Transport Layer Security Protocol. More...

#include <stdint.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <errno.h>
#include <byteswap.h>
#include <ipxe/pending.h>
#include <ipxe/hmac.h>
#include <ipxe/md5.h>
#include <ipxe/sha1.h>
#include <ipxe/sha256.h>
#include <ipxe/md5_sha1.h>
#include <ipxe/aes.h>
#include <ipxe/rsa.h>
#include <ipxe/hkdf.h>
#include <ipxe/iobuf.h>
#include <ipxe/xfer.h>
#include <ipxe/open.h>
#include <ipxe/x509.h>
#include <ipxe/privkey.h>
#include <ipxe/certstore.h>
#include <ipxe/rootcert.h>
#include <ipxe/rbg.h>
#include <ipxe/validator.h>
#include <ipxe/job.h>
#include <ipxe/ffdhe.h>
#include <ipxe/tls.h>
#include <config/crypto.h>

Data Structures
struct	tls24_t
	A TLS 24-bit integer. More...

Macros
#define	EINVAL_CHANGE_CIPHER __einfo_error ( EINFO_EINVAL_CHANGE_CIPHER )
#define	EINFO_EINVAL_CHANGE_CIPHER
#define	EINVAL_ALERT __einfo_error ( EINFO_EINVAL_ALERT )
#define	EINFO_EINVAL_ALERT
#define	EINVAL_HELLO __einfo_error ( EINFO_EINVAL_HELLO )
#define	EINFO_EINVAL_HELLO
#define	EINVAL_CERTIFICATE __einfo_error ( EINFO_EINVAL_CERTIFICATE )
#define	EINFO_EINVAL_CERTIFICATE
#define	EINVAL_CERTIFICATES __einfo_error ( EINFO_EINVAL_CERTIFICATES )
#define	EINFO_EINVAL_CERTIFICATES
#define	EINVAL_HELLO_DONE __einfo_error ( EINFO_EINVAL_HELLO_DONE )
#define	EINFO_EINVAL_HELLO_DONE
#define	EINVAL_FINISHED __einfo_error ( EINFO_EINVAL_FINISHED )
#define	EINFO_EINVAL_FINISHED
#define	EINVAL_HANDSHAKE __einfo_error ( EINFO_EINVAL_HANDSHAKE )
#define	EINFO_EINVAL_HANDSHAKE
#define	EINVAL_IV __einfo_error ( EINFO_EINVAL_IV )
#define	EINFO_EINVAL_IV
#define	EINVAL_PADDING __einfo_error ( EINFO_EINVAL_PADDING )
#define	EINFO_EINVAL_PADDING
#define	EINVAL_RX_STATE __einfo_error ( EINFO_EINVAL_RX_STATE )
#define	EINFO_EINVAL_RX_STATE
#define	EINVAL_MAC __einfo_error ( EINFO_EINVAL_MAC )
#define	EINFO_EINVAL_MAC
#define	EINVAL_TICKET __einfo_error ( EINFO_EINVAL_TICKET )
#define	EINFO_EINVAL_TICKET
#define	EINVAL_KEY_EXCHANGE __einfo_error ( EINFO_EINVAL_KEY_EXCHANGE )
#define	EINFO_EINVAL_KEY_EXCHANGE
#define	EIO_ALERT __einfo_error ( EINFO_EIO_ALERT )
#define	EINFO_EIO_ALERT
#define	ENOENT_CERT __einfo_error ( EINFO_ENOENT_CERT )
#define	EINFO_ENOENT_CERT
#define	ENOMEM_CONTEXT __einfo_error ( EINFO_ENOMEM_CONTEXT )
#define	EINFO_ENOMEM_CONTEXT
#define	ENOMEM_CERTIFICATE __einfo_error ( EINFO_ENOMEM_CERTIFICATE )
#define	EINFO_ENOMEM_CERTIFICATE
#define	ENOMEM_CHAIN __einfo_error ( EINFO_ENOMEM_CHAIN )
#define	EINFO_ENOMEM_CHAIN
#define	ENOMEM_TX_PLAINTEXT __einfo_error ( EINFO_ENOMEM_TX_PLAINTEXT )
#define	EINFO_ENOMEM_TX_PLAINTEXT
#define	ENOMEM_TX_CIPHERTEXT __einfo_error ( EINFO_ENOMEM_TX_CIPHERTEXT )
#define	EINFO_ENOMEM_TX_CIPHERTEXT
#define	ENOMEM_RX_DATA __einfo_error ( EINFO_ENOMEM_RX_DATA )
#define	EINFO_ENOMEM_RX_DATA
#define	ENOMEM_RX_CONCAT __einfo_error ( EINFO_ENOMEM_RX_CONCAT )
#define	EINFO_ENOMEM_RX_CONCAT
#define	ENOTSUP_CIPHER __einfo_error ( EINFO_ENOTSUP_CIPHER )
#define	EINFO_ENOTSUP_CIPHER
#define	ENOTSUP_NULL __einfo_error ( EINFO_ENOTSUP_NULL )
#define	EINFO_ENOTSUP_NULL
#define	ENOTSUP_SIG_HASH __einfo_error ( EINFO_ENOTSUP_SIG_HASH )
#define	EINFO_ENOTSUP_SIG_HASH
#define	ENOTSUP_VERSION __einfo_error ( EINFO_ENOTSUP_VERSION )
