prime239v3_OID[] =
 178     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x06, 0x00 };
 179 static const unsigned char TLS_EC_prime256v1_OID[] =
 180     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x00 };
 181
 182 #define TLS_EC_secp256r1_OID    TLS_EC_prime256v1_OID
 183 static const unsigned char TLS_EC_secp224r1_OID[] =
 184     { 0x2B, 0x81, 0x04, 0x00, 0x21, 0x00 };
 185 static const unsigned char TLS_EC_secp384r1_OID[] =
 186     { 0x2B, 0x81, 0x04, 0x00, 0x22, 0x00 };
 187 static const unsigned char TLS_EC_secp521r1_OID[] =
 188     { 0x2B, 0x81, 0x04, 0x00, 0x23, 0x00 };
 189
 190 int tls_random(unsigned char *key, int len);
 191 void tls_destroy_packet(struct TLSPacket *packet);
 192 struct TLSPacket *tls_build_hello(struct TLSContext *context,
 193                                   int tls13_downgrade);
 194
 195 /* not supported */
 196 #if 0
 197 static unsigned char TLS_DSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x52, 0xCE, 0x38, 0x04, 0x03, 0x00};
 198 #endif
 199
 200 static uint16_t get16(const unsigned char *buf) {
 201         uint16_t res;
 202
 203         res = ((*buf) << 8) + (*(buf+1));
 204         return res;
 205 }
 206
 207 static uint32_t get24(const unsigned char *buf) {
 208         uint32_t res;
 209
 210         res = (buf[0] << 16) + (buf[1] << 8) + buf[2];
 211         return res;
 212 }
 213
 214 #ifdef DEBUG
 215 static char *packet_content_type(int type) {
 216         switch (type) {
 217                 case 20: return "change_cipher_spec"; break;
 218                 case 21: return "alert"; break;
 219                 case 22: return "handshake"; break;
 220                 case 23: return "application_data"; break;
 221                 default: break;
 222         }
 223         return "unknown content type";
 224 }
 225
 226 static char *packet_handshake_type(int type) {
 227         switch (type) {
 228                 case 0: return "hello_request"; break;
 229                 case 1: return "client_hello"; break;
 230                 case 2: return "server_hello"; break;
 231                 case 11: return "certificate"; break;
 232                 case 12: return "server_key_exchange"; break;
 233                 case 13: return "certificate_request"; break;
 234                 case 14: return "server_hello_done"; break;
 235                 case 15: return "certificate_verify"; break;
 236                 case 16: return "client_key_exchange"; break;
 237                 case 20: return "finished"; break;
 238                 default: break;
 239         }
 240         return "unknown handshake type";
 241 }
 242 #endif
 243
 244 size_t tls_queue_packet(struct TLSPacket *packet) {
 245         ENTER;
 246         if (!packet) {
 247                 LEAVE;
 248                 return -1;
 249         }
 250
 251         struct TLSContext *context = packet->context;
 252
 253         if (!context) {
 254                 LEAVE;
 255                 return -1;
 256         }
 257
 258         DEBUG_PRINTLN("sending packet type %d %s\n", (int)packet->buf[0],
 259                         packet_content_type(packet->buf[0]));
 260         if (packet->buf[0] == 22) {
 261                 DEBUG_PRINTLN("handshake type %d %s\n", (int)packet->buf[5],
 262                                 packet_handshake_type(packet->buf[5])
 263                                 );
 264         }
 265         tls_buffer_append(&context->output_buffer, packet->buf, packet->len);
 266         tls_destroy_packet(packet);
 267         LEAVE;
 268         return context->output_buffer.len;
 269 }
 270
 271 static void tls_send_change_cipher_spec(struct TLSContext *context) {
 272         ENTER;
 273         struct TLSPacket *packet =
 274             tls_create_packet(context, TLS_CHANGE_CIPHER, context->version,
 275                               64);
 276         tls_packet_uint8(packet, 1);
 277         tls_packet_update(packet);
 278         context->local_sequence_number = 0;
 279         tls_queue_packet(packet);
 280         LEAVE;
 281         return;
 282 }
 283
 284 static void tls_send_encrypted_extensions(struct TLSContext *context) {
 285         struct TLSPacket *packet =
 286             tls_create_packet(context, TLS_HANDSHAKE, context->version, 3);
 287         tls_packet_uint8(packet, 0x08);
 288
 289         if (context->negotiated_alpn) {
 290                 int alpn_negotiated_len = strlen(context->negotiated_alpn);
 291                 int alpn_len = alpn_negotiated_len + 1;
 292
 293                 tls_packet_uint24(packet, alpn_len + 8);
 294                 tls_packet_uint16(packet, alpn_len + 6);
 295                 tls_packet_uint16(packet, 0x10);
 296                 tls_packet_uint16(packet, alpn_len + 2);
 297                 tls_packet_uint16(packet, alpn_len);
 298
 299                 tls_packet_uint8(packet, alpn_negotiated_len);
 300                 tls_packet_append(packet, (unsigned char *) context->
 301                                 negotiated_alpn, alpn_negotiated_len);
 302         } else {
 303                 tls_packet_uint24(packet, 2);
 304                 tls_packet_uint16(packet, 0);
 305         }
 306         tls_packet_update(packet);
 307         tls_queue_packet(packet);
 308         return;
 309 }
 310
 311 static void tls_send_done(struct TLSContext *context) {
 312         struct TLSPacket *packet =
 313             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 314         tls_packet_uint8(packet, 0x0E);
 315         tls_packet_uint24(packet, 0);
 316         tls_packet_update(packet);
 317         tls_queue_packet(packet);
 318         return;
 319 }
 320
 321 static void tls_send_certificate(struct TLSContext *context) {
 322         int i;
 323         unsigned int all_certificate_size = 0;
 324         int certificates_count;
 325         struct TLSCertificate **certificates;
 326
 327         ENTER;
 328         if (context->is_server) {
 329                 certificates_count = context->certificates_count;
 330                 certificates = context->certificates;
 331         } else {
 332                 certificates_count = context->client_certificates_count;
 333                 certificates = context->client_certificates;
 334         }
 335
 336         int delta = 3;
 337         if (context->tlsver == TLS_VERSION13) {
 338                 delta = 5;
 339         }
 340
 341         int is_ecdsa = tls_is_ecdsa(context);
 342         /* TODO can do one loop and test for ecdsa inside loop */
 343         if (is_ecdsa) {
 344                 for (i = 0; i < certificates_count; i++) {
 345                         struct TLSCertificate *cert = certificates[i];
 346                         if (cert && cert->der_len && cert->ec_algorithm) {
 347                                 all_certificate_size += cert->der_len + delta;
 348                         }
 349                 }
 350         } else {
 351                 for (i = 0; i < certificates_count; i++) {
 352                         struct TLSCertificate *cert = certificates[i];
 353                         if (cert && cert->der_len && !cert->ec_algorithm) {
 354                                 all_certificate_size += cert->der_len + delta;
 355                         }
 356                 }
 357         }
 358
 359         for (i = 0; i < certificates_count; i++) {
 360                 struct TLSCertificate *cert = certificates[i];
 361                 if (cert && cert->der_len) {
 362                         all_certificate_size += cert->der_len + delta;
 363                 }
 364         }
 365
 366         if (!all_certificate_size) {
 367                 DEBUG_PRINT("NO CERTIFICATE SET\n");
 368         }
 369
 370         struct TLSPacket *packet = tls_create_packet(context, TLS_HANDSHAKE,
 371                         context->version, 0);
 372         tls_packet_uint8(packet, 0x0B);
 373
 374         if (all_certificate_size) {
 375                 /* context */
 376                 if (context->tlsver == TLS_VERSION13) {
 377                         tls_packet_uint24(packet, all_certificate_size + 4);
 378                         tls_packet_uint8(packet, 0);
 379                 } else {
 380                         tls_packet_uint24(packet, all_certificate_size + 3);
 381                 }
 382
 383                 tls_packet_uint24(packet, all_certificate_size);
 384
 385                 for (i = 0; i < certificates_count; i++) {
 386                         struct TLSCertificate *cert = certificates[i];
 387                         if (cert && cert->der_len) {
 388                                 /* is RSA certificate ? */
 389                                 if (is_ecdsa && !cert->ec_algorithm) {
 390                                         continue;
 391                                 }
 392                                 /* is ECC certificate ? */
 393                                 if (!is_ecdsa && cert->ec_algorithm) {
 394                                         continue;
 395                                 }
 396                                 /* 2 times -> one certificate */
 397                                 tls_packet_uint24(packet, cert->der_len);
 398                                 tls_packet_append(packet, cert->der_bytes,
 399                                                   cert->der_len);
 400                                 /* extension */
 401                                 if (context->tlsver == TLS_VERSION13) {
 402                                         tls_packet_uint16(packet, 0);
 403                                 }
 404                         }
 405                 }
 406         } else {
 407                 tls_packet_uint24(packet, all_certificate_size);
 408                 if (context->tlsver == TLS_VERSION13) {
 409                         tls_packet_uint8(packet, 0);
 410                 }
 411
 412         }
 413         tls_packet_update(packet);
 414         tls_queue_packet(packet);
 415         LEAVE;
 416         return;
 417 }
 418
 419 int tls_supported_version(uint16_t ver) {
 420         switch (ver) {
 421                 case TLS_V12:
 422                 case TLS_V13:
 423                         break;
 424                 default:
 425                         DEBUG_PRINT("UNSUPPORTED TLS VERSION %x\n", (int)ver);
 426                         return 0;
 427         }
 428         return 1;
 429 }
 430
 431 void tls_set_packet_length(struct TLSPacket *packet, uint32_t length) {
 432         int offset = packet->payload_pos;
 433         packet->buf[offset] = (length >> 16) & 0xff;
 434         packet->buf[offset+1] = (length >> 8) & 0xff;
 435         packet->buf[offset+2] = (length >> 0) & 0xff;
 436 }
 437
 438 static void tls_init() {
 439         static int loaded = 0;
 440         if (loaded) {
 441                 return;
 442         }
 443
 444         DEBUG_PRINT("Initializing dependencies\n");
 445         loaded = 1;
 446 #ifdef LTM_DESC
 447         ltc_mp = ltm_desc;
 448 #else
 449 #ifdef TFM_DESC
 450         ltc_mp = tfm_desc;
 451 #endif
 452 #endif
 453         /* TODO remove these */
 454         register_hash(&md5_desc);
 455         register_hash(&sha1_desc);
 456
 457         register_hash(&sha256_desc);
 458         register_hash(&sha384_desc);
 459         register_hash(&sha512_desc);
 460
 461         register_prng(&sprng_desc);
 462
 463         register_cipher(&aes_desc);
 464
 465         tls_ecc_init_curves();
 466 }
 467
 468 static unsigned char *decrypt_rsa(struct TLSContext *context,
 469                                         const unsigned char *buffer,
 470                                         unsigned int len,
 471                                         unsigned int *size) {
 472         *size = 0;
 473         if (!len || !context || !context->private_key
 474             || !context->private_key->der_bytes
 475             || !context->private_key->der_len) {
 476                 DEBUG_PRINT("No private key set\n");
 477                 return NULL;
 478         }
 479         rsa_key key;
 480         int err;
 481         err = rsa_import(context->private_key->der_bytes,
 482                         context->private_key->der_len, &key);
 483
 484         if (err) {
 485                 DEBUG_PRINT("Error importing RSA key (code: %i)\n", err);
 486                 return NULL;
 487         }
 488
 489         unsigned char *out = malloc(len);
 490         unsigned long out_size = len;
 491         int hash_idx = find_hash("sha256");
 492         int res = 0;
 493         err = rsa_decrypt_key_ex(buffer, len, out, &out_size, (unsigned char *)
 494                         "Concept", 7, hash_idx, LTC_PKCS_1_V1_5, &res, &key);
 495         rsa_free(&key);
 496
 497         if (err || !out_size) {
 498                 DEBUG_PRINT("RSA DECRYPT ERROR\n");
 499                 free(out);
 500                 return NULL;
 501         }
 502         *size = (unsigned int) out_size;
 503         return out;
 504 }
 505
 506 static int verify_rsa(struct TLSContext *context, unsigned int hash_type, const
 507                 unsigned char *buffer, unsigned int len, const unsigned char
 508                 *message, unsigned long message_len) {
 509         rsa_key key;
 510         int err;
 511
 512         if (len == 0) {
 513                 return TLS_GENERIC_ERROR;
 514         }
 515
 516         struct TLSCertificate **cert;
 517         int count;
 518
 519         if (context->is_server) {
 520                 cert = context->client_certificates;
 521                 count = context->client_certificates_count;
 522         } else {
 523                 cert = context->certificates;
 524                 count = context->certificates_count;
 525         }
 526
 527         if (count == 0 || !cert) {
 528                 return TLS_GENERIC_ERROR;
 529         }
 530
 531         err = rsa_import(cert[0]->der_bytes, cert[0]->der_len, &key);
 532
 533         if (err) {
 534                 DEBUG_PRINT("Error importing RSA certificate (code: %i)\n",
 535                             err);
 536                 return TLS_GENERIC_ERROR;
 537         }
 538         int hash_idx = -1;
 539         unsigned char hash[TLS_MAX_HASH_LEN];
 540         unsigned long hash_len;
 541         hash_len = (unsigned long)sizeof hash;
 542
 543         switch (hash_type) {
 544                 case md5:
 545                         hash_idx = find_hash("md5");
 546                         break;
 547                 case sha1:
 548                         hash_idx = find_hash("sha1");
 549                         break;
 550                 case sha256:
 551                         hash_idx = find_hash("sha256");
 552                         break;
 553                 case sha384:
 554                         hash_idx = find_hash("sha384");
 555                         break;
 556                 case sha512:
 557                         hash_idx = find_hash("sha512");
 558                         break;
 559         }
 560         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 561         if (hash_idx < 0 || err) {
 562                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 563                 return TLS_GENERIC_ERROR;
 564         }
 565         int rsa_stat = 0;
 566         if (context->tlsver == TLS_VERSION13) {
 567                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 568                                 LTC_PKCS_1_PSS, hash_idx, 0, &rsa_stat, &key);
 569         } else {
 570                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 571                                 LTC_PKCS_1_V1_5, hash_idx, 0, &rsa_stat, &key);
 572         }
 573         rsa_free(&key);
 574         if (err) {
 575                 return 0;
 576         }
 577         return rsa_stat;
 578 }
 579
 580 static int sign_rsa(struct TLSContext *context, unsigned int hash_type, const
 581                 unsigned char *message, unsigned int message_len, unsigned char
 582                 *out, unsigned long *outlen) {
 583         rsa_key key;
 584         int err;
 585         int hash_index = -1;
 586         unsigned char hash[TLS_MAX_HASH_LEN];
 587         unsigned long hash_len = 0;
 588         //hash_state state;
 589
 590         if (!outlen || !context || !out || !context->private_key
 591             || !context->private_key->der_bytes
 592             || !context->private_key->der_len) {
 593                 DEBUG_PRINT("No private key set\n");
 594                 return TLS_GENERIC_ERROR;
 595         }
 596
 597         err = rsa_import(context->private_key->der_bytes,
 598                         context->private_key->der_len, &key);
 599
 600         if (err) {
 601                 DEBUG_PRINT("Error %d importing RSA certificate", err);
 602                 return TLS_GENERIC_ERROR;
 603         }
 604
 605         switch (hash_type) {
 606                 case sha1:
 607                         hash_index = find_hash("sha1");
 608                         hash_len = 20;
 609                         break;
 610                 case sha256:
 611                         hash_index = find_hash("sha256");
 612                         hash_len = 32;
 613                         break;
 614                 case sha384:
 615                         hash_index = find_hash("sha384");
 616                         hash_len = 48;
 617                         break;
 618                 case sha512:
 619                         hash_index = find_hash("sha512");
 620                         hash_len = 64;
 621                         break;
 622                 case md5:
 623                 case _md5_sha1:
 624                         hash_index = find_hash("md5");
 625                         hash_len = 16;
 626                         break;
 627         }
 628
 629         if (hash_index < 0 || err) {
 630                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 631                 return TLS_GENERIC_ERROR;
 632         }
 633
 634         hash_memory(hash_index, message, message_len, hash, &hash_len);
 635
 636         if (hash_type == _md5_sha1) {
 637                 unsigned long hlen = 20;
 638                 hash_index = find_hash("sha1");
 639                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 640                 hash_len += hlen;
 641         }
 642
 643         //err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 644
 645         if (context->tlsver == TLS_VERSION13) {
 646                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 647                                 LTC_PKCS_1_PSS, NULL, find_prng("sprng"),
 648                                 hash_index, hash_type == sha256 ? 32 : 48, &key);
 649         } else {
 650                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 651                                 LTC_PKCS_1_V1_5, NULL, find_prng("sprng"),
 652                                 hash_index, 0, &key);
 653         }
 654
 655         rsa_free(&key);
 656         if (err) {
 657                 return 0;
 658         }
 659
 660         return 1;
 661 }
 662
 663 static int tls_is_point(ecc_key * key) {
 664         void *prime, *b, *t1, *t2;
 665         int err;
 666
 667         if ((err = mp_init_multi(&prime, &b, &t1, &t2, NULL)) != CRYPT_OK) {
 668                 return err;
 669         }
 670
 671         /* load prime and b */
 672         if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) {
 673                 goto error;
 674         }
 675         if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) {
 676                 goto error;
 677         }
 678
 679         /* compute y^2 */
 680         if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) {
 681                 goto error;
 682         }
 683
 684         /* compute x^3 */
 685         if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) {
 686                 goto error;
 687         }
 688         if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) {
 689                 goto error;
 690         }
 691         if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) {
 692                 goto error;
 693         }
 694
 695         /* compute y^2 - x^3 */
 696         if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) {
 697                 goto error;
 698         }
 699
 700         /* compute y^2 - x^3 + 3x */
 701         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 702                 goto error;
 703         }
 704         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 705                 goto error;
 706         }
 707         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 708                 goto error;
 709         }
 710         if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) {
 711                 goto error;
 712         }
 713         while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
 714                 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) {
 715                         goto error;
 716                 }
 717         }
 718         while (mp_cmp(t1, prime) != LTC_MP_LT) {
 719                 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) {
 720                         goto error;
 721                 }
 722         }
 723
 724         /* compare to b */
 725         if (mp_cmp(t1, b) != LTC_MP_EQ) {
 726                 err = CRYPT_INVALID_PACKET;
 727         } else {
 728                 err = CRYPT_OK;
 729         }
 730
 731       error:
 732         mp_clear_multi(prime, b, t1, t2, NULL);
 733         return err;
 734 }
 735
 736 static int tls_ecc_import_key(const unsigned char *private_key,
 737                                 int private_len,
 738                                 const unsigned char *public_key,
 739                                 int public_len, ecc_key *key,
 740                                 const ltc_ecc_set_type *dp) {
 741         int err;
 742
 743         if (!key || !ltc_mp.name) {
 744                 return CRYPT_MEM;
 745         }
 746
 747         key->type = PK_PRIVATE;
 748
 749         if (mp_init_multi
 750             (&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k,
 751              NULL) != CRYPT_OK)
 752                 return CRYPT_MEM;
 753
 754         if (public_len && !public_key[0]) {
 755                 public_key++;
 756                 public_len--;
 757         }
 758         if ((err = mp_read_unsigned_bin(key->pubkey.x,
 759                                   (unsigned char *) public_key + 1,
 760                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 761                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 762                                key->k, NULL);
 763                 return err;
 764         }
 765
 766         if ((err = mp_read_unsigned_bin(key->pubkey.y,
 767                                   (unsigned char *) public_key + 1 +
 768                                   ((public_len - 1) >> 1),
 769                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 770                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 771                                key->k, NULL);
 772                 return err;
 773         }
 774
 775         if ((err =
 776              mp_read_unsigned_bin(key->k, (unsigned char *) private_key,
 777                                   private_len)) != CRYPT_OK) {
 778                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 779                                key->k, NULL);
 780                 return err;
 781         }
 782
 783         key->idx = -1;
 784         key->dp = dp;
 785
 786         /* set z */
 787         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
 788                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 789                                key->k, NULL);
 790                 return err;
 791         }
 792
 793         /* is it a point on the curve?  */
 794         if ((err = tls_is_point(key)) != CRYPT_OK) {
 795                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
 796                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 797                                key->k, NULL);
 798                 return err;
 799         }
 800
 801         /* we're good */
 802         return CRYPT_OK;
 803 }
 804
 805 static int sign_ecdsa(struct TLSContext *context,
 806                             unsigned int hash_type,
 807                             const unsigned char *message,
 808                             unsigned int message_len, unsigned char *out,
 809                             unsigned long *outlen) {
 810         if (!outlen || !context || !out || !outlen
 811             || !context->ec_private_key
 812             || !context->ec_private_key->priv
 813             || !context->ec_private_key->priv_len
 814             || !context->ec_private_key->pk
 815             || !context->ec_private_key->pk_len) {
 816                 DEBUG_PRINT("No private ECDSA key set\n");
 817                 return TLS_GENERIC_ERROR;
 818         }
 819
 820         const struct ECCCurveParameters *curve = NULL;
 821
 822         switch (context->ec_private_key->ec_algorithm) {
 823                 case 19:
 824                         curve = &secp192r1;
 825                         break;
 826                 case 20:
 827                         curve = &secp224k1;
 828                         break;
 829                 case 21:
 830                         curve = &secp224r1;
 831                         break;
 832                 case 22:
 833                         curve = &secp256k1;
 834                         break;
 835                 case 23:
 836                         curve = &secp256r1;
 837                         break;
 838                 case 24:
 839                         curve = &secp384r1;
 840                         break;
 841                 case 25:
 842                         curve = &secp521r1;
 843                         break;
 844                 default:
 845                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
 846         }
 847
 848         if (!curve) {
 849                 return TLS_GENERIC_ERROR;
 850         }
 851
 852         ecc_key key;
 853         int err;
 854
 855         ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&curve->dp;
 856
 857         /* broken ... fix this */
 858         err = tls_ecc_import_key(context->ec_private_key->priv,
 859                         context->ec_private_key->priv_len,
 860                         context->ec_private_key->pk,
 861                         context->ec_private_key->pk_len, &key, dp);
 862
 863         if (err) {
 864                 DEBUG_PRINT("Error importing ECC certificate (code: %i)\n",
 865                             (int) err);
 866                 return TLS_GENERIC_ERROR;
 867         }
 868
 869         unsigned char hash[TLS_MAX_HASH_LEN];
 870         unsigned long hash_len = 0;
 871         int hash_index;
 872
 873         switch (hash_type) {
 874                 case sha1:
 875                         hash_index = find_hash("sha1");
 876                         hash_len = 20;
 877                         break;
 878                 case sha256:
 879                         hash_index = find_hash("sha256");
 880                         hash_len = 32;
 881                         break;
 882                 case sha384:
 883                         hash_index = find_hash("sha384");
 884                         hash_len = 48;
 885                         break;
 886                 case sha512:
 887                         hash_index = find_hash("sha512");
 888                         hash_len = 64;
 889                         break;
 890                 case md5:
 891                 case _md5_sha1:
 892                         hash_index = find_hash("md5");
 893                         hash_len = 16;
 894                         break;
 895         }
 896
 897         hash_memory(hash_index, message, message_len, hash, &hash_len);
 898
 899         if (hash_type == _md5_sha1) {
 900                 unsigned long hlen = 20;
 901                 hash_index = find_hash("sha1");
 902                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 903                 hash_len += hlen;
 904         }
 905
 906         if (err) {
 907                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 908                 return TLS_GENERIC_ERROR;
 909         }
 910         /* "Let z be the Ln leftmost bits of e, where Ln is the bit length of
 911          * the group order n." */
 912         if ((int)hash_len > curve->size) {
 913                 hash_len = curve->size;
 914         }
 915         err = ecc_sign_hash(hash, hash_len, out, outlen, NULL,
 916                         find_prng("sprng"), &key);
 917         DEBUG_DUMP_HEX_LABEL("ECC SIGNATURE", out, *outlen);
 918         ecc_free(&key);
 919
 920         return err ? 0 : 1;
 921 }
 922
 923 static void tls_send_certificate_verify(struct TLSContext *context) {
 924         struct TLSPacket *packet =
 925             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 926         /* certificate verify */
 927         tls_packet_uint8(packet, 0x0F);
 928         tls_packet_uint24(packet, 0);
 929
 930         unsigned char out[TLS_MAX_RSA_KEY];
 931         unsigned long out_len = TLS_MAX_RSA_KEY;
 932
 933         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
 934         int signing_data_len;
 935
 936         /* first 64 bytes to 0x20 (32) */
 937         memset(signing_data, 0x20, 64);
 938         /* context string 33 bytes */
 939         if (context->is_server) {
 940                 memcpy(signing_data + 64, "TLS 1.3, server CertificateVerify",
 941                                 33);
 942         } else {
 943                 memcpy(signing_data + 64, "TLS 1.3, client CertificateVerify",
 944                                 33);
 945         }
 946         /* a single 0 byte separator */
 947         signing_data[97] = 0;
 948         signing_data_len = 98;
 949
 950         signing_data_len += tls_get_hash(context, signing_data + 98);
