iPXE
|
Transport Layer Security Protocol. More...
#include <stdint.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <time.h>
#include <errno.h>
#include <byteswap.h>
#include <ipxe/pending.h>
#include <ipxe/hmac.h>
#include <ipxe/md5.h>
#include <ipxe/sha1.h>
#include <ipxe/sha256.h>
#include <ipxe/aes.h>
#include <ipxe/rsa.h>
#include <ipxe/iobuf.h>
#include <ipxe/xfer.h>
#include <ipxe/open.h>
#include <ipxe/x509.h>
#include <ipxe/privkey.h>
#include <ipxe/certstore.h>
#include <ipxe/rootcert.h>
#include <ipxe/rbg.h>
#include <ipxe/validator.h>
#include <ipxe/job.h>
#include <ipxe/dhe.h>
#include <ipxe/ecdhe.h>
#include <ipxe/tls.h>
#include <config/crypto.h>
Go to the source code of this file.
Data Structures | |
struct | tls24_t |
A TLS 24-bit integer. More... | |
Functions | |
FILE_LICENCE (GPL2_OR_LATER) | |
static | LIST_HEAD (tls_sessions) |
List of TLS session. More... | |
static void | tls_tx_resume_all (struct tls_session *session) |
Resume TX state machine for all connections within a session. More... | |
static int | tls_send_plaintext (struct tls_connection *tls, unsigned int type, const void *data, size_t len) |
Send plaintext record. More... | |
static void | tls_clear_cipher (struct tls_connection *tls, struct tls_cipherspec *cipherspec) |
static unsigned long | tls_uint24 (const tls24_t *field24) |
Extract 24-bit field value. More... | |
static void | tls_set_uint24 (tls24_t *field24, unsigned long value) |
Set 24-bit field value. More... | |
static int | tls_ready (struct tls_connection *tls) |
Determine if TLS connection is ready for application data. More... | |
static int | tls_version (struct tls_connection *tls, unsigned int version) |
Check for TLS version. More... | |
static void | md5_sha1_init (void *ctx) |
Initialise MD5+SHA1 algorithm. More... | |
static void | md5_sha1_update (void *ctx, const void *data, size_t len) |
Accumulate data with MD5+SHA1 algorithm. More... | |
static void | md5_sha1_final (void *ctx, void *out) |
Generate MD5+SHA1 digest. More... | |
static void | free_tls_session (struct refcnt *refcnt) |
Free TLS session. More... | |
static void | free_tls (struct refcnt *refcnt) |
Free TLS connection. More... | |
static void | tls_close (struct tls_connection *tls, int rc) |
Finish with TLS connection. More... | |
static int | tls_generate_random (struct tls_connection *tls, void *data, size_t len) |
Generate random data. More... | |
static void | tls_hmac_update_va (struct digest_algorithm *digest, void *ctx, va_list args) |
Update HMAC with a list of ( data, len ) pairs. More... | |
static void | tls_p_hash_va (struct tls_connection *tls, struct digest_algorithm *digest, const void *secret, size_t secret_len, void *out, size_t out_len, va_list seeds) |
Generate secure pseudo-random data using a single hash function. More... | |
static void | tls_prf (struct tls_connection *tls, const void *secret, size_t secret_len, void *out, size_t out_len,...) |
Generate secure pseudo-random data. More... | |
static void | tls_generate_master_secret (struct tls_connection *tls, const void *pre_master_secret, size_t pre_master_secret_len) |
Generate master secret. More... | |
static int | tls_generate_keys (struct tls_connection *tls) |
Generate key material. More... | |
static void | tls_clear_handshake (struct tls_connection *tls) |
Clear handshake digest algorithm. More... | |
static int | tls_select_handshake (struct tls_connection *tls, struct digest_algorithm *digest) |
Select handshake digest algorithm. More... | |
static int | tls_add_handshake (struct tls_connection *tls, const void *data, size_t len) |
Add handshake record to verification hash. More... | |
static void | tls_verify_handshake (struct tls_connection *tls, void *out) |
Calculate handshake verification hash. More... | |
static struct tls_cipher_suite * | tls_find_cipher_suite (unsigned int cipher_suite) |
Identify cipher suite. More... | |
static void | tls_clear_cipher (struct tls_connection *tls __unused, struct tls_cipherspec *cipherspec) |
Clear cipher suite. More... | |
static int | tls_set_cipher (struct tls_connection *tls, struct tls_cipherspec *cipherspec, struct tls_cipher_suite *suite) |
Set cipher suite. More... | |
static int | tls_select_cipher (struct tls_connection *tls, unsigned int cipher_suite) |
Select next cipher suite. More... | |
static int | tls_change_cipher (struct tls_connection *tls, struct tls_cipherspec_pair *pair) |
Activate next cipher suite. More... | |
static struct tls_signature_hash_algorithm * | tls_signature_hash_algorithm (struct pubkey_algorithm *pubkey, struct digest_algorithm *digest) |
Find TLS signature and hash algorithm. More... | |
static struct pubkey_algorithm * | tls_signature_hash_pubkey (struct tls_signature_hash_id code) |
Find TLS signature algorithm. More... | |
static struct digest_algorithm * | tls_signature_hash_digest (struct tls_signature_hash_id code) |
Find TLS hash algorithm. More... | |
static struct tls_named_curve * | tls_find_named_curve (unsigned int named_curve) |
Identify named curve. More... | |
static void | tls_tx_resume (struct tls_connection *tls) |
Resume TX state machine. More... | |
static void | tls_restart (struct tls_connection *tls) |
Restart negotiation. More... | |
static int | tls_send_handshake (struct tls_connection *tls, const void *data, size_t len) |
Transmit Handshake record. More... | |
static int | tls_client_hello (struct tls_connection *tls, int(*action)(struct tls_connection *tls, const void *data, size_t len)) |
Digest or transmit Client Hello record. More... | |
static int | tls_send_client_hello (struct tls_connection *tls) |
Transmit Client Hello record. More... | |
static int | tls_send_certificate (struct tls_connection *tls) |
Transmit Certificate record. More... | |
static int | tls_send_client_key_exchange_pubkey (struct tls_connection *tls) |
Transmit Client Key Exchange record using public key exchange. More... | |
static int | tls_verify_dh_params (struct tls_connection *tls, size_t param_len) |
Verify Diffie-Hellman parameter signature. More... | |
static int | tls_send_client_key_exchange_dhe (struct tls_connection *tls) |
Transmit Client Key Exchange record using DHE key exchange. More... | |
static int | tls_send_client_key_exchange_ecdhe (struct tls_connection *tls) |
Transmit Client Key Exchange record using ECDHE key exchange. More... | |
static int | tls_send_client_key_exchange (struct tls_connection *tls) |
Transmit Client Key Exchange record. More... | |