#define	EINFO_ENOTSUP_VERSION
#define	ENOTSUP_GROUP __einfo_error ( EINFO_ENOTSUP_GROUP )
#define	EINFO_ENOTSUP_GROUP
#define	EPERM_ALERT __einfo_error ( EINFO_EPERM_ALERT )
#define	EINFO_EPERM_ALERT
#define	EPERM_VERIFY __einfo_error ( EINFO_EPERM_VERIFY )
#define	EINFO_EPERM_VERIFY
#define	EPERM_RENEG_INSECURE __einfo_error ( EINFO_EPERM_RENEG_INSECURE )
#define	EINFO_EPERM_RENEG_INSECURE
#define	EPERM_RENEG_VERIFY __einfo_error ( EINFO_EPERM_RENEG_VERIFY )
#define	EINFO_EPERM_RENEG_VERIFY
#define	EPERM_KEY_EXCHANGE __einfo_error ( EINFO_EPERM_KEY_EXCHANGE )
#define	EINFO_EPERM_KEY_EXCHANGE
#define	EPERM_EMS __einfo_error ( EINFO_EPERM_EMS )
#define	EINFO_EPERM_EMS
#define	EPERM_BOUND __einfo_error ( EINFO_EPERM_BOUND )
#define	EINFO_EPERM_BOUND
#define	EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION )
#define	EINFO_EPROTO_VERSION
#define	tls_prf_label(tls, out, out_len, label, ...)
	Generate secure pseudo-random data.
#define	TLS_NUM_CIPHER_SUITES table_num_entries ( TLS_CIPHER_SUITES )
	Number of supported cipher suites.
#define	TLS_NUM_SIG_HASH_ALGORITHMS table_num_entries ( TLS_SIG_HASH_ALGORITHMS )
	Number of supported signature and hash algorithms.

Functions
	FILE_LICENCE (GPL2_OR_LATER)
	FILE_SECBOOT (PERMITTED)
static	LIST_HEAD (tls_sessions)
	List of TLS session.
static void	tls_regenerate_ephemeral_master (struct tls_connection *tls)
	Regenerate ephemeral master secret.
static void	tls_tx_resume_all (struct tls_session *session)
	Resume TX state machine for all connections within a session.
static struct io_buffer *	tls_alloc_iob (struct tls_connection *tls, size_t len)
	Allocate I/O buffer for transmitted record(s).
static int	tls_send_handshake (struct tls_connection tls, const void data, size_t len)
	Transmit Handshake record.
static int	tls_send_alert (struct tls_connection *tls, unsigned int level, unsigned int description)
	Transmit Alert record.
static int	tls_send_record (struct tls_connection tls, unsigned int type, struct io_buffer iobuf)
	Send plaintext record(s).
static int	tls_send_plaintext (struct tls_connection tls, unsigned int type, const void data, size_t len)
	Send plaintext record.
static void	tls_clear_cipher (struct tls_connection tls, struct tls_cipherspec cipherspec)
static void	tls_clear_digest (struct tls_connection *tls)
	Clear key schedule digest algorithm.
static void	tls_verify_handshake (struct tls_connection tls, void out)
	Calculate handshake verification hash.
static unsigned long	tls_uint24 (const tls24_t *field24)
	Extract 24-bit field value.
static void	tls_set_uint24 (tls24_t *field24, unsigned long value)
	Set 24-bit field value.
static int	tls_ready (struct tls_connection *tls)
	Determine if TLS connection is ready for application data.
static int	tls_version (struct tls_connection *tls, unsigned int version)
	Check for TLS version.
static void	free_tls_session (struct refcnt *refcnt)
	Free TLS session.
static void	free_tls (struct refcnt *refcnt)
	Free TLS connection.
static void	tls_close (struct tls_connection *tls, int rc)
	Finish with TLS connection.
static void	tls_close_alert (struct tls_connection *tls, int rc)
	Send closure alert and finish with TLS connection.
