pd.if.org Git - zpackage/blob - crypto/tlse.c

   1 #define _POSIX_C_SOURCE 200809L
   2
   3 #include <fcntl.h>
   4 #include <stdint.h>
   5 #include <stdio.h>
   6 #include <stdlib.h>
   7 #include <string.h>
   8 #include <strings.h>
   9 #include <sys/mman.h>
  10 #include <sys/stat.h>
  11 #include <time.h>
  12
  13 #include <sys/socket.h>
  14 #include <arpa/inet.h>
  15 #include <unistd.h>
  16
  17 #include <errno.h>
  18
  19 #include "tomcrypt.h"
  20
  21 #define mp_init(a)                           ltc_mp.init(a)
  22 #define mp_init_multi                        ltc_init_multi
  23 #define mp_clear(a)                          ltc_mp.deinit(a)
  24 #define mp_clear_multi                       ltc_deinit_multi
  25 #define mp_count_bits(a)                     ltc_mp.count_bits(a)
  26 #define mp_read_radix(a, b, c)               ltc_mp.read_radix(a, b, c)
  27 #define mp_unsigned_bin_size(a)              ltc_mp.unsigned_size(a)
  28 #define mp_to_unsigned_bin(a, b)             ltc_mp.unsigned_write(a, b)
  29 #define mp_read_unsigned_bin(a, b, c)        ltc_mp.unsigned_read(a, b, c)
  30 #define mp_exptmod(a, b, c, d)               ltc_mp.exptmod(a, b, c, d)
  31 #define mp_add(a, b, c)                      ltc_mp.add(a, b, c)
  32 #define mp_mul(a, b, c)                      ltc_mp.mul(a, b, c)
  33 #define mp_cmp(a, b)                         ltc_mp.compare(a, b)
  34 #define mp_cmp_d(a, b)                       ltc_mp.compare_d(a, b)
  35 #define mp_sqr(a, b)                         ltc_mp.sqr(a, b)
  36 #define mp_mod(a, b, c)                      ltc_mp.mpdiv(a, b, NULL, c)
  37 #define mp_sub(a, b, c)                      ltc_mp.sub(a, b, c)
  38 #define mp_set(a, b)                         ltc_mp.set_int(a, b)
  39
  40 #if (CRYPT <= 0x0117)
  41 #define LTC_PKCS_1_EMSA LTC_LTC_PKCS_1_EMSA
  42 #define LTC_PKCS_1_V1_5 LTC_LTC_PKCS_1_V1_5
  43 #define LTC_PKCS_1_PSS LTC_LTC_PKCS_1_PSS
  44 #endif
  45
  46 #include "tlse.h"
  47 #include "chacha.h"
  48 #include "buffer.h"
  49
  50 #define TLS_DH_DEFAULT_P            "87A8E61DB4B6663CFFBBD19C651959998CEEF608660DD0F25D2CEED4435E3B00E00DF8F1D61957D4FAF7DF4561B2AA3016C3D91134096FAA3BF4296D830E9A7C209E0C6497517ABD5A8A9D306BCF67ED91F9E6725B4758C022E0B1EF4275BF7B6C5BFC11D45F9088B941F54EB1E59BB8BC39A0BF12307F5C4FDB70C581B23F76B63ACAE1CAA6B7902D52526735488A0EF13C6D9A51BFA4AB3AD8347796524D8EF6A167B5A41825D967E144E5140564251CCACB83E6B486F6B3CA3F7971506026C0B857F689962856DED4010ABD0BE621C3A3960A54E710C375F26375D7014103A4B54330C198AF126116D2276E11715F693877FAD7EF09CADB094AE91E1A1597"
  51 #define TLS_DH_DEFAULT_G            "3FB32C9B73134D0B2E77506660EDBD484CA7B18F21EF205407F4793A1A0BA12510DBC15077BE463FFF4FED4AAC0BB555BE3A6C1B0C6B47B1BC3773BF7E8C6F62901228F8C28CBB18A55AE31341000A650196F931C77A57F2DDF463E5E9EC144B777DE62AAAB8A8628AC376D282D6ED3864E67982428EBC831D14348F6F2F9193B5045AF2767164E1DFC967C1FB3F2E55A4BD1BFFE83B9C80D052B985D182EA0ADB2A3B7313D3FE14C8484B1E052588B9B7D2BBD2DF016199ECD06E1557CD0915B3353BBB64E0EC377FD028370DF92B52C7891428CDC67EB6184B523D1DB246C32F63078490F00EF8D647D148D47954515E2327CFEF98C582664B4C0F6CC41659"
  52 #define TLS_DHE_KEY_SIZE          2048
  53
  54 #ifndef htonll
  55 #define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
  56 #endif
  57
  58 #ifndef ntohll
  59 #define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
  60 #endif
  61
  62 #define CHECK_HANDSHAKE_STATE(context, n, limit)  { if (context->hs_messages[n] >= limit) { DEBUG_PRINT("* UNEXPECTED MESSAGE (%i)\n", (int)n); payload_res = TLS_UNEXPECTED_MESSAGE; break; } context->hs_messages[n]++; }
  63
  64 #ifdef DEBUG
  65 int tls_indent = 0;
  66 int tls_indent_i = 0;
  67 #endif
  68
  69 //#define MARK
  70 typedef enum {
  71         KEA_dhe_dss,
  72         KEA_dhe_rsa,
  73         KEA_dh_anon,
  74         KEA_rsa,
  75         KEA_dh_dss,
  76         KEA_dh_rsa,
  77         KEA_ec_diffie_hellman
  78 } KeyExchangeAlgorithm;
  79
  80 typedef enum {
  81         rsa_sign = 1,
  82         dss_sign = 2,
  83         rsa_fixed_dh = 3,
  84         dss_fixed_dh = 4,
  85         rsa_ephemeral_dh_RESERVED = 5,
  86         dss_ephemeral_dh_RESERVED = 6,
  87         fortezza_dms_RESERVED = 20,
  88         ecdsa_sign = 64,
  89         rsa_fixed_ecdh = 65,
  90         ecdsa_fixed_ecdh = 66
  91 } TLSClientCertificateType;
  92
  93 typedef enum {
  94         none = 0,
  95         md5 = 1,
  96         sha1 = 2,
  97         sha224 = 3,
  98         sha256 = 4,
  99         sha384 = 5,
 100         sha512 = 6,
 101         _md5_sha1 = 255
 102 } TLSHashAlgorithm;
 103
 104 typedef enum {
 105         anonymous = 0,
 106         rsa = 1,
 107         dsa = 2,
 108         ecdsa = 3
 109 } TLSSignatureAlgorithm;
 110
 111 struct OID_chain {
 112         void *top;
 113         unsigned char *oid;
 114 };
 115
 116 typedef ssize_t (*tls_recv_func)(int sockfd, void *buf, size_t len,
 117                                  int flags);
 118 typedef ssize_t (*tls_send_func)(int sockfd, const void *buf, size_t len,
 119                                  int flags);
 120
 121 static const unsigned int version_id[] = { 1, 1, 1, 0 };
 122 static const unsigned int pk_id[] = { 1, 1, 7, 0 };
 123 static const unsigned int serial_id[] = { 1, 1, 2, 1, 0 };
 124 static const unsigned int issurer_id[] = { 1, 1, 4, 0 };
 125 static const unsigned int owner_id[] = { 1, 1, 6, 0 };
 126 static const unsigned int validity_id[] = { 1, 1, 5, 0 };
 127 static const unsigned int algorithm_id[] = { 1, 1, 3, 0 };
 128 static const unsigned int sign_id[] = { 1, 3, 2, 1, 0 };
 129 static const unsigned int sign_id2[] = { 1, 3, 2, 2, 0 };
 130 static const unsigned int priv_id[] = { 1, 4, 0 };
 131 static const unsigned int priv_der_id[] = { 1, 3, 1, 0 };
 132 static const unsigned int ecc_priv_id[] = { 1, 2, 0 };
 133
 134 static const unsigned char country_oid[] = { 0x55, 0x04, 0x06, 0x00 };
 135 static const unsigned char state_oid[] = { 0x55, 0x04, 0x08, 0x00 };
 136 static const unsigned char location_oid[] = { 0x55, 0x04, 0x07, 0x00 };
 137 static const unsigned char entity_oid[] = { 0x55, 0x04, 0x0A, 0x00 };
 138 static const unsigned char subject_oid[] = { 0x55, 0x04, 0x03, 0x00 };
 139 static const unsigned char san_oid[] = { 0x55, 0x1D, 0x11, 0x00 };
 140 static const unsigned char ocsp_oid[] =
 141     { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x00 };
 142
 143 static const unsigned char TLS_RSA_SIGN_RSA_OID[] =
 144     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x00 };
 145 static const unsigned char TLS_RSA_SIGN_MD5_OID[] =
 146     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x04, 0x00 };
 147 static const unsigned char TLS_RSA_SIGN_SHA1_OID[] =
 148     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x05, 0x00 };
 149 static const unsigned char TLS_RSA_SIGN_SHA256_OID[] =
 150     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0B, 0x00 };
 151 static const unsigned char TLS_RSA_SIGN_SHA384_OID[] =
 152     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0C, 0x00 };
 153 static const unsigned char TLS_RSA_SIGN_SHA512_OID[] =
 154     { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x0D, 0x00 };
 155
 156 #if 0
 157 static const unsigned char TLS_ECDSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x01, 0x05, 0x00, 0x00};
 158 static const unsigned char TLS_ECDSA_SIGN_SHA224_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x01, 0x05, 0x00, 0x00};
 159 static const unsigned char TLS_ECDSA_SIGN_SHA256_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x02, 0x05, 0x00, 0x00};
 160 static const unsigned char TLS_ECDSA_SIGN_SHA384_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x03, 0x05, 0x00, 0x00};
 161 static const unsigned char TLS_ECDSA_SIGN_SHA512_OID[] = {0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x04, 0x03, 0x04, 0x05, 0x00, 0x00};
 162 #endif
 163
 164 static const unsigned char TLS_EC_PUBLIC_KEY_OID[] =
 165     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, 0x00 };
 166
 167 static const unsigned char TLS_EC_prime192v1_OID[] =
 168     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x01, 0x00 };
 169 static const unsigned char TLS_EC_prime192v2_OID[] =
 170     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x02, 0x00 };
 171 static const unsigned char TLS_EC_prime192v3_OID[] =
 172     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x03, 0x00 };
 173 static const unsigned char TLS_EC_prime239v1_OID[] =
 174     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x04, 0x00 };
 175 static const unsigned char TLS_EC_prime239v2_OID[] =
 176     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x05, 0x00 };
 177 static const unsigned char TLS_EC_prime239v3_OID[] =
 178     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x06, 0x00 };
 179 static const unsigned char TLS_EC_prime256v1_OID[] =
 180     { 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x00 };
 181
 182 #define TLS_EC_secp256r1_OID    TLS_EC_prime256v1_OID
 183 static const unsigned char TLS_EC_secp224r1_OID[] =
 184     { 0x2B, 0x81, 0x04, 0x00, 0x21, 0x00 };
 185 static const unsigned char TLS_EC_secp384r1_OID[] =
 186     { 0x2B, 0x81, 0x04, 0x00, 0x22, 0x00 };
 187 static const unsigned char TLS_EC_secp521r1_OID[] =
 188     { 0x2B, 0x81, 0x04, 0x00, 0x23, 0x00 };
 189
 190 int tls_random(unsigned char *key, int len);
 191 void tls_destroy_packet(struct TLSPacket *packet);
 192 struct TLSPacket *tls_build_hello(struct TLSContext *context,
 193                                   int tls13_downgrade);
 194
 195 /* not supported */
 196 #if 0
 197 static unsigned char TLS_DSA_SIGN_SHA1_OID[] = {0x2A, 0x86, 0x52, 0xCE, 0x38, 0x04, 0x03, 0x00};
 198 #endif
 199
 200 static uint16_t get16(const unsigned char *buf) {
 201         uint16_t res;
 202
 203         res = ((*buf) << 8) + (*(buf+1));
 204         return res;
 205 }
 206
 207 static uint32_t get24(const unsigned char *buf) {
 208         uint32_t res;
 209
 210         res = (buf[0] << 16) + (buf[1] << 8) + buf[2];
 211         return res;
 212 }
 213
 214 #ifdef DEBUG
 215 static char *packet_content_type(int type) {
 216         switch (type) {
 217                 case 20: return "change_cipher_spec"; break;
 218                 case 21: return "alert"; break;
 219                 case 22: return "handshake"; break;
 220                 case 23: return "application_data"; break;
 221                 default: break;
 222         }
 223         return "unknown content type";
 224 }
 225
 226 static char *packet_handshake_type(int type) {
 227         switch (type) {
 228                 case 0: return "hello_request"; break;
 229                 case 1: return "client_hello"; break;
 230                 case 2: return "server_hello"; break;
 231                 case 11: return "certificate"; break;
 232                 case 12: return "server_key_exchange"; break;
 233                 case 13: return "certificate_request"; break;
 234                 case 14: return "server_hello_done"; break;
 235                 case 15: return "certificate_verify"; break;
 236                 case 16: return "client_key_exchange"; break;
 237                 case 20: return "finished"; break;
 238                 default: break;
 239         }
 240         return "unknown handshake type";
 241 }
 242 #endif
 243
 244 size_t tls_queue_packet(struct TLSPacket *packet) {
 245         ENTER;
 246         if (!packet) {
 247                 LEAVE;
 248                 return -1;
 249         }
 250
 251         struct TLSContext *context = packet->context;
 252
 253         if (!context) {
 254                 LEAVE;
 255                 return -1;
 256         }
 257
 258         DEBUG_PRINTLN("sending packet type %d %s\n", (int)packet->buf[0],
 259                         packet_content_type(packet->buf[0]));
 260         if (packet->buf[0] == 22) {
 261                 DEBUG_PRINTLN("handshake type %d %s\n", (int)packet->buf[5],
 262                                 packet_handshake_type(packet->buf[5])
 263                                 );
 264         }
 265         tls_buffer_append(&context->output_buffer, packet->buf, packet->len);
 266         tls_destroy_packet(packet);
 267         LEAVE;
 268         return context->output_buffer.len;
 269 }
 270
 271 static void tls_send_change_cipher_spec(struct TLSContext *context) {
 272         ENTER;
 273         struct TLSPacket *packet =
 274             tls_create_packet(context, TLS_CHANGE_CIPHER, context->version,
 275                               64);
 276         tls_packet_uint8(packet, 1);
 277         tls_packet_update(packet);
 278         context->local_sequence_number = 0;
 279         tls_queue_packet(packet);
 280         LEAVE;
 281         return;
 282 }
 283
 284 static void tls_send_encrypted_extensions(struct TLSContext *context) {
 285         struct TLSPacket *packet =
 286             tls_create_packet(context, TLS_HANDSHAKE, context->version, 3);
 287         tls_packet_uint8(packet, 0x08);
 288
 289         if (context->negotiated_alpn) {
 290                 int alpn_negotiated_len = strlen(context->negotiated_alpn);
 291                 int alpn_len = alpn_negotiated_len + 1;
 292
 293                 tls_packet_uint24(packet, alpn_len + 8);
 294                 tls_packet_uint16(packet, alpn_len + 6);
 295                 tls_packet_uint16(packet, 0x10);
 296                 tls_packet_uint16(packet, alpn_len + 2);
 297                 tls_packet_uint16(packet, alpn_len);
 298
 299                 tls_packet_uint8(packet, alpn_negotiated_len);
 300                 tls_packet_append(packet, (unsigned char *) context->
 301                                 negotiated_alpn, alpn_negotiated_len);
 302         } else {
 303                 tls_packet_uint24(packet, 2);
 304                 tls_packet_uint16(packet, 0);
 305         }
 306         tls_packet_update(packet);
 307         tls_queue_packet(packet);
 308         return;
 309 }
 310
 311 static void tls_send_done(struct TLSContext *context) {
 312         struct TLSPacket *packet =
 313             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 314         tls_packet_uint8(packet, 0x0E);
 315         tls_packet_uint24(packet, 0);
 316         tls_packet_update(packet);
 317         tls_queue_packet(packet);
 318         return;
 319 }
 320
 321 static void tls_send_certificate(struct TLSContext *context) {
 322         int i;
 323         unsigned int all_certificate_size = 0;
 324         int certificates_count;
 325         struct TLSCertificate **certificates;
 326
 327         ENTER;
 328         if (context->is_server) {
 329                 certificates_count = context->certificates_count;
 330                 certificates = context->certificates;
 331         } else {
 332                 certificates_count = context->client_certificates_count;
 333                 certificates = context->client_certificates;
 334         }
 335
 336         int delta = 3;
 337         if (context->tlsver == TLS_VERSION13) {
 338                 delta = 5;
 339         }
 340
 341         int is_ecdsa = tls_is_ecdsa(context);
 342         /* TODO can do one loop and test for ecdsa inside loop */
 343         if (is_ecdsa) {
 344                 for (i = 0; i < certificates_count; i++) {
 345                         struct TLSCertificate *cert = certificates[i];
 346                         if (cert && cert->der_len && cert->ec_algorithm) {
 347                                 all_certificate_size += cert->der_len + delta;
 348                         }
 349                 }
 350         } else {
 351                 for (i = 0; i < certificates_count; i++) {
 352                         struct TLSCertificate *cert = certificates[i];
 353                         if (cert && cert->der_len && !cert->ec_algorithm) {
 354                                 all_certificate_size += cert->der_len + delta;
 355                         }
 356                 }
 357         }
 358
 359         for (i = 0; i < certificates_count; i++) {
 360                 struct TLSCertificate *cert = certificates[i];
 361                 if (cert && cert->der_len) {
 362                         all_certificate_size += cert->der_len + delta;
 363                 }
 364         }
 365
 366         if (!all_certificate_size) {
 367                 DEBUG_PRINT("NO CERTIFICATE SET\n");
 368         }
 369
 370         struct TLSPacket *packet = tls_create_packet(context, TLS_HANDSHAKE,
 371                         context->version, 0);
 372         tls_packet_uint8(packet, 0x0B);
 373
 374         if (all_certificate_size) {
 375                 /* context */
 376                 if (context->tlsver == TLS_VERSION13) {
 377                         tls_packet_uint24(packet, all_certificate_size + 4);
 378                         tls_packet_uint8(packet, 0);
 379                 } else {
 380                         tls_packet_uint24(packet, all_certificate_size + 3);
 381                 }
 382
 383                 tls_packet_uint24(packet, all_certificate_size);
 384
 385                 for (i = 0; i < certificates_count; i++) {
 386                         struct TLSCertificate *cert = certificates[i];
 387                         if (cert && cert->der_len) {
 388                                 /* is RSA certificate ? */
 389                                 if (is_ecdsa && !cert->ec_algorithm) {
 390                                         continue;
 391                                 }
 392                                 /* is ECC certificate ? */
 393                                 if (!is_ecdsa && cert->ec_algorithm) {
 394                                         continue;
 395                                 }
 396                                 /* 2 times -> one certificate */
 397                                 tls_packet_uint24(packet, cert->der_len);
 398                                 tls_packet_append(packet, cert->der_bytes,
 399                                                   cert->der_len);
 400                                 /* extension */
 401                                 if (context->tlsver == TLS_VERSION13) {
 402                                         tls_packet_uint16(packet, 0);
 403                                 }
 404                         }
 405                 }
 406         } else {
 407                 tls_packet_uint24(packet, all_certificate_size);
 408                 if (context->tlsver == TLS_VERSION13) {
 409                         tls_packet_uint8(packet, 0);
 410                 }
 411
 412         }
 413         tls_packet_update(packet);
 414         tls_queue_packet(packet);
 415         LEAVE;
 416         return;
 417 }
 418
 419 int tls_supported_version(uint16_t ver) {
 420         switch (ver) {
 421                 case TLS_V12:
 422                 case TLS_V13:
 423                         break;
 424                 default:
 425                         DEBUG_PRINT("UNSUPPORTED TLS VERSION %x\n", (int)ver);
 426                         return 0;
 427         }
 428         return 1;
 429 }
 430
 431 void tls_set_packet_length(struct TLSPacket *packet, uint32_t length) {
 432         int offset = packet->payload_pos;
 433         packet->buf[offset] = (length >> 16) & 0xff;
 434         packet->buf[offset+1] = (length >> 8) & 0xff;
 435         packet->buf[offset+2] = (length >> 0) & 0xff;
 436 }
 437
 438 static void tls_init() {
 439         static int loaded = 0;
 440         if (loaded) {
 441                 return;
 442         }
 443
 444         DEBUG_PRINT("Initializing dependencies\n");
 445         loaded = 1;
 446 #ifdef LTM_DESC
 447         ltc_mp = ltm_desc;
 448 #else
 449 #ifdef TFM_DESC
 450         ltc_mp = tfm_desc;
 451 #endif
 452 #endif
 453         /* TODO remove these */
 454         register_hash(&md5_desc);
 455         register_hash(&sha1_desc);
 456
 457         register_hash(&sha256_desc);
 458         register_hash(&sha384_desc);
 459         register_hash(&sha512_desc);
 460
 461         register_prng(&sprng_desc);
 462
 463         register_cipher(&aes_desc);
 464
 465         tls_ecc_init_curves();
 466 }
 467
 468 static unsigned char *decrypt_rsa(struct TLSContext *context,
 469                                         const unsigned char *buffer,
 470                                         unsigned int len,
 471                                         unsigned int *size) {
 472         *size = 0;
 473         if (!len || !context || !context->private_key
 474             || !context->private_key->der_bytes
 475             || !context->private_key->der_len) {
 476                 DEBUG_PRINT("No private key set\n");
 477                 return NULL;
 478         }
 479         rsa_key key;
 480         int err;
 481         err = rsa_import(context->private_key->der_bytes,
 482                         context->private_key->der_len, &key);
 483
 484         if (err) {
 485                 DEBUG_PRINT("Error importing RSA key (code: %i)\n", err);
 486                 return NULL;
 487         }
 488
 489         unsigned char *out = malloc(len);
 490         unsigned long out_size = len;
 491         int hash_idx = find_hash("sha256");
 492         int res = 0;
 493         err = rsa_decrypt_key_ex(buffer, len, out, &out_size, (unsigned char *)
 494                         "Concept", 7, hash_idx, LTC_PKCS_1_V1_5, &res, &key);
 495         rsa_free(&key);
 496
 497         if (err || !out_size) {
 498                 DEBUG_PRINT("RSA DECRYPT ERROR\n");
 499                 free(out);
 500                 return NULL;
 501         }
 502         *size = (unsigned int) out_size;
 503         return out;
 504 }
 505
 506 static int verify_rsa(struct TLSContext *context, unsigned int hash_type, const
 507                 unsigned char *buffer, unsigned int len, const unsigned char
 508                 *message, unsigned long message_len) {
 509         rsa_key key;
 510         int err;
 511
 512         if (len == 0) {
 513                 return TLS_GENERIC_ERROR;
 514         }
 515
 516         struct TLSCertificate **cert;
 517         int count;
 518
 519         if (context->is_server) {
 520                 cert = context->client_certificates;
 521                 count = context->client_certificates_count;
 522         } else {
 523                 cert = context->certificates;
 524                 count = context->certificates_count;
 525         }
 526
 527         if (count == 0 || !cert) {
 528                 return TLS_GENERIC_ERROR;
 529         }
 530
 531         err = rsa_import(cert[0]->der_bytes, cert[0]->der_len, &key);
 532
 533         if (err) {
 534                 DEBUG_PRINT("Error importing RSA certificate (code: %i)\n",
 535                             err);
 536                 return TLS_GENERIC_ERROR;
 537         }
 538         int hash_idx = -1;
 539         unsigned char hash[TLS_MAX_HASH_LEN];
 540         unsigned long hash_len;
 541         hash_len = (unsigned long)sizeof hash;
 542
 543         switch (hash_type) {
 544                 case md5:
 545                         hash_idx = find_hash("md5");
 546                         break;
 547                 case sha1:
 548                         hash_idx = find_hash("sha1");
 549                         break;
 550                 case sha256:
 551                         hash_idx = find_hash("sha256");
 552                         break;
 553                 case sha384:
 554                         hash_idx = find_hash("sha384");
 555                         break;
 556                 case sha512:
 557                         hash_idx = find_hash("sha512");
 558                         break;
 559         }
 560         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 561         if (hash_idx < 0 || err) {
 562                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 563                 return TLS_GENERIC_ERROR;
 564         }
 565         int rsa_stat = 0;
 566         if (context->tlsver == TLS_VERSION13) {
 567                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 568                                 LTC_PKCS_1_PSS, hash_idx, 0, &rsa_stat, &key);
 569         } else {
 570                 err = rsa_verify_hash_ex(buffer, len, hash, hash_len,
 571                                 LTC_PKCS_1_V1_5, hash_idx, 0, &rsa_stat, &key);
 572         }
 573         rsa_free(&key);
 574         if (err) {
 575                 return 0;
 576         }
 577         return rsa_stat;
 578 }
 579
 580 static int sign_rsa(struct TLSContext *context, unsigned int hash_type, const
 581                 unsigned char *message, unsigned int message_len, unsigned char
 582                 *out, unsigned long *outlen) {
 583         rsa_key key;
 584         int err;
 585         int hash_index = -1;
 586         unsigned char hash[TLS_MAX_HASH_LEN];
 587         unsigned long hash_len = 0;
 588         //hash_state state;
 589
 590         if (!outlen || !context || !out || !context->private_key
 591             || !context->private_key->der_bytes
 592             || !context->private_key->der_len) {
 593                 DEBUG_PRINT("No private key set\n");
 594                 return TLS_GENERIC_ERROR;
 595         }
 596
 597         err = rsa_import(context->private_key->der_bytes,
 598                         context->private_key->der_len, &key);
 599
 600         if (err) {
 601                 DEBUG_PRINT("Error %d importing RSA certificate", err);
 602                 return TLS_GENERIC_ERROR;
 603         }
 604
 605         switch (hash_type) {
 606                 case sha1:
 607                         hash_index = find_hash("sha1");
 608                         hash_len = 20;
 609                         break;
 610                 case sha256:
 611                         hash_index = find_hash("sha256");
 612                         hash_len = 32;
 613                         break;
 614                 case sha384:
 615                         hash_index = find_hash("sha384");
 616                         hash_len = 48;
 617                         break;
 618                 case sha512:
 619                         hash_index = find_hash("sha512");
 620                         hash_len = 64;
 621                         break;
 622                 case md5:
 623                 case _md5_sha1:
 624                         hash_index = find_hash("md5");
 625                         hash_len = 16;
 626                         break;
 627         }
 628
 629         if (hash_index < 0 || err) {
 630                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 631                 return TLS_GENERIC_ERROR;
 632         }
 633
 634         hash_memory(hash_index, message, message_len, hash, &hash_len);
 635
 636         if (hash_type == _md5_sha1) {
 637                 unsigned long hlen = 20;
 638                 hash_index = find_hash("sha1");
 639                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 640                 hash_len += hlen;
 641         }
 642
 643         //err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
 644
 645         if (context->tlsver == TLS_VERSION13) {
 646                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 647                                 LTC_PKCS_1_PSS, NULL, find_prng("sprng"),
 648                                 hash_index, hash_type == sha256 ? 32 : 48, &key);
 649         } else {
 650                 err = rsa_sign_hash_ex(hash, hash_len, out, outlen,
 651                                 LTC_PKCS_1_V1_5, NULL, find_prng("sprng"),
 652                                 hash_index, 0, &key);
 653         }
 654
 655         rsa_free(&key);
 656         if (err) {
 657                 return 0;
 658         }
 659
 660         return 1;
 661 }
 662
 663 static int tls_is_point(ecc_key * key) {
 664         void *prime, *b, *t1, *t2;
 665         int err;
 666
 667         if ((err = mp_init_multi(&prime, &b, &t1, &t2, NULL)) != CRYPT_OK) {
 668                 return err;
 669         }
 670
 671         /* load prime and b */
 672         if ((err = mp_read_radix(prime, key->dp->prime, 16)) != CRYPT_OK) {
 673                 goto error;
 674         }
 675         if ((err = mp_read_radix(b, key->dp->B, 16)) != CRYPT_OK) {
 676                 goto error;
 677         }
 678
 679         /* compute y^2 */
 680         if ((err = mp_sqr(key->pubkey.y, t1)) != CRYPT_OK) {
 681                 goto error;
 682         }
 683
 684         /* compute x^3 */
 685         if ((err = mp_sqr(key->pubkey.x, t2)) != CRYPT_OK) {
 686                 goto error;
 687         }
 688         if ((err = mp_mod(t2, prime, t2)) != CRYPT_OK) {
 689                 goto error;
 690         }
 691         if ((err = mp_mul(key->pubkey.x, t2, t2)) != CRYPT_OK) {
 692                 goto error;
 693         }
 694
 695         /* compute y^2 - x^3 */
 696         if ((err = mp_sub(t1, t2, t1)) != CRYPT_OK) {
 697                 goto error;
 698         }
 699
 700         /* compute y^2 - x^3 + 3x */
 701         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 702                 goto error;
 703         }
 704         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 705                 goto error;
 706         }
 707         if ((err = mp_add(t1, key->pubkey.x, t1)) != CRYPT_OK) {
 708                 goto error;
 709         }
 710         if ((err = mp_mod(t1, prime, t1)) != CRYPT_OK) {
 711                 goto error;
 712         }
 713         while (mp_cmp_d(t1, 0) == LTC_MP_LT) {
 714                 if ((err = mp_add(t1, prime, t1)) != CRYPT_OK) {
 715                         goto error;
 716                 }
 717         }
 718         while (mp_cmp(t1, prime) != LTC_MP_LT) {
 719                 if ((err = mp_sub(t1, prime, t1)) != CRYPT_OK) {
 720                         goto error;
 721                 }
 722         }
 723
 724         /* compare to b */
 725         if (mp_cmp(t1, b) != LTC_MP_EQ) {
 726                 err = CRYPT_INVALID_PACKET;
 727         } else {
 728                 err = CRYPT_OK;
 729         }
 730
 731       error:
 732         mp_clear_multi(prime, b, t1, t2, NULL);
 733         return err;
 734 }
 735
 736 static int tls_ecc_import_key(const unsigned char *private_key,
 737                                 int private_len,
 738                                 const unsigned char *public_key,
 739                                 int public_len, ecc_key *key,
 740                                 const ltc_ecc_set_type *dp) {
 741         int err;
 742
 743         if (!key || !ltc_mp.name) {
 744                 return CRYPT_MEM;
 745         }
 746
 747         key->type = PK_PRIVATE;
 748
 749         if (mp_init_multi
 750             (&key->pubkey.x, &key->pubkey.y, &key->pubkey.z, &key->k,
 751              NULL) != CRYPT_OK)
 752                 return CRYPT_MEM;
 753
 754         if (public_len && !public_key[0]) {
 755                 public_key++;
 756                 public_len--;
 757         }
 758         if ((err = mp_read_unsigned_bin(key->pubkey.x,
 759                                   (unsigned char *) public_key + 1,
 760                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 761                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 762                                key->k, NULL);
 763                 return err;
 764         }
 765
 766         if ((err = mp_read_unsigned_bin(key->pubkey.y,
 767                                   (unsigned char *) public_key + 1 +
 768                                   ((public_len - 1) >> 1),
 769                                   (public_len - 1) >> 1)) != CRYPT_OK) {
 770                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 771                                key->k, NULL);
 772                 return err;
 773         }
 774
 775         if ((err =
 776              mp_read_unsigned_bin(key->k, (unsigned char *) private_key,
 777                                   private_len)) != CRYPT_OK) {
 778                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 779                                key->k, NULL);
 780                 return err;
 781         }
 782
 783         key->idx = -1;
 784         key->dp = dp;
 785
 786         /* set z */
 787         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
 788                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 789                                key->k, NULL);
 790                 return err;
 791         }
 792
 793         /* is it a point on the curve?  */
 794         if ((err = tls_is_point(key)) != CRYPT_OK) {
 795                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
 796                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
 797                                key->k, NULL);
 798                 return err;
 799         }
 800
 801         /* we're good */
 802         return CRYPT_OK;
 803 }
 804
 805 static int sign_ecdsa(struct TLSContext *context,
 806                             unsigned int hash_type,
 807                             const unsigned char *message,
 808                             unsigned int message_len, unsigned char *out,
 809                             unsigned long *outlen) {
 810         if (!outlen || !context || !out || !outlen
 811             || !context->ec_private_key
 812             || !context->ec_private_key->priv
 813             || !context->ec_private_key->priv_len
 814             || !context->ec_private_key->pk
 815             || !context->ec_private_key->pk_len) {
 816                 DEBUG_PRINT("No private ECDSA key set\n");
 817                 return TLS_GENERIC_ERROR;
 818         }
 819
 820         const struct ECCCurveParameters *curve = NULL;
 821
 822         switch (context->ec_private_key->ec_algorithm) {