 951         DEBUG_DUMP_HEX_LABEL("verify data", signing_data, signing_data_len);
 952         int hash_algorithm = sha256;
 953         if (tls_is_ecdsa(context)) {
 954                 switch (context->ec_private_key->ec_algorithm) {
 955                         case 23:
 956                                 /* secp256r1 + sha256 */
 957                                 tls_packet_uint16(packet, 0x0403);
 958                                 break;
 959                         case 24:
 960                                 /* secp384r1 + sha384 */
 961                                 tls_packet_uint16(packet, 0x0503);
 962                                 hash_algorithm = sha384;
 963                                 break;
 964                         case 25:
 965                                 /* secp521r1 + sha512 */
 966                                 tls_packet_uint16(packet, 0x0603);
 967                                 hash_algorithm = sha512;
 968                                 break;
 969                         default:
 970                                 DEBUG_PRINT("UNSUPPORTED CURVE (SIGNING)\n");
 971                                 packet->broken = 1;
 972                                 /* TODO error */
 973                                 return;
 974                 }
 975         } else {
 976                 tls_packet_uint16(packet, 0x0804);
 977         }
 978
 979         int packet_size = 2;
 980
 981         if (tls_is_ecdsa(context)) {
 982                 if (sign_ecdsa(context, hash_algorithm, signing_data,
 983                                         signing_data_len, out, &out_len) == 1)
 984                 {
 985                         DEBUG_PRINT
 986                             ("ECDSA signing OK! (ECDSA, length %lu)\n",
 987                              out_len);
 988                         tls_packet_uint16(packet, out_len);
 989                         tls_packet_append(packet, out, out_len);
 990                         packet_size += out_len + 2;
 991                 }
 992         } else if (sign_rsa(context, hash_algorithm, signing_data,
 993                                 signing_data_len, out, &out_len) == 1) {
 994                 DEBUG_PRINT("RSA signing OK! (length %lu)\n", out_len);
 995                 tls_packet_uint16(packet, out_len);
 996                 tls_packet_append(packet, out, out_len);
 997                 packet_size += out_len + 2;
 998         }
 999
1000         tls_set_packet_length(packet, packet_size);
1001
1002         tls_packet_update(packet);
1003         tls_queue_packet(packet);
1004         return;
1005 }
1006
1007 static int tls_ecc_import_pk(const unsigned char *public_key,
1008                                int public_len, ecc_key * key,
1009                                const ltc_ecc_set_type * dp) {
1010         int err;
1011
1012         if (!key || !ltc_mp.name) {
1013                 return CRYPT_MEM;
1014         }
1015
1016         key->type = PK_PUBLIC;
1017
1018         if (mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z,
1019                                 &key->k, NULL) != CRYPT_OK) {
1020                 return CRYPT_MEM;
1021         }
1022
1023         if (public_len && !public_key[0]) {
1024                 public_key++;
1025                 public_len--;
1026         }
1027         if ((err = mp_read_unsigned_bin(key->pubkey.x,
1028                                   (unsigned char *) public_key + 1,
1029                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1030                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1031                                key->k, NULL);
1032                 return err;
1033         }
1034
1035         if ((err = mp_read_unsigned_bin(key->pubkey.y,
1036                                   (unsigned char *) public_key + 1 +
1037                                   ((public_len - 1) >> 1),
1038                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1039                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1040                                key->k, NULL);
1041                 return err;
1042         }
1043
1044         key->idx = -1;
1045         key->dp = dp;
1046
1047         /* set z */
1048         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
1049                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1050                                key->k, NULL);
1051                 return err;
1052         }
1053
1054         /* is it a point on the curve?  */
1055         if ((err = tls_is_point(key)) != CRYPT_OK) {
1056                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
1057                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1058                                key->k, NULL);
1059                 return err;
1060         }
1061
1062         /* we're good */
1063         return CRYPT_OK;
1064 }
1065
1066 static int tls_verify_ecdsa(struct TLSContext *context,
1067                               unsigned int hash_type,
1068                               const unsigned char *buffer,
1069                               unsigned int len,
1070                               const unsigned char *message,
1071                               unsigned int message_len,
1072                               const struct ECCCurveParameters *curve_hint)
1073 {
1074         ecc_key key;
1075         int err;
1076
1077         if (!curve_hint) {
1078                 curve_hint = context->curve;
1079         }
1080
1081         if (len == 0) {
1082                 return TLS_GENERIC_ERROR;
1083         }
1084
1085         struct TLSCertificate **cert;
1086         int count;
1087
1088         if (context->is_server) {
1089                 cert = context->client_certificates;
1090                 count = context->client_certificates_count;
1091         } else {
1092                 cert = context->certificates;
1093                 count = context->certificates_count;
1094         }
1095
1096         if (count == 0 || !cert || !cert[0] || !cert[0]->pk ||
1097                         !cert[0]->pk_len) {
1098                 return TLS_GENERIC_ERROR;
1099         }
1100
1101         err = tls_ecc_import_pk(cert[0]->pk, cert[0]->pk_len, &key,
1102                         (ltc_ecc_set_type *)&curve_hint->dp);
1103
1104         if (err) {
1105                 DEBUG_PRINT("Error importing ECC certificate (code: %i)", err);
1106                 return TLS_GENERIC_ERROR;
1107         }
1108
1109         int hash_idx = -1;
1110         unsigned char hash[TLS_MAX_HASH_LEN];
1111         unsigned long hash_len = 0;
1112
1113         switch (hash_type) {
1114                 case md5:
1115                         hash_idx = find_hash("md5");
1116                         hash_len = 16;
1117                         break;
1118                 case sha1:
1119                         hash_idx = find_hash("sha1");
1120                         hash_len = 20;
1121                         break;
1122                 case sha256:
1123                         hash_idx = find_hash("sha256");
1124                         hash_len = 32;
1125                         break;
1126                 case sha384:
1127                         hash_idx = find_hash("sha384");
1128                         hash_len = 48;
1129                         break;
1130                 case sha512:
1131                         hash_idx = find_hash("sha512");
1132                         hash_len = 64;
1133                         break;
1134         }
1135
1136         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
1137
1138         if (hash_idx < 0 || err) {
1139                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
1140                 return TLS_GENERIC_ERROR;
1141         }
1142
1143         int ecc_stat = 0;
1144         err = ecc_verify_hash(buffer, len, hash, hash_len, &ecc_stat, &key);
1145         ecc_free(&key);
1146         if (err) {
1147                 return 0;
1148         }
1149         return ecc_stat;
1150 }
1151
1152 static void prf_helper(int hash_idx, unsigned long dlen,
1153                              unsigned char *output, unsigned int outlen,
1154                              const unsigned char *secret,
1155                              const unsigned int secret_len,
1156                              const unsigned char *label,
1157                              unsigned int label_len, unsigned char *seed,
1158                              unsigned int seed_len, unsigned char *seed_b,
1159                              unsigned int seed_b_len) {
1160         unsigned char digest_out0[TLS_MAX_HASH_LEN];
1161         unsigned char digest_out1[TLS_MAX_HASH_LEN];
1162         unsigned int i;
1163         hmac_state hmac;
1164
1165         hmac_init(&hmac, hash_idx, secret, secret_len);
1166         hmac_process(&hmac, label, label_len);
1167
1168         hmac_process(&hmac, seed, seed_len);
1169         if (seed_b && seed_b_len) {
1170                 hmac_process(&hmac, seed_b, seed_b_len);
1171         }
1172         hmac_done(&hmac, digest_out0, &dlen);
1173         int idx = 0;
1174         while (outlen) {
1175                 hmac_init(&hmac, hash_idx, secret, secret_len);
1176                 hmac_process(&hmac, digest_out0, dlen);
1177                 hmac_process(&hmac, label, label_len);
1178                 hmac_process(&hmac, seed, seed_len);
1179                 if (seed_b && seed_b_len) {
1180                         hmac_process(&hmac, seed_b, seed_b_len);
1181                 }
1182                 hmac_done(&hmac, digest_out1, &dlen);
1183
1184                 unsigned int copylen = outlen;
1185                 if (copylen > dlen) {
1186                         copylen = dlen;
1187                 }
1188
1189                 for (i = 0; i < copylen; i++) {
1190                         output[idx++] ^= digest_out1[i];
1191                         outlen--;
1192                 }
1193
1194                 if (!outlen) {
1195                         break;
1196                 }
1197
1198                 hmac_init(&hmac, hash_idx, secret, secret_len);
1199                 hmac_process(&hmac, digest_out0, dlen);
1200                 hmac_done(&hmac, digest_out0, &dlen);
1201         }
1202 }
1203
1204 static void tls_prf(struct TLSContext *context,
1205                       unsigned char *output, unsigned int outlen,
1206                       const unsigned char *secret,
1207                       const unsigned int secret_len,
1208                       const unsigned char *label, unsigned int label_len,
1209                       unsigned char *seed, unsigned int seed_len,
1210                       unsigned char *seed_b, unsigned int seed_b_len) {
1211         if (!secret || !secret_len) {
1212                 DEBUG_PRINT("NULL SECRET\n");
1213                 return;
1214         }
1215
1216         /* TODO I don't think this is right, wouldn't use md5 for tls v1.3 */
1217         if (context->version != TLS_V12) {
1218                 int md5_hash_idx = find_hash("md5");
1219                 int sha1_hash_idx = find_hash("sha1");
1220                 int half_secret = (secret_len + 1) / 2;
1221
1222                 memset(output, 0, outlen);
1223                 prf_helper(md5_hash_idx, 16, output, outlen, secret,
1224                                 half_secret, label, label_len, seed, seed_len,
1225                                 seed_b, seed_b_len);
1226                 prf_helper(sha1_hash_idx, 20, output, outlen, secret +
1227                                 (secret_len - half_secret), secret_len -
1228                                 half_secret, label, label_len, seed, seed_len,
1229                                 seed_b, seed_b_len);
1230         } else {
1231                 /* sha256_hmac */
1232                 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1233                 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1234                 unsigned long dlen = 32;
1235                 int hash_idx;
1236                 unsigned int mac_length = tls_mac_length(context);
1237
1238                 if (mac_length == TLS_SHA384_MAC_SIZE) {
1239                         hash_idx = find_hash("sha384");
1240                         dlen = mac_length;
1241                 } else {
1242                         hash_idx = find_hash("sha256");
1243                 }
1244
1245                 unsigned int i;
1246
1247                 hmac_state hmac;
1248                 hmac_init(&hmac, hash_idx, secret, secret_len);
1249                 hmac_process(&hmac, label, label_len);
1250                 hmac_process(&hmac, seed, seed_len);
1251                 if (seed_b && seed_b_len) {
1252                         hmac_process(&hmac, seed_b, seed_b_len);
1253                 }
1254                 hmac_done(&hmac, digest_out0, &dlen);
1255
1256                 int idx = 0;
1257                 while (outlen) {
1258                         hmac_init(&hmac, hash_idx, secret, secret_len);
1259                         hmac_process(&hmac, digest_out0, dlen);
1260                         hmac_process(&hmac, label, label_len);
1261                         hmac_process(&hmac, seed, seed_len);
1262                         if (seed_b && seed_b_len) {
1263                                 hmac_process(&hmac, seed_b, seed_b_len);
1264                         }
1265                         hmac_done(&hmac, digest_out1, &dlen);
1266
1267                         unsigned int copylen = outlen;
1268                         if (copylen > dlen) {
1269                                 copylen = (unsigned int) dlen;
1270                         }
1271
1272                         for (i = 0; i < copylen; i++) {
1273                                 output[idx++] = digest_out1[i];
1274                                 outlen--;
1275                         }
1276
1277                         if (!outlen) {
1278                                 break;
1279                         }
1280
1281                         hmac_init(&hmac, hash_idx, secret, secret_len);
1282                         hmac_process(&hmac, digest_out0, dlen);
1283                         hmac_done(&hmac, digest_out0, &dlen);
1284                 }
1285         }
1286 }
1287
1288 static void tls_send_finished(struct TLSContext *context) {
1289         ENTER;
1290         struct TLSPacket *packet =
1291             tls_create_packet(context, TLS_HANDSHAKE, context->version,
1292                               TLS_MIN_FINISHED_OPAQUE_LEN + 64);
1293         tls_packet_uint8(packet, 20);
1294
1295         if (context->tlsver == TLS_VERSION13) {
1296                 tls_packet_uint24(packet, tls_mac_length(context));
1297         } else {
1298                 tls_packet_uint24(packet, TLS_MIN_FINISHED_OPAQUE_LEN);
1299         }
1300
1301         /* verify */
1302         unsigned char hash[TLS_MAX_HASH_SIZE];
1303         unsigned long out_size = TLS_MIN_FINISHED_OPAQUE_LEN;
1304         unsigned char out[TLS_MAX_HASH_SIZE];
1305         unsigned int hash_len;
1306
1307         int context_is_v13 = 0;
1308
1309         if (packet->context->tlsver == TLS_VERSION13) {
1310                 context_is_v13 = 1;
1311         }
1312
1313         /* server verifies client's message */
1314         if (context->is_server) {
1315                 if (context_is_v13) {
1316                         hash_len = tls_get_hash(context, hash);
1317                         if (!context->finished_key || !hash_len) {
1318                                 DEBUG_PRINT
1319                                     ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
1320
1321                                 /* TODO probably need to terminate */
1322                                 tls_destroy_packet(packet);
1323                                 LEAVE;
1324                                 return;
1325                         }
1326
1327                         DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
1328                         DEBUG_DUMP_HEX_LABEL("HS FINISH",
1329                                              context->finished_key,
1330                                              hash_len);
1331
1332                         out_size = hash_len;
1333                         hmac_state hmac;
1334                         hmac_init(&hmac, tls_get_hash_idx(context),
1335                                         context->finished_key, hash_len);
1336                         hmac_process(&hmac, hash, hash_len);
1337                         hmac_done(&hmac, out, &out_size);
1338                 } else {
1339                         hash_len = tls_done_hash(context, hash);
1340                         tls_prf(context, out,
1341                                          TLS_MIN_FINISHED_OPAQUE_LEN,
1342                                          context->master_key,
1343                                          context->master_key_len,
1344                                          (unsigned char *)
1345                                          "server finished", 15, hash,
1346                                          hash_len, NULL, 0);
1347                         tls_destroy_hash(context);
1348                 }
1349         } else {
1350                 /* client */
1351                 hash_len = tls_get_hash(context, hash);
1352                 tls_prf(context, out, TLS_MIN_FINISHED_OPAQUE_LEN,
1353                                  context->master_key,
1354                                  context->master_key_len,
1355                                  (unsigned char *) "client finished", 15,
1356                                  hash, hash_len, NULL, 0);
1357         }
1358
1359         tls_packet_append(packet, out, out_size);
1360         tls_packet_update(packet);
1361         DEBUG_DUMP_HEX_LABEL("VERIFY DATA", out, out_size);
1362         tls_queue_packet(packet);
1363         LEAVE;
1364         return;
1365 }
1366
1367 static int tls_key_length(struct TLSContext *context) {
1368         switch (context->cipher) {
1369                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1370                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1371                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1372                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1373                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1374                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1375                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1376                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1377                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1378                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1379                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1380                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1381                 case TLS_AES_128_GCM_SHA256:
1382                         return 16;
1383                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1384                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1385                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1386                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1387                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1388                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1389                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1390                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1391                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1392                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1393                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1394                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1395                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1396                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1397                 case TLS_AES_256_GCM_SHA384:
1398                 case TLS_CHACHA20_POLY1305_SHA256:
1399                         return 32;
1400         }
1401         return 0;
1402 }
1403
1404 /* 0 is none, 1 is GCM?, 2 is chacha */
1405 int tls_is_aead(struct TLSContext *context) {
1406         switch (context->cipher) {
1407                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1408                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1409                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1410                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1411                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1412                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1413                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1414                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1415                 case TLS_AES_128_GCM_SHA256:
1416                 case TLS_AES_256_GCM_SHA384:
1417                         return 1;
1418                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1419                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1420                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1421                 case TLS_CHACHA20_POLY1305_SHA256:
1422                         return 2;
1423         }
1424         return 0;
1425 }
1426
1427 int tls_mac_length(struct TLSContext *context) {
1428         switch (context->cipher) {
1429                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1430                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1431                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1432                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1433                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1434                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1435                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1436                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1437                         return TLS_SHA1_MAC_SIZE;
1438                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1439                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1440                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1441                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1442                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1443                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1444                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1445                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1446                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1447                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1448                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1449                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1450                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1451                 case TLS_AES_128_GCM_SHA256:
1452                 case TLS_CHACHA20_POLY1305_SHA256:
1453                 case TLS_AES_128_CCM_SHA256:
1454                 case TLS_AES_128_CCM_8_SHA256:
1455                         return TLS_SHA256_MAC_SIZE;
1456                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1457                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1458                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1459                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1460                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1461                 case TLS_AES_256_GCM_SHA384:
1462                         return TLS_SHA384_MAC_SIZE;
1463         }
1464         return 0;
1465 }
1466
1467 int _private_tls13_key(struct TLSContext *context, int handshake) {
1468         int key_length = tls_key_length(context);
1469         int mac_length = tls_mac_length(context);
1470
1471         if (!context->premaster_key || !context->premaster_key_len) {
1472                 return 0;
1473         }
1474
1475         if (!key_length || !mac_length) {
1476                 DEBUG_PRINT
1477                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1478                      key_length, mac_length);
1479                 return 0;
1480         }
1481
1482         unsigned char *clientkey = NULL;
1483         unsigned char *serverkey = NULL;
1484         unsigned char *clientiv = NULL;
1485         unsigned char *serveriv = NULL;
1486         int is_aead = tls_is_aead(context);
1487
1488         unsigned char local_keybuffer[TLS_V13_MAX_KEY_SIZE];
1489         unsigned char local_ivbuffer[TLS_V13_MAX_IV_SIZE];
1490         unsigned char remote_keybuffer[TLS_V13_MAX_KEY_SIZE];
1491         unsigned char remote_ivbuffer[TLS_V13_MAX_IV_SIZE];
1492
1493         unsigned char prk[TLS_MAX_HASH_SIZE];
1494         unsigned char hash[TLS_MAX_HASH_SIZE];
1495         static unsigned char earlysecret[TLS_MAX_HASH_SIZE];
1496
1497         const char *server_key = "s ap traffic";
1498         const char *client_key = "c ap traffic";
1499         if (handshake) {
1500                 server_key = "s hs traffic";
1501                 client_key = "c hs traffic";
1502         }
1503
1504         unsigned char salt[TLS_MAX_HASH_SIZE];
1505
1506         hash_state md;
1507         /* TODO what is the point of this ? */
1508         if (mac_length == TLS_SHA384_MAC_SIZE) {
1509                 sha384_init(&md);
1510                 sha384_done(&md, hash);
1511         } else {
1512                 sha256_init(&md);
1513                 sha256_done(&md, hash);
1514         }
1515         /* extract secret "early" */
1516         if (context->master_key && context->master_key_len && !handshake) {
1517                 DEBUG_DUMP_HEX_LABEL("USING PREVIOUS SECRET",
1518                                      context->master_key,
1519                                      context->master_key_len);
1520                 tls_hkdf_expand_label(mac_length, salt, mac_length,
1521                                 context->master_key, context->master_key_len,
1522                                 "derived", 7, hash, mac_length);
1523                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1524                 tls_hkdf_extract(mac_length, prk, mac_length, salt, mac_length,
1525                                 earlysecret, mac_length);
1526         } else {
1527                 tls_hkdf_extract(mac_length, prk, mac_length, NULL, 0,
1528                                 earlysecret, mac_length);
1529                 /* derive secret for handshake "tls13 derived": */
1530                 DEBUG_DUMP_HEX_LABEL("null hash", hash, mac_length);
1531                 tls_hkdf_expand_label(mac_length, salt, mac_length, prk,
1532                                 mac_length, "derived", 7, hash, mac_length);
1533                 /* extract secret "handshake": */
1534                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1535                 tls_hkdf_extract(mac_length, prk, mac_length,
1536                                           salt, mac_length,
1537                                           context->premaster_key,
1538                                           context->premaster_key_len);
1539         }
1540
1541         if (!is_aead) {
1542                 DEBUG_PRINT("KEY EXPANSION FAILED, NON AEAD CIPHER\n");
1543                 return 0;
1544         }
1545
1546         unsigned char secret[TLS_MAX_MAC_SIZE];
1547         unsigned char hs_secret[TLS_MAX_HASH_SIZE];
1548
1549         int hash_size;
1550         if (handshake) {
1551                 hash_size = tls_get_hash(context, hash);
1552         } else {
1553                 hash_size = tls_done_hash(context, hash);
1554         }
1555
1556         DEBUG_DUMP_HEX_LABEL("messages hash", hash, hash_size);
1557
1558         if (context->is_server) {
1559                 tls_hkdf_expand_label(mac_length, hs_secret, mac_length, prk,
1560                                 mac_length, server_key, 12, context->
1561                                 server_finished_hash ?  context->
1562                                 server_finished_hash : hash, hash_size);
1563                 DEBUG_DUMP_HEX_LABEL(server_key, hs_secret, mac_length);
1564                 serverkey = local_keybuffer;
1565                 serveriv = local_ivbuffer;
1566                 clientkey = remote_keybuffer;
1567                 clientiv = remote_ivbuffer;
1568         } else {
1569                 tls_hkdf_expand_label(mac_length, hs_secret,
1570                                                mac_length, prk, mac_length,
1571                                                client_key, 12,
1572                                                context->
1573                                                server_finished_hash ?
1574                                                context->
1575                                                server_finished_hash : hash,
1576                                                hash_size);
1577                 serverkey = remote_keybuffer;
1578                 serveriv = remote_ivbuffer;
1579                 clientkey = local_keybuffer;
1580                 clientiv = local_ivbuffer;
1581         }
1582
1583         int iv_length = TLS_13_AES_GCM_IV_LENGTH;
1584         if (is_aead == 2) {
1585                 iv_length = TLS_CHACHA20_IV_LENGTH;
1586         }
1587
1588         tls_hkdf_expand_label(mac_length, local_keybuffer, key_length,
1589                         hs_secret, mac_length, "key", 3, NULL, 0);
1590         tls_hkdf_expand_label(mac_length, local_ivbuffer, iv_length, hs_secret,
1591                         mac_length, "iv", 2, NULL, 0);
1592
1593         tls_hkdf_expand_label(mac_length, secret,
1594                         mac_length, prk, mac_length,
1595                         context->is_server ? client_key : server_key,
1596                         12,
1597                         context->server_finished_hash ?
