lib/gnutls_kx.c

   1 /*
   2  * Copyright (C) 2000, 2001, 2004, 2005, 2006, 2008  Free Software Foundation
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GNUTLS.
   7  *
   8  * The GNUTLS library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 2.1 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  21  * USA
  22  *
  23  */
  24
  25 /* This file contains functions which are wrappers for the key exchange
  26  * part of TLS. They are called by the handshake functions (gnutls_handshake)
  27  */
  28
  29 #include "gnutls_int.h"
  30 #include "gnutls_handshake.h"
  31 #include "gnutls_kx.h"
  32 #include "gnutls_dh.h"
  33 #include "gnutls_errors.h"
  34 #include "gnutls_algorithms.h"
  35 #include "debug.h"
  36 #include "gnutls_mpi.h"
  37 #include <gnutls_state.h>
  38 #include <gnutls_datum.h>
  39 #include <gnutls_rsa_export.h>
  40
  41 /* This file contains important thing for the TLS handshake procedure.
  42  */
  43
  44 #define MASTER_SECRET "master secret"
  45 static int generate_normal_master (gnutls_session_t session, int);
  46
  47 int
  48 _gnutls_generate_master (gnutls_session_t session, int keep_premaster)
  49 {
  50   if (session->internals.resumed == RESUME_FALSE)
  51     return generate_normal_master (session, keep_premaster);
  52   return 0;
  53 }
  54
  55 /* here we generate the TLS Master secret.
  56  */
  57 #define PREMASTER session->key->key
  58 static int
  59 generate_normal_master (gnutls_session_t session, int keep_premaster)
  60 {
  61   int ret = 0;
  62   char buf[512];
  63
  64   _gnutls_hard_log ("INT: PREMASTER SECRET[%d]: %s\n", PREMASTER.size,
  65                     _gnutls_bin2hex (PREMASTER.data, PREMASTER.size, buf,
  66                                      sizeof (buf)));
  67   _gnutls_hard_log ("INT: CLIENT RANDOM[%d]: %s\n", 32,
  68                     _gnutls_bin2hex (session->security_parameters.
  69                                      client_random, 32, buf, sizeof (buf)));
  70   _gnutls_hard_log ("INT: SERVER RANDOM[%d]: %s\n", 32,
  71                     _gnutls_bin2hex (session->security_parameters.
  72                                      server_random, 32, buf, sizeof (buf)));
  73
  74   if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
  75     {
  76       opaque rnd[2 * GNUTLS_RANDOM_SIZE + 1];
  77
  78       memcpy (rnd, session->security_parameters.client_random,
  79               GNUTLS_RANDOM_SIZE);
  80       memcpy (&rnd[GNUTLS_RANDOM_SIZE],
  81               session->security_parameters.server_random, GNUTLS_RANDOM_SIZE);
  82
  83       ret =
  84         _gnutls_ssl3_generate_random (PREMASTER.data, PREMASTER.size,
  85                                       rnd, 2 * GNUTLS_RANDOM_SIZE,
  86                                       GNUTLS_MASTER_SIZE,
  87                                       session->security_parameters.
  88                                       master_secret);
  89
  90     }
  91   else if (session->security_parameters.extensions.oprfi_client_len > 0 &&
  92            session->security_parameters.extensions.oprfi_server_len > 0)
  93     {
  94       opaque *rnd;
  95       size_t rndlen = 2 * GNUTLS_RANDOM_SIZE;
  96
  97       rndlen += session->security_parameters.extensions.oprfi_client_len;
  98       rndlen += session->security_parameters.extensions.oprfi_server_len;
  99
 100       rnd = gnutls_malloc (rndlen + 1);
 101       if (!rnd)
 102         {
 103           gnutls_assert ();
 104           return GNUTLS_E_MEMORY_ERROR;
 105         }
 106
 107       _gnutls_hard_log ("INT: CLIENT OPRFI[%d]: %s\n",
 108                         session->security_parameters.
 109                         extensions.oprfi_server_len,
 110                         _gnutls_bin2hex (session->security_parameters.
