Subversion Repositories planix.SVN

Rev

Rev 33 | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
2 - 1 
#include <u.h>
2 
#include <libc.h>
3 
#include <auth.h>
4 
#include <mp.h>
5 
#include <libsec.h>
6 
 
7 
// The main groups of functions are:
8 
//		client/server - main handshake protocol definition
9 
//		message functions - formating handshake messages
10 
//		cipher choices - catalog of digest and encrypt algorithms
11 
//		security functions - PKCS#1, sslHMAC, session keygen
12 
//		general utility functions - malloc, serialization
13 
// The handshake protocol builds on the TLS/SSL3 record layer protocol,
14 
// which is implemented in kernel device #a.  See also /lib/rfc/rfc2246.
15 
 
16 
enum {
17 
	TLSFinishedLen = 12,
18 
	SSL3FinishedLen = MD5dlen+SHA1dlen,
33 7u83 19 
	MaxKeyData = 160,	// amount of secret we may need
20 
	MAXdlen = SHA2_512dlen,
2 - 21 
	RandomSize = 32,
22 
	MasterSecretSize = 48,
23 
	AQueue = 0,
24 
	AFlush = 1,
25 
};
26 
 
27 
typedef struct Bytes{
28 
	int len;
33 7u83 29 
	uchar data[];
2 - 30 
} Bytes;
31 
 
32 
typedef struct Ints{
33 
	int len;
33 7u83 34 
	int data[];
2 - 35 
} Ints;
36 
 
37 
typedef struct Algs{
38 
	char *enc;
39 
	char *digest;
40 
	int nsecret;
41 
	int tlsid;
42 
	int ok;
43 
} Algs;
44 
 
33 7u83 45 
typedef struct Namedcurve{
46 
	int tlsid;
47 
	void (*init)(mpint *p, mpint *a, mpint *b, mpint *x, mpint *y, mpint *n, mpint *h);
48 
} Namedcurve;
49 
 
2 - 50 
typedef struct Finished{
51 
	uchar verify[SSL3FinishedLen];
52 
	int n;
53 
} Finished;
54 
 
33 7u83 55 
typedef struct HandshakeHash {
56 
	MD5state	md5;
57 
	SHAstate	sha1;
58 
	SHA2_256state	sha2_256;
59 
} HandshakeHash;
60 
 
61 
typedef struct TlsSec TlsSec;
62 
struct TlsSec {
63 
	RSApub *rsapub;
64 
	AuthRpc *rpc;	// factotum for rsa private key
65 
	uchar *psk;	// pre-shared key
66 
	int psklen;
67 
	int clientVers;			// version in ClientHello
68 
	uchar sec[MasterSecretSize];	// master secret
69 
	uchar crandom[RandomSize];	// client random
70 
	uchar srandom[RandomSize];	// server random
71 
 
72 
	// diffie hellman state
73 
	DHstate dh;
74 
	struct {
75 
		ECdomain dom;
76 
		ECpriv Q;
77 
	} ec;
78 
 
79 
	// byte generation and handshake checksum
80 
	void (*prf)(uchar*, int, uchar*, int, char*, uchar*, int, uchar*, int);
81 
	void (*setFinished)(TlsSec*, HandshakeHash, uchar*, int);
82 
	int nfin;
83 
};
84 
 
2 - 85 
typedef struct TlsConnection{
33 7u83 86 
	TlsSec sec[1];	// security management goo
2 - 87 
	int hand, ctl;	// record layer file descriptors
88 
	int erred;		// set when tlsError called
89 
	int (*trace)(char*fmt, ...); // for debugging
90 
	int version;	// protocol we are speaking
33 7u83 91 
	Bytes *cert;	// server certificate; only last - no chain
2 - 92 
 
33 7u83 93 
	int cipher;
94 
	int nsecret;	// amount of secret data to init keys
2 - 95 
	char *digest;	// name of digest algorithm to use
33 7u83 96 
	char *enc;	// name of encryption algorithm to use
2 - 97 
 
98 
	// for finished messages
33 7u83 99 
	HandshakeHash	handhash;
2 - 100 
	Finished	finished;
33 7u83 101 
 
102 
	uchar *sendp;
103 
	uchar buf[1<<16];
2 - 104 
} TlsConnection;
105 
 
106 
typedef struct Msg{
107 
	int tag;
108 
	union {
109 
		struct {
110 
			int version;
111 
			uchar 	random[RandomSize];
112 
			Bytes*	sid;
113 
			Ints*	ciphers;
114 
			Bytes*	compressors;
33 7u83 115 
			Bytes*	extensions;
2 - 116 
		} clientHello;
117 
		struct {
118 
			int version;
33 7u83 119 
			uchar	random[RandomSize];
2 - 120 
			Bytes*	sid;
33 7u83 121 
			int	cipher;
122 
			int	compressor;
123 
			Bytes*	extensions;
2 - 124 
		} serverHello;
125 
		struct {
126 
			int ncert;
127 
			Bytes **certs;
128 
		} certificate;
129 
		struct {
130 
			Bytes *types;
33 7u83 131 
			Ints *sigalgs;
2 - 132 
			int nca;
133 
			Bytes **cas;
134 
		} certificateRequest;
135 
		struct {
33 7u83 136 
			Bytes *pskid;
2 - 137 
			Bytes *key;
138 
		} clientKeyExchange;
33 7u83 139 
		struct {
140 
			Bytes *pskid;
141 
			Bytes *dh_p;
142 
			Bytes *dh_g;
143 
			Bytes *dh_Ys;
144 
			Bytes *dh_parameters;
145 
			Bytes *dh_signature;
146 
			int sigalg;
147 
			int curve;
148 
		} serverKeyExchange;
149 
		struct {
150 
			int sigalg;
151 
			Bytes *signature;
152 
		} certificateVerify;
2 - 153 
		Finished finished;
154 
	} u;
155 
} Msg;
156 
 
157 
 
158 
enum {
33 7u83 159 
	SSL3Version	= 0x0300,
160 
	TLS10Version	= 0x0301,
161 
	TLS11Version	= 0x0302,
162 
	TLS12Version	= 0x0303,
163 
	ProtocolVersion	= TLS12Version,	// maximum version we speak
164 
	MinProtoVersion	= 0x0300,	// limits on version we accept
2 - 165 
	MaxProtoVersion	= 0x03ff,
166 
};
167 
 
168 
// handshake type
169 
enum {
170 
	HHelloRequest,
171 
	HClientHello,
172 
	HServerHello,
173 
	HSSL2ClientHello = 9,  /* local convention;  see devtls.c */
174 
	HCertificate = 11,
175 
	HServerKeyExchange,
176 
	HCertificateRequest,
177 
	HServerHelloDone,
178 
	HCertificateVerify,
179 
	HClientKeyExchange,
180 
	HFinished = 20,
181 
	HMax
182 
};
183 
 
184 
// alerts
185 
enum {
186 
	ECloseNotify = 0,
187 
	EUnexpectedMessage = 10,
188 
	EBadRecordMac = 20,
189 
	EDecryptionFailed = 21,
190 
	ERecordOverflow = 22,
191 
	EDecompressionFailure = 30,
192 
	EHandshakeFailure = 40,
193 
	ENoCertificate = 41,
194 
	EBadCertificate = 42,
195 
	EUnsupportedCertificate = 43,
196 
	ECertificateRevoked = 44,
197 
	ECertificateExpired = 45,
198 
	ECertificateUnknown = 46,
199 
	EIllegalParameter = 47,
200 
	EUnknownCa = 48,
201 
	EAccessDenied = 49,
202 
	EDecodeError = 50,
203 
	EDecryptError = 51,
204 
	EExportRestriction = 60,
205 
	EProtocolVersion = 70,
206 
	EInsufficientSecurity = 71,
207 
	EInternalError = 80,
33 7u83 208 
	EInappropriateFallback = 86,
2 - 209 
	EUserCanceled = 90,
210 
	ENoRenegotiation = 100,
33 7u83 211 
	EUnknownPSKidentity = 115,
2 - 212 
	EMax = 256
213 
};
214 
 
215 
// cipher suites
216 
enum {
33 7u83 217 
	TLS_NULL_WITH_NULL_NULL			= 0x0000,
218 
	TLS_RSA_WITH_NULL_MD5			= 0x0001,
219 
	TLS_RSA_WITH_NULL_SHA			= 0x0002,
220 
	TLS_RSA_EXPORT_WITH_RC4_40_MD5		= 0x0003,
221 
	TLS_RSA_WITH_RC4_128_MD5		= 0x0004,
222 
	TLS_RSA_WITH_RC4_128_SHA		= 0x0005,
2 - 223 
	TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5	= 0X0006,
33 7u83 224 
	TLS_RSA_WITH_IDEA_CBC_SHA		= 0X0007,
2 - 225 
	TLS_RSA_EXPORT_WITH_DES40_CBC_SHA	= 0X0008,
226 
	TLS_RSA_WITH_DES_CBC_SHA		= 0X0009,
227 
	TLS_RSA_WITH_3DES_EDE_CBC_SHA		= 0X000A,
228 
	TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA	= 0X000B,
229 
	TLS_DH_DSS_WITH_DES_CBC_SHA		= 0X000C,
230 
	TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA	= 0X000D,
231 
	TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA	= 0X000E,
232 
	TLS_DH_RSA_WITH_DES_CBC_SHA		= 0X000F,
233 
	TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA	= 0X0010,
234 
	TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA	= 0X0011,
235 
	TLS_DHE_DSS_WITH_DES_CBC_SHA		= 0X0012,
236 
	TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA	= 0X0013,	// ZZZ must be implemented for tls1.0 compliance
237 
	TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA	= 0X0014,
238 
	TLS_DHE_RSA_WITH_DES_CBC_SHA		= 0X0015,
239 
	TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA	= 0X0016,
240 
	TLS_DH_anon_EXPORT_WITH_RC4_40_MD5	= 0x0017,
33 7u83 241 
	TLS_DH_anon_WITH_RC4_128_MD5		= 0x0018,
2 - 242 
	TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA	= 0X0019,
243 
	TLS_DH_anon_WITH_DES_CBC_SHA		= 0X001A,
244 
	TLS_DH_anon_WITH_3DES_EDE_CBC_SHA	= 0X001B,
33 7u83 245 
	TLS_RSA_WITH_AES_128_CBC_SHA		= 0X002F,	// aes, aka rijndael with 128 bit blocks
2 - 246 
	TLS_DH_DSS_WITH_AES_128_CBC_SHA		= 0X0030,
247 
	TLS_DH_RSA_WITH_AES_128_CBC_SHA		= 0X0031,
248 
	TLS_DHE_DSS_WITH_AES_128_CBC_SHA	= 0X0032,
249 
	TLS_DHE_RSA_WITH_AES_128_CBC_SHA	= 0X0033,
250 
	TLS_DH_anon_WITH_AES_128_CBC_SHA	= 0X0034,
251 
	TLS_RSA_WITH_AES_256_CBC_SHA		= 0X0035,
252 
	TLS_DH_DSS_WITH_AES_256_CBC_SHA		= 0X0036,
253 
	TLS_DH_RSA_WITH_AES_256_CBC_SHA		= 0X0037,
254 
	TLS_DHE_DSS_WITH_AES_256_CBC_SHA	= 0X0038,
255 
	TLS_DHE_RSA_WITH_AES_256_CBC_SHA	= 0X0039,
256 
	TLS_DH_anon_WITH_AES_256_CBC_SHA	= 0X003A,
33 7u83 257 
	TLS_RSA_WITH_AES_128_CBC_SHA256		= 0X003C,
258 
	TLS_RSA_WITH_AES_256_CBC_SHA256		= 0X003D,
259 
	TLS_DHE_RSA_WITH_AES_128_CBC_SHA256	= 0X0067,
260 
 
261 
	TLS_RSA_WITH_AES_128_GCM_SHA256		= 0x009C,
262 
	TLS_RSA_WITH_AES_256_GCM_SHA384		= 0x009D,
263 
	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	= 0x009E,
264 
	TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	= 0x009F,
265 
	TLS_DH_RSA_WITH_AES_128_GCM_SHA256	= 0x00A0,
266 
	TLS_DH_RSA_WITH_AES_256_GCM_SHA384	= 0x00A1,
267 
	TLS_DHE_DSS_WITH_AES_128_GCM_SHA256	= 0x00A2,
268 
	TLS_DHE_DSS_WITH_AES_256_GCM_SHA384	= 0x00A3,
269 
	TLS_DH_DSS_WITH_AES_128_GCM_SHA256	= 0x00A4,
270 
	TLS_DH_DSS_WITH_AES_256_GCM_SHA384	= 0x00A5,
271 
	TLS_DH_anon_WITH_AES_128_GCM_SHA256	= 0x00A6,
272 
	TLS_DH_anon_WITH_AES_256_GCM_SHA384	= 0x00A7,
273 
 
274 
	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02B,
275 
	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	= 0xC02F,
276 
 
277 
	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	= 0xC013,
278 
	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	= 0xC014,
279 
	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	= 0xC027,
280 
	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	= 0xC023,
281 
 
282 
	TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305	= 0xCCA8,
283 
	TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305	= 0xCCA9,
284 
	TLS_DHE_RSA_WITH_CHACHA20_POLY1305	= 0xCCAA,
285 
 
286 
	GOOGLE_ECDHE_RSA_WITH_CHACHA20_POLY1305		= 0xCC13,
287 
	GOOGLE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305	= 0xCC14,
288 
	GOOGLE_DHE_RSA_WITH_CHACHA20_POLY1305		= 0xCC15,
289 
 
290 
	TLS_PSK_WITH_CHACHA20_POLY1305		= 0xCCAB,
291 
	TLS_PSK_WITH_AES_128_CBC_SHA256		= 0x00AE,
292 
	TLS_PSK_WITH_AES_128_CBC_SHA		= 0x008C,
293 
 
294 
	TLS_FALLBACK_SCSV = 0x5600,
2 - 295 
};
296 
 
297 
// compression methods
298 
enum {
299 
	CompressionNull = 0,
300 
	CompressionMax
301 
};
302 
 
303 
static Algs cipherAlgs[] = {
33 7u83 304 
	// ECDHE-ECDSA
305 
	{"ccpoly96_aead", "clear", 2*(32+12), TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305},
306 
	{"ccpoly64_aead", "clear", 2*32, GOOGLE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305},
307 
	{"aes_128_gcm_aead", "clear", 2*(16+4), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
308 
	{"aes_128_cbc", "sha256", 2*(16+16+SHA2_256dlen), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
309 
 
310 
	// ECDHE-RSA
311 
	{"ccpoly96_aead", "clear", 2*(32+12), TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305},
312 
	{"ccpoly64_aead", "clear", 2*32, GOOGLE_ECDHE_RSA_WITH_CHACHA20_POLY1305},
313 
	{"aes_128_gcm_aead", "clear", 2*(16+4), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
314 
	{"aes_128_cbc", "sha256", 2*(16+16+SHA2_256dlen), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
315 
	{"aes_128_cbc", "sha1", 2*(16+16+SHA1dlen), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA},
316 
	{"aes_256_cbc", "sha1", 2*(32+16+SHA1dlen), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA},
317 
 
318 
	// DHE-RSA
319 
	{"ccpoly96_aead", "clear", 2*(32+12), TLS_DHE_RSA_WITH_CHACHA20_POLY1305},
320 
	{"ccpoly64_aead", "clear", 2*32, GOOGLE_DHE_RSA_WITH_CHACHA20_POLY1305},
321 
	{"aes_128_gcm_aead", "clear", 2*(16+4), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
322 
	{"aes_128_cbc", "sha256", 2*(16+16+SHA2_256dlen), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256},
323 
	{"aes_128_cbc", "sha1", 2*(16+16+SHA1dlen), TLS_DHE_RSA_WITH_AES_128_CBC_SHA},
324 
	{"aes_256_cbc", "sha1", 2*(32+16+SHA1dlen), TLS_DHE_RSA_WITH_AES_256_CBC_SHA},
325 
	{"3des_ede_cbc","sha1",	2*(4*8+SHA1dlen), TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA},
326 
 
327 
	// RSA
328 
	{"aes_128_gcm_aead", "clear", 2*(16+4), TLS_RSA_WITH_AES_128_GCM_SHA256},
329 
	{"aes_128_cbc", "sha256", 2*(16+16+SHA2_256dlen), TLS_RSA_WITH_AES_128_CBC_SHA256},
330 
	{"aes_256_cbc", "sha256", 2*(32+16+SHA2_256dlen), TLS_RSA_WITH_AES_256_CBC_SHA256},
2 - 331 
	{"aes_128_cbc", "sha1", 2*(16+16+SHA1dlen), TLS_RSA_WITH_AES_128_CBC_SHA},
33 7u83 332 
	{"aes_256_cbc", "sha1", 2*(32+16+SHA1dlen), TLS_RSA_WITH_AES_256_CBC_SHA},
333 
	{"3des_ede_cbc","sha1",	2*(4*8+SHA1dlen), TLS_RSA_WITH_3DES_EDE_CBC_SHA},
334 
 