static int | tls_send_certificate_verify (struct tls_connection *tls) |
Transmit Certificate Verify record. More... | |
static int | tls_send_change_cipher (struct tls_connection *tls) |
Transmit Change Cipher record. More... | |
static int | tls_send_finished (struct tls_connection *tls) |
Transmit Finished record. More... | |
static int | tls_new_change_cipher (struct tls_connection *tls, struct io_buffer *iobuf) |
Receive new Change Cipher record. More... | |
static int | tls_new_alert (struct tls_connection *tls, struct io_buffer *iobuf) |
Receive new Alert record. More... | |
static int | tls_new_hello_request (struct tls_connection *tls, const void *data __unused, size_t len __unused) |
Receive new Hello Request handshake record. More... | |
static int | tls_new_server_hello (struct tls_connection *tls, const void *data, size_t len) |
Receive new Server Hello handshake record. More... | |
static int | tls_new_session_ticket (struct tls_connection *tls, const void *data, size_t len) |
Receive New Session Ticket handshake record. More... | |
static int | tls_parse_chain (struct tls_connection *tls, const void *data, size_t len) |
Parse certificate chain. More... | |
static int | tls_new_certificate (struct tls_connection *tls, const void *data, size_t len) |
Receive new Certificate handshake record. More... | |
static int | tls_new_server_key_exchange (struct tls_connection *tls, const void *data, size_t len) |
Receive new Server Key Exchange handshake record. More... | |
static int | tls_new_certificate_request (struct tls_connection *tls, const void *data __unused, size_t len __unused) |
Receive new Certificate Request handshake record. More... | |
static int | tls_new_server_hello_done (struct tls_connection *tls, const void *data, size_t len) |
Receive new Server Hello Done handshake record. More... | |
static int | tls_new_finished (struct tls_connection *tls, const void *data, size_t len) |
Receive new Finished handshake record. More... | |
static int | tls_new_handshake (struct tls_connection *tls, struct io_buffer *iobuf) |
Receive new Handshake record. More... | |
static int | tls_new_unknown (struct tls_connection *tls __unused, struct io_buffer *iobuf) |
Receive new unknown record. More... | |
static int | tls_new_data (struct tls_connection *tls, struct list_head *rx_data) |
Receive new data record. More... | |
static int | tls_new_record (struct tls_connection *tls, unsigned int type, struct list_head *rx_data) |
Receive new record. More... | |
static void | tls_hmac_init (struct tls_cipherspec *cipherspec, void *ctx, struct tls_auth_header *authhdr) |
Initialise HMAC. More... | |
static void | tls_hmac_update (struct tls_cipherspec *cipherspec, void *ctx, const void *data, size_t len) |
Update HMAC. More... | |
static void | tls_hmac_final (struct tls_cipherspec *cipherspec, void *ctx, void *hmac) |
Finalise HMAC. More... | |
static void | tls_hmac (struct tls_cipherspec *cipherspec, struct tls_auth_header *authhdr, const void *data, size_t len, void *hmac) |
Calculate HMAC. More... | |
static void | tls_hmac_list (struct tls_cipherspec *cipherspec, struct tls_auth_header *authhdr, struct list_head *list, void *hmac) |
Calculate HMAC over list of I/O buffers. More... | |
static int | tls_verify_padding (struct tls_connection *tls, struct io_buffer *iobuf) |
Verify block padding. More... | |
static int | tls_new_ciphertext (struct tls_connection *tls, struct tls_header *tlshdr, struct list_head *rx_data) |
Receive new ciphertext record. More... | |
static size_t | tls_plainstream_window (struct tls_connection *tls) |
Check flow control window. More... | |
static int | tls_plainstream_deliver (struct tls_connection *tls, struct io_buffer *iobuf, struct xfer_metadata *meta __unused) |
Deliver datagram as raw data. More... | |
static int | tls_progress (struct tls_connection *tls, struct job_progress *progress) |
Report job progress. More... | |
static int | tls_newdata_process_header (struct tls_connection *tls) |
Handle received TLS header. More... | |
static int | tls_newdata_process_data (struct tls_connection *tls) |
Handle received TLS data payload. More... | |
static size_t | tls_cipherstream_window (struct tls_connection *tls) |
Check flow control window. More... | |
static int | tls_cipherstream_deliver (struct tls_connection *tls, struct io_buffer *iobuf, struct xfer_metadata *xfer __unused) |
Receive new ciphertext. More... | |
static void | tls_validator_done (struct tls_connection *tls, int rc) |
Handle certificate validation completion. More... | |
static void | tls_tx_step (struct tls_connection *tls) |
TLS TX state machine. More... | |
static int | tls_session (struct tls_connection *tls, const char *name) |
Find or create session for TLS connection. More... | |
int | add_tls (struct interface *xfer, const char *name, struct x509_root *root, struct private_key *key) |
Add TLS on an interface. More... | |
REQUIRING_SYMBOL (add_tls) | |
REQUIRE_OBJECT (config_crypto) | |
Variables | |
static struct digest_algorithm | md5_sha1_algorithm |
Hybrid MD5+SHA1 digest algorithm. More... | |
struct rsa_digestinfo_prefix rsa_md5_sha1_prefix | __rsa_digestinfo_prefix |
RSA digestInfo prefix for MD5+SHA1 algorithm. More... | |
struct tls_cipher_suite | tls_cipher_suite_null |
Null cipher suite. More... | |
struct tls_key_exchange_algorithm | tls_pubkey_exchange_algorithm |
Public key exchange algorithm. More... | |
struct tls_key_exchange_algorithm | tls_dhe_exchange_algorithm |
Ephemeral Diffie-Hellman key exchange algorithm. More... | |
struct tls_key_exchange_algorithm | tls_ecdhe_exchange_algorithm |
Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm. More... | |
static struct interface_operation | tls_plainstream_ops [] |
TLS plaintext stream interface operations. More... | |
static struct interface_descriptor | tls_plainstream_desc |
TLS plaintext stream interface descriptor. More... | |
static struct interface_operation | tls_cipherstream_ops [] |
TLS ciphertext stream interface operations. More... | |
static struct interface_descriptor | tls_cipherstream_desc |
TLS ciphertext stream interface descriptor. More... | |
static struct interface_operation | tls_validator_ops [] |
TLS certificate validator interface operations. More... | |
static struct interface_descriptor | tls_validator_desc |
TLS certificate validator interface descriptor. More... | |
static struct process_descriptor | tls_process_desc |
TLS TX process descriptor. More... | |
Transport Layer Security Protocol.