1598                         context->server_finished_hash :
1599                         hash,
1600                         hash_size);
1601
1602         tls_hkdf_expand_label(mac_length, remote_keybuffer, key_length, secret,
1603                         mac_length, "key", 3, NULL, 0);
1604         tls_hkdf_expand_label(mac_length, remote_ivbuffer, iv_length, secret,
1605                         mac_length, "iv", 2, NULL, 0);
1606
1607         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1608         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1609         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1610         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1611         free(context->finished_key);
1612         free(context->remote_finished_key);
1613
1614         if (handshake) {
1615                 context->finished_key = malloc(mac_length);
1616                 context->remote_finished_key = malloc(mac_length);
1617
1618                 if (context->finished_key) {
1619                         tls_hkdf_expand_label(mac_length,
1620                                         context->finished_key, mac_length,
1621                                         hs_secret, mac_length, "finished", 8,
1622                                         NULL, 0);
1623                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1624                                         mac_length);
1625                 }
1626
1627                 if (context->remote_finished_key) {
1628                         tls_hkdf_expand_label(mac_length,
1629                                         context->remote_finished_key,
1630                                         mac_length, secret, mac_length,
1631                                         "finished", 8, NULL, 0);
1632                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1633                                         mac_length);
1634                 }
1635         } else {
1636                 context->finished_key = NULL;
1637                 context->remote_finished_key = NULL;
1638                 free(context->server_finished_hash);
1639                 context->server_finished_hash = NULL;
1640         }
1641
1642         if (context->is_server) {
1643                 if (is_aead == 2) {
1644                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1645                                         clientiv, iv_length);
1646                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1647                                         serveriv, iv_length);
1648                 } else if (is_aead) {
1649                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1650                                         clientiv, iv_length);
1651                         memcpy(context->crypto.ctx_local_mac.local_iv,
1652                                         serveriv, iv_length);
1653                 }
1654                 if (tls_crypto_create(context, key_length,
1655                                         serverkey, serveriv, clientkey,
1656                                         clientiv)) {
1657                         return 0;
1658                 }
1659         } else {
1660                 if (is_aead == 2) {
1661                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1662                                clientiv, iv_length);
1663                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1664                                serveriv, iv_length);
1665                 } else if (is_aead) {
1666                         memcpy(context->crypto.ctx_local_mac.local_iv,
1667                                         clientiv, iv_length);
1668                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1669                                         serveriv, iv_length);
1670                 }
1671
1672                 if (tls_crypto_create(context, key_length,
1673                                         clientkey, clientiv, serverkey,
1674                                         serveriv)) {
1675                         return 0;
1676                 }
1677         }
1678
1679         context->crypto.created = 1 + is_aead;
1680
1681         free(context->master_key);
1682         context->master_key = malloc(mac_length);
1683         if (context->master_key) {
1684                 memcpy(context->master_key, prk, mac_length);
1685                 context->master_key_len = mac_length;
1686         }
1687         context->local_sequence_number = 0;
1688         context->remote_sequence_number = 0;
1689
1690         /*
1691          * extract client_mac_key(mac_key_length)
1692          * extract server_mac_key(mac_key_length)
1693          * extract client_key(enc_key_length)
1694          * extract server_key(enc_key_length)
1695          * extract client_iv(fixed_iv_lengh)
1696          * extract server_iv(fixed_iv_length)
1697          */
1698         return 1;
1699 }
1700
1701 static int tls_expand_key(struct TLSContext *context) {
1702         unsigned char key[TLS_MAX_KEY_EXPANSION_SIZE];
1703         if (context->tlsver == TLS_VERSION13) {
1704                 return 0;
1705         }
1706
1707         if (!context->master_key || !context->master_key_len) {
1708                 return 0;
1709         }
1710
1711         int key_length = tls_key_length(context);
1712         int mac_length = tls_mac_length(context);
1713
1714         if (!key_length || !mac_length) {
1715                 DEBUG_PRINT
1716                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1717                      key_length, mac_length);
1718                 return 0;
1719         }
1720         unsigned char *clientkey = NULL;
1721         unsigned char *serverkey = NULL;
1722         unsigned char *clientiv = NULL;
1723         unsigned char *serveriv = NULL;
1724         int iv_length = TLS_AES_IV_LENGTH;
1725         int is_aead = tls_is_aead(context);
1726
1727         if (context->is_server) {
1728                 tls_prf(context, key, sizeof(key),
1729                                  context->master_key, context->master_key_len,
1730                                  (unsigned char *) "key expansion", 13,
1731                                  context->local_random, TLS_SERVER_RANDOM_SIZE,
1732                                  context->remote_random,
1733                                  TLS_CLIENT_RANDOM_SIZE);
1734         } else {
1735                 tls_prf(context, key, sizeof(key),
1736                                  context->master_key,
1737                                  context->master_key_len,
1738                                  (unsigned char *) "key expansion", 13,
1739                                  context->remote_random,
1740                                  TLS_SERVER_RANDOM_SIZE,
1741                                  context->local_random,
1742                                  TLS_CLIENT_RANDOM_SIZE);
1743         }
1744
1745         DEBUG_DUMP_HEX_LABEL("LOCAL RANDOM ", context->local_random,
1746                              TLS_SERVER_RANDOM_SIZE);
1747         DEBUG_DUMP_HEX_LABEL("REMOTE RANDOM", context->remote_random,
1748                              TLS_CLIENT_RANDOM_SIZE);
1749         DEBUG_PRINT("\n=========== EXPANSION ===========\n");
1750         DEBUG_DUMP_HEX(key, TLS_MAX_KEY_EXPANSION_SIZE);
1751         DEBUG_PRINT("\n");
1752
1753         int pos = 0;
1754         if (is_aead == 2) {
1755                 iv_length = TLS_CHACHA20_IV_LENGTH;
1756         } else {
1757                 if (is_aead) {
1758                         iv_length = TLS_AES_GCM_IV_LENGTH;
1759                 } else {
1760                         if (context->is_server) {
1761                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1762                                                 &key[pos], mac_length);
1763                                 pos += mac_length;
1764                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1765                                                 &key[pos], mac_length);
1766                                 pos += mac_length;
1767                         } else {
1768                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1769                                                 &key[pos], mac_length);
1770                                 pos += mac_length;
1771                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1772                                                 &key[pos], mac_length);
1773                                 pos += mac_length;
1774                         }
1775                 }
1776         }
1777
1778         clientkey = &key[pos];
1779         pos += key_length;
1780         serverkey = &key[pos];
1781         pos += key_length;
1782         clientiv = &key[pos];
1783         pos += iv_length;
1784         serveriv = &key[pos];
1785         pos += iv_length;
1786         DEBUG_PRINT("EXPANSION %i/%i\n", (int) pos,
1787                         (int) TLS_MAX_KEY_EXPANSION_SIZE);
1788         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1789         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1790         DEBUG_DUMP_HEX_LABEL("CLIENT MAC KEY",
1791                         context->is_server ? context->crypto.
1792                         ctx_remote_mac.remote_mac : context->
1793                         crypto.ctx_local_mac.local_mac,
1794                         mac_length);
1795         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1796         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1797         DEBUG_DUMP_HEX_LABEL("SERVER MAC KEY",
1798                         context->is_server ? context->crypto.
1799                         ctx_local_mac.local_mac : context->crypto.
1800                         ctx_remote_mac.remote_mac, mac_length);
1801         if (context->is_server) {
1802                 if (is_aead == 2) {
1803                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1804                                         clientiv, iv_length);
1805                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1806                                         serveriv, iv_length);
1807                 } else {
1808                         if (is_aead) {
1809                                 memcpy(context->crypto.ctx_remote_mac.
1810                                                 remote_aead_iv, clientiv, iv_length);
1811                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1812                                                 serveriv, iv_length);
1813                         }
1814                 }
1815
1816                 if (tls_crypto_create(context, key_length,
1817                                         serverkey, serveriv, clientkey,
1818                                         clientiv)) {
1819                         return 0;
1820                 }
1821         } else {
1822                 if (is_aead == 2) {
1823                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1824                                         clientiv, iv_length);
1825                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1826                                         serveriv, iv_length);
1827                 } else {
1828                         if (is_aead) {
1829                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1830                                                 clientiv, iv_length);
1831                                 memcpy(context->crypto.ctx_remote_mac.
1832                                                 remote_aead_iv, serveriv, iv_length);
1833                         }
1834                 }
1835
1836                 if (tls_crypto_create(context, key_length,
1837                                         clientkey, clientiv, serverkey,
1838                                         serveriv)) {
1839                         return 0;
1840                 }
1841         }
1842
1843         /*
1844          * extract client_mac_key(mac_key_length)
1845          * extract server_mac_key(mac_key_length)
1846          * extract client_key(enc_key_length)
1847          * extract server_key(enc_key_length)
1848          * extract client_iv(fixed_iv_lengh)
1849          * extract server_iv(fixed_iv_length)
1850          */
1851         return 1;
1852 }
1853
1854 int tls_compute_key(struct TLSContext *context, unsigned int key_len) {
1855         if (context->tlsver == TLS_VERSION13) {
1856                 return 0;
1857         }
1858
1859         if (!context->premaster_key || !context->premaster_key_len
1860             || key_len < 48) {
1861                 DEBUG_PRINT("CANNOT COMPUTE MASTER SECRET\n");
1862                 return 0;
1863         }
1864
1865         unsigned char master_secret_label[] = "master secret";
1866 #ifdef TLS_CHECK_PREMASTER_KEY
1867         if (!tls_cipher_is_ephemeral(context)) {
1868                 uint16_t version = get16(context->premaster_key);
1869                 /* this check is not true for DHE/ECDHE ciphers */
1870                 if (context->version > version) {
1871                         DEBUG_PRINT("Mismatch protocol version 0x(%x)\n",
1872                                     version);
1873                         return 0;
1874                 }
1875         }
1876 #endif
1877         free(context->master_key);
1878         context->master_key_len = 0;
1879         context->master_key = NULL;
1880
1881         context->master_key = malloc(key_len);
1882         if (!context->master_key) {
1883                 return 0;
1884         }
1885
1886         context->master_key_len = key_len;
1887         if (context->is_server) {
1888                 tls_prf(context,
1889                                 context->master_key,
1890                                 context->master_key_len,
1891                                 context->premaster_key,
1892                                 context->premaster_key_len,
1893                                 master_secret_label, 13,
1894                                 context->remote_random,
1895                                 TLS_CLIENT_RANDOM_SIZE,
1896                                 context->local_random,
1897                                 TLS_SERVER_RANDOM_SIZE);
1898         } else {
1899                 tls_prf(context,
1900                                 context->master_key,
1901                                 context->master_key_len,
1902                                 context->premaster_key,
1903                                 context->premaster_key_len,
1904                                 master_secret_label, 13,
1905                                 context->local_random,
1906                                 TLS_CLIENT_RANDOM_SIZE,
1907                                 context->remote_random,
1908                                 TLS_SERVER_RANDOM_SIZE);
1909         }
1910         free(context->premaster_key);
1911         context->premaster_key = NULL;
1912         context->premaster_key_len = 0;
1913         DEBUG_PRINT("\n=========== Master key ===========\n");
1914         DEBUG_DUMP_HEX(context->master_key,
1915                         context->master_key_len);
1916         DEBUG_PRINT("\n");
1917         tls_expand_key(context);
1918         return 1;
1919 }
1920
1921 int _is_oid(const unsigned char *oid, const unsigned char *compare_to,
1922             int compare_to_len) {
1923         int i = 0;
1924         while ((oid[i]) && (i < compare_to_len)) {
1925                 if (oid[i] != compare_to[i])
1926                         return 0;
1927
1928                 i++;
1929         }
1930         return 1;
1931 }
1932
1933 int _is_oid2(const unsigned char *oid, const unsigned char *compare_to,
1934              int compare_to_len, int oid_len) {
1935         int i = 0;
1936         if (oid_len < compare_to_len) {
1937                 compare_to_len = oid_len;
1938         }
1939
1940         while (i < compare_to_len) {
1941                 if (oid[i] != compare_to[i]) {
1942                         return 0;
1943                 }
1944
1945                 i++;
1946         }
1947         return 1;
1948 }
1949
1950 struct TLSCertificate *tls_create_certificate() {
1951         struct TLSCertificate zero = { 0 };
1952         struct TLSCertificate *cert = malloc(sizeof *cert);
1953         if (cert) {
1954                 *cert = zero;
1955         }
1956         cert->not_before[0] = 0;
1957         cert->not_after[0] = 0;
1958
1959         return cert;
1960 }
1961
1962 int tls_certificate_valid_subject_name(const unsigned char *cert_subject,
1963                                        const char *subject) {
1964         /* no subjects ... */
1965         if ((!cert_subject || !cert_subject[0]) && (!subject || !subject[0])) {
1966                 return 0;
1967         }
1968
1969         if (!subject || !subject[0]) {
1970                 return bad_certificate;
1971         }
1972
1973         if (!cert_subject || !cert_subject[0]) {
1974                 return bad_certificate;
1975         }
1976
1977         /* exact match */
1978         if (!strcmp((const char *) cert_subject, subject)) {
1979                 return 0;
1980         }
1981
1982         const char *wildcard = strchr((const char *) cert_subject, '*');
1983         if (wildcard) {
1984                 /* 6.4.3 (1) The client SHOULD NOT attempt to match a presented
1985                  * identifier in which the wildcard character comprises a label
1986                  * other than the left-most label
1987                  */
1988                 if (!wildcard[1]) {
1989                         /* subject is [*]
1990                          * or
1991                          * subject is [something*] .. invalid
1992                          */
1993                         return bad_certificate;
1994                 }
1995                 wildcard++;
1996                 const char *match = strstr(subject, wildcard);
1997                 if ((!match) && (wildcard[0] == '.')) {
1998                         /* check *.domain.com against domain.com */
1999                         wildcard++;
2000                         if (!strcasecmp(subject, wildcard))
2001                                 return 0;
2002                 }
2003                 if (match) {
2004                         unsigned long offset = (unsigned long) match -
2005                                 (unsigned long) subject;
2006                         if (offset) {
2007                                 /* check for foo.*.domain.com against *.domain.com (invalid) */
2008                                 if (memchr(subject, '.', offset))
2009                                         return bad_certificate;
2010                         }
2011                         /* check if exact match */
2012                         if (!strcasecmp(match, wildcard)) {
2013                                 return 0;
2014                         }
2015                 }
2016         }
2017
2018         return bad_certificate;
2019 }
2020
2021 int tls_certificate_valid_subject(struct TLSCertificate *cert,
2022                                   const char *subject) {
2023         int i;
2024         if (!cert) {
2025                 return certificate_unknown;
2026         }
2027
2028         int err = tls_certificate_valid_subject_name(cert->subject, subject);
2029         if (err && cert->san) {
2030                 for (i = 0; i < cert->san_length; i++) {
2031                         err = tls_certificate_valid_subject_name(cert->san[i],
2032                                         subject);
2033                         if (!err) {
2034                                 return err;
2035                         }
2036                 }
2037         }
2038         return err;
2039 }
2040
2041 int tls_certificate_is_valid(struct TLSCertificate *cert) {
2042         if (!cert) {
2043                 return certificate_unknown;
2044         }
2045
2046         char ts[16]; /* YYYYMMDDHHMMSSZ */
2047         time_t t = time(NULL);
2048         struct tm *utc = gmtime(&t);
2049
2050         if (utc) {
2051                 strftime(ts, sizeof ts, "%Y%m%d%H%M%SZ", utc);
2052
2053                 if (strcmp(cert->not_before, ts) > 0) {
2054                         DEBUG_PRINT
2055                             ("Certificate is not yet valid, now: %s (validity: %s - %s)\n",
2056                              ts, cert->not_before, cert->not_after);
2057                         return certificate_expired;
2058                 }
2059
2060                 if (strcmp(cert->not_after, ts) < 0) {
2061                         DEBUG_PRINT
2062                             ("Expired certificate, now: %s (validity: %s - %s)\n",
2063                              ts, cert->not_before, cert->not_after);
2064                         return certificate_expired;
2065                 }
2066                 DEBUG_PRINT("Valid certificate, now: %s (validity: %s - %s)\n",
2067                                 ts, cert->not_before,
2068                                 cert->not_after);
2069         }
2070         return 0;
2071 }
2072
2073 void tls_certificate_set_copy(unsigned char **member,
2074                               const unsigned char *val, int len) {
2075         if (!member) {
2076                 return;
2077         }
2078
2079         free(*member);
2080
2081         if (len) {
2082                 *member = malloc(len + 1);
2083                 if (*member) {
2084                         memcpy(*member, val, len);
2085                         (*member)[len] = 0;
2086                 }
2087         } else {
2088                 *member = NULL;
2089         }
2090 }
2091
2092 void tls_certificate_set_copy_date(unsigned char *member,
2093                                    const unsigned char *val, int len) {
2094
2095         if (len > 4) {
2096                 if (val[0] >= '5') {
2097                         member[0] = '1';
2098                         member[1] = '9';
2099                 } else {
2100                         member[0] = '2';
2101                         member[1] = '0';
2102                 }
2103                 memcpy(member + 2, val, len);
2104                 member[len] = 0;
2105         } else {
2106                 member[0] = 0;
2107         }
2108 }
2109
2110 void tls_certificate_set_key(struct TLSCertificate *cert,
2111                              const unsigned char *val, int len) {
2112         if (!val[0] && len % 2) {
2113                 val++;
2114                 len--;
2115         }
2116         tls_certificate_set_copy(&cert->pk, val, len);
2117         if (cert->pk) {
2118                 cert->pk_len = len;
2119         }
2120 }
2121
2122 void tls_certificate_set_priv(struct TLSCertificate *cert,
2123                               const unsigned char *val, int len) {
2124         tls_certificate_set_copy(&cert->priv, val, len);
2125         if (cert->priv) {
2126                 cert->priv_len = len;
2127         }
2128 }
2129
2130 void tls_certificate_set_sign_key(struct TLSCertificate *cert,
2131                                   const unsigned char *val, int len) {
2132         if (!val[0] && len % 2) {
2133                 val++;
2134                 len--;
2135         }
2136         tls_certificate_set_copy(&cert->sign_key, val, len);
2137         if (cert->sign_key) {
2138                 cert->sign_len = len;
2139         }
2140 }
2141
2142 void tls_certificate_set_exponent(struct TLSCertificate *cert,
2143                                   const unsigned char *val, int len) {
2144         tls_certificate_set_copy(&cert->exponent, val, len);
2145         if (cert->exponent) {
2146                 cert->exponent_len = len;
2147         }
2148 }
2149
2150 void tls_certificate_set_serial(struct TLSCertificate *cert,
2151                                 const unsigned char *val, int len) {
2152         tls_certificate_set_copy(&cert->serial_number, val, len);
2153         if (cert->serial_number) {
2154                 cert->serial_len = len;
2155         }
2156 }
2157
2158 void tls_certificate_set_algorithm(unsigned int *algorithm,
2159                                    const unsigned char *val, int len) {
2160         if (len == 7 && _is_oid(val, TLS_EC_PUBLIC_KEY_OID, 7)) {
2161                 *algorithm = TLS_EC_PUBLIC_KEY;
2162                 return;
2163         }
2164
2165         if (len == 8) {
2166                 if (_is_oid(val, TLS_EC_prime192v1_OID, len)) {
2167                         *algorithm = TLS_EC_prime192v1;
2168                         return;
2169                 }
2170                 if (_is_oid(val, TLS_EC_prime192v2_OID, len)) {
2171                         *algorithm = TLS_EC_prime192v2;
2172                         return;
2173                 }
2174                 if (_is_oid(val, TLS_EC_prime192v3_OID, len)) {
2175                         *algorithm = TLS_EC_prime192v3;
2176                         return;
2177                 }
2178                 if (_is_oid(val, TLS_EC_prime239v1_OID, len)) {
2179                         *algorithm = TLS_EC_prime239v1;
2180                         return;
2181                 }
2182                 if (_is_oid(val, TLS_EC_prime239v2_OID, len)) {
2183                         *algorithm = TLS_EC_prime239v2;
2184                         return;
2185                 }
2186                 if (_is_oid(val, TLS_EC_prime239v3_OID, len)) {
2187                         *algorithm = TLS_EC_prime239v3;
2188                         return;
2189                 }
2190                 if (_is_oid(val, TLS_EC_prime256v1_OID, len)) {
2191                         *algorithm = TLS_EC_prime256v1;
2192                         return;
2193                 }
2194         }
2195         if (len == 5) {
2196                 if (_is_oid2
2197                     (val, TLS_EC_secp224r1_OID, len,
2198                      sizeof(TLS_EC_secp224r1_OID) - 1)) {
2199                         *algorithm = TLS_EC_secp224r1;
2200                         return;
2201                 }
2202                 if (_is_oid2
2203                     (val, TLS_EC_secp384r1_OID, len,
2204                      sizeof(TLS_EC_secp384r1_OID) - 1)) {
2205                         *algorithm = TLS_EC_secp384r1;
2206                         return;
2207                 }
2208                 if (_is_oid2
2209                     (val, TLS_EC_secp521r1_OID, len,
2210                      sizeof(TLS_EC_secp521r1_OID) - 1)) {
2211                         *algorithm = TLS_EC_secp521r1;
2212                         return;
2213                 }
2214         }
2215         if (len != 9) {
2216                 return;
2217         }
2218
2219         if (_is_oid(val, TLS_RSA_SIGN_SHA256_OID, 9)) {
2220                 *algorithm = TLS_RSA_SIGN_SHA256;
2221                 return;
2222         }
2223
2224         if (_is_oid(val, TLS_RSA_SIGN_RSA_OID, 9)) {
2225                 *algorithm = TLS_RSA_SIGN_RSA;
2226                 return;
2227         }
2228
2229         if (_is_oid(val, TLS_RSA_SIGN_SHA1_OID, 9)) {
2230                 *algorithm = TLS_RSA_SIGN_SHA1;
2231                 return;
2232         }
2233
2234         if (_is_oid(val, TLS_RSA_SIGN_SHA512_OID, 9)) {
2235                 *algorithm = TLS_RSA_SIGN_SHA512;
2236                 return;
2237         }
2238
2239         if (_is_oid(val, TLS_RSA_SIGN_SHA384_OID, 9)) {
2240                 *algorithm = TLS_RSA_SIGN_SHA384;
2241                 return;
2242         }
2243
2244         if (_is_oid(val, TLS_RSA_SIGN_MD5_OID, 9)) {
2245                 *algorithm = TLS_RSA_SIGN_MD5;
2246                 return;
2247         }
2248 }
2249
2250 void tls_destroy_certificate(struct TLSCertificate *cert) {
2251         if (cert) {
2252                 int i;
2253                 free(cert->exponent);
2254                 free(cert->pk);
2255                 free(cert->issuer_country);
2256                 free(cert->issuer_state);
2257                 free(cert->issuer_location);
2258                 free(cert->issuer_entity);
2259                 free(cert->issuer_subject);
2260                 free(cert->country);
2261                 free(cert->state);
2262                 free(cert->location);
2263                 free(cert->subject);
2264                 for (i = 0; i < cert->san_length; i++) {
2265                         free(cert->san[i]);
2266                 }
2267                 free(cert->san);
2268                 free(cert->ocsp);
2269                 free(cert->serial_number);
2270                 free(cert->entity);
2271                 cert->not_before[0] = 0;
2272                 cert->not_after[0] = 0;
2273                 free(cert->sign_key);
2274                 free(cert->priv);
2275                 free(cert->der_bytes);
2276                 free(cert->bytes);
2277                 free(cert->fingerprint);
2278                 free(cert);
2279         }
2280 }
2281
2282 struct TLSPacket *tls_create_packet(struct TLSContext *context,
2283                                     unsigned char type,
2284                                     unsigned short version,
2285                                     int payload_size_hint) {
2286         struct TLSPacket *packet = malloc(sizeof *packet);
2287         if (!packet) {
2288                 return NULL;
2289         }
2290         packet->broken = 0;
2291         if (payload_size_hint > 0) {
2292                 packet->size = payload_size_hint + 10;
2293         } else {
2294                 packet->size = TLS_BLOB_INCREMENT;
2295         }
2296         packet->buf = malloc(packet->size);
2297         memset(packet->buf, 0, packet->size);
2298         packet->context = context;
2299         if (!packet->buf) {
2300                 free(packet);
2301                 return NULL;
2302         }
2303         if (context) {
2304                 packet->payload_pos = 6;
2305                 packet->len = packet->payload_pos - 1;
2306         } else {
2307                 packet->len = 5;
2308         }
2309         packet->buf[0] = type;
2310
2311         /* big endian protocol version */
2312         packet->buf[1] = version >> 8;
2313         packet->buf[2] = version & 0xff;
2314         if (version == TLS_V13) {
2315                 packet->buf[2] = 0x04;
2316         }
2317
2318         return packet;
2319 }
2320
2321 void tls_destroy_packet(struct TLSPacket *packet) {
2322         if (packet) {
2323                 if (packet->buf) {
2324                         free(packet->buf);
2325                 }
2326                 free(packet);
2327         }
2328 }
2329
2330 int tls_crypto_create(struct TLSContext *context, int key_length,
2331                                unsigned char *localkey,
2332                                unsigned char *localiv,
2333                                unsigned char *remotekey,
2334                                unsigned char *remoteiv) {
2335         if (context->crypto.created) {
2336                 if (context->crypto.created == 1) {
2337                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2338                         cbc_done(&context->crypto.ctx_local.aes_local);
2339                 } else {
2340                         if (context->crypto.created == 2) {
2341                                 unsigned char dummy_buffer[32];
2342                                 unsigned long tag_len = 0;
2343                                 gcm_done(&context->crypto.ctx_remote.