 823                 case 19:
 824                         curve = &secp192r1;
 825                         break;
 826                 case 20:
 827                         curve = &secp224k1;
 828                         break;
 829                 case 21:
 830                         curve = &secp224r1;
 831                         break;
 832                 case 22:
 833                         curve = &secp256k1;
 834                         break;
 835                 case 23:
 836                         curve = &secp256r1;
 837                         break;
 838                 case 24:
 839                         curve = &secp384r1;
 840                         break;
 841                 case 25:
 842                         curve = &secp521r1;
 843                         break;
 844                 default:
 845                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
 846         }
 847
 848         if (!curve) {
 849                 return TLS_GENERIC_ERROR;
 850         }
 851
 852         ecc_key key;
 853         int err;
 854
 855         ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&curve->dp;
 856
 857         /* broken ... fix this */
 858         err = tls_ecc_import_key(context->ec_private_key->priv,
 859                         context->ec_private_key->priv_len,
 860                         context->ec_private_key->pk,
 861                         context->ec_private_key->pk_len, &key, dp);
 862
 863         if (err) {
 864                 DEBUG_PRINT("Error importing ECC certificate (code: %i)\n",
 865                             (int) err);
 866                 return TLS_GENERIC_ERROR;
 867         }
 868
 869         unsigned char hash[TLS_MAX_HASH_LEN];
 870         unsigned long hash_len = 0;
 871         int hash_index;
 872
 873         switch (hash_type) {
 874                 case sha1:
 875                         hash_index = find_hash("sha1");
 876                         hash_len = 20;
 877                         break;
 878                 case sha256:
 879                         hash_index = find_hash("sha256");
 880                         hash_len = 32;
 881                         break;
 882                 case sha384:
 883                         hash_index = find_hash("sha384");
 884                         hash_len = 48;
 885                         break;
 886                 case sha512:
 887                         hash_index = find_hash("sha512");
 888                         hash_len = 64;
 889                         break;
 890                 case md5:
 891                 case _md5_sha1:
 892                         hash_index = find_hash("md5");
 893                         hash_len = 16;
 894                         break;
 895         }
 896
 897         hash_memory(hash_index, message, message_len, hash, &hash_len);
 898
 899         if (hash_type == _md5_sha1) {
 900                 unsigned long hlen = 20;
 901                 hash_index = find_hash("sha1");
 902                 hash_memory(hash_index, message, message_len, hash+16, &hlen);
 903                 hash_len += hlen;
 904         }
 905
 906         if (err) {
 907                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
 908                 return TLS_GENERIC_ERROR;
 909         }
 910         /* "Let z be the Ln leftmost bits of e, where Ln is the bit length of
 911          * the group order n." */
 912         if ((int)hash_len > curve->size) {
 913                 hash_len = curve->size;
 914         }
 915         err = ecc_sign_hash(hash, hash_len, out, outlen, NULL,
 916                         find_prng("sprng"), &key);
 917         DEBUG_DUMP_HEX_LABEL("ECC SIGNATURE", out, *outlen);
 918         ecc_free(&key);
 919
 920         return err ? 0 : 1;
 921 }
 922
 923 static void tls_send_certificate_verify(struct TLSContext *context) {
 924         struct TLSPacket *packet =
 925             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
 926         /* certificate verify */
 927         tls_packet_uint8(packet, 0x0F);
 928         tls_packet_uint24(packet, 0);
 929
 930         unsigned char out[TLS_MAX_RSA_KEY];
 931         unsigned long out_len = TLS_MAX_RSA_KEY;
 932
 933         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
 934         int signing_data_len;
 935
 936         /* first 64 bytes to 0x20 (32) */
 937         memset(signing_data, 0x20, 64);
 938         /* context string 33 bytes */
 939         if (context->is_server) {
 940                 memcpy(signing_data + 64, "TLS 1.3, server CertificateVerify",
 941                                 33);
 942         } else {
 943                 memcpy(signing_data + 64, "TLS 1.3, client CertificateVerify",
 944                                 33);
 945         }
 946         /* a single 0 byte separator */
 947         signing_data[97] = 0;
 948         signing_data_len = 98;
 949
 950         signing_data_len += tls_get_hash(context, signing_data + 98);
 951         DEBUG_DUMP_HEX_LABEL("verify data", signing_data, signing_data_len);
 952         int hash_algorithm = sha256;
 953         if (tls_is_ecdsa(context)) {
 954                 switch (context->ec_private_key->ec_algorithm) {
 955                         case 23:
 956                                 /* secp256r1 + sha256 */
 957                                 tls_packet_uint16(packet, 0x0403);
 958                                 break;
 959                         case 24:
 960                                 /* secp384r1 + sha384 */
 961                                 tls_packet_uint16(packet, 0x0503);
 962                                 hash_algorithm = sha384;
 963                                 break;
 964                         case 25:
 965                                 /* secp521r1 + sha512 */
 966                                 tls_packet_uint16(packet, 0x0603);
 967                                 hash_algorithm = sha512;
 968                                 break;
 969                         default:
 970                                 DEBUG_PRINT("UNSUPPORTED CURVE (SIGNING)\n");
 971                                 packet->broken = 1;
 972                                 /* TODO error */
 973                                 return;
 974                 }
 975         } else {
 976                 tls_packet_uint16(packet, 0x0804);
 977         }
 978
 979         int packet_size = 2;
 980
 981         if (tls_is_ecdsa(context)) {
 982                 if (sign_ecdsa(context, hash_algorithm, signing_data,
 983                                         signing_data_len, out, &out_len) == 1)
 984                 {
 985                         DEBUG_PRINT
 986                             ("ECDSA signing OK! (ECDSA, length %lu)\n",
 987                              out_len);
 988                         tls_packet_uint16(packet, out_len);
 989                         tls_packet_append(packet, out, out_len);
 990                         packet_size += out_len + 2;
 991                 }
 992         } else if (sign_rsa(context, hash_algorithm, signing_data,
 993                                 signing_data_len, out, &out_len) == 1) {
 994                 DEBUG_PRINT("RSA signing OK! (length %lu)\n", out_len);
 995                 tls_packet_uint16(packet, out_len);
 996                 tls_packet_append(packet, out, out_len);
 997                 packet_size += out_len + 2;
 998         }
 999
1000         tls_set_packet_length(packet, packet_size);
1001
1002         tls_packet_update(packet);
1003         tls_queue_packet(packet);
1004         return;
1005 }
1006
1007 static int tls_ecc_import_pk(const unsigned char *public_key,
1008                                int public_len, ecc_key * key,
1009                                const ltc_ecc_set_type * dp) {
1010         int err;
1011
1012         if (!key || !ltc_mp.name) {
1013                 return CRYPT_MEM;
1014         }
1015
1016         key->type = PK_PUBLIC;
1017
1018         if (mp_init_multi(&key->pubkey.x, &key->pubkey.y, &key->pubkey.z,
1019                                 &key->k, NULL) != CRYPT_OK) {
1020                 return CRYPT_MEM;
1021         }
1022
1023         if (public_len && !public_key[0]) {
1024                 public_key++;
1025                 public_len--;
1026         }
1027         if ((err = mp_read_unsigned_bin(key->pubkey.x,
1028                                   (unsigned char *) public_key + 1,
1029                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1030                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1031                                key->k, NULL);
1032                 return err;
1033         }
1034
1035         if ((err = mp_read_unsigned_bin(key->pubkey.y,
1036                                   (unsigned char *) public_key + 1 +
1037                                   ((public_len - 1) >> 1),
1038                                   (public_len - 1) >> 1)) != CRYPT_OK) {
1039                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1040                                key->k, NULL);
1041                 return err;
1042         }
1043
1044         key->idx = -1;
1045         key->dp = dp;
1046
1047         /* set z */
1048         if ((err = mp_set(key->pubkey.z, 1)) != CRYPT_OK) {
1049                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1050                                key->k, NULL);
1051                 return err;
1052         }
1053
1054         /* is it a point on the curve?  */
1055         if ((err = tls_is_point(key)) != CRYPT_OK) {
1056                 DEBUG_PRINT("KEY IS NOT ON CURVE\n");
1057                 mp_clear_multi(key->pubkey.x, key->pubkey.y, key->pubkey.z,
1058                                key->k, NULL);
1059                 return err;
1060         }
1061
1062         /* we're good */
1063         return CRYPT_OK;
1064 }
1065
1066 static int tls_verify_ecdsa(struct TLSContext *context,
1067                               unsigned int hash_type,
1068                               const unsigned char *buffer,
1069                               unsigned int len,
1070                               const unsigned char *message,
1071                               unsigned int message_len,
1072                               const struct ECCCurveParameters *curve_hint)
1073 {
1074         ecc_key key;
1075         int err;
1076
1077         if (!curve_hint) {
1078                 curve_hint = context->curve;
1079         }
1080
1081         if (len == 0) {
1082                 return TLS_GENERIC_ERROR;
1083         }
1084
1085         struct TLSCertificate **cert;
1086         int count;
1087
1088         if (context->is_server) {
1089                 cert = context->client_certificates;
1090                 count = context->client_certificates_count;
1091         } else {
1092                 cert = context->certificates;
1093                 count = context->certificates_count;
1094         }
1095
1096         if (count == 0 || !cert || !cert[0] || !cert[0]->pk ||
1097                         !cert[0]->pk_len) {
1098                 return TLS_GENERIC_ERROR;
1099         }
1100
1101         err = tls_ecc_import_pk(cert[0]->pk, cert[0]->pk_len, &key,
1102                         (ltc_ecc_set_type *)&curve_hint->dp);
1103
1104         if (err) {
1105                 DEBUG_PRINT("Error importing ECC certificate (code: %i)", err);
1106                 return TLS_GENERIC_ERROR;
1107         }
1108
1109         int hash_idx = -1;
1110         unsigned char hash[TLS_MAX_HASH_LEN];
1111         unsigned long hash_len = 0;
1112
1113         switch (hash_type) {
1114                 case md5:
1115                         hash_idx = find_hash("md5");
1116                         hash_len = 16;
1117                         break;
1118                 case sha1:
1119                         hash_idx = find_hash("sha1");
1120                         hash_len = 20;
1121                         break;
1122                 case sha256:
1123                         hash_idx = find_hash("sha256");
1124                         hash_len = 32;
1125                         break;
1126                 case sha384:
1127                         hash_idx = find_hash("sha384");
1128                         hash_len = 48;
1129                         break;
1130                 case sha512:
1131                         hash_idx = find_hash("sha512");
1132                         hash_len = 64;
1133                         break;
1134         }
1135
1136         err = hash_memory(hash_idx, message, message_len, hash, &hash_len);
1137
1138         if (hash_idx < 0 || err) {
1139                 DEBUG_PRINT("Unsupported hash type: %i\n", hash_type);
1140                 return TLS_GENERIC_ERROR;
1141         }
1142
1143         int ecc_stat = 0;
1144         err = ecc_verify_hash(buffer, len, hash, hash_len, &ecc_stat, &key);
1145         ecc_free(&key);
1146         if (err) {
1147                 return 0;
1148         }
1149         return ecc_stat;
1150 }
1151
1152 static void prf_helper(int hash_idx, unsigned long dlen,
1153                              unsigned char *output, unsigned int outlen,
1154                              const unsigned char *secret,
1155                              const unsigned int secret_len,
1156                              const unsigned char *label,
1157                              unsigned int label_len, unsigned char *seed,
1158                              unsigned int seed_len, unsigned char *seed_b,
1159                              unsigned int seed_b_len) {
1160         unsigned char digest_out0[TLS_MAX_HASH_LEN];
1161         unsigned char digest_out1[TLS_MAX_HASH_LEN];
1162         unsigned int i;
1163         hmac_state hmac;
1164
1165         hmac_init(&hmac, hash_idx, secret, secret_len);
1166         hmac_process(&hmac, label, label_len);
1167
1168         hmac_process(&hmac, seed, seed_len);
1169         if (seed_b && seed_b_len) {
1170                 hmac_process(&hmac, seed_b, seed_b_len);
1171         }
1172         hmac_done(&hmac, digest_out0, &dlen);
1173         int idx = 0;
1174         while (outlen) {
1175                 hmac_init(&hmac, hash_idx, secret, secret_len);
1176                 hmac_process(&hmac, digest_out0, dlen);
1177                 hmac_process(&hmac, label, label_len);
1178                 hmac_process(&hmac, seed, seed_len);
1179                 if (seed_b && seed_b_len) {
1180                         hmac_process(&hmac, seed_b, seed_b_len);
1181                 }
1182                 hmac_done(&hmac, digest_out1, &dlen);
1183
1184                 unsigned int copylen = outlen;
1185                 if (copylen > dlen) {
1186                         copylen = dlen;
1187                 }
1188
1189                 for (i = 0; i < copylen; i++) {
1190                         output[idx++] ^= digest_out1[i];
1191                         outlen--;
1192                 }
1193
1194                 if (!outlen) {
1195                         break;
1196                 }
1197
1198                 hmac_init(&hmac, hash_idx, secret, secret_len);
1199                 hmac_process(&hmac, digest_out0, dlen);
1200                 hmac_done(&hmac, digest_out0, &dlen);
1201         }
1202 }
1203
1204 static void tls_prf(struct TLSContext *context,
1205                       unsigned char *output, unsigned int outlen,
1206                       const unsigned char *secret,
1207                       const unsigned int secret_len,
1208                       const unsigned char *label, unsigned int label_len,
1209                       unsigned char *seed, unsigned int seed_len,
1210                       unsigned char *seed_b, unsigned int seed_b_len) {
1211         if (!secret || !secret_len) {
1212                 DEBUG_PRINT("NULL SECRET\n");
1213                 return;
1214         }
1215
1216         /* TODO I don't think this is right, wouldn't use md5 for tls v1.3 */
1217         if (context->version != TLS_V12) {
1218                 int md5_hash_idx = find_hash("md5");
1219                 int sha1_hash_idx = find_hash("sha1");
1220                 int half_secret = (secret_len + 1) / 2;
1221
1222                 memset(output, 0, outlen);
1223                 prf_helper(md5_hash_idx, 16, output, outlen, secret,
1224                                 half_secret, label, label_len, seed, seed_len,
1225                                 seed_b, seed_b_len);
1226                 prf_helper(sha1_hash_idx, 20, output, outlen, secret +
1227                                 (secret_len - half_secret), secret_len -
1228                                 half_secret, label, label_len, seed, seed_len,
1229                                 seed_b, seed_b_len);
1230         } else {
1231                 /* sha256_hmac */
1232                 unsigned char digest_out0[TLS_MAX_HASH_LEN];
1233                 unsigned char digest_out1[TLS_MAX_HASH_LEN];
1234                 unsigned long dlen = 32;
1235                 int hash_idx;
1236                 unsigned int mac_length = tls_mac_length(context);
1237
1238                 if (mac_length == TLS_SHA384_MAC_SIZE) {
1239                         hash_idx = find_hash("sha384");
1240                         dlen = mac_length;
1241                 } else {
1242                         hash_idx = find_hash("sha256");
1243                 }
1244
1245                 unsigned int i;
1246
1247                 hmac_state hmac;
1248                 hmac_init(&hmac, hash_idx, secret, secret_len);
1249                 hmac_process(&hmac, label, label_len);
1250                 hmac_process(&hmac, seed, seed_len);
1251                 if (seed_b && seed_b_len) {
1252                         hmac_process(&hmac, seed_b, seed_b_len);
1253                 }
1254                 hmac_done(&hmac, digest_out0, &dlen);
1255
1256                 int idx = 0;
1257                 while (outlen) {
1258                         hmac_init(&hmac, hash_idx, secret, secret_len);
1259                         hmac_process(&hmac, digest_out0, dlen);
1260                         hmac_process(&hmac, label, label_len);
1261                         hmac_process(&hmac, seed, seed_len);
1262                         if (seed_b && seed_b_len) {
1263                                 hmac_process(&hmac, seed_b, seed_b_len);
1264                         }
1265                         hmac_done(&hmac, digest_out1, &dlen);
1266
1267                         unsigned int copylen = outlen;
1268                         if (copylen > dlen) {
1269                                 copylen = (unsigned int) dlen;
1270                         }
1271
1272                         for (i = 0; i < copylen; i++) {
1273                                 output[idx++] = digest_out1[i];
1274                                 outlen--;
1275                         }
1276
1277                         if (!outlen) {
1278                                 break;
1279                         }
1280
1281                         hmac_init(&hmac, hash_idx, secret, secret_len);
1282                         hmac_process(&hmac, digest_out0, dlen);
1283                         hmac_done(&hmac, digest_out0, &dlen);
1284                 }
1285         }
1286 }
1287
1288 static void tls_send_finished(struct TLSContext *context) {
1289         ENTER;
1290         struct TLSPacket *packet =
1291             tls_create_packet(context, TLS_HANDSHAKE, context->version,
1292                               TLS_MIN_FINISHED_OPAQUE_LEN + 64);
1293         tls_packet_uint8(packet, 20);
1294
1295         if (context->tlsver == TLS_VERSION13) {
1296                 tls_packet_uint24(packet, tls_mac_length(context));
1297         } else {
1298                 tls_packet_uint24(packet, TLS_MIN_FINISHED_OPAQUE_LEN);
1299         }
1300
1301         /* verify */
1302         unsigned char hash[TLS_MAX_HASH_SIZE];
1303         unsigned long out_size = TLS_MIN_FINISHED_OPAQUE_LEN;
1304         unsigned char out[TLS_MAX_HASH_SIZE];
1305         unsigned int hash_len;
1306
1307         int context_is_v13 = 0;
1308
1309         if (packet->context->tlsver == TLS_VERSION13) {
1310                 context_is_v13 = 1;
1311         }
1312
1313         /* server verifies client's message */
1314         if (context->is_server) {
1315                 if (context_is_v13) {
1316                         hash_len = tls_get_hash(context, hash);
1317                         if (!context->finished_key || !hash_len) {
1318                                 DEBUG_PRINT
1319                                     ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
1320
1321                                 /* TODO probably need to terminate */
1322                                 tls_destroy_packet(packet);
1323                                 LEAVE;
1324                                 return;
1325                         }
1326
1327                         DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
1328                         DEBUG_DUMP_HEX_LABEL("HS FINISH",
1329                                              context->finished_key,
1330                                              hash_len);
1331
1332                         out_size = hash_len;
1333                         hmac_state hmac;
1334                         hmac_init(&hmac, tls_get_hash_idx(context),
1335                                         context->finished_key, hash_len);
1336                         hmac_process(&hmac, hash, hash_len);
1337                         hmac_done(&hmac, out, &out_size);
1338                 } else {
1339                         hash_len = tls_done_hash(context, hash);
1340                         tls_prf(context, out,
1341                                          TLS_MIN_FINISHED_OPAQUE_LEN,
1342                                          context->master_key,
1343                                          context->master_key_len,
1344                                          (unsigned char *)
1345                                          "server finished", 15, hash,
1346                                          hash_len, NULL, 0);
1347                         tls_destroy_hash(context);
1348                 }
1349         } else {
1350                 /* client */
1351                 hash_len = tls_get_hash(context, hash);
1352                 tls_prf(context, out, TLS_MIN_FINISHED_OPAQUE_LEN,
1353                                  context->master_key,
1354                                  context->master_key_len,
1355                                  (unsigned char *) "client finished", 15,
1356                                  hash, hash_len, NULL, 0);
1357         }
1358
1359         tls_packet_append(packet, out, out_size);
1360         tls_packet_update(packet);
1361         DEBUG_DUMP_HEX_LABEL("VERIFY DATA", out, out_size);
1362         tls_queue_packet(packet);
1363         LEAVE;
1364         return;
1365 }
1366
1367 static int tls_key_length(struct TLSContext *context) {
1368         switch (context->cipher) {
1369                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1370                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1371                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1372                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1373                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1374                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1375                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1376                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1377                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1378                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1379                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1380                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1381                 case TLS_AES_128_GCM_SHA256:
1382                         return 16;
1383                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1384                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1385                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1386                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1387                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1388                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1389                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1390                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1391                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1392                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1393                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1394                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1395                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1396                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1397                 case TLS_AES_256_GCM_SHA384:
1398                 case TLS_CHACHA20_POLY1305_SHA256:
1399                         return 32;
1400         }
1401         return 0;
1402 }
1403
1404 /* 0 is none, 1 is GCM?, 2 is chacha */
1405 int tls_is_aead(struct TLSContext *context) {
1406         switch (context->cipher) {
1407                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1408                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1409                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1410                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1411                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1412                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1413                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1414                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1415                 case TLS_AES_128_GCM_SHA256:
1416                 case TLS_AES_256_GCM_SHA384:
1417                         return 1;
1418                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1419                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1420                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1421                 case TLS_CHACHA20_POLY1305_SHA256:
1422                         return 2;
1423         }
1424         return 0;
1425 }
1426
1427 int tls_mac_length(struct TLSContext *context) {
1428         switch (context->cipher) {
1429                 case TLS_RSA_WITH_AES_128_CBC_SHA:
1430                 case TLS_RSA_WITH_AES_256_CBC_SHA:
1431                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
1432                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
1433                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
1434                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
1435                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
1436                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
1437                         return TLS_SHA1_MAC_SIZE;
1438                 case TLS_RSA_WITH_AES_128_CBC_SHA256:
1439                 case TLS_RSA_WITH_AES_256_CBC_SHA256:
1440                 case TLS_RSA_WITH_AES_128_GCM_SHA256:
1441                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
1442                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
1443                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
1444                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
1445                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
1446                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
1447                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
1448                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1449                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
1450                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
1451                 case TLS_AES_128_GCM_SHA256:
1452                 case TLS_CHACHA20_POLY1305_SHA256:
1453                 case TLS_AES_128_CCM_SHA256:
1454                 case TLS_AES_128_CCM_8_SHA256:
1455                         return TLS_SHA256_MAC_SIZE;
1456                 case TLS_RSA_WITH_AES_256_GCM_SHA384:
1457                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
1458                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
1459                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
1460                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
1461                 case TLS_AES_256_GCM_SHA384:
1462                         return TLS_SHA384_MAC_SIZE;
1463         }
1464         return 0;
1465 }
1466
1467 int _private_tls13_key(struct TLSContext *context, int handshake) {
1468         int key_length = tls_key_length(context);
1469         int mac_length = tls_mac_length(context);
1470
1471         if (!context->premaster_key || !context->premaster_key_len) {
1472                 return 0;
1473         }
1474
1475         if (!key_length || !mac_length) {
1476                 DEBUG_PRINT
1477                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1478                      key_length, mac_length);
1479                 return 0;
1480         }
1481
1482         unsigned char *clientkey = NULL;
1483         unsigned char *serverkey = NULL;
1484         unsigned char *clientiv = NULL;
1485         unsigned char *serveriv = NULL;
1486         int is_aead = tls_is_aead(context);
1487
1488         unsigned char local_keybuffer[TLS_V13_MAX_KEY_SIZE];
1489         unsigned char local_ivbuffer[TLS_V13_MAX_IV_SIZE];
1490         unsigned char remote_keybuffer[TLS_V13_MAX_KEY_SIZE];
1491         unsigned char remote_ivbuffer[TLS_V13_MAX_IV_SIZE];
1492
1493         unsigned char prk[TLS_MAX_HASH_SIZE];
1494         unsigned char hash[TLS_MAX_HASH_SIZE];
1495         static unsigned char earlysecret[TLS_MAX_HASH_SIZE];
1496
1497         const char *server_key = "s ap traffic";
1498         const char *client_key = "c ap traffic";
1499         if (handshake) {
1500                 server_key = "s hs traffic";
1501                 client_key = "c hs traffic";
1502         }
1503
1504         unsigned char salt[TLS_MAX_HASH_SIZE];
1505
1506         hash_state md;
1507         /* TODO what is the point of this ? */
1508         if (mac_length == TLS_SHA384_MAC_SIZE) {
1509                 sha384_init(&md);
1510                 sha384_done(&md, hash);
1511         } else {
1512                 sha256_init(&md);
1513                 sha256_done(&md, hash);
1514         }
1515         /* extract secret "early" */
1516         if (context->master_key && context->master_key_len && !handshake) {
1517                 DEBUG_DUMP_HEX_LABEL("USING PREVIOUS SECRET",
1518                                      context->master_key,
1519                                      context->master_key_len);
1520                 tls_hkdf_expand_label(mac_length, salt, mac_length,
1521                                 context->master_key, context->master_key_len,
1522                                 "derived", 7, hash, mac_length);
1523                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1524                 tls_hkdf_extract(mac_length, prk, mac_length, salt, mac_length,
1525                                 earlysecret, mac_length);
1526         } else {
1527                 tls_hkdf_extract(mac_length, prk, mac_length, NULL, 0,
1528                                 earlysecret, mac_length);
1529                 /* derive secret for handshake "tls13 derived": */
1530                 DEBUG_DUMP_HEX_LABEL("null hash", hash, mac_length);
1531                 tls_hkdf_expand_label(mac_length, salt, mac_length, prk,
1532                                 mac_length, "derived", 7, hash, mac_length);
1533                 /* extract secret "handshake": */
1534                 DEBUG_DUMP_HEX_LABEL("salt", salt, mac_length);
1535                 tls_hkdf_extract(mac_length, prk, mac_length,
1536                                           salt, mac_length,
1537                                           context->premaster_key,
1538                                           context->premaster_key_len);
1539         }
1540
1541         if (!is_aead) {
1542                 DEBUG_PRINT("KEY EXPANSION FAILED, NON AEAD CIPHER\n");
1543                 return 0;
1544         }
1545
1546         unsigned char secret[TLS_MAX_MAC_SIZE];
1547         unsigned char hs_secret[TLS_MAX_HASH_SIZE];
1548
1549         int hash_size;
1550         if (handshake) {
1551                 hash_size = tls_get_hash(context, hash);
1552         } else {
1553                 hash_size = tls_done_hash(context, hash);
1554         }
1555
1556         DEBUG_DUMP_HEX_LABEL("messages hash", hash, hash_size);
1557
1558         if (context->is_server) {
1559                 tls_hkdf_expand_label(mac_length, hs_secret, mac_length, prk,
1560                                 mac_length, server_key, 12, context->
1561                                 server_finished_hash ?  context->
1562                                 server_finished_hash : hash, hash_size);
1563                 DEBUG_DUMP_HEX_LABEL(server_key, hs_secret, mac_length);
1564                 serverkey = local_keybuffer;
1565                 serveriv = local_ivbuffer;
1566                 clientkey = remote_keybuffer;
1567                 clientiv = remote_ivbuffer;
1568         } else {
1569                 tls_hkdf_expand_label(mac_length, hs_secret,
1570                                                mac_length, prk, mac_length,
1571                                                client_key, 12,
1572                                                context->
1573                                                server_finished_hash ?