Definition in file tls.c.
#define EINVAL_CHANGE_CIPHER __einfo_error ( EINFO_EINVAL_CHANGE_CIPHER ) |
#define EINFO_EINVAL_CHANGE_CIPHER |
#define EINVAL_ALERT __einfo_error ( EINFO_EINVAL_ALERT ) |
#define EINFO_EINVAL_ALERT |
#define EINVAL_HELLO __einfo_error ( EINFO_EINVAL_HELLO ) |
#define EINFO_EINVAL_HELLO |
#define EINVAL_CERTIFICATE __einfo_error ( EINFO_EINVAL_CERTIFICATE ) |
#define EINFO_EINVAL_CERTIFICATE |
#define EINVAL_CERTIFICATES __einfo_error ( EINFO_EINVAL_CERTIFICATES ) |
#define EINFO_EINVAL_CERTIFICATES |
#define EINVAL_HELLO_DONE __einfo_error ( EINFO_EINVAL_HELLO_DONE ) |
#define EINFO_EINVAL_HELLO_DONE |
#define EINVAL_FINISHED __einfo_error ( EINFO_EINVAL_FINISHED ) |
#define EINFO_EINVAL_FINISHED |
#define EINVAL_HANDSHAKE __einfo_error ( EINFO_EINVAL_HANDSHAKE ) |
#define EINFO_EINVAL_HANDSHAKE |
#define EINVAL_IV __einfo_error ( EINFO_EINVAL_IV ) |
#define EINFO_EINVAL_IV |
#define EINVAL_PADDING __einfo_error ( EINFO_EINVAL_PADDING ) |
#define EINFO_EINVAL_PADDING |
#define EINVAL_RX_STATE __einfo_error ( EINFO_EINVAL_RX_STATE ) |
#define EINFO_EINVAL_RX_STATE |
#define EINVAL_MAC __einfo_error ( EINFO_EINVAL_MAC ) |
#define EINFO_EINVAL_MAC |
#define EINVAL_TICKET __einfo_error ( EINFO_EINVAL_TICKET ) |
#define EINFO_EINVAL_TICKET |
#define EINVAL_KEY_EXCHANGE __einfo_error ( EINFO_EINVAL_KEY_EXCHANGE ) |
#define EINFO_EINVAL_KEY_EXCHANGE |
#define EIO_ALERT __einfo_error ( EINFO_EIO_ALERT ) |
#define EINFO_EIO_ALERT |
#define ENOMEM_CONTEXT __einfo_error ( EINFO_ENOMEM_CONTEXT ) |
#define EINFO_ENOMEM_CONTEXT |
#define ENOMEM_CERTIFICATE __einfo_error ( EINFO_ENOMEM_CERTIFICATE ) |
#define EINFO_ENOMEM_CERTIFICATE |
#define ENOMEM_CHAIN __einfo_error ( EINFO_ENOMEM_CHAIN ) |
#define EINFO_ENOMEM_CHAIN |
#define ENOMEM_TX_PLAINTEXT __einfo_error ( EINFO_ENOMEM_TX_PLAINTEXT ) |
#define EINFO_ENOMEM_TX_PLAINTEXT |
#define ENOMEM_TX_CIPHERTEXT __einfo_error ( EINFO_ENOMEM_TX_CIPHERTEXT ) |
#define EINFO_ENOMEM_TX_CIPHERTEXT |
#define ENOMEM_RX_DATA __einfo_error ( EINFO_ENOMEM_RX_DATA ) |
#define EINFO_ENOMEM_RX_DATA |
#define ENOMEM_RX_CONCAT __einfo_error ( EINFO_ENOMEM_RX_CONCAT ) |
#define EINFO_ENOMEM_RX_CONCAT |
#define ENOTSUP_CIPHER __einfo_error ( EINFO_ENOTSUP_CIPHER ) |
#define EINFO_ENOTSUP_CIPHER |
#define ENOTSUP_NULL __einfo_error ( EINFO_ENOTSUP_NULL ) |
#define EINFO_ENOTSUP_NULL |
#define ENOTSUP_SIG_HASH __einfo_error ( EINFO_ENOTSUP_SIG_HASH ) |
#define EINFO_ENOTSUP_SIG_HASH |
#define ENOTSUP_VERSION __einfo_error ( EINFO_ENOTSUP_VERSION ) |
#define EINFO_ENOTSUP_VERSION |
#define ENOTSUP_CURVE __einfo_error ( EINFO_ENOTSUP_CURVE ) |
#define EINFO_ENOTSUP_CURVE |
#define EPERM_ALERT __einfo_error ( EINFO_EPERM_ALERT ) |
#define EINFO_EPERM_ALERT |
#define EPERM_VERIFY __einfo_error ( EINFO_EPERM_VERIFY ) |
#define EINFO_EPERM_VERIFY |
#define EPERM_CLIENT_CERT __einfo_error ( EINFO_EPERM_CLIENT_CERT ) |
#define EINFO_EPERM_CLIENT_CERT |
#define EPERM_RENEG_INSECURE __einfo_error ( EINFO_EPERM_RENEG_INSECURE ) |
#define EINFO_EPERM_RENEG_INSECURE |
#define EPERM_RENEG_VERIFY __einfo_error ( EINFO_EPERM_RENEG_VERIFY ) |
#define EINFO_EPERM_RENEG_VERIFY |
#define EPERM_KEY_EXCHANGE __einfo_error ( EINFO_EPERM_KEY_EXCHANGE ) |
#define EINFO_EPERM_KEY_EXCHANGE |
#define EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION ) |
#define EINFO_EPROTO_VERSION |
Generate secure pseudo-random data.