2344                                          aes_gcm_remote, dummy_buffer,
2345                                          &tag_len);
2346                                 gcm_done(&context->crypto.ctx_local.
2347                                          aes_gcm_local, dummy_buffer,
2348                                          &tag_len);
2349                         }
2350                 }
2351                 context->crypto.created = 0;
2352         }
2353         int is_aead = tls_is_aead(context);
2354         int cipherID = find_cipher("aes");
2355         DEBUG_PRINT("Using cipher ID: %x\n", (int) context->cipher);
2356         if (is_aead == 2) {
2357                 unsigned int counter = 1;
2358
2359                 chacha_keysetup(&context->crypto.ctx_local.chacha_local,
2360                                 localkey, key_length * 8);
2361                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_local.
2362                                           chacha_local, localiv,
2363                                           (unsigned char *) &counter);
2364
2365                 chacha_keysetup(&context->crypto.ctx_remote.chacha_remote,
2366                                 remotekey, key_length * 8);
2367                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_remote.
2368                                           chacha_remote, remoteiv,
2369                                           (unsigned char *) &counter);
2370
2371                 context->crypto.created = 3;
2372         } else {
2373                 if (is_aead) {
2374                         int res1 =
2375                                 gcm_init(&context->crypto.ctx_local.aes_gcm_local,
2376                                                 cipherID, localkey, key_length);
2377                         int res2 =
2378                                 gcm_init(&context->crypto.ctx_remote.aes_gcm_remote,
2379                                                 cipherID, remotekey, key_length);
2380
2381                         if (res1 || res2) {
2382                                 return TLS_GENERIC_ERROR;
2383                         }
2384                         context->crypto.created = 2;
2385                 } else {
2386                         int res1 =
2387                                 cbc_start(cipherID, localiv, localkey, key_length, 0,
2388                                                 &context->crypto.ctx_local.aes_local);
2389                         int res2 =
2390                                 cbc_start(cipherID, remoteiv, remotekey, key_length, 0,
2391                                                 &context->crypto.ctx_remote.aes_remote);
2392
2393                         if (res1 || res2) {
2394                                 return TLS_GENERIC_ERROR;
2395                         }
2396                         context->crypto.created = 1;
2397                 }
2398         }
2399         return 0;
2400 }
2401
2402 static void tls_crypto_done(struct TLSContext *context) {
2403         unsigned char dummy_buffer[32];
2404         unsigned long tag_len = 0;
2405
2406         switch (context->crypto.created) {
2407                 case 1:
2408                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2409                         cbc_done(&context->crypto.ctx_local.aes_local);
2410                         break;
2411                 case 2:
2412                         gcm_done(&context->crypto.ctx_remote.aes_gcm_remote,
2413                                         dummy_buffer, &tag_len);
2414                         gcm_done(&context->crypto.ctx_local.aes_gcm_local,
2415                                         dummy_buffer, &tag_len);
2416                         break;
2417         }
2418         context->crypto.created = 0;
2419 }
2420
2421 int tls_packet_append(struct TLSPacket *packet, const unsigned char *buf,
2422                       unsigned int len) {
2423         void *new;
2424
2425         if (!packet || packet->broken) {
2426                 return -1;
2427         }
2428
2429         if (!len) {
2430                 return 0;
2431         }
2432
2433         unsigned int new_len = packet->len + len;
2434
2435         if (new_len > packet->size) {
2436                 packet->size = (new_len / TLS_BLOB_INCREMENT + 1) *
2437                         TLS_BLOB_INCREMENT;
2438                 new = TLS_REALLOC(packet->buf, packet->size);
2439                 if (new) {
2440                         packet->buf = new;
2441                 } else {
2442                         free(packet->buf);
2443                         packet->size = 0;
2444                         packet->len = 0;
2445                         packet->broken = 1;
2446                         return -1;
2447                 }
2448         }
2449         memcpy(packet->buf + packet->len, buf, len);
2450         packet->len = new_len;
2451         return new_len;
2452 }
2453
2454 int tls_packet_uint8(struct TLSPacket *packet, unsigned char i) {
2455         return tls_packet_append(packet, &i, 1);
2456 }
2457
2458 int tls_packet_uint16(struct TLSPacket *packet, unsigned short i) {
2459         unsigned short ni = htons(i);
2460         return tls_packet_append(packet, (unsigned char *) &ni, 2);
2461 }
2462
2463 int tls_packet_uint32(struct TLSPacket *packet, unsigned int i) {
2464         unsigned int ni = htonl(i);
2465         return tls_packet_append(packet, (unsigned char *) &ni, 4);
2466 }
2467
2468 int tls_packet_uint24(struct TLSPacket *packet, unsigned int i) {
2469         unsigned char buf[3];
2470         buf[0] = (i >> 16) & 0xff;
2471         buf[1] = (i >> 8) & 0xff;
2472         buf[2] = (i >> 0) & 0xff;
2473
2474         return tls_packet_append(packet, buf, 3);
2475 }
2476
2477 int tls_random(unsigned char *key, int len) {
2478 #ifdef __APPLE__
2479         for (int i = 0; i < len; i++) {
2480                 unsigned int v = arc4random() % 0x100;
2481                 key[i] = (char) v;
2482         }
2483         return 1;
2484 #else
2485         /* TODO use open and read */
2486         FILE *fp = fopen("/dev/urandom", "r");
2487         if (fp) {
2488                 int key_len = fread(key, 1, len, fp);
2489                 fclose(fp);
2490                 if (key_len == len)
2491                         return 1;
2492         }
2493 #endif
2494         return 0;
2495 }
2496
2497 int tls_established(struct TLSContext *context) {
2498         return context && context->connection_status == TLS_CONNECTED;
2499 }
2500
2501 void tls_read_clear(struct TLSContext *context) {
2502         if (context) {
2503                tls_buffer_free(&context->application_buffer);
2504         }
2505 }
2506
2507 struct TLSContext *tls_create_context(int is_server, unsigned short version) {
2508         struct TLSContext zero = {0};
2509         uint16_t ver = 0;
2510         struct TLSContext *context = 0;
2511
2512         if (version == TLS_V13 && !is_server) {
2513                 /* TLS 1.3 clients not supported */
2514                 return NULL;
2515         }
2516
2517         tls_init();
2518         switch (version) {
2519                 case TLS_V13:
2520                 case TLS_V12:
2521                         context = malloc(sizeof *context);
2522                         break;
2523                 default:
2524                         return NULL;
2525         }
2526
2527         ver = version - 0x0201;
2528
2529         if (context) {
2530                 *context = zero;
2531                 context->is_server = is_server;
2532                 context->version = version;
2533                 context->tlsver = ver;
2534                 context->hs_index = -1;
2535                 /* set up output buffer */
2536                 tls_buffer_init(&context->output_buffer, 0);
2537                 tls_buffer_init(&context->input_buffer, 0);
2538                 tls_buffer_init(&context->cached_handshake, 0);
2539                 tls_buffer_init(&context->application_buffer, 0);
2540         }
2541         return context;
2542 }
2543
2544 struct TLSContext *tls_accept(struct TLSContext *context) {
2545         if (!context || !context->is_server) {
2546                 return NULL;
2547         }
2548
2549         struct TLSContext *child = malloc(sizeof *child);
2550         if (child) {
2551                 memset(child, 0, sizeof(struct TLSContext));
2552                 child->is_server = 1;
2553                 child->is_child = 1;
2554                 child->version = context->version;
2555                 child->certificates = context->certificates;
2556                 child->certificates_count = context->certificates_count;
2557                 child->private_key = context->private_key;
2558                 child->ec_private_key = context->ec_private_key;
2559                 child->root_certificates = context->root_certificates;
2560                 child->root_count = context->root_count;
2561                 child->default_dhe_p = context->default_dhe_p;
2562                 child->default_dhe_g = context->default_dhe_g;
2563                 child->curve = context->curve;
2564                 child->alpn = context->alpn;
2565                 child->alpn_count = context->alpn_count;
2566         }
2567         return child;
2568 }
2569
2570 int tls_add_alpn(struct TLSContext *context, const char *alpn) {
2571         void *new;
2572
2573         if (!context || !alpn || !alpn[0]
2574             || (context->is_server && context->is_child)) {
2575                 return TLS_GENERIC_ERROR;
2576         }
2577
2578         int len = strlen(alpn);
2579         if (tls_alpn_contains(context, alpn, len)) {
2580                 return 0;
2581         }
2582
2583         new = TLS_REALLOC(context->alpn, (context->alpn_count + 1) *
2584                         sizeof(char *));
2585         if (new) {
2586                 context->alpn = new;
2587         } else {
2588                 free(context->alpn);
2589                 context->alpn = 0;
2590                 context->alpn_count = 0;
2591                 return TLS_NO_MEMORY;
2592         }
2593         char *alpn_ref = malloc(len + 1);
2594         context->alpn[context->alpn_count] = alpn_ref;
2595         if (alpn_ref) {
2596                 memcpy(alpn_ref, alpn, len);
2597                 alpn_ref[len] = 0;
2598                 context->alpn_count++;
2599         } else {
2600                 return TLS_NO_MEMORY;
2601         }
2602         return 0;
2603 }
2604
2605 int tls_alpn_contains(struct TLSContext *context, const char *alpn,
2606                       unsigned char alpn_size) {
2607         int i;
2608
2609         if (!context || !alpn || !alpn_size || !context->alpn) {
2610                 return 0;
2611         }
2612
2613         for (i = 0; i < context->alpn_count; i++) {
2614                 const char *alpn_local = context->alpn[i];
2615                 if (alpn_local) {
2616                         int len = strlen(alpn_local);
2617                         if (alpn_size == len) {
2618                                 if (!memcmp(alpn_local, alpn, alpn_size)) {
2619                                         return 1;
2620                                 }
2621                         }
2622                 }
2623         }
2624
2625         return 0;
2626 }
2627
2628 void tls_destroy_context(struct TLSContext *context) {
2629         int i;
2630
2631         if (!context) {
2632                 return;
2633         }
2634
2635         if (!context->is_child) {
2636                 if (context->certificates) {
2637                         for (i = 0; i < context->certificates_count; i++) {
2638                                 tls_destroy_certificate(context->
2639                                                         certificates[i]);
2640                         }
2641                 }
2642                 if (context->root_certificates) {
2643                         for (i = 0; i < context->root_count; i++) {
2644                                 tls_destroy_certificate(context->
2645                                                         root_certificates[i]);
2646                         }
2647                         free(context->root_certificates);
2648                         context->root_certificates = NULL;
2649                 }
2650                 if (context->private_key) {
2651                         tls_destroy_certificate(context->private_key);
2652                 }
2653                 if (context->ec_private_key) {
2654                         tls_destroy_certificate(context->ec_private_key);
2655                 }
2656                 free(context->certificates);
2657                 free(context->default_dhe_p);
2658                 free(context->default_dhe_g);
2659                 if (context->alpn) {
2660                         for (i = 0; i < context->alpn_count; i++) {
2661                                 free(context->alpn[i]);
2662                         }
2663                         free(context->alpn);
2664                 }
2665         }
2666
2667         if (context->client_certificates) {
2668                 for (i = 0; i < context->client_certificates_count; i++) {
2669                         tls_destroy_certificate(context->
2670                                                 client_certificates[i]);
2671                 }
2672                 free(context->client_certificates);
2673         }
2674
2675         context->client_certificates = NULL;
2676         free(context->master_key);
2677         free(context->premaster_key);
2678
2679         if (context->crypto.created) {
2680                 tls_crypto_done(context);
2681         }
2682
2683         tls_done_hash(context, NULL);
2684         tls_destroy_hash(context);
2685
2686         tls_buffer_free(&context->output_buffer);
2687         tls_buffer_free(&context->input_buffer);
2688         tls_buffer_free(&context->application_buffer);
2689         tls_buffer_free(&context->cached_handshake);
2690         //free(context->cached_handshake);
2691
2692         free(context->sni);
2693         tls_dhe_free(context);
2694         tls_ecc_dhe_free(context);
2695         free(context->negotiated_alpn);
2696         free(context->finished_key);
2697         free(context->remote_finished_key);
2698         free(context->server_finished_hash);
2699         free(context);
2700 }
2701
2702 int tls_cipher_is_ephemeral(struct TLSContext *context) {
2703         if (!context) {
2704                 return 0;
2705         }
2706
2707         switch (context->cipher) {
2708                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2709                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2710                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2711                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
2712                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2713                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
2714                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2715                         return 1;
2716                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2717                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2718                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2719                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2720                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
2721                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2722                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2723                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2724                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2725                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2726                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2727                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2728                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2729                         return 2;
2730                 case TLS_AES_128_GCM_SHA256:
2731                 case TLS_CHACHA20_POLY1305_SHA256:
2732                 case TLS_AES_128_CCM_SHA256:
2733                 case TLS_AES_128_CCM_8_SHA256:
2734                 case TLS_AES_256_GCM_SHA384:
2735                         if (context->dhe) {
2736                                 return 1;
2737                         }
2738                         return 2;
2739         }
2740         return 0;
2741 }
2742
2743 int tls_is_ecdsa(struct TLSContext *context) {
2744         if (!context) {
2745                 return 0;
2746         }
2747
2748         switch (context->cipher) {
2749                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2750                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2751                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2752                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2753                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2754                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2755                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2756                         return 1;
2757         }
2758
2759         if (context->ec_private_key) {
2760                 return 1;
2761         }
2762
2763         return 0;
2764 }
2765
2766 static void tls_send_server_key_exchange(struct TLSContext *context,
2767                                                 int method) {
2768         if (!context->is_server) {
2769                 DEBUG_PRINT
2770                     ("CANNOT BUILD SERVER KEY EXCHANGE MESSAGE FOR CLIENTS\n");
2771                 return;
2772         }
2773
2774         struct TLSPacket *packet =
2775             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
2776         tls_packet_uint8(packet, 0x0C);
2777         unsigned char dummy[3];
2778         tls_packet_append(packet, dummy, 3);
2779         int start_len = packet->len;
2780
2781         if (method == KEA_dhe_rsa) {
2782                 tls_dhe_create(context);
2783
2784                 const char *default_dhe_p = context->default_dhe_p;
2785                 const char *default_dhe_g = context->default_dhe_g;
2786                 int key_size;
2787                 if (!default_dhe_p || !default_dhe_g) {
2788                         default_dhe_p = TLS_DH_DEFAULT_P;
2789                         default_dhe_g = TLS_DH_DEFAULT_G;
2790                         key_size = TLS_DHE_KEY_SIZE / 8;
2791                 } else {
2792                         key_size = strlen(default_dhe_p);
2793                 }
2794                 if (tls_dh_make_key(key_size, context->dhe, default_dhe_p,
2795                                         default_dhe_g, 0, 0)) {
2796                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
2797                         free(packet);
2798                         free(context->dhe);
2799                         context->dhe = NULL;
2800                         /* TODO set error */
2801                         return;
2802                 }
2803
2804                 unsigned char dh_Ys[0xFFF];
2805                 unsigned char dh_p[0xFFF];
2806                 unsigned char dh_g[0xFFF];
2807                 unsigned long dh_p_len = sizeof(dh_p);
2808                 unsigned long dh_g_len = sizeof(dh_g);
2809                 unsigned long dh_Ys_len = sizeof(dh_Ys);
2810
2811                 if (tls_dh_export_pqY
2812                     (dh_p, &dh_p_len, dh_g, &dh_g_len, dh_Ys, &dh_Ys_len,
2813                      context->dhe)) {
2814                         DEBUG_PRINT("ERROR EXPORTING DHE KEY\n");
2815                         free(packet);
2816                         /* TODO set error */
2817                         return;
2818                 }
2819
2820                 DEBUG_PRINT("LEN: %lu (%lu, %lu)\n", dh_Ys_len, dh_p_len,
2821                             dh_g_len);
2822                 DEBUG_DUMP_HEX_LABEL("DHE PK", dh_Ys, dh_Ys_len);
2823                 DEBUG_DUMP_HEX_LABEL("DHE P", dh_p, dh_p_len);
2824                 DEBUG_DUMP_HEX_LABEL("DHE G", dh_g, dh_g_len);
2825
2826                 tls_packet_uint16(packet, dh_p_len);
2827                 tls_packet_append(packet, dh_p, dh_p_len);
2828
2829                 tls_packet_uint16(packet, dh_g_len);
2830                 tls_packet_append(packet, dh_g, dh_g_len);
2831
2832                 tls_packet_uint16(packet, dh_Ys_len);
2833                 tls_packet_append(packet, dh_Ys, dh_Ys_len);
2834                 /* dh_p */
2835                 /* dh_g */
2836                 /* dh_Ys */
2837         } else if (method == KEA_ec_diffie_hellman) {
2838                 /* 3 = named curve */
2839                 if (!context->curve) {
2840                         context->curve = tls_ecc_default_curve;
2841                 }
2842                 tls_packet_uint8(packet, 3);
2843                 tls_packet_uint16(packet, context->curve->iana);
2844                 tls_ecc_dhe_create(context);
2845
2846                 ltc_ecc_set_type *dp =
2847                     (ltc_ecc_set_type *) & context->curve->dp;
2848
2849                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
2850                                         dp)) {
2851                         free(context->ecc_dhe);
2852                         context->ecc_dhe = NULL;
2853                         DEBUG_PRINT("Error generating ECC key\n");
2854                         free(packet);
2855                         /* TODO set error */
2856                         return;
2857                 }
2858                 unsigned char out[TLS_MAX_RSA_KEY];
2859                 unsigned long out_len = TLS_MAX_RSA_KEY;
2860                 if (ecc_ansi_x963_export(context->ecc_dhe, out, &out_len)) {
2861                         DEBUG_PRINT("Error exporting ECC key\n");
2862                         free(packet);
2863                         /* TODO abort */
2864                         return;
2865                 }
2866                 tls_packet_uint8(packet, out_len);
2867                 tls_packet_append(packet, out, out_len);
2868         } else {
2869                 /* TODO abort */
2870                 free(packet);
2871                 DEBUG_PRINT("Unsupported ephemeral method: %i\n", method);
2872                 return;
2873         }
2874
2875         /* signature */
2876         unsigned int params_len = packet->len - start_len;
2877         unsigned int message_len =
2878             params_len + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
2879         unsigned char *message = malloc(message_len);
2880         if (message) {
2881                 unsigned char out[TLS_MAX_RSA_KEY];
2882                 unsigned long out_len = TLS_MAX_RSA_KEY;
2883
2884                 int hash_algorithm;
2885
2886                 hash_algorithm = sha256;
2887
2888                 if (tls_is_ecdsa(context)) {
2889                         hash_algorithm = sha512;
2890                         tls_packet_uint8(packet, hash_algorithm);
2891                         tls_packet_uint8(packet, ecdsa);
2892                 } else {
2893                         tls_packet_uint8(packet, hash_algorithm);
2894                         tls_packet_uint8(packet, rsa_sign);
2895                 }
2896
2897                 memcpy(message, context->remote_random,
2898                                 TLS_CLIENT_RANDOM_SIZE);
2899                 memcpy(message + TLS_CLIENT_RANDOM_SIZE, context->local_random,
2900                                 TLS_SERVER_RANDOM_SIZE);
2901                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
2902                                 TLS_SERVER_RANDOM_SIZE, packet->buf +
2903                                 start_len, params_len);
2904                 if (tls_is_ecdsa(context)) {
2905                         if (sign_ecdsa(context, hash_algorithm, message,
2906                                                 message_len, out, &out_len) ==
2907                                         1) {
2908                                 DEBUG_PRINT
2909                                     ("Signing OK! (ECDSA, length %lu)\n",
2910                                      out_len);
2911                                 tls_packet_uint16(packet, out_len);
2912                                 tls_packet_append(packet, out, out_len);
2913                         }
2914                 } else
2915                 if (sign_rsa(context, hash_algorithm, message, message_len,
2916                                         out, &out_len) == 1) {
2917                         DEBUG_PRINT("Signing OK! (length %lu)\n", out_len);
2918                         tls_packet_uint16(packet, out_len);
2919                         tls_packet_append(packet, out, out_len);
2920                 }
2921                 free(message);
2922         }
2923         if (!packet->broken && packet->buf) {
2924                 tls_set_packet_length(packet, packet->len - start_len);
2925         }
2926         tls_packet_update(packet);
2927         tls_queue_packet(packet);
2928         return;
2929 }
2930
2931 #if 0
2932 void _private_tls_set_session_id(struct TLSContext *context) {
2933         if (context->tlsver == TLS_VERSION13
2934                         && context->session_size == TLS_MAX_SESSION_ID) {
2935                 return;
2936         }
2937
2938         if (tls_random(context->session, TLS_MAX_SESSION_ID)) {
2939                 context->session_size = TLS_MAX_SESSION_ID;
2940         } else {
2941                 context->session_size = 0;
2942         }
2943 }
2944 #endif
2945
2946 struct TLSPacket *tls_certificate_request(struct TLSContext *context) {
2947         if (!context || !context->is_server) {
2948                 return NULL;
2949         }
2950
2951         unsigned short packet_version = context->version;
2952         struct TLSPacket *packet =
2953             tls_create_packet(context, TLS_HANDSHAKE, packet_version, 0);
2954
2955         if (!packet) {
2956                 return NULL;
2957         }
2958
2959         /* cert request and size placeholder */
2960         unsigned char dummy[] = { 0x0d, 0, 0, 0 };
2961         tls_packet_append(packet, dummy, sizeof dummy);
2962
2963         int start_len = packet->len;
2964
2965         if (context->tlsver == TLS_VERSION13) {
2966                 /* certificate request context */
2967                 tls_packet_uint8(packet, 0);
2968                 /* extensions */
2969                 tls_packet_uint16(packet, 18);
2970                 /* signature algorithms */
2971                 tls_packet_uint16(packet, 0x0D);
2972                 tls_packet_uint16(packet, 14);
2973                 tls_packet_uint16(packet, 12);
2974 #if 0
2975                 rsa_pkcs1_sha256
2976                         tls_packet_uint16(packet, 0x0401);
2977                 rsa_pkcs1_sha384
2978                         tls_packet_uint16(packet, 0x0501);
2979                 rsa_pkcs1_sha512
2980                         tls_packet_uint16(packet, 0x0601);
2981 #endif
2982
2983                 /* ecdsa_secp256r1_sha256 */
2984                 tls_packet_uint16(packet, 0x0403);
2985                 /* ecdsa_secp384r1_sha384 */
2986                 tls_packet_uint16(packet, 0x0503);
2987                 /* ecdsa_secp521r1_sha512 */
2988                 tls_packet_uint16(packet, 0x0604);
2989                 /* rsa_pss_rsae_sha256 */
2990                 tls_packet_uint16(packet, 0x0804);
2991                 /* rsa_pss_rsae_sha384 */
2992                 tls_packet_uint16(packet, 0x0805);
2993                 /* rsa_pss_rsae_sha512 */
2994                 tls_packet_uint16(packet, 0x0806);
2995         } else {
2996                 tls_packet_uint8(packet, 1);
2997                 tls_packet_uint8(packet, rsa_sign);
2998                 if (context->version == TLS_V12) {
2999                         /* 10 pairs or 2 bytes */
3000                         tls_packet_uint16(packet, 10);
3001                         tls_packet_uint8(packet, sha256);
3002                         tls_packet_uint8(packet, rsa);
3003                         tls_packet_uint8(packet, sha1);
3004                         tls_packet_uint8(packet, rsa);
3005                         tls_packet_uint8(packet, sha384);
3006                         tls_packet_uint8(packet, rsa);
3007                         tls_packet_uint8(packet, sha512);
3008                         tls_packet_uint8(packet, rsa);
3009                         tls_packet_uint8(packet, md5);
3010                         tls_packet_uint8(packet, rsa);
3011                 }
3012                 /* no DistinguishedName yet */
3013                 tls_packet_uint16(packet, 0);
3014         }
3015         if (!packet->broken) {
3016                 tls_set_packet_length(packet, packet->len - start_len);
3017         }
3018         tls_packet_update(packet);
3019         return packet;
3020 }
3021
3022 int tls_parse_key_share(struct TLSContext *context, const unsigned char *buf,
3023                 int buf_len) {
3024         int i = 0;
3025         struct ECCCurveParameters *curve = 0;
3026         struct DHKey *dhkey = 0;
3027         int dhe_key_size = 0;
3028         const unsigned char *buffer = NULL;
3029         unsigned char *out2;
3030         unsigned long out_size;
3031         uint16_t key_size;
3032
3033         while (buf_len >= 4) {
3034                 uint16_t named_group = get16(&buf[i]);
3035                 i += 2;
3036                 buf_len -= 2;
3037
3038                 key_size = get16(&buf[i]);
3039                 i += 2;
3040                 buf_len -= 2;
3041
3042                 if (key_size > buf_len) {
3043                         return TLS_BROKEN_PACKET;
3044                 }
3045
3046                 switch (named_group) {
3047                         case 0x0017:
3048                                 curve = &secp256r1;
3049                                 buffer = &buf[i];
3050                                 DEBUG_PRINT("KEY SHARE => secp256r1\n");
3051                                 buf_len = 0;
3052                                 continue;
3053                         case 0x0018:
3054                                 /* secp384r1 */
3055                                 curve = &secp384r1;
3056                                 buffer = &buf[i];
3057                                 DEBUG_PRINT("KEY SHARE => secp384r1\n");
3058                                 buf_len = 0;
3059                                 continue;
3060                         case 0x0019:
3061                                 /* secp521r1 */
3062                                 break;
3063                         case 0x001D:
3064                                 /* x25519 */
3065                                 if (key_size != 32) {
3066                                         DEBUG_PRINT
3067                                                 ("INVALID x25519 KEY SIZE (%i)\n",
3068                                                  key_size);
3069                                         continue;
3070                                 }
3071                                 curve = &curve25519;
3072                                 buffer = &buf[i];
3073                                 DEBUG_PRINT("KEY SHARE => x25519\n");
3074                                 buf_len = 0;
3075                                 continue;
3076                                 break;
3077
3078                         case 0x001E:
3079                                 /* x448 */
3080                                 break;
3081                         case 0x0100:
3082                                 dhkey = &ffdhe2048;
3083                                 dhe_key_size = 2048;