1574                                                context->
1575                                                server_finished_hash : hash,
1576                                                hash_size);
1577                 serverkey = remote_keybuffer;
1578                 serveriv = remote_ivbuffer;
1579                 clientkey = local_keybuffer;
1580                 clientiv = local_ivbuffer;
1581         }
1582
1583         int iv_length = TLS_13_AES_GCM_IV_LENGTH;
1584         if (is_aead == 2) {
1585                 iv_length = TLS_CHACHA20_IV_LENGTH;
1586         }
1587
1588         tls_hkdf_expand_label(mac_length, local_keybuffer, key_length,
1589                         hs_secret, mac_length, "key", 3, NULL, 0);
1590         tls_hkdf_expand_label(mac_length, local_ivbuffer, iv_length, hs_secret,
1591                         mac_length, "iv", 2, NULL, 0);
1592
1593         tls_hkdf_expand_label(mac_length, secret,
1594                         mac_length, prk, mac_length,
1595                         context->is_server ? client_key : server_key,
1596                         12,
1597                         context->server_finished_hash ?
1598                         context->server_finished_hash :
1599                         hash,
1600                         hash_size);
1601
1602         tls_hkdf_expand_label(mac_length, remote_keybuffer, key_length, secret,
1603                         mac_length, "key", 3, NULL, 0);
1604         tls_hkdf_expand_label(mac_length, remote_ivbuffer, iv_length, secret,
1605                         mac_length, "iv", 2, NULL, 0);
1606
1607         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1608         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1609         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1610         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1611         free(context->finished_key);
1612         free(context->remote_finished_key);
1613
1614         if (handshake) {
1615                 context->finished_key = malloc(mac_length);
1616                 context->remote_finished_key = malloc(mac_length);
1617
1618                 if (context->finished_key) {
1619                         tls_hkdf_expand_label(mac_length,
1620                                         context->finished_key, mac_length,
1621                                         hs_secret, mac_length, "finished", 8,
1622                                         NULL, 0);
1623                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1624                                         mac_length);
1625                 }
1626
1627                 if (context->remote_finished_key) {
1628                         tls_hkdf_expand_label(mac_length,
1629                                         context->remote_finished_key,
1630                                         mac_length, secret, mac_length,
1631                                         "finished", 8, NULL, 0);
1632                         DEBUG_DUMP_HEX_LABEL("FINISHED", context->finished_key,
1633                                         mac_length);
1634                 }
1635         } else {
1636                 context->finished_key = NULL;
1637                 context->remote_finished_key = NULL;
1638                 free(context->server_finished_hash);
1639                 context->server_finished_hash = NULL;
1640         }
1641
1642         if (context->is_server) {
1643                 if (is_aead == 2) {
1644                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1645                                         clientiv, iv_length);
1646                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1647                                         serveriv, iv_length);
1648                 } else if (is_aead) {
1649                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1650                                         clientiv, iv_length);
1651                         memcpy(context->crypto.ctx_local_mac.local_iv,
1652                                         serveriv, iv_length);
1653                 }
1654                 if (tls_crypto_create(context, key_length,
1655                                         serverkey, serveriv, clientkey,
1656                                         clientiv)) {
1657                         return 0;
1658                 }
1659         } else {
1660                 if (is_aead == 2) {
1661                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1662                                clientiv, iv_length);
1663                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1664                                serveriv, iv_length);
1665                 } else if (is_aead) {
1666                         memcpy(context->crypto.ctx_local_mac.local_iv,
1667                                         clientiv, iv_length);
1668                         memcpy(context->crypto.ctx_remote_mac.remote_iv,
1669                                         serveriv, iv_length);
1670                 }
1671
1672                 if (tls_crypto_create(context, key_length,
1673                                         clientkey, clientiv, serverkey,
1674                                         serveriv)) {
1675                         return 0;
1676                 }
1677         }
1678
1679         context->crypto.created = 1 + is_aead;
1680
1681         free(context->master_key);
1682         context->master_key = malloc(mac_length);
1683         if (context->master_key) {
1684                 memcpy(context->master_key, prk, mac_length);
1685                 context->master_key_len = mac_length;
1686         }
1687         context->local_sequence_number = 0;
1688         context->remote_sequence_number = 0;
1689
1690         /*
1691          * extract client_mac_key(mac_key_length)
1692          * extract server_mac_key(mac_key_length)
1693          * extract client_key(enc_key_length)
1694          * extract server_key(enc_key_length)
1695          * extract client_iv(fixed_iv_lengh)
1696          * extract server_iv(fixed_iv_length)
1697          */
1698         return 1;
1699 }
1700
1701 static int tls_expand_key(struct TLSContext *context) {
1702         unsigned char key[TLS_MAX_KEY_EXPANSION_SIZE];
1703         if (context->tlsver == TLS_VERSION13) {
1704                 return 0;
1705         }
1706
1707         if (!context->master_key || !context->master_key_len) {
1708                 return 0;
1709         }
1710
1711         int key_length = tls_key_length(context);
1712         int mac_length = tls_mac_length(context);
1713
1714         if (!key_length || !mac_length) {
1715                 DEBUG_PRINT
1716                     ("KEY EXPANSION FAILED, KEY LENGTH: %i, MAC LENGTH: %i\n",
1717                      key_length, mac_length);
1718                 return 0;
1719         }
1720         unsigned char *clientkey = NULL;
1721         unsigned char *serverkey = NULL;
1722         unsigned char *clientiv = NULL;
1723         unsigned char *serveriv = NULL;
1724         int iv_length = TLS_AES_IV_LENGTH;
1725         int is_aead = tls_is_aead(context);
1726
1727         if (context->is_server) {
1728                 tls_prf(context, key, sizeof(key),
1729                                  context->master_key, context->master_key_len,
1730                                  (unsigned char *) "key expansion", 13,
1731                                  context->local_random, TLS_SERVER_RANDOM_SIZE,
1732                                  context->remote_random,
1733                                  TLS_CLIENT_RANDOM_SIZE);
1734         } else {
1735                 tls_prf(context, key, sizeof(key),
1736                                  context->master_key,
1737                                  context->master_key_len,
1738                                  (unsigned char *) "key expansion", 13,
1739                                  context->remote_random,
1740                                  TLS_SERVER_RANDOM_SIZE,
1741                                  context->local_random,
1742                                  TLS_CLIENT_RANDOM_SIZE);
1743         }
1744
1745         DEBUG_DUMP_HEX_LABEL("LOCAL RANDOM ", context->local_random,
1746                              TLS_SERVER_RANDOM_SIZE);
1747         DEBUG_DUMP_HEX_LABEL("REMOTE RANDOM", context->remote_random,
1748                              TLS_CLIENT_RANDOM_SIZE);
1749         DEBUG_PRINT("\n=========== EXPANSION ===========\n");
1750         DEBUG_DUMP_HEX(key, TLS_MAX_KEY_EXPANSION_SIZE);
1751         DEBUG_PRINT("\n");
1752
1753         int pos = 0;
1754         if (is_aead == 2) {
1755                 iv_length = TLS_CHACHA20_IV_LENGTH;
1756         } else {
1757                 if (is_aead) {
1758                         iv_length = TLS_AES_GCM_IV_LENGTH;
1759                 } else {
1760                         if (context->is_server) {
1761                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1762                                                 &key[pos], mac_length);
1763                                 pos += mac_length;
1764                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1765                                                 &key[pos], mac_length);
1766                                 pos += mac_length;
1767                         } else {
1768                                 memcpy(context->crypto.ctx_local_mac.local_mac,
1769                                                 &key[pos], mac_length);
1770                                 pos += mac_length;
1771                                 memcpy(context->crypto.ctx_remote_mac.remote_mac,
1772                                                 &key[pos], mac_length);
1773                                 pos += mac_length;
1774                         }
1775                 }
1776         }
1777
1778         clientkey = &key[pos];
1779         pos += key_length;
1780         serverkey = &key[pos];
1781         pos += key_length;
1782         clientiv = &key[pos];
1783         pos += iv_length;
1784         serveriv = &key[pos];
1785         pos += iv_length;
1786         DEBUG_PRINT("EXPANSION %i/%i\n", (int) pos,
1787                         (int) TLS_MAX_KEY_EXPANSION_SIZE);
1788         DEBUG_DUMP_HEX_LABEL("CLIENT KEY", clientkey, key_length);
1789         DEBUG_DUMP_HEX_LABEL("CLIENT IV", clientiv, iv_length);
1790 #if 0
1791         DEBUG_DUMP_HEX_LABEL("CLIENT MAC KEY",
1792                         context->is_server ? context->crypto.
1793                         ctx_remote_mac.remote_mac : context->
1794                         crypto.ctx_local_mac.local_mac,
1795                         mac_length);
1796 #endif
1797         DEBUG_DUMP_HEX_LABEL("SERVER KEY", serverkey, key_length);
1798         DEBUG_DUMP_HEX_LABEL("SERVER IV", serveriv, iv_length);
1799 #if 0
1800         DEBUG_DUMP_HEX_LABEL("SERVER MAC KEY",
1801                         context->is_server ? context->crypto.
1802                         ctx_local_mac.local_mac : context->crypto.
1803                         ctx_remote_mac.remote_mac, mac_length);
1804 #endif
1805         if (context->is_server) {
1806                 if (is_aead == 2) {
1807                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1808                                         clientiv, iv_length);
1809                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1810                                         serveriv, iv_length);
1811                 } else {
1812                         if (is_aead) {
1813                                 memcpy(context->crypto.ctx_remote_mac.
1814                                                 remote_aead_iv, clientiv, iv_length);
1815                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1816                                                 serveriv, iv_length);
1817                         }
1818                 }
1819
1820                 if (tls_crypto_create(context, key_length,
1821                                         serverkey, serveriv, clientkey,
1822                                         clientiv)) {
1823                         return 0;
1824                 }
1825         } else {
1826                 if (is_aead == 2) {
1827                         memcpy(context->crypto.ctx_local_mac.local_nonce,
1828                                         clientiv, iv_length);
1829                         memcpy(context->crypto.ctx_remote_mac.remote_nonce,
1830                                         serveriv, iv_length);
1831                 } else {
1832                         if (is_aead) {
1833                                 memcpy(context->crypto.ctx_local_mac.local_aead_iv,
1834                                                 clientiv, iv_length);
1835                                 memcpy(context->crypto.ctx_remote_mac.
1836                                                 remote_aead_iv, serveriv, iv_length);
1837                         }
1838                 }
1839
1840                 if (tls_crypto_create(context, key_length,
1841                                         clientkey, clientiv, serverkey,
1842                                         serveriv)) {
1843                         return 0;
1844                 }
1845         }
1846
1847         /*
1848          * extract client_mac_key(mac_key_length)
1849          * extract server_mac_key(mac_key_length)
1850          * extract client_key(enc_key_length)
1851          * extract server_key(enc_key_length)
1852          * extract client_iv(fixed_iv_lengh)
1853          * extract server_iv(fixed_iv_length)
1854          */
1855         return 1;
1856 }
1857
1858 int tls_compute_key(struct TLSContext *context, unsigned int key_len) {
1859         if (context->tlsver == TLS_VERSION13) {
1860                 return 0;
1861         }
1862
1863         if (!context->premaster_key || !context->premaster_key_len
1864             || key_len < 48) {
1865                 DEBUG_PRINT("CANNOT COMPUTE MASTER SECRET\n");
1866                 return 0;
1867         }
1868
1869         unsigned char master_secret_label[] = "master secret";
1870 #ifdef TLS_CHECK_PREMASTER_KEY
1871         if (!tls_cipher_is_ephemeral(context)) {
1872                 uint16_t version = get16(context->premaster_key);
1873                 /* this check is not true for DHE/ECDHE ciphers */
1874                 if (context->version > version) {
1875                         DEBUG_PRINT("Mismatch protocol version 0x(%x)\n",
1876                                     version);
1877                         return 0;
1878                 }
1879         }
1880 #endif
1881         free(context->master_key);
1882         context->master_key_len = 0;
1883         context->master_key = NULL;
1884
1885         context->master_key = malloc(key_len);
1886         if (!context->master_key) {
1887                 return 0;
1888         }
1889
1890         context->master_key_len = key_len;
1891         if (context->is_server) {
1892                 tls_prf(context,
1893                                 context->master_key,
1894                                 context->master_key_len,
1895                                 context->premaster_key,
1896                                 context->premaster_key_len,
1897                                 master_secret_label, 13,
1898                                 context->remote_random,
1899                                 TLS_CLIENT_RANDOM_SIZE,
1900                                 context->local_random,
1901                                 TLS_SERVER_RANDOM_SIZE);
1902         } else {
1903                 tls_prf(context,
1904                                 context->master_key,
1905                                 context->master_key_len,
1906                                 context->premaster_key,
1907                                 context->premaster_key_len,
1908                                 master_secret_label, 13,
1909                                 context->local_random,
1910                                 TLS_CLIENT_RANDOM_SIZE,
1911                                 context->remote_random,
1912                                 TLS_SERVER_RANDOM_SIZE);
1913         }
1914         free(context->premaster_key);
1915         context->premaster_key = NULL;
1916         context->premaster_key_len = 0;
1917         DEBUG_PRINT("\n=========== Master key ===========\n");
1918         DEBUG_DUMP_HEX(context->master_key,
1919                         context->master_key_len);
1920         DEBUG_PRINT("\n");
1921         tls_expand_key(context);
1922         return 1;
1923 }
1924
1925 int _is_oid(const unsigned char *oid, const unsigned char *compare_to,
1926             int compare_to_len) {
1927         int i = 0;
1928         while ((oid[i]) && (i < compare_to_len)) {
1929                 if (oid[i] != compare_to[i])
1930                         return 0;
1931
1932                 i++;
1933         }
1934         return 1;
1935 }
1936
1937 int _is_oid2(const unsigned char *oid, const unsigned char *compare_to,
1938              int compare_to_len, int oid_len) {
1939         int i = 0;
1940         if (oid_len < compare_to_len) {
1941                 compare_to_len = oid_len;
1942         }
1943
1944         while (i < compare_to_len) {
1945                 if (oid[i] != compare_to[i]) {
1946                         return 0;
1947                 }
1948
1949                 i++;
1950         }
1951         return 1;
1952 }
1953
1954 struct TLSCertificate *tls_create_certificate() {
1955         struct TLSCertificate zero = { 0 };
1956         struct TLSCertificate *cert = malloc(sizeof *cert);
1957         if (cert) {
1958                 *cert = zero;
1959         }
1960         cert->not_before[0] = 0;
1961         cert->not_after[0] = 0;
1962
1963         return cert;
1964 }
1965
1966 int tls_certificate_valid_subject_name(const unsigned char *cert_subject,
1967                                        const char *subject) {
1968         /* no subjects ... */
1969         if ((!cert_subject || !cert_subject[0]) && (!subject || !subject[0])) {
1970                 return 0;
1971         }
1972
1973         if (!subject || !subject[0]) {
1974                 return bad_certificate;
1975         }
1976
1977         if (!cert_subject || !cert_subject[0]) {
1978                 return bad_certificate;
1979         }
1980
1981         /* exact match */
1982         if (!strcmp((const char *) cert_subject, subject)) {
1983                 return 0;
1984         }
1985
1986         const char *wildcard = strchr((const char *) cert_subject, '*');
1987         if (wildcard) {
1988                 /* 6.4.3 (1) The client SHOULD NOT attempt to match a presented
1989                  * identifier in which the wildcard character comprises a label
1990                  * other than the left-most label
1991                  */
1992                 if (!wildcard[1]) {
1993                         /* subject is [*]
1994                          * or
1995                          * subject is [something*] .. invalid
1996                          */
1997                         return bad_certificate;
1998                 }
1999                 wildcard++;
2000                 const char *match = strstr(subject, wildcard);
2001                 if ((!match) && (wildcard[0] == '.')) {
2002                         /* check *.domain.com against domain.com */
2003                         wildcard++;
2004                         if (!strcasecmp(subject, wildcard))
2005                                 return 0;
2006                 }
2007                 if (match) {
2008                         unsigned long offset = (unsigned long) match -
2009                                 (unsigned long) subject;
2010                         if (offset) {
2011                                 /* check for foo.*.domain.com against *.domain.com (invalid) */
2012                                 if (memchr(subject, '.', offset))
2013                                         return bad_certificate;
2014                         }
2015                         /* check if exact match */
2016                         if (!strcasecmp(match, wildcard)) {
2017                                 return 0;
2018                         }
2019                 }
2020         }
2021
2022         return bad_certificate;
2023 }
2024
2025 int tls_certificate_valid_subject(struct TLSCertificate *cert,
2026                                   const char *subject) {
2027         int i;
2028         if (!cert) {
2029                 return certificate_unknown;
2030         }
2031
2032         int err = tls_certificate_valid_subject_name(cert->subject, subject);
2033         if (err && cert->san) {
2034                 for (i = 0; i < cert->san_length; i++) {
2035                         err = tls_certificate_valid_subject_name(cert->san[i],
2036                                         subject);
2037                         if (!err) {
2038                                 return err;
2039                         }
2040                 }
2041         }
2042         return err;
2043 }
2044
2045 int tls_certificate_is_valid(struct TLSCertificate *cert) {
2046         if (!cert) {
2047                 return certificate_unknown;
2048         }
2049
2050         char ts[16]; /* YYYYMMDDHHMMSSZ */
2051         time_t t = time(NULL);
2052         struct tm *utc = gmtime(&t);
2053
2054         if (utc) {
2055                 strftime(ts, sizeof ts, "%Y%m%d%H%M%SZ", utc);
2056
2057                 if (strcmp(cert->not_before, ts) > 0) {
2058                         DEBUG_PRINT
2059                             ("Certificate is not yet valid, now: %s (validity: %s - %s)\n",
2060                              ts, cert->not_before, cert->not_after);
2061                         return certificate_expired;
2062                 }
2063
2064                 if (strcmp(cert->not_after, ts) < 0) {
2065                         DEBUG_PRINT
2066                             ("Expired certificate, now: %s (validity: %s - %s)\n",
2067                              ts, cert->not_before, cert->not_after);
2068                         return certificate_expired;
2069                 }
2070                 DEBUG_PRINT("Valid certificate, now: %s (validity: %s - %s)\n",
2071                                 ts, cert->not_before,
2072                                 cert->not_after);
2073         }
2074         return 0;
2075 }
2076
2077 void tls_certificate_set_copy(unsigned char **member,
2078                               const unsigned char *val, int len) {
2079         if (!member) {
2080                 return;
2081         }
2082
2083         free(*member);
2084
2085         if (len) {
2086                 *member = malloc(len + 1);
2087                 if (*member) {
2088                         memcpy(*member, val, len);
2089                         (*member)[len] = 0;
2090                 }
2091         } else {
2092                 *member = NULL;
2093         }
2094 }
2095
2096 void tls_certificate_set_copy_date(unsigned char *member,
2097                                    const unsigned char *val, int len) {
2098
2099         if (len > 4) {
2100                 if (val[0] >= '5') {
2101                         member[0] = '1';
2102                         member[1] = '9';
2103                 } else {
2104                         member[0] = '2';
2105                         member[1] = '0';
2106                 }
2107                 memcpy(member + 2, val, len);
2108                 member[len] = 0;
2109         } else {
2110                 member[0] = 0;
2111         }
2112 }
2113
2114 void tls_certificate_set_key(struct TLSCertificate *cert,
2115                              const unsigned char *val, int len) {
2116         if (!val[0] && len % 2) {
2117                 val++;
2118                 len--;
2119         }
2120         tls_certificate_set_copy(&cert->pk, val, len);
2121         if (cert->pk) {
2122                 cert->pk_len = len;
2123         }
2124 }
2125
2126 void tls_certificate_set_priv(struct TLSCertificate *cert,
2127                               const unsigned char *val, int len) {
2128         tls_certificate_set_copy(&cert->priv, val, len);
2129         if (cert->priv) {
2130                 cert->priv_len = len;
2131         }
2132 }
2133
2134 void tls_certificate_set_sign_key(struct TLSCertificate *cert,
2135                                   const unsigned char *val, int len) {
2136         if (!val[0] && len % 2) {
2137                 val++;
2138                 len--;
2139         }
2140         tls_certificate_set_copy(&cert->sign_key, val, len);
2141         if (cert->sign_key) {
2142                 cert->sign_len = len;
2143         }
2144 }
2145
2146 void tls_certificate_set_exponent(struct TLSCertificate *cert,
2147                                   const unsigned char *val, int len) {
2148         tls_certificate_set_copy(&cert->exponent, val, len);
2149         if (cert->exponent) {
2150                 cert->exponent_len = len;
2151         }
2152 }
2153
2154 void tls_certificate_set_serial(struct TLSCertificate *cert,
2155                                 const unsigned char *val, int len) {
2156         tls_certificate_set_copy(&cert->serial_number, val, len);
2157         if (cert->serial_number) {
2158                 cert->serial_len = len;
2159         }
2160 }
2161
2162 void tls_certificate_set_algorithm(unsigned int *algorithm,
2163                                    const unsigned char *val, int len) {
2164         if (len == 7 && _is_oid(val, TLS_EC_PUBLIC_KEY_OID, 7)) {
2165                 *algorithm = TLS_EC_PUBLIC_KEY;
2166                 return;
2167         }
2168
2169         if (len == 8) {
2170                 if (_is_oid(val, TLS_EC_prime192v1_OID, len)) {
2171                         *algorithm = TLS_EC_prime192v1;
2172                         return;
2173                 }
2174                 if (_is_oid(val, TLS_EC_prime192v2_OID, len)) {
2175                         *algorithm = TLS_EC_prime192v2;
2176                         return;
2177                 }
2178                 if (_is_oid(val, TLS_EC_prime192v3_OID, len)) {
2179                         *algorithm = TLS_EC_prime192v3;
2180                         return;
2181                 }
2182                 if (_is_oid(val, TLS_EC_prime239v1_OID, len)) {
2183                         *algorithm = TLS_EC_prime239v1;
2184                         return;
2185                 }
2186                 if (_is_oid(val, TLS_EC_prime239v2_OID, len)) {
2187                         *algorithm = TLS_EC_prime239v2;
2188                         return;
2189                 }
2190                 if (_is_oid(val, TLS_EC_prime239v3_OID, len)) {
2191                         *algorithm = TLS_EC_prime239v3;
2192                         return;
2193                 }
2194                 if (_is_oid(val, TLS_EC_prime256v1_OID, len)) {
2195                         *algorithm = TLS_EC_prime256v1;
2196                         return;
2197                 }
2198         }
2199         if (len == 5) {
2200                 if (_is_oid2
2201                     (val, TLS_EC_secp224r1_OID, len,
2202                      sizeof(TLS_EC_secp224r1_OID) - 1)) {
2203                         *algorithm = TLS_EC_secp224r1;
2204                         return;
2205                 }
2206                 if (_is_oid2
2207                     (val, TLS_EC_secp384r1_OID, len,
2208                      sizeof(TLS_EC_secp384r1_OID) - 1)) {
2209                         *algorithm = TLS_EC_secp384r1;
2210                         return;
2211                 }
2212                 if (_is_oid2
2213                     (val, TLS_EC_secp521r1_OID, len,
2214                      sizeof(TLS_EC_secp521r1_OID) - 1)) {
2215                         *algorithm = TLS_EC_secp521r1;
2216                         return;
2217                 }
2218         }
2219         if (len != 9) {
2220                 return;
2221         }
2222
2223         if (_is_oid(val, TLS_RSA_SIGN_SHA256_OID, 9)) {
2224                 *algorithm = TLS_RSA_SIGN_SHA256;
2225                 return;
2226         }
2227
2228         if (_is_oid(val, TLS_RSA_SIGN_RSA_OID, 9)) {
2229                 *algorithm = TLS_RSA_SIGN_RSA;
2230                 return;
2231         }
2232
2233         if (_is_oid(val, TLS_RSA_SIGN_SHA1_OID, 9)) {
2234                 *algorithm = TLS_RSA_SIGN_SHA1;
2235                 return;
2236         }
2237
2238         if (_is_oid(val, TLS_RSA_SIGN_SHA512_OID, 9)) {
2239                 *algorithm = TLS_RSA_SIGN_SHA512;
2240                 return;
2241         }
2242
2243         if (_is_oid(val, TLS_RSA_SIGN_SHA384_OID, 9)) {
2244                 *algorithm = TLS_RSA_SIGN_SHA384;
2245                 return;
2246         }
2247
2248         if (_is_oid(val, TLS_RSA_SIGN_MD5_OID, 9)) {
2249                 *algorithm = TLS_RSA_SIGN_MD5;
2250                 return;
2251         }
2252 }
2253
2254 void tls_destroy_certificate(struct TLSCertificate *cert) {
2255         if (cert) {
2256                 int i;
2257                 free(cert->exponent);
2258                 free(cert->pk);
2259                 free(cert->issuer_country);
2260                 free(cert->issuer_state);
2261                 free(cert->issuer_location);
2262                 free(cert->issuer_entity);
2263                 free(cert->issuer_subject);
2264                 free(cert->country);
2265                 free(cert->state);
2266                 free(cert->location);
2267                 free(cert->subject);
2268                 for (i = 0; i < cert->san_length; i++) {
2269                         free(cert->san[i]);
2270                 }
2271                 free(cert->san);
2272                 free(cert->ocsp);
2273                 free(cert->serial_number);
2274                 free(cert->entity);
2275                 cert->not_before[0] = 0;
2276                 cert->not_after[0] = 0;
2277                 free(cert->sign_key);
2278                 free(cert->priv);
2279                 free(cert->der_bytes);
2280                 free(cert->bytes);
2281                 free(cert->fingerprint);
2282                 free(cert);
2283         }
2284 }
2285
2286 struct TLSPacket *tls_create_packet(struct TLSContext *context,
2287                                     unsigned char type,
2288                                     unsigned short version,
2289                                     int payload_size_hint) {
2290         struct TLSPacket *packet = malloc(sizeof *packet);
2291         if (!packet) {
2292                 return NULL;
2293         }
2294         packet->broken = 0;
2295         if (payload_size_hint > 0) {
2296                 packet->size = payload_size_hint + 10;
2297         } else {
2298                 packet->size = TLS_BLOB_INCREMENT;
2299         }
2300         packet->buf = malloc(packet->size);
2301         memset(packet->buf, 0, packet->size);
2302         packet->context = context;
2303         if (!packet->buf) {
2304                 free(packet);
2305                 return NULL;
2306         }
2307         if (context) {
2308                 packet->payload_pos = 6;
2309                 packet->len = packet->payload_pos - 1;
2310         } else {
2311                 packet->len = 5;
2312         }
2313         packet->buf[0] = type;
2314
2315         /* big endian protocol version */
2316         packet->buf[1] = version >> 8;
2317         packet->buf[2] = version & 0xff;
2318         if (version == TLS_V13) {
2319                 packet->buf[2] = 0x04;
2320         }
2321
2322         return packet;
2323 }
2324
2325 void tls_destroy_packet(struct TLSPacket *packet) {
2326         if (packet) {
2327                 if (packet->buf) {
2328                         free(packet->buf);
2329                 }
2330                 free(packet);
2331         }
2332 }
2333
2334 int tls_crypto_create(struct TLSContext *context, int key_length,
2335                                unsigned char *localkey,
2336                                unsigned char *localiv,
2337                                unsigned char *remotekey,
2338                                unsigned char *remoteiv) {
2339         if (context->crypto.created) {
