lib/ext_oprfi.c

   1 /*
   2  * Copyright (C) 2007 Free Software Foundation
   3  *
   4  * Author: Simon Josefsson
   5  *
   6  * This file is part of GNUTLS.
   7  *
   8  * The GNUTLS library is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 2.1 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this library; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  21  * USA
  22  *
  23  */
  24
  25 /* Implementation of Opaque PRF Input:
  26  * http://tools.ietf.org/id/draft-rescorla-tls-opaque-prf-input-00.txt
  27  *
  28  */
  29
  30 #include <ext_oprfi.h>
  31
  32 #include <gnutls_errors.h>
  33 #include <gnutls_num.h>
  34
  35 int
  36 oprfi_recv_server (gnutls_session_t session,
  37                    const opaque * data, size_t _data_size)
  38 {
  39   ssize_t data_size = _data_size;
  40   uint16_t len;
  41   int ret;
  42
  43   if (!session->security_parameters.extensions.oprfi_cb)
  44     {
  45       gnutls_assert ();
  46       return 0;
  47     }
  48
  49   DECR_LEN (data_size, 2);
  50   len = _gnutls_read_uint16 (data);
  51   data += 2;
  52
  53   if (len != data_size)
  54     {
  55       gnutls_assert ();
  56       return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
  57     }
  58
  59   /* Store incoming data. */
  60   session->security_parameters.extensions.oprfi_client_len = len;
  61   session->security_parameters.extensions.oprfi_client = gnutls_malloc (len);
  62   if (!session->security_parameters.extensions.oprfi_client)
  63     {
  64       gnutls_assert ();
  65       return GNUTLS_E_MEMORY_ERROR;
  66     }
  67   memcpy (session->security_parameters.extensions.oprfi_client, data, len);
  68
  69   return 0;
  70 }
  71
  72 int
  73 oprfi_recv_client (gnutls_session_t session,
  74                    const opaque * data, size_t _data_size)
  75 {
  76   ssize_t data_size = _data_size;
  77   uint16_t len;
  78   int ret;
  79
  80   if (session->security_parameters.extensions.oprfi_client == NULL)
  81     {
  82       gnutls_assert ();
  83       return 0;
  84     }
  85
  86   DECR_LEN (data_size, 2);
  87   len = _gnutls_read_uint16 (data);
  88   data += 2;
  89
  90   if (len != data_size)
  91     {
  92       gnutls_assert ();
  93       return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
  94     }
  95
  96   if (len != session->security_parameters.extensions.oprfi_client_len)
  97     {
  98       gnutls_assert ();
  99       return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
 100     }
 101
 102   /* Store incoming data. */
 103   session->security_parameters.extensions.oprfi_server_len = len;
 104   session->security_parameters.extensions.oprfi_server = gnutls_malloc (len);
 105   if (!session->security_parameters.extensions.oprfi_server)
 106     {
 107       gnutls_assert ();
 108       return GNUTLS_E_MEMORY_ERROR;
 109     }
 110   memcpy (session->security_parameters.extensions.oprfi_server, data, len);
 111
 112   return 0;
 113 }
 114
 115 int
 116 _gnutls_oprfi_recv_params (gnutls_session_t session,
 117                            const opaque * data, size_t data_size)
 118 {
 119   if (session->security_parameters.entity == GNUTLS_CLIENT)
 120     return oprfi_recv_client (session, data, data_size);
 121   else
 122     return oprfi_recv_server (session, data, data_size);
 123 }
 124
 125 int
 126 oprfi_send_client (gnutls_session_t session, opaque * data, size_t _data_size)
 127 {
 128   opaque *p = data;
 129   ssize_t data_size = _data_size;
 130   int oprf_size = session->security_parameters.extensions.oprfi_client_len;
 131
 132   if (oprf_size == 0)
 133     return 0;
 134
 135   DECR_LENGTH_RET (data_size, 2, GNUTLS_E_SHORT_MEMORY_BUFFER);
 136   _gnutls_write_uint16 (oprf_size, p);
 137   p += 2;
 138
 139   DECR_LENGTH_RET (data_size, oprf_size, GNUTLS_E_SHORT_MEMORY_BUFFER);
 140
 141   memcpy (p, session->security_parameters.extensions.oprfi_client, oprf_size);
 142
 143   return 2 + oprf_size;
 144 }
 145
 146 int
 147 oprfi_send_server (gnutls_session_t session, opaque * data, size_t _data_size)
 148 {
 149   opaque *p = data;
 150   int ret;
 151   ssize_t data_size = _data_size;
 152   size_t len;
 153
 154   if (!session->security_parameters.extensions.oprfi_client ||