 111                                          extensions.oprfi_client,
 112                                          session->security_parameters.
 113                                          extensions.oprfi_client_len, buf,
 114                                          sizeof (buf)));
 115       _gnutls_hard_log ("INT: SERVER OPRFI[%d]: %s\n",
 116                         session->security_parameters.
 117                         extensions.oprfi_server_len,
 118                         _gnutls_bin2hex (session->security_parameters.
 119                                          extensions.oprfi_server,
 120                                          session->security_parameters.
 121                                          extensions.oprfi_server_len, buf,
 122                                          sizeof (buf)));
 123
 124       memcpy (rnd, session->security_parameters.client_random,
 125               GNUTLS_RANDOM_SIZE);
 126       memcpy (rnd + GNUTLS_RANDOM_SIZE,
 127               session->security_parameters.extensions.oprfi_client,
 128               session->security_parameters.extensions.oprfi_client_len);
 129       memcpy (rnd + GNUTLS_RANDOM_SIZE +
 130               session->security_parameters.extensions.oprfi_client_len,
 131               session->security_parameters.server_random, GNUTLS_RANDOM_SIZE);
 132       memcpy (rnd + GNUTLS_RANDOM_SIZE +
 133               session->security_parameters.extensions.oprfi_client_len +
 134               GNUTLS_RANDOM_SIZE,
 135               session->security_parameters.extensions.oprfi_server,
 136               session->security_parameters.extensions.oprfi_server_len);
 137
 138       ret = _gnutls_PRF (session, PREMASTER.data, PREMASTER.size,
 139                          MASTER_SECRET, strlen (MASTER_SECRET),
 140                          rnd, rndlen, GNUTLS_MASTER_SIZE,
 141                          session->security_parameters.master_secret);
 142
 143       gnutls_free (rnd);
 144     }
 145   else
 146     {
 147       opaque rnd[2 * GNUTLS_RANDOM_SIZE + 1];
 148
 149       memcpy (rnd, session->security_parameters.client_random,
 150               GNUTLS_RANDOM_SIZE);
 151       memcpy (&rnd[GNUTLS_RANDOM_SIZE],
 152               session->security_parameters.server_random, GNUTLS_RANDOM_SIZE);
 153
 154       ret =
 155         _gnutls_PRF (session, PREMASTER.data, PREMASTER.size,
 156                      MASTER_SECRET, strlen (MASTER_SECRET),
 157                      rnd, 2 * GNUTLS_RANDOM_SIZE, GNUTLS_MASTER_SIZE,
 158                      session->security_parameters.master_secret);
 159     }
 160
 161   /* TLS/IA inner secret is derived from the master secret. */
 162   memcpy (session->security_parameters.inner_secret,
 163           session->security_parameters.master_secret, GNUTLS_MASTER_SIZE);
 164
 165   if (!keep_premaster)
 166     _gnutls_free_datum (&PREMASTER);
 167
 168   if (ret < 0)
 169     return ret;
 170
 171   _gnutls_hard_log ("INT: MASTER SECRET: %s\n",
 172                     _gnutls_bin2hex (session->security_parameters.
 173                                      master_secret, GNUTLS_MASTER_SIZE, buf,
 174                                      sizeof (buf)));
 175
 176   return ret;
 177 }
 178
 179
 180 /* This is called when we want to receive the key exchange message of the
 181  * server. It does nothing if this type of message is not required
 182  * by the selected ciphersuite.