static int	tls_generate_ephemeral_master (struct tls_connection *tls)
	Generate ephemeral master secret.
static void	tls_ephemeral (struct tls_connection tls, const void info, size_t info_len, void *out, size_t len)
	Generate ephemeral secret.
static void	tls_ephemeral_label (struct tls_connection tls, const char label, void *out, size_t len)
	Generate ephemeral secret from label.
static void	tls_clear_binding (struct tls_connection *tls)
	Clear key schedule binding.
static void	tls_set_binding (struct tls_connection tls, struct x509_certificate cert)
	Bind key schedule to a server identity.
static int	tls_set_digest (struct tls_connection tls, struct digest_algorithm digest)
	Set key schedule digest algorithm.
static void	tls_hmac_update_va (struct digest_algorithm digest, void ctx, va_list args)
	Update HMAC with a list of ( data, len ) pairs.
static void	tls_p_hash_va (struct tls_connection tls, struct digest_algorithm digest, const void hkey, void out, size_t out_len, va_list seeds)
	Generate secure pseudo-random data using a single hash function.
static void	tls_prf (struct tls_connection tls, void out, size_t out_len,...)
	Generate secure pseudo-random data.
static void	tls_set_kdf_master (struct tls_connection tls, const void secret, size_t secret_len)
	Set key derivation function master secret.
static int	tls_share_ephemeral (struct tls_connection tls, void public)
	Share ephemeral public key.
static int	tls_agree_ephemeral (struct tls_connection tls, const void partner, size_t partner_len, int strip)
	Agree ephemeral public key (i.e.
static void	tls_generate_master_secret (struct tls_connection *tls)
	Generate master secret.
static int	tls_generate_keys (struct tls_connection *tls)
	Generate key material.
static void	tls_generate_resumption_master (struct tls_connection *tls)
	Generate resumption master secret.
static void	tls_resume_secret (struct tls_connection *tls)
	Resume from resumption master secret.
static int	tls_add_handshake (struct tls_connection tls, const void data, size_t len)
	Add handshake record to verification hash.
static struct tls_cipher_suite *	tls_find_cipher_suite (unsigned int cipher_suite)
	Identify cipher suite.
static void	tls_clear_cipher (struct tls_connection tls __unused, struct tls_cipherspec cipherspec)
	Clear cipher suite.
static int	tls_set_cipher (struct tls_connection tls, struct tls_cipherspec cipherspec, struct tls_cipher_suite *suite)
	Set cipher suite.
static int	tls_select_cipher (struct tls_connection *tls, unsigned int cipher_suite)
	Select next cipher suite.
static int	tls_change_cipher (struct tls_connection tls, struct tls_cipherspec_pair pair)
	Activate next cipher suite.
static struct tls_signature_hash_algorithm *	tls_signature_hash_algorithm (struct pubkey_algorithm pubkey, struct digest_algorithm digest)
	Find TLS signature and hash algorithm.
static struct tls_signature_hash_algorithm *	tls_find_signature_hash (unsigned int code)
	Find TLS signature and hash algorithm.
static struct tls_named_group *	tls_find_named_group (unsigned int named_group)
	Identify named key exchange group.
static struct tls_named_group *	tls_find_param_group (const void dh_p, size_t dh_p_len, const void dh_g, size_t dh_g_len)
	Identify named key exchange group by Diffie-Hellman parameters.
static int	tls_verify_dh_params (struct tls_connection tls, const void data, size_t len, size_t param_len)
	Verify Diffie-Hellman parameter signature.
static int	tls_new_server_key_exchange_pubkey (struct tls_connection tls, const void data, size_t len)
	Receive new Server Key Exchange record using public key transport.
static int	tls_send_client_key_exchange_pubkey (struct tls_connection *tls)
	Transmit Client Key Exchange record using public key exchange.
static int	tls_new_server_key_exchange_dhe (struct tls_connection tls, const void data, size_t len)
	Receive new Server Key Exchange record using DHE key exchange.
static int	tls_send_client_key_exchange_dhe (struct tls_connection *tls)
	Transmit Client Key Exchange record using DHE key exchange.
static int	tls_new_server_key_exchange_ecdhe (struct tls_connection tls, const void data, size_t len)
	Receive new Server Key Exchange record using ECDHE key exchange.
static int	tls_send_client_key_exchange_ecdhe (struct tls_connection *tls)
	Transmit Client Key Exchange record using ECDHE key exchange.
static void	tls_tx_resume (struct tls_connection *tls)
	Resume TX state machine.
static void	tls_restart (struct tls_connection *tls)
	Restart negotiation.