2340                 if (context->crypto.created == 1) {
2341                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2342                         cbc_done(&context->crypto.ctx_local.aes_local);
2343                 } else {
2344                         if (context->crypto.created == 2) {
2345                                 unsigned char dummy_buffer[32];
2346                                 unsigned long tag_len = 0;
2347                                 gcm_done(&context->crypto.ctx_remote.
2348                                          aes_gcm_remote, dummy_buffer,
2349                                          &tag_len);
2350                                 gcm_done(&context->crypto.ctx_local.
2351                                          aes_gcm_local, dummy_buffer,
2352                                          &tag_len);
2353                         }
2354                 }
2355                 context->crypto.created = 0;
2356         }
2357         int is_aead = tls_is_aead(context);
2358         int cipherID = find_cipher("aes");
2359         DEBUG_PRINT("Using cipher ID: %x\n", (int) context->cipher);
2360         if (is_aead == 2) {
2361                 unsigned int counter = 1;
2362
2363                 chacha_keysetup(&context->crypto.ctx_local.chacha_local,
2364                                 localkey, key_length * 8);
2365                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_local.
2366                                           chacha_local, localiv,
2367                                           (unsigned char *) &counter);
2368
2369                 chacha_keysetup(&context->crypto.ctx_remote.chacha_remote,
2370                                 remotekey, key_length * 8);
2371                 chacha_ivsetup_96bitnonce(&context->crypto.ctx_remote.
2372                                           chacha_remote, remoteiv,
2373                                           (unsigned char *) &counter);
2374
2375                 context->crypto.created = 3;
2376         } else {
2377                 if (is_aead) {
2378                         int res1 =
2379                                 gcm_init(&context->crypto.ctx_local.aes_gcm_local,
2380                                                 cipherID, localkey, key_length);
2381                         int res2 =
2382                                 gcm_init(&context->crypto.ctx_remote.aes_gcm_remote,
2383                                                 cipherID, remotekey, key_length);
2384
2385                         if (res1 || res2) {
2386                                 return TLS_GENERIC_ERROR;
2387                         }
2388                         context->crypto.created = 2;
2389                 } else {
2390                         int res1 =
2391                                 cbc_start(cipherID, localiv, localkey, key_length, 0,
2392                                                 &context->crypto.ctx_local.aes_local);
2393                         int res2 =
2394                                 cbc_start(cipherID, remoteiv, remotekey, key_length, 0,
2395                                                 &context->crypto.ctx_remote.aes_remote);
2396
2397                         if (res1 || res2) {
2398                                 return TLS_GENERIC_ERROR;
2399                         }
2400                         context->crypto.created = 1;
2401                 }
2402         }
2403         return 0;
2404 }
2405
2406 static void tls_crypto_done(struct TLSContext *context) {
2407         unsigned char dummy_buffer[32];
2408         unsigned long tag_len = 0;
2409
2410         switch (context->crypto.created) {
2411                 case 1:
2412                         cbc_done(&context->crypto.ctx_remote.aes_remote);
2413                         cbc_done(&context->crypto.ctx_local.aes_local);
2414                         break;
2415                 case 2:
2416                         gcm_done(&context->crypto.ctx_remote.aes_gcm_remote,
2417                                         dummy_buffer, &tag_len);
2418                         gcm_done(&context->crypto.ctx_local.aes_gcm_local,
2419                                         dummy_buffer, &tag_len);
2420                         break;
2421         }
2422         context->crypto.created = 0;
2423 }
2424
2425 int tls_packet_append(struct TLSPacket *packet, const unsigned char *buf,
2426                       unsigned int len) {
2427         void *new;
2428
2429         if (!packet || packet->broken) {
2430                 return -1;
2431         }
2432
2433         if (!len) {
2434                 return 0;
2435         }
2436
2437         unsigned int new_len = packet->len + len;
2438
2439         if (new_len > packet->size) {
2440                 packet->size = (new_len / TLS_BLOB_INCREMENT + 1) *
2441                         TLS_BLOB_INCREMENT;
2442                 new = TLS_REALLOC(packet->buf, packet->size);
2443                 if (new) {
2444                         packet->buf = new;
2445                 } else {
2446                         free(packet->buf);
2447                         packet->size = 0;
2448                         packet->len = 0;
2449                         packet->broken = 1;
2450                         return -1;
2451                 }
2452         }
2453         memcpy(packet->buf + packet->len, buf, len);
2454         packet->len = new_len;
2455         return new_len;
2456 }
2457
2458 int tls_packet_uint8(struct TLSPacket *packet, unsigned char i) {
2459         return tls_packet_append(packet, &i, 1);
2460 }
2461
2462 int tls_packet_uint16(struct TLSPacket *packet, unsigned short i) {
2463         unsigned short ni = htons(i);
2464         return tls_packet_append(packet, (unsigned char *) &ni, 2);
2465 }
2466
2467 int tls_packet_uint32(struct TLSPacket *packet, unsigned int i) {
2468         unsigned int ni = htonl(i);
2469         return tls_packet_append(packet, (unsigned char *) &ni, 4);
2470 }
2471
2472 int tls_packet_uint24(struct TLSPacket *packet, unsigned int i) {
2473         unsigned char buf[3];
2474         buf[0] = (i >> 16) & 0xff;
2475         buf[1] = (i >> 8) & 0xff;
2476         buf[2] = (i >> 0) & 0xff;
2477
2478         return tls_packet_append(packet, buf, 3);
2479 }
2480
2481 int tls_random(unsigned char *key, int len) {
2482 #ifdef __APPLE__
2483         for (int i = 0; i < len; i++) {
2484                 unsigned int v = arc4random() % 0x100;
2485                 key[i] = (char) v;
2486         }
2487         return 1;
2488 #else
2489         /* TODO use open and read */
2490         FILE *fp = fopen("/dev/urandom", "r");
2491         if (fp) {
2492                 int key_len = fread(key, 1, len, fp);
2493                 fclose(fp);
2494                 if (key_len == len)
2495                         return 1;
2496         }
2497 #endif
2498         return 0;
2499 }
2500
2501 int tls_established(struct TLSContext *context) {
2502         return context && context->connection_status == TLS_CONNECTED;
2503 }
2504
2505 void tls_read_clear(struct TLSContext *context) {
2506         if (context) {
2507                tls_buffer_free(&context->application_buffer);
2508         }
2509 }
2510
2511 struct TLSContext *tls_create_context(int is_server, unsigned short version) {
2512         struct TLSContext zero = {0};
2513         uint16_t ver = 0;
2514         struct TLSContext *context = 0;
2515
2516         if (version == TLS_V13 && !is_server) {
2517                 /* TLS 1.3 clients not supported */
2518                 return NULL;
2519         }
2520
2521         tls_init();
2522         switch (version) {
2523                 case TLS_V13:
2524                 case TLS_V12:
2525                         context = malloc(sizeof *context);
2526                         break;
2527                 default:
2528                         return NULL;
2529         }
2530
2531         ver = version - 0x0201;
2532
2533         if (context) {
2534                 *context = zero;
2535                 context->is_server = is_server;
2536                 context->version = version;
2537                 context->tlsver = ver;
2538                 context->hs_index = -1;
2539                 /* set up output buffer */
2540                 tls_buffer_init(&context->output_buffer, 0);
2541                 tls_buffer_init(&context->input_buffer, 0);
2542                 tls_buffer_init(&context->cached_handshake, 0);
2543                 tls_buffer_init(&context->application_buffer, 0);
2544         }
2545         return context;
2546 }
2547
2548 struct TLSContext *tls_accept(struct TLSContext *context) {
2549         if (!context || !context->is_server) {
2550                 return NULL;
2551         }
2552
2553         struct TLSContext *child = malloc(sizeof *child);
2554         if (child) {
2555                 memset(child, 0, sizeof(struct TLSContext));
2556                 child->is_server = 1;
2557                 child->is_child = 1;
2558                 child->version = context->version;
2559                 child->certificates = context->certificates;
2560                 child->certificates_count = context->certificates_count;
2561                 child->private_key = context->private_key;
2562                 child->ec_private_key = context->ec_private_key;
2563                 child->root_certificates = context->root_certificates;
2564                 child->root_count = context->root_count;
2565                 child->default_dhe_p = context->default_dhe_p;
2566                 child->default_dhe_g = context->default_dhe_g;
2567                 child->curve = context->curve;
2568                 child->alpn = context->alpn;
2569                 child->alpn_count = context->alpn_count;
2570         }
2571         return child;
2572 }
2573
2574 int tls_add_alpn(struct TLSContext *context, const char *alpn) {
2575         void *new;
2576
2577         if (!context || !alpn || !alpn[0]
2578             || (context->is_server && context->is_child)) {
2579                 return TLS_GENERIC_ERROR;
2580         }
2581
2582         int len = strlen(alpn);
2583         if (tls_alpn_contains(context, alpn, len)) {
2584                 return 0;
2585         }
2586
2587         new = TLS_REALLOC(context->alpn, (context->alpn_count + 1) *
2588                         sizeof(char *));
2589         if (new) {
2590                 context->alpn = new;
2591         } else {
2592                 free(context->alpn);
2593                 context->alpn = 0;
2594                 context->alpn_count = 0;
2595                 return TLS_NO_MEMORY;
2596         }
2597         char *alpn_ref = malloc(len + 1);
2598         context->alpn[context->alpn_count] = alpn_ref;
2599         if (alpn_ref) {
2600                 memcpy(alpn_ref, alpn, len);
2601                 alpn_ref[len] = 0;
2602                 context->alpn_count++;
2603         } else {
2604                 return TLS_NO_MEMORY;
2605         }
2606         return 0;
2607 }
2608
2609 int tls_alpn_contains(struct TLSContext *context, const char *alpn,
2610                       unsigned char alpn_size) {
2611         int i;
2612
2613         if (!context || !alpn || !alpn_size || !context->alpn) {
2614                 return 0;
2615         }
2616
2617         for (i = 0; i < context->alpn_count; i++) {
2618                 const char *alpn_local = context->alpn[i];
2619                 if (alpn_local) {
2620                         int len = strlen(alpn_local);
2621                         if (alpn_size == len) {
2622                                 if (!memcmp(alpn_local, alpn, alpn_size)) {
2623                                         return 1;
2624                                 }
2625                         }
2626                 }
2627         }
2628
2629         return 0;
2630 }
2631
2632 void tls_destroy_context(struct TLSContext *context) {
2633         int i;
2634
2635         if (!context) {
2636                 return;
2637         }
2638
2639         if (!context->is_child) {
2640                 if (context->certificates) {
2641                         for (i = 0; i < context->certificates_count; i++) {
2642                                 tls_destroy_certificate(context->
2643                                                         certificates[i]);
2644                         }
2645                 }
2646                 if (context->root_certificates) {
2647                         for (i = 0; i < context->root_count; i++) {
2648                                 tls_destroy_certificate(context->
2649                                                         root_certificates[i]);
2650                         }
2651                         free(context->root_certificates);
2652                         context->root_certificates = NULL;
2653                 }
2654                 if (context->private_key) {
2655                         tls_destroy_certificate(context->private_key);
2656                 }
2657                 if (context->ec_private_key) {
2658                         tls_destroy_certificate(context->ec_private_key);
2659                 }
2660                 free(context->certificates);
2661                 free(context->default_dhe_p);
2662                 free(context->default_dhe_g);
2663                 if (context->alpn) {
2664                         for (i = 0; i < context->alpn_count; i++) {
2665                                 free(context->alpn[i]);
2666                         }
2667                         free(context->alpn);
2668                 }
2669         }
2670
2671         if (context->client_certificates) {
2672                 for (i = 0; i < context->client_certificates_count; i++) {
2673                         tls_destroy_certificate(context->
2674                                                 client_certificates[i]);
2675                 }
2676                 free(context->client_certificates);
2677         }
2678
2679         context->client_certificates = NULL;
2680         free(context->master_key);
2681         free(context->premaster_key);
2682
2683         if (context->crypto.created) {
2684                 tls_crypto_done(context);
2685         }
2686
2687         tls_done_hash(context, NULL);
2688         tls_destroy_hash(context);
2689
2690         tls_buffer_free(&context->output_buffer);
2691         tls_buffer_free(&context->input_buffer);
2692         tls_buffer_free(&context->application_buffer);
2693         tls_buffer_free(&context->cached_handshake);
2694         //free(context->cached_handshake);
2695
2696         free(context->sni);
2697         tls_dhe_free(context);
2698         tls_ecc_dhe_free(context);
2699         free(context->negotiated_alpn);
2700         free(context->finished_key);
2701         free(context->remote_finished_key);
2702         free(context->server_finished_hash);
2703         free(context);
2704 }
2705
2706 int tls_cipher_is_ephemeral(struct TLSContext *context) {
2707         if (!context) {
2708                 return 0;
2709         }
2710
2711         switch (context->cipher) {
2712                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2713                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2714                 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2715                 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
2716                 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2717                 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384:
2718                 case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2719                         return 1;
2720                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2721                 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2722                 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2723                 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2724                 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:
2725                 case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:
2726                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2727                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2728                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2729                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2730                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2731                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2732                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2733                         return 2;
2734                 case TLS_AES_128_GCM_SHA256:
2735                 case TLS_CHACHA20_POLY1305_SHA256:
2736                 case TLS_AES_128_CCM_SHA256:
2737                 case TLS_AES_128_CCM_8_SHA256:
2738                 case TLS_AES_256_GCM_SHA384:
2739                         if (context->dhe) {
2740                                 return 1;
2741                         }
2742                         return 2;
2743         }
2744         return 0;
2745 }
2746
2747 int tls_is_ecdsa(struct TLSContext *context) {
2748         if (!context) {
2749                 return 0;
2750         }
2751
2752         switch (context->cipher) {
2753                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
2754                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
2755                 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2756                 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:
2757                 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2758                 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:
2759                 case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:
2760                         return 1;
2761         }
2762
2763         if (context->ec_private_key) {
2764                 return 1;
2765         }
2766
2767         return 0;
2768 }
2769
2770 static void tls_send_server_key_exchange(struct TLSContext *context,
2771                                                 int method) {
2772         if (!context->is_server) {
2773                 DEBUG_PRINT
2774                     ("CANNOT BUILD SERVER KEY EXCHANGE MESSAGE FOR CLIENTS\n");
2775                 return;
2776         }
2777
2778         struct TLSPacket *packet =
2779             tls_create_packet(context, TLS_HANDSHAKE, context->version, 0);
2780         tls_packet_uint8(packet, 0x0C);
2781         unsigned char dummy[3];
2782         tls_packet_append(packet, dummy, 3);
2783         int start_len = packet->len;
2784
2785         if (method == KEA_dhe_rsa) {
2786                 tls_dhe_create(context);
2787
2788                 const char *default_dhe_p = context->default_dhe_p;
2789                 const char *default_dhe_g = context->default_dhe_g;
2790                 int key_size;
2791                 if (!default_dhe_p || !default_dhe_g) {
2792                         default_dhe_p = TLS_DH_DEFAULT_P;
2793                         default_dhe_g = TLS_DH_DEFAULT_G;
2794                         key_size = TLS_DHE_KEY_SIZE / 8;
2795                 } else {
2796                         key_size = strlen(default_dhe_p);
2797                 }
2798                 if (tls_dh_make_key(key_size, context->dhe, default_dhe_p,
2799                                         default_dhe_g, 0, 0)) {
2800                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
2801                         free(packet);
2802                         free(context->dhe);
2803                         context->dhe = NULL;
2804                         /* TODO set error */
2805                         return;
2806                 }
2807
2808                 unsigned char dh_Ys[0xFFF];
2809                 unsigned char dh_p[0xFFF];
2810                 unsigned char dh_g[0xFFF];
2811                 unsigned long dh_p_len = sizeof(dh_p);
2812                 unsigned long dh_g_len = sizeof(dh_g);
2813                 unsigned long dh_Ys_len = sizeof(dh_Ys);
2814
2815                 if (tls_dh_export_pqY
2816                     (dh_p, &dh_p_len, dh_g, &dh_g_len, dh_Ys, &dh_Ys_len,
2817                      context->dhe)) {
2818                         DEBUG_PRINT("ERROR EXPORTING DHE KEY\n");
2819                         free(packet);
2820                         /* TODO set error */
2821                         return;
2822                 }
2823
2824                 DEBUG_PRINT("LEN: %lu (%lu, %lu)\n", dh_Ys_len, dh_p_len,
2825                             dh_g_len);
2826                 DEBUG_DUMP_HEX_LABEL("DHE PK", dh_Ys, dh_Ys_len);
2827                 DEBUG_DUMP_HEX_LABEL("DHE P", dh_p, dh_p_len);
2828                 DEBUG_DUMP_HEX_LABEL("DHE G", dh_g, dh_g_len);
2829
2830                 tls_packet_uint16(packet, dh_p_len);
2831                 tls_packet_append(packet, dh_p, dh_p_len);
2832
2833                 tls_packet_uint16(packet, dh_g_len);
2834                 tls_packet_append(packet, dh_g, dh_g_len);
2835
2836                 tls_packet_uint16(packet, dh_Ys_len);
2837                 tls_packet_append(packet, dh_Ys, dh_Ys_len);
2838                 /* dh_p */
2839                 /* dh_g */
2840                 /* dh_Ys */
2841         } else if (method == KEA_ec_diffie_hellman) {
2842                 /* 3 = named curve */
2843                 if (!context->curve) {
2844                         context->curve = tls_ecc_default_curve;
2845                 }
2846                 tls_packet_uint8(packet, 3);
2847                 tls_packet_uint16(packet, context->curve->iana);
2848                 tls_ecc_dhe_create(context);
2849
2850                 ltc_ecc_set_type *dp =
2851                     (ltc_ecc_set_type *) & context->curve->dp;
2852
2853                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
2854                                         dp)) {
2855                         free(context->ecc_dhe);
2856                         context->ecc_dhe = NULL;
2857                         DEBUG_PRINT("Error generating ECC key\n");
2858                         free(packet);
2859                         /* TODO set error */
2860                         return;
2861                 }
2862                 unsigned char out[TLS_MAX_RSA_KEY];
2863                 unsigned long out_len = TLS_MAX_RSA_KEY;
2864                 if (ecc_ansi_x963_export(context->ecc_dhe, out, &out_len)) {
2865                         DEBUG_PRINT("Error exporting ECC key\n");
2866                         free(packet);
2867                         /* TODO abort */
2868                         return;
2869                 }
2870                 tls_packet_uint8(packet, out_len);
2871                 tls_packet_append(packet, out, out_len);
2872         } else {
2873                 /* TODO abort */
2874                 free(packet);
2875                 DEBUG_PRINT("Unsupported ephemeral method: %i\n", method);
2876                 return;
2877         }
2878
2879         /* signature */
2880         unsigned int params_len = packet->len - start_len;
2881         unsigned int message_len =
2882             params_len + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
2883         unsigned char *message = malloc(message_len);
2884         if (message) {
2885                 unsigned char out[TLS_MAX_RSA_KEY];
2886                 unsigned long out_len = TLS_MAX_RSA_KEY;
2887
2888                 int hash_algorithm;
2889
2890                 hash_algorithm = sha256;
2891
2892                 if (tls_is_ecdsa(context)) {
2893                         hash_algorithm = sha512;
2894                         tls_packet_uint8(packet, hash_algorithm);
2895                         tls_packet_uint8(packet, ecdsa);
2896                 } else {
2897                         tls_packet_uint8(packet, hash_algorithm);
2898                         tls_packet_uint8(packet, rsa_sign);
2899                 }
2900
2901                 memcpy(message, context->remote_random,
2902                                 TLS_CLIENT_RANDOM_SIZE);
2903                 memcpy(message + TLS_CLIENT_RANDOM_SIZE, context->local_random,
2904                                 TLS_SERVER_RANDOM_SIZE);
2905                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
2906                                 TLS_SERVER_RANDOM_SIZE, packet->buf +
2907                                 start_len, params_len);
2908                 if (tls_is_ecdsa(context)) {
2909                         if (sign_ecdsa(context, hash_algorithm, message,
2910                                                 message_len, out, &out_len) ==
2911                                         1) {
2912                                 DEBUG_PRINT
2913                                     ("Signing OK! (ECDSA, length %lu)\n",
2914                                      out_len);
2915                                 tls_packet_uint16(packet, out_len);
2916                                 tls_packet_append(packet, out, out_len);
2917                         }
2918                 } else
2919                 if (sign_rsa(context, hash_algorithm, message, message_len,
2920                                         out, &out_len) == 1) {
2921                         DEBUG_PRINT("Signing OK! (length %lu)\n", out_len);
2922                         tls_packet_uint16(packet, out_len);
2923                         tls_packet_append(packet, out, out_len);
2924                 }
2925                 free(message);
2926         }
2927         if (!packet->broken && packet->buf) {
2928                 tls_set_packet_length(packet, packet->len - start_len);
2929         }
2930         tls_packet_update(packet);
2931         tls_queue_packet(packet);
2932         return;
2933 }
2934
2935 #if 0
2936 void _private_tls_set_session_id(struct TLSContext *context) {
2937         if (context->tlsver == TLS_VERSION13
2938                         && context->session_size == TLS_MAX_SESSION_ID) {
2939                 return;
2940         }
2941
2942         if (tls_random(context->session, TLS_MAX_SESSION_ID)) {
2943                 context->session_size = TLS_MAX_SESSION_ID;
2944         } else {
2945                 context->session_size = 0;
2946         }
2947 }
2948 #endif
2949
2950 struct TLSPacket *tls_certificate_request(struct TLSContext *context) {
2951         if (!context || !context->is_server) {
2952                 return NULL;
2953         }
2954
2955         unsigned short packet_version = context->version;
2956         struct TLSPacket *packet =
2957             tls_create_packet(context, TLS_HANDSHAKE, packet_version, 0);
2958
2959         if (!packet) {
2960                 return NULL;
2961         }
2962
2963         /* cert request and size placeholder */
2964         unsigned char dummy[] = { 0x0d, 0, 0, 0 };
2965         tls_packet_append(packet, dummy, sizeof dummy);
2966
2967         int start_len = packet->len;
2968
2969         if (context->tlsver == TLS_VERSION13) {
2970                 /* certificate request context */
2971                 tls_packet_uint8(packet, 0);
2972                 /* extensions */
2973                 tls_packet_uint16(packet, 18);
2974                 /* signature algorithms */
2975                 tls_packet_uint16(packet, 0x0D);
2976                 tls_packet_uint16(packet, 14);
2977                 tls_packet_uint16(packet, 12);
2978 #if 0
2979                 rsa_pkcs1_sha256
2980                         tls_packet_uint16(packet, 0x0401);
2981                 rsa_pkcs1_sha384
2982                         tls_packet_uint16(packet, 0x0501);
2983                 rsa_pkcs1_sha512
2984                         tls_packet_uint16(packet, 0x0601);
2985 #endif
2986
2987                 /* ecdsa_secp256r1_sha256 */
2988                 tls_packet_uint16(packet, 0x0403);
2989                 /* ecdsa_secp384r1_sha384 */
2990                 tls_packet_uint16(packet, 0x0503);
2991                 /* ecdsa_secp521r1_sha512 */
2992                 tls_packet_uint16(packet, 0x0604);
2993                 /* rsa_pss_rsae_sha256 */
2994                 tls_packet_uint16(packet, 0x0804);
2995                 /* rsa_pss_rsae_sha384 */
2996                 tls_packet_uint16(packet, 0x0805);
2997                 /* rsa_pss_rsae_sha512 */
2998                 tls_packet_uint16(packet, 0x0806);
2999         } else {
3000                 tls_packet_uint8(packet, 1);
3001                 tls_packet_uint8(packet, rsa_sign);
3002                 if (context->version == TLS_V12) {
3003                         /* 10 pairs or 2 bytes */
3004                         tls_packet_uint16(packet, 10);
3005                         tls_packet_uint8(packet, sha256);
3006                         tls_packet_uint8(packet, rsa);
3007                         tls_packet_uint8(packet, sha1);
3008                         tls_packet_uint8(packet, rsa);
3009                         tls_packet_uint8(packet, sha384);
3010                         tls_packet_uint8(packet, rsa);
3011                         tls_packet_uint8(packet, sha512);
3012                         tls_packet_uint8(packet, rsa);
3013                         tls_packet_uint8(packet, md5);
3014                         tls_packet_uint8(packet, rsa);
3015                 }
3016                 /* no DistinguishedName yet */
3017                 tls_packet_uint16(packet, 0);
3018         }
3019         if (!packet->broken) {
3020                 tls_set_packet_length(packet, packet->len - start_len);
3021         }
3022         tls_packet_update(packet);
3023         return packet;
3024 }
3025
3026 int tls_parse_key_share(struct TLSContext *context, const unsigned char *buf,
3027                 int buf_len) {
3028         int i = 0;
3029         struct ECCCurveParameters *curve = 0;
3030         struct DHKey *dhkey = 0;
3031         int dhe_key_size = 0;
3032         const unsigned char *buffer = NULL;
3033         unsigned char *out2;
3034         unsigned long out_size;
3035         uint16_t key_size;
3036
3037         while (buf_len >= 4) {
3038                 uint16_t named_group = get16(&buf[i]);
3039                 i += 2;
3040                 buf_len -= 2;
3041
3042                 key_size = get16(&buf[i]);
3043                 i += 2;
3044                 buf_len -= 2;
3045
3046                 if (key_size > buf_len) {
3047                         return TLS_BROKEN_PACKET;
3048                 }
3049
3050                 switch (named_group) {
3051                         case 0x0017:
3052                                 curve = &secp256r1;
3053                                 buffer = &buf[i];
3054                                 DEBUG_PRINT("KEY SHARE => secp256r1\n");
3055                                 buf_len = 0;
3056                                 continue;
3057                         case 0x0018:
3058                                 /* secp384r1 */
3059                                 curve = &secp384r1;
3060                                 buffer = &buf[i];
3061                                 DEBUG_PRINT("KEY SHARE => secp384r1\n");
3062                                 buf_len = 0;
3063                                 continue;
3064                         case 0x0019:
3065                                 /* secp521r1 */
3066                                 break;
3067                         case 0x001D:
3068                                 /* x25519 */
3069                                 if (key_size != 32) {
3070                                         DEBUG_PRINT
3071                                                 ("INVALID x25519 KEY SIZE (%i)\n",
3072                                                  key_size);
3073                                         continue;
3074                                 }
3075                                 curve = &curve25519;
3076                                 buffer = &buf[i];
3077                                 DEBUG_PRINT("KEY SHARE => x25519\n");
3078                                 buf_len = 0;
3079                                 continue;
3080                                 break;
3081
3082                         case 0x001E:
3083                                 /* x448 */
3084                                 break;
3085                         case 0x0100:
3086                                 dhkey = &ffdhe2048;
3087                                 dhe_key_size = 2048;
3088                                 break;
3089                         case 0x0101:
3090                                 dhkey = &ffdhe3072;
3091                                 dhe_key_size = 3072;
3092                                 break;
3093                         case 0x0102:
3094                                 dhkey = &ffdhe4096;
3095                                 dhe_key_size = 4096;
3096                                 break;
3097                         case 0x0103:
3098                                 dhkey = &ffdhe6144;
3099                                 dhe_key_size = 6144;
3100                                 break;
3101                         case 0x0104:
3102                                 dhkey = &ffdhe8192;
3103                                 dhe_key_size = 8192;
3104                                 break;
3105                 }
3106                 i += key_size;
3107                 buf_len -= key_size;
3108         }
3109
3110         if (curve) {
3111                 context->curve = curve;
3112
3113                 if (curve == &curve25519) {
3114                         if (!tls_random(context->local_random,
3115                              TLS_SERVER_RANDOM_SIZE)) {
3116                                 return TLS_GENERIC_ERROR;
3117                         }
3118
3119                         unsigned char secret[32];
3120                         static const unsigned char basepoint[32] = { 9 };
3121
3122                         tls_random(secret, 32);
3123
3124                         secret[0] &= 248;
3125                         secret[31] &= 127;
3126                         secret[31] |= 64;
3127
3128                         /* use finished key to store public key */
3129                         free(context->finished_key);
3130                         context->finished_key = malloc(32);
3131                         if (!context->finished_key) {
3132                                 return TLS_GENERIC_ERROR;
3133                         }
3134
3135                         x25519(context->finished_key, secret, basepoint);
3136
3137                         free(context->premaster_key);
3138                         context->premaster_key = malloc(32);
3139
3140                         if (!context->premaster_key) {
3141                                 return TLS_GENERIC_ERROR;
3142                         }
3143
3144                         x25519(context->premaster_key, secret, buffer);
3145                         context->premaster_key_len = 32;
3146
3147                         return 0;
3148                 }
3149
3150                 tls_ecc_dhe_create(context);
3151                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *)&context->curve->dp;
3152
3153                 if (ecc_make_key_ex(NULL, find_prng("sprng"), context->ecc_dhe,
3154                                         dp)) {
3155                         free(context->ecc_dhe);
3156                         context->ecc_dhe = NULL;
3157                         DEBUG_PRINT("Error generating ECC DHE key\n");
3158                         return TLS_GENERIC_ERROR;
3159                 }
3160
3161                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE)) {
3162                         return TLS_GENERIC_ERROR;
3163                 }
3164
3165                 ecc_key client_key;
3166                 memset(&client_key, 0, sizeof client_key);
3167                 if (ecc_ansi_x963_import_ex
3168                     (buffer, key_size, &client_key, dp)) {
3169                         DEBUG_PRINT("Error importing ECC DHE key\n");
3170                         return TLS_GENERIC_ERROR;
3171                 }
3172                 out2 = malloc(key_size);
3173                 out_size = key_size;
3174
3175                 int err = ecc_shared_secret(context->ecc_dhe, &client_key,
3176                                 out2, &out_size);
3177                 ecc_free(&client_key);
3178
3179                 if (err) {
3180                         DEBUG_PRINT("ECC DHE DECRYPT ERROR %i\n", err);
3181                         free(out2);
3182                         return TLS_GENERIC_ERROR;
3183                 }
3184
3185                 DEBUG_PRINT("OUT_SIZE: %lu\n", out_size);
3186                 DEBUG_DUMP_HEX_LABEL("ECC DHE", out2, out_size);
3187
3188                 free(context->premaster_key);
3189                 context->premaster_key = out2;
3190                 context->premaster_key_len = out_size;
3191                 return 0;
3192         } else if (dhkey) {
3193                 tls_dhe_create(context);
3194                 if (!tls_random(context->local_random, TLS_SERVER_RANDOM_SIZE))
3195                 {
3196                         return TLS_GENERIC_ERROR;
3197                 }
3198
3199                 if (tls_dh_make_key(dhe_key_size / 8, context->dhe,
3200                      (const char *)dhkey->p, (const char *)dhkey->g, 0, 0)) {
3201                         free(context->dhe);
3202                         context->dhe = NULL;
3203                         DEBUG_PRINT("Error generating DHE key\n");
3204                         return TLS_GENERIC_ERROR;
3205                 }
3206
3207                 unsigned int dhe_out_size;
3208                 out2 = tls_decrypt_dhe(context, buffer, key_size,
3209                                 &dhe_out_size, 0);
3210                 if (!out2) {
3211                         DEBUG_PRINT("Error generating DHE shared key\n");
3212                         return TLS_GENERIC_ERROR;
3213                 }
3214
3215                 free(context->premaster_key);
3216                 context->premaster_key = out2;
3217                 context->premaster_key_len = dhe_out_size;
3218                 if (context->dhe) {
3219                         context->dhe->iana = dhkey->iana;
3220                 }
3221                 return 0;
3222         }
3223         DEBUG_PRINT("NO COMMON KEY SHARE SUPPORTED\n");
3224         return TLS_NO_COMMON_CIPHER;
3225 }
3226
3227 int tls_parse_certificate(struct TLSContext *context,
3228                           const unsigned char *buf, int buf_len,
3229                           int is_client) {
3230         int res = 0;
3231         if (buf_len < 3) {
3232                 return TLS_NEED_MORE_DATA;
3233         }
3234
3235         int size = get24(buf);
3236
3237         /* not enough data, so just consume all of it */
3238         if (size <= 4) {
3239                 return 3 + size;
3240         }
3241
3242         res += 3; /* skip over the size field */
3243
3244         if (context->tlsver == TLS_VERSION13) {
3245                 int context_size = buf[res];
3246                 res++;
3247                 /* must be 0 */
3248                 if (context_size) {
3249                         res += context_size;
3250                 }
3251         }
3252
3253         if (buf_len - res < size) {
3254                 return TLS_NEED_MORE_DATA;
3255         }
3256
3257         int idx = 0;
3258         int valid_certificate = 0;
3259         while (size > 0) {
3260                 idx++;
3261                 if (buf_len - res < 3) {
3262                         return TLS_NEED_MORE_DATA;
3263                 }
3264                 int certificate_size = get24(buf+res);
3265                 res += 3;
3266                 if (buf_len - res < certificate_size) {
3267                         return TLS_NEED_MORE_DATA;
3268                 }
3269                 /* load chain */
3270                 int certificates_in_chain = 0;
3271                 int res2 = res;
3272                 unsigned int remaining = certificate_size;
3273                 do {
3274                         if (remaining <= 3) {
3275                                 break;
3276                         }
3277                         certificates_in_chain++;
3278                         unsigned int certificate_size2 = get24(buf+res2);
3279                         res2 += 3;
3280                         remaining -= 3;
3281                         if (certificate_size2 > remaining) {
3282                                 DEBUG_PRINT
3283                                     ("Invalid certificate size (%i from %i bytes remaining)\n",
3284                                      certificate_size2, remaining);
3285                                 break;
3286                         }
3287                         remaining -= certificate_size2;
3288
3289                         struct TLSCertificate *cert = asn1_parse(context,
3290                                                                  &buf
3291                                                                  [res2],
3292                                                                  certificate_size2,
3293                                                                  is_client);
3294                         if (cert) {
3295                                 if (certificate_size2) {
3296                                         cert->bytes =
3297                                             malloc(certificate_size2);
3298                                         if (cert->bytes) {
3299                                                 cert->len =
3300                                                     certificate_size2;
3301                                                 memcpy(cert->bytes,
3302                                                        &buf[res2],
3303                                                        certificate_size2);
3304                                         }
3305                                 }
3306                                 /* valid certificate */
3307                                 if (is_client) {
3308                                         void *new;
3309                                         valid_certificate = 1;
3310
3311                                         new =
3312                                             TLS_REALLOC(context->
3313                                                         client_certificates,
3314                                                         (context->
3315                                                          client_certificates_count
3316                                                          +
3317                                                          1) *
3318                                                         sizeof(struct
3319                                                                TLSCertificate
3320                                                                *));
3321
3322                                         if (!new) {
3323                                                 free(context->
3324                                                          client_certificates);
3325                                                 context->
3326                                                     client_certificates =
3327                                                     0;
3328                                                 return TLS_NO_MEMORY;
3329                                         }
3330
3331                                         context->client_certificates = new;
3332                                         context->
3333                                             client_certificates
3334                                             [context->client_certificates_count]
3335                                             = cert;
3336                                         context->
3337                                             client_certificates_count++;
3338                                 } else {
3339                                         void *new;
3340                                         new =
3341                                             TLS_REALLOC(context->
3342                                                         certificates,
3343                                                         (context->
3344                                                          certificates_count
3345                                                          +
3346                                                          1) *
3347                                                         sizeof(struct
3348                                                                TLSCertificate
3349                                                                *));
3350                                         if (!new) {
3351                                                 free(context->
3352                                                          certificates);
3353                                                 context->certificates = 0;
3354                                                 return TLS_NO_MEMORY;
3355                                         }
3356                                         context->certificates = new;
3357                                         context->certificates[context->
3358                                                               certificates_count]
3359                                             = cert;
3360                                         context->certificates_count++;
3361                                         if ((cert->pk) || (cert->priv))
3362                                                 valid_certificate = 1;
3363                                         else if (!context->is_server)
3364                                                 valid_certificate = 1;
3365                                 }
3366                         }
3367                         res2 += certificate_size2;
3368                         /* extension */
3369                         if (context->tlsver == TLS_VERSION13) {
3370                                 if (remaining >= 2) {
3371                                         /* ignore extensions */
3372                                         remaining -= 2;
3373                                         uint16_t size = get16(&buf[res2]);
3374                                         if (size && size >= remaining) {
3375                                                 res2 += size;
3376                                                 remaining -= size;
3377                                         }
3378                                 }
3379                         }
3380                 } while (remaining > 0);
3381                 if (remaining) {
3382                         DEBUG_PRINT("Extra %i bytes after certificate\n",
3383                                     remaining);
3384                 }
3385                 size -= certificate_size + 3;
3386                 res += certificate_size;
3387         }
3388         if (!valid_certificate) {
3389                 MARK;
3390                 return TLS_UNSUPPORTED_CERTIFICATE;
3391         }
3392         if (res != buf_len) {
3393                 DEBUG_PRINT("Warning: %i bytes read from %i byte buffer\n",
3394                             (int) res, (int) buf_len);
3395         }
3396         return res;
3397 }
3398
3399 static int parse_dh( const unsigned char *buf, int buf_len, const unsigned char
3400                 **out, int *out_size) {
3401         int res = 0;
3402         *out = NULL;
3403         *out_size = 0;
3404         if (buf_len < 2) {
3405                 return TLS_NEED_MORE_DATA;
3406         }
3407         uint16_t size = get16(buf);
3408         res += 2;
3409         if (buf_len - res < size) {
3410                 return TLS_NEED_MORE_DATA;
3411         }
3412         DEBUG_DUMP_HEX(&buf[res], size);
3413         *out = &buf[res];
3414         *out_size = size;
3415         res += size;
3416         return res;
3417 }
3418
3419 static int tls_parse_random(struct TLSContext *context,
3420                               const unsigned char *buf, int buf_len) {
3421         int res = 0;
3422         int ephemeral = tls_cipher_is_ephemeral(context);
3423         uint16_t size;
3424         if (ephemeral == 2) {
3425                 if (buf_len < 1) {
3426                         return TLS_NEED_MORE_DATA;
3427                 }
3428                 size = buf[0];
3429                 res += 1;
3430         } else {
3431                 if (buf_len < 2) {
3432                         return TLS_NEED_MORE_DATA;
3433                 }
3434                 size = get16(buf);
3435                 res += 2;
3436         }
3437
3438         if (buf_len - res < size) {
3439                 return TLS_NEED_MORE_DATA;
3440         }
3441         unsigned int out_len = 0;
3442         unsigned char *random = NULL;
3443         switch (ephemeral) {
3444                 case 1:
3445                         random = tls_decrypt_dhe(context, &buf[res], size, &out_len,
3446                                         1);
3447                         break;
3448                 case 2:
3449                         random = tls_decrypt_ecc_dhe(context, &buf[res], size,
3450                                         &out_len, 1);
3451                         break;
3452                 default:
3453                         random = decrypt_rsa(context, &buf[res], size,
3454                                         &out_len);
3455         }
3456
3457         if (random && out_len > 2) {
3458                 /* *(unsigned short *)&random[0] = htons(context->version); */
3459                 DEBUG_DUMP_HEX_LABEL("PRE MASTER KEY", random, out_len);
3460                 free(context->premaster_key);
3461                 context->premaster_key = random;
3462                 context->premaster_key_len = out_len;
3463                 tls_compute_key(context, 48);
3464         } else {
3465                 free(random);
3466                 return 0;
3467         }
3468         res += size;
3469         return res;
3470 }
3471
3472 static const unsigned char *parse_signature(const unsigned char *buf, int
3473                 buf_len, int *hash_algorithm, int *sign_algorithm, int
3474                 *sig_size, int *offset) {
3475         int res = 0;
3476         if (buf_len < 2) {
3477                 return NULL;
3478         }
3479         *hash_algorithm = _md5_sha1;
3480         *sign_algorithm = rsa_sign;
3481         *sig_size = 0;
3482         *hash_algorithm = buf[res];
3483         res++;
3484         *sign_algorithm = buf[res];
3485         res++;
3486         uint16_t size = get16(&buf[res]);
3487         res += 2;
3488         if (buf_len - res < size) {
3489                 return NULL;
3490         }
3491         DEBUG_DUMP_HEX(&buf[res], size);
3492         *sig_size = size;
3493         *offset = res + size;
3494         return &buf[res];
3495 }
3496
3497 int tls_parse_server_key_exchange(struct TLSContext *context,
3498                                   const unsigned char *buf, int buf_len) {
3499         int res = 0;
3500         int dh_res = 0;
3501         if (buf_len < 3) {
3502                 return TLS_NEED_MORE_DATA;
3503         }
3504         int size = get24(buf);
3505         res += 3;
3506         const unsigned char *packet_ref = buf + res;
3507         if (buf_len - res < size) {
3508                 return TLS_NEED_MORE_DATA;
3509         }
3510
3511         if (!size) {
3512                 return res;
3513         }
3514
3515         unsigned char has_ds_params = 0;
3516         int key_size = 0;
3517         const struct ECCCurveParameters *curve = NULL;
3518         const unsigned char *pk_key = NULL;
3519         int ephemeral = tls_cipher_is_ephemeral(context);
3520         if (ephemeral) {
3521                 if (ephemeral == 1) {
3522                         has_ds_params = 1;
3523                 } else {
3524                         if (buf[res++] != 3) {
3525                                 /* named curve */
3526                                 /* any other method is not supported */
3527                                 return 0;
3528                         }
3529                         if (buf_len - res < 3) {
3530                                 return TLS_NEED_MORE_DATA;
3531                         }
3532                         int iana_n = get16(&buf[res]);
3533                         res += 2;
3534                         key_size = buf[res];
3535                         res++;
3536                         if (buf_len - res < key_size) {
3537                                 return TLS_NEED_MORE_DATA;
3538                         }
3539                         DEBUG_PRINT("IANA CURVE NUMBER: %i\n", iana_n);
3540                         switch (iana_n) {
3541                                 case 19:
3542                                         curve = &secp192r1;
3543                                         break;
3544                                 case 20:
3545                                         curve = &secp224k1;
3546                                         break;
3547                                 case 21:
3548                                         curve = &secp224r1;
3549                                         break;
3550                                 case 22:
3551                                         curve = &secp256k1;
3552                                         break;
3553                                 case 23:
3554                                         curve = &secp256r1;
3555                                         break;
3556                                 case 24:
3557                                         curve = &secp384r1;
3558                                         break;
3559                                 case 25:
3560                                         curve = &secp521r1;
3561                                         break;
3562                                 default:
3563                                         DEBUG_PRINT("UNSUPPORTED CURVE\n");
3564                                         return TLS_GENERIC_ERROR;
3565                         }
3566                         pk_key = &buf[res];
3567                         res += key_size;
3568                         context->curve = curve;
3569                 }
3570         }
3571
3572         const unsigned char *dh_p = NULL;
3573         int dh_p_len = 0;
3574         const unsigned char *dh_g = NULL;
3575         int dh_g_len = 0;
3576         const unsigned char *dh_Ys = NULL;
3577         int dh_Ys_len = 0;
3578
3579         if (has_ds_params) {
3580                 DEBUG_PRINT("          dh_p: ");
3581                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_p, &dh_p_len);
3582                 if (dh_res <= 0) {
3583                         return TLS_BROKEN_PACKET;
3584                 }
3585                 res += dh_res;
3586                 DEBUG_PRINT("\n");
3587
3588                 DEBUG_PRINT("          dh_q: ");
3589                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_g, &dh_g_len);
3590                 if (dh_res <= 0) {
3591                 MARK;
3592                         return TLS_BROKEN_PACKET;
3593                 }
3594                 res += dh_res;
3595                 DEBUG_PRINT("\n");
3596
3597                 DEBUG_PRINT("          dh_Ys: ");
3598                 dh_res = parse_dh(&buf[res], buf_len - res, &dh_Ys,
3599                                 &dh_Ys_len);
3600                 if (dh_res <= 0) {
3601                 MARK;
3602                         return TLS_BROKEN_PACKET;
3603                 }
3604                 res += dh_res;
3605                 DEBUG_PRINT("\n");
3606         }
3607         int sign_size;
3608         int hash_algorithm;
3609         int sign_algorithm;
3610         int packet_size = res - 3;
3611         int offset = 0;
3612         DEBUG_PRINT("          SIGNATURE (%i/%i/%i): ", packet_size,
3613                     dh_res, key_size);
3614         const unsigned char *signature =
3615             parse_signature(&buf[res], buf_len - res, &hash_algorithm,
3616                             &sign_algorithm, &sign_size, &offset);
3617         DEBUG_PRINT("\n");
3618         if (sign_size <= 0 || !signature) {
3619                 return TLS_BROKEN_PACKET;
3620         }
3621         res += offset;
3622         /* check signature */
3623         unsigned int message_len =
3624             packet_size + TLS_CLIENT_RANDOM_SIZE + TLS_SERVER_RANDOM_SIZE;
3625         unsigned char *message = malloc(message_len);
3626         if (message) {
3627                 memcpy(message, context->local_random, TLS_CLIENT_RANDOM_SIZE);
3628                 memcpy(message + TLS_CLIENT_RANDOM_SIZE,
3629                        context->remote_random, TLS_SERVER_RANDOM_SIZE);
3630                 memcpy(message + TLS_CLIENT_RANDOM_SIZE +
3631                        TLS_SERVER_RANDOM_SIZE, packet_ref, packet_size);
3632                 if (tls_is_ecdsa(context)) {
3633                         if (tls_verify_ecdsa
3634                             (context, hash_algorithm, signature, sign_size,
3635                              message, message_len, NULL) != 1) {
3636                                 DEBUG_PRINT
3637                                     ("ECC Server signature FAILED!\n");
3638                                 free(message);
3639                                 return TLS_BROKEN_PACKET;
3640                         }
3641                 } else
3642                 {
3643                         if (verify_rsa(context, hash_algorithm, signature,
3644                                                 sign_size, message,
3645                                                 message_len) != 1) {
3646                                 DEBUG_PRINT("Server signature FAILED!\n");
3647                                 free(message);
3648                                 return TLS_BROKEN_PACKET;
3649                         }
3650                 }
3651                 free(message);
3652         }
3653
3654         if (buf_len - res) {
3655                 DEBUG_PRINT("EXTRA %i BYTES AT THE END OF MESSAGE\n",
3656                             buf_len - res);
3657                 DEBUG_DUMP_HEX(&buf[res], buf_len - res);
3658                 DEBUG_PRINT("\n");
3659         }
3660
3661         if (ephemeral == 1) {
3662                 tls_dhe_create(context);
3663                 DEBUG_DUMP_HEX_LABEL("DHP", dh_p, dh_p_len);
3664                 DEBUG_DUMP_HEX_LABEL("DHG", dh_g, dh_g_len);
3665                 int dhe_key_size = dh_p_len;
3666                 if (dh_g_len > dh_p_len) {
3667                         dhe_key_size = dh_g_len;
3668                 }
3669
3670                 if (tls_dh_make_key(dhe_key_size, context->dhe, (const char *)
3671                                         dh_p, (const char *) dh_g, dh_p_len,
3672                                         dh_g_len)) {
3673                         DEBUG_PRINT("ERROR CREATING DHE KEY\n");
3674                         free(context->dhe);
3675                         context->dhe = NULL;
3676                         return TLS_GENERIC_ERROR;
3677                 }
3678
3679                 unsigned int dh_key_size = 0;
3680                 unsigned char *key = tls_decrypt_dhe(context, dh_Ys, dh_Ys_len,
3681                                 &dh_key_size, 0);
3682                 DEBUG_DUMP_HEX_LABEL("DH COMMON SECRET", key, dh_key_size);
3683                 if (key && dh_key_size) {
3684                         free(context->premaster_key);
3685                         context->premaster_key = key;
3686                         context->premaster_key_len = dh_key_size;
3687                 }
3688         } else if (ephemeral == 2 && curve && pk_key && key_size) {
3689                 tls_ecc_dhe_create(context);
3690
3691                 ltc_ecc_set_type *dp = (ltc_ecc_set_type *) & curve->dp;
3692                 if (ecc_make_key_ex
3693                     (NULL, find_prng("sprng"), context->ecc_dhe, dp)) {
3694                         free(context->ecc_dhe);
3695                         context->ecc_dhe = NULL;
3696                         DEBUG_PRINT("Error generating ECC key\n");
3697                         return TLS_GENERIC_ERROR;
3698                 }
3699
3700                 free(context->premaster_key);
3701                 context->premaster_key_len = 0;
3702
3703                 unsigned int out_len = 0;
3704                 context->premaster_key =
3705                     tls_decrypt_ecc_dhe(context, pk_key, key_size,
3706                                                  &out_len, 0);
3707                 if (context->premaster_key) {
3708                         context->premaster_key_len = out_len;
3709                 }
3710         }
3711
3712         return res;
3713 }
3714
3715 int tls_parse_client_key_exchange(struct TLSContext *context,
3716                                   const unsigned char *buf, int buf_len) {
3717         if (context->connection_status != 1) {
3718                 DEBUG_PRINT
3719                     ("UNEXPECTED CLIENT KEY EXCHANGE MESSAGE (connections status: %i)\n",
3720                      (int) context->connection_status);
3721                 return TLS_UNEXPECTED_MESSAGE;
3722         }
3723
3724         int res = 0;
3725         int dh_res = 0;
3726         if (buf_len < 3) {
3727                 return TLS_NEED_MORE_DATA;
3728         }
3729         int size = get24(buf);
3730         res += 3;
3731
3732         if (buf_len - res < size) {
3733                 return TLS_NEED_MORE_DATA;
3734         }
3735
3736         if (!size) {
3737                 return res;
3738         }
3739
3740         dh_res = tls_parse_random(context, &buf[res], size);
3741         if (dh_res <= 0) {
3742                 DEBUG_PRINT("broken key\n");
3743                 return TLS_BROKEN_PACKET;
3744         }
3745         DEBUG_PRINT("\n");
3746
3747         res += size;
3748         context->connection_status = 2;
3749         return res;
3750 }
3751
3752 static int tls_parse_server_hello_done(const unsigned char *buf, int buf_len) {
3753         int res = 0;
3754         if (buf_len < 3) {
3755                 return TLS_NEED_MORE_DATA;
3756         }
3757         int size = get24(buf);
3758         res += 3;
3759
3760         if (buf_len - res < size) {
3761                 return TLS_NEED_MORE_DATA;
3762         }
3763
3764                 MARK;
3765         res += size;
3766         return res;
3767 }
3768
3769 int tls_parse_finished(struct TLSContext *context,
3770                        const unsigned char *buf, int buf_len,
3771                        unsigned int *write_packets) {
3772         if (context->connection_status < 2
3773             || context->connection_status == TLS_CONNECTED) {
3774                 DEBUG_PRINT("UNEXPECTED FINISHED MESSAGE\n");
3775                 return TLS_UNEXPECTED_MESSAGE;
3776         }
3777
3778         int res = 0;
3779         *write_packets = 0;
3780         if (buf_len < 3) {
3781                 return TLS_NEED_MORE_DATA;
3782         }
3783         int size = get24(buf);
3784         res += 3;
3785
3786         if (size < TLS_MIN_FINISHED_OPAQUE_LEN) {
3787                 DEBUG_PRINT("Invalid finished packet size: %i\n", size);
3788                 return TLS_BROKEN_PACKET;
3789         }
3790
3791         if (buf_len - res < size) {
3792                 return TLS_NEED_MORE_DATA;
3793         }
3794
3795         unsigned char hash[TLS_MAX_SHA_SIZE];
3796         unsigned int hash_len = tls_get_hash(context, hash);
3797
3798         if (context->tlsver == TLS_VERSION13) {
3799                 unsigned char hash_out[TLS_MAX_SHA_SIZE];
3800                 unsigned long out_size = TLS_MAX_SHA_SIZE;
3801                 if (!context->remote_finished_key || !hash_len) {
3802                         DEBUG_PRINT
3803                             ("NO FINISHED KEY COMPUTED OR NO HANDSHAKE HASH\n");
3804                         return TLS_NOT_VERIFIED;
3805                 }
3806
3807                 DEBUG_DUMP_HEX_LABEL("HS HASH", hash, hash_len);
3808                 DEBUG_DUMP_HEX_LABEL("HS FINISH", context->remote_finished_key,
3809                                 hash_len);
3810
3811                 out_size = hash_len;
3812                 hmac_state hmac;
3813                 hmac_init(&hmac, tls_get_hash_idx(context),