335 
	// PSK
336 
	{"ccpoly96_aead", "clear", 2*(32+12), TLS_PSK_WITH_CHACHA20_POLY1305},
337 
	{"aes_128_cbc", "sha256", 2*(16+16+SHA2_256dlen), TLS_PSK_WITH_AES_128_CBC_SHA256},
338 
	{"aes_128_cbc", "sha1", 2*(16+16+SHA1dlen), TLS_PSK_WITH_AES_128_CBC_SHA},
2 - 339 
};
340 
 
341 
static uchar compressors[] = {
342 
	CompressionNull,
343 
};
344 
 
33 7u83 345 
static Namedcurve namedcurves[] = {
346 
	0x0017, secp256r1,
347 
	0x0018, secp384r1,
348 
};
2 - 349 
 
33 7u83 350 
static uchar pointformats[] = {
351 
	CompressionNull /* support of uncompressed point format is mandatory */
352 
};
353 
 
354 
static struct {
355 
	DigestState* (*fun)(uchar*, ulong, uchar*, DigestState*);
356 
	int len;
357 
} hashfun[] = {
358 
/*	[0x00]  is reserved for MD5+SHA1 for < TLS1.2 */
359 
	[0x01]	{md5,		MD5dlen},
360 
	[0x02]	{sha1,		SHA1dlen},
361 
	[0x03]	{sha2_224,	SHA2_224dlen},
362 
	[0x04]	{sha2_256,	SHA2_256dlen},
363 
	[0x05]	{sha2_384,	SHA2_384dlen},
364 
	[0x06]	{sha2_512,	SHA2_512dlen},
365 
};
366 
 
367 
// signature algorithms (only RSA and ECDSA at the moment)
368 
static int sigalgs[] = {
369 
	0x0603,		/* SHA512 ECDSA */
370 
	0x0503,		/* SHA384 ECDSA */
371 
	0x0403,		/* SHA256 ECDSA */
372 
	0x0203,		/* SHA1 ECDSA */
373 
 
374 
	0x0601,		/* SHA512 RSA */
375 
	0x0501,		/* SHA384 RSA */
376 
	0x0401,		/* SHA256 RSA */
377 
	0x0201,		/* SHA1 RSA */
378 
};
379 
 
380 
static TlsConnection *tlsServer2(int ctl, int hand,
381 
	uchar *cert, int certlen,
382 
	char *pskid, uchar *psk, int psklen,
383 
	int (*trace)(char*fmt, ...), PEMChain *chain);
384 
static TlsConnection *tlsClient2(int ctl, int hand,
385 
	uchar *cert, int certlen,
386 
	char *pskid, uchar *psk, int psklen,
387 
	uchar *ext, int extlen, int (*trace)(char*fmt, ...));
2 - 388 
static void	msgClear(Msg *m);
389 
static char* msgPrint(char *buf, int n, Msg *m);
390 
static int	msgRecv(TlsConnection *c, Msg *m);
391 
static int	msgSend(TlsConnection *c, Msg *m, int act);
392 
static void	tlsError(TlsConnection *c, int err, char *msg, ...);
393 
#pragma	varargck argpos	tlsError 3
394 
static int setVersion(TlsConnection *c, int version);
33 7u83 395 
static int setSecrets(TlsConnection *c, int isclient);
2 - 396 
static int finishedMatch(TlsConnection *c, Finished *f);
397 
static void tlsConnectionFree(TlsConnection *c);
398 
 
33 7u83 399 
static int isDHE(int tlsid);
400 
static int isECDHE(int tlsid);
401 
static int isPSK(int tlsid);
402 
static int isECDSA(int tlsid);
403 
 
2 - 404 
static int setAlgs(TlsConnection *c, int a);
33 7u83 405 
static int okCipher(Ints *cv, int ispsk);
2 - 406 
static int okCompression(Bytes *cv);
407 
static int initCiphers(void);
33 7u83 408 
static Ints* makeciphers(int ispsk);
2 - 409 
 
33 7u83 410 
static AuthRpc* factotum_rsa_open(RSApub *rsapub);
411 
static mpint* factotum_rsa_decrypt(AuthRpc *rpc, mpint *cipher);
412 
static void factotum_rsa_close(AuthRpc *rpc);
413 
 
414 
static void	tlsSecInits(TlsSec *sec, int cvers, uchar *crandom);
415 
static int	tlsSecRSAs(TlsSec *sec, Bytes *epm);
416 
static Bytes*	tlsSecECDHEs1(TlsSec *sec, Namedcurve *nc);
417 
static int	tlsSecECDHEs2(TlsSec *sec, Bytes *Yc);
418 
static void	tlsSecInitc(TlsSec *sec, int cvers);
419 
static Bytes*	tlsSecRSAc(TlsSec *sec, uchar *cert, int ncert);
420 
static Bytes*	tlsSecDHEc(TlsSec *sec, Bytes *p, Bytes *g, Bytes *Ys);
421 
static Bytes*	tlsSecECDHEc(TlsSec *sec, int curve, Bytes *Ys);
422 
static void	tlsSecVers(TlsSec *sec, int v);
423 
static int	tlsSecFinished(TlsSec *sec, HandshakeHash hsh, uchar *fin, int nfin, int isclient);
2 - 424 
static void	setMasterSecret(TlsSec *sec, Bytes *pm);
33 7u83 425 
static int	digestDHparams(TlsSec *sec, Bytes *par, uchar digest[MAXdlen], int sigalg);
426 
static char*	verifyDHparams(TlsSec *sec, Bytes *par, Bytes *cert, Bytes *sig, int sigalg);
2 - 427 
 
33 7u83 428 
static Bytes*	pkcs1_encrypt(Bytes* data, RSApub* key);
429 
static Bytes*	pkcs1_decrypt(TlsSec *sec, Bytes *data);
430 
static Bytes*	pkcs1_sign(TlsSec *sec, uchar *digest, int digestlen, int sigalg);
2 - 431 
 
432 
static void* emalloc(int);
433 
static void* erealloc(void*, int);
434 
static void put32(uchar *p, u32int);
435 
static void put24(uchar *p, int);
436 
static void put16(uchar *p, int);
437 
static int get24(uchar *p);
438 
static int get16(uchar *p);
439 
static Bytes* newbytes(int len);
440 
static Bytes* makebytes(uchar* buf, int len);
33 7u83 441 
static Bytes* mptobytes(mpint* big, int len);
442 
static mpint* bytestomp(Bytes* bytes);
2 - 443 
static void freebytes(Bytes* b);
444 
static Ints* newints(int len);
445 
static void freeints(Ints* b);
33 7u83 446 
static int lookupid(Ints* b, int id);
2 - 447 
 
448 
//================= client/server ========================
449 
 
450 
//	push TLS onto fd, returning new (application) file descriptor
451 
//		or -1 if error.
452 
int
453 
tlsServer(int fd, TLSconn *conn)
454 
{
455 
	char buf[8];
456 
	char dname[64];
457 
	int n, data, ctl, hand;
458 
	TlsConnection *tls;
459 
 
460 
	if(conn == nil)
461 
		return -1;
462 
	ctl = open("#a/tls/clone", ORDWR);
463 
	if(ctl < 0)
464 
		return -1;
465 
	n = read(ctl, buf, sizeof(buf)-1);
466 
	if(n < 0){
467 
		close(ctl);
468 
		return -1;
469 
	}
470 
	buf[n] = 0;
33 7u83 471 
	snprint(conn->dir, sizeof(conn->dir), "#a/tls/%s", buf);
472 
	snprint(dname, sizeof(dname), "#a/tls/%s/hand", buf);
2 - 473 
	hand = open(dname, ORDWR);
474 
	if(hand < 0){
475 
		close(ctl);
476 
		return -1;
477 
	}
33 7u83 478 
	data = -1;
2 - 479 
	fprint(ctl, "fd %d 0x%x", fd, ProtocolVersion);
33 7u83 480 
	tls = tlsServer2(ctl, hand,
481 
		conn->cert, conn->certlen,
482 
		conn->pskID, conn->psk, conn->psklen,
483 
		conn->trace, conn->chain);
484 
	if(tls != nil){
485 
		snprint(dname, sizeof(dname), "#a/tls/%s/data", buf);
486 
		data = open(dname, ORDWR);
487 
	}
2 - 488 
	close(hand);
489 
	close(ctl);
490 
	if(data < 0){
33 7u83 491 
		tlsConnectionFree(tls);
2 - 492 
		return -1;
493 
	}
33 7u83 494 
	free(conn->cert);
495 
	conn->cert = nil;  // client certificates are not yet implemented
2 - 496 
	conn->certlen = 0;
33 7u83 497 
	conn->sessionIDlen = 0;
498 
	conn->sessionID = nil;
499 
	if(conn->sessionKey != nil
500 
	&& conn->sessionType != nil
501 
	&& strcmp(conn->sessionType, "ttls") == 0)
502 
		tls->sec->prf(
503 
			conn->sessionKey, conn->sessionKeylen,
504 
			tls->sec->sec, MasterSecretSize,
505 
			conn->sessionConst,
506 
			tls->sec->crandom, RandomSize,
507 
			tls->sec->srandom, RandomSize);
2 - 508 
	tlsConnectionFree(tls);
33 7u83 509 
	close(fd);
2 - 510 
	return data;
511 
}
512 
 
33 7u83 513 
static uchar*
514 
tlsClientExtensions(TLSconn *conn, int *plen)
515 
{
516 
	uchar *b, *p;
517 
	int i, n, m;
518 
 
519 
	p = b = nil;
520 
 
521 
	// RFC6066 - Server Name Identification
522 
	if(conn->serverName != nil){
523 
		n = strlen(conn->serverName);
524 
 
525 
		m = p - b;
526 
		b = erealloc(b, m + 2+2+2+1+2+n);
527 
		p = b + m;
528 
 
529 
		put16(p, 0), p += 2;		/* Type: server_name */
530 
		put16(p, 2+1+2+n), p += 2;	/* Length */
531 
		put16(p, 1+2+n), p += 2;	/* Server Name list length */
532 
		*p++ = 0;			/* Server Name Type: host_name */
533 
		put16(p, n), p += 2;		/* Server Name length */
534 
		memmove(p, conn->serverName, n);
535 
		p += n;
536 
	}
537 
 
538 
	// ECDHE
539 
	if(ProtocolVersion >= TLS10Version){
540 
		m = p - b;
541 
		b = erealloc(b, m + 2+2+2+nelem(namedcurves)*2 + 2+2+1+nelem(pointformats));
542 
		p = b + m;
543 
 
544 
		n = nelem(namedcurves);
545 
		put16(p, 0x000a), p += 2;	/* Type: elliptic_curves */
546 
		put16(p, (n+1)*2), p += 2;	/* Length */
547 
		put16(p, n*2), p += 2;		/* Elliptic Curves Length */
548 
		for(i=0; i < n; i++){		/* Elliptic curves */
549 
			put16(p, namedcurves[i].tlsid);
550 
			p += 2;
551 
		}
552 
 
553 
		n = nelem(pointformats);
554 
		put16(p, 0x000b), p += 2;	/* Type: ec_point_formats */
555 
		put16(p, n+1), p += 2;		/* Length */
556 
		*p++ = n;			/* EC point formats Length */
557 
		for(i=0; i < n; i++)		/* Elliptic curves point formats */
558 
			*p++ = pointformats[i];
559 
	}
560 
 
561 
	// signature algorithms
562 
	if(ProtocolVersion >= TLS12Version){
563 
		n = nelem(sigalgs);
564 
 
565 
		m = p - b;
566 
		b = erealloc(b, m + 2+2+2+n*2);
567 
		p = b + m;
568 
 
569 
		put16(p, 0x000d), p += 2;
570 
		put16(p, n*2 + 2), p += 2;
571 
		put16(p, n*2), p += 2;
572 
		for(i=0; i < n; i++){
573 
			put16(p, sigalgs[i]);
574 
			p += 2;
575 
		}
576 
	}
577 
 
578 
	*plen = p - b;
579 
	return b;
580 
}
581 
 
2 - 582 
//	push TLS onto fd, returning new (application) file descriptor
583 
//		or -1 if error.
584 
int
585 
tlsClient(int fd, TLSconn *conn)
586 
{
587 
	char buf[8];
588 
	char dname[64];
589 
	int n, data, ctl, hand;
590 
	TlsConnection *tls;
33 7u83 591 
	uchar *ext;
2 - 592 
 
33 7u83 593 
	if(conn == nil)
2 - 594 
		return -1;
595 
	ctl = open("#a/tls/clone", ORDWR);
596 
	if(ctl < 0)
597 
		return -1;
598 
	n = read(ctl, buf, sizeof(buf)-1);
599 
	if(n < 0){
600 
		close(ctl);
601 
		return -1;
602 
	}
603 
	buf[n] = 0;
33 7u83 604 
	snprint(conn->dir, sizeof(conn->dir), "#a/tls/%s", buf);
605 
	snprint(dname, sizeof(dname), "#a/tls/%s/hand", buf);
2 - 606 
	hand = open(dname, ORDWR);
607 
	if(hand < 0){
608 
		close(ctl);
609 
		return -1;
610 
	}
33 7u83 611 
	snprint(dname, sizeof(dname), "#a/tls/%s/data", buf);
2 - 612 
	data = open(dname, ORDWR);
33 7u83 613 
	if(data < 0){
614 
		close(hand);
615 
		close(ctl);
2 - 616 
		return -1;
33 7u83 617 
	}
2 - 618 
	fprint(ctl, "fd %d 0x%x", fd, ProtocolVersion);
33 7u83 619 
	ext = tlsClientExtensions(conn, &n);
620 
	tls = tlsClient2(ctl, hand,
621 
		conn->cert, conn->certlen,
622 
		conn->pskID, conn->psk, conn->psklen,
623 
		ext, n, conn->trace);
624 
	free(ext);
2 - 625 
	close(hand);
626 
	close(ctl);
627 
	if(tls == nil){
628 
		close(data);
629 
		return -1;
630 
	}
33 7u83 631 
	free(conn->cert);
632 
	if(tls->cert != nil){
633 
		conn->certlen = tls->cert->len;
634 
		conn->cert = emalloc(conn->certlen);
635 
		memcpy(conn->cert, tls->cert->data, conn->certlen);
636 
	} else {
637 
		conn->certlen = 0;
638 
		conn->cert = nil;
639 
	}
640 
	conn->sessionIDlen = 0;
641 
	conn->sessionID = nil;
642 
	if(conn->sessionKey != nil
643 
	&& conn->sessionType != nil
644 
	&& strcmp(conn->sessionType, "ttls") == 0)
645 
		tls->sec->prf(
646 
			conn->sessionKey, conn->sessionKeylen,
647 
			tls->sec->sec, MasterSecretSize,
648 
			conn->sessionConst,
649 
			tls->sec->crandom, RandomSize,
650 
			tls->sec->srandom, RandomSize);
2 - 651 
	tlsConnectionFree(tls);
33 7u83 652 
	close(fd);
2 - 653 
	return data;
654 
}
655 
 
656 
static int
657 
countchain(PEMChain *p)
658 
{
659 
	int i = 0;
660 
 
661 
	while (p) {
662 
		i++;
663 
		p = p->next;
664 
	}
665 
	return i;
666 
}
667 
 
668 
static TlsConnection *
33 7u83 669 
tlsServer2(int ctl, int hand,
670 
	uchar *cert, int certlen,
671 
	char *pskid, uchar *psk, int psklen,
672 
	int (*trace)(char*fmt, ...), PEMChain *chp)
2 - 673 
{
33 7u83 674 
	int cipher, compressor, numcerts, i;
2 - 675 
	TlsConnection *c;
676 
	Msg m;
677 
 
678 
	if(trace)
679 
		trace("tlsServer2\n");
680 
	if(!initCiphers())
681 
		return nil;
33 7u83 682 
 
2 - 683 
	c = emalloc(sizeof(TlsConnection));
684 
	c->ctl = ctl;
685 
	c->hand = hand;
686 
	c->trace = trace;
687 
	c->version = ProtocolVersion;
33 7u83 688 
	c->sendp = c->buf;
2 - 689 
 