secret | Secret |
secret_len | Length of secret |
out | Output buffer |
out_len | Length of output buffer |
label | String literal label |
... | ( data, len ) pairs of seed data |
#define TLS_NUM_CIPHER_SUITES table_num_entries ( TLS_CIPHER_SUITES ) |
#define TLS_NUM_SIG_HASH_ALGORITHMS table_num_entries ( TLS_SIG_HASH_ALGORITHMS ) |
#define TLS_NUM_NAMED_CURVES table_num_entries ( TLS_NAMED_CURVES ) |
FILE_LICENCE | ( | GPL2_OR_LATER | ) |
|
static |
List of TLS session.
|
static |
Resume TX state machine for all connections within a session.
session | TLS session |
Definition at line 1091 of file tls.c.
References tls_session::conn, tls_connection::list, list_for_each_entry, tls_connection::session, and tls_tx_resume().
Referenced by tls_close(), and tls_new_finished().
|
static |
Send plaintext record.
tls | TLS connection |
type | Record type |
data | Plaintext record |
len | Length of plaintext record |
rc | Return status code |
Definition at line 2939 of file tls.c.
References __attribute__, tls_cipherspec_pair::active, assert(), cipher_algorithm::authsize, cipher_algorithm::blocksize, tls_cipher_suite::cipher, cipher_auth(), tls_cipherspec::cipher_ctx, cipher_encrypt, cipher_setiv(), tls_tx::cipherspec, tls_connection::cipherstream, cpu_to_be64, data, DBGC, DBGC2, DBGC2_HD, tls_cipher_suite::digest, digest_algorithm::digestsize, ENOMEM_TX_CIPHERTEXT, ENOMEM_TX_PLAINTEXT, fixed, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, free, free_iob(), tls_auth_header::header, htons, iob_disown, iob_len(), iob_put, is_auth_cipher(), is_block_cipher(), iv, len, tls_header::length, mac, tls_cipher_suite::mac_len, malloc(), memcpy(), memset(), NULL, rc, tls_cipher_suite::record_iv_len, tls_auth_header::seq, tls_tx::seq, strerror(), tls_cipherspec::suite, tls_generate_random(), tls_hmac(), tmp, tls_connection::tx, type, tls_header::type, tls_header::version, tls_connection::version, xfer_alloc_iob(), and xfer_deliver_iob().
Referenced by tls_plainstream_deliver(), tls_send_change_cipher(), and tls_send_handshake().
|
static |
Referenced by add_tls(), free_tls(), tls_change_cipher(), and tls_set_cipher().
|
inlinestatic |
Extract 24-bit field value.
field24 | 24-bit field |
value | Field value |
Definition at line 231 of file tls.c.
References be16_to_cpu, tls24_t::high, and tls24_t::low.
Referenced by tls_new_certificate(), tls_new_handshake(), and tls_parse_chain().
|
static |
Set 24-bit field value.
field24 | 24-bit field |
value | Field value |
Definition at line 242 of file tls.c.
References cpu_to_be16, tls24_t::high, tls24_t::low, and value.
Referenced by tls_send_certificate().
|
static |
Determine if TLS connection is ready for application data.
tls | TLS connection |
is_ready | TLS connection is ready |
Definition at line 254 of file tls.c.
References tls_connection::client, is_pending(), tls_client::negotiation, tls_server::negotiation, and tls_connection::server.
Referenced by tls_cipherstream_window(), tls_new_data(), tls_new_hello_request(), tls_plainstream_deliver(), and tls_plainstream_window().
|
inlinestatic |
Check for TLS version.
tls | TLS connection |
version | TLS version |
at_least | TLS connection is using at least the specified version |
Check that TLS connection uses at least the specified protocol version. Optimise down to a compile-time constant true result if this is already guaranteed by the minimum supported version check.
Definition at line 271 of file tls.c.
References TLS_VERSION_MIN, tls_connection::version, and version.
Referenced by tls_prf(), tls_select_cipher(), tls_send_certificate_verify(), and tls_verify_dh_params().
|
static |
Initialise MD5+SHA1 algorithm.
ctx | MD5+SHA1 context |
Definition at line 288 of file tls.c.
References ctx, digest_init(), md5_sha1_context::md5, md5_algorithm, md5_sha1_context::sha1, and sha1_algorithm.
|
static |
Accumulate data with MD5+SHA1 algorithm.
ctx | MD5+SHA1 context |
data | Data |
len | Length of data |
Definition at line 302 of file tls.c.
References ctx, data, digest_update(), len, md5_sha1_context::md5, md5_algorithm, md5_sha1_context::sha1, and sha1_algorithm.
|
static |
Generate MD5+SHA1 digest.
ctx | MD5+SHA1 context |
out | Output buffer |
Definition at line 315 of file tls.c.