 183  */
 184 int
 185 _gnutls_send_server_kx_message (gnutls_session_t session, int again)
 186 {
 187   uint8_t *data = NULL;
 188   int data_size = 0;
 189   int ret = 0;
 190
 191   if (session->internals.auth_struct->gnutls_generate_server_kx == NULL)
 192     return 0;
 193
 194   data = NULL;
 195   data_size = 0;
 196
 197   if (again == 0)
 198     {
 199       data_size =
 200         session->internals.auth_struct->gnutls_generate_server_kx (session,
 201                                                                    &data);
 202
 203       if (data_size == GNUTLS_E_INT_RET_0)
 204         {
 205           gnutls_assert ();
 206           return 0;
 207         }
 208
 209       if (data_size < 0)
 210         {
 211           gnutls_assert ();
 212           return data_size;
 213         }
 214     }
 215
 216   ret =
 217     _gnutls_send_handshake (session, data, data_size,
 218                             GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE);
 219   gnutls_free (data);
 220
 221   if (ret < 0)
 222     {
 223       gnutls_assert ();
 224       return ret;
 225     }
 226   return data_size;
 227 }
 228
 229 /* This function sends a certificate request message to the
 230  * client.
 231  */
 232 int
 233 _gnutls_send_server_certificate_request (gnutls_session_t session, int again)
 234 {
 235   uint8_t *data = NULL;
 236   int data_size = 0;
 237   int ret = 0;
 238
 239   if (session->internals.auth_struct->
 240       gnutls_generate_server_certificate_request == NULL)
 241     return 0;
 242
 243   if (session->internals.send_cert_req <= 0)
 244     return 0;
 245
 246   data = NULL;
 247   data_size = 0;
 248
 249   if (again == 0)
 250     {
 251       data_size =
 252         session->internals.auth_struct->
 253         gnutls_generate_server_certificate_request (session, &data);
 254
 255       if (data_size < 0)
 256         {
 257           gnutls_assert ();
 258           return data_size;
 259         }
 260     }
 261   ret =
 262     _gnutls_send_handshake (session, data, data_size,
 263                             GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST);
 264   gnutls_free (data);
 265
 266   if (ret < 0)
 267     {
 268       gnutls_assert ();
 269       return ret;
 270     }
 271   return data_size;
 272 }
 273
 274
 275 /* This is the function for the client to send the key
 276  * exchange message
 277  */
 278 int
 279 _gnutls_send_client_kx_message (gnutls_session_t session, int again)
 280 {
 281   uint8_t *data;
 282   int data_size;
 283   int ret = 0;
 284
 285   if (session->internals.auth_struct->gnutls_generate_client_kx == NULL)
 286     return 0;
 287
 288
 289   data = NULL;
 290   data_size = 0;
 291
 292   if (again == 0)
 293     {
 294       data_size =
 295         session->internals.auth_struct->gnutls_generate_client_kx (session,
 296                                                                    &data);
 297       if (data_size < 0)
 298         {
 299           gnutls_assert ();
 300           return data_size;
 301         }
 302     }
 303   ret =
 304     _gnutls_send_handshake (session, data, data_size,
 305                             GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE);
 306   gnutls_free (data);
 307
 308   if (ret < 0)
 309     {
 310       gnutls_assert ();
 311       return ret;
 312     }
 313
 314   return ret;
 315 }
 316
 317
 318 /* This is the function for the client to send the certificate
 319  * verify message
 320  */
 321 int
 322 _gnutls_send_client_certificate_verify (gnutls_session_t session, int again)
 323 {
 324   uint8_t *data;
 325   int ret = 0;
 326   int data_size;
 327
 328   /* This is a packet that is only sent by the client
 329    */
 330   if (session->security_parameters.entity == GNUTLS_SERVER)
 331     return 0;
 332
 333   /* if certificate verify is not needed just exit
 334    */
 335   if (session->key->certificate_requested == 0)
 336     return 0;
 337
 338   if (session->internals.auth_struct->gnutls_generate_client_cert_vrfy ==
 339       NULL)
 340     {
 341       gnutls_assert ();
 342       return 0;                 /* this algorithm does not support cli_cert_vrfy
 343                                  */
 344     }
 345
 346   data = NULL;
 347   data_size = 0;
 348
 349   if (again == 0)
 350     {
 351       data_size =
 352         session->internals.auth_struct->
 353         gnutls_generate_client_cert_vrfy (session, &data);
 354       if (data_size < 0)
 355         {
 356           gnutls_assert ();
 357           return data_size;
 358         }
 359       if (data_size == 0)
 360         return 0;
 361
 362     }
 363   ret =
 364     _gnutls_send_handshake (session, data,
 365                             data_size, GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY);