690 
	memset(&m, 0, sizeof(m));
691 
	if(!msgRecv(c, &m)){
692 
		if(trace)
693 
			trace("initial msgRecv failed\n");
694 
		goto Err;
695 
	}
696 
	if(m.tag != HClientHello) {
697 
		tlsError(c, EUnexpectedMessage, "expected a client hello");
698 
		goto Err;
699 
	}
700 
	if(trace)
33 7u83 701 
		trace("ClientHello version %x\n", m.u.clientHello.version);
2 - 702 
	if(setVersion(c, m.u.clientHello.version) < 0) {
703 
		tlsError(c, EIllegalParameter, "incompatible version");
704 
		goto Err;
705 
	}
33 7u83 706 
	if(c->version < ProtocolVersion
707 
	&& lookupid(m.u.clientHello.ciphers, TLS_FALLBACK_SCSV) >= 0){
708 
		tlsError(c, EInappropriateFallback, "inappropriate fallback");
2 - 709 
		goto Err;
710 
	}
33 7u83 711 
	cipher = okCipher(m.u.clientHello.ciphers, psklen > 0);
712 
	if(cipher < 0 || !setAlgs(c, cipher)) {
2 - 713 
		tlsError(c, EHandshakeFailure, "no matching cipher suite");
714 
		goto Err;
715 
	}
716 
	compressor = okCompression(m.u.clientHello.compressors);
717 
	if(compressor < 0) {
718 
		tlsError(c, EHandshakeFailure, "no matching compressor");
719 
		goto Err;
720 
	}
33 7u83 721 
	if(trace)
722 
		trace("  cipher %x, compressor %x\n", cipher, compressor);
2 - 723 
 
33 7u83 724 
	tlsSecInits(c->sec, m.u.clientHello.version, m.u.clientHello.random);
725 
	tlsSecVers(c->sec, c->version);
726 
	if(psklen > 0){
727 
		c->sec->psk = psk;
728 
		c->sec->psklen = psklen;
2 - 729 
	}
33 7u83 730 
	if(certlen > 0){
731 
		/* server certificate */
732 
		c->sec->rsapub = X509toRSApub(cert, certlen, nil, 0);
733 
		if(c->sec->rsapub == nil){
734 
			tlsError(c, EHandshakeFailure, "invalid X509/rsa certificate");
735 
			goto Err;
736 
		}
737 
		c->sec->rpc = factotum_rsa_open(c->sec->rsapub);
738 
		if(c->sec->rpc == nil){
739 
			tlsError(c, EHandshakeFailure, "factotum_rsa_open: %r");
740 
			goto Err;
741 
		}
2 - 742 
	}
743 
	msgClear(&m);
744 
 
745 
	m.tag = HServerHello;
746 
	m.u.serverHello.version = c->version;
33 7u83 747 
	memmove(m.u.serverHello.random, c->sec->srandom, RandomSize);
2 - 748 
	m.u.serverHello.cipher = cipher;
749 
	m.u.serverHello.compressor = compressor;
33 7u83 750 
	m.u.serverHello.sid = makebytes(nil, 0);
2 - 751 
	if(!msgSend(c, &m, AQueue))
752 
		goto Err;
753 
 
33 7u83 754 
	if(certlen > 0){
755 
		m.tag = HCertificate;
756 
		numcerts = countchain(chp);
757 
		m.u.certificate.ncert = 1 + numcerts;
758 
		m.u.certificate.certs = emalloc(m.u.certificate.ncert * sizeof(Bytes*));
759 
		m.u.certificate.certs[0] = makebytes(cert, certlen);
760 
		for (i = 0; i < numcerts && chp; i++, chp = chp->next)
761 
			m.u.certificate.certs[i+1] = makebytes(chp->pem, chp->pemlen);
762 
		if(!msgSend(c, &m, AQueue))
763 
			goto Err;
764 
	}
2 - 765 
 
33 7u83 766 
	if(isECDHE(cipher)){
767 
		Namedcurve *nc = &namedcurves[0];	/* secp256r1 */
768 
 
769 
		m.tag = HServerKeyExchange;
770 
		m.u.serverKeyExchange.curve = nc->tlsid;
771 
		m.u.serverKeyExchange.dh_parameters = tlsSecECDHEs1(c->sec, nc);
772 
		if(m.u.serverKeyExchange.dh_parameters == nil){
773 
			tlsError(c, EInternalError, "can't set DH parameters");
774 
			goto Err;
775 
		}
776 
 
777 
		/* sign the DH parameters */
778 
		if(certlen > 0){
779 
			uchar digest[MAXdlen];
780 
			int digestlen;
781 
 
782 
			if(c->version >= TLS12Version)
783 
				m.u.serverKeyExchange.sigalg = 0x0401;	/* RSA SHA256 */
784 
			digestlen = digestDHparams(c->sec, m.u.serverKeyExchange.dh_parameters,
785 
				digest, m.u.serverKeyExchange.sigalg);
786 
			if((m.u.serverKeyExchange.dh_signature = pkcs1_sign(c->sec, digest, digestlen,
787 
				m.u.serverKeyExchange.sigalg)) == nil){
788 
				tlsError(c, EHandshakeFailure, "pkcs1_sign: %r");
789 
				goto Err;
790 
			}
791 
		}
792 
		if(!msgSend(c, &m, AQueue))
793 
			goto Err;
794 
	}
795 
 
2 - 796 
	m.tag = HServerHelloDone;
797 
	if(!msgSend(c, &m, AFlush))
798 
		goto Err;
799 
 
800 
	if(!msgRecv(c, &m))
801 
		goto Err;
802 
	if(m.tag != HClientKeyExchange) {
803 
		tlsError(c, EUnexpectedMessage, "expected a client key exchange");
804 
		goto Err;
805 
	}
33 7u83 806 
	if(pskid != nil){
807 
		if(m.u.clientKeyExchange.pskid == nil
808 
		|| m.u.clientKeyExchange.pskid->len != strlen(pskid)
809 
		|| memcmp(pskid, m.u.clientKeyExchange.pskid->data, m.u.clientKeyExchange.pskid->len) != 0){
810 
			tlsError(c, EUnknownPSKidentity, "unknown or missing pskid");
811 
			goto Err;
812 
		}
813 
	}
814 
	if(isECDHE(cipher)){
815 
		if(tlsSecECDHEs2(c->sec, m.u.clientKeyExchange.key) < 0){
816 
			tlsError(c, EHandshakeFailure, "couldn't set keys: %r");
817 
			goto Err;
818 
		}
819 
	} else if(certlen > 0){
820 
		if(tlsSecRSAs(c->sec, m.u.clientKeyExchange.key) < 0){
821 
			tlsError(c, EHandshakeFailure, "couldn't set keys: %r");
822 
			goto Err;
823 
		}
824 
	} else if(psklen > 0){
825 
		setMasterSecret(c->sec, newbytes(psklen));
826 
	} else {
827 
		tlsError(c, EInternalError, "no psk or certificate");
2 - 828 
		goto Err;
829 
	}
33 7u83 830 
 
2 - 831 
	if(trace)
832 
		trace("tls secrets\n");
33 7u83 833 
	if(setSecrets(c, 0) < 0){
834 
		tlsError(c, EHandshakeFailure, "can't set secrets: %r");
2 - 835 
		goto Err;
836 
	}
837 
 
838 
	/* no CertificateVerify; skip to Finished */
33 7u83 839 
	if(tlsSecFinished(c->sec, c->handhash, c->finished.verify, c->finished.n, 1) < 0){
2 - 840 
		tlsError(c, EInternalError, "can't set finished: %r");
841 
		goto Err;
842 
	}
843 
	if(!msgRecv(c, &m))
844 
		goto Err;
845 
	if(m.tag != HFinished) {
846 
		tlsError(c, EUnexpectedMessage, "expected a finished");
847 
		goto Err;
848 
	}
849 
	if(!finishedMatch(c, &m.u.finished)) {
850 
		tlsError(c, EHandshakeFailure, "finished verification failed");
851 
		goto Err;
852 
	}
853 
	msgClear(&m);
854 
 
855 
	/* change cipher spec */
856 
	if(fprint(c->ctl, "changecipher") < 0){
857 
		tlsError(c, EInternalError, "can't enable cipher: %r");
858 
		goto Err;
859 
	}
860 
 
33 7u83 861 
	if(tlsSecFinished(c->sec, c->handhash, c->finished.verify, c->finished.n, 0) < 0){
2 - 862 
		tlsError(c, EInternalError, "can't set finished: %r");
863 
		goto Err;
864 
	}
865 
	m.tag = HFinished;
866 
	m.u.finished = c->finished;
867 
	if(!msgSend(c, &m, AFlush))
868 
		goto Err;
869 
	if(trace)
870 
		trace("tls finished\n");
871 
 
872 
	if(fprint(c->ctl, "opened") < 0)
873 
		goto Err;
874 
	return c;
875 
 
876 
Err:
877 
	msgClear(&m);
878 
	tlsConnectionFree(c);
33 7u83 879 
	return nil;
2 - 880 
}
881 
 
33 7u83 882 
static Bytes*
883 
tlsSecDHEc(TlsSec *sec, Bytes *p, Bytes *g, Bytes *Ys)
884 
{
885 
	DHstate *dh = &sec->dh;
886 
	mpint *G, *P, *Y, *K;
887 
	Bytes *Yc;
888 
	int n;
889 
 
890 
	if(p == nil || g == nil || Ys == nil)
891 
		return nil;
892 
 
893 
	Yc = nil;
894 
	P = bytestomp(p);
895 
	G = bytestomp(g);
896 
	Y = bytestomp(Ys);
897 
	K = nil;
898 
 
899 
	if(dh_new(dh, P, nil, G) == nil)
900 
		goto Out;
901 
	n = (mpsignif(P)+7)/8;
902 
	Yc = mptobytes(dh->y, n);
903 
	K = dh_finish(dh, Y);	/* zeros dh */
904 
	if(K == nil){
905 
		freebytes(Yc);
906 
		Yc = nil;
907 
		goto Out;
908 
	}
909 
	setMasterSecret(sec, mptobytes(K, n));
910 
 
911 
Out:
912 
	mpfree(K);
913 
	mpfree(Y);
914 
	mpfree(G);
915 
	mpfree(P);
916 
 
917 
	return Yc;
918 
}
919 
 
920 
static Bytes*
921 
tlsSecECDHEc(TlsSec *sec, int curve, Bytes *Ys)
922 
{
923 
	ECdomain *dom = &sec->ec.dom;
924 
	ECpriv *Q = &sec->ec.Q;
925 
	Namedcurve *nc;
926 
	ECpub *pub;
927 
	ECpoint K;
928 
	Bytes *Yc;
929 
	int n;
930 
 
931 
	if(Ys == nil)
932 
		return nil;
933 
	for(nc = namedcurves; nc != &namedcurves[nelem(namedcurves)]; nc++)
934 
		if(nc->tlsid == curve)
935 
			goto Found;
936 
	return nil;
937 
 
938 
Found:
939 
	ecdominit(dom, nc->init);
940 
	pub = ecdecodepub(dom, Ys->data, Ys->len);
941 
	if(pub == nil)
942 
		return nil;
943 
 
944 
	memset(Q, 0, sizeof(*Q));
945 
	Q->x = mpnew(0);
946 
	Q->y = mpnew(0);
947 
	Q->d = mpnew(0);
948 
 
949 
	memset(&K, 0, sizeof(K));
950 
	K.x = mpnew(0);
951 
	K.y = mpnew(0);
952 
 
953 
	ecgen(dom, Q);
954 
	ecmul(dom, pub, Q->d, &K);
955 
 
956 
	n = (mpsignif(dom->p)+7)/8;
957 
	setMasterSecret(sec, mptobytes(K.x, n));
958 
	Yc = newbytes(1 + 2*n);
959 
	Yc->len = ecencodepub(dom, Q, Yc->data, Yc->len);
960 
 
961 
	mpfree(K.x);
962 
	mpfree(K.y);
963 
 
964 
	ecpubfree(pub);
965 
 
966 
	return Yc;
967 
}
968 
 
2 - 969 
static TlsConnection *
33 7u83 970 
tlsClient2(int ctl, int hand,
971 
	uchar *cert, int certlen,
972 
	char *pskid, uchar *psk, int psklen,
973 
	uchar *ext, int extlen,
974 
	int (*trace)(char*fmt, ...))
2 - 975 
{
33 7u83 976 
	int creq, dhx, cipher;
2 - 977 
	TlsConnection *c;
33 7u83 978 
	Bytes *epm;
2 - 979 
	Msg m;
980 
 
981 
	if(!initCiphers())
982 
		return nil;
33 7u83 983 
 
2 - 984 
	epm = nil;
33 7u83 985 
	memset(&m, 0, sizeof(m));
2 - 986 
	c = emalloc(sizeof(TlsConnection));
33 7u83 987 
 
2 - 988 
	c->ctl = ctl;
989 
	c->hand = hand;
990 
	c->trace = trace;
33 7u83 991 
	c->cert = nil;
992 
	c->sendp = c->buf;
2 - 993 
 
33 7u83 994 
	c->version = ProtocolVersion;
995 
	tlsSecInitc(c->sec, c->version);
996 
	if(psklen > 0){
997 
		c->sec->psk = psk;
998 
		c->sec->psklen = psklen;
999 
	}
1000 
	if(certlen > 0){
1001 
		/* client certificate */
1002 
		c->sec->rsapub = X509toRSApub(cert, certlen, nil, 0);
1003 
		if(c->sec->rsapub == nil){
1004 
			tlsError(c, EInternalError, "invalid X509/rsa certificate");
1005 
			goto Err;
1006 
		}
1007 
		c->sec->rpc = factotum_rsa_open(c->sec->rsapub);
1008 
		if(c->sec->rpc == nil){
1009 
			tlsError(c, EInternalError, "factotum_rsa_open: %r");
1010 
			goto Err;
1011 
		}
1012 
	}
2 - 1013 
 
1014 
	/* client hello */
1015 
	m.tag = HClientHello;
33 7u83 1016 
	m.u.clientHello.version = c->version;
1017 
	memmove(m.u.clientHello.random, c->sec->crandom, RandomSize);
1018 
	m.u.clientHello.sid = makebytes(nil, 0);
1019 
	m.u.clientHello.ciphers = makeciphers(psklen > 0);
2 - 1020 
	m.u.clientHello.compressors = makebytes(compressors,sizeof(compressors));
33 7u83 1021 
	m.u.clientHello.extensions = makebytes(ext, extlen);
2 - 1022 
	if(!msgSend(c, &m, AFlush))
1023 
		goto Err;
1024 
 
1025 
	/* server hello */
1026 
	if(!msgRecv(c, &m))
1027 
		goto Err;
1028 
	if(m.tag != HServerHello) {
1029 
		tlsError(c, EUnexpectedMessage, "expected a server hello");
1030 
		goto Err;
1031 
	}
1032 
	if(setVersion(c, m.u.serverHello.version) < 0) {
33 7u83 1033 
		tlsError(c, EIllegalParameter, "incompatible version: %r");
2 - 1034 
		goto Err;
1035 
	}
33 7u83 1036 
	tlsSecVers(c->sec, c->version);
1037 
	memmove(c->sec->srandom, m.u.serverHello.random, RandomSize);
1038 
 
1039 
	cipher = m.u.serverHello.cipher;
1040 
	if((psklen > 0) != isPSK(cipher) || !setAlgs(c, cipher)) {
2 - 1041 
		tlsError(c, EIllegalParameter, "invalid cipher suite");
1042 
		goto Err;
1043 
	}
1044 
	if(m.u.serverHello.compressor != CompressionNull) {
1045 
		tlsError(c, EIllegalParameter, "invalid compression");
1046 
		goto Err;
1047 
	}
1048 
 
33 7u83 1049 
	dhx = isDHE(cipher) || isECDHE(cipher);
1050 
	if(!msgRecv(c, &m))
1051 
		goto Err;
1052 
	if(m.tag == HCertificate){
1053 
		if(m.u.certificate.ncert < 1) {
1054 
			tlsError(c, EIllegalParameter, "runt certificate");
1055 
			goto Err;
1056 
		}
1057 
		c->cert = makebytes(m.u.certificate.certs[0]->data, m.u.certificate.certs[0]->len);
1058 
		if(!msgRecv(c, &m))
1059 
			goto Err;
1060 
	} else if(psklen == 0) {
2 - 1061 
		tlsError(c, EUnexpectedMessage, "expected a certificate");
1062 
		goto Err;
1063 
	}
1064 
	if(m.tag == HServerKeyExchange) {
33 7u83 1065 
		if(dhx){
1066 
			char *err = verifyDHparams(c->sec,
1067 
				m.u.serverKeyExchange.dh_parameters,
1068 
				c->cert,
1069 
				m.u.serverKeyExchange.dh_signature,
1070 
				c->version<TLS12Version ? 0x01 : m.u.serverKeyExchange.sigalg);
1071 
			if(err != nil){
1072 
				tlsError(c, EBadCertificate, "can't verify DH parameters: %s", err);
1073 
				goto Err;
1074 
			}
1075 
			if(isECDHE(cipher)){
1076 
				epm = tlsSecECDHEc(c->sec,
1077 
					m.u.serverKeyExchange.curve,
1078 
					m.u.serverKeyExchange.dh_Ys);
1079 
			}
1080 
			else{
1081 
				epm = tlsSecDHEc(c->sec,
1082 
					m.u.serverKeyExchange.dh_p,
1083 
					m.u.serverKeyExchange.dh_g,
1084 
					m.u.serverKeyExchange.dh_Ys);
1085 
			}
1086 
			if(epm == nil){
1087 
				tlsError(c, EHandshakeFailure, "bad DH parameters");
1088 
				goto Err;
1089 
			}
1090 
		} else if(psklen == 0){
1091 
			tlsError(c, EUnexpectedMessage, "got an server key exchange");
1092 
			goto Err;
1093 
		}
1094 
		if(!msgRecv(c, &m))
1095 
			goto Err;
1096 
	} else if(dhx){
1097 
		tlsError(c, EUnexpectedMessage, "expected server key exchange");
2 - 1098 
		goto Err;
1099 
	}
1100 
 