3084                                 break;
3085                         case 0x0101:
3086                                 dhkey = &ffdhe3072;
3087                                 dhe_key_size = 3072;
3088                                 break;
3089                         case 0x0102:
3090                                 dhkey = &ffdhe4096;
3091                                 dhe_key_size = 4096;
3092                                 break;
3093                         case 0x0103:
3094                                 dhkey = &ffdhe6144;
3095                                 dhe_key_size = 6144;
3096                                 break;
3097                         case 0x0104:
3098                                 dhkey = &ffdhe8192;
3099                                 dhe_key_size = 8192;
3100                                 break;
3101                 }
3102                 i += key_size;
3103                 buf_len -= key_size;
3104         }
3105
3106         if (curve) {
3107                 context->curve = curve;
3108
3109                 if (curve == &curve25519) {
3110                         if (!tls_random(context->local_random,
3111                              TLS_SERVER_RANDOM_SIZE)) {
3112                                 return TLS_GENERIC_ERROR;
3113                         }
3114
3115                         unsigned char secret[32];
3116                         static const unsigned char basepoint[32] = { 9 };
3117
3118                         tls_random(secret, 32);
3119
3120                         secret[0] &= 248;
3121                         secret[31] &= 127;
3122                         secret[31] |= 64;
3123
3124                         /* use finished key to store public key */
3125                         free(context->finished_key);
3126                         context->finished_key = malloc(32);
3127                         if (!context->finished_key) {
3128                                 return TLS_GENERIC_ERROR;
3129                         }
3130
3131                         x25519(context->finished_key, secret, basepoint);
3132
3133                         free(context->premaster_key);
3134                         context->premaster_key = malloc(32);
3135
3136                         if (!context->premaster_key) {
3137                                 return TLS_GENERIC_ERROR;
3138                         }
3139
3140                         x25519(context->premaster_key, secret, buffer);
3141                         context->premaster_key_len = 32;
3142
3143                         return 0;
3144                 }
3145
3146                 tls_ecc_dhe_create(context);
3147                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&context->curve->dp;
3148
3149                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
3150                                         dp)) {
3151                         free(context->ecc_dhe);
3152                         context->ecc_dhe = NULL;
3153                         DEBUG_PRINT("Error generating ECC DHE key\n");
3154                         return TLS_GENERIC_ERROR;
3155                 }
3156
3157                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE)) {
3158                         return TLS_GENERIC_ERROR;
3159                 }
3160
3161                 ecc_key client_key;
3162                 memset(&client_key, 0, sizeof client_key);
3163                 if (ecc_ansi_x963_import_ex
3164                     (buffer, key_size, &client_key, dp)) {
3165                         DEBUG_PRINT("Error importing ECC DHE key\n");
3166                         return TLS_GENERIC_ERROR;
3167                 }
3168                 out2 = malloc(key_size);
3169                 out_size = key_size;
3170
3171                 int err = ecc_shared_secret(context->ecc_dhe, &client_key,
3172                                 out2, &out_size);
3173                 ecc_free(&client_key);
3174
3175                 if (err) {
3176                         DEBUG_PRINT("ECC DHE DECRYPT ERROR %i\n", err);
3177                         free(out2);
3178                         return TLS_GENERIC_ERROR;
3179                 }
3180
3181                 DEBUG_PRINT("OUT_SIZE: %lu\n", out_size);
3182                 DEBUG_DUMP_HEX_LABEL("ECC DHE", out2, out_size);
3183
3184                 free(context->premaster_key);
3185                 context->premaster_key = out2;
3186                 context->premaster_key_len = out_size;
3187                 return 0;
3188         } else if (dhkey) {
3189                 tls_dhe_create(context);
3190                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE))
3191                 {
3192                         return TLS_GENERIC_ERROR;
3193                 }
3194
3195                 if (tls_dh_make_key(dhe_key_size / 8, context->dhe,
3196                      (const char *)dhkey->p, (const char *)dhkey->g, 0, 0)) {
3197                         free(context->dhe);
3198                         context->dhe = NULL;
3199                         DEBUG_PRINT("Error generating DHE key\n");
3200                         return TLS_GENERIC_ERROR;
3201                 }
3202
3203                 unsigned int dhe_out_size;
3204                 out2 = tls_decrypt_dhe(context, buffer, key_size,
3205                                 &dhe_out_size, 0);
3206                 if (!out2) {
3207                         DEBUG_PRINT("Error generating DHE shared key\n");
3208                         return TLS_GENERIC_ERROR;
3209                 }
3210
3211                 free(context->premaster_key);
3212                 context->premaster_key = out2;
3213                 context->premaster_key_len = dhe_out_size;
3214                 if (context->dhe) {
3215                         context->dhe->iana = dhkey->iana;
3216                 }
3217                 return 0;
3218         }
3219         DEBUG_PRINT("NO COMMON KEY SHARE SUPPORTED\n");
3220         return TLS_NO_COMMON_CIPHER;
3221 }
3222
3223 int tls_parse_certificate(struct TLSContext *context,
3224                           const unsigned char *buf, int buf_len,
3225                           int is_client) {
3226         int res = 0;
3227         if (buf_len < 3) {
3228                 return TLS_NEED_MORE_DATA;
3229         }
3230
3231         int size = get24(buf);
3232
3233         /* not enough data, so just consume all of it */
3234         if (size <= 4) {
3235                 return 3 + size;
3236         }
3237
3238         res += 3; /* skip over the size field */
3239
3240         if (context->tlsver == TLS_VERSION13) {
3241                 int context_size = buf[res];
3242                 res++;
3243                 /* must be 0 */
3244                 if (context_size) {
3245                         res += context_size;
3246                 }
3247         }
3248
3249         if (buf_len - res < size) {
3250                 return TLS_NEED_MORE_DATA;
3251         }
3252
3253         int idx = 0;
3254         int valid_certificate = 0;
3255         while (size > 0) {
3256                 idx++;
3257                 if (buf_len - res < 3) {
3258                         return TLS_NEED_MORE_DATA;
3259                 }
3260                 int certificate_size = get24(buf+res);
3261                 res += 3;
3262                 if (buf_len - res < certificate_size) {
3263                         return TLS_NEED_MORE_DATA;
3264                 }
3265                 /* load chain */
3266                 int certificates_in_chain = 0;
3267                 int res2 = res;
3268                 unsigned int remaining = certificate_size;
3269                 do {
3270                         if (remaining <= 3) {
3271                                 break;
3272                         }
3273                         certificates_in_chain++;
3274                         unsigned int certificate_size2 = get24(buf+res2);
3275                         res2 += 3;
3276                         remaining -= 3;
3277                         if (certificate_size2 > remaining) {
3278                                 DEBUG_PRINT
3279                                     ("Invalid certificate size (%i from %i bytes remaining)\n",
3280                                      certificate_size2, remaining);
3281                                 break;
3282                         }
3283                         remaining -= certificate_size2;
3284
3285                         struct TLSCertificate *cert = asn1_parse(context,
3286                                                                  &buf
3287                                                                  [res2],
3288                                                                  certificate_size2,
3289                                                                  is_client);
3290                         if (cert) {
3291                                 if (certificate_size2) {
3292                                         cert->bytes =
3293                                             malloc(certificate_size2);
3294                                         if (cert->bytes) {
3295                                                 cert->len =
3296                                                     certificate_size2;
3297                                                 memcpy(cert->bytes,
3298                                                        &buf[res2],
3299                                                        certificate_size2);
3300                                         }
3301                                 }
3302                                 /* valid certificate */
3303                                 if (is_client) {
3304                                         void *new;
3305                                         valid_certificate = 1;
3306
3307                                         new =
3308                                             TLS_REALLOC(context->
3309                                                         client_certificates,
3310                                                         (context->
3311                                                          client_certificates_count
3312                                                          +
3313                                                          1) *
3314                                                         sizeof(struct
3315                                                                TLSCertificate
3316                                                                *));
3317
3318                                         if (!new) {
3319                                                 free(context->
3320                                                          client_certificates);
3321                                                 context->
3322                                                     client_certificates =
3323                                                     0;
3324                                                 return TLS_NO_MEMORY;
3325                                         }
3326
3327                                         context->client_certificates = new;
3328                                         context->
3329                                             client_certificates
3330                                             [context->client_certificates_count]
3331                                             = cert;
3332                                         context->
3333                                             client_certificates_count++;
3334                                 } else {
3335                                         void *new;
3336                                         new =
3337                                             TLS_REALLOC(context->
3338                                                         certificates,
3339                                                         (context->
3340                                                          certificates_count
3341                                                          +
3342                                                          1) *
3343                                                         sizeof(struct
3344                                                                TLSCertificate
3345                                                                *));
3346                                         if (!new) {
3347                                                 free(context->
3348                                                          certificates);
3349                                                 context->certificates = 0;
3350                                                 return TLS_NO_MEMORY;
3351                                         }
3352                                         context->certificates = new;
3353                                         context->certificates[context->
3354                                                               certificates_count]
3355                                             = cert;
3356                                         context->certificates_count++;
3357                                         if ((cert->pk) || (cert->priv))
3358                                                 valid_certificate = 1;
3359                                         else if (!context->is_server)
3360                                                 valid_certificate = 1;
3361                                 }
3362                         }
3363                         res2 += certificate_size2;
3364                         /* extension */
3365                         if (context->tlsver == TLS_VERSION13) {
3366                                 if (remaining >= 2) {
3367                                         /* ignore extensions */
3368                                         remaining -= 2;
3369                                         uint16_t size = get16(&buf[res2]);
3370                                         if (size && size >= remaining) {
3371                                                 res2 += size;
3372                                                 remaining -= size;
3373                                         }
3374                                 }
3375                         }
3376                 } while (remaining > 0);
3377                 if (remaining) {
3378                         DEBUG_PRINT("Extra %i bytes after certificate\n",
3379                                     remaining);
3380                 }
3381                 size -= certificate_size + 3;
3382                 res += certificate_size;
3383         }
3384         if (!valid_certificate) {
3385                 MARK;
3386                 return TLS_UNSUPPORTED_CERTIFICATE;
3387         }
3388         if (res != buf_len) {
3389                 DEBUG_PRINT("Warning: %i bytes read from %i byte buffer\n",
3390                             (int) res, (int) buf_len);
3391         }
3392         return res;
3393 }
3394
3395 static int parse_dh( const unsigned char *buf, int buf_len, const unsigned char
3396                 **out, int *out_size) {
3397         int res = 0;
3398         *out = NULL;
3399         *out_size = 0;
3400         if (buf_len < 2) {
3401                 return TLS_NEED_MORE_DATA;
3402         }
3403         uint16_t size = get16(buf);
3404         res += 2;
3405         if (buf_len - res < size) {
3406                 return TLS_NEED_MORE_DATA;
3407         }
3408         DEBUG_DUMP_HEX(&buf[res], size);
3409         *out = &buf[res];
3410         *out_size = size;
3411         res += size;
3412         return res;
3413 }
3414
3415 static int tls_parse_random(struct TLSContext *context,
3416                               const unsigned char *buf, int buf_len) {
3417         int res = 0;
3418         int ephemeral = tls_cipher_is_ephemeral(context);
3419         uint16_t size;
3420         if (ephemeral == 2) {
3421                 if (buf_len < 1) {
3422                         return TLS_NEED_MORE_DATA;
3423                 }
3424                 size = buf[0];
3425                 res += 1;
3426         } else {
3427                 if (buf_len < 2) {
3428                         return TLS_NEED_MORE_DATA;
3429                 }
3430                 size = get16(buf);
3431                 res += 2;
3432         }
3433
3434         if (buf_len - res < size) {
3435                 return TLS_NEED_MORE_DATA;
3436         }
3437         unsigned int out_len = 0;
3438         unsigned char *random = NULL;
3439         switch (ephemeral) {
3440                 case 1:
3441                         random = tls_decrypt_dhe(context, &buf[res], size, &out_len,
3442                                         1);
3443                         break;
3444                 case 2:
3445                         random = tls_decrypt_ecc_dhe(context, &buf[res], size,
3446                                         &out_len, 1);
3447                         break;
3448                 default:
3449                         random = decrypt_rsa(context, &buf[res], size,
3450                                         &out_len);
3451         }
3452
3453         if (random && out_len > 2) {
3454                 /* *(unsigned short *)&random[0] = htons(context->version); */
3455                 DEBUG_DUMP_HEX_LABEL("PRE MASTER KEY", random, out_len);
3456                 free(context->premaster_key);
3457                 context->premaster_key = random;
3458                 context->premaster_key_len = out_len;
3459                 tls_compute_key(context, 48);
3460         } else {
3461                 free(random);
3462                 return 0;
3463         }
3464         res += size;
3465         return res;
3466 }
3467
3468 static const unsigned char *parse_signature(const unsigned char *buf, int
3469                 buf_len, int *hash_algorithm, int *sign_algorithm, int
3470                 *sig_size, int *offset) {
3471         int res = 0;
3472         if (buf_len < 2) {
3473                 return NULL;
3474         }
3475         *hash_algorithm = _md5_sha1;
3476         *sign_algorithm = rsa_sign;
3477         *sig_size = 0;
3478         *hash_algorithm = buf[res];
3479         res++;
3480         *sign_algorithm = buf[res];
3481         res++;
3482         uint16_t size = get16(&buf[res]);
3483         res += 2;
3484         if (buf_len - res < size) {
3485                 return NULL;
3486         }
3487         DEBUG_DUMP_HEX(&buf[res], size);
3488         *sig_size = size;
3489         *offset = res + size;
3490         return &buf[res];
3491 }
3492
3493 int tls_parse_server_key_exchange(struct TLSContext *context,
3494                                   const unsigned char *buf, int buf_len) {
3495         int res = 0;
3496         int dh_res = 0;
3497         if (buf_len < 3) {
3498                 return TLS_NEED_MORE_DATA;
3499         }
3500         int size = get24(buf);
3501         res += 3;
3502         const unsigned char *packet_ref = buf + res;
3503         if (buf_len - res < size) {
3504                 return TLS_NEED_MORE_DATA;
3505         }
3506
3507         if (!size) {
3508                 return res;
3509         }
3510
3511         unsigned char has_ds_params = 0;
3512         int key_size = 0;
3513         const struct ECCCurveParameters *curve = NULL;
3514         const unsigned char *pk_key = NULL;
3515         int ephemeral = tls_cipher_is_ephemeral(context);
3516         if (ephemeral) {
3517                 if (ephemeral == 1) {
3518                         has_ds_params = 1;
3519                 } else {
3520                         if (buf[res++] != 3) {
3521                                 /* named curve */
3522                                 /* any other method is not supported */
3523                                 return 0;
3524                         }
3525                         if (buf_len - res < 3) {
3526                                 return TLS_NEED_MORE_DATA;
3527                         }
3528                         int iana_n = get16(&buf[res]);
3529                         res += 2;
3530                         key_size = buf[res];
3531                         res++;
3532                         if (buf_len - res < key_size) {
3533                                 return TLS_NEED_MORE_DATA;
3534                         }
3535                         DEBUG_PRINT("IANA CURVE NUMBER: %i\n", iana_n);
3536                         switch (iana_n) {
3537                                 case 19:
3538                                         curve = &secp192r1;
3539                                         break;
3540                                 case 20:
3541                                         curve = &secp224k1;
3542                                         break;
3543                                 case 21:
3544                                         curve = &secp224r1;
3545                                         break;
3546                                 case 22:
3547                                         curve = &secp256k1;
3548                                         break;
3549                                 case 23:
3550                                         curve = &secp256r1;
3551                                         break;
3552                                 case 24:
3553                                         curve = &secp384r1;
3554                                         break;
3555                                 case 25:
3556                                         curve = &secp521r1;
3557                                         break;
3558                                 default:
3559                                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
3560                                         return TLS_GENERIC_ERROR;
3561                         }
3562                         pk_key = &buf[res];
3563                         res += key_size;
3564                         context->curve = curve;
3565                 }
3566         }
3567
3568         const unsigned char *dh_p = NULL;
3569         int dh_p_len = 0;
3570         const unsigned char *dh_g = NULL;
3571         int dh_g_len = 0;
3572         const unsigned char *dh_Ys = NULL;
3573         int dh_Ys_len = 0;
3574
3575         if (has_ds_params) {
3576                 DEBUG_PRINT("          dh_p: ");
3577                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_p, &dh_p_len);
3578                 if (dh_res <= 0) {
3579                         return TLS_BROKEN_PACKET;
3580                 }
3581                 res += dh_res;
3582                 DEBUG_PRINT("\n");
3583
3584                 DEBUG_PRINT("          dh_q: ");
3585                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_g, &dh_g_len);
3586                 if (dh_res <= 0) {
3587                 MARK;
3588                         return TLS_BROKEN_PACKET;
3589                 }
3590                 res += dh_res;
3591                 DEBUG_PRINT("\n");
3592
3593                 DEBUG_PRINT("          dh_Ys: ");
3594                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_Ys,
3595                                 &dh_Ys_len);
3596                 if (dh_res <= 0) {
3597                 MARK;
3598                         return TLS_BROKEN_PACKET;
3599                 }
3600                 res += dh_res;
3601                 DEBUG_PRINT("\n");
3602         }
3603         int sign_size;
3604         int hash_algorithm;
3605         int sign_algorithm;
3606         int packet_size = res - 3;
3607         int offset = 0;
3608         DEBUG_PRINT("          SIGNATURE (%i/%i/%i): ", packet_size,
3609                     dh_res, key_size);
3610         const unsigned char *signature =
3611             parse_signature(&buf[res], buf_len - res, &hash_algorithm,
3612                             &sign_algorithm, &sign_size, &offset);
3613         DEBUG_PRINT("\n");
3614         if (sign_size <= 0 || !signature) {
3615                 return TLS_BROKEN_PACKET;
3616         }
3617         res += offset;
3618         /* check signature */
3619         unsigned int message_len =
3620             packet_size + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
3621         unsigned char *message = malloc(message_len);
3622         if (message) {
3623                 memcpy(message, context->local_random, TLS_CLIENT_RANDOM_SIZE);
3624                 memcpy(message + TLS_CLIENT_RANDOM_SIZE,
3625                        context->remote_random, TLS_SERVER_RANDOM_SIZE);
3626                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
3627                        TLS_SERVER_RANDOM_SIZE, packet_ref, packet_size);
3628                 if (tls_is_ecdsa(context)) {
3629                         if (tls_verify_ecdsa
3630                             (context, hash_algorithm, signature, sign_size,
3631                              message, message_len, NULL) != 1) {
3632                                 DEBUG_PRINT
3633                                     ("ECC Server signature FAILED!\n");
3634                                 free(message);
3635                                 return TLS_BROKEN_PACKET;
3636                         }
3637                 } else
3638                 {
3639                         if (verify_rsa(context, hash_algorithm, signature,
3640                                                 sign_size, message,
3641                                                 message_len) != 1) {
3642                                 DEBUG_PRINT("Server signature FAILED!\n");
3643                                 free(message);
3644                                 return TLS_BROKEN_PACKET;
3645                         }
3646                 }
3647                 free(message);
3648         }
3649
3650         if (buf_len - res) {
3651                 DEBUG_PRINT("EXTRA %i BYTES AT THE END OF MESSAGE\n",
3652                             buf_len - res);
3653                 DEBUG_DUMP_HEX(&buf[res], buf_len - res);
3654                 DEBUG_PRINT("\n");
3655         }
3656
3657         if (ephemeral == 1) {
3658                 tls_dhe_create(context);
3659                 DEBUG_DUMP_HEX_LABEL("DHP", dh_p, dh_p_len);
3660                 DEBUG_DUMP_HEX_LABEL("DHG", dh_g, dh_g_len);
3661                 int dhe_key_size = dh_p_len;
3662                 if (dh_g_len > dh_p_len) {
3663                         dhe_key_size = dh_g_len;
3664                 }
3665
3666                 if (tls_dh_make_key(dhe_key_size, context->dhe, (const char *)
3667                                         dh_p, (const char *) dh_g, dh_p_len,
3668                                         dh_g_len)) {
3669                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
3670                         free(context->dhe);
3671                         context->dhe = NULL;
3672                         return TLS_GENERIC_ERROR;
3673                 }
3674
3675                 unsigned int dh_key_size = 0;
3676                 unsigned char *key = tls_decrypt_dhe(context, dh_Ys, dh_Ys_len,
3677                                 &dh_key_size, 0);
3678                 DEBUG_DUMP_HEX_LABEL("DH COMMON SECRET", key, dh_key_size);
3679                 if (key && dh_key_size) {
3680                         free(context->premaster_key);
3681                         context->premaster_key = key;
3682                         context->premaster_key_len = dh_key_size;
3683                 }
3684         } else if (ephemeral == 2 && curve && pk_key && key_size) {
3685                 tls_ecc_dhe_create(context);
3686
3687                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *) & curve->dp;
3688                 if (ecc_make_key_ex
3689                     (NULL, find_prng("sprng"), context->ecc_dhe, dp)) {
3690                         free(context->ecc_dhe);
3691                         context->ecc_dhe = NULL;
3692                         DEBUG_PRINT("Error generating ECC key\n");
3693                         return TLS_GENERIC_ERROR;
3694                 }
3695
3696                 free(context->premaster_key);
3697                 context->premaster_key_len = 0;
3698
3699                 unsigned int out_len = 0;
3700                 context->premaster_key =
3701                     tls_decrypt_ecc_dhe(context, pk_key, key_size,
3702                                                  &out_len, 0);
3703                 if (context->premaster_key) {
3704                         context->premaster_key_len = out_len;
3705                 }
3706         }
3707
3708         return res;
3709 }
3710
3711 int tls_parse_client_key_exchange(struct TLSContext *context,
3712                                   const unsigned char *buf, int buf_len) {
3713         if (context->connection_status != 1) {
3714                 DEBUG_PRINT
3715                     ("UNEXPECTED CLIENT KEY EXCHANGE MESSAGE (connections status: %i)\n",
3716                      (int) context->connection_status);
3717                 return TLS_UNEXPECTED_MESSAGE;
3718         }
3719
3720         int res = 0;
3721         int dh_res = 0;
3722         if (buf_len < 3) {
3723                 return TLS_NEED_MORE_DATA;
3724         }
3725         int size = get24(buf);
3726         res += 3;
3727
3728         if (buf_len - res < size) {
3729                 return TLS_NEED_MORE_DATA;
3730         }
3731
3732         if (!size) {
3733                 return res;
3734         }
3735
3736         dh_res = tls_parse_random(context, &buf[res], size);
3737         if (dh_res <= 0) {
3738                 DEBUG_PRINT("broken key\n");
3739                 return TLS_BROKEN_PACKET;
3740         }
3741         DEBUG_PRINT("\n");
3742
3743         res += size;
3744         context->connection_status = 2;
3745         return res;
3746 }
3747
3748 static int tls_parse_server_hello_done(const unsigned char *buf, int buf_len) {
3749         int res = 0;
3750         if (buf_len < 3) {
3751                 return TLS_NEED_MORE_DATA;
3752         }
3753         int size = get24(buf);
3754         res += 3;
3755
3756         if (buf_len - res < size) {
3757                 return TLS_NEED_MORE_DATA;
3758         }
3759
3760                 MARK;
3761         res += size;
3762         return res;
3763 }
3764
3765 int tls_parse_finished(struct TLSContext *context,
3766                        const unsigned char *buf, int buf_len,
3767                        unsigned int *write_packets) {
3768         if (context->connection_status < 2
3769             || context->connection_status == TLS_CONNECTED) {
3770                 DEBUG_PRINT("UNEXPECTED FINISHED MESSAGE\n");
3771                 return TLS_UNEXPECTED_MESSAGE;
3772         }
3773
3774         int res = 0;
3775         *write_packets = 0;
3776         if (buf_len < 3) {
3777                 return TLS_NEED_MORE_DATA;
3778         }
3779         int size = get24(buf);
3780         res += 3;
3781
3782         if (size < TLS_MIN_FINISHED_OPAQUE_LEN) {
3783                 DEBUG_PRINT("Invalid finished packet size: %i\n", size);
3784                 return TLS_BROKEN_PACKET;
3785         }
3786
3787         if (buf_len - res < size) {
3788                 return TLS_NEED_MORE_DATA;
3789         }
3790
3791         unsigned char hash[TLS_MAX_SHA_SIZE];
3792         unsigned int hash_len = tls_get_hash(context, hash);
3793
3794         if (context->tlsver == TLS_VERSION13) {
3795                 unsigned char hash_out[TLS_MAX_SHA_SIZE];
3796                 unsigned long out_size = TLS_MAX_SHA_SIZE;
3797                 if (!context->remote_finished_key || !hash_len) {
3798                         DEBUG_PRINT
3799                             ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
3800                         return TLS_NOT_VERIFIED;
3801                 }
3802
3803                 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