References ctx, digest_final(), md5_sha1_context::md5, md5_sha1_digest::md5, md5_algorithm, out, md5_sha1_context::sha1, md5_sha1_digest::sha1, and sha1_algorithm.
|
static |
Free TLS session.
refcnt | Reference counter |
Definition at line 353 of file tls.c.
References assert(), tls_session::conn, container_of, free, tls_session::key, tls_session::list, list_del, list_empty, privkey_put(), tls_session::root, tls_session::ticket, and x509_root_put().
Referenced by tls_session().
|
static |
Free TLS connection.
refcnt | Reference counter |
Definition at line 377 of file tls.c.
References tls_cipherspec_pair::active, assert(), tls_client::chain, tls_server::chain, tls_tx::cipherspec, tls_rx::cipherspec, tls_connection::client, container_of, tls_rx::data, tls_server::exchange, free, free_iob(), tls_rx::handshake, tls_connection::handshake_ctx, tls_client::key, io_buffer::list, tls_connection::list, list_del, list_empty, list_for_each_entry_safe, tls_connection::new_session_ticket, tls_cipherspec_pair::pending, privkey_put(), ref_put, tls_session::refcnt, tls_server::root, tls_connection::rx, tls_connection::server, tls_connection::session, tls_clear_cipher(), tmp, tls_connection::tx, x509_chain_put(), and x509_root_put().
Referenced by add_tls().
|
static |
Finish with TLS connection.
tls | TLS connection |
rc | Status code |
Definition at line 416 of file tls.c.
References tls_connection::cipherstream, tls_connection::client, INIT_LIST_HEAD, intf_shutdown(), tls_connection::list, list_del, tls_client::negotiation, tls_server::negotiation, pending_put(), tls_connection::plainstream, tls_tx::process, process_del(), rc, tls_connection::server, tls_connection::session, tls_tx_resume_all(), tls_connection::tx, tls_server::validation, and tls_server::validator.
Referenced by tls_cipherstream_deliver(), tls_tx_step(), and tls_validator_done().
|
static |
Generate random data.
tls | TLS connection |
data | Buffer to fill |
len | Length of buffer |
rc | Return status code |
Definition at line 454 of file tls.c.
References data, DBGC, len, NULL, rbg_generate(), rc, and strerror().
Referenced by add_tls(), tls_send_client_key_exchange_dhe(), tls_send_client_key_exchange_ecdhe(), tls_send_client_key_exchange_pubkey(), and tls_send_plaintext().
|
static |
Update HMAC with a list of ( data, len ) pairs.
digest | Hash function to use |
ctx | HMAC context |
args | ( data, len ) pairs of data, terminated by NULL |
Definition at line 477 of file tls.c.
References ctx, data, hmac_update(), len, and va_arg.
Referenced by tls_p_hash_va().
|
static |
Generate secure pseudo-random data using a single hash function.
tls | TLS connection |
digest | Hash function to use |
secret | Secret |
secret_len | Length of secret |
out | Output buffer |
out_len | Length of output buffer |
seeds | ( data, len ) pairs of seed data, terminated by NULL |
Definition at line 499 of file tls.c.
References ctx, DBGC2, DBGC2_HD, digest_algorithm::digestsize, hmac_ctxsize(), hmac_final(), hmac_init(), hmac_update(), memcpy(), digest_algorithm::name, out, tls_hmac_update_va(), tmp, va_copy, and va_end.
Referenced by tls_prf().
|
static |
Generate secure pseudo-random data.
tls | TLS connection |
secret | Secret |
secret_len | Length of secret |
out | Output buffer |
out_len | Length of output buffer |
... | ( data, len ) pairs of seed data, terminated by NULL |
Definition at line 561 of file tls.c.
References tls_connection::handshake_digest, md5_algorithm, out, sha1_algorithm, tls_p_hash_va(), tls_version(), TLS_VERSION_TLS_1_2, tmp, va_copy, va_end, and va_start.
|
static |
Generate master secret.
tls | TLS connection |
pre_master_secret | Pre-master secret |
pre_master_secret_len | Length of pre-master secret |
The client and server random values must already be known.
Definition at line 637 of file tls.c.
References tls_connection::client, DBGC, DBGC_HD, tls_connection::master_secret, tls_client::random, tls_server::random, tls_connection::server, and tls_prf_label.
Referenced by tls_send_client_key_exchange_dhe(), tls_send_client_key_exchange_ecdhe(), and tls_send_client_key_exchange_pubkey().
|
static |
Generate key material.
tls | TLS connection |
The master secret must already be known.
Definition at line 665 of file tls.c.
References assert(), tls_cipher_suite::cipher, tls_cipherspec::cipher_ctx, cipher_setkey(), tls_tx::cipherspec, tls_rx::cipherspec, tls_connection::client, DBGC, DBGC_HD, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, key, tls_cipher_suite::key_len, tls_cipher_suite::mac_len, tls_cipherspec::mac_secret, tls_connection::master_secret, memcpy(), tls_cipherspec_pair::pending, tls_client::random, tls_server::random, rc, tls_connection::rx, tls_connection::server, strerror(), tls_cipherspec::suite, tls_prf_label, and tls_connection::tx.
Referenced by tls_new_server_hello(), and tls_send_client_key_exchange().
|
static |
Clear handshake digest algorithm.
tls | TLS connection |
Definition at line 750 of file tls.c.
References digest_null, free, tls_connection::handshake_ctx, tls_connection::handshake_digest, and NULL.
Referenced by add_tls(), and tls_select_handshake().
|
static |
Select handshake digest algorithm.
tls | TLS connection |
digest | Handshake digest algorithm |
rc | Return status code |
Definition at line 767 of file tls.c.
References digest_algorithm::ctxsize, digest_init(), ENOMEM, tls_connection::handshake_ctx, tls_connection::handshake_digest, malloc(), and tls_clear_handshake().