3814                           context->remote_finished_key, hash_len);
3815                 hmac_process(&hmac, hash, hash_len);
3816                 hmac_done(&hmac, hash_out, &out_size);
3817
3818                 if (size != (int)out_size || memcmp(hash_out, &buf[res], size)) {
3819                         DEBUG_PRINT
3820                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3821                              (int) context->local_sequence_number,
3822                              (int) context->remote_sequence_number);
3823                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3824                                              size);
3825                         DEBUG_DUMP_HEX_LABEL("VERIFY", hash_out, out_size);
3826                         return TLS_NOT_VERIFIED;
3827                 }
3828                 if (context->is_server) {
3829                         context->connection_status = TLS_CONNECTED;
3830                         res += size;
3831                         _private_tls13_key(context, 0);
3832                         context->local_sequence_number = 0;
3833                         context->remote_sequence_number = 0;
3834                         return res;
3835                 }
3836                 /* TODO client verify */
3837         } else {
3838                 /* verify */
3839                 unsigned char *out = malloc(size);
3840                 if (!out) {
3841                         DEBUG_PRINT("Error in malloc (%i bytes)\n",
3842                                     (int) size);
3843                         return TLS_NO_MEMORY;
3844                 }
3845
3846                 /* server verifies client's message */
3847                 if (context->is_server) {
3848                         tls_prf(context, out, size,
3849                                          context->master_key,
3850                                          context->master_key_len,
3851                                          (unsigned char *)
3852                                          "client finished", 15, hash,
3853                                          hash_len, NULL, 0);
3854                 } else {
3855                         tls_prf(context, out, size,
3856                                          context->master_key,
3857                                          context->master_key_len,
3858                                          (unsigned char *)
3859                                          "server finished", 15, hash,
3860                                          hash_len, NULL, 0);
3861                 }
3862
3863                 if (memcmp(out, &buf[res], size)) {
3864                         free(out);
3865                         DEBUG_PRINT
3866                             ("Finished validation error (sequence number, local: %i, remote: %i)\n",
3867                              (int) context->local_sequence_number,
3868                              (int) context->remote_sequence_number);
3869                         DEBUG_DUMP_HEX_LABEL("FINISHED OPAQUE", &buf[res],
3870                                              size);
3871                         DEBUG_DUMP_HEX_LABEL("VERIFY", out, size);
3872                         return TLS_NOT_VERIFIED;
3873                 }
3874                 free(out);
3875         }
3876
3877         if (context->is_server) {
3878                 *write_packets = 3;
3879         } else {
3880                 context->connection_status = TLS_CONNECTED;
3881         }
3882
3883         // fprintf(stderr, "set conn status = %d\n", context->connection_status);
3884
3885                 MARK;
3886         res += size;
3887         return res;
3888 }
3889
3890 int tls_parse_verify_tls13(struct TLSContext *context,
3891                            const unsigned char *buf, int buf_len) {
3892         if (buf_len < 7) {
3893                 return TLS_NEED_MORE_DATA;
3894         }
3895         int size = get24(buf);
3896
3897         if (size < 2) {
3898                 return buf_len;
3899         }
3900
3901         unsigned char signing_data[TLS_MAX_HASH_SIZE + 98];
3902         int signing_data_len;
3903
3904         /* first 64 bytes to 0x20 (32) */
3905         memset(signing_data, 0x20, 64);
3906         /* context string 33 bytes */
3907         if (context->is_server) {
3908                 memcpy(signing_data + 64,
3909                        "TLS 1.3, server CertificateVerify", 33);
3910         } else {
3911                 memcpy(signing_data + 64,
3912                        "TLS 1.3, client CertificateVerify", 33);
3913         }
3914
3915         /* a single 0 byte separator */
3916         signing_data[97] = 0;
3917         signing_data_len = 98;
3918
3919         signing_data_len += tls_get_hash(context, signing_data + 98);
3920         DEBUG_DUMP_HEX_LABEL("signature data", signing_data, signing_data_len);
3921         uint16_t signature = get16(&buf[3]);
3922         uint16_t signature_size = get16(&buf[5]);
3923         int valid = 0;
3924         if (buf_len < size + 7) {
3925                 return TLS_NEED_MORE_DATA;
3926         }
3927         switch (signature) {
3928                 case 0x0403:
3929                         /* secp256r1 + sha256 */
3930                         valid =
3931                                 tls_verify_ecdsa(context, sha256, buf + 7,
3932                                                 signature_size, signing_data,
3933                                                 signing_data_len,
3934                                                 &secp256r1);
3935                         break;
3936                 case 0x0503:
3937                         /* secp384r1 + sha384 */
3938                         valid = tls_verify_ecdsa(context, sha384, buf + 7,
3939                                         signature_size, signing_data,
3940                                         signing_data_len, &secp384r1);
3941                         break;
3942                 case 0x0603:
3943                         /* secp521r1 + sha512 */
3944                         valid = tls_verify_ecdsa(context, sha512, buf + 7,
3945                                         signature_size, signing_data,
3946                                         signing_data_len, &secp521r1);
3947                         break;
3948                 case 0x0804:
3949                         valid = verify_rsa(context, sha256, buf + 7,
3950                                         signature_size, signing_data,
3951                                         signing_data_len);
3952                         break;
3953                 default:
3954                         DEBUG_PRINT("Unsupported signature: %x\n",
3955                                         (int) signature);
3956                         return TLS_UNSUPPORTED_CERTIFICATE;
3957         }
3958         if (valid != 1) {
3959                 DEBUG_PRINT("Signature FAILED!\n");
3960                 return TLS_DECRYPTION_FAILED;
3961         }
3962         return buf_len;
3963 }
3964
3965 int tls_parse_verify(struct TLSContext *context, const unsigned char *buf,
3966                      int buf_len) {
3967         if (context->tlsver == TLS_VERSION13) {
3968                 return tls_parse_verify_tls13(context, buf, buf_len);
3969         }
3970
3971         if (buf_len < 7) {
3972                 return TLS_BAD_CERTIFICATE;
3973         }
3974
3975         int bytes_to_follow = get24(buf);
3976
3977         if (buf_len - 3 < bytes_to_follow) {
3978                 return TLS_BAD_CERTIFICATE;
3979         }
3980
3981         int res = -1;
3982
3983         unsigned int hash = buf[3];
3984         unsigned int algorithm = buf[4];
3985         if (algorithm != rsa) {
3986                 return TLS_UNSUPPORTED_CERTIFICATE;
3987         }
3988         uint16_t size = get16(&buf[5]);
3989         if (bytes_to_follow - 4 < size) {
3990                 return TLS_BAD_CERTIFICATE;
3991         }
3992         DEBUG_PRINT("ALGORITHM %i/%i (%i)\n", hash, algorithm, (int) size);
3993         DEBUG_DUMP_HEX_LABEL("VERIFY", &buf[7], bytes_to_follow - 7);
3994
3995         res = verify_rsa(context, hash, &buf[7], size,
3996                         context->cached_handshake.buffer,
3997                         context->cached_handshake.len);
3998
3999         tls_buffer_free(&context->cached_handshake);
4000         if (res == 1) {
4001                 DEBUG_PRINT("Signature OK\n");
4002                 context->client_verified = 1;
4003         } else {
4004                 DEBUG_PRINT("Signature FAILED\n");
4005                 context->client_verified = 0;
4006         }
4007         return 1;
4008 }
4009
4010 /* TODO This is actually a parse a handshake message */
4011 int tls_parse_payload(struct TLSContext *context, const unsigned char *buf,
4012                       int buf_len) {
4013         ENTER;
4014         int orig_len = buf_len;
4015
4016
4017         if (context->connection_status == TLS_CONNECTED) {
4018                 if (context->version == TLS_V13) {
4019                         tls_alert(context, 1, unexpected_message);
4020                 } else {
4021                         tls_alert(context, 0, no_renegotiation_RESERVED);
4022                 }
4023
4024                 return 1;
4025         }
4026
4027         while (buf_len >= 4 && !context->critical_error) {
4028                 int payload_res = 0;
4029                 //unsigned char update_hash = 1;
4030                 unsigned char type = buf[0];
4031                 unsigned int write_packets = 0;
4032                 int certificate_verify_alert = no_error;
4033                 int payload_size = get24(buf+1) + 3;
4034                 if (buf_len < payload_size + 1) {
4035                         return TLS_NEED_MORE_DATA;
4036                 }
4037                 switch (type) {
4038                         case 0x00:
4039                                 /* hello request */
4040                                 CHECK_HANDSHAKE_STATE(context, 0, 1);
4041                                 DEBUG_PRINT
4042                                         (" => HELLO REQUEST (RENEGOTIATION?)\n");
4043                                 if (context->is_server) {
4044                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4045                                 } else {
4046                                         if (context->connection_status == TLS_CONNECTED) {
4047                                                 /* renegotiation */
4048                                                 payload_res = TLS_NO_RENEGOTIATION;
4049                                         } else {
4050                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4051                                         }
4052                                 }
4053                                 /* no payload */
4054                                 break;
4055                         case 0x01:
4056                                 /* client hello */
4057                                 CHECK_HANDSHAKE_STATE(context, 1, 1);
4058                                 DEBUG_PRINT(" => CLIENT HELLO\n");
4059                                 if (context->is_server) {
4060                                         payload_res =
4061                                                 tls_parse_client_hello(context,
4062                                                                 buf + 1,
4063                                                                 payload_size,
4064                                                                 &write_packets);
4065                                 } else {
4066                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4067                                 }
4068                                 break;
4069                         case 0x02:
4070                                 /* server hello */
4071                                 CHECK_HANDSHAKE_STATE(context, 2, 1);
4072                                 DEBUG_PRINT(" => SERVER HELLO\n");
4073                                 if (context->is_server) {
4074                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4075                                 } else {
4076                                         write_packets = 0;
4077                                         payload_res = tls_parse_server_hello(context, buf + 1, payload_size);
4078                                 }
4079                                 break;
4080                         case 0x03:
4081                                 /* hello verify request */
4082                                 DEBUG_PRINT(" => VERIFY REQUEST\n");
4083                                 CHECK_HANDSHAKE_STATE(context, 3, 1);
4084                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4085                                 break;
4086                         case 0x0B:
4087                                 /* certificate */
4088                                 CHECK_HANDSHAKE_STATE(context, 4, 1);
4089                                 DEBUG_PRINT(" => CERTIFICATE\n");
4090                                 if (context->tlsver == TLS_VERSION13) {
4091                                         if (context->connection_status == 2) {
4092                                                 payload_res =
4093                                                         tls_parse_certificate(context,
4094                                                                         buf + 1,
4095                                                                         payload_size,
4096                                                                         context->
4097                                                                         is_server);
4098                                                 if (context->is_server) {
4099                                                         if (context->certificate_verify && context->client_certificates_count) {
4100                                                                 certificate_verify_alert
4101                                                                         =
4102                                                                         context->certificate_verify(context,
4103                                                                          context->client_certificates,
4104                                                                          context->client_certificates_count);
4105                                                         }
4106                                                         /* empty certificates are permitted for client */
4107                                                         if (payload_res <= 0) {
4108                                                                 payload_res = 1;
4109                                                         }
4110                                                 }
4111                                         } else
4112                                                 payload_res =
4113                                                         TLS_UNEXPECTED_MESSAGE;
4114                                 } else
4115                                         if (context->connection_status == 1) {
4116                                                 if (context->is_server) {
4117                                                         /* client certificate */
4118                                                         payload_res =
4119                                                                 tls_parse_certificate(context,
4120                                                                                 buf + 1,
4121                                                                                 payload_size,
4122                                                                                 1);
4123                                                         if (context->certificate_verify && context->client_certificates_count) {
4124                                                                 certificate_verify_alert =
4125                                                                         context->certificate_verify
4126                                                                         (context,
4127                                                                          context->
4128                                                                          client_certificates,
4129                                                                          context->
4130                                                                          client_certificates_count);
4131                                                         }
4132                                                         /* empty certificates are permitted for client */
4133                                                         if (payload_res <= 0)
4134                                                                 payload_res = 1;
4135                                                 } else {
4136                                                         payload_res =
4137                                                                 tls_parse_certificate(context,
4138                                                                                 buf + 1,
4139                                                                                 payload_size,
4140                                                                                 0);
4141                                                         if (certificate_verify && context->certificates_count) {
4142                                                                 certificate_verify_alert =
4143                                                                         context->certificate_verify
4144                                                                         (context,
4145                                                                          context->certificates,
4146                                                                          context->
4147                                                                          certificates_count);
4148                                                         }
4149                                                 }
4150                                         } else {
4151                                                 payload_res = TLS_UNEXPECTED_MESSAGE;
4152                                         }
4153                                 break;
4154                         case 0x0C:
4155                                 /* server key exchange */
4156                                 CHECK_HANDSHAKE_STATE(context, 5, 1);
4157                                 DEBUG_PRINT(" => SERVER KEY EXCHANGE\n");
4158                                 if (context->is_server) {
4159                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4160                                 } else {
4161                                         payload_res =
4162                                                 tls_parse_server_key_exchange(context,
4163                                                                 buf + 1,
4164                                                                 payload_size);
4165                                 }
4166                                 break;
4167                         case 0x0D:
4168                                 /* certificate request */
4169                                 CHECK_HANDSHAKE_STATE(context, 6, 1);
4170                                 /* server to client */
4171                                 if (context->is_server) {
4172                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4173                                 } else {
4174                                         context->client_verified = 2;
4175                                 }
4176                                 DEBUG_PRINT(" => CERTIFICATE REQUEST\n");
4177                                 break;
4178                         case 0x0E:
4179                                 /* server hello done */
4180                                 CHECK_HANDSHAKE_STATE(context, 7, 1);
4181                                 DEBUG_PRINT(" => SERVER HELLO DONE\n");
4182                                 if (context->is_server) {
4183                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4184                                 } else {
4185                                         payload_res =
4186                                                 tls_parse_server_hello_done(
4187                                                                 buf + 1,
4188                                                                 payload_size);
4189                                         if (payload_res > 0) {
4190                                                 write_packets = 1;
4191                                         }
4192                                 }
4193                                 break;
4194                         case 0x0F:
4195                                 /* certificate verify */
4196                                 CHECK_HANDSHAKE_STATE(context, 8, 1);
4197                                 DEBUG_PRINT(" => CERTIFICATE VERIFY\n");
4198                                 if (context->connection_status == 2) {
4199                                         payload_res =
4200                                                 tls_parse_verify(context, buf + 1,
4201                                                                 payload_size);
4202                                 } else {
4203                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4204                                 }
4205                                 break;
4206                         case 0x10:
4207                                 /* client key exchange */
4208                                 CHECK_HANDSHAKE_STATE(context, 9, 1);
4209                                 DEBUG_PRINT(" => CLIENT KEY EXCHANGE\n");
4210                                 if (context->is_server) {
4211                                         payload_res =
4212                                                 tls_parse_client_key_exchange(context,
4213                                                                 buf + 1,
4214                                                                 payload_size);
4215                                 } else {
4216                                         payload_res = TLS_UNEXPECTED_MESSAGE;
4217                                 }
4218                                 break;
4219                         case 0x14:
4220                                 /* finished */
4221                                 tls_buffer_free(&context->cached_handshake);
4222                                 CHECK_HANDSHAKE_STATE(context, 10, 1);
4223                                 DEBUG_PRINT(" => FINISHED\n");
4224                                 payload_res = tls_parse_finished(context,
4225                                                 buf + 1, payload_size,
4226                                                 &write_packets);
4227                                 if (payload_res > 0) {
4228                                         memset(context->hs_messages, 0,
4229                                                         sizeof(context->hs_messages));
4230                                 }
4231                                 break;
4232                         default:
4233                                 DEBUG_PRINT
4234                                         (" => NOT UNDERSTOOD PAYLOAD TYPE: %x\n",
4235                                          (int) type);
4236                                 return TLS_NOT_UNDERSTOOD;
4237                 }
4238
4239                 //if (type != 0x00 && update_hash) {
4240                 if (type != 0x00) {
4241                         tls_update_hash(context, buf, payload_size + 1);
4242                 }
4243
4244                 if (certificate_verify_alert != no_error) {
4245                         MARK;
4246                         tls_alert(context, 1, certificate_verify_alert);
4247                         context->critical_error = 1;
4248                 }
4249
4250                 if (payload_res < 0) {
4251                         switch (payload_res) {
4252                                 case TLS_UNEXPECTED_MESSAGE:
4253                                         MARK;
4254                                         tls_alert(context, 1, unexpected_message);
4255                                         break;
4256                                 case TLS_COMPRESSION_NOT_SUPPORTED:
4257                                         MARK;
4258                                         tls_alert(context, 1, decompression_failure_RESERVED);
4259                                         break;
4260                                 case TLS_BROKEN_PACKET:
4261                                         MARK;
4262                                         tls_alert(context, 1, decode_error);
4263                                         break;
4264                                 case TLS_NO_MEMORY:
4265                                         MARK;
4266                                         tls_alert(context, 1, internal_error);
4267                                         break;
4268                                 case TLS_NOT_VERIFIED:
4269                                         MARK;
4270                                         tls_alert(context, 1, bad_record_mac);
4271                                         break;
4272                                 case TLS_BAD_CERTIFICATE:
4273                                         MARK;
4274                                         if (context->is_server) {
4275                                                 /* bad client certificate, continue */
4276                                                 tls_alert(context, 0, bad_certificate);
4277                                                 payload_res = 0;
4278                                         } else {
4279                                                 tls_alert(context, 1, bad_certificate);
4280                                         }
4281                                         break;
4282                                 case TLS_UNSUPPORTED_CERTIFICATE:
4283                                         MARK;
4284                                         tls_alert(context, 1, unsupported_certificate);
4285                                         break;
4286                                 case TLS_NO_COMMON_CIPHER:
4287                                         MARK;
4288                                         tls_alert(context, 1, insufficient_security);
4289                                         break;
4290                                 case TLS_NOT_UNDERSTOOD:
4291                                         MARK;
4292                                         tls_alert(context, 1, internal_error);
4293                                         break;
4294                                 case TLS_NO_RENEGOTIATION:
4295                                         MARK;
4296                                         tls_alert(context, 0, no_renegotiation_RESERVED);
4297                                         payload_res = 0;
4298                                         break;
4299                                 case TLS_DECRYPTION_FAILED:
4300                                         MARK;
4301                                         tls_alert(context, 1, decryption_failed_RESERVED);
4302                                         break;
4303                         }
4304                         if (payload_res < 0) {
4305                                 return payload_res;
4306                         }
4307                 }
4308
4309                 if (certificate_verify_alert != no_error) {
4310                         payload_res = TLS_BAD_CERTIFICATE;
4311                         /* TODO this is set but not used */
4312                 }
4313
4314                 /* except renegotiation */
4315                 struct TLSPacket *pkt;
4316                 switch (write_packets) {
4317                         case 1:
4318                                 if (context->client_verified == 2) {
4319                                         tls_send_certificate(context);
4320                                         context->client_verified = 0;
4321                                 }
4322
4323                                 /* client handshake */
4324                                 tls_send_client_key_exchange(context);
4325                                 tls_send_change_cipher_spec(context);
4326
4327                                 context->cipher_spec_set = 1;
4328                                 context->local_sequence_number = 0;
4329
4330                                 tls_send_finished(context);
4331
4332                                 context->cipher_spec_set = 0;
4333                                 break;
4334                         case 2:
4335                                 /* server handshake */
4336                                 DEBUG_PRINT("<= SENDING SERVER HELLO\n");
4337                                 if (context->connection_status == 3) {
4338                                         context->connection_status = 2;
4339                                         tls_queue_packet
4340                                                 (tls_build_hello(context, 0));
4341                                         tls_send_change_cipher_spec(context);
4342                                         _private_tls13_key(context, 1);
4343                                         context->cipher_spec_set = 1;
4344                                         DEBUG_PRINT
4345                                                 ("<= SENDING ENCRYPTED EXTENSIONS\n");
4346                                         tls_send_encrypted_extensions(context);
4347
4348                                         if (context->request_client_certificate) {
4349                                                 DEBUG_PRINT
4350                                                         ("<= SENDING CERTIFICATE REQUEST\n");
4351                                                 tls_queue_packet
4352                                                         (tls_certificate_request
4353                                                          (context));
4354                                         }
4355
4356                                         tls_send_certificate(context);
4357                                         tls_send_certificate_verify(context);
4358                                         tls_send_finished(context);
4359
4360                                         /* new key */
4361                                         free(context->server_finished_hash);
4362
4363                                         context->server_finished_hash =
4364                                                 malloc(tls_mac_length(context));
4365
4366                                         if (context->server_finished_hash) {
4367                                                 tls_get_hash(context,
4368                                                                 context->server_finished_hash);
4369                                         }
4370
4371                                         break;
4372                                 }
4373                                 tls_queue_packet(tls_build_hello(context, 0));
4374                                 DEBUG_PRINT("<= SENDING CERTIFICATE\n");
4375                                 tls_send_certificate(context);
4376
4377                                 int ephemeral_cipher =
4378                                         tls_cipher_is_ephemeral(context);
4379                                 if (ephemeral_cipher) {
4380                                         DEBUG_PRINT
4381                                                 ("<= SENDING EPHEMERAL DH KEY\n");
4382                                         tls_send_server_key_exchange(context,
4383                                                         ephemeral_cipher == 1 ?