3804                 DEBUG_DUMP_HEX_LABEL("HS FINISH", context->remote_finished_key,
3805                                 hash_len);
3806
3807                 out_size = hash_len;
3808                 hmac_state hmac;
3809                 hmac_init(&hmac, tls_get_hash_idx(context),
3810                           context->remote_finished_key, hash_len);
3811                 hmac_process(&hmac, hash, hash_len);
3812                 hmac_done(&hmac, hash_out, &out_size);
3813
3814                 if (size != (int)out_size || memcmp(hash_out, &buf[res], size)) {
3815                         DEBUG_PRINT
3816                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3817                              (int) context->local_sequence_number,
3818                              (int) context->remote_sequence_number);
3819                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3820                                              size);
3821                         DEBUG_DUMP_HEX_LABEL("VERIFY", hash_out, out_size);
3822                         return TLS_NOT_VERIFIED;
3823                 }
3824                 if (context->is_server) {
3825                         context->connection_status = TLS_CONNECTED;
3826                         res += size;
3827                         _private_tls13_key(context, 0);
3828                         context->local_sequence_number = 0;
3829                         context->remote_sequence_number = 0;
3830                         return res;
3831                 }
3832                 /* TODO client verify */
3833         } else {
3834                 /* verify */
3835                 unsigned char *out = malloc(size);
3836                 if (!out) {
3837                         DEBUG_PRINT("Error in malloc (%i bytes)\n",
3838                                     (int) size);
3839                         return TLS_NO_MEMORY;
3840                 }
3841
3842                 /* server verifies client's message */
3843                 if (context->is_server) {
3844                         tls_prf(context, out, size,
3845                                          context->master_key,
3846                                          context->master_key_len,
3847                                          (unsigned char *)
3848                                          "client finished", 15, hash,
3849                                          hash_len, NULL, 0);
3850                 } else {
3851                         tls_prf(context, out, size,
3852                                          context->master_key,
3853                                          context->master_key_len,
3854                                          (unsigned char *)
3855                                          "server finished", 15, hash,
3856                                          hash_len, NULL, 0);
3857                 }
3858
3859                 if (memcmp(out, &buf[res], size)) {
3860                         free(out);
3861                         DEBUG_PRINT
3862                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3863                              (int) context->local_sequence_number,
3864                              (int) context->remote_sequence_number);
3865                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3866                                              size);
3867                         DEBUG_DUMP_HEX_LABEL("VERIFY", out, size);
3868                         return TLS_NOT_VERIFIED;
3869                 }
3870                 free(out);
3871         }
3872
3873         if (context->is_server) {
3874                 *write_packets = 3;
3875         } else {
3876                 context->connection_status = TLS_CONNECTED;
3877         }
3878
3879         // fprintf(stderr, "set conn status = %d\n", context->connection_status);
3880
3881                 MARK;
3882         res += size;
3883         return res;
3884 }
3885
3886 int tls_parse_verify_tls13(struct TLSContext *context,
3887                            const unsigned char *buf, int buf_len) {
3888         if (buf_len < 7) {
3889                 return TLS_NEED_MORE_DATA;
3890         }
3891         int size = get24(buf);
3892
3893         if (size < 2) {
3894                 return buf_len;
3895         }
3896
3897         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
3898         int signing_data_len;
3899
3900         /* first 64 bytes to 0x20 (32) */
3901         memset(signing_data, 0x20, 64);
3902         /* context string 33 bytes */
3903         if (context->is_server) {
3904                 memcpy(signing_data + 64,
3905                        "TLS 1.3, server CertificateVerify", 33);
3906         } else {
3907                 memcpy(signing_data + 64,
3908                        "TLS 1.3, client CertificateVerify", 33);
3909         }
3910
3911         /* a single 0 byte separator */
3912         signing_data[97] = 0;
3913         signing_data_len = 98;
3914
3915         signing_data_len += tls_get_hash(context, signing_data + 98);
3916         DEBUG_DUMP_HEX_LABEL("signature data", signing_data, signing_data_len);
3917         uint16_t signature = get16(&buf[3]);
3918         uint16_t signature_size = get16(&buf[5]);
3919         int valid = 0;
3920         if (buf_len < size + 7) {
3921                 return TLS_NEED_MORE_DATA;
3922         }
3923         switch (signature) {
3924                 case 0x0403:
3925                         /* secp256r1 + sha256 */
3926                         valid =
3927                                 tls_verify_ecdsa(context, sha256, buf + 7,
3928                                                 signature_size, signing_data,
3929                                                 signing_data_len,
3930                                                 &secp256r1);
3931                         break;
3932                 case 0x0503:
3933                         /* secp384r1 + sha384 */
3934                         valid = tls_verify_ecdsa(context, sha384, buf + 7,
3935                                         signature_size, signing_data,
3936                                         signing_data_len, &secp384r1);
3937                         break;
3938                 case 0x0603:
3939                         /* secp521r1 + sha512 */
3940                         valid = tls_verify_ecdsa(context, sha512, buf + 7,
3941                                         signature_size, signing_data,
3942                                         signing_data_len, &secp521r1);
3943                         break;
3944                 case 0x0804:
3945                         valid = verify_rsa(context, sha256, buf + 7,
3946                                         signature_size, signing_data,
3947                                         signing_data_len);
3948                         break;
3949                 default:
3950                         DEBUG_PRINT("Unsupported signature: %x\n",
3951                                         (int) signature);
3952                         return TLS_UNSUPPORTED_CERTIFICATE;
3953         }
3954         if (valid != 1) {
3955                 DEBUG_PRINT("Signature FAILED!\n");
3956                 return TLS_DECRYPTION_FAILED;
3957         }
3958         return buf_len;
3959 }
3960
3961 int tls_parse_verify(struct TLSContext *context, const unsigned char *buf,
3962                      int buf_len) {
3963         if (context->tlsver == TLS_VERSION13) {
3964                 return tls_parse_verify_tls13(context, buf, buf_len);
3965         }
3966
3967         if (buf_len < 7) {
3968                 return TLS_BAD_CERTIFICATE;
3969         }
3970
3971         int bytes_to_follow = get24(buf);
3972
3973         if (buf_len - 3 < bytes_to_follow) {
3974                 return TLS_BAD_CERTIFICATE;
3975         }
3976
3977         int res = -1;
3978
3979         unsigned int hash = buf[3];
3980         unsigned int algorithm = buf[4];
3981         if (algorithm != rsa) {
3982                 return TLS_UNSUPPORTED_CERTIFICATE;
3983         }
3984         uint16_t size = get16(&buf[5]);
3985         if (bytes_to_follow - 4 < size) {
3986                 return TLS_BAD_CERTIFICATE;
3987         }
3988         DEBUG_PRINT("ALGORITHM %i/%i (%i)\n", hash, algorithm, (int) size);
3989         DEBUG_DUMP_HEX_LABEL("VERIFY", &buf[7], bytes_to_follow - 7);
3990
3991         res = verify_rsa(context, hash, &buf[7], size,
3992                         context->cached_handshake.buffer,
3993                         context->cached_handshake.len);
3994
3995         tls_buffer_free(&context->cached_handshake);
3996         if (res == 1) {
3997                 DEBUG_PRINT("Signature OK\n");
3998                 context->client_verified = 1;
3999         } else {
4000                 DEBUG_PRINT("Signature FAILED\n");
4001                 context->client_verified = 0;
4002         }
4003         return 1;
4004 }
4005
4006 /* TODO This is actually a parse a handshake message */
4007 int tls_parse_payload(struct TLSContext *context, const unsigned char *buf,
4008                       int buf_len) {
4009         ENTER;
4010         int orig_len = buf_len;
4011
4012
4013         if (context->connection_status == TLS_CONNECTED) {
4014                 if (context->version == TLS_V13) {
4015                         tls_alert(context, 1, unexpected_message);
4016                 } else {
4017                         tls_alert(context, 0, no_renegotiation_RESERVED);
4018                 }
4019
4020                 return 1;
4021         }
4022
4023         while (buf_len >= 4 && !context->critical_error) {
4024                 int payload_res = 0;
4025                 //unsigned char update_hash = 1;
4026                 unsigned char type = buf[0];
4027                 unsigned int write_packets = 0;
4028                 int certificate_verify_alert = no_error;
4029                 int payload_size = get24(buf+1) + 3;
4030                 if (buf_len < payload_size + 1) {
4031                         return TLS_NEED_MORE_DATA;
4032                 }
4033                 switch (type) {
4034                         case 0x00:
4035                                 /* hello request */
4036                                 CHECK_HANDSHAKE_STATE(context, 0, 1);
4037                                 DEBUG_PRINT
4038                                         (" => HELLO REQUEST (RENEGOTIATION?)\n");
4039                                 if (context->is_server) {
4040                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4041                                 } else {
4042                                         if (context->connection_status == TLS_CONNECTED) {
4043                                                 /* renegotiation */
4044                                                 payload_res = TLS_NO_RENEGOTIATION;
4045                                         } else {
4046                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4047                                         }
4048                                 }
4049                                 /* no payload */
4050                                 break;
4051                         case 0x01:
4052                                 /* client hello */
4053                                 CHECK_HANDSHAKE_STATE(context, 1, 1);
4054                                 DEBUG_PRINT(" => CLIENT HELLO\n");
4055                                 if (context->is_server) {
4056                                         payload_res =
4057                                                 tls_parse_client_hello(context,
4058                                                                 buf + 1,
4059                                                                 payload_size,
4060                                                                 &write_packets);
4061                                 } else {
4062                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4063                                 }
4064                                 break;
4065                         case 0x02:
4066                                 /* server hello */
4067                                 CHECK_HANDSHAKE_STATE(context, 2, 1);
4068                                 DEBUG_PRINT(" => SERVER HELLO\n");
4069                                 if (context->is_server) {
4070                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4071                                 } else {
4072                                         write_packets = 0;
4073                                         payload_res = tls_parse_server_hello(context, buf + 1, payload_size);
4074                                 }
4075                                 break;
4076                         case 0x03:
4077                                 /* hello verify request */
4078                                 DEBUG_PRINT(" => VERIFY REQUEST\n");
4079                                 CHECK_HANDSHAKE_STATE(context, 3, 1);
4080                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4081                                 break;
4082                         case 0x0B:
4083                                 /* certificate */
4084                                 CHECK_HANDSHAKE_STATE(context, 4, 1);
4085                                 DEBUG_PRINT(" => CERTIFICATE\n");
4086                                 if (context->tlsver == TLS_VERSION13) {
4087                                         if (context->connection_status == 2) {
4088                                                 payload_res =
4089                                                         tls_parse_certificate(context,
4090                                                                         buf + 1,
4091                                                                         payload_size,
4092                                                                         context->
4093                                                                         is_server);
4094                                                 if (context->is_server) {
4095                                                         if (context->certificate_verify && context->client_certificates_count) {
4096                                                                 certificate_verify_alert
4097                                                                         =
4098                                                                         context->certificate_verify(context,
4099                                                                          context->client_certificates,
4100                                                                          context->client_certificates_count);
4101                                                         }
4102                                                         /* empty certificates are permitted for client */
4103                                                         if (payload_res <= 0) {
4104                                                                 payload_res = 1;
4105                                                         }
4106                                                 }
4107                                         } else
4108                                                 payload_res =
4109                                                         TLS_UNEXPECTED_MESSAGE;
4110                                 } else
4111                                         if (context->connection_status == 1) {
4112                                                 if (context->is_server) {
4113                                                         /* client certificate */
4114                                                         payload_res =
4115                                                                 tls_parse_certificate(context,
4116                                                                                 buf + 1,
4117                                                                                 payload_size,
4118                                                                                 1);
4119                                                         if (context->certificate_verify && context->client_certificates_count) {
4120                                                                 certificate_verify_alert =
4121                                                                         context->certificate_verify
4122                                                                         (context,
4123                                                                          context->
4124                                                                          client_certificates,
4125                                                                          context->
4126                                                                          client_certificates_count);
4127                                                         }
4128                                                         /* empty certificates are permitted for client */
4129                                                         if (payload_res <= 0)
4130                                                                 payload_res = 1;
4131                                                 } else {
4132                                                         payload_res =
4133                                                                 tls_parse_certificate(context,
4134                                                                                 buf + 1,
4135                                                                                 payload_size,
4136                                                                                 0);
4137                                                         if (certificate_verify && context->certificates_count) {
4138                                                                 certificate_verify_alert =
4139                                                                         context->certificate_verify
4140                                                                         (context,
4141                                                                          context->certificates,
4142                                                                          context->
4143                                                                          certificates_count);
4144                                                         }
4145                                                 }
4146                                         } else {
4147                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4148                                         }
4149                                 break;
4150                         case 0x0C:
4151                                 /* server key exchange */
4152                                 CHECK_HANDSHAKE_STATE(context, 5, 1);
4153                                 DEBUG_PRINT(" => SERVER KEY EXCHANGE\n");
4154                                 if (context->is_server) {
4155                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4156                                 } else {
4157                                         payload_res =
4158                                                 tls_parse_server_key_exchange(context,
4159                                                                 buf + 1,
4160                                                                 payload_size);
4161                                 }
4162                                 break;
4163                         case 0x0D:
4164                                 /* certificate request */
4165                                 CHECK_HANDSHAKE_STATE(context, 6, 1);
4166                                 /* server to client */
4167                                 if (context->is_server) {
4168                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4169                                 } else {
4170                                         context->client_verified = 2;
4171                                 }
4172                                 DEBUG_PRINT(" => CERTIFICATE REQUEST\n");
4173                                 break;
4174                         case 0x0E:
4175                                 /* server hello done */
4176                                 CHECK_HANDSHAKE_STATE(context, 7, 1);
4177                                 DEBUG_PRINT(" => SERVER HELLO DONE\n");
4178                                 if (context->is_server) {
4179                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4180                                 } else {
4181                                         payload_res =
4182                                                 tls_parse_server_hello_done(
4183                                                                 buf + 1,
4184                                                                 payload_size);
4185                                         if (payload_res > 0) {
4186                                                 write_packets = 1;
4187                                         }
4188                                 }
4189                                 break;
4190                         case 0x0F:
4191                                 /* certificate verify */
4192                                 CHECK_HANDSHAKE_STATE(context, 8, 1);
4193                                 DEBUG_PRINT(" => CERTIFICATE VERIFY\n");
4194                                 if (context->connection_status == 2) {
4195                                         payload_res =
4196                                                 tls_parse_verify(context, buf + 1,
4197                                                                 payload_size);
4198                                 } else {
4199                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4200                                 }
4201                                 break;
4202                         case 0x10:
4203                                 /* client key exchange */
4204                                 CHECK_HANDSHAKE_STATE(context, 9, 1);
4205                                 DEBUG_PRINT(" => CLIENT KEY EXCHANGE\n");
4206                                 if (context->is_server) {
4207                                         payload_res =
4208                                                 tls_parse_client_key_exchange(context,
4209                                                                 buf + 1,
4210                                                                 payload_size);
4211                                 } else {
4212                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4213                                 }
4214                                 break;
4215                         case 0x14:
4216                                 /* finished */
4217                                 tls_buffer_free(&context->cached_handshake);
4218                                 CHECK_HANDSHAKE_STATE(context, 10, 1);
4219                                 DEBUG_PRINT(" => FINISHED\n");
4220                                 payload_res = tls_parse_finished(context,
4221                                                 buf + 1, payload_size,
4222                                                 &write_packets);
4223                                 if (payload_res > 0) {
4224                                         memset(context->hs_messages, 0,
4225                                                         sizeof(context->hs_messages));
4226                                 }
4227                                 break;
4228                         default:
4229                                 DEBUG_PRINT
4230                                         (" => NOT UNDERSTOOD PAYLOAD TYPE: %x\n",
4231                                          (int) type);
4232                                 return TLS_NOT_UNDERSTOOD;
4233                 }
4234
4235                 //if (type != 0x00 && update_hash) {
4236                 if (type != 0x00) {
4237                         tls_update_hash(context, buf, payload_size + 1);
4238                 }
4239
4240                 if (certificate_verify_alert != no_error) {
4241                         tls_alert(context, 1, certificate_verify_alert);
4242                         context->critical_error = 1;
4243                 }
4244
4245                 if (payload_res < 0) {
4246                         switch (payload_res) {
4247                                 case TLS_UNEXPECTED_MESSAGE:
4248                                         tls_alert(context, 1, unexpected_message);
4249                                         break;
4250                                 case TLS_COMPRESSION_NOT_SUPPORTED:
4251                                         tls_alert(context, 1, decompression_failure_RESERVED);
4252                                         break;
4253                                 case TLS_BROKEN_PACKET:
4254                                         tls_alert(context, 1, decode_error);
4255                                         break;
4256                                 case TLS_NO_MEMORY:
4257                                         tls_alert(context, 1, internal_error);
4258                                         break;
4259                                 case TLS_NOT_VERIFIED:
4260                                         tls_alert(context, 1, bad_record_mac);
4261                                         break;
4262                                 case TLS_BAD_CERTIFICATE:
4263                                         if (context->is_server) {
4264                                                 /* bad client certificate, continue */
4265                                                 tls_alert(context, 0, bad_certificate);
4266                                                 payload_res = 0;
4267                                         } else {
4268                                                 tls_alert(context, 1, bad_certificate);
4269                                         }
4270                                         break;
4271                                 case TLS_UNSUPPORTED_CERTIFICATE:
4272                                         tls_alert(context, 1, unsupported_certificate);
4273                                         break;
4274                                 case TLS_NO_COMMON_CIPHER:
4275                                         tls_alert(context, 1, insufficient_security);
4276                                         break;
4277                                 case TLS_NOT_UNDERSTOOD:
4278                                         tls_alert(context, 1, internal_error);
4279                                         break;
4280                                 case TLS_NO_RENEGOTIATION:
4281                                         tls_alert(context, 0, no_renegotiation_RESERVED);
4282                                         payload_res = 0;
4283                                         break;
4284                                 case TLS_DECRYPTION_FAILED:
4285                                         tls_alert(context, 1, decryption_failed_RESERVED);
4286                                         break;
4287                         }
4288                         if (payload_res < 0) {
4289                                 return payload_res;
4290                         }
4291                 }
4292
4293                 if (certificate_verify_alert != no_error) {
4294                         payload_res = TLS_BAD_CERTIFICATE;
4295                 }
4296
4297                 /* except renegotiation */
4298                 struct TLSPacket *pkt;
4299                 switch (write_packets) {
4300                         case 1:
4301                                 if (context->client_verified == 2) {
4302                                         tls_send_certificate(context);
4303                                         context->client_verified = 0;
4304                                 }
4305
4306                                 /* client handshake */
4307                                 tls_send_client_key_exchange(context);
4308                                 tls_send_change_cipher_spec(context);
4309
4310                                 context->cipher_spec_set = 1;
4311                                 context->local_sequence_number = 0;
4312
4313                                 tls_send_finished(context);
4314
4315                                 context->cipher_spec_set = 0;
4316                                 break;
4317                         case 2:
4318                                 /* server handshake */
4319                                 DEBUG_PRINT("<= SENDING SERVER HELLO\n");
4320                                 if (context->connection_status == 3) {
4321                                         context->connection_status = 2;
4322                                         tls_queue_packet
4323                                                 (tls_build_hello(context, 0));
4324                                         tls_send_change_cipher_spec(context);
4325                                         _private_tls13_key(context, 1);
4326                                         context->cipher_spec_set = 1;
4327                                         DEBUG_PRINT
4328                                                 ("<= SENDING ENCRYPTED EXTENSIONS\n");
4329                                         tls_send_encrypted_extensions(context);
4330
4331                                         if (context->request_client_certificate) {
4332                                                 DEBUG_PRINT
4333                                                         ("<= SENDING CERTIFICATE REQUEST\n");
4334                                                 tls_queue_packet
4335                                                         (tls_certificate_request
4336                                                          (context));
4337                                         }
4338
4339                                         tls_send_certificate(context);
4340
4341                                         tls_send_certificate_verify(context);
4342
4343                                         tls_send_finished(context);
4344
4345                                         /* new key */
4346                                         free(context->server_finished_hash);
4347
4348                                         context->server_finished_hash =
4349                                                 malloc(tls_mac_length(context));
4350
4351                                         if (context->server_finished_hash) {
4352                                                 tls_get_hash(context,
4353                                                                 context->server_finished_hash);
4354                                         }
4355
4356                                         break;
4357                                 }
4358                                 tls_queue_packet(tls_build_hello(context, 0));
4359                                 DEBUG_PRINT("<= SENDING CERTIFICATE\n");
4360                                 tls_send_certificate(context);
4361
4362                                 int ephemeral_cipher =
4363                                         tls_cipher_is_ephemeral(context);
4364                                 if (ephemeral_cipher) {
4365                                         DEBUG_PRINT
4366                                                 ("<= SENDING EPHEMERAL DH KEY\n");
4367                                         tls_send_server_key_exchange(context,
4368                                                         ephemeral_cipher == 1 ?