 366   gnutls_free (data);
 367
 368   return ret;
 369 }
 370
 371
 372 int
 373 _gnutls_recv_server_kx_message (gnutls_session_t session)
 374 {
 375   uint8_t *data = NULL;
 376   int datasize;
 377   int ret = 0;
 378   Optional optflag = MANDATORY_PACKET;
 379
 380   if (session->internals.auth_struct->gnutls_process_server_kx != NULL)
 381     {
 382
 383       /* EXCEPTION FOR RSA_EXPORT cipher suite
 384        */
 385       if (_gnutls_session_is_export (session) != 0 &&
 386           _gnutls_peers_cert_less_512 (session) != 0)
 387         {
 388           gnutls_assert ();
 389           return 0;
 390         }
 391
 392       /* Server key exchange packet is optional for PSK. */
 393       if (_gnutls_session_is_psk (session))
 394         optflag = OPTIONAL_PACKET;
 395
 396       ret =
 397         _gnutls_recv_handshake (session, &data,
 398                                 &datasize,
 399                                 GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE,
 400                                 optflag);
 401       if (ret < 0)
 402         {
 403           gnutls_assert ();
 404           return ret;
 405         }
 406
 407       ret =
 408         session->internals.auth_struct->gnutls_process_server_kx (session,
 409                                                                   data,
 410                                                                   datasize);
 411       gnutls_free (data);
 412
 413       if (ret < 0)
 414         {
 415           gnutls_assert ();
 416           return ret;
 417         }
 418
 419     }
 420   return ret;
 421 }
 422
 423 int
 424 _gnutls_recv_server_certificate_request (gnutls_session_t session)
 425 {
 426   uint8_t *data;
 427   int datasize;
 428   int ret = 0;
 429
 430   if (session->internals.auth_struct->
 431       gnutls_process_server_certificate_request != NULL)
 432     {
 433
 434       ret =
 435         _gnutls_recv_handshake (session, &data,
 436                                 &datasize,
 437                                 GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST,
 438                                 OPTIONAL_PACKET);
 439       if (ret < 0)
 440         return ret;
 441
 442       if (ret == 0 && datasize == 0)
 443         return 0;               /* ignored */
 444
 445       ret =
 446         session->internals.auth_struct->
 447         gnutls_process_server_certificate_request (session, data, datasize);
 448       gnutls_free (data);
 449       if (ret < 0)
 450         return ret;
 451
 452     }
 453   return ret;
 454 }
 455
 456 int
 457 _gnutls_recv_client_kx_message (gnutls_session_t session)
 458 {
 459   uint8_t *data;
 460   int datasize;
 461   int ret = 0;
 462
 463
 464   /* Do key exchange only if the algorithm permits it */
 465   if (session->internals.auth_struct->gnutls_process_client_kx != NULL)
 466     {
 467
 468       ret =
 469         _gnutls_recv_handshake (session, &data,
 470                                 &datasize,
 471                                 GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE,
 472                                 MANDATORY_PACKET);
 473       if (ret < 0)
 474         return ret;
 475
 476       ret =
 477         session->internals.auth_struct->gnutls_process_client_kx (session,
 478                                                                   data,
 479                                                                   datasize);
 480       gnutls_free (data);
 481       if (ret < 0)
 482         return ret;
 483
 484     }
 485
 486   return ret;
 487 }
 488
 489
 490 /* This is called when we want send our certificate
 491  */
 492 int
 493 _gnutls_send_client_certificate (gnutls_session_t session, int again)
 494 {
 495   uint8_t *data = NULL;
 496   int data_size = 0;
 497   int ret = 0;
 498
 499
 500   if (session->key->certificate_requested == 0)
 501     return 0;
 502
 503   if (session->internals.auth_struct->gnutls_generate_client_certificate ==
 504       NULL)
 505     return 0;
 506
 507   data = NULL;
 508   data_size = 0;
 509
 510   if (again == 0)
 511     {
 512       if (gnutls_protocol_get_version (session) != GNUTLS_SSL3 ||
 513           session->internals.selected_cert_list_length > 0)
 514         {
 515           /* TLS 1.0 or SSL 3.0 with a valid certificate
 516            */
 517           data_size =
 518             session->internals.auth_struct->
 519             gnutls_generate_client_certificate (session, &data);
 520
 521           if (data_size < 0)
 522             {
 523               gnutls_assert ();
 524               return data_size;
 525             }
 526         }
 527     }
 528
 529   /* In the SSL 3.0 protocol we need to send a
 530    * no certificate alert instead of an
 531    * empty certificate.