4384                                                         KEA_dhe_rsa :
4385                                                         KEA_ec_diffie_hellman);
4386                                 }
4387                                 if (context->request_client_certificate) {
4388                                         DEBUG_PRINT
4389                                                 ("<= SENDING CERTIFICATE REQUEST\n");
4390                                         tls_queue_packet
4391                                                 (tls_certificate_request
4392                                                  (context));
4393                                 }
4394                                 tls_send_done(context);
4395                                 break;
4396                         case 3:
4397                                 /* finished */
4398                                 tls_send_change_cipher_spec(context);
4399                                 tls_send_finished(context);
4400                                 context->connection_status = TLS_CONNECTED;
4401                                 break;
4402                         case 4:
4403                                 /* dtls only */
4404                                 /* TODO error */
4405                                 break;
4406                         case 5:
4407                                 /* hello retry request */
4408                                 DEBUG_PRINT("<= SENDING HELLO RETRY REQUEST\n");
4409                                 pkt = tls_build_hello(context, 0);
4410                                 tls_queue_packet(pkt);
4411                                 break;
4412                 }
4413                 payload_size++;
4414                 buf += payload_size;
4415                 buf_len -= payload_size;
4416         }
4417         LEAVE;
4418         return orig_len;
4419 }
4420
4421 unsigned int asn1_get_len(const unsigned char *buffer, int buf_len,
4422                           unsigned int *octets) {
4423         *octets = 0;
4424
4425         if (buf_len < 1) {
4426                 return 0;
4427         }
4428
4429         unsigned char size = buffer[0];
4430         int i;
4431         if (size & 0x80) {
4432                 *octets = size & 0x7F;
4433                 if ((int) *octets > buf_len - 1) {
4434                         return 0;
4435                 }
4436                 /* max 32 bits */
4437                 unsigned int ref_octets = *octets;
4438                 if (*octets > 4) {
4439                         ref_octets = 4;
4440                 }
4441                 if ((int) *octets > buf_len - 1) {
4442                         return 0;
4443                 }
4444                 unsigned int long_size = 0;
4445                 unsigned int coef = 1;
4446
4447                 for (i = ref_octets; i > 0; i--) {
4448                         long_size += buffer[i] * coef;
4449                         coef *= 0x100;
4450                 }
4451                 ++*octets;
4452                 return long_size;
4453         }
4454         ++*octets;
4455         return size;
4456 }
4457
4458 void print_index(const unsigned int *fields) {
4459         int i = 0;
4460         while (fields[i]) {
4461                 if (i) {
4462                         DEBUG_PRINT(".");
4463                 }
4464                 DEBUG_PRINT("%i", fields[i]);
4465                 i++;
4466         }
4467         while (i < 6) {
4468                 DEBUG_PRINT("  ");
4469                 i++;
4470         }
4471 }
4472
4473 int _is_field(const unsigned int *fields, const unsigned int *prefix) {
4474         int i = 0;
4475         while (prefix[i]) {
4476                 if (fields[i] != prefix[i]) {
4477                         return 0;
4478                 }
4479                 i++;
4480         }
4481         return 1;
4482 }
4483
4484 static int tls_hash_len(int algorithm) {
4485         switch (algorithm) {
4486                 case TLS_RSA_SIGN_MD5:
4487                         return 16;
4488                 case TLS_RSA_SIGN_SHA1:
4489                         return 20;
4490                 case TLS_RSA_SIGN_SHA256:
4491                         return 32;
4492                 case TLS_RSA_SIGN_SHA384:
4493                         return 48;
4494                 case TLS_RSA_SIGN_SHA512:
4495                         return 64;
4496         }
4497         return 0;
4498 }
4499
4500 static unsigned char *tls_compute_hash(int algorithm, const unsigned char
4501                 *message, unsigned int message_len) {
4502         unsigned char *hash = NULL;
4503         int err;
4504         int hash_index = -1;
4505         unsigned long hash_len = 0;
4506
4507         if (!message || !message_len) {
4508                 return hash;
4509         }
4510
4511         switch (algorithm) {
4512                 case TLS_RSA_SIGN_MD5:
4513                         DEBUG_PRINT("SIGN MD5\n");
4514                         hash_index = find_hash("md5");
4515                         hash_len = 16;
4516                         break;
4517                 case TLS_RSA_SIGN_SHA1:
4518                         DEBUG_PRINT("SIGN SHA1\n");
4519                         hash_index = find_hash("sha1");
4520                         hash_len = 20;
4521                         break;
4522                 case TLS_RSA_SIGN_SHA256:
4523                         DEBUG_PRINT("SIGN SHA256\n");
4524                         hash_index = find_hash("sha256");
4525                         hash_len = 32;
4526                         break;
4527                 case TLS_RSA_SIGN_SHA384:
4528                         DEBUG_PRINT("SIGN SHA384\n");
4529                         hash_index = find_hash("sha384");
4530                         hash_len = 48;
4531                         break;
4532                 case TLS_RSA_SIGN_SHA512:
4533                         DEBUG_PRINT("SIGN SHA512\n");
4534                         hash_index = find_hash("sha512");
4535                         hash_len = 64;
4536                         break;
4537                 default:
4538                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4539                         return NULL;
4540                         break;
4541         }
4542
4543         hash = malloc(hash_len);
4544         if (!hash) {
4545                 return NULL;
4546         }
4547
4548         err = hash_memory(hash_index, message, message_len, hash, &hash_len);
4549         if (err) {
4550                 return NULL;
4551         }
4552         return hash;
4553 }
4554
4555 int tls_certificate_verify_signature(struct TLSCertificate *cert,
4556                                      struct TLSCertificate *parent) {
4557         if (!cert || !parent || !cert->sign_key
4558             || !cert->fingerprint || !cert->sign_len
4559             || !parent->der_bytes || !parent->der_len) {
4560                 DEBUG_PRINT("CANNOT VERIFY SIGNATURE ");
4561                 if (!cert) {
4562                         DEBUG_PRINT("!cert ");
4563                 } else {
4564                         if (!cert->sign_key) {
4565                                 DEBUG_PRINT("!cert->sign_key ");
4566                         }
4567                         if (!cert->fingerprint) {
4568                                 DEBUG_PRINT("!cert->fingerprint ");
4569                         }
4570                         if (!cert->sign_len) {
4571                                 DEBUG_PRINT("!cert->sign_len ");
4572                         }
4573                 }
4574
4575                 if (!parent) {
4576                         DEBUG_PRINT("!parent ");
4577                 } else {
4578                         if (!parent->der_bytes) {
4579                                 DEBUG_PRINT("!parent->der_bytes ");
4580                         }
4581                         if (!parent->der_len) {
4582                                 DEBUG_PRINT("!parent->der_len ");
4583                         }
4584                 }
4585                 DEBUG_PRINT("\n");
4586
4587                 return 0;
4588         }
4589         DEBUG_PRINT("checking alg\n");
4590         int hash_len = tls_hash_len(cert->algorithm);
4591         if (hash_len <= 0) {
4592                 return 0;
4593         }
4594
4595         int hash_index;
4596         switch (cert->algorithm) {
4597                 case TLS_RSA_SIGN_MD5:
4598                         hash_index = find_hash("md5");
4599                         break;
4600                 case TLS_RSA_SIGN_SHA1:
4601                         hash_index = find_hash("sha1");
4602                         break;
4603                 case TLS_RSA_SIGN_SHA256:
4604                         hash_index = find_hash("sha256");
4605                         break;
4606                 case TLS_RSA_SIGN_SHA384:
4607                         hash_index = find_hash("sha384");
4608                         break;
4609                 case TLS_RSA_SIGN_SHA512:
4610                         hash_index = find_hash("sha512");
4611                         break;
4612                 default:
4613                         DEBUG_PRINT("UNKNOWN SIGNATURE ALGORITHM\n");
4614                         return 0;
4615         }
4616
4617         rsa_key key;
4618         DEBUG_PRINTLN("rsa_import(%p, %d, %p)\n", parent->der_bytes,
4619                       parent->der_len, &key);
4620         int err = rsa_import(parent->der_bytes, parent->der_len, &key);
4621         if (err) {
4622                 DEBUG_PRINTLN
4623                     ("Error importing RSA certificate (code: %i)\n", err);
4624                 DEBUG_PRINT("Message: %s\n", error_to_string(err));
4625                 DEBUG_DUMP_HEX_LABEL("CERTIFICATE", parent->der_bytes,
4626                                      parent->der_len);
4627                 return 0;
4628         }
4629         int rsa_stat = 0;
4630         unsigned char *signature = cert->sign_key;
4631         int signature_len = cert->sign_len;
4632         if (!signature[0]) {
4633                 signature++;
4634                 signature_len--;
4635         }
4636
4637         err = rsa_verify_hash_ex(signature, signature_len, cert->fingerprint,
4638                         hash_len, LTC_PKCS_1_V1_5, hash_index, 0, &rsa_stat,
4639                         &key);
4640
4641         rsa_free(&key);
4642         if (err) {
4643                 DEBUG_PRINT("HASH VERIFY ERROR %i\n", err);
4644                 return 0;
4645         }
4646         DEBUG_PRINT("CERTIFICATE VALIDATION: %i\n", rsa_stat);
4647         return rsa_stat;
4648 }
4649
4650 int tls_certificate_chain_is_valid(struct TLSCertificate **certificates,
4651                                    int len) {
4652         if (!certificates || !len) {
4653                 return bad_certificate;
4654         }
4655
4656         int i;
4657         DEBUG_PRINT("verifying %i length cert chain\n", len);
4658         len--;
4659
4660         /* expired certificate or not yet valid ? */
4661         if (tls_certificate_is_valid(certificates[0])) {
4662                 return bad_certificate;
4663         }
4664
4665         /* check */
4666         for (i = 0; i < len; i++) {
4667                 /* certificate in chain is expired ? */
4668                 if (tls_certificate_is_valid(certificates[i + 1])) {
4669                         return bad_certificate;
4670                 }
4671
4672                 if (!tls_certificate_verify_signature(certificates[i],
4673                                         certificates[i + 1])) {
4674                         DEBUG_PRINT
4675                             ("tls_certificate_verify_signature certs[%d], certs[%d+1] failed\n",
4676                              i, i);
4677                         return bad_certificate;
4678                 }
4679
4680         }
4681         return 0;
4682 }
4683
4684 int tls_certificate_chain_is_valid_root(struct TLSContext *context, struct
4685                 TLSCertificate **certificates, int len) {
4686         int i, j;
4687
4688         if (!certificates || !len || !context->root_certificates
4689             || !context->root_count) {
4690                 return bad_certificate;
4691         }
4692         for (i = 0; i < len; i++) {
4693                 for (j = 0; j < context->root_count; j++) {
4694                         /* check if root certificate expired */
4695                         if (tls_certificate_is_valid
4696                             (context->root_certificates[j])) {
4697                                 continue;
4698                         }
4699                         /* if any root validates any certificate in the chain,
4700                          * then is root validated */
4701                         if (tls_certificate_verify_signature(certificates[i],
4702                                                 context->root_certificates[j]))
4703                         {
4704                                 return 0;
4705                         }
4706                 }
4707         }
4708         return bad_certificate;
4709 }
4710
4711 int _private_is_oid(struct OID_chain *ref_chain,
4712                     const unsigned char *looked_oid, int looked_oid_len) {
4713         while (ref_chain) {
4714                 if (ref_chain->oid) {
4715                         if (_is_oid2
4716                             (ref_chain->oid, looked_oid, 16,
4717                              looked_oid_len)) {
4718                                 return 1;
4719                         }
4720                 }
4721                 ref_chain = (struct OID_chain *) ref_chain->top;
4722         }
4723         return 0;
4724 }
4725
4726 int _private_asn1_parse(struct TLSContext *context,
4727                         struct TLSCertificate *cert,
4728                         const unsigned char *buffer, int size, int level,
4729                         unsigned int *fields, unsigned char *has_key,
4730                         int client_cert, unsigned char *top_oid,
4731                         struct OID_chain *chain) {
4732         struct OID_chain local_chain;
4733         DEBUG_INDEX(fields);
4734         DEBUG_PRINT("\n");
4735         local_chain.top = chain;
4736         int pos = 0;
4737         /* X.690 */
4738         int idx = 0;
4739         unsigned char oid[16];
4740         memset(oid, 0, 16);
4741         local_chain.oid = oid;
4742         if (has_key) {
4743                 *has_key = 0;
4744         }
4745         unsigned char local_has_key = 0;
4746         const unsigned char *cert_data = NULL;
4747         unsigned int cert_len = 0;
4748         while (pos < size) {
4749                 unsigned int start_pos = pos;
4750                 if (size - pos < 2) {
4751                         return TLS_NEED_MORE_DATA;
4752                 }
4753                 unsigned char first = buffer[pos++];
4754                 unsigned char type = first & 0x1F;
4755                 unsigned char constructed = first & 0x20;
4756                 unsigned char element_class = first >> 6;
4757                 int octets = 0;
4758                 unsigned int temp;
4759                 idx++;
4760                 if (level <= TLS_ASN1_MAXLEVEL) {
4761                         fields[level - 1] = idx;
4762                 }
4763                 DEBUG_INDEX(fields);
4764                 DEBUG_PRINT("\n");
4765                 int length = asn1_get_len((unsigned char *) &buffer[pos], size
4766                                 - pos, &octets);
4767                 DEBUG_PRINT("asn1_get_len = %u\n", length);
4768                 if ((octets > 4) || (octets > size - pos)) {
4769                         DEBUG_PRINT
4770                             ("CANNOT READ CERTIFICATE octets = %d, size = %d pos = %d, size - pos = %d\n",
4771                              octets, size, pos, size - pos);
4772                         return pos;
4773                 }
4774                 pos += octets;
4775
4776                 if (size - pos < length) {
4777                         return TLS_NEED_MORE_DATA;
4778                 }
4779
4780                 /*DEBUG_PRINT("FIRST: %x => %x (%i)\n", (int)first, (int)type, length); */
4781                 /* sequence */
4782                 /*DEBUG_PRINT("%2i: ", level); */
4783 #ifdef DEBUG
4784                 DEBUG_INDEX(fields);
4785                 int i1;
4786                 for (i1 = 1; i1 < level; i1++) {
4787                         DEBUG_PRINT("  ");
4788                 }
4789 #endif
4790
4791                 if (length && constructed) {
4792                         switch (type) {
4793                                 case 0x03:
4794                                         DEBUG_PRINT("CONSTRUCTED BITSTREAM\n");
4795                                         break;
4796                                 case 0x10:
4797                                 DEBUG_PRINT("SEQUENCE\n");
4798                                 if ((level == 2) && (idx == 1)) {
4799                                         cert_len =
4800                                             length + (pos - start_pos);
4801                                         cert_data = &buffer[start_pos];
4802                                 }
4803                                 /* private key on server or public key on client */
4804                                 if (!cert->version
4805                                     && (_is_field(fields, priv_der_id))) {
4806                                         free(cert->der_bytes);
4807                                         temp = length + (pos - start_pos);
4808                                         cert->der_bytes = malloc(temp);
4809                                         if (cert->der_bytes) {
4810                                                 memcpy(cert->der_bytes,
4811                                                        &buffer[start_pos],
4812                                                        temp);
4813                                                 cert->der_len = temp;
4814                                         } else
4815                                                 cert->der_len = 0;
4816                                 }
4817                                 break;
4818                         case 0x11:
4819                                 DEBUG_PRINT("EMBEDDED PDV\n");
4820                                 break;
4821                         case 0x00:
4822                                 if (element_class == 0x02) {
4823                                         DEBUG_PRINT("CONTEXT-SPECIFIC\n");
4824                                         break;
4825                                 }
4826                         default:
4827                                 DEBUG_PRINT("CONSTRUCT TYPE %02X\n",(int)type);
4828                         }
4829
4830                         local_has_key = 0;
4831                         _private_asn1_parse(context, cert, &buffer[pos],
4832                                             length, level + 1, fields,
4833                                             &local_has_key, client_cert,
4834                                             top_oid, &local_chain);
4835                         if (((local_has_key && context
4836                               && (!context->is_server || client_cert))
4837                              || !context)
4838                             && (_is_field(fields, pk_id))) {
4839                                 free(cert->der_bytes);
4840                                 temp = length + (pos - start_pos);
4841                                 cert->der_bytes = malloc(temp);
4842                                 if (cert->der_bytes) {
4843                                         memcpy(cert->der_bytes,
4844                                                &buffer[start_pos], temp);
4845                                         cert->der_len = temp;
4846                                 } else {
4847                                         cert->der_len = 0;
4848                                 }
4849                         }
4850                 } else {
4851                         switch (type) {
4852                         case 0x00:
4853                                 /* end of content */
4854                                 DEBUG_PRINT("END OF CONTENT\n");
4855                                 return pos;
4856                                 break;
4857                         case 0x01:
4858                                 /* boolean */
4859                                 temp = buffer[pos];
4860                                 DEBUG_PRINT("BOOLEAN: %i\n", temp);
4861                                 break;
4862                         case 0x02:
4863                                 /* integer */
4864                                 if (_is_field(fields, pk_id)) {
4865                                         if (has_key) {
4866                                                 *has_key = 1;
4867                                         }
4868
4869                                         if (idx == 1) {
4870                                                 tls_certificate_set_key
4871                                                     (cert, &buffer[pos],
4872                                                      length);
4873                                         } else if (idx == 2) {
4874                                                 tls_certificate_set_exponent
4875                                                     (cert, &buffer[pos],
4876                                                      length);
4877                                         }
4878                                 } else if (_is_field(fields, serial_id)) {
4879                                         tls_certificate_set_serial(cert,
4880                                                                    &buffer
4881                                                                    [pos],
4882                                                                    length);
4883                                 }
4884
4885                                 if (_is_field(fields, version_id)) {
4886                                         if (length == 1) {
4887                                                 cert->version =
4888                                                     buffer[pos];
4889                                         }
4890 #ifdef TLS_X509_V1_SUPPORT
4891                                         else {
4892                                                 cert->version = 0;
4893                                         }
4894                                         idx++;
4895 #endif
4896                                 }
4897                                 if (level >= 2) {
4898                                         unsigned int fields_temp[3];
4899                                         fields_temp[0] = fields[level - 2];
4900                                         fields_temp[1] = fields[level - 1];
4901                                         fields_temp[2] = 0;
4902                                         if (_is_field
4903                                             (fields_temp, priv_id)) {
4904                                                 tls_certificate_set_priv
4905                                                     (cert, &buffer[pos],
4906                                                      length);
4907                                         }
4908                                 }
4909                                 DEBUG_PRINT("INTEGER(%i): ", length);
4910                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4911                                 if ((chain) && (length > 2)) {
4912                                         if (_private_is_oid
4913                                             (chain, san_oid,
4914                                              sizeof(san_oid) - 1)) {
4915                                                 void *new;
4916
4917                                                 new =
4918                                                     TLS_REALLOC(cert->san,
4919                                                                 sizeof
4920                                                                 (unsigned
4921                                                                  char *) *
4922                                                                 (cert->
4923                                                                  san_length
4924                                                                  + 1));
4925                                                 if (new) {
4926                                                         cert->san = new;
4927                                                         cert->san[cert->
4928                                                                   san_length]
4929                                                             = NULL;
4930                                                         tls_certificate_set_copy
4931                                                             (&cert->
4932                                                              san[cert->
4933                                                                  san_length],
4934                                                              &buffer[pos],
4935                                                              length);
4936                                                         DEBUG_PRINT
4937                                                             (" => SUBJECT ALTERNATIVE NAME: %s",
4938                                                              cert->
4939                                                              san[cert->
4940                                                                  san_length]);
4941                                                         cert->san_length++;
4942                                                 } else {
4943                                                         free(cert->
4944                                                                  san);
4945                                                         cert->san = 0;
4946                                                         cert->san_length =
4947                                                             0;
4948                                                 }
4949                                         }
4950                                 }
4951                                 DEBUG_PRINT("\n");
4952                                 break;
4953                         case 0x03:
4954                                 if (_is_field(fields, pk_id)) {
4955                                         if (has_key)
4956                                                 *has_key = 1;
4957                                 }
4958                                 /* bitstream */
4959                                 DEBUG_PRINT("BITSTREAM(%i): ", length);
4960                                 DEBUG_DUMP_HEX(&buffer[pos], length);
4961                                 DEBUG_PRINT("\n");
4962                                 if (_is_field(fields, sign_id)
4963                                     || _is_field(fields, sign_id2)) {
4964                                         DEBUG_PRINT("set sign key\n");
4965                                         tls_certificate_set_sign_key(cert,
4966                                                                      &buffer
4967                                                                      [pos],
4968                                                                      length);
4969                                 } else if (cert->ec_algorithm
4970                                            && (_is_field(fields, pk_id))) {
4971                                         tls_certificate_set_key(cert,
4972                                                                 &buffer
4973                                                                 [pos],
4974                                                                 length);
4975                                 } else {
4976                                         if (buffer[pos] == 0x00
4977                                             && length > 256) {
4978                                                 _private_asn1_parse
4979                                                     (context, cert,
4980                                                      &buffer[pos] + 1,
4981                                                      length - 1, level + 1,
4982                                                      fields,
4983                                                      &local_has_key,
4984                                                      client_cert, top_oid,
4985                                                      &local_chain);
4986                                         } else {
4987                                                 _private_asn1_parse
4988                                                     (context, cert,
4989                                                      &buffer[pos], length,
4990                                                      level + 1, fields,
4991                                                      &local_has_key,
4992                                                      client_cert, top_oid,
4993                                                      &local_chain);
4994                                         }
4995
4996                                         if (top_oid) {
4997                                                 if (_is_oid2
4998                                                     (top_oid,
4999                                                      TLS_EC_prime256v1_OID,
5000                                                      sizeof(oid),
5001                                                      sizeof
5002                                                      (TLS_EC_prime256v1) -
5003                                                      1)) {
5004                                                         cert->
5005                                                             ec_algorithm =
5006                                                             secp256r1.iana;
5007                                                 } else
5008                                                     if (_is_oid2
5009                                                         (top_oid,
5010                                                          TLS_EC_secp224r1_OID,
5011                                                          sizeof(oid),
5012                                                          sizeof
5013                                                          (TLS_EC_secp224r1_OID)
5014                                                          - 1)) {
5015                                                         cert->
5016                                                             ec_algorithm =
5017                                                             secp224r1.iana;
5018                                                 } else
5019                                                     if (_is_oid2
5020                                                         (top_oid,
5021                                                          TLS_EC_secp384r1_OID,
5022                                                          sizeof(oid),
5023                                                          sizeof
5024                                                          (TLS_EC_secp384r1_OID)
5025                                                          - 1)) {
5026                                                         cert->
5027                                                             ec_algorithm =
5028                                                             secp384r1.iana;
5029                                                 } else
5030                                                     if (_is_oid2