1101 
	/* certificate request (optional) */
1102 
	creq = 0;
1103 
	if(m.tag == HCertificateRequest) {
1104 
		creq = 1;
1105 
		if(!msgRecv(c, &m))
1106 
			goto Err;
1107 
	}
1108 
 
1109 
	if(m.tag != HServerHelloDone) {
1110 
		tlsError(c, EUnexpectedMessage, "expected a server hello done");
1111 
		goto Err;
1112 
	}
1113 
	msgClear(&m);
1114 
 
33 7u83 1115 
	if(!dhx){
1116 
		if(c->cert != nil){
1117 
			epm = tlsSecRSAc(c->sec, c->cert->data, c->cert->len);
1118 
			if(epm == nil){
1119 
				tlsError(c, EBadCertificate, "bad certificate: %r");
1120 
				goto Err;
1121 
			}
1122 
		} else if(psklen > 0){
1123 
			setMasterSecret(c->sec, newbytes(psklen));
1124 
		} else {
1125 
			tlsError(c, EInternalError, "no psk or certificate");
1126 
			goto Err;
1127 
		}
2 - 1128 
	}
33 7u83 1129 
 
1130 
	if(trace)
1131 
		trace("tls secrets\n");
1132 
	if(setSecrets(c, 1) < 0){
1133 
		tlsError(c, EHandshakeFailure, "can't set secrets: %r");
2 - 1134 
		goto Err;
1135 
	}
1136 
 
1137 
	if(creq) {
1138 
		m.tag = HCertificate;
33 7u83 1139 
		if(certlen > 0){
1140 
			m.u.certificate.ncert = 1;
1141 
			m.u.certificate.certs = emalloc(m.u.certificate.ncert * sizeof(Bytes*));
1142 
			m.u.certificate.certs[0] = makebytes(cert, certlen);
1143 
		}
2 - 1144 
		if(!msgSend(c, &m, AFlush))
1145 
			goto Err;
1146 
	}
1147 
 
1148 
	/* client key exchange */
1149 
	m.tag = HClientKeyExchange;
33 7u83 1150 
	if(psklen > 0){
1151 
		if(pskid == nil)
1152 
			pskid = "";
1153 
		m.u.clientKeyExchange.pskid = makebytes((uchar*)pskid, strlen(pskid));
1154 
	}
1155 
	m.u.clientKeyExchange.key = epm;
2 - 1156 
	epm = nil;
33 7u83 1157 
 
2 - 1158 
	if(!msgSend(c, &m, AFlush))
1159 
		goto Err;
1160 
 
33 7u83 1161 
	/* certificate verify */
1162 
	if(creq && certlen > 0) {
1163 
		HandshakeHash hsave;
1164 
		uchar digest[MAXdlen];
1165 
		int digestlen;
1166 
 
1167 
		/* save the state for the Finish message */
1168 
		hsave = c->handhash;
1169 
		if(c->version < TLS12Version){
1170 
			md5(nil, 0, digest, &c->handhash.md5);
1171 
			sha1(nil, 0, digest+MD5dlen, &c->handhash.sha1);
1172 
			digestlen = MD5dlen+SHA1dlen;
1173 
		} else {
1174 
			m.u.certificateVerify.sigalg = 0x0401;	/* RSA SHA256 */
1175 
			sha2_256(nil, 0, digest, &c->handhash.sha2_256);
1176 
			digestlen = SHA2_256dlen;
1177 
		}
1178 
		c->handhash = hsave;
1179 
 
1180 
		if((m.u.certificateVerify.signature = pkcs1_sign(c->sec, digest, digestlen,
1181 
			m.u.certificateVerify.sigalg)) == nil){
1182 
			tlsError(c, EHandshakeFailure, "pkcs1_sign: %r");
1183 
			goto Err;
1184 
		}
1185 
 
1186 
		m.tag = HCertificateVerify;
1187 
		if(!msgSend(c, &m, AFlush))
1188 
			goto Err;
1189 
	}
1190 
 
2 - 1191 
	/* change cipher spec */
1192 
	if(fprint(c->ctl, "changecipher") < 0){
1193 
		tlsError(c, EInternalError, "can't enable cipher: %r");
1194 
		goto Err;
1195 
	}
1196 
 
1197 
	// Cipherchange must occur immediately before Finished to avoid
1198 
	// potential hole;  see section 4.3 of Wagner Schneier 1996.
33 7u83 1199 
	if(tlsSecFinished(c->sec, c->handhash, c->finished.verify, c->finished.n, 1) < 0){
2 - 1200 
		tlsError(c, EInternalError, "can't set finished 1: %r");
1201 
		goto Err;
1202 
	}
1203 
	m.tag = HFinished;
1204 
	m.u.finished = c->finished;
1205 
	if(!msgSend(c, &m, AFlush)) {
1206 
		tlsError(c, EInternalError, "can't flush after client Finished: %r");
1207 
		goto Err;
1208 
	}
1209 
 
33 7u83 1210 
	if(tlsSecFinished(c->sec, c->handhash, c->finished.verify, c->finished.n, 0) < 0){
2 - 1211 
		tlsError(c, EInternalError, "can't set finished 0: %r");
1212 
		goto Err;
1213 
	}
1214 
	if(!msgRecv(c, &m)) {
1215 
		tlsError(c, EInternalError, "can't read server Finished: %r");
1216 
		goto Err;
1217 
	}
1218 
	if(m.tag != HFinished) {
1219 
		tlsError(c, EUnexpectedMessage, "expected a Finished msg from server");
1220 
		goto Err;
1221 
	}
1222 
 
1223 
	if(!finishedMatch(c, &m.u.finished)) {
1224 
		tlsError(c, EHandshakeFailure, "finished verification failed");
1225 
		goto Err;
1226 
	}
1227 
	msgClear(&m);
1228 
 
1229 
	if(fprint(c->ctl, "opened") < 0){
1230 
		if(trace)
1231 
			trace("unable to do final open: %r\n");
1232 
		goto Err;
1233 
	}
1234 
	return c;
1235 
 
1236 
Err:
1237 
	free(epm);
1238 
	msgClear(&m);
1239 
	tlsConnectionFree(c);
33 7u83 1240 
	return nil;
2 - 1241 
}
1242 
 
1243 
 
1244 
//================= message functions ========================
1245 
 
33 7u83 1246 
static void
1247 
msgHash(TlsConnection *c, uchar *p, int n)
1248 
{
1249 
	md5(p, n, 0, &c->handhash.md5);
1250 
	sha1(p, n, 0, &c->handhash.sha1);
1251 
	if(c->version >= TLS12Version)
1252 
		sha2_256(p, n, 0, &c->handhash.sha2_256);
1253 
}
2 - 1254 
 
1255 
static int
1256 
msgSend(TlsConnection *c, Msg *m, int act)
1257 
{
33 7u83 1258 
	uchar *p, *e; // sendp = start of new message;  p = write pointer; e = end pointer
1259 
	int n, i;
2 - 1260 
 
33 7u83 1261 
	p = c->sendp;
1262 
	e = &c->buf[sizeof(c->buf)];
2 - 1263 
	if(c->trace)
33 7u83 1264 
		c->trace("send %s", msgPrint((char*)p, e - p, m));
2 - 1265 
 
1266 
	p[0] = m->tag;	// header - fill in size later
1267 
	p += 4;
1268 
 
1269 
	switch(m->tag) {
1270 
	default:
1271 
		tlsError(c, EInternalError, "can't encode a %d", m->tag);
1272 
		goto Err;
1273 
	case HClientHello:
33 7u83 1274 
		if(p+2+RandomSize > e)
1275 
			goto Overflow;
1276 
		put16(p, m->u.clientHello.version), p += 2;
2 - 1277 
		memmove(p, m->u.clientHello.random, RandomSize);
1278 
		p += RandomSize;
1279 
 
33 7u83 1280 
		if(p+1+(n = m->u.clientHello.sid->len) > e)
1281 
			goto Overflow;
1282 
		*p++ = n;
1283 
		memmove(p, m->u.clientHello.sid->data, n);
1284 
		p += n;
2 - 1285 
 
33 7u83 1286 
		if(p+2+(n = m->u.clientHello.ciphers->len) > e)
1287 
			goto Overflow;
1288 
		put16(p, n*2), p += 2;
1289 
		for(i=0; i<n; i++)
1290 
			put16(p, m->u.clientHello.ciphers->data[i]), p += 2;
2 - 1291 
 
33 7u83 1292 
		if(p+1+(n = m->u.clientHello.compressors->len) > e)
1293 
			goto Overflow;
1294 
		*p++ = n;
1295 
		memmove(p, m->u.clientHello.compressors->data, n);
1296 
		p += n;
1297 
 
1298 
		if(m->u.clientHello.extensions == nil
1299 
		|| (n = m->u.clientHello.extensions->len) == 0)
1300 
			break;
1301 
		if(p+2+n > e)
1302 
			goto Overflow;
1303 
		put16(p, n), p += 2;
1304 
		memmove(p, m->u.clientHello.extensions->data, n);
1305 
		p += n;
2 - 1306 
		break;
1307 
	case HServerHello:
33 7u83 1308 
		if(p+2+RandomSize > e)
1309 
			goto Overflow;
1310 
		put16(p, m->u.serverHello.version), p += 2;
2 - 1311 
		memmove(p, m->u.serverHello.random, RandomSize);
1312 
		p += RandomSize;
1313 
 
33 7u83 1314 
		if(p+1+(n = m->u.serverHello.sid->len) > e)
1315 
			goto Overflow;
1316 
		*p++ = n;
1317 
		memmove(p, m->u.serverHello.sid->data, n);
1318 
		p += n;
2 - 1319 
 
33 7u83 1320 
		if(p+2+1 > e)
1321 
			goto Overflow;
1322 
		put16(p, m->u.serverHello.cipher), p += 2;
1323 
		*p++ = m->u.serverHello.compressor;
1324 
 
1325 
		if(m->u.serverHello.extensions == nil
1326 
		|| (n = m->u.serverHello.extensions->len) == 0)
1327 
			break;
1328 
		if(p+2+n > e)
1329 
			goto Overflow;
1330 
		put16(p, n), p += 2;
1331 
		memmove(p, m->u.serverHello.extensions->data, n);
1332 
		p += n;
2 - 1333 
		break;
1334 
	case HServerHelloDone:
1335 
		break;
1336 
	case HCertificate:
33 7u83 1337 
		n = 0;
2 - 1338 
		for(i = 0; i < m->u.certificate.ncert; i++)
33 7u83 1339 
			n += 3 + m->u.certificate.certs[i]->len;
1340 
		if(p+3+n > e)
1341 
			goto Overflow;
1342 
		put24(p, n), p += 3;
2 - 1343 
		for(i = 0; i < m->u.certificate.ncert; i++){
33 7u83 1344 
			n = m->u.certificate.certs[i]->len;
1345 
			put24(p, n), p += 3;
1346 
			memmove(p, m->u.certificate.certs[i]->data, n);
1347 
			p += n;
2 - 1348 
		}
1349 
		break;
33 7u83 1350 
	case HCertificateVerify:
1351 
		if(p+2+2+(n = m->u.certificateVerify.signature->len) > e)
1352 
			goto Overflow;
1353 
		if(m->u.certificateVerify.sigalg != 0)
1354 
			put16(p, m->u.certificateVerify.sigalg), p += 2;
1355 
		put16(p, n), p += 2;
1356 
		memmove(p, m->u.certificateVerify.signature->data, n);
1357 
		p += n;
1358 
		break;
1359 
	case HServerKeyExchange:
1360 
		if(m->u.serverKeyExchange.pskid != nil){
1361 
			if(p+2+(n = m->u.serverKeyExchange.pskid->len) > e)
1362 
				goto Overflow;
1363 
			put16(p, n), p += 2;
1364 
			memmove(p, m->u.serverKeyExchange.pskid->data, n);
1365 
			p += n;
1366 
		}
1367 
		if(m->u.serverKeyExchange.dh_parameters == nil)
1368 
			break;
1369 
		if(p+(n = m->u.serverKeyExchange.dh_parameters->len) > e)
1370 
			goto Overflow;
1371 
		memmove(p, m->u.serverKeyExchange.dh_parameters->data, n);
1372 
		p += n;
1373 
		if(m->u.serverKeyExchange.dh_signature == nil)
1374 
			break;
1375 
		if(p+2+2+(n = m->u.serverKeyExchange.dh_signature->len) > e)
1376 
			goto Overflow;
1377 
		if(c->version >= TLS12Version)
1378 
			put16(p, m->u.serverKeyExchange.sigalg), p += 2;
1379 
		put16(p, n), p += 2;
1380 
		memmove(p, m->u.serverKeyExchange.dh_signature->data, n);
1381 
		p += n;
1382 
		break;
2 - 1383 
	case HClientKeyExchange:
33 7u83 1384 
		if(m->u.clientKeyExchange.pskid != nil){
1385 
			if(p+2+(n = m->u.clientKeyExchange.pskid->len) > e)
1386 
				goto Overflow;
1387 
			put16(p, n), p += 2;
1388 
			memmove(p, m->u.clientKeyExchange.pskid->data, n);
1389 
			p += n;
2 - 1390 
		}
33 7u83 1391 
		if(m->u.clientKeyExchange.key == nil)
1392 
			break;
1393 
		if(p+2+(n = m->u.clientKeyExchange.key->len) > e)
1394 
			goto Overflow;
1395 
		if(isECDHE(c->cipher))
1396 
			*p++ = n;
1397 
		else if(isDHE(c->cipher) || c->version != SSL3Version)
1398 
			put16(p, n), p += 2;
2 - 1399 
		memmove(p, m->u.clientKeyExchange.key->data, n);
1400 
		p += n;
1401 
		break;
1402 
	case HFinished:
33 7u83 1403 
		if(p+m->u.finished.n > e)
1404 
			goto Overflow;
2 - 1405 
		memmove(p, m->u.finished.verify, m->u.finished.n);
1406 
		p += m->u.finished.n;
1407 
		break;
1408 
	}
1409 
 
1410 
	// go back and fill in size
33 7u83 1411 
	n = p - c->sendp;
1412 
	put24(c->sendp+1, n-4);
2 - 1413 
 
1414 
	// remember hash of Handshake messages
33 7u83 1415 
	if(m->tag != HHelloRequest)
1416 
		msgHash(c, c->sendp, n);
2 - 1417 
 
33 7u83 1418 
	c->sendp = p;
2 - 1419 
	if(act == AFlush){
33 7u83 1420 
		c->sendp = c->buf;
1421 
		if(write(c->hand, c->buf, p - c->buf) < 0){
2 - 1422 
			fprint(2, "write error: %r\n");
1423 
			goto Err;
1424 
		}
1425 
	}
1426 
	msgClear(m);
1427 
	return 1;
33 7u83 1428 
Overflow:
1429 
	tlsError(c, EInternalError, "not enougth send buffer for message (%d)", m->tag);
2 - 1430 
Err:
1431 
	msgClear(m);
1432 
	return 0;
1433 
}
1434 
 
1435 
static uchar*
1436 
tlsReadN(TlsConnection *c, int n)
1437 
{
33 7u83 1438 
	uchar *p, *w, *e;
2 - 1439 
 
33 7u83 1440 
	e = &c->buf[sizeof(c->buf)];
1441 
	p = e - n;
1442 
	if(n > sizeof(c->buf) || p < c->sendp){
1443 
		tlsError(c, EDecodeError, "handshake message too long %d", n);
1444 
		return nil;
2 - 1445 
	}
33 7u83 1446 
	for(w = p; w < e; w += n)
1447 
		if((n = read(c->hand, w, e - w)) <= 0)
1448 
			return nil;
2 - 1449 
	return p;
1450 
}
1451 
 
1452 
static int
1453 
msgRecv(TlsConnection *c, Msg *m)
1454 
{
33 7u83 1455 
	uchar *p, *s;
1456 
	int type, n, nn, i;
2 - 1457 
 
33 7u83 1458 
	msgClear(m);
2 - 1459 
	for(;;) {
1460 
		p = tlsReadN(c, 4);
1461 
		if(p == nil)
1462 
			return 0;
1463 
		type = p[0];
1464 
		n = get24(p+1);
1465 
 
1466 
		if(type != HHelloRequest)
1467 
			break;
1468 
		if(n != 0) {
1469 
			tlsError(c, EDecodeError, "invalid hello request during handshake");
1470 
			return 0;
1471 
		}
1472 
	}
1473 
 