Referenced by tls_select_cipher().
|
static |
Add handshake record to verification hash.
tls | TLS connection |
data | Handshake record |
len | Length of handshake record |
rc | Return status code |
Definition at line 791 of file tls.c.
References data, digest_update(), tls_connection::handshake_ctx, tls_connection::handshake_digest, and len.
Referenced by tls_new_handshake(), tls_new_server_hello(), and tls_send_handshake().
|
static |
Calculate handshake verification hash.
tls | TLS connection |
out | Output buffer |
Calculates the digest over all handshake messages seen so far.
Definition at line 807 of file tls.c.
References ctx, digest_algorithm::ctxsize, digest_final(), tls_connection::handshake_ctx, tls_connection::handshake_digest, memcpy(), and out.
Referenced by tls_new_finished(), tls_send_certificate_verify(), and tls_send_finished().
|
static |
Identify cipher suite.
cipher_suite | Cipher suite specification |
suite | Cipher suite, or NULL |
Definition at line 840 of file tls.c.
References tls_cipher_suite::code, for_each_table_entry, NULL, and TLS_CIPHER_SUITES.
Referenced by tls_select_cipher().
|
static |
Clear cipher suite.
cipherspec | TLS cipher specification |
Definition at line 857 of file tls.c.
References tls_cipherspec::dynamic, free, memset(), tls_cipherspec::suite, and tls_cipher_suite_null.
|
static |
Set cipher suite.
tls | TLS connection |
cipherspec | TLS cipher specification |
suite | Cipher suite |
rc | Return status code |
Definition at line 873 of file tls.c.
References assert(), tls_cipher_suite::cipher, tls_cipherspec::cipher_ctx, cipher_algorithm::ctxsize, DBGC, tls_cipherspec::dynamic, ENOMEM_CONTEXT, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, tls_cipher_suite::mac_len, tls_cipherspec::mac_secret, tls_cipherspec::suite, tls_clear_cipher(), and zalloc().
Referenced by tls_select_cipher().
|
static |
Select next cipher suite.
tls | TLS connection |
cipher_suite | Cipher suite specification |
rc | Return status code |
Definition at line 912 of file tls.c.
References tls_cipher_suite::cipher, tls_tx::cipherspec, tls_rx::cipherspec, DBGC, tls_cipher_suite::digest, ENOTSUP_CIPHER, tls_cipher_suite::exchange, tls_cipher_suite::handshake, tls_cipher_suite::key_len, md5_sha1_algorithm, digest_algorithm::name, cipher_algorithm::name, pubkey_algorithm::name, tls_key_exchange_algorithm::name, ntohs, tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, rc, tls_connection::rx, tls_find_cipher_suite(), tls_select_handshake(), tls_set_cipher(), tls_version(), TLS_VERSION_TLS_1_2, and tls_connection::tx.
Referenced by tls_new_server_hello().
|
static |
Activate next cipher suite.
tls | TLS connection |
pair | Cipher specification pair |
rc | Return status code |
Definition at line 955 of file tls.c.
References tls_cipherspec_pair::active, DBGC, ENOTSUP_NULL, memswap(), tls_cipherspec_pair::pending, tls_cipherspec::suite, tls_cipher_suite_null, and tls_clear_cipher().
Referenced by tls_new_change_cipher(), and tls_tx_step().
|
static |
Find TLS signature and hash algorithm.
pubkey | Public-key algorithm |
digest | Digest algorithm |
sig_hash | Signature and hash algorithm, or NULL |
Definition at line 988 of file tls.c.
References tls_signature_hash_algorithm::digest, for_each_table_entry, NULL, tls_signature_hash_algorithm::pubkey, and TLS_SIG_HASH_ALGORITHMS.
Referenced by tls_send_certificate_verify().
|
static |
Find TLS signature algorithm.
code | Signature and hash algorithm identifier |
pubkey | Public key algorithm, or NULL |
Definition at line 1010 of file tls.c.
References code, tls_signature_hash_algorithm::code, for_each_table_entry, NULL, tls_signature_hash_algorithm::pubkey, tls_signature_hash_id::signature, and TLS_SIG_HASH_ALGORITHMS.
Referenced by tls_verify_dh_params().
|
static |
Find TLS hash algorithm.
code | Signature and hash algorithm identifier |
digest | Digest algorithm, or NULL |
Definition at line 1029 of file tls.c.
References code, tls_signature_hash_algorithm::code, tls_signature_hash_algorithm::digest, for_each_table_entry, tls_signature_hash_id::hash, NULL, and TLS_SIG_HASH_ALGORITHMS.
Referenced by tls_verify_dh_params().
|
static |
Identify named curve.
named_curve | Named curve specification |
curve | Named curve, or NULL |
Definition at line 1058 of file tls.c.
References tls_named_curve::curve, for_each_table_entry, NULL, and TLS_NAMED_CURVES.
Referenced by tls_send_client_key_exchange_ecdhe().
|
static |
Resume TX state machine.
tls | TLS connection |
Definition at line 1082 of file tls.c.
References tls_tx::process, process_add(), and tls_connection::tx.
Referenced by tls_new_finished(), tls_restart(), tls_tx_resume_all(), tls_tx_step(), and tls_validator_done().
|
static |
Restart negotiation.
tls | TLS connection |
Definition at line 1103 of file tls.c.
References assert(), tls_connection::client, is_pending(), tls_client::negotiation, tls_server::negotiation, tls_tx::pending, pending_get(), tls_connection::server, TLS_TX_CLIENT_HELLO, tls_tx_resume(), tls_connection::tx, and tls_server::validation.
Referenced by add_tls(), and tls_new_hello_request().
|
static |
Transmit Handshake record.
tls | TLS connection |
data | Plaintext record |
len | Length of plaintext record |
rc | Return status code |
Definition at line 1126 of file tls.c.