4369                                                         KEA_dhe_rsa :
4370                                                         KEA_ec_diffie_hellman);
4371                                 }
4372                                 if (context->request_client_certificate) {
4373                                         DEBUG_PRINT
4374                                                 ("<= SENDING CERTIFICATE REQUEST\n");
4375                                         tls_queue_packet
4376                                                 (tls_certificate_request
4377                                                  (context));
4378                                 }
4379                                 tls_send_done(context);
4380                                 break;
4381                         case 3:
4382                                 /* finished */
4383                                 tls_send_change_cipher_spec(context);
4384                                 tls_send_finished(context);
4385                                 context->connection_status = TLS_CONNECTED;
4386                                 break;
4387                         case 4:
4388                                 /* dtls only */
4389                                 /* TODO error */
4390                                 break;
4391                         case 5:
4392                                 /* hello retry request */
4393                                 DEBUG_PRINT("<= SENDING HELLO RETRY REQUEST\n");
4394                                 pkt = tls_build_hello(context, 0);
4395                                 tls_queue_packet(pkt);
4396                                 break;
4397                 }
4398                 payload_size++;
4399                 buf += payload_size;
4400                 buf_len -= payload_size;
4401         }
4402         LEAVE;
4403         return orig_len;
4404 }
4405
4406 unsigned int asn1_get_len(const unsigned char *buffer, int buf_len,
4407                           unsigned int *octets) {
4408         *octets = 0;
4409
4410         if (buf_len < 1) {
4411                 return 0;
4412         }
4413
4414         unsigned char size = buffer[0];
4415         int i;
4416         if (size & 0x80) {
4417                 *octets = size & 0x7F;
4418                 if ((int) *octets > buf_len - 1) {
4419                         return 0;
4420                 }
4421                 /* max 32 bits */
4422                 unsigned int ref_octets = *octets;
4423                 if (*octets > 4) {
4424                         ref_octets = 4;
4425                 }
4426                 if ((int) *octets > buf_len - 1) {
4427                         return 0;
4428                 }
4429                 unsigned int long_size = 0;
4430                 unsigned int coef = 1;
4431
4432                 for (i = ref_octets; i > 0; i--) {
4433                         long_size += buffer[i] * coef;
4434                         coef *= 0x100;
4435                 }
4436                 ++*octets;
4437                 return long_size;
4438         }
4439         ++*octets;
4440         return size;
4441 }
4442
4443 void print_index(const unsigned int *fields) {
4444         int i = 0;
4445         while (fields[i]) {
4446                 if (i) {
4447                         DEBUG_PRINT(".");
4448                 }
4449                 DEBUG_PRINT("%i", fields[i]);
4450                 i++;
4451         }
4452         while (i < 6) {
4453                 DEBUG_PRINT("  ");
4454                 i++;
4455         }
4456 }
4457
4458 int _is_field(const unsigned int *fields, const unsigned int *prefix) {
4459         int i = 0;
4460         while (prefix[i]) {
4461                 if (fields[i] != prefix[i]) {
4462                         return 0;
4463                 }
4464                 i++;
4465         }
4466         return 1;
4467 }
4468
4469 static int tls_hash_len(int algorithm) {
4470         switch (algorithm) {
4471                 case TLS_RSA_SIGN_MD5:
4472                         return 16;
4473                 case TLS_RSA_SIGN_SHA1:
4474                         return 20;
4475                 case TLS_RSA_SIGN_SHA256:
4476                         return 32;
4477                 case TLS_RSA_SIGN_SHA384:
4478                         return 48;
4479                 case TLS_RSA_SIGN_SHA512:
4480                         return 64;
4481         }
4482         return 0;
4483 }
4484
4485 static unsigned char *tls_compute_hash(int algorithm, const unsigned char
4486                 *message, unsigned int message_len) {
4487         unsigned char *hash = NULL;
4488         int err;
4489         int hash_index = -1;
4490         unsigned long hash_len = 0;
4491
4492         if (!message || !message_len) {
4493                 return hash;
4494         }
4495
4496         switch (algorithm) {
4497                 case TLS_RSA_SIGN_MD5:
4498                         DEBUG_PRINT("SIGN MD5\n");
4499                         hash_index = find_hash("md5");
4500                         hash_len = 16;
4501                         break;
4502                 case TLS_RSA_SIGN_SHA1:
4503                         DEBUG_PRINT("SIGN SHA1\n");
4504                         hash_index = find_hash("sha1");
4505                         hash_len = 20;
4506                         break;
4507                 case TLS_RSA_SIGN_SHA256:
4508                         DEBUG_PRINT("SIGN SHA256\n");
4509                         hash_index = find_hash("sha256");
4510                         hash_len = 32;
4511                         break;
4512                 case TLS_RSA_SIGN_SHA384:
4513                         DEBUG_PRINT("SIGN SHA384\n");
4514                         hash_index = find_hash("sha384");
4515                         hash_len = 48;
4516                         break;
4517                 case TLS_RSA_SIGN_SHA512:
4518                         DEBUG_PRINT("SIGN SHA512\n");
4519                         hash_index = find_hash("sha512");
4520                         hash_len = 64;
4521                         break;
4522                 default:
4523                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4524                         return NULL;
4525                         break;
4526         }
4527
4528         hash = malloc(hash_len);
4529         if (!hash) {
4530                 return NULL;
4531         }
4532
4533         err = hash_memory(hash_index, message, message_len, hash, &hash_len);
4534         if (err) {
4535                 return NULL;
4536         }
4537         return hash;
4538 }
4539
4540 int tls_certificate_verify_signature(struct TLSCertificate *cert,
4541                                      struct TLSCertificate *parent) {
4542         if (!cert || !parent || !cert->sign_key
4543             || !cert->fingerprint || !cert->sign_len
4544             || !parent->der_bytes || !parent->der_len) {
4545                 DEBUG_PRINT("CANNOT VERIFY SIGNATURE ");
4546                 if (!cert) {
4547                         DEBUG_PRINT("!cert ");
4548                 } else {
4549                         if (!cert->sign_key) {
4550                                 DEBUG_PRINT("!cert->sign_key ");
4551                         }
4552                         if (!cert->fingerprint) {
4553                                 DEBUG_PRINT("!cert->fingerprint ");
4554                         }
4555                         if (!cert->sign_len) {
4556                                 DEBUG_PRINT("!cert->sign_len ");
4557                         }
4558                 }
4559
4560                 if (!parent) {
4561                         DEBUG_PRINT("!parent ");
4562                 } else {
4563                         if (!parent->der_bytes) {
4564                                 DEBUG_PRINT("!parent->der_bytes ");
4565                         }
4566                         if (!parent->der_len) {
4567                                 DEBUG_PRINT("!parent->der_len ");
4568                         }
4569                 }
4570                 DEBUG_PRINT("\n");
4571
4572                 return 0;
4573         }
4574         DEBUG_PRINT("checking alg\n");
4575         int hash_len = tls_hash_len(cert->algorithm);
4576         if (hash_len <= 0) {
4577                 return 0;
4578         }
4579
4580         int hash_index;
4581         switch (cert->algorithm) {
4582                 case TLS_RSA_SIGN_MD5:
4583                         hash_index = find_hash("md5");
4584                         break;
4585                 case TLS_RSA_SIGN_SHA1:
4586                         hash_index = find_hash("sha1");
4587                         break;
4588                 case TLS_RSA_SIGN_SHA256:
4589                         hash_index = find_hash("sha256");
4590                         break;
4591                 case TLS_RSA_SIGN_SHA384:
4592                         hash_index = find_hash("sha384");
4593                         break;
4594                 case TLS_RSA_SIGN_SHA512:
4595                         hash_index = find_hash("sha512");
4596                         break;
4597                 default:
4598                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4599                         return 0;
4600         }
4601
4602         rsa_key key;
4603         DEBUG_PRINTLN("rsa_import(%p, %d, %p)\n", parent->der_bytes,
4604                       parent->der_len, &key);
4605         int err = rsa_import(parent->der_bytes, parent->der_len, &key);
4606         if (err) {
4607                 DEBUG_PRINTLN
4608                     ("Error importing RSA certificate (code: %i)\n", err);
4609                 DEBUG_PRINT("Message: %s\n", error_to_string(err));
4610                 DEBUG_DUMP_HEX_LABEL("CERTIFICATE", parent->der_bytes,
4611                                      parent->der_len);
4612                 return 0;
4613         }
4614         int rsa_stat = 0;
4615         unsigned char *signature = cert->sign_key;
4616         int signature_len = cert->sign_len;
4617         if (!signature[0]) {
4618                 signature++;
4619                 signature_len--;
4620         }
4621
4622         err = rsa_verify_hash_ex(signature, signature_len, cert->fingerprint,
4623                         hash_len, LTC_PKCS_1_V1_5, hash_index, 0, &rsa_stat,
4624                         &key);
4625
4626         rsa_free(&key);
4627         if (err) {
4628                 DEBUG_PRINT("HASH VERIFY ERROR %i\n", err);
4629                 return 0;
4630         }
4631         DEBUG_PRINT("CERTIFICATE VALIDATION: %i\n", rsa_stat);
4632         return rsa_stat;
4633 }
4634
4635 int tls_certificate_chain_is_valid(struct TLSCertificate **certificates,
4636                                    int len) {
4637         if (!certificates || !len) {
4638                 return bad_certificate;
4639         }
4640
4641         int i;
4642         DEBUG_PRINT("verifying %i length cert chain\n", len);
4643         len--;
4644
4645         /* expired certificate or not yet valid ? */
4646         if (tls_certificate_is_valid(certificates[0])) {
4647                 return bad_certificate;
4648         }
4649
4650         /* check */
4651         for (i = 0; i < len; i++) {
4652                 /* certificate in chain is expired ? */
4653                 if (tls_certificate_is_valid(certificates[i + 1])) {
4654                         return bad_certificate;
4655                 }
4656
4657                 if (!tls_certificate_verify_signature(certificates[i],
4658                                         certificates[i + 1])) {
4659                         DEBUG_PRINT
4660                             ("tls_certificate_verify_signature certs[%d], certs[%d+1] failed\n",
4661                              i, i);
4662                         return bad_certificate;
4663                 }
4664
4665         }
4666         return 0;
4667 }
4668
4669 int tls_certificate_chain_is_valid_root(struct TLSContext *context, struct
4670                 TLSCertificate **certificates, int len) {
4671         int i, j;
4672
4673         if (!certificates || !len || !context->root_certificates
4674             || !context->root_count) {
4675                 return bad_certificate;
4676         }
4677         for (i = 0; i < len; i++) {
4678                 for (j = 0; j < context->root_count; j++) {
4679                         /* check if root certificate expired */
4680                         if (tls_certificate_is_valid
4681                             (context->root_certificates[j])) {
4682                                 continue;
4683                         }
4684                         /* if any root validates any certificate in the chain,
4685                          * then is root validated */
4686                         if (tls_certificate_verify_signature(certificates[i],
4687                                                 context->root_certificates[j]))
4688                         {
4689                                 return 0;
4690                         }
4691                 }
4692         }
4693         return bad_certificate;
4694 }
4695
4696 int _private_is_oid(struct OID_chain *ref_chain,
4697                     const unsigned char *looked_oid, int looked_oid_len) {
4698         while (ref_chain) {
4699                 if (ref_chain->oid) {
4700                         if (_is_oid2
4701                             (ref_chain->oid, looked_oid, 16,
4702                              looked_oid_len)) {
4703                                 return 1;
4704                         }
4705                 }
4706                 ref_chain = (struct OID_chain *) ref_chain->top;
4707         }
4708         return 0;
4709 }
4710
4711 int _private_asn1_parse(struct TLSContext *context,
4712                         struct TLSCertificate *cert,
4713                         const unsigned char *buffer, int size, int level,
4714                         unsigned int *fields, unsigned char *has_key,
4715                         int client_cert, unsigned char *top_oid,
4716                         struct OID_chain *chain) {
4717         struct OID_chain local_chain;
4718         DEBUG_INDEX(fields);
4719         DEBUG_PRINT("\n");
4720         local_chain.top = chain;
4721         int pos = 0;
4722         /* X.690 */
4723         int idx = 0;
4724         unsigned char oid[16];
4725         memset(oid, 0, 16);
4726         local_chain.oid = oid;
4727         if (has_key) {
4728                 *has_key = 0;
4729         }
4730         unsigned char local_has_key = 0;
4731         const unsigned char *cert_data = NULL;
4732         unsigned int cert_len = 0;
4733         while (pos < size) {
4734                 unsigned int start_pos = pos;
4735                 if (size - pos < 2) {
4736                         return TLS_NEED_MORE_DATA;
4737                 }
4738                 unsigned char first = buffer[pos++];
4739                 unsigned char type = first & 0x1F;
4740                 unsigned char constructed = first & 0x20;
4741                 unsigned char element_class = first >> 6;
4742                 int octets = 0;
4743                 unsigned int temp;
4744                 idx++;
4745                 if (level <= TLS_ASN1_MAXLEVEL) {
4746                         fields[level - 1] = idx;
4747                 }
4748                 DEBUG_INDEX(fields);
4749                 DEBUG_PRINT("\n");
4750                 int length = asn1_get_len((unsigned char *) &buffer[pos], size
4751                                 - pos, &octets);
4752                 DEBUG_PRINT("asn1_get_len = %u\n", length);
4753                 if ((octets > 4) || (octets > size - pos)) {
4754                         DEBUG_PRINT
4755                             ("CANNOT READ CERTIFICATE octets = %d, size = %d pos = %d, size - pos = %d\n",
4756                              octets, size, pos, size - pos);
4757                         return pos;
4758                 }
4759                 pos += octets;
4760
4761                 if (size - pos < length) {
4762                         return TLS_NEED_MORE_DATA;
4763                 }
4764
4765                 /*DEBUG_PRINT("FIRST: %x => %x (%i)\n", (int)first, (int)type, length); */
4766                 /* sequence */
4767                 /*DEBUG_PRINT("%2i: ", level); */
4768 #ifdef DEBUG
4769                 DEBUG_INDEX(fields);
4770                 int i1;
4771                 for (i1 = 1; i1 < level; i1++) {
4772                         DEBUG_PRINT("  ");
4773                 }
4774 #endif
4775
4776                 if (length && constructed) {
4777                         switch (type) {
4778                                 case 0x03:
4779                                         DEBUG_PRINT("CONSTRUCTED BITSTREAM\n");
4780                                         break;
4781                                 case 0x10:
4782                                 DEBUG_PRINT("SEQUENCE\n");
4783                                 if ((level == 2) && (idx == 1)) {
4784                                         cert_len =
4785                                             length + (pos - start_pos);
4786                                         cert_data = &buffer[start_pos];
4787                                 }
4788                                 /* private key on server or public key on client */
4789                                 if (!cert->version
4790                                     && (_is_field(fields, priv_der_id))) {
4791                                         free(cert->der_bytes);
4792                                         temp = length + (pos - start_pos);
4793                                         cert->der_bytes = malloc(temp);
4794                                         if (cert->der_bytes) {
4795                                                 memcpy(cert->der_bytes,
4796                                                        &buffer[start_pos],
4797                                                        temp);
4798                                                 cert->der_len = temp;
4799                                         } else
4800                                                 cert->der_len = 0;
4801                                 }
4802                                 break;
4803                         case 0x11:
4804                                 DEBUG_PRINT("EMBEDDED PDV\n");
4805                                 break;
4806                         case 0x00:
4807                                 if (element_class == 0x02) {
4808                                         DEBUG_PRINT("CONTEXT-SPECIFIC\n");
4809                                         break;
4810                                 }
4811                         default:
4812                                 DEBUG_PRINT("CONSTRUCT TYPE %02X\n",(int)type);
4813                         }
4814
4815                         local_has_key = 0;
4816                         _private_asn1_parse(context, cert, &buffer[pos],
4817                                             length, level + 1, fields,
4818                                             &local_has_key, client_cert,
4819                                             top_oid, &local_chain);
4820                         if (((local_has_key && context
4821                               && (!context->is_server || client_cert))
4822                              || !context)
4823                             && (_is_field(fields, pk_id))) {
4824                                 free(cert->der_bytes);
4825                                 temp = length + (pos - start_pos);
4826                                 cert->der_bytes = malloc(temp);
4827                                 if (cert->der_bytes) {
4828                                         memcpy(cert->der_bytes,
4829                                                &buffer[start_pos], temp);
4830                                         cert->der_len = temp;
4831                                 } else {
4832                                         cert->der_len = 0;
4833                                 }
4834                         }
4835                 } else {
4836                         switch (type) {
4837                         case 0x00:
4838                                 /* end of content */
4839                                 DEBUG_PRINT("END OF CONTENT\n");
4840                                 return pos;
4841                                 break;
4842                         case 0x01:
4843                                 /* boolean */
4844                                 temp = buffer[pos];
4845                                 DEBUG_PRINT("BOOLEAN: %i\n", temp);
4846                                 break;
4847                         case 0x02:
4848                                 /* integer */
4849                                 if (_is_field(fields, pk_id)) {
4850                                         if (has_key) {
4851                                                 *has_key = 1;
4852                                         }
4853
4854                                         if (idx == 1) {
4855                                                 tls_certificate_set_key
4856                                                     (cert, &buffer[pos],
4857                                                      length);
4858                                         } else if (idx == 2) {
4859                                                 tls_certificate_set_exponent
4860                                                     (cert, &buffer[pos],
4861                                                      length);
4862                                         }
4863                                 } else if (_is_field(fields, serial_id)) {
4864                                         tls_certificate_set_serial(cert,
4865                                                                    &buffer
4866                                                                    [pos],
4867                                                                    length);
4868                                 }
4869
4870                                 if (_is_field(fields, version_id)) {
4871                                         if (length == 1) {
4872                                                 cert->version =
4873                                                     buffer[pos];
4874                                         }
4875 #ifdef TLS_X509_V1_SUPPORT
4876                                         else {
4877                                                 cert->version = 0;
4878                                         }
4879                                         idx++;
4880 #endif
4881                                 }
4882                                 if (level >= 2) {
4883                                         unsigned int fields_temp[3];
4884                                         fields_temp[0] = fields[level - 2];
4885                                         fields_temp[1] = fields[level - 1];
4886                                         fields_temp[2] = 0;
4887                                         if (_is_field
4888                                             (fields_temp, priv_id)) {
4889                                                 tls_certificate_set_priv
4890                                                     (cert, &buffer[pos],
4891                                                      length);
4892                                         }
4893                                 }
4894                                 DEBUG_PRINT("INTEGER(%i): ", length);
4895                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4896                                 if ((chain) && (length > 2)) {
4897                                         if (_private_is_oid
4898                                             (chain, san_oid,
4899                                              sizeof(san_oid) - 1)) {
4900                                                 void *new;
4901
4902                                                 new =
4903                                                     TLS_REALLOC(cert->san,
4904                                                                 sizeof
4905                                                                 (unsigned
4906                                                                  char *) *
4907                                                                 (cert->
4908                                                                  san_length
4909                                                                  + 1));
4910                                                 if (new) {
4911                                                         cert->san = new;
4912                                                         cert->san[cert->
4913                                                                   san_length]
4914                                                             = NULL;
4915                                                         tls_certificate_set_copy
4916                                                             (&cert->
4917                                                              san[cert->
4918                                                                  san_length],
4919                                                              &buffer[pos],
4920                                                              length);
4921                                                         DEBUG_PRINT
4922                                                             (" => SUBJECT ALTERNATIVE NAME: %s",
4923                                                              cert->
4924                                                              san[cert->
4925                                                                  san_length]);
4926                                                         cert->san_length++;
4927                                                 } else {
4928                                                         free(cert->
4929                                                                  san);
4930                                                         cert->san = 0;
4931                                                         cert->san_length =
4932                                                             0;
4933                                                 }
4934                                         }
4935                                 }
4936                                 DEBUG_PRINT("\n");
4937                                 break;
4938                         case 0x03:
4939                                 if (_is_field(fields, pk_id)) {
4940                                         if (has_key)
4941                                                 *has_key = 1;
4942                                 }
4943                                 /* bitstream */
4944                                 DEBUG_PRINT("BITSTREAM(%i): ", length);
4945                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4946                                 DEBUG_PRINT("\n");
4947                                 if (_is_field(fields, sign_id)
4948                                     || _is_field(fields, sign_id2)) {
4949                                         DEBUG_PRINT("set sign key\n");
4950                                         tls_certificate_set_sign_key(cert,
4951                                                                      &buffer
4952                                                                      [pos],
4953                                                                      length);
4954                                 } else if (cert->ec_algorithm
4955                                            && (_is_field(fields, pk_id))) {
4956                                         tls_certificate_set_key(cert,
4957                                                                 &buffer
4958                                                                 [pos],
4959                                                                 length);
4960                                 } else {
4961                                         if (buffer[pos] == 0x00
4962                                             && length > 256) {
4963                                                 _private_asn1_parse
4964                                                     (context, cert,
4965                                                      &buffer[pos] + 1,
4966                                                      length - 1, level + 1,
4967                                                      fields,
4968                                                      &local_has_key,
4969                                                      client_cert, top_oid,
4970                                                      &local_chain);
4971                                         } else {
4972                                                 _private_asn1_parse
4973                                                     (context, cert,
4974                                                      &buffer[pos], length,
4975                                                      level + 1, fields,
4976                                                      &local_has_key,
4977                                                      client_cert, top_oid,
4978                                                      &local_chain);
4979                                         }
4980
4981                                         if (top_oid) {
4982                                                 if (_is_oid2
4983                                                     (top_oid,
4984                                                      TLS_EC_prime256v1_OID,
4985                                                      sizeof(oid),
4986                                                      sizeof
4987                                                      (TLS_EC_prime256v1) -
4988                                                      1)) {
4989                                                         cert->
4990                                                             ec_algorithm =
4991                                                             secp256r1.iana;
4992                                                 } else
4993                                                     if (_is_oid2
4994                                                         (top_oid,
4995                                                          TLS_EC_secp224r1_OID,
4996                                                          sizeof(oid),
4997                                                          sizeof
4998                                                          (TLS_EC_secp224r1_OID)
4999                                                          - 1)) {
5000                                                         cert->
5001                                                             ec_algorithm =
5002                                                             secp224r1.iana;
5003                                                 } else
5004                                                     if (_is_oid2
5005                                                         (top_oid,
5006                                                          TLS_EC_secp384r1_OID,
5007                                                          sizeof(oid),
5008                                                          sizeof
5009                                                          (TLS_EC_secp384r1_OID)
5010                                                          - 1)) {
5011                                                         cert->
5012                                                             ec_algorithm =
5013                                                             secp384r1.iana;
5014                                                 } else
5015                                                     if (_is_oid2