1474 
	if(type == HSSL2ClientHello){
1475 
		/* Cope with an SSL3 ClientHello expressed in SSL2 record format.
1476 
			This is sent by some clients that we must interoperate
1477 
			with, such as Java's JSSE and Microsoft's Internet Explorer. */
33 7u83 1478 
		int nsid, nrandom, nciph;
1479 
 
2 - 1480 
		p = tlsReadN(c, n);
1481 
		if(p == nil)
1482 
			return 0;
33 7u83 1483 
		msgHash(c, p, n);
2 - 1484 
		m->tag = HClientHello;
1485 
		if(n < 22)
1486 
			goto Short;
1487 
		m->u.clientHello.version = get16(p+1);
1488 
		p += 3;
1489 
		n -= 3;
1490 
		nn = get16(p); /* cipher_spec_len */
1491 
		nsid = get16(p + 2);
1492 
		nrandom = get16(p + 4);
1493 
		p += 6;
1494 
		n -= 6;
1495 
		if(nsid != 0 	/* no sid's, since shouldn't restart using ssl2 header */
33 7u83 1496 
		|| nrandom < 16 || nn % 3 || n - nrandom < nn)
2 - 1497 
			goto Err;
1498 
		/* ignore ssl2 ciphers and look for {0x00, ssl3 cipher} */
1499 
		nciph = 0;
1500 
		for(i = 0; i < nn; i += 3)
1501 
			if(p[i] == 0)
1502 
				nciph++;
1503 
		m->u.clientHello.ciphers = newints(nciph);
1504 
		nciph = 0;
1505 
		for(i = 0; i < nn; i += 3)
1506 
			if(p[i] == 0)
1507 
				m->u.clientHello.ciphers->data[nciph++] = get16(&p[i + 1]);
1508 
		p += nn;
1509 
		m->u.clientHello.sid = makebytes(nil, 0);
1510 
		if(nrandom > RandomSize)
1511 
			nrandom = RandomSize;
1512 
		memset(m->u.clientHello.random, 0, RandomSize - nrandom);
1513 
		memmove(&m->u.clientHello.random[RandomSize - nrandom], p, nrandom);
1514 
		m->u.clientHello.compressors = newbytes(1);
1515 
		m->u.clientHello.compressors->data[0] = CompressionNull;
1516 
		goto Ok;
1517 
	}
33 7u83 1518 
	msgHash(c, p, 4);
2 - 1519 
 
1520 
	p = tlsReadN(c, n);
1521 
	if(p == nil)
1522 
		return 0;
1523 
 
33 7u83 1524 
	msgHash(c, p, n);
2 - 1525 
 
1526 
	m->tag = type;
1527 
 
1528 
	switch(type) {
1529 
	default:
1530 
		tlsError(c, EUnexpectedMessage, "can't decode a %d", type);
1531 
		goto Err;
1532 
	case HClientHello:
1533 
		if(n < 2)
1534 
			goto Short;
1535 
		m->u.clientHello.version = get16(p);
33 7u83 1536 
		p += 2, n -= 2;
2 - 1537 
 
1538 
		if(n < RandomSize)
1539 
			goto Short;
1540 
		memmove(m->u.clientHello.random, p, RandomSize);
33 7u83 1541 
		p += RandomSize, n -= RandomSize;
2 - 1542 
		if(n < 1 || n < p[0]+1)
1543 
			goto Short;
1544 
		m->u.clientHello.sid = makebytes(p+1, p[0]);
1545 
		p += m->u.clientHello.sid->len+1;
1546 
		n -= m->u.clientHello.sid->len+1;
1547 
 
1548 
		if(n < 2)
1549 
			goto Short;
1550 
		nn = get16(p);
33 7u83 1551 
		p += 2, n -= 2;
2 - 1552 
 
1553 
		if((nn & 1) || n < nn || nn < 2)
1554 
			goto Short;
1555 
		m->u.clientHello.ciphers = newints(nn >> 1);
1556 
		for(i = 0; i < nn; i += 2)
1557 
			m->u.clientHello.ciphers->data[i >> 1] = get16(&p[i]);
33 7u83 1558 
		p += nn, n -= nn;
2 - 1559 
 
1560 
		if(n < 1 || n < p[0]+1 || p[0] == 0)
1561 
			goto Short;
1562 
		nn = p[0];
33 7u83 1563 
		m->u.clientHello.compressors = makebytes(p+1, nn);
1564 
		p += nn + 1, n -= nn + 1;
1565 
 
1566 
		if(n < 2)
1567 
			break;
1568 
		nn = get16(p);
1569 
		if(nn > n-2)
1570 
			goto Short;
1571 
		m->u.clientHello.extensions = makebytes(p+2, nn);
1572 
		n -= nn + 2;
2 - 1573 
		break;
1574 
	case HServerHello:
1575 
		if(n < 2)
1576 
			goto Short;
1577 
		m->u.serverHello.version = get16(p);
33 7u83 1578 
		p += 2, n -= 2;
2 - 1579 
 
1580 
		if(n < RandomSize)
1581 
			goto Short;
1582 
		memmove(m->u.serverHello.random, p, RandomSize);
33 7u83 1583 
		p += RandomSize, n -= RandomSize;
2 - 1584 
 
1585 
		if(n < 1 || n < p[0]+1)
1586 
			goto Short;
1587 
		m->u.serverHello.sid = makebytes(p+1, p[0]);
1588 
		p += m->u.serverHello.sid->len+1;
1589 
		n -= m->u.serverHello.sid->len+1;
1590 
 
1591 
		if(n < 3)
1592 
			goto Short;
1593 
		m->u.serverHello.cipher = get16(p);
1594 
		m->u.serverHello.compressor = p[2];
33 7u83 1595 
		p += 3, n -= 3;
1596 
 
1597 
		if(n < 2)
1598 
			break;
1599 
		nn = get16(p);
1600 
		if(nn > n-2)
1601 
			goto Short;
1602 
		m->u.serverHello.extensions = makebytes(p+2, nn);
1603 
		n -= nn + 2;
2 - 1604 
		break;
1605 
	case HCertificate:
1606 
		if(n < 3)
1607 
			goto Short;
1608 
		nn = get24(p);
33 7u83 1609 
		p += 3, n -= 3;
1610 
		if(nn == 0 && n > 0)
2 - 1611 
			goto Short;
1612 
		/* certs */
1613 
		i = 0;
1614 
		while(n > 0) {
1615 
			if(n < 3)
1616 
				goto Short;
1617 
			nn = get24(p);
33 7u83 1618 
			p += 3, n -= 3;
2 - 1619 
			if(nn > n)
1620 
				goto Short;
1621 
			m->u.certificate.ncert = i+1;
33 7u83 1622 
			m->u.certificate.certs = erealloc(m->u.certificate.certs, (i+1)*sizeof(Bytes*));
2 - 1623 
			m->u.certificate.certs[i] = makebytes(p, nn);
33 7u83 1624 
			p += nn, n -= nn;
2 - 1625 
			i++;
1626 
		}
1627 
		break;
1628 
	case HCertificateRequest:
1629 
		if(n < 1)
1630 
			goto Short;
1631 
		nn = p[0];
33 7u83 1632 
		p++, n--;
1633 
		if(nn > n)
2 - 1634 
			goto Short;
1635 
		m->u.certificateRequest.types = makebytes(p, nn);
33 7u83 1636 
		p += nn, n -= nn;
1637 
		if(c->version >= TLS12Version){
1638 
			if(n < 2)
1639 
				goto Short;
1640 
			nn = get16(p);
1641 
			p += 2, n -= 2;
1642 
			if(nn & 1)
1643 
				goto Short;
1644 
			m->u.certificateRequest.sigalgs = newints(nn>>1);
1645 
			for(i = 0; i < nn; i += 2)
1646 
				m->u.certificateRequest.sigalgs->data[i >> 1] = get16(&p[i]);
1647 
			p += nn, n -= nn;
1648 
 
1649 
		}
2 - 1650 
		if(n < 2)
1651 
			goto Short;
1652 
		nn = get16(p);
33 7u83 1653 
		p += 2, n -= 2;
2 - 1654 
		/* nn == 0 can happen; yahoo's servers do it */
1655 
		if(nn != n)
1656 
			goto Short;
1657 
		/* cas */
1658 
		i = 0;
1659 
		while(n > 0) {
1660 
			if(n < 2)
1661 
				goto Short;
1662 
			nn = get16(p);
33 7u83 1663 
			p += 2, n -= 2;
2 - 1664 
			if(nn < 1 || nn > n)
1665 
				goto Short;
1666 
			m->u.certificateRequest.nca = i+1;
1667 
			m->u.certificateRequest.cas = erealloc(
33 7u83 1668 
				m->u.certificateRequest.cas, (i+1)*sizeof(Bytes*));
2 - 1669 
			m->u.certificateRequest.cas[i] = makebytes(p, nn);
33 7u83 1670 
			p += nn, n -= nn;
2 - 1671 
			i++;
1672 
		}
1673 
		break;
1674 
	case HServerHelloDone:
1675 
		break;
33 7u83 1676 
	case HServerKeyExchange:
1677 
		if(isPSK(c->cipher)){
1678 
			if(n < 2)
1679 
				goto Short;
1680 
			nn = get16(p);
1681 
			p += 2, n -= 2;
1682 
			if(nn > n)
1683 
				goto Short;
1684 
			m->u.serverKeyExchange.pskid = makebytes(p, nn);
1685 
			p += nn, n -= nn;
1686 
			if(n == 0)
1687 
				break;
1688 
		}
1689 
		if(n < 2)
1690 
			goto Short;
1691 
		s = p;
1692 
		if(isECDHE(c->cipher)){
1693 
			nn = *p;
1694 
			p++, n--;
1695 
			if(nn != 3 || nn > n) /* not a named curve */
1696 
				goto Short;
1697 
			nn = get16(p);
1698 
			p += 2, n -= 2;
1699 
			m->u.serverKeyExchange.curve = nn;
1700 
 
1701 
			nn = *p++, n--;
1702 
			if(nn < 1 || nn > n)
1703 
				goto Short;
1704 
			m->u.serverKeyExchange.dh_Ys = makebytes(p, nn);
1705 
			p += nn, n -= nn;
1706 
		}else if(isDHE(c->cipher)){
1707 
			nn = get16(p);
1708 
			p += 2, n -= 2;
1709 
			if(nn < 1 || nn > n)
1710 
				goto Short;
1711 
			m->u.serverKeyExchange.dh_p = makebytes(p, nn);
1712 
			p += nn, n -= nn;
1713 
 
1714 
			if(n < 2)
1715 
				goto Short;
1716 
			nn = get16(p);
1717 
			p += 2, n -= 2;
1718 
			if(nn < 1 || nn > n)
1719 
				goto Short;
1720 
			m->u.serverKeyExchange.dh_g = makebytes(p, nn);
1721 
			p += nn, n -= nn;
1722 
 
1723 
			if(n < 2)
1724 
				goto Short;
1725 
			nn = get16(p);
1726 
			p += 2, n -= 2;
1727 
			if(nn < 1 || nn > n)
1728 
				goto Short;
1729 
			m->u.serverKeyExchange.dh_Ys = makebytes(p, nn);
1730 
			p += nn, n -= nn;
1731 
		} else {
1732 
			/* should not happen */
1733 
			goto Short;
1734 
		}
1735 
		m->u.serverKeyExchange.dh_parameters = makebytes(s, p - s);
1736 
		if(n >= 2){
1737 
			m->u.serverKeyExchange.sigalg = 0;
1738 
			if(c->version >= TLS12Version){
1739 
				m->u.serverKeyExchange.sigalg = get16(p);
1740 
				p += 2, n -= 2;
1741 
				if(n < 2)
1742 
					goto Short;
1743 
			}
1744 
			nn = get16(p);
1745 
			p += 2, n -= 2;
1746 
			if(nn > 0 && nn <= n){
1747 
				m->u.serverKeyExchange.dh_signature = makebytes(p, nn);
1748 
				n -= nn;
1749 
			}
1750 
		}
1751 
		break;
2 - 1752 
	case HClientKeyExchange:
33 7u83 1753 
		if(isPSK(c->cipher)){
2 - 1754 
			if(n < 2)
1755 
				goto Short;
1756 
			nn = get16(p);
33 7u83 1757 
			p += 2, n -= 2;
1758 
			if(nn > n)
1759 
				goto Short;
1760 
			m->u.clientKeyExchange.pskid = makebytes(p, nn);
1761 
			p += nn, n -= nn;
1762 
			if(n == 0)
1763 
				break;
2 - 1764 
		}
33 7u83 1765 
		if(n < 2)
1766 
			goto Short;
1767 
		if(isECDHE(c->cipher))
1768 
			nn = *p++, n--;
1769 
		else if(isDHE(c->cipher) || c->version != SSL3Version)
1770 
			nn = get16(p), p += 2, n -= 2;
1771 
		else
1772 
			nn = n;
2 - 1773 
		if(n < nn)
1774 
			goto Short;
1775 
		m->u.clientKeyExchange.key = makebytes(p, nn);
1776 
		n -= nn;
1777 
		break;
1778 
	case HFinished:
1779 
		m->u.finished.n = c->finished.n;
1780 
		if(n < m->u.finished.n)
1781 
			goto Short;
1782 
		memmove(m->u.finished.verify, p, m->u.finished.n);
1783 
		n -= m->u.finished.n;
1784 
		break;
1785 
	}
1786 
 
33 7u83 1787 
	if(n != 0 && type != HClientHello && type != HServerHello)
2 - 1788 
		goto Short;
1789 
Ok:
33 7u83 1790 
	if(c->trace)
1791 
		c->trace("recv %s", msgPrint((char*)c->sendp, &c->buf[sizeof(c->buf)] - c->sendp, m));
2 - 1792 
	return 1;
1793 
Short:
33 7u83 1794 
	tlsError(c, EDecodeError, "handshake message (%d) has invalid length", type);
2 - 1795 
Err:
1796 
	msgClear(m);
1797 
	return 0;
1798 
}
1799 
 
1800 
static void
1801 
msgClear(Msg *m)
1802 
{
1803 
	int i;
1804 
 
1805 
	switch(m->tag) {
1806 
	case HHelloRequest:
1807 
		break;
1808 
	case HClientHello:
1809 
		freebytes(m->u.clientHello.sid);
1810 
		freeints(m->u.clientHello.ciphers);
1811 
		freebytes(m->u.clientHello.compressors);
33 7u83 1812 
		freebytes(m->u.clientHello.extensions);
2 - 1813 
		break;
1814 
	case HServerHello:
33 7u83 1815 
		freebytes(m->u.serverHello.sid);
1816 
		freebytes(m->u.serverHello.extensions);
2 - 1817 
		break;
1818 
	case HCertificate:
1819 
		for(i=0; i<m->u.certificate.ncert; i++)
1820 
			freebytes(m->u.certificate.certs[i]);
1821 
		free(m->u.certificate.certs);
1822 
		break;
1823 
	case HCertificateRequest:
1824 
		freebytes(m->u.certificateRequest.types);
33 7u83 1825 
		freeints(m->u.certificateRequest.sigalgs);
2 - 1826 
		for(i=0; i<m->u.certificateRequest.nca; i++)
1827 
			freebytes(m->u.certificateRequest.cas[i]);
1828 
		free(m->u.certificateRequest.cas);
1829 
		break;
33 7u83 1830 
	case HCertificateVerify:
1831 
		freebytes(m->u.certificateVerify.signature);
1832 
		break;
2 - 1833 
	case HServerHelloDone:
1834 
		break;
33 7u83 1835 
	case HServerKeyExchange:
1836 
		freebytes(m->u.serverKeyExchange.pskid);
1837 
		freebytes(m->u.serverKeyExchange.dh_p);
1838 
		freebytes(m->u.serverKeyExchange.dh_g);
1839 
		freebytes(m->u.serverKeyExchange.dh_Ys);
1840 
		freebytes(m->u.serverKeyExchange.dh_parameters);
1841 
		freebytes(m->u.serverKeyExchange.dh_signature);
1842 
		break;
2 - 1843 
	case HClientKeyExchange:
33 7u83 1844 
		freebytes(m->u.clientKeyExchange.pskid);
2 - 1845 
		freebytes(m->u.clientKeyExchange.key);
1846 
		break;
1847 
	case HFinished:
1848 
		break;
1849 
	}
1850 
	memset(m, 0, sizeof(Msg));
1851 
}
1852 
 
1853 
static char *
1854 
bytesPrint(char *bs, char *be, char *s0, Bytes *b, char *s1)
1855 
{
1856 
	int i;
1857 
 