 532    */
 533   if (gnutls_protocol_get_version (session) == GNUTLS_SSL3 &&
 534       session->internals.selected_cert_list_length == 0)
 535     {
 536       ret =
 537         gnutls_alert_send (session, GNUTLS_AL_WARNING,
 538                            GNUTLS_A_SSL3_NO_CERTIFICATE);
 539
 540     }
 541   else
 542     {                           /* TLS 1.0 or SSL 3.0 with a valid certificate
 543                                  */
 544       ret =
 545         _gnutls_send_handshake (session, data, data_size,
 546                                 GNUTLS_HANDSHAKE_CERTIFICATE_PKT);
 547       gnutls_free (data);
 548     }
 549
 550   if (ret < 0)
 551     {
 552       gnutls_assert ();
 553       return ret;
 554     }
 555
 556   return data_size;
 557 }
 558
 559
 560 /* This is called when we want send our certificate
 561  */
 562 int
 563 _gnutls_send_server_certificate (gnutls_session_t session, int again)
 564 {
 565   uint8_t *data = NULL;
 566   int data_size = 0;
 567   int ret = 0;
 568
 569
 570   if (session->internals.auth_struct->gnutls_generate_server_certificate ==
 571       NULL)
 572     return 0;
 573
 574   data = NULL;
 575   data_size = 0;
 576
 577   if (again == 0)
 578     {
 579       data_size =
 580         session->internals.auth_struct->
 581         gnutls_generate_server_certificate (session, &data);
 582
 583       if (data_size < 0)
 584         {
 585           gnutls_assert ();
 586           return data_size;
 587         }
 588     }
 589   ret =
 590     _gnutls_send_handshake (session, data, data_size,
 591                             GNUTLS_HANDSHAKE_CERTIFICATE_PKT);
 592   gnutls_free (data);
 593
 594   if (ret < 0)
 595     {
 596       gnutls_assert ();
 597       return ret;
 598     }
 599
 600   return data_size;
 601 }
 602
 603
 604 int
 605 _gnutls_recv_client_certificate (gnutls_session_t session)
 606 {
 607   int datasize;
 608   opaque *data;
 609   int ret = 0;
 610   int optional;
 611
 612   if (session->internals.auth_struct->gnutls_process_client_certificate !=
 613       NULL)
 614     {
 615
 616       /* if we have not requested a certificate then just return
 617        */
 618       if (session->internals.send_cert_req == 0)
 619         {
 620           return 0;
 621         }
 622
 623       if (session->internals.send_cert_req == GNUTLS_CERT_REQUIRE)
 624         optional = MANDATORY_PACKET;
 625       else
 626         optional = OPTIONAL_PACKET;
 627
 628       ret =
 629         _gnutls_recv_handshake (session, &data,
 630                                 &datasize,
 631                                 GNUTLS_HANDSHAKE_CERTIFICATE_PKT, optional);
 632
 633       if (ret < 0)
 634         {
 635           /* Handle the case of old SSL3 clients who send
 636            * a warning alert instead of an empty certificate to indicate
 637            * no certificate.
 638            */
 639           if (optional == OPTIONAL_PACKET &&
 640               ret == GNUTLS_E_WARNING_ALERT_RECEIVED &&
 641               gnutls_protocol_get_version (session) == GNUTLS_SSL3 &&
 642               gnutls_alert_get (session) == GNUTLS_A_SSL3_NO_CERTIFICATE)
 643             {
 644
 645               /* SSL3 does not send an empty certificate,
 646                * but this alert. So we just ignore it.