References data, len, tls_add_handshake(), tls_send_plaintext(), and TLS_TYPE_HANDSHAKE.
Referenced by tls_send_certificate(), tls_send_certificate_verify(), tls_send_client_hello(), tls_send_client_key_exchange_dhe(), tls_send_client_key_exchange_ecdhe(), tls_send_client_key_exchange_pubkey(), and tls_send_finished().
|
static |
Digest or transmit Client Hello record.
tls | TLS connection |
action | Action to take on Client Hello record |
rc | Return status code |
Definition at line 1143 of file tls.c.
References __attribute__, tls_verify_data::client, tls_connection::client, code, tls_cipher_suite::code, tls_signature_hash_algorithm::code, cpu_to_le32, tls_named_curve::curve, data, for_each_table_entry, hello, htonl, htons, len, tls_session::list, max, memcpy(), memset(), tls_session::name, random(), tls_client::random, tls_connection::secure_renegotiation, tls_connection::session, tls_connection::session_id, tls_connection::session_id_len, strlen(), tls_session::ticket, tls_session::ticket_len, TLS_CIPHER_SUITES, TLS_CLIENT_HELLO, TLS_MAX_FRAGMENT_LENGTH, TLS_MAX_FRAGMENT_LENGTH_4096, TLS_NAMED_CURVE, TLS_NAMED_CURVES, TLS_NUM_CIPHER_SUITES, TLS_NUM_NAMED_CURVES, TLS_NUM_SIG_HASH_ALGORITHMS, TLS_RENEGOTIATION_INFO, TLS_SERVER_NAME, TLS_SERVER_NAME_HOST_NAME, TLS_SESSION_TICKET, TLS_SIG_HASH_ALGORITHMS, TLS_SIGNATURE_ALGORITHMS, TLS_VERSION_MAX, type, typeof(), tls_connection::verify, and version.
Referenced by tls_new_server_hello(), and tls_send_client_hello().
|
static |
Transmit Client Hello record.
tls | TLS connection |
rc | Return status code |
Definition at line 1313 of file tls.c.
References tls_client_hello(), and tls_send_handshake().
Referenced by tls_tx_step().
|
static |
Transmit Certificate record.
tls | TLS connection |
rc | Return status code |
Definition at line 1324 of file tls.c.
References __attribute__, tls_client::chain, tls_connection::client, cpu_to_le32, asn1_cursor::data, data, DBGC, ENOMEM_CERTIFICATE, free, htonl, len, asn1_cursor::len, length, link, x509_chain::links, list_for_each_entry, memcpy(), x509_certificate::raw, rc, TLS_CERTIFICATE, tls_send_handshake(), tls_set_uint24(), typeof(), x509_name(), and zalloc().
Referenced by tls_tx_step().
|
static |
Transmit Client Key Exchange record using public key exchange.
tls | TLS connection |
rc | Return status code |
Definition at line 1386 of file tls.c.
References __attribute__, tls_tx::cipherspec, cpu_to_le32, DBGC, htonl, htons, tls_server::key, len, pubkey_algorithm::max_len, memset(), tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, pubkey_encrypt(), pubkey_max_len(), random(), rc, tls_connection::server, strerror(), tls_cipherspec::suite, TLS_CLIENT_KEY_EXCHANGE, tls_generate_master_secret(), tls_generate_random(), tls_send_handshake(), TLS_VERSION_MAX, tls_connection::tx, unused, and version.
|
static |
Verify Diffie-Hellman parameter signature.
tls | TLS connection |
param_len | Diffie-Hellman parameter length |
rc | Return status code |
Definition at line 1451 of file tls.c.
References __attribute__, assert(), tls_tx::cipherspec, tls_connection::client, ctx, digest_algorithm::ctxsize, data, DBGC, DBGC_HDA, digest_final(), digest_init(), digest_update(), digest_algorithm::digestsize, EINVAL_KEY_EXCHANGE, ENOTSUP_SIG_HASH, EPERM_KEY_EXCHANGE, tls_server::exchange, tls_server::exchange_len, hash, tls_server::key, md5_sha1_algorithm, pubkey_algorithm::name, ntohs, tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, pubkey_verify(), tls_client::random, tls_server::random, rc, tls_connection::server, sig, signature, tls_cipherspec::suite, tls_signature_hash_digest(), tls_signature_hash_pubkey(), tls_version(), TLS_VERSION_TLS_1_2, and tls_connection::tx.
Referenced by tls_send_client_key_exchange_dhe(), and tls_send_client_key_exchange_ecdhe().
|
static |
Transmit Client Key Exchange record using DHE key exchange.
tls | TLS connection |
rc | Return status code |
Definition at line 1540 of file tls.c.
References __attribute__, tls_connection::client, cpu_to_le32, data, DBGC, DBGC_HDA, dhe_key(), EINVAL_KEY_EXCHANGE, ENOMEM, tls_server::exchange, tls_server::exchange_len, free, htonl, htons, len, malloc(), ntohs, tls_client_random::random, tls_client::random, rc, tls_connection::server, strerror(), TLS_CLIENT_KEY_EXCHANGE, tls_generate_master_secret(), tls_generate_random(), tls_send_handshake(), tls_verify_dh_params(), and typeof().
|
static |
Transmit Client Key Exchange record using ECDHE key exchange.
tls | TLS connection |
rc | Return status code |
Definition at line 1665 of file tls.c.
References __attribute__, cpu_to_le32, tls_named_curve::curve, DBGC, DBGC_HDA, ecdhe_key(), EINVAL_KEY_EXCHANGE, ENOTSUP_CURVE, tls_server::exchange, tls_server::exchange_len, tls_named_curve::format, htonl, keysize, elliptic_curve::keysize, elliptic_curve::name, ntohs, offset, elliptic_curve::pointsize, tls_named_curve::pre_master_secret_len, rc, tls_connection::server, strerror(), TLS_CLIENT_KEY_EXCHANGE, tls_find_named_curve(), tls_generate_master_secret(), tls_generate_random(), TLS_NAMED_CURVE_TYPE, tls_send_handshake(), and tls_verify_dh_params().
|
static |
Transmit Client Key Exchange record.
tls | TLS connection |
rc | Return status code |
Definition at line 1795 of file tls.c.