1858 
	if(s0)
1859 
		bs = seprint(bs, be, "%s", s0);
1860 
	if(b == nil)
1861 
		bs = seprint(bs, be, "nil");
33 7u83 1862 
	else {
1863 
		bs = seprint(bs, be, "<%d> [ ", b->len);
2 - 1864 
		for(i=0; i<b->len; i++)
1865 
			bs = seprint(bs, be, "%.2x ", b->data[i]);
33 7u83 1866 
		bs = seprint(bs, be, "]");
1867 
	}
2 - 1868 
	if(s1)
1869 
		bs = seprint(bs, be, "%s", s1);
1870 
	return bs;
1871 
}
1872 
 
1873 
static char *
1874 
intsPrint(char *bs, char *be, char *s0, Ints *b, char *s1)
1875 
{
1876 
	int i;
1877 
 
1878 
	if(s0)
1879 
		bs = seprint(bs, be, "%s", s0);
1880 
	if(b == nil)
1881 
		bs = seprint(bs, be, "nil");
33 7u83 1882 
	else {
1883 
		bs = seprint(bs, be, "[ ");
2 - 1884 
		for(i=0; i<b->len; i++)
1885 
			bs = seprint(bs, be, "%x ", b->data[i]);
33 7u83 1886 
		bs = seprint(bs, be, "]");
1887 
	}
2 - 1888 
	if(s1)
1889 
		bs = seprint(bs, be, "%s", s1);
1890 
	return bs;
1891 
}
1892 
 
1893 
static char*
1894 
msgPrint(char *buf, int n, Msg *m)
1895 
{
1896 
	int i;
1897 
	char *bs = buf, *be = buf+n;
1898 
 
1899 
	switch(m->tag) {
1900 
	default:
1901 
		bs = seprint(bs, be, "unknown %d\n", m->tag);
1902 
		break;
1903 
	case HClientHello:
1904 
		bs = seprint(bs, be, "ClientHello\n");
1905 
		bs = seprint(bs, be, "\tversion: %.4x\n", m->u.clientHello.version);
1906 
		bs = seprint(bs, be, "\trandom: ");
1907 
		for(i=0; i<RandomSize; i++)
1908 
			bs = seprint(bs, be, "%.2x", m->u.clientHello.random[i]);
1909 
		bs = seprint(bs, be, "\n");
1910 
		bs = bytesPrint(bs, be, "\tsid: ", m->u.clientHello.sid, "\n");
1911 
		bs = intsPrint(bs, be, "\tciphers: ", m->u.clientHello.ciphers, "\n");
1912 
		bs = bytesPrint(bs, be, "\tcompressors: ", m->u.clientHello.compressors, "\n");
33 7u83 1913 
		if(m->u.clientHello.extensions != nil)
1914 
			bs = bytesPrint(bs, be, "\textensions: ", m->u.clientHello.extensions, "\n");
2 - 1915 
		break;
1916 
	case HServerHello:
1917 
		bs = seprint(bs, be, "ServerHello\n");
1918 
		bs = seprint(bs, be, "\tversion: %.4x\n", m->u.serverHello.version);
1919 
		bs = seprint(bs, be, "\trandom: ");
1920 
		for(i=0; i<RandomSize; i++)
1921 
			bs = seprint(bs, be, "%.2x", m->u.serverHello.random[i]);
1922 
		bs = seprint(bs, be, "\n");
1923 
		bs = bytesPrint(bs, be, "\tsid: ", m->u.serverHello.sid, "\n");
1924 
		bs = seprint(bs, be, "\tcipher: %.4x\n", m->u.serverHello.cipher);
1925 
		bs = seprint(bs, be, "\tcompressor: %.2x\n", m->u.serverHello.compressor);
33 7u83 1926 
		if(m->u.serverHello.extensions != nil)
1927 
			bs = bytesPrint(bs, be, "\textensions: ", m->u.serverHello.extensions, "\n");
2 - 1928 
		break;
1929 
	case HCertificate:
1930 
		bs = seprint(bs, be, "Certificate\n");
1931 
		for(i=0; i<m->u.certificate.ncert; i++)
1932 
			bs = bytesPrint(bs, be, "\t", m->u.certificate.certs[i], "\n");
1933 
		break;
1934 
	case HCertificateRequest:
1935 
		bs = seprint(bs, be, "CertificateRequest\n");
1936 
		bs = bytesPrint(bs, be, "\ttypes: ", m->u.certificateRequest.types, "\n");
33 7u83 1937 
		if(m->u.certificateRequest.sigalgs != nil)
1938 
			bs = intsPrint(bs, be, "\tsigalgs: ", m->u.certificateRequest.sigalgs, "\n");
2 - 1939 
		bs = seprint(bs, be, "\tcertificateauthorities\n");
1940 
		for(i=0; i<m->u.certificateRequest.nca; i++)
1941 
			bs = bytesPrint(bs, be, "\t\t", m->u.certificateRequest.cas[i], "\n");
1942 
		break;
33 7u83 1943 
	case HCertificateVerify:
1944 
		bs = seprint(bs, be, "HCertificateVerify\n");
1945 
		if(m->u.certificateVerify.sigalg != 0)
1946 
			bs = seprint(bs, be, "\tsigalg: %.4x\n", m->u.certificateVerify.sigalg);
1947 
		bs = bytesPrint(bs, be, "\tsignature: ", m->u.certificateVerify.signature,"\n");
1948 
		break;
2 - 1949 
	case HServerHelloDone:
1950 
		bs = seprint(bs, be, "ServerHelloDone\n");
1951 
		break;
33 7u83 1952 
	case HServerKeyExchange:
1953 
		bs = seprint(bs, be, "HServerKeyExchange\n");
1954 
		if(m->u.serverKeyExchange.pskid != nil)
1955 
			bs = bytesPrint(bs, be, "\tpskid: ", m->u.serverKeyExchange.pskid, "\n");
1956 
		if(m->u.serverKeyExchange.dh_parameters == nil)
1957 
			break;
1958 
		if(m->u.serverKeyExchange.curve != 0){
1959 
			bs = seprint(bs, be, "\tcurve: %.4x\n", m->u.serverKeyExchange.curve);
1960 
		} else {
1961 
			bs = bytesPrint(bs, be, "\tdh_p: ", m->u.serverKeyExchange.dh_p, "\n");
1962 
			bs = bytesPrint(bs, be, "\tdh_g: ", m->u.serverKeyExchange.dh_g, "\n");
1963 
		}
1964 
		bs = bytesPrint(bs, be, "\tdh_Ys: ", m->u.serverKeyExchange.dh_Ys, "\n");
1965 
		if(m->u.serverKeyExchange.sigalg != 0)
1966 
			bs = seprint(bs, be, "\tsigalg: %.4x\n", m->u.serverKeyExchange.sigalg);
1967 
		bs = bytesPrint(bs, be, "\tdh_parameters: ", m->u.serverKeyExchange.dh_parameters, "\n");
1968 
		bs = bytesPrint(bs, be, "\tdh_signature: ", m->u.serverKeyExchange.dh_signature, "\n");
1969 
		break;
2 - 1970 
	case HClientKeyExchange:
1971 
		bs = seprint(bs, be, "HClientKeyExchange\n");
33 7u83 1972 
		if(m->u.clientKeyExchange.pskid != nil)
1973 
			bs = bytesPrint(bs, be, "\tpskid: ", m->u.clientKeyExchange.pskid, "\n");
1974 
		if(m->u.clientKeyExchange.key != nil)
1975 
			bs = bytesPrint(bs, be, "\tkey: ", m->u.clientKeyExchange.key, "\n");
2 - 1976 
		break;
1977 
	case HFinished:
1978 
		bs = seprint(bs, be, "HFinished\n");
1979 
		for(i=0; i<m->u.finished.n; i++)
1980 
			bs = seprint(bs, be, "%.2x", m->u.finished.verify[i]);
1981 
		bs = seprint(bs, be, "\n");
1982 
		break;
1983 
	}
1984 
	USED(bs);
1985 
	return buf;
1986 
}
1987 
 
1988 
static void
1989 
tlsError(TlsConnection *c, int err, char *fmt, ...)
1990 
{
1991 
	char msg[512];
1992 
	va_list arg;
1993 
 
1994 
	va_start(arg, fmt);
1995 
	vseprint(msg, msg+sizeof(msg), fmt, arg);
1996 
	va_end(arg);
1997 
	if(c->trace)
1998 
		c->trace("tlsError: %s\n", msg);
33 7u83 1999 
	if(c->erred)
2 - 2000 
		fprint(2, "double error: %r, %s", msg);
2001 
	else
33 7u83 2002 
		errstr(msg, sizeof(msg));
2 - 2003 
	c->erred = 1;
2004 
	fprint(c->ctl, "alert %d", err);
2005 
}
2006 
 
2007 
// commit to specific version number
2008 
static int
2009 
setVersion(TlsConnection *c, int version)
2010 
{
33 7u83 2011 
	if(version > MaxProtoVersion || version < MinProtoVersion)
2 - 2012 
		return -1;
2013 
	if(version > c->version)
2014 
		version = c->version;
2015 
	if(version == SSL3Version) {
2016 
		c->version = version;
2017 
		c->finished.n = SSL3FinishedLen;
33 7u83 2018 
	}else {
2 - 2019 
		c->version = version;
2020 
		c->finished.n = TLSFinishedLen;
33 7u83 2021 
	}
2 - 2022 
	return fprint(c->ctl, "version 0x%x", version);
2023 
}
2024 
 
2025 
// confirm that received Finished message matches the expected value
2026 
static int
2027 
finishedMatch(TlsConnection *c, Finished *f)
2028 
{
33 7u83 2029 
	return tsmemcmp(f->verify, c->finished.verify, f->n) == 0;
2 - 2030 
}
2031 
 
2032 
// free memory associated with TlsConnection struct
2033 
//		(but don't close the TLS channel itself)
2034 
static void
2035 
tlsConnectionFree(TlsConnection *c)
2036 
{
33 7u83 2037 
	if(c == nil)
2038 
		return;
2039 
 
2040 
	dh_finish(&c->sec->dh, nil);
2041 
 
2042 
	mpfree(c->sec->ec.Q.x);
2043 
	mpfree(c->sec->ec.Q.y);
2044 
	mpfree(c->sec->ec.Q.d);
2045 
	ecdomfree(&c->sec->ec.dom);
2046 
 
2047 
	factotum_rsa_close(c->sec->rpc);
2048 
	rsapubfree(c->sec->rsapub);
2 - 2049 
	freebytes(c->cert);
33 7u83 2050 
 
2051 
	memset(c, 0, sizeof(*c));
2 - 2052 
	free(c);
2053 
}
2054 
 
2055 
 
2056 
//================= cipher choices ========================
2057 
 
33 7u83 2058 
static int
2059 
isDHE(int tlsid)
2 - 2060 
{
33 7u83 2061 
	switch(tlsid){
2062 
	case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256:
2063 
	case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
2064 
 	case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
2065 
 	case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
2066 
 	case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
2067 
	case TLS_DHE_RSA_WITH_CHACHA20_POLY1305:
2068 
	case GOOGLE_DHE_RSA_WITH_CHACHA20_POLY1305:
2069 
		return 1;
2070 
	}
2071 
	return 0;
2072 
}
2 - 2073 
 
2074 
static int
33 7u83 2075 
isECDHE(int tlsid)
2076 
{
2077 
	switch(tlsid){
2078 
	case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305:
2079 
	case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305:
2080 
 
2081 
	case GOOGLE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305:
2082 
	case GOOGLE_ECDHE_RSA_WITH_CHACHA20_POLY1305:
2083 
 
2084 
	case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2085 
	case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:
2086 
 
2087 
	case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2088 
	case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:
2089 
	case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
2090 
	case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
2091 
		return 1;
2092 
	}
2093 
	return 0;
2094 
}
2095 
 
2096 
static int
2097 
isPSK(int tlsid)
2098 
{
2099 
	switch(tlsid){
2100 
	case TLS_PSK_WITH_CHACHA20_POLY1305:
2101 
	case TLS_PSK_WITH_AES_128_CBC_SHA256:
2102 
	case TLS_PSK_WITH_AES_128_CBC_SHA:
2103 
		return 1;
2104 
	}
2105 
	return 0;
2106 
}
2107 
 
2108 
static int
2109 
isECDSA(int tlsid)
2110 
{
2111 
	switch(tlsid){
2112 
	case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305:
2113 
	case GOOGLE_ECDHE_ECDSA_WITH_CHACHA20_POLY1305:
2114 
	case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:
2115 
	case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:
2116 
		return 1;
2117 
	}
2118 
	return 0;
2119 
}
2120 
 
2121 
static int
2 - 2122 
setAlgs(TlsConnection *c, int a)
2123 
{
2124 
	int i;
2125 
 
2126 
	for(i = 0; i < nelem(cipherAlgs); i++){
2127 
		if(cipherAlgs[i].tlsid == a){
33 7u83 2128 
			c->cipher = a;
2 - 2129 
			c->enc = cipherAlgs[i].enc;
2130 
			c->digest = cipherAlgs[i].digest;
2131 
			c->nsecret = cipherAlgs[i].nsecret;
2132 
			if(c->nsecret > MaxKeyData)
2133 
				return 0;
2134 
			return 1;
2135 
		}
2136 
	}
2137 
	return 0;
2138 
}
2139 
 
2140 
static int
33 7u83 2141 
okCipher(Ints *cv, int ispsk)
2 - 2142 
{
33 7u83 2143 
	int i, c;
2 - 2144 
 
33 7u83 2145 
	for(i = 0; i < nelem(cipherAlgs); i++) {
2146 
		c = cipherAlgs[i].tlsid;
2147 
		if(!cipherAlgs[i].ok || isECDSA(c) || isDHE(c) || isPSK(c) != ispsk)
2148 
			continue;
2149 
		if(lookupid(cv, c) >= 0)
2150 
			return c;
2 - 2151 
	}
2152 
	return -1;
2153 
}
2154 
 
2155 
static int
2156 
okCompression(Bytes *cv)
2157 
{
33 7u83 2158 
	int i, c;
2 - 2159 
 
33 7u83 2160 
	for(i = 0; i < nelem(compressors); i++) {
2161 
		c = compressors[i];
2162 
		if(memchr(cv->data, c, cv->len) != nil)
2163 
			return c;
2 - 2164 
	}
2165 
	return -1;
2166 
}
2167 
 
2168 
static Lock	ciphLock;
2169 
static int	nciphers;
2170 
 
2171 
static int
2172 
initCiphers(void)
2173 
{
2174 
	enum {MaxAlgF = 1024, MaxAlgs = 10};
2175 
	char s[MaxAlgF], *flds[MaxAlgs];
2176 
	int i, j, n, ok;
2177 
 
2178 
	lock(&ciphLock);
2179 
	if(nciphers){
2180 
		unlock(&ciphLock);
2181 
		return nciphers;
2182 
	}
2183 
	j = open("#a/tls/encalgs", OREAD);
2184 
	if(j < 0){
2185 
		werrstr("can't open #a/tls/encalgs: %r");
33 7u83 2186 
		goto out;
2 - 2187 
	}
2188 
	n = read(j, s, MaxAlgF-1);
2189 
	close(j);
2190 
	if(n <= 0){
2191 
		werrstr("nothing in #a/tls/encalgs: %r");
33 7u83 2192 
		goto out;
2 - 2193 
	}
2194 
	s[n] = 0;
2195 
	n = getfields(s, flds, MaxAlgs, 1, " \t\r\n");
2196 
	for(i = 0; i < nelem(cipherAlgs); i++){
2197 
		ok = 0;
2198 
		for(j = 0; j < n; j++){
2199 
			if(strcmp(cipherAlgs[i].enc, flds[j]) == 0){
2200 
				ok = 1;
2201 
				break;
2202 
			}
2203 
		}
2204 
		cipherAlgs[i].ok = ok;
2205 
	}
2206 
 
2207 
	j = open("#a/tls/hashalgs", OREAD);
2208 
	if(j < 0){
2209 
		werrstr("can't open #a/tls/hashalgs: %r");
33 7u83 2210 
		goto out;
2 - 2211 
	}
2212 
	n = read(j, s, MaxAlgF-1);
2213 
	close(j);
2214 
	if(n <= 0){
2215 
		werrstr("nothing in #a/tls/hashalgs: %r");
33 7u83 2216 
		goto out;
2 - 2217 
	}
2218 
	s[n] = 0;
2219 
	n = getfields(s, flds, MaxAlgs, 1, " \t\r\n");
2220 
	for(i = 0; i < nelem(cipherAlgs); i++){
2221 
		ok = 0;
2222 
		for(j = 0; j < n; j++){
2223 
			if(strcmp(cipherAlgs[i].digest, flds[j]) == 0){
2224 
				ok = 1;
2225 
				break;
2226 
			}
2227 
		}
2228 
		cipherAlgs[i].ok &= ok;
2229 
		if(cipherAlgs[i].ok)
2230 
			nciphers++;
2231 
	}
33 7u83 2232 
out:
2 - 2233 
	unlock(&ciphLock);
2234 
	return nciphers;
2235 
}
2236 
 
2237 
static Ints*
33 7u83 2238 
makeciphers(int ispsk)
2 - 2239 
{
2240 
	Ints *is;
2241 
	int i, j;
2242 
 