 155       !session->security_parameters.extensions.oprfi_cb)
 156     return 0;
 157
 158   /* Allocate buffer for outgoing data. */
 159   session->security_parameters.extensions.oprfi_server_len =
 160     session->security_parameters.extensions.oprfi_client_len;
 161   session->security_parameters.extensions.oprfi_server =
 162     gnutls_malloc (session->security_parameters.extensions.oprfi_server_len);
 163   if (!session->security_parameters.extensions.oprfi_server)
 164     {
 165       gnutls_assert ();
 166       return GNUTLS_E_MEMORY_ERROR;
 167     }
 168
 169   /* Get outgoing data. */
 170   ret = session->security_parameters.extensions.oprfi_cb
 171     (session, session->security_parameters.extensions.oprfi_userdata,
 172      session->security_parameters.extensions.oprfi_client_len,
 173      session->security_parameters.extensions.oprfi_client,
 174      session->security_parameters.extensions.oprfi_server);
 175   if (ret < 0)
 176     {
 177       gnutls_assert ();
 178       gnutls_free (session->security_parameters.extensions.oprfi_server);
 179       return ret;
 180     }
 181
 182   DECR_LENGTH_RET (data_size, 2, GNUTLS_E_SHORT_MEMORY_BUFFER);
 183   _gnutls_write_uint16 (session->security_parameters.
 184                         extensions.oprfi_server_len, p);
 185   p += 2;
 186
 187   DECR_LENGTH_RET (data_size,
 188                    session->security_parameters.extensions.oprfi_server_len,
 189                    GNUTLS_E_SHORT_MEMORY_BUFFER);
 190
 191   memcpy (p, session->security_parameters.extensions.oprfi_server,
 192           session->security_parameters.extensions.oprfi_server_len);
 193
 194   return 2 + session->security_parameters.extensions.oprfi_server_len;
 195 }
 196
 197 int
 198 _gnutls_oprfi_send_params (gnutls_session_t session,
 199                            opaque * data, size_t data_size)
 200 {
 201   if (session->security_parameters.entity == GNUTLS_CLIENT)
 202     return oprfi_send_client (session, data, data_size);
 203   else
 204     return oprfi_send_server (session, data, data_size);
 205 }
 206
 207 /**
 208  * gnutls_oprfi_enable_client:
 209  * @session: is a #gnutls_session_t structure.
 210  * @len: length of Opaque PRF data to use in client.
 211  * @data: Opaque PRF data to use in client.
 212  *
 213  * Request that the client should attempt to negotiate the Opaque PRF
 214  * Input TLS extension, using the given data as the client's Opaque
 215  * PRF input.
 216  *
 217  * The data is copied into the session context after this call, so you
 218  * may de-allocate it immediately after calling this function.
 219  **/
 220 void
 221 gnutls_oprfi_enable_client (gnutls_session_t session,
 222                             size_t len, unsigned char *data)
 223 {
 224   session->security_parameters.extensions.oprfi_client_len = len;
 225   session->security_parameters.extensions.oprfi_client = data;
 226 }
 227
 228 /**
 229  * gnutls_oprfi_enable_server:
 230  * @session: is a #gnutls_session_t structure.
 231  * @cb: function pointer to Opaque PRF extension server callback.
 232  * @userdata: hook passed to callback function for passing application state.
 233  *
 234  * Request that the server should attempt to accept the Opaque PRF
 235  * Input TLS extension.  If the client requests the extension, the
 236  * provided callback @cb will be invoked.  The callback must have the
 237  * following prototype:
 238  *
 239  * int callback (gnutls_session_t session, void *userdata,
 240  *               size_t oprfi_len, const unsigned char *in_oprfi,
 241  *               unsigned char *out_oprfi);
 242  *
 243  * The callback can inspect the client-provided data in the input
 244  * parameters, and specify its own opaque prf input data in the output
 245  * variable.  The function must return 0 on success, otherwise the
 246  * handshake will be aborted.
 247  **/
 248 void
 249 gnutls_oprfi_enable_server (gnutls_session_t session,
 250                             gnutls_oprfi_callback_func cb, void *userdata)
 251 {
 252   session->security_parameters.extensions.oprfi_cb = cb;
 253   session->security_parameters.extensions.oprfi_userdata = userdata;
 254 }