static int	tls_client_hello (struct tls_connection tls, int(action)(struct tls_connection tls, const void data, size_t len))
	Digest or transmit Client Hello record.
static int	tls_send_client_hello (struct tls_connection *tls)
	Transmit Client Hello record.
static int	tls_send_certificate (struct tls_connection *tls)
	Transmit Certificate record.
static int	tls_send_client_key_exchange (struct tls_connection *tls)
	Transmit Client Key Exchange record.
static int	tls_send_certificate_verify (struct tls_connection *tls)
	Transmit Certificate Verify record.
static int	tls_send_change_cipher (struct tls_connection *tls)
	Transmit Change Cipher record.
static int	tls_send_finished (struct tls_connection *tls)
	Transmit Finished record.
static int	tls_new_change_cipher (struct tls_connection tls, struct io_buffer iobuf)
	Receive new Change Cipher record.
static int	tls_new_alert (struct tls_connection tls, struct io_buffer iobuf)
	Receive new Alert record.
static int	tls_new_hello_request (struct tls_connection tls, const void data __unused, size_t len __unused)
	Receive new Hello Request handshake record.
static int	tls_new_server_hello (struct tls_connection tls, const void data, size_t len)
	Receive new Server Hello handshake record.
static int	tls_new_session_ticket (struct tls_connection tls, const void data, size_t len)
	Receive New Session Ticket handshake record.
static int	tls_parse_chain (struct tls_connection tls, const void data, size_t len)
	Parse certificate chain.
static int	tls_new_certificate (struct tls_connection tls, const void data, size_t len)
	Receive new Certificate handshake record.
static int	tls_new_server_key_exchange (struct tls_connection tls, const void data, size_t len)
	Receive new Server Key Exchange handshake record.
static int	tls_new_certificate_request (struct tls_connection tls, const void data __unused, size_t len __unused)
	Receive new Certificate Request handshake record.
static int	tls_new_server_hello_done (struct tls_connection tls, const void data, size_t len)
	Receive new Server Hello Done handshake record.
static int	tls_new_finished (struct tls_connection tls, const void data, size_t len)
	Receive new Finished handshake record.
static int	tls_new_handshake (struct tls_connection tls, struct io_buffer iobuf)
	Receive new Handshake record.
static int	tls_new_unknown (struct tls_connection tls __unused, struct io_buffer iobuf)
	Receive new unknown record.
static int	tls_new_data (struct tls_connection tls, struct list_head rx_data)
	Receive new data record.
static int	tls_new_record (struct tls_connection tls, unsigned int type, struct list_head rx_data)
	Receive new record.
static void	tls_hmac_init (struct tls_cipherspec cipherspec, void ctx, struct tls_auth_header *authhdr)
	Initialise HMAC.
static void	tls_hmac_update (struct tls_cipherspec cipherspec, void ctx, const void *data, size_t len)
	Update HMAC.
static void	tls_hmac_final (struct tls_cipherspec cipherspec, void ctx, void *hmac)
	Finalise HMAC.
static void	tls_hmac (struct tls_cipherspec cipherspec, struct tls_auth_header authhdr, const void data, size_t len, void hmac)
	Calculate HMAC.
static void	tls_hmac_list (struct tls_cipherspec cipherspec, struct tls_auth_header authhdr, struct list_head list, void hmac)
	Calculate HMAC over list of I/O buffers.
static size_t	tls_iob_reserved (struct tls_connection *tls, size_t len)
	Calculate maximum additional length required for transmitted record(s).
static int	tls_verify_padding (struct tls_connection tls, struct io_buffer iobuf)
	Verify block padding.
static int	tls_new_ciphertext (struct tls_connection tls, struct tls_header tlshdr, struct list_head *rx_data)
	Receive new ciphertext record.
static size_t	tls_plainstream_window (struct tls_connection *tls)
	Check flow control window.
static int	tls_plainstream_deliver (struct tls_connection tls, struct io_buffer iobuf, struct xfer_metadata *meta __unused)
	Deliver datagram as raw data.
static int	tls_progress (struct tls_connection tls, struct job_progress progress)
	Report job progress.
static int	tls_newdata_process_header (struct tls_connection *tls)
	Handle received TLS header.
static int	tls_newdata_process_data (struct tls_connection *tls)
	Handle received TLS data payload.
static size_t	tls_cipherstream_window (struct tls_connection *tls)
	Check flow control window.
static int	tls_cipherstream_deliver (struct tls_connection tls, struct io_buffer iobuf, struct xfer_metadata *xfer __unused)
	Receive new ciphertext.
static void	tls_validator_done (struct tls_connection *tls, int rc)
	Handle certificate validation completion.
static void	tls_tx_step (struct tls_connection *tls)
	