2243 
	is = newints(nciphers);
2244 
	j = 0;
33 7u83 2245 
	for(i = 0; i < nelem(cipherAlgs); i++)
2246 
		if(cipherAlgs[i].ok && isPSK(cipherAlgs[i].tlsid) == ispsk)
2 - 2247 
			is->data[j++] = cipherAlgs[i].tlsid;
33 7u83 2248 
	is->len = j;
2 - 2249 
	return is;
2250 
}
2251 
 
2252 
 
2253 
//================= security functions ========================
2254 
 
33 7u83 2255 
// given a public key, set up connection to factotum
2256 
// for using corresponding private key
2 - 2257 
static AuthRpc*
33 7u83 2258 
factotum_rsa_open(RSApub *rsapub)
2 - 2259 
{
2260 
	int afd;
2261 
	char *s;
33 7u83 2262 
	mpint *n;
2 - 2263 
	AuthRpc *rpc;
2264 
 
2265 
	// start talking to factotum
2266 
	if((afd = open("/mnt/factotum/rpc", ORDWR)) < 0)
2267 
		return nil;
2268 
	if((rpc = auth_allocrpc(afd)) == nil){
2269 
		close(afd);
2270 
		return nil;
2271 
	}
2272 
	s = "proto=rsa service=tls role=client";
33 7u83 2273 
	if(auth_rpc(rpc, "start", s, strlen(s)) == ARok){
2274 
		// roll factotum keyring around to match public key
2275 
		n = mpnew(0);
2276 
		while(auth_rpc(rpc, "read", nil, 0) == ARok){
2277 
			if(strtomp(rpc->arg, nil, 16, n) != nil
2278 
			&& mpcmp(n, rsapub->n) == 0){
2279 
				mpfree(n);
2280 
				return rpc;
2281 
			}
2 - 2282 
		}
33 7u83 2283 
		mpfree(n);
2 - 2284 
	}
33 7u83 2285 
	factotum_rsa_close(rpc);
2286 
	return nil;
2 - 2287 
}
2288 
 
2289 
static mpint*
2290 
factotum_rsa_decrypt(AuthRpc *rpc, mpint *cipher)
2291 
{
2292 
	char *p;
2293 
	int rv;
2294 
 
33 7u83 2295 
	if(cipher == nil)
2 - 2296 
		return nil;
33 7u83 2297 
	p = mptoa(cipher, 16, nil, 0);
2298 
	mpfree(cipher);
2299 
	if(p == nil)
2300 
		return nil;
2 - 2301 
	rv = auth_rpc(rpc, "write", p, strlen(p));
2302 
	free(p);
2303 
	if(rv != ARok || auth_rpc(rpc, "read", nil, 0) != ARok)
2304 
		return nil;
2305 
	return strtomp(rpc->arg, nil, 16, nil);
2306 
}
2307 
 
2308 
static void
33 7u83 2309 
factotum_rsa_close(AuthRpc *rpc)
2 - 2310 
{
33 7u83 2311 
	if(rpc == nil)
2 - 2312 
		return;
2313 
	close(rpc->afd);
2314 
	auth_freerpc(rpc);
2315 
}
2316 
 
2317 
static void
2318 
tlsPmd5(uchar *buf, int nbuf, uchar *key, int nkey, uchar *label, int nlabel, uchar *seed0, int nseed0, uchar *seed1, int nseed1)
2319 
{
2320 
	uchar ai[MD5dlen], tmp[MD5dlen];
2321 
	int i, n;
2322 
	MD5state *s;
2323 
 
2324 
	// generate a1
2325 
	s = hmac_md5(label, nlabel, key, nkey, nil, nil);
2326 
	s = hmac_md5(seed0, nseed0, key, nkey, nil, s);
2327 
	hmac_md5(seed1, nseed1, key, nkey, ai, s);
2328 
 
2329 
	while(nbuf > 0) {
2330 
		s = hmac_md5(ai, MD5dlen, key, nkey, nil, nil);
2331 
		s = hmac_md5(label, nlabel, key, nkey, nil, s);
2332 
		s = hmac_md5(seed0, nseed0, key, nkey, nil, s);
2333 
		hmac_md5(seed1, nseed1, key, nkey, tmp, s);
2334 
		n = MD5dlen;
2335 
		if(n > nbuf)
2336 
			n = nbuf;
2337 
		for(i = 0; i < n; i++)
2338 
			buf[i] ^= tmp[i];
2339 
		buf += n;
2340 
		nbuf -= n;
2341 
		hmac_md5(ai, MD5dlen, key, nkey, tmp, nil);
2342 
		memmove(ai, tmp, MD5dlen);
2343 
	}
2344 
}
2345 
 
2346 
static void
2347 
tlsPsha1(uchar *buf, int nbuf, uchar *key, int nkey, uchar *label, int nlabel, uchar *seed0, int nseed0, uchar *seed1, int nseed1)
2348 
{
2349 
	uchar ai[SHA1dlen], tmp[SHA1dlen];
2350 
	int i, n;
2351 
	SHAstate *s;
2352 
 
2353 
	// generate a1
2354 
	s = hmac_sha1(label, nlabel, key, nkey, nil, nil);
2355 
	s = hmac_sha1(seed0, nseed0, key, nkey, nil, s);
2356 
	hmac_sha1(seed1, nseed1, key, nkey, ai, s);
2357 
 
2358 
	while(nbuf > 0) {
2359 
		s = hmac_sha1(ai, SHA1dlen, key, nkey, nil, nil);
2360 
		s = hmac_sha1(label, nlabel, key, nkey, nil, s);
2361 
		s = hmac_sha1(seed0, nseed0, key, nkey, nil, s);
2362 
		hmac_sha1(seed1, nseed1, key, nkey, tmp, s);
2363 
		n = SHA1dlen;
2364 
		if(n > nbuf)
2365 
			n = nbuf;
2366 
		for(i = 0; i < n; i++)
2367 
			buf[i] ^= tmp[i];
2368 
		buf += n;
2369 
		nbuf -= n;
2370 
		hmac_sha1(ai, SHA1dlen, key, nkey, tmp, nil);
2371 
		memmove(ai, tmp, SHA1dlen);
2372 
	}
2373 
}
2374 
 
33 7u83 2375 
static void
2376 
p_sha256(uchar *buf, int nbuf, uchar *key, int nkey, uchar *label, int nlabel, uchar *seed, int nseed)
2377 
{
2378 
	uchar ai[SHA2_256dlen], tmp[SHA2_256dlen];
2379 
	SHAstate *s;
2380 
	int n;
2381 
 
2382 
	// generate a1
2383 
	s = hmac_sha2_256(label, nlabel, key, nkey, nil, nil);
2384 
	hmac_sha2_256(seed, nseed, key, nkey, ai, s);
2385 
 
2386 
	while(nbuf > 0) {
2387 
		s = hmac_sha2_256(ai, SHA2_256dlen, key, nkey, nil, nil);
2388 
		s = hmac_sha2_256(label, nlabel, key, nkey, nil, s);
2389 
		hmac_sha2_256(seed, nseed, key, nkey, tmp, s);
2390 
		n = SHA2_256dlen;
2391 
		if(n > nbuf)
2392 
			n = nbuf;
2393 
		memmove(buf, tmp, n);
2394 
		buf += n;
2395 
		nbuf -= n;
2396 
		hmac_sha2_256(ai, SHA2_256dlen, key, nkey, tmp, nil);
2397 
		memmove(ai, tmp, SHA2_256dlen);
2398 
	}
2399 
}
2400 
 
2 - 2401 
// fill buf with md5(args)^sha1(args)
2402 
static void
33 7u83 2403 
tls10PRF(uchar *buf, int nbuf, uchar *key, int nkey, char *label, uchar *seed0, int nseed0, uchar *seed1, int nseed1)
2 - 2404 
{
2405 
	int nlabel = strlen(label);
2406 
	int n = (nkey + 1) >> 1;
2407 
 
33 7u83 2408 
	memset(buf, 0, nbuf);
2 - 2409 
	tlsPmd5(buf, nbuf, key, n, (uchar*)label, nlabel, seed0, nseed0, seed1, nseed1);
2410 
	tlsPsha1(buf, nbuf, key+nkey-n, n, (uchar*)label, nlabel, seed0, nseed0, seed1, nseed1);
2411 
}
2412 
 
33 7u83 2413 
static void
2414 
tls12PRF(uchar *buf, int nbuf, uchar *key, int nkey, char *label, uchar *seed0, int nseed0, uchar *seed1, int nseed1)
2415 
{
2416 
	uchar seed[2*RandomSize];
2 - 2417 
 
33 7u83 2418 
	assert(nseed0+nseed1 <= sizeof(seed));
2419 
	memmove(seed, seed0, nseed0);
2420 
	memmove(seed+nseed0, seed1, nseed1);
2421 
	p_sha256(buf, nbuf, key, nkey, (uchar*)label, strlen(label), seed, nseed0+nseed1);
2422 
}
2423 
 
2424 
static void
2425 
sslPRF(uchar *buf, int nbuf, uchar *key, int nkey, char *label, uchar *seed0, int nseed0, uchar *seed1, int nseed1)
2 - 2426 
{
33 7u83 2427 
	uchar sha1dig[SHA1dlen], md5dig[MD5dlen], tmp[26];
2428 
	DigestState *s;
2429 
	int i, n, len;
2 - 2430 
 
33 7u83 2431 
	USED(label);
2432 
	len = 1;
2433 
	while(nbuf > 0){
2434 
		if(len > 26)
2435 
			return;
2436 
		for(i = 0; i < len; i++)
2437 
			tmp[i] = 'A' - 1 + len;
2438 
		s = sha1(tmp, len, nil, nil);
2439 
		s = sha1(key, nkey, nil, s);
2440 
		s = sha1(seed0, nseed0, nil, s);
2441 
		sha1(seed1, nseed1, sha1dig, s);
2442 
		s = md5(key, nkey, nil, nil);
2443 
		md5(sha1dig, SHA1dlen, md5dig, s);
2444 
		n = MD5dlen;
2445 
		if(n > nbuf)
2446 
			n = nbuf;
2447 
		memmove(buf, md5dig, n);
2448 
		buf += n;
2449 
		nbuf -= n;
2450 
		len++;
2451 
	}
2452 
}
2 - 2453 
 
33 7u83 2454 
static void
2455 
sslSetFinished(TlsSec *sec, HandshakeHash hsh, uchar *finished, int isclient)
2456 
{
2457 
	DigestState *s;
2458 
	uchar h0[MD5dlen], h1[SHA1dlen], pad[48];
2459 
	char *label;
2460 
 
2461 
	if(isclient)
2462 
		label = "CLNT";
2463 
	else
2464 
		label = "SRVR";
2465 
 
2466 
	md5((uchar*)label, 4, nil, &hsh.md5);
2467 
	md5(sec->sec, MasterSecretSize, nil, &hsh.md5);
2468 
	memset(pad, 0x36, 48);
2469 
	md5(pad, 48, nil, &hsh.md5);
2470 
	md5(nil, 0, h0, &hsh.md5);
2471 
	memset(pad, 0x5C, 48);
2472 
	s = md5(sec->sec, MasterSecretSize, nil, nil);
2473 
	s = md5(pad, 48, nil, s);
2474 
	md5(h0, MD5dlen, finished, s);
2475 
 
2476 
	sha1((uchar*)label, 4, nil, &hsh.sha1);
2477 
	sha1(sec->sec, MasterSecretSize, nil, &hsh.sha1);
2478 
	memset(pad, 0x36, 40);
2479 
	sha1(pad, 40, nil, &hsh.sha1);
2480 
	sha1(nil, 0, h1, &hsh.sha1);
2481 
	memset(pad, 0x5C, 40);
2482 
	s = sha1(sec->sec, MasterSecretSize, nil, nil);
2483 
	s = sha1(pad, 40, nil, s);
2484 
	sha1(h1, SHA1dlen, finished + MD5dlen, s);
2485 
}
2486 
 
2487 
// fill "finished" arg with md5(args)^sha1(args)
2488 
static void
2489 
tls10SetFinished(TlsSec *sec, HandshakeHash hsh, uchar *finished, int isclient)
2490 
{
2491 
	uchar h0[MD5dlen], h1[SHA1dlen];
2492 
	char *label;
2493 
 
2494 
	// get current hash value, but allow further messages to be hashed in
2495 
	md5(nil, 0, h0, &hsh.md5);
2496 
	sha1(nil, 0, h1, &hsh.sha1);
2497 
 
2498 
	if(isclient)
2499 
		label = "client finished";
2500 
	else
2501 
		label = "server finished";
2502 
	tls10PRF(finished, TLSFinishedLen, sec->sec, MasterSecretSize, label, h0, MD5dlen, h1, SHA1dlen);
2503 
}
2504 
 
2505 
static void
2506 
tls12SetFinished(TlsSec *sec, HandshakeHash hsh, uchar *finished, int isclient)
2507 
{
2508 
	uchar seed[SHA2_256dlen];
2509 
	char *label;
2510 
 
2511 
	// get current hash value, but allow further messages to be hashed in
2512 
	sha2_256(nil, 0, seed, &hsh.sha2_256);
2513 
 
2514 
	if(isclient)
2515 
		label = "client finished";
2516 
	else
2517 
		label = "server finished";
2518 
	p_sha256(finished, TLSFinishedLen, sec->sec, MasterSecretSize, (uchar*)label, strlen(label), seed, SHA2_256dlen);
2519 
}
2520 
 
2521 
static void
2522 
tlsSecInits(TlsSec *sec, int cvers, uchar *crandom)
2523 
{
2524 
	memset(sec, 0, sizeof(*sec));
2525 
	sec->clientVers = cvers;
2 - 2526 
	memmove(sec->crandom, crandom, RandomSize);
2527 
 
33 7u83 2528 
	put32(sec->srandom, time(nil));
2 - 2529 
	genrandom(sec->srandom+4, RandomSize-4);
33 7u83 2530 
}
2 - 2531 
 
33 7u83 2532 
static int
2533 
tlsSecRSAs(TlsSec *sec, Bytes *epm)
2534 
{
2535 
	Bytes *pm;
2536 
 
2537 
	if(epm == nil){
2538 
		werrstr("no encrypted premaster secret");
2539 
		return -1;
2540 
	}
2541 
	// if the client messed up, just continue as if everything is ok,
2542 
	// to prevent attacks to check for correctly formatted messages.
2543 
	pm = pkcs1_decrypt(sec, epm);
2544 
	if(pm == nil || pm->len != MasterSecretSize || get16(pm->data) != sec->clientVers){
2545 
		freebytes(pm);
2546 
		pm = newbytes(MasterSecretSize);
2547 
		genrandom(pm->data, pm->len);
2548 
	}
2549 
	setMasterSecret(sec, pm);
2550 
	return 0;
2 - 2551 
}
2552 
 
33 7u83 2553 
static Bytes*
2554 
tlsSecECDHEs1(TlsSec *sec, Namedcurve *nc)
2555 
{
2556 
	ECdomain *dom = &sec->ec.dom;
2557 
	ECpriv *Q = &sec->ec.Q;
2558 
	Bytes *par;
2559 
	int n;
2560 
 
2561 
	ecdominit(dom, nc->init);
2562 
	memset(Q, 0, sizeof(*Q));
2563 
	Q->x = mpnew(0);
2564 
	Q->y = mpnew(0);
2565 
	Q->d = mpnew(0);
2566 
	ecgen(dom, Q);
2567 
	n = 1 + 2*((mpsignif(dom->p)+7)/8);
2568 
	par = newbytes(1+2+1+n);
2569 
	par->data[0] = 3;
2570 
	put16(par->data+1, nc->tlsid);
2571 
	n = ecencodepub(dom, Q, par->data+4, par->len-4);
2572 
	par->data[3] = n;
2573 
	par->len = 1+2+1+n;
2574 
 
2575 
	return par;
2576 
}
2577 
 
2 - 2578 
static int
33 7u83 2579 
tlsSecECDHEs2(TlsSec *sec, Bytes *Yc)
2 - 2580 
{
33 7u83 2581 
	ECdomain *dom = &sec->ec.dom;
2582 
	ECpriv *Q = &sec->ec.Q;
2583 
	ECpoint K;
2584 
	ECpub *Y;
2585 
 
2586 
	if(Yc == nil){
2587 
		werrstr("no public key");
2588 
		return -1;
2 - 2589 
	}
33 7u83 2590 
 
2591 
	if((Y = ecdecodepub(dom, Yc->data, Yc->len)) == nil){
2592 
		werrstr("bad public key");
2593 
		return -1;
2594 
	}
2595 
 
2596 
	memset(&K, 0, sizeof(K));
2597 
	K.x = mpnew(0);
2598 
	K.y = mpnew(0);
2599 
 