5016                                                         (top_oid,
5017                                                          TLS_EC_secp521r1_OID,
5018                                                          sizeof(oid),
5019                                                          sizeof
5020                                                          (TLS_EC_secp521r1_OID)
5021                                                          - 1)) {
5022                                                         cert->
5023                                                             ec_algorithm =
5024                                                             secp521r1.iana;
5025                                                 }
5026                                                 if ((cert->ec_algorithm)
5027                                                     && (!cert->pk))
5028                                                         tls_certificate_set_key
5029                                                             (cert,
5030                                                              &buffer[pos],
5031                                                              length);
5032                                         }
5033                                 }
5034                                 break;
5035                         case 0x04:
5036                                 if (top_oid && _is_field(fields, ecc_priv_id)
5037                                                 && !cert->priv) {
5038                                         DEBUG_PRINT("BINARY STRING(%i): ",
5039                                                     length);
5040                                         DEBUG_DUMP_HEX(&buffer[pos],
5041                                                        length);
5042                                         DEBUG_PRINT("\n");
5043                                         tls_certificate_set_priv(cert,
5044                                                                  &buffer
5045                                                                  [pos],
5046                                                                  length);
5047                                 } else {
5048                                         _private_asn1_parse(context, cert,
5049                                                             &buffer[pos],
5050                                                             length,
5051                                                             level + 1,
5052                                                             fields,
5053                                                             &local_has_key,
5054                                                             client_cert,
5055                                                             top_oid,
5056                                                             &local_chain);
5057                                 }
5058                                 break;
5059                         case 0x05:
5060                                 DEBUG_PRINT("NULL\n");
5061                                 break;
5062                         case 0x06:
5063                                 /* object identifier */
5064                                 if (_is_field(fields, pk_id)) {
5065                                         if (length == 8 || length == 5) {
5066                                                 tls_certificate_set_algorithm
5067                                                     (&cert->ec_algorithm,
5068                                                      &buffer[pos], length);
5069                                         } else {
5070                                                 tls_certificate_set_algorithm
5071                                                     (&cert->key_algorithm,
5072                                                      &buffer[pos], length);
5073                                         }
5074                                 }
5075                                 if (_is_field(fields, algorithm_id))
5076                                         tls_certificate_set_algorithm
5077                                             (&cert->algorithm,
5078                                              &buffer[pos], length);
5079
5080                                 DEBUG_PRINT("OBJECT IDENTIFIER(%i): ", length);
5081                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5082                                 DEBUG_PRINT("\n");
5083                                 /* check previous oid */
5084                                 if (_is_oid2
5085                                     (oid, ocsp_oid, 16,
5086                                      sizeof(ocsp_oid) - 1))
5087                                         tls_certificate_set_copy(&cert->ocsp,
5088                                                                  &buffer[pos],
5089                                                                  length);
5090
5091                                 if (length < 16) {
5092                                         memcpy(oid, &buffer[pos], length);
5093                                 } else {
5094                                         memcpy(oid, &buffer[pos], 16);
5095                                 }
5096                                 if (top_oid)
5097                                         memcpy(top_oid, oid, 16);
5098                                 break;
5099                         case 0x09:
5100                                 DEBUG_PRINT("REAL NUMBER(%i): ", length);
5101                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5102                                 DEBUG_PRINT("\n");
5103                                 break;
5104                         case 0x17:
5105                                 /* utc time */
5106                                 DEBUG_PRINT("UTC TIME: [");
5107                                 DEBUG_DUMP(&buffer[pos], length);
5108                                 DEBUG_PRINT("]\n");
5109
5110                                 if (_is_field(fields, validity_id)) {
5111                                         if (idx == 1) {
5112                                                 tls_certificate_set_copy_date
5113                                                     (cert->not_before,
5114                                                      &buffer[pos], length);
5115                                         } else {
5116                                                 tls_certificate_set_copy_date
5117                                                     (cert->not_after,
5118                                                      &buffer[pos], length);
5119                                         }
5120                                 }
5121                                 break;
5122                         case 0x18:
5123                                 /* generalized time */
5124                                 DEBUG_PRINT("GENERALIZED TIME: [");
5125                                 DEBUG_DUMP(&buffer[pos], length);
5126                                 DEBUG_PRINT("]\n");
5127                                 break;
5128                         case 0x13:
5129                                 /* printable string */
5130                         case 0x0C:
5131                         case 0x14:
5132                         case 0x15:
5133                         case 0x16:
5134                         case 0x19:
5135                         case 0x1A:
5136                         case 0x1B:
5137                         case 0x1C:
5138                         case 0x1D:
5139                         case 0x1E:
5140                                 if (_is_field(fields, issurer_id)) {
5141                                         if (_is_oid(oid, country_oid, 3)) {
5142                                                 tls_certificate_set_copy
5143                                                     (&cert->issuer_country,
5144                                                      &buffer[pos], length);
5145                                         } else if (_is_oid
5146                                                  (oid, state_oid, 3)) {
5147                                                 tls_certificate_set_copy
5148                                                     (&cert->issuer_state,
5149                                                      &buffer[pos], length);
5150                                         } else if (_is_oid
5151                                                  (oid, location_oid, 3)) {
5152                                                 tls_certificate_set_copy
5153                                                     (&cert->
5154                                                      issuer_location,
5155                                                      &buffer[pos], length);
5156                                         } else if (_is_oid
5157                                                  (oid, entity_oid, 3)) {
5158                                                 tls_certificate_set_copy
5159                                                     (&cert->issuer_entity,
5160                                                      &buffer[pos], length);
5161                                         } else if (_is_oid
5162                                                  (oid, subject_oid, 3)) {
5163                                                 tls_certificate_set_copy
5164                                                     (&cert->issuer_subject,
5165                                                      &buffer[pos], length);
5166                                         }
5167                                 } else if (_is_field(fields, owner_id)) {
5168                                         if (_is_oid(oid, country_oid, 3)) {
5169                                                 tls_certificate_set_copy
5170                                                     (&cert->country,
5171                                                      &buffer[pos], length);
5172                                         } else if (_is_oid
5173                                                  (oid, state_oid, 3)) {
5174                                                 tls_certificate_set_copy
5175                                                     (&cert->state,
5176                                                      &buffer[pos], length);
5177                                         } else if (_is_oid
5178                                                  (oid, location_oid, 3)) {
5179                                                 tls_certificate_set_copy
5180                                                     (&cert->location,
5181                                                      &buffer[pos], length);
5182                                         } else if (_is_oid
5183                                                  (oid, entity_oid, 3)) {
5184                                                 tls_certificate_set_copy
5185                                                     (&cert->entity,
5186                                                      &buffer[pos], length);
5187                                         } else if (_is_oid
5188                                                  (oid, subject_oid, 3)) {
5189                                                 tls_certificate_set_copy
5190                                                     (&cert->subject,
5191                                                      &buffer[pos], length);
5192                                         }
5193                                 }
5194                                 DEBUG_PRINT("STR: [");
5195                                 DEBUG_DUMP(&buffer[pos], length);
5196                                 DEBUG_PRINT("]\n");
5197                                 break;
5198                         case 0x10:
5199                                 DEBUG_PRINT("EMPTY SEQUENCE\n");
5200                                 break;
5201                         case 0xA:
5202                                 DEBUG_PRINT("ENUMERATED(%i): ", length);
5203                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5204                                 DEBUG_PRINT("\n");
5205                                 break;
5206                         default:
5207                                 DEBUG_PRINT("========> NOT SUPPORTED %x\n",
5208                                             (int) type);
5209                                 /* not supported / needed */
5210                                 break;
5211                         }
5212                 }
5213                 pos += length;
5214         }
5215
5216         if (cert_len && cert_data) {
5217                 int h = find_hash("sha256");
5218                 size_t len = sizeof cert->fp;
5219                 hash_memory(h, cert_data,cert_len, cert->fp, &len);
5220         }
5221
5222         if (level == 2 && cert->sign_key && cert->sign_len
5223             && cert_len && cert_data) {
5224                 free(cert->fingerprint);
5225                 cert->fingerprint = tls_compute_hash(cert->algorithm,
5226                                 cert_data, cert_len);
5227 #ifdef DEBUG
5228                 if (cert->fingerprint) {
5229                         DEBUG_DUMP_HEX_LABEL("FINGERPRINT",
5230                                              cert->fingerprint,
5231                                              tls_hash_len(cert->algorithm));
5232                 }
5233 #endif
5234         }
5235         return pos;
5236 }
5237
5238 struct TLSCertificate *asn1_parse(struct TLSContext *context,
5239                                   const unsigned char *buffer, int size,
5240                                   int client_cert) {
5241         unsigned int fields[TLS_ASN1_MAXLEVEL] = { 0 };
5242
5243         struct TLSCertificate *cert = tls_create_certificate();
5244
5245         if (cert) {
5246                 if (client_cert < 0) {
5247                         client_cert = 0;
5248                         /* private key */
5249                         unsigned char top_oid[16];
5250                         memset(top_oid, 0, sizeof(top_oid));
5251                         _private_asn1_parse(context, cert, buffer, size, 1,
5252                                             fields, NULL, client_cert,
5253                                             top_oid, NULL);
5254                 } else {
5255                         _private_asn1_parse(context, cert, buffer, size, 1,
5256                                             fields, NULL, client_cert,
5257                                             NULL, NULL);
5258                 }
5259         }
5260         return cert;
5261 }
5262
5263 int tls_clear_certificates(struct TLSContext *tls) {
5264         int i;
5265
5266         if (!tls || !tls->is_server || tls->is_child) {
5267                 return TLS_GENERIC_ERROR;
5268         }
5269
5270         if (tls->root_certificates) {
5271                 for (i = 0; i < tls->root_count; i++) {
5272                         tls_destroy_certificate(tls->root_certificates[i]);
5273                 }
5274         }
5275         tls->root_certificates = NULL;
5276         tls->root_count = 0;
5277
5278         if (tls->private_key) {
5279                 tls_destroy_certificate(tls->private_key);
5280         }
5281         tls->private_key = NULL;
5282         if (tls->ec_private_key) {
5283                 tls_destroy_certificate(tls->ec_private_key);
5284         }
5285         tls->ec_private_key = NULL;
5286         free(tls->certificates);
5287         tls->certificates = NULL;
5288         tls->certificates_count = 0;
5289         return 0;
5290 }
5291
5292 /* This is just a wrapper around parse message so we don't
5293  * call read more often than necessary.  IOW, if there's
5294  * more than one record in the input buffer, process them all
5295  */
5296 int tls_consume_stream(struct TLSContext *context) {
5297         if (!context) {
5298                 return TLS_GENERIC_ERROR;
5299         }
5300
5301         if (context->critical_error) {
5302                 return TLS_BROKEN_CONNECTION;
5303         }
5304
5305         size_t tls_buffer_len = context->input_buffer.len;
5306         unsigned char *buffer = context->input_buffer.buffer;
5307
5308         unsigned int index = 0;
5309         int err_flag = 0;
5310
5311         int tls_header_size;
5312         int tls_size_offset;
5313
5314         tls_size_offset = 3;
5315         tls_header_size = 5;
5316
5317         while (tls_buffer_len >= 5) {
5318                 uint16_t length;
5319
5320                 length = get16(buffer + index + tls_size_offset)
5321                     + tls_header_size;
5322
5323                 if (length > tls_buffer_len) {
5324                         /* record not complete */
5325                         break;
5326                 }
5327
5328                 /* This is the only place tls_parse_message is called */
5329                 int consumed = tls_parse_message(context, buffer+index, length);
5330                 if (consumed < 0) {
5331                         fprintf(stderr, "parse message error: %d\n", consumed);
5332                         err_flag = consumed;
5333                         break;
5334                 }
5335                 index += length;
5336                 tls_buffer_len -= length;
5337                 if (context->critical_error) {
5338                         err_flag = TLS_BROKEN_CONNECTION;
5339                         break;
5340                 }
5341         }
5342
5343         if (err_flag || context->input_buffer.error) {
5344                 if (!context->critical_error) {
5345                         context->critical_error = 1;
5346                 }
5347                 DEBUG_PRINT("ERROR IN CONSUME: %i\n", err_flag);
5348                 tls_buffer_free(&context->input_buffer);
5349                 return err_flag;
5350         }
5351         tls_buffer_shift(&context->input_buffer, index);
5352         return index;
5353 }
5354
5355 void tls_close_notify(struct TLSContext *context) {
5356         if (!context || context->critical_error) {
5357                 return;
5358         }
5359         context->critical_error = 1;
5360         DEBUG_PRINT("CLOSE\n");
5361         tls_alert(context, 0, close_notify);
5362 }
5363
5364 void tls_alert(struct TLSContext *context, int critical, int code) {
5365         if (!context) {
5366                 return;
5367         }
5368
5369         struct TLSPacket *packet = tls_create_packet(context, TLS_ALERT,
5370                         context->version, 0);
5371         tls_packet_uint8(packet, critical ? TLS_ALERT_CRITICAL :
5372                         TLS_ALERT_WARNING);
5373
5374         tls_packet_uint8(packet, code);
5375         tls_packet_update(packet);
5376
5377         if (critical) {
5378                 context->critical_error = 1;
5379         }
5380
5381         tls_queue_packet(packet);
5382 }
5383
5384 int tls_is_broken(struct TLSContext *context) {
5385         if (!context || context->critical_error) {
5386                 return 1;
5387         }
5388         return 0;
5389 }
5390
5391 /* TODO I don't see that this ever gets cleared */
5392 int tls_request_client_certificate(struct TLSContext *context) {
5393         if (!context || !context->is_server) {
5394                 return 0;
5395         }
5396
5397         context->request_client_certificate = 1;
5398         return 1;
5399 }
5400
5401 int tls_client_verified(struct TLSContext *context) {
5402         if (!context || context->critical_error) {
5403                 return 0;
5404         }
5405
5406         return context->client_verified == 1;
5407 }
5408
5409 int tls_sni_set(struct TLSContext *context, const char *sni) {
5410         if (!context || context->is_server || context->critical_error
5411             || context->connection_status != 0) {
5412                 return 0;
5413         }
5414
5415         free(context->sni);
5416         errno = 0;
5417         context->sni = sni ? strdup(sni) : 0;
5418         return context->sni ? 1 : 0;
5419 }
5420
5421 int tls_default_verify(struct TLSContext *context,
5422                        struct TLSCertificate **certificate_chain, int len)
5423 {
5424         int i;
5425         int err;
5426
5427         if (certificate_chain) {
5428                 for (i = 0; i < len; i++) {
5429                         struct TLSCertificate *certificate =
5430                             certificate_chain[i];
5431                         /* check validity date */
5432                         err = tls_certificate_is_valid(certificate);
5433                         if (err) {
5434                                 return err;
5435                         }
5436                 }
5437         }
5438         /* check if chain is valid */
5439         err = tls_certificate_chain_is_valid(certificate_chain, len);
5440         if (err) {
5441                 return err;
5442         }
5443
5444         /* check certificate subject */
5445         if (!context->is_server && context->sni && len > 0
5446             && certificate_chain) {
5447                 err = tls_certificate_valid_subject(certificate_chain[0],
5448                                 context->sni);
5449                 if (err) {
5450                         return err;
5451                 }
5452         }
5453
5454         err = tls_certificate_chain_is_valid_root(context, certificate_chain,
5455                                                 len);
5456         if (err) {
5457                 return err;
5458         }
5459
5460         DEBUG_PRINT("Certificate OK\n");
5461         return no_error;
5462 }
5463
5464 ssize_t tls_fsync(struct TLSContext *context) {
5465         size_t buflen = 0;
5466         size_t offset = 0;
5467         ssize_t send_res = 0;
5468         int fd;
5469         unsigned char *buffer;
5470         tls_send_func write_cb = NULL;
5471
5472         if (!context) {
5473                 return 0;
5474         }
5475
5476         fd = context->fd;
5477         if (fd < 0) {
5478                 return -1;
5479         }
5480
5481         buffer = context->output_buffer.buffer;
5482         buflen = context->output_buffer.len;
5483
5484         if (context->send) {
5485                 write_cb = context->send;
5486         } else {
5487                 write_cb = send;
5488         }
5489
5490         while (buflen > 0) {
5491                 ssize_t res;
5492                 errno = 0;
5493                 res = write_cb(fd, buffer+offset, buflen, 0);
5494                 if (res <= 0) {
5495                         perror("send error");
5496                         send_res = res;
5497                         break;
5498                 }
5499                 buflen -= res;
5500                 offset += res;
5501                 send_res += res;
5502         }
5503         DEBUG_PRINT("sent %zd bytes\n", send_res);
5504         context->output_buffer.len = 0;
5505         return send_res;
5506 }
5507
5508 void tls_free(struct TLSContext *context) {
5509         if (context) {
5510                 free(context->user_data);
5511                 tls_destroy_context(context);
5512         }
5513 }
5514
5515 int tls_set_fd(struct TLSContext *context, int socket) {
5516         if (!context) {
5517                 return TLS_GENERIC_ERROR;
5518         }
5519         context->fd = socket;
5520         return 0;
5521 }
5522
5523 int tls_load_root_file(struct TLSContext *context, const char *pem_filename) {
5524         int fd;
5525         struct stat st;
5526         void *addr;
5527
5528         if (!context) {
5529                 return -1;
5530         }
5531
5532         int count = -1;
5533
5534         fd = open(pem_filename, O_RDONLY);
5535         if (fd == -1) {
5536                 return -1;
5537         }
5538
5539         if (fstat(fd, &st) == -1) {
5540                 close(fd);
5541                 return -1;
5542         }
5543
5544         addr = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
5545         if (addr == MAP_FAILED) {
5546                 close(fd);
5547                 return -1;
5548         }
5549
5550         count = tls_load_root_certificates(context, addr, st.st_size);
5551         munmap(addr, st.st_size);
5552         close(fd);
5553
5554         return count;
5555 }
5556
5557 void tls_set_verify(struct TLSContext *tls, tls_validation_function vfunc) {
5558         if (tls) {
5559                 tls->certificate_verify = vfunc;
5560         }
5561 }
5562
5563 static ssize_t tls_safe_read(struct TLSContext *tls) {
5564         tls_recv_func read_cb;
5565         char buffer[8192];
5566         ssize_t bytes;
5567
5568         if (!tls || tls->fd <= 0) {
5569                 return TLS_GENERIC_ERROR;
5570         }
5571
5572         if (tls->recv) {
5573                 read_cb = tls->recv;
5574         } else {
5575                 read_cb = recv;
5576         }
5577
5578         errno = 0;
5579         bytes = read_cb(tls->fd, buffer, sizeof buffer, 0);
5580         if (bytes > 0) {
5581                 tls_buffer_append(&tls->input_buffer, buffer, bytes);
5582         }
5583
5584         return bytes;
5585 }
5586
5587 /* I think this is the server handshake */
5588 int SSL_accept(struct TLSContext *context) {
5589         ssize_t read_size = 0;
5590
5591         if (!context || context->fd <= 0) {
5592                 return TLS_GENERIC_ERROR;
5593         }
5594
5595         if (tls_established(context)) {
5596                 return 1;
5597         }
5598
5599         /* accept */
5600         while ((read_size = tls_safe_read(context)) > 0) {
5601                 if (tls_consume_stream(context) >= 0) {
5602                         ssize_t res = tls_fsync(context);
5603                         if (res < 0) {
5604                                 return res;
5605                         }
5606                 }
5607                 if (tls_established(context)) {
5608                         return 1;
5609                 }
5610         }
5611         if (read_size <= 0) {
5612                 return TLS_BROKEN_CONNECTION;
5613         }
5614         return 0;
5615 }
5616
5617 /* TODO this is really do the handshake */
5618 int tls_connect(struct TLSContext *context) {
5619         int res;
5620         ssize_t read_size;
5621
5622         MARK;
5623         if (!context || context->fd < 0 || context->critical_error) {
5624                 if (!context) {
5625                         MARK;
5626                 } else if (context->fd < 0) {
5627                         MARK;
5628                 } else {
5629                         MARK;
5630                 }
5631
5632                 return TLS_GENERIC_ERROR;
5633         }
5634
5635         MARK;
5636         if (context->is_server) {
5637                 return TLS_UNEXPECTED_MESSAGE;
5638         }
5639         MARK;
5640
5641         res = tls_queue_packet(tls_build_client_hello(context));
5642
5643         MARK;
5644         if (res < 0) {
5645                 return res;
5646         }
5647
5648         MARK;
5649         res = tls_fsync(context);
5650         MARK;
5651         if (res < 0) {
5652                 return res;
5653         }
5654
5655         while ((read_size = tls_safe_read(context)) > 0) {
5656                 if ((res = tls_consume_stream(context)) >= 0) {
5657                         res = tls_fsync(context);
5658                         if (res < 0) {
5659                                 return res;
5660                         }
5661                 }
5662         MARK;
5663                 if (tls_established(context)) {
5664                         MARK;
5665                         return 1;
5666                 }
5667         MARK;
5668                 if (context->critical_error) {
5669                         fprintf(stderr, "critical error: %d\n",
5670                                         context->critical_error);
5671                         return TLS_GENERIC_ERROR;
5672                 }
5673         }
5674         MARK;
5675         return read_size;
5676 }
5677
5678 int tls_shutdown(struct TLSContext *tls) {
5679         if (!tls || tls->fd <= 0) {
5680                 return TLS_GENERIC_ERROR;
5681         }
5682
5683         tls_close_notify(tls);
5684         return 0;
5685 }
5686
5687 /* TODO configure for maximum packet data length
5688  * max is 2^14 - 5 byte header - 32 byte mac - padding which depends
5689  * on the cipher (up to 255 bytes I think).
5690  */
5691 ssize_t tls_write(struct TLSContext *context, const void *buf, size_t count) {
5692         if (!context) {
5693                 return TLS_GENERIC_ERROR;
5694         }
5695         if (context->connection_status != TLS_CONNECTED) {
5696                 return TLS_UNEXPECTED_MESSAGE;
5697         }
5698         if (count > TLS_MAXTLS_APP_SIZE) {
5699                 count = TLS_MAXTLS_APP_SIZE;
5700         }
5701
5702         if (!buf || !count) {
5703                 return 0;
5704         }
5705
5706         struct TLSPacket *packet = tls_create_packet(context,
5707                         TLS_APPLICATION_DATA, context->version, count);
5708         tls_packet_append(packet, buf, count);
5709         tls_packet_update(packet);
5710
5711         tls_queue_packet(packet);
5712         /* TODO think about this.  context->sync with O_NONBLOCK might be a
5713          * problem
5714          */
5715         if (context->sync) {
5716                 ssize_t res;
5717                 res = tls_fsync(context);
5718                 if (res == -1) {
5719                         return res;
5720                 }
5721         }
5722         return count;
5723 }
5724
5725 static ssize_t tls_readbuf(struct TLSContext *tls, void *buf, size_t count) {
5726         if (count > tls->application_buffer.len) {
5727                 count = tls->application_buffer.len;
5728         }
5729
5730         if (count > 0) {
5731                 /* TODO should have a buffer read and shift */
5732                 memcpy(buf, tls->application_buffer.buffer, count);
5733                 tls_buffer_shift(&tls->application_buffer, count);
5734         }
5735
5736         return count;
5737 }
5738
5739 ssize_t tls_read(struct TLSContext *context, void *buf, size_t count) {
5740         if (!context) {
5741                 return TLS_GENERIC_ERROR;
5742         }
5743
5744         if (context->application_buffer.len) {
5745                 return tls_readbuf(context, buf, count);
5746         }
5747
5748         if (context->fd <= 0 || context->critical_error) {
5749                 return TLS_GENERIC_ERROR;
5750         }
5751
5752         if (!tls_established(context)) {
5753                 return TLS_GENERIC_ERROR;
5754         }
5755
5756         if (context->application_buffer.len == 0 && !context->critical_error) {
5757                 /* attempt to fill buffer, unless we're already in an error
5758                  * state
5759                  */
5760                 ssize_t read_size;
5761
5762                 while ((read_size = tls_safe_read(context)) > 0) {
5763                         if (tls_consume_stream(context) > 0) {
5764                                 tls_fsync(context);
5765                                 break;
5766                         }
5767                         if (context->critical_error
5768                             && !context->application_buffer.len) {
5769                                 /* if there's a critical error, don't bail if
5770                                  * we managed to get some data
5771                                  */
5772                                 return TLS_GENERIC_ERROR;
5773                         }
5774                 }
5775
5776                 if (read_size <= 0 && context->application_buffer.len == 0) {
5777                         /* can return errors as for read(2) */
5778                         return read_size;
5779                 }
5780         }
5781
5782         return tls_readbuf(context, buf, count);
5783 }