lib/auth_srp_rsa.c

   1 /*
   2  * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GNUTLS.
   7  *
   8  * The GNUTLS library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 2.1 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  21  * USA
  22  *
  23  */
  24
  25 #include <gnutls_int.h>
  26
  27 #ifdef ENABLE_SRP
  28
  29 #include "gnutls_errors.h"
  30 #include "auth_srp_passwd.h"
  31 #include "gnutls_auth.h"
  32 #include "gnutls_auth.h"
  33 #include "gnutls_srp.h"
  34 #include "debug.h"
  35 #include "gnutls_num.h"
  36 #include "auth_srp.h"
  37 #include <gnutls_str.h>
  38 #include <auth_cert.h>
  39 #include <gnutls_datum.h>
  40 #include <gnutls_sig.h>
  41 #include <auth_srp.h>
  42 #include <gnutls_x509.h>
  43
  44 static int gen_srp_cert_server_kx (gnutls_session_t, opaque **);
  45 static int proc_srp_cert_server_kx (gnutls_session_t, opaque *, size_t);
  46
  47 const mod_auth_st srp_rsa_auth_struct = {
  48   "SRP",
  49   _gnutls_gen_cert_server_certificate,
  50   NULL,
  51   gen_srp_cert_server_kx,
  52   _gnutls_gen_srp_client_kx,
  53   NULL,
  54   NULL,
  55
  56   _gnutls_proc_cert_server_certificate,
  57   NULL,                         /* certificate */
  58   proc_srp_cert_server_kx,
  59   _gnutls_proc_srp_client_kx,
  60   NULL,
  61   NULL
  62 };
  63
  64 const mod_auth_st srp_dss_auth_struct = {
  65   "SRP",
  66   _gnutls_gen_cert_server_certificate,
  67   NULL,
  68   gen_srp_cert_server_kx,
  69   _gnutls_gen_srp_client_kx,
  70   NULL,
  71   NULL,
  72
  73   _gnutls_proc_cert_server_certificate,
  74   NULL,                         /* certificate */
  75   proc_srp_cert_server_kx,
  76   _gnutls_proc_srp_client_kx,
  77   NULL,
  78   NULL
  79 };
  80
  81 static int
  82 gen_srp_cert_server_kx (gnutls_session_t session, opaque ** data)
  83 {
  84   ssize_t ret, data_size;
  85   gnutls_datum_t signature, ddata;
  86   gnutls_certificate_credentials_t cred;
  87   gnutls_cert *apr_cert_list;
  88   gnutls_privkey *apr_pkey;
  89   int apr_cert_list_length;
  90   gnutls_sign_algorithm_t sign_algo;
  91
  92   ret = _gnutls_gen_srp_server_kx (session, data);
  93
  94   if (ret < 0)
  95     return ret;
  96
  97   data_size = ret;
  98   ddata.data = *data;
  99   ddata.size = data_size;
 100
 101   cred = (gnutls_certificate_credentials_t)
 102     _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
 103   if (cred == NULL)
 104     {
 105       gnutls_assert ();
 106       return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
 107     }
 108
 109   /* find the appropriate certificate */
 110   if ((ret =
 111        _gnutls_get_selected_cert (session, &apr_cert_list,
 112                                   &apr_cert_list_length, &apr_pkey)) < 0)
 113     {
 114       gnutls_assert ();
 115       return ret;
 116     }
 117
 118   if ((ret =
 119        _gnutls_handshake_sign_data (session, &apr_cert_list[0],
 120                                 apr_pkey, &ddata, &signature,
 121                                 &sign_algo)) < 0)
 122     {
 123       gnutls_assert ();
 124       gnutls_free (*data);
 125       return ret;
 126     }
 127
 128   *data = gnutls_realloc_fast (*data, data_size + signature.size + 2);
 129   if (*data == NULL)
 130     {
 131       _gnutls_free_datum (&signature);
 132       gnutls_assert ();
 133       return GNUTLS_E_MEMORY_ERROR;
 134     }
 135
 136   _gnutls_write_datum16 (&(*data)[data_size], signature);
 137   data_size += signature.size + 2;
 138
 139   _gnutls_free_datum (&signature);
 140
 141   return data_size;
 142
 143 }
 144
 145 static int
 146 proc_srp_cert_server_kx (gnutls_session_t session, opaque * data,
 147                          size_t _data_size)
 148 {
 149   ssize_t ret;
 150   int sigsize;
 151   gnutls_datum_t vparams, signature;
 152   ssize_t data_size;
 153   cert_auth_info_t info;
 154   gnutls_cert peer_cert;
 155   opaque *p;
 156
 157   ret = _gnutls_proc_srp_server_kx (session, data, _data_size);
 158   if (ret < 0)
 159     return ret;
 160
 161   data_size = _data_size - ret;
 162
 163   info = _gnutls_get_auth_info (session);
 164   if (info == NULL || info->ncerts == 0)
 165     {
 166       gnutls_assert ();
 167       /* we need this in order to get peer's certificate */
 168       return GNUTLS_E_INTERNAL_ERROR;
 169     }
 170
 171   /* VERIFY SIGNATURE */
 172
 173   vparams.size = ret;           /* all the data minus the signature */
 174   vparams.data = data;
 175
 176   p = &data[vparams.size];
 177
 178   DECR_LEN (data_size, 2);
 179   sigsize = _gnutls_read_uint16 (p);
 180
 181   DECR_LEN (data_size, sigsize);
 182   signature.data = &p[2];
 183   signature.size = sigsize;
 184
 185   ret =
 186     _gnutls_get_auth_info_gcert (&peer_cert,
 187                                  session->security_parameters.cert_type,
 188                                  info, CERT_NO_COPY);
 189
 190   if (ret < 0)
 191     {
 192       gnutls_assert ();
 193       return ret;
 194     }
 195
 196   ret = _gnutls_handshake_verify_data (session, &peer_cert, &vparams, &signature,
 197                                    GNUTLS_SIGN_UNKNOWN);
 198
 199   _gnutls_gcert_deinit (&peer_cert);
 200   if (ret < 0)
 201     {
 202       gnutls_assert ();
 203       return ret;
 204     }
 205
 206   return 0;
 207 }
 208
 209
 210 #endif /* ENABLE_SRP */