 647                */
 648               gnutls_assert ();
 649               return 0;
 650             }
 651
 652           /* certificate was required
 653            */
 654           if ((ret == GNUTLS_E_WARNING_ALERT_RECEIVED
 655                || ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
 656               && optional == MANDATORY_PACKET)
 657             {
 658               gnutls_assert ();
 659               return GNUTLS_E_NO_CERTIFICATE_FOUND;
 660             }
 661
 662           return ret;
 663         }
 664
 665       if (ret == 0 && datasize == 0 && optional == OPTIONAL_PACKET)
 666         {
 667           /* Client has not sent the certificate message.
 668            * well I'm not sure we should accept this
 669            * behaviour.
 670            */
 671           gnutls_assert ();
 672           return 0;
 673         }
 674       ret =
 675         session->internals.auth_struct->
 676         gnutls_process_client_certificate (session, data, datasize);
 677
 678       gnutls_free (data);
 679       if (ret < 0 && ret != GNUTLS_E_NO_CERTIFICATE_FOUND)
 680         {
 681           gnutls_assert ();
 682           return ret;
 683         }
 684
 685       /* ok we should expect a certificate verify message now
 686        */
 687       if (ret == GNUTLS_E_NO_CERTIFICATE_FOUND && optional == OPTIONAL_PACKET)
 688         ret = 0;
 689       else
 690         session->key->certificate_requested = 1;
 691
 692     }
 693
 694   return ret;
 695 }
 696
 697 int
 698 _gnutls_recv_server_certificate (gnutls_session_t session)
 699 {
 700   int datasize;
 701   opaque *data;
 702   int ret = 0;
 703
 704   if (session->internals.auth_struct->gnutls_process_server_certificate !=
 705       NULL)
 706     {
 707
 708       ret =
 709         _gnutls_recv_handshake (session, &data,
 710                                 &datasize,
 711                                 GNUTLS_HANDSHAKE_CERTIFICATE_PKT,
 712                                 MANDATORY_PACKET);
 713       if (ret < 0)
 714         {
 715           gnutls_assert ();
 716           return ret;
 717         }
 718
 719       ret =
 720         session->internals.auth_struct->
 721         gnutls_process_server_certificate (session, data, datasize);
 722       gnutls_free (data);
 723       if (ret < 0)
 724         {
 725           gnutls_assert ();
 726           return ret;
 727         }
 728     }
 729
 730   return ret;
 731 }
 732
 733
 734 /* Recv the client certificate verify. This packet may not
 735  * arrive if the peer did not send us a certificate.
 736  */
 737 int
 738 _gnutls_recv_client_certificate_verify_message (gnutls_session_t session)
 739 {
 740   uint8_t *data;
 741   int datasize;
 742   int ret = 0;
 743
 744
 745   if (session->internals.auth_struct->gnutls_process_client_cert_vrfy != NULL)
 746     {
 747
 748       if (session->internals.send_cert_req == 0 ||
 749           session->key->certificate_requested == 0)
 750         {
 751           return 0;
 752         }
 753
 754       ret =
 755         _gnutls_recv_handshake (session, &data,
 756                                 &datasize,
 757                                 GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY,
 758                                 OPTIONAL_PACKET);
 759       if (ret < 0)
 760         return ret;
 761
 762       if (ret == 0 && datasize == 0
 763           && session->internals.send_cert_req == GNUTLS_CERT_REQUIRE)
 764         {
 765           /* certificate was required */
 766           gnutls_assert ();
 767           return GNUTLS_E_NO_CERTIFICATE_FOUND;
 768         }
 769
 770       ret =
 771         session->internals.auth_struct->
 772         gnutls_process_client_cert_vrfy (session, data, datasize);
 773       gnutls_free (data);
 774       if (ret < 0)
 775         return ret;
 776
 777     }
 778
 779   return ret;
 780 }