5031                                                         (top_oid,
5032                                                          TLS_EC_secp521r1_OID,
5033                                                          sizeof(oid),
5034                                                          sizeof
5035                                                          (TLS_EC_secp521r1_OID)
5036                                                          - 1)) {
5037                                                         cert->
5038                                                             ec_algorithm =
5039                                                             secp521r1.iana;
5040                                                 }
5041                                                 if ((cert->ec_algorithm)
5042                                                     && (!cert->pk))
5043                                                         tls_certificate_set_key
5044                                                             (cert,
5045                                                              &buffer[pos],
5046                                                              length);
5047                                         }
5048                                 }
5049                                 break;
5050                         case 0x04:
5051                                 if (top_oid && _is_field(fields, ecc_priv_id)
5052                                                 && !cert->priv) {
5053                                         DEBUG_PRINT("BINARY STRING(%i): ",
5054                                                     length);
5055                                         DEBUG_DUMP_HEX(&buffer[pos],
5056                                                        length);
5057                                         DEBUG_PRINT("\n");
5058                                         tls_certificate_set_priv(cert,
5059                                                                  &buffer
5060                                                                  [pos],
5061                                                                  length);
5062                                 } else {
5063                                         _private_asn1_parse(context, cert,
5064                                                             &buffer[pos],
5065                                                             length,
5066                                                             level + 1,
5067                                                             fields,
5068                                                             &local_has_key,
5069                                                             client_cert,
5070                                                             top_oid,
5071                                                             &local_chain);
5072                                 }
5073                                 break;
5074                         case 0x05:
5075                                 DEBUG_PRINT("NULL\n");
5076                                 break;
5077                         case 0x06:
5078                                 /* object identifier */
5079                                 if (_is_field(fields, pk_id)) {
5080                                         if (length == 8 || length == 5) {
5081                                                 tls_certificate_set_algorithm
5082                                                     (&cert->ec_algorithm,
5083                                                      &buffer[pos], length);
5084                                         } else {
5085                                                 tls_certificate_set_algorithm
5086                                                     (&cert->key_algorithm,
5087                                                      &buffer[pos], length);
5088                                         }
5089                                 }
5090                                 if (_is_field(fields, algorithm_id))
5091                                         tls_certificate_set_algorithm
5092                                             (&cert->algorithm,
5093                                              &buffer[pos], length);
5094
5095                                 DEBUG_PRINT("OBJECT IDENTIFIER(%i): ", length);
5096                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5097                                 DEBUG_PRINT("\n");
5098                                 /* check previous oid */
5099                                 if (_is_oid2
5100                                     (oid, ocsp_oid, 16,
5101                                      sizeof(ocsp_oid) - 1))
5102                                         tls_certificate_set_copy(&cert->ocsp,
5103                                                                  &buffer[pos],
5104                                                                  length);
5105
5106                                 if (length < 16) {
5107                                         memcpy(oid, &buffer[pos], length);
5108                                 } else {
5109                                         memcpy(oid, &buffer[pos], 16);
5110                                 }
5111                                 if (top_oid)
5112                                         memcpy(top_oid, oid, 16);
5113                                 break;
5114                         case 0x09:
5115                                 DEBUG_PRINT("REAL NUMBER(%i): ", length);
5116                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5117                                 DEBUG_PRINT("\n");
5118                                 break;
5119                         case 0x17:
5120                                 /* utc time */
5121                                 DEBUG_PRINT("UTC TIME: [");
5122                                 DEBUG_DUMP(&buffer[pos], length);
5123                                 DEBUG_PRINT("]\n");
5124
5125                                 if (_is_field(fields, validity_id)) {
5126                                         if (idx == 1) {
5127                                                 tls_certificate_set_copy_date
5128                                                     (cert->not_before,
5129                                                      &buffer[pos], length);
5130                                         } else {
5131                                                 tls_certificate_set_copy_date
5132                                                     (cert->not_after,
5133                                                      &buffer[pos], length);
5134                                         }
5135                                 }
5136                                 break;
5137                         case 0x18:
5138                                 /* generalized time */
5139                                 DEBUG_PRINT("GENERALIZED TIME: [");
5140                                 DEBUG_DUMP(&buffer[pos], length);
5141                                 DEBUG_PRINT("]\n");
5142                                 break;
5143                         case 0x13:
5144                                 /* printable string */
5145                         case 0x0C:
5146                         case 0x14:
5147                         case 0x15:
5148                         case 0x16:
5149                         case 0x19:
5150                         case 0x1A:
5151                         case 0x1B:
5152                         case 0x1C:
5153                         case 0x1D:
5154                         case 0x1E:
5155                                 if (_is_field(fields, issurer_id)) {
5156                                         if (_is_oid(oid, country_oid, 3)) {
5157                                                 tls_certificate_set_copy
5158                                                     (&cert->issuer_country,
5159                                                      &buffer[pos], length);
5160                                         } else if (_is_oid
5161                                                  (oid, state_oid, 3)) {
5162                                                 tls_certificate_set_copy
5163                                                     (&cert->issuer_state,
5164                                                      &buffer[pos], length);
5165                                         } else if (_is_oid
5166                                                  (oid, location_oid, 3)) {
5167                                                 tls_certificate_set_copy
5168                                                     (&cert->
5169                                                      issuer_location,
5170                                                      &buffer[pos], length);
5171                                         } else if (_is_oid
5172                                                  (oid, entity_oid, 3)) {
5173                                                 tls_certificate_set_copy
5174                                                     (&cert->issuer_entity,
5175                                                      &buffer[pos], length);
5176                                         } else if (_is_oid
5177                                                  (oid, subject_oid, 3)) {
5178                                                 tls_certificate_set_copy
5179                                                     (&cert->issuer_subject,
5180                                                      &buffer[pos], length);
5181                                         }
5182                                 } else if (_is_field(fields, owner_id)) {
5183                                         if (_is_oid(oid, country_oid, 3)) {
5184                                                 tls_certificate_set_copy
5185                                                     (&cert->country,
5186                                                      &buffer[pos], length);
5187                                         } else if (_is_oid
5188                                                  (oid, state_oid, 3)) {
5189                                                 tls_certificate_set_copy
5190                                                     (&cert->state,
5191                                                      &buffer[pos], length);
5192                                         } else if (_is_oid
5193                                                  (oid, location_oid, 3)) {
5194                                                 tls_certificate_set_copy
5195                                                     (&cert->location,
5196                                                      &buffer[pos], length);
5197                                         } else if (_is_oid
5198                                                  (oid, entity_oid, 3)) {
5199                                                 tls_certificate_set_copy
5200                                                     (&cert->entity,
5201                                                      &buffer[pos], length);
5202                                         } else if (_is_oid
5203                                                  (oid, subject_oid, 3)) {
5204                                                 tls_certificate_set_copy
5205                                                     (&cert->subject,
5206                                                      &buffer[pos], length);
5207                                         }
5208                                 }
5209                                 DEBUG_PRINT("STR: [");
5210                                 DEBUG_DUMP(&buffer[pos], length);
5211                                 DEBUG_PRINT("]\n");
5212                                 break;
5213                         case 0x10:
5214                                 DEBUG_PRINT("EMPTY SEQUENCE\n");
5215                                 break;
5216                         case 0xA:
5217                                 DEBUG_PRINT("ENUMERATED(%i): ", length);
5218                                 DEBUG_DUMP_HEX(&buffer[pos], length);
5219                                 DEBUG_PRINT("\n");
5220                                 break;
5221                         default:
5222                                 DEBUG_PRINT("========> NOT SUPPORTED %x\n",
5223                                             (int) type);
5224                                 /* not supported / needed */
5225                                 break;
5226                         }
5227                 }
5228                 pos += length;
5229         }
5230
5231         if (cert_len && cert_data) {
5232                 int h = find_hash("sha256");
5233                 size_t len = sizeof cert->fp;
5234                 hash_memory(h, cert_data,cert_len, cert->fp, &len);
5235         }
5236
5237         if (level == 2 && cert->sign_key && cert->sign_len
5238             && cert_len && cert_data) {
5239                 free(cert->fingerprint);
5240                 cert->fingerprint = tls_compute_hash(cert->algorithm,
5241                                 cert_data, cert_len);
5242 #ifdef DEBUG
5243                 if (cert->fingerprint) {
5244                         DEBUG_DUMP_HEX_LABEL("FINGERPRINT",
5245                                              cert->fingerprint,
5246                                              tls_hash_len(cert->algorithm));
5247                 }
5248 #endif
5249         }
5250         return pos;
5251 }
5252
5253 struct TLSCertificate *asn1_parse(struct TLSContext *context,
5254                                   const unsigned char *buffer, int size,
5255                                   int client_cert) {
5256         unsigned int fields[TLS_ASN1_MAXLEVEL] = { 0 };
5257
5258         struct TLSCertificate *cert = tls_create_certificate();
5259
5260         if (cert) {
5261                 if (client_cert < 0) {
5262                         client_cert = 0;
5263                         /* private key */
5264                         unsigned char top_oid[16];
5265                         memset(top_oid, 0, sizeof(top_oid));
5266                         _private_asn1_parse(context, cert, buffer, size, 1,
5267                                             fields, NULL, client_cert,
5268                                             top_oid, NULL);
5269                 } else {
5270                         _private_asn1_parse(context, cert, buffer, size, 1,
5271                                             fields, NULL, client_cert,
5272                                             NULL, NULL);
5273                 }
5274         }
5275         return cert;
5276 }
5277
5278 int tls_clear_certificates(struct TLSContext *tls) {
5279         int i;
5280
5281         if (!tls || !tls->is_server || tls->is_child) {
5282                 return TLS_GENERIC_ERROR;
5283         }
5284
5285         if (tls->root_certificates) {
5286                 for (i = 0; i < tls->root_count; i++) {
5287                         tls_destroy_certificate(tls->root_certificates[i]);
5288                 }
5289         }
5290         tls->root_certificates = NULL;
5291         tls->root_count = 0;
5292
5293         if (tls->private_key) {
5294                 tls_destroy_certificate(tls->private_key);
5295         }
5296         tls->private_key = NULL;
5297         if (tls->ec_private_key) {
5298                 tls_destroy_certificate(tls->ec_private_key);
5299         }
5300         tls->ec_private_key = NULL;
5301         free(tls->certificates);
5302         tls->certificates = NULL;
5303         tls->certificates_count = 0;
5304         return 0;
5305 }
5306
5307 /* This is just a wrapper around parse message so we don't
5308  * call read more often than necessary.  IOW, if there's
5309  * more than one record in the input buffer, process them all
5310  */
5311 int tls_consume_stream(struct TLSContext *context) {
5312         if (!context) {
5313                 return TLS_GENERIC_ERROR;
5314         }
5315
5316         if (context->critical_error) {
5317                 return TLS_BROKEN_CONNECTION;
5318         }
5319
5320         size_t tls_buffer_len = context->input_buffer.len;
5321         unsigned char *buffer = context->input_buffer.buffer;
5322
5323         unsigned int index = 0;
5324         int err_flag = 0;
5325
5326         int tls_header_size;
5327         int tls_size_offset;
5328
5329         tls_size_offset = 3;
5330         tls_header_size = 5;
5331
5332         while (tls_buffer_len >= 5) {
5333                 uint16_t length;
5334
5335                 length = get16(buffer + index + tls_size_offset)
5336                     + tls_header_size;
5337
5338                 if (length > tls_buffer_len) {
5339                         /* record not complete */
5340                         break;
5341                 }
5342
5343                 /* This is the only place tls_parse_message is called */
5344                 int consumed = tls_parse_message(context, buffer+index, length);
5345                 if (consumed < 0) {
5346                         fprintf(stderr, "parse message error: %d\n", consumed);
5347                         err_flag = consumed;
5348                         break;
5349                 }
5350                 index += length;
5351                 tls_buffer_len -= length;
5352                 if (context->critical_error) {
5353                         err_flag = TLS_BROKEN_CONNECTION;
5354                         break;
5355                 }
5356         }
5357
5358         if (err_flag || context->input_buffer.error) {
5359                 if (!context->critical_error) {
5360                         context->critical_error = 1;
5361                 }
5362                 DEBUG_PRINT("ERROR IN CONSUME: %i\n", err_flag);
5363                 tls_buffer_free(&context->input_buffer);
5364                 return err_flag;
5365         }
5366         tls_buffer_shift(&context->input_buffer, index);
5367         return index;
5368 }
5369
5370 void tls_close_notify(struct TLSContext *context) {
5371         if (!context || context->critical_error) {
5372                 return;
5373         }
5374         context->critical_error = 1;
5375         DEBUG_PRINT("CLOSE\n");
5376         tls_alert(context, 0, close_notify);
5377 }
5378
5379 void tls_alert(struct TLSContext *context, int critical, int code) {
5380         if (!context) {
5381                 return;
5382         }
5383
5384         struct TLSPacket *packet = tls_create_packet(context, TLS_ALERT,
5385                         context->version, 0);
5386         tls_packet_uint8(packet, critical ? TLS_ALERT_CRITICAL :
5387                         TLS_ALERT_WARNING);
5388
5389         tls_packet_uint8(packet, code);
5390         tls_packet_update(packet);
5391
5392         if (critical) {
5393                 context->critical_error = 1;
5394         }
5395
5396         tls_queue_packet(packet);
5397 }
5398
5399 int tls_is_broken(struct TLSContext *context) {
5400         if (!context || context->critical_error) {
5401                 return 1;
5402         }
5403         return 0;
5404 }
5405
5406 /* TODO I don't see that this ever gets cleared */
5407 int tls_request_client_certificate(struct TLSContext *context) {
5408         if (!context || !context->is_server) {
5409                 return 0;
5410         }
5411
5412         context->request_client_certificate = 1;
5413         return 1;
5414 }
5415
5416 int tls_client_verified(struct TLSContext *context) {
5417         if (!context || context->critical_error) {
5418                 return 0;
5419         }
5420
5421         return context->client_verified == 1;
5422 }
5423
5424 int tls_sni_set(struct TLSContext *context, const char *sni) {
5425         if (!context || context->is_server || context->critical_error
5426             || context->connection_status != 0) {
5427                 return 0;
5428         }
5429
5430         free(context->sni);
5431         errno = 0;
5432         context->sni = sni ? strdup(sni) : 0;
5433         return context->sni ? 1 : 0;
5434 }
5435
5436 int tls_default_verify(struct TLSContext *context,
5437                        struct TLSCertificate **certificate_chain, int len)
5438 {
5439         int i;
5440         int err;
5441
5442         if (certificate_chain) {
5443                 for (i = 0; i < len; i++) {
5444                         struct TLSCertificate *certificate =
5445                             certificate_chain[i];
5446                         /* check validity date */
5447                         err = tls_certificate_is_valid(certificate);
5448                         if (err) {
5449                                 return err;
5450                         }
5451                 }
5452         }
5453         /* check if chain is valid */
5454         err = tls_certificate_chain_is_valid(certificate_chain, len);
5455         if (err) {
5456                 return err;
5457         }
5458
5459         /* check certificate subject */
5460         if (!context->is_server && context->sni && len > 0
5461             && certificate_chain) {
5462                 err = tls_certificate_valid_subject(certificate_chain[0],
5463                                 context->sni);
5464                 if (err) {
5465                         return err;
5466                 }
5467         }
5468
5469         err = tls_certificate_chain_is_valid_root(context, certificate_chain,
5470                                                 len);
5471         if (err) {
5472                 return err;
5473         }
5474
5475         DEBUG_PRINT("Certificate OK\n");
5476         return no_error;
5477 }
5478
5479 ssize_t tls_fsync(struct TLSContext *context) {
5480         size_t buflen = 0;
5481         size_t offset = 0;
5482         ssize_t send_res = 0;
5483         int fd;
5484         unsigned char *buffer;
5485         tls_send_func write_cb = NULL;
5486
5487         if (!context) {
5488                 return 0;
5489         }
5490
5491         fd = context->fd;
5492         if (fd < 0) {
5493                 return -1;
5494         }
5495
5496         buffer = context->output_buffer.buffer;
5497         buflen = context->output_buffer.len;
5498
5499         if (context->send) {
5500                 write_cb = context->send;
5501         } else {
5502                 write_cb = send;
5503         }
5504
5505         while (buflen > 0) {
5506                 ssize_t res;
5507                 errno = 0;
5508                 res = write_cb(fd, buffer+offset, buflen, 0);
5509                 if (res <= 0) {
5510                         perror("send error");
5511                         send_res = res;
5512                         break;
5513                 }
5514                 buflen -= res;
5515                 offset += res;
5516                 send_res += res;
5517         }
5518         DEBUG_PRINT("sent %zd bytes\n", send_res);
5519         context->output_buffer.len = 0;
5520         return send_res;
5521 }
5522
5523 void tls_free(struct TLSContext *context) {
5524         if (context) {
5525                 free(context->user_data);
5526                 tls_destroy_context(context);
5527         }
5528 }
5529
5530 int tls_set_fd(struct TLSContext *context, int socket) {
5531         if (!context) {
5532                 return TLS_GENERIC_ERROR;
5533         }
5534         context->fd = socket;
5535         return 0;
5536 }
5537
5538 int tls_load_root_file(struct TLSContext *context, const char *pem_filename) {
5539         int fd;
5540         struct stat st;
5541         void *addr;
5542
5543         if (!context) {
5544                 return -1;
5545         }
5546
5547         int count = -1;
5548
5549         fd = open(pem_filename, O_RDONLY);
5550         if (fd == -1) {
5551                 return -1;
5552         }
5553
5554         if (fstat(fd, &st) == -1) {
5555                 close(fd);
5556                 return -1;
5557         }
5558
5559         addr = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
5560         if (addr == MAP_FAILED) {
5561                 close(fd);
5562                 return -1;
5563         }
5564
5565         count = tls_load_root_certificates(context, addr, st.st_size);
5566         munmap(addr, st.st_size);
5567         close(fd);
5568
5569         return count;
5570 }
5571
5572 void tls_set_verify(struct TLSContext *tls, tls_validation_function vfunc) {
5573         if (tls) {
5574                 tls->certificate_verify = vfunc;
5575         }
5576 }
5577
5578 static ssize_t tls_safe_read(struct TLSContext *tls) {
5579         tls_recv_func read_cb;
5580         char buffer[8192];
5581         ssize_t bytes;
5582
5583         if (!tls || tls->fd <= 0) {
5584                 return TLS_GENERIC_ERROR;
5585         }
5586
5587         if (tls->recv) {
5588                 read_cb = tls->recv;
5589         } else {
5590                 read_cb = recv;
5591         }
5592
5593         errno = 0;
5594         bytes = read_cb(tls->fd, buffer, sizeof buffer, 0);
5595         if (bytes > 0) {
5596                 tls_buffer_append(&tls->input_buffer, buffer, bytes);
5597         }
5598
5599         return bytes;
5600 }
5601
5602 /* I think this is the server handshake */
5603 int SSL_accept(struct TLSContext *context) {
5604         ssize_t read_size = 0;
5605
5606         if (!context || context->fd <= 0) {
5607                 return TLS_GENERIC_ERROR;
5608         }
5609
5610         if (tls_established(context)) {
5611                 return 1;
5612         }
5613
5614         /* accept */
5615         while ((read_size = tls_safe_read(context)) > 0) {
5616                 if (tls_consume_stream(context) >= 0) {
5617                         ssize_t res = tls_fsync(context);
5618                         if (res < 0) {
5619                                 return res;
5620                         }
5621                 }
5622                 if (tls_established(context)) {
5623                         return 1;
5624                 }
5625         }
5626         if (read_size <= 0) {
5627                 return TLS_BROKEN_CONNECTION;
5628         }
5629         return 0;
5630 }
5631
5632 /* TODO this is really do the handshake */
5633 int tls_connect(struct TLSContext *context) {
5634         int res;
5635         ssize_t read_size;
5636
5637         MARK;
5638         if (!context || context->fd < 0 || context->critical_error) {
5639                 if (!context) {
5640                         MARK;
5641                 } else if (context->fd < 0) {
5642                         MARK;
5643                 } else {
5644                         MARK;
5645                 }
5646
5647                 return TLS_GENERIC_ERROR;
5648         }
5649
5650         MARK;
5651         if (context->is_server) {
5652                 return TLS_UNEXPECTED_MESSAGE;
5653         }
5654         MARK;
5655
5656         res = tls_queue_packet(tls_build_client_hello(context));
5657
5658         MARK;
5659         if (res < 0) {
5660                 return res;
5661         }
5662
5663         MARK;
5664         res = tls_fsync(context);
5665         MARK;
5666         if (res < 0) {
5667                 return res;
5668         }
5669
5670         while ((read_size = tls_safe_read(context)) > 0) {
5671                 if ((res = tls_consume_stream(context)) >= 0) {
5672                         res = tls_fsync(context);
5673                         if (res < 0) {
5674                                 return res;
5675                         }
5676                 }
5677         MARK;
5678                 if (tls_established(context)) {
5679                         MARK;
5680                         return 1;
5681                 }
5682         MARK;
5683                 if (context->critical_error) {
5684                         fprintf(stderr, "critical error: %d\n",
5685                                         context->critical_error);
5686                         return TLS_GENERIC_ERROR;
5687                 }
5688         }
5689         MARK;
5690         return read_size;
5691 }
5692
5693 int tls_shutdown(struct TLSContext *tls) {
5694         if (!tls || tls->fd <= 0) {
5695                 return TLS_GENERIC_ERROR;
5696         }
5697
5698         tls_close_notify(tls);
5699         return 0;
5700 }
5701
5702 /* TODO configure for maximum packet data length
5703  * max is 2^14 - 5 byte header - 32 byte mac - padding which depends
5704  * on the cipher (up to 255 bytes I think).
5705  */
5706 ssize_t tls_write(struct TLSContext *context, const void *buf, size_t count) {
5707         if (!context) {
5708                 return TLS_GENERIC_ERROR;
5709         }
5710         if (context->connection_status != TLS_CONNECTED) {
5711                 return TLS_UNEXPECTED_MESSAGE;
5712         }
5713         if (count > TLS_MAXTLS_APP_SIZE) {
5714                 count = TLS_MAXTLS_APP_SIZE;
5715         }
5716
5717         if (!buf || !count) {
5718                 return 0;
5719         }
5720
5721         struct TLSPacket *packet = tls_create_packet(context,
5722                         TLS_APPLICATION_DATA, context->version, count);
5723         tls_packet_append(packet, buf, count);
5724         tls_packet_update(packet);
5725
5726         tls_queue_packet(packet);
5727         /* TODO think about this.  context->sync with O_NONBLOCK might be a
5728          * problem
5729          */
5730         if (context->sync) {
5731                 ssize_t res;
5732                 res = tls_fsync(context);
5733                 if (res == -1) {
5734                         return res;
5735                 }
5736         }
5737         return count;
5738 }
5739
5740 static ssize_t tls_readbuf(struct TLSContext *tls, void *buf, size_t count) {
5741         if (count > tls->application_buffer.len) {
5742                 count = tls->application_buffer.len;
5743         }
5744
5745         if (count > 0) {
5746                 /* TODO should have a buffer read and shift */
5747                 memcpy(buf, tls->application_buffer.buffer, count);
5748                 tls_buffer_shift(&tls->application_buffer, count);
5749         }
5750
5751         return count;
5752 }
5753
5754 ssize_t tls_read(struct TLSContext *context, void *buf, size_t count) {
5755         if (!context) {
5756                 return TLS_GENERIC_ERROR;
5757         }
5758
5759         if (context->application_buffer.len) {
5760                 return tls_readbuf(context, buf, count);
5761         }
5762
5763         if (context->fd <= 0 || context->critical_error) {
5764                 return TLS_GENERIC_ERROR;
5765         }
5766
5767         if (!tls_established(context)) {
5768                 return TLS_GENERIC_ERROR;
5769         }
5770
5771         if (context->application_buffer.len == 0 && !context->critical_error) {
5772                 /* attempt to fill buffer, unless we're already in an error
5773                  * state
5774                  */
5775                 ssize_t read_size;
5776
5777                 while ((read_size = tls_safe_read(context)) > 0) {
5778                         if (tls_consume_stream(context) > 0) {
5779                                 tls_fsync(context);
5780                                 break;
5781                         }
5782                         if (context->critical_error
5783                             && !context->application_buffer.len) {
5784                                 /* if there's a critical error, don't bail if
5785                                  * we managed to get some data
5786                                  */
5787                                 return TLS_GENERIC_ERROR;
5788                         }
5789                 }
5790
5791                 if (read_size <= 0 && context->application_buffer.len == 0) {
5792                         /* can return errors as for read(2) */
5793                         return read_size;
5794                 }
5795         }
5796
5797         return tls_readbuf(context, buf, count);
5798 }