2600 
	ecmul(dom, Y, Q->d, &K);
2601 
 
2602 
	setMasterSecret(sec, mptobytes(K.x, (mpsignif(dom->p)+7)/8));
2603 
 
2604 
	mpfree(K.x);
2605 
	mpfree(K.y);
2606 
 
2607 
	ecpubfree(Y);
2608 
 
2 - 2609 
	return 0;
2610 
}
2611 
 
33 7u83 2612 
static void
2613 
tlsSecInitc(TlsSec *sec, int cvers)
2 - 2614 
{
33 7u83 2615 
	memset(sec, 0, sizeof(*sec));
2 - 2616 
	sec->clientVers = cvers;
33 7u83 2617 
	put32(sec->crandom, time(nil));
2 - 2618 
	genrandom(sec->crandom+4, RandomSize-4);
2619 
}
2620 
 
33 7u83 2621 
static Bytes*
2622 
tlsSecRSAc(TlsSec *sec, uchar *cert, int ncert)
2 - 2623 
{
2624 
	RSApub *pub;
33 7u83 2625 
	Bytes *pm, *epm;
2 - 2626 
 
2627 
	pub = X509toRSApub(cert, ncert, nil, 0);
2628 
	if(pub == nil){
2629 
		werrstr("invalid x509/rsa certificate");
33 7u83 2630 
		return nil;
2 - 2631 
	}
33 7u83 2632 
	pm = newbytes(MasterSecretSize);
2633 
	put16(pm->data, sec->clientVers);
2634 
	genrandom(pm->data+2, MasterSecretSize - 2);
2635 
	epm = pkcs1_encrypt(pm, pub);
2636 
	setMasterSecret(sec, pm);
2 - 2637 
	rsapubfree(pub);
33 7u83 2638 
	return epm;
2 - 2639 
}
2640 
 
2641 
static int
33 7u83 2642 
tlsSecFinished(TlsSec *sec, HandshakeHash hsh, uchar *fin, int nfin, int isclient)
2 - 2643 
{
2644 
	if(sec->nfin != nfin){
2645 
		werrstr("invalid finished exchange");
2646 
		return -1;
2647 
	}
33 7u83 2648 
	hsh.md5.malloced = 0;
2649 
	hsh.sha1.malloced = 0;
2650 
	hsh.sha2_256.malloced = 0;
2651 
	(*sec->setFinished)(sec, hsh, fin, isclient);
2652 
	return 0;
2 - 2653 
}
2654 
 
2655 
static void
33 7u83 2656 
tlsSecVers(TlsSec *sec, int v)
2 - 2657 
{
2658 
	if(v == SSL3Version){
2659 
		sec->setFinished = sslSetFinished;
2660 
		sec->nfin = SSL3FinishedLen;
2661 
		sec->prf = sslPRF;
33 7u83 2662 
	}else if(v < TLS12Version) {
2663 
		sec->setFinished = tls10SetFinished;
2 - 2664 
		sec->nfin = TLSFinishedLen;
33 7u83 2665 
		sec->prf = tls10PRF;
2666 
	}else {
2667 
		sec->setFinished = tls12SetFinished;
2668 
		sec->nfin = TLSFinishedLen;
2669 
		sec->prf = tls12PRF;
2 - 2670 
	}
2671 
}
2672 
 
33 7u83 2673 
static int
2674 
setSecrets(TlsConnection *c, int isclient)
2 - 2675 
{
33 7u83 2676 
	uchar kd[MaxKeyData];
2677 
	char *secrets;
2678 
	int rv;
2679 
 
2680 
	assert(c->nsecret <= sizeof(kd));
2681 
	secrets = emalloc(2*c->nsecret);
2682 
 
2683 
	/*
2684 
	 * generate secret keys from the master secret.
2685 
	 *
2686 
	 * different cipher selections will require different amounts
2687 
	 * of key expansion and use of key expansion data,
2688 
	 * but it's all generated using the same function.
2689 
	 */
2690 
	(*c->sec->prf)(kd, c->nsecret, c->sec->sec, MasterSecretSize, "key expansion",
2691 
			c->sec->srandom, RandomSize, c->sec->crandom, RandomSize);
2692 
 
2693 
	enc64(secrets, 2*c->nsecret, kd, c->nsecret);
2694 
	memset(kd, 0, c->nsecret);
2695 
 
2696 
	rv = fprint(c->ctl, "secret %s %s %d %s", c->digest, c->enc, isclient, secrets);
2697 
	memset(secrets, 0, 2*c->nsecret);
2698 
	free(secrets);
2699 
 
2700 
	return rv;
2 - 2701 
}
2702 
 
2703 
/*
33 7u83 2704 
 * set the master secret from the pre-master secret,
2705 
 * destroys premaster.
2 - 2706 
 */
2707 
static void
2708 
setMasterSecret(TlsSec *sec, Bytes *pm)
2709 
{
33 7u83 2710 
	if(sec->psklen > 0){
2711 
		Bytes *opm = pm;
2712 
		uchar *p;
2 - 2713 
 
33 7u83 2714 
		/* concatenate psk to pre-master secret */
2715 
		pm = newbytes(4 + opm->len + sec->psklen);
2716 
		p = pm->data;
2717 
		put16(p, opm->len), p += 2;
2718 
		memmove(p, opm->data, opm->len), p += opm->len;
2719 
		put16(p, sec->psklen), p += 2;
2720 
		memmove(p, sec->psk, sec->psklen);
2 - 2721 
 
33 7u83 2722 
		memset(opm->data, 0, opm->len);
2723 
		freebytes(opm);
2724 
	}
2 - 2725 
 
33 7u83 2726 
	(*sec->prf)(sec->sec, MasterSecretSize, pm->data, pm->len, "master secret",
2727 
			sec->crandom, RandomSize, sec->srandom, RandomSize);
2728 
 
2 - 2729 
	memset(pm->data, 0, pm->len);
2730 
	freebytes(pm);
2731 
}
2732 
 
2733 
static int
33 7u83 2734 
digestDHparams(TlsSec *sec, Bytes *par, uchar digest[MAXdlen], int sigalg)
2 - 2735 
{
33 7u83 2736 
	int hashalg = (sigalg>>8) & 0xFF;
2737 
	int digestlen;
2738 
	Bytes *blob;
2 - 2739 
 
33 7u83 2740 
	blob = newbytes(2*RandomSize + par->len);
2741 
	memmove(blob->data+0*RandomSize, sec->crandom, RandomSize);
2742 
	memmove(blob->data+1*RandomSize, sec->srandom, RandomSize);
2743 
	memmove(blob->data+2*RandomSize, par->data, par->len);
2744 
	if(hashalg == 0){
2745 
		digestlen = MD5dlen+SHA1dlen;
2746 
		md5(blob->data, blob->len, digest, nil);
2747 
		sha1(blob->data, blob->len, digest+MD5dlen, nil);
2748 
	} else {
2749 
		digestlen = -1;
2750 
		if(hashalg < nelem(hashfun) && hashfun[hashalg].fun != nil){
2751 
			digestlen = hashfun[hashalg].len;
2752 
			(*hashfun[hashalg].fun)(blob->data, blob->len, digest, nil);
2753 
		}
2 - 2754 
	}
33 7u83 2755 
	freebytes(blob);
2756 
	return digestlen;
2 - 2757 
}
2758 
 
33 7u83 2759 
static char*
2760 
verifyDHparams(TlsSec *sec, Bytes *par, Bytes *cert, Bytes *sig, int sigalg)
2 - 2761 
{
33 7u83 2762 
	uchar digest[MAXdlen];
2763 
	int digestlen;
2764 
	ECdomain dom;
2765 
	ECpub *ecpk;
2766 
	RSApub *rsapk;
2767 
	char *err;
2 - 2768 
 
33 7u83 2769 
	if(par == nil || par->len <= 0)
2770 
		return "no DH parameters";
2 - 2771 
 
33 7u83 2772 
	if(sig == nil || sig->len <= 0){
2773 
		if(sec->psklen > 0)
2774 
			return nil;
2775 
		return "no signature";
2776 
	}
2 - 2777 
 
33 7u83 2778 
	if(cert == nil)
2779 
		return "no certificate";
2 - 2780 
 
33 7u83 2781 
	digestlen = digestDHparams(sec, par, digest, sigalg);
2782 
	if(digestlen <= 0)
2783 
		return "unknown signature digest algorithm";
2784 
 
2785 
	switch(sigalg & 0xFF){
2786 
	case 0x01:
2787 
		rsapk = X509toRSApub(cert->data, cert->len, nil, 0);
2788 
		if(rsapk == nil)
2789 
			return "bad certificate";
2790 
		err = X509rsaverifydigest(sig->data, sig->len, digest, digestlen, rsapk);
2791 
		rsapubfree(rsapk);
2792 
		break;
2793 
	case 0x03:
2794 
		ecpk = X509toECpub(cert->data, cert->len, nil, 0, &dom);
2795 
		if(ecpk == nil)
2796 
			return "bad certificate";
2797 
		err = X509ecdsaverifydigest(sig->data, sig->len, digest, digestlen, &dom, ecpk);
2798 
		ecdomfree(&dom);
2799 
		ecpubfree(ecpk);
2800 
		break;
2801 
	default:
2802 
		err = "signaure algorithm not RSA or ECDSA";
2 - 2803 
	}
2804 
 
33 7u83 2805 
	return err;
2 - 2806 
}
2807 
 
33 7u83 2808 
// encrypt data according to PKCS#1, /lib/rfc/rfc2437 9.1.2.1
2 - 2809 
static Bytes*
33 7u83 2810 
pkcs1_encrypt(Bytes* data, RSApub* key)
2 - 2811 
{
2812 
	mpint *x, *y;
2813 
 
33 7u83 2814 
	x = pkcs1padbuf(data->data, data->len, key->n, 2);
2815 
	if(x == nil)
2816 
		return nil;
2 - 2817 
	y = rsaencrypt(key, x, nil);
2818 
	mpfree(x);
33 7u83 2819 
	data = newbytes((mpsignif(key->n)+7)/8);
2820 
	mptober(y, data->data, data->len);
2 - 2821 
	mpfree(y);
33 7u83 2822 
	return data;
2 - 2823 
}
2824 
 
33 7u83 2825 
// decrypt data according to PKCS#1, with given key.
2 - 2826 
static Bytes*
33 7u83 2827 
pkcs1_decrypt(TlsSec *sec, Bytes *data)
2 - 2828 
{
33 7u83 2829 
	mpint *y;
2 - 2830 
 
33 7u83 2831 
	if(data->len != (mpsignif(sec->rsapub->n)+7)/8)
2 - 2832 
		return nil;
33 7u83 2833 
	y = factotum_rsa_decrypt(sec->rpc, bytestomp(data));
2834 
	if(y == nil)
2835 
		return nil;
2836 
	data = mptobytes(y, (mpsignif(y)+7)/8);
2837 
	mpfree(y);
2838 
	if((data->len = pkcs1unpadbuf(data->data, data->len, sec->rsapub->n, 2)) < 0){
2839 
		freebytes(data);
2840 
		return nil;
2 - 2841 
	}
33 7u83 2842 
	return data;
2 - 2843 
}
2844 
 
2845 
static Bytes*
33 7u83 2846 
pkcs1_sign(TlsSec *sec, uchar *digest, int digestlen, int sigalg)
2 - 2847 
{
33 7u83 2848 
	int hashalg = (sigalg>>8)&0xFF;
2849 
	mpint *signedMP;
2850 
	Bytes *signature;
2851 
	uchar buf[128];
2 - 2852 
 
33 7u83 2853 
	if(hashalg > 0 && hashalg < nelem(hashfun) && hashfun[hashalg].len == digestlen)
2854 
		digestlen = asn1encodedigest(hashfun[hashalg].fun, digest, buf, sizeof(buf));
2855 
	else if(digestlen == MD5dlen+SHA1dlen)
2856 
		memmove(buf, digest, digestlen);
2857 
	else
2858 
		digestlen = -1;
2859 
	if(digestlen <= 0){
2860 
		werrstr("bad digest algorithm");
2 - 2861 
		return nil;
33 7u83 2862 
	}
2863 
 
2864 
	signedMP = factotum_rsa_decrypt(sec->rpc, pkcs1padbuf(buf, digestlen, sec->rsapub->n, 1));
2865 
	if(signedMP == nil)
2 - 2866 
		return nil;
33 7u83 2867 
	signature = mptobytes(signedMP, (mpsignif(sec->rsapub->n)+7)/8);
2868 
	mpfree(signedMP);
2869 
	return signature;
2 - 2870 
}
2871 
 
2872 
 
2873 
//================= general utility functions ========================
2874 
 
2875 
static void *
2876 
emalloc(int n)
2877 
{
2878 
	void *p;
2879 
	if(n==0)
2880 
		n=1;
2881 
	p = malloc(n);
33 7u83 2882 
	if(p == nil)
2883 
		sysfatal("out of memory");
2 - 2884 
	memset(p, 0, n);
33 7u83 2885 
	setmalloctag(p, getcallerpc(&n));
2 - 2886 
	return p;
2887 
}
2888 
 
2889 
static void *
2890 
erealloc(void *ReallocP, int ReallocN)
2891 
{
2892 
	if(ReallocN == 0)
2893 
		ReallocN = 1;
33 7u83 2894 
	if(ReallocP == nil)
2 - 2895 
		ReallocP = emalloc(ReallocN);
33 7u83 2896 
	else if((ReallocP = realloc(ReallocP, ReallocN)) == nil)
2897 
		sysfatal("out of memory");
2898 
	setrealloctag(ReallocP, getcallerpc(&ReallocP));
2 - 2899 
	return(ReallocP);
2900 
}
2901 
 
2902 
static void
2903 
put32(uchar *p, u32int x)
2904 
{
2905 
	p[0] = x>>24;
2906 
	p[1] = x>>16;
2907 
	p[2] = x>>8;
2908 
	p[3] = x;
2909 
}
2910 
 
2911 
static void
2912 
put24(uchar *p, int x)
2913 
{
2914 
	p[0] = x>>16;
2915 
	p[1] = x>>8;
2916 
	p[2] = x;
2917 
}
2918 
 
2919 
static void
2920 
put16(uchar *p, int x)
2921 
{
2922 
	p[0] = x>>8;
2923 
	p[1] = x;
2924 
}
2925 
 
2926 
static int
2927 
get24(uchar *p)
2928 
{
2929 
	return (p[0]<<16)|(p[1]<<8)|p[2];
2930 
}
2931 
 
2932 
static int
2933 
get16(uchar *p)
2934 
{
2935 
	return (p[0]<<8)|p[1];
2936 
}
2937 
 
2938 
static Bytes*
2939 
newbytes(int len)
2940 
{
2941 
	Bytes* ans;
2942 
 
33 7u83 2943 
	if(len < 0)
2944 
		abort();
2945 
	ans = emalloc(sizeof(Bytes) + len);
2 - 2946 
	ans->len = len;
2947 
	return ans;
2948 
}
2949 
 
2950 
/*
2951 
 * newbytes(len), with data initialized from buf
2952 
 */
2953 
static Bytes*
2954 
makebytes(uchar* buf, int len)
2955 
{
2956 
	Bytes* ans;
2957 
 
2958 
	ans = newbytes(len);
2959 
	memmove(ans->data, buf, len);
2960 
	return ans;
2961 
}
2962 
 
2963 
static void
2964 
freebytes(Bytes* b)
2965 
{
33 7u83 2966 
	free(b);
2 - 2967 
}
2968 
 
33 7u83 2969 
static mpint*
2970 
bytestomp(Bytes* bytes)
2 - 2971 
{
33 7u83 2972 
	return betomp(bytes->data, bytes->len, nil);
2973 
}
2 - 2974 
 
33 7u83 2975 
/*
2976 
 * Convert mpint* to Bytes, putting high order byte first.
2977 
 */
2978 
static Bytes*
2979 
mptobytes(mpint *big, int len)
2980 
{
2981 
	Bytes* ans;
2982 
 
2983 
	if(len == 0) len++;
2984 
	ans = newbytes(len);
2985 
	mptober(big, ans->data, ans->len);
2 - 2986 
	return ans;
2987 
}
2988 
 
33 7u83 2989 
/* len is number of ints */
2 - 2990 
static Ints*
33 7u83 2991 
newints(int len)
2 - 2992 
{
2993 
	Ints* ans;
2994 
 
33 7u83 2995 
	if(len < 0 || len > ((uint)-1>>1)/sizeof(int))
2996 
		abort();
2997 
	ans = emalloc(sizeof(Ints) + len*sizeof(int));
2998 
	ans->len = len;
2 - 2999 
	return ans;
3000 
}
3001 
 
3002 
static void
3003 
freeints(Ints* b)
3004 
{
33 7u83 3005 
	free(b);
2 - 3006 
}
33 7u83 3007 
 
3008 
static int
3009 
lookupid(Ints* b, int id)
3010 
{
3011 
	int i;
3012 
 
3013 
	for(i=0; i<b->len; i++)
3014 
		if(b->data[i] == id)
3015 
			return i;
3016 
	return -1;
3017 
}