References tls_tx::cipherspec, DBGC, tls_key_exchange_algorithm::exchange, tls_cipher_suite::exchange, tls_cipherspec_pair::pending, rc, strerror(), tls_cipherspec::suite, tls_generate_keys(), and tls_connection::tx.
Referenced by tls_tx_step().
|
static |
Transmit Certificate Verify record.
tls | TLS connection |
rc | Return status code |
Definition at line 1823 of file tls.c.
References __attribute__, tls_client::chain, tls_connection::client, tls_signature_hash_algorithm::code, cpu_to_le32, DBGC, tls_signature_hash_algorithm::digest, digest_algorithm::digestsize, ENOTSUP_SIG_HASH, tls_connection::handshake_digest, htonl, htons, key, tls_client::key, len, memcpy(), digest_algorithm::name, pubkey_algorithm::name, NULL, privkey_cursor(), tls_signature_hash_algorithm::pubkey, asn1_algorithm::pubkey, pubkey_max_len(), pubkey_sign(), rc, signature, x509_certificate::signature_algorithm, strerror(), TLS_CERTIFICATE_VERIFY, tls_send_handshake(), tls_signature_hash_algorithm(), tls_verify_handshake(), tls_version(), TLS_VERSION_TLS_1_2, unused, and x509_first().
Referenced by tls_tx_step().
|
static |
Transmit Change Cipher record.
tls | TLS connection |
rc | Return status code |
Definition at line 1903 of file tls.c.
References __attribute__, spec, TLS_CHANGE_CIPHER_SPEC, tls_send_plaintext(), and TLS_TYPE_CHANGE_CIPHER.
Referenced by tls_tx_step().
|
static |
Transmit Finished record.
tls | TLS connection |
rc | Return status code |
Definition at line 1920 of file tls.c.
References __attribute__, tls_verify_data::client, tls_connection::client, cpu_to_le32, digest_algorithm::digestsize, tls_connection::handshake_digest, htonl, tls_connection::master_secret, memcpy(), memset(), tls_client::negotiation, pending_put(), rc, TLS_FINISHED, tls_prf_label, tls_send_handshake(), tls_verify_handshake(), and tls_connection::verify.
Referenced by tls_tx_step().
|
static |
Receive new Change Cipher record.
tls | TLS connection |
iobuf | I/O buffer |
rc | Return status code |
Definition at line 1961 of file tls.c.
References __attribute__, tls_rx::cipherspec, io_buffer::data, DBGC, DBGC_HD, EINVAL_CHANGE_CIPHER, iob_len(), iob_pull, len, rc, tls_connection::rx, tls_rx::seq, spec, strerror(), tls_change_cipher(), and TLS_CHANGE_CIPHER_SPEC.
Referenced by tls_new_record().
|
static |
Receive new Alert record.
tls | TLS connection |
iobuf | I/O buffer |
rc | Return status code |
Definition at line 1996 of file tls.c.
References __attribute__, alert(), io_buffer::data, DBGC, DBGC_HD, EINVAL_ALERT, EIO_ALERT, EPERM_ALERT, iob_len(), iob_pull, len, next, TLS_ALERT_FATAL, and TLS_ALERT_WARNING.
Referenced by tls_new_record().
|
static |
Receive new Hello Request handshake record.
tls | TLS connection |
data | Plaintext handshake record |
len | Length of plaintext handshake record |
rc | Return status code |
Definition at line 2038 of file tls.c.
References DBGC, EPERM_RENEG_INSECURE, tls_connection::secure_renegotiation, tls_ready(), and tls_restart().
Referenced by tls_new_handshake().
|
static |
Receive new Server Hello handshake record.
tls | TLS connection |
data | Plaintext handshake record |
len | Length of plaintext handshake record |
rc | Return status code |
Definition at line 2069 of file tls.c.
References __attribute__, data, DBGC, DBGC_HD, DBGC_HDA, EINVAL_HELLO, ENOTSUP_VERSION, EPERM_RENEG_VERIFY, EPROTO_VERSION, ext, htons, len, memcmp(), memcpy(), next, ntohs, NULL, random(), tls_server::random, rc, tls_connection::secure_renegotiation, tls_connection::server, tls_connection::session_id, tls_connection::session_id_len, tls_add_handshake(), tls_client_hello(), tls_generate_keys(), TLS_RENEGOTIATION_INFO, tls_select_cipher(), TLS_VERSION_MIN, type, tls_connection::verify, tls_connection::version, and version.
Referenced by tls_new_handshake().
|
static |
Receive New Session Ticket handshake record.
tls | TLS connection |
data | Plaintext handshake record |
len | Length of plaintext handshake record |
rc | Return status code |
Definition at line 2254 of file tls.c.
References __attribute__, data, DBGC, DBGC_HD, DBGC_HDA, EINVAL_TICKET, ENOMEM, free, len, lifetime, malloc(), memcpy(), tls_connection::new_session_ticket, tls_connection::new_session_ticket_len, ntohs, and NULL.
Referenced by tls_new_handshake().
|
static |
Parse certificate chain.
tls | TLS connection |
data | Certificate chain |
len | Length of certificate chain |
rc | Return status code |
Definition at line 2305 of file tls.c.
References __attribute__, tls_server::chain, data, DBGC, DBGC_HDA, EINVAL_CERTIFICATE, ENOMEM_CHAIN, tls_server::key, len, length, memset(), NULL, rc, tls_connection::server, strerror(), tls_uint24(), x509_alloc_chain(), x509_append_raw(), x509_chain_put(), x509_last(), and x509_name().
Referenced by tls_new_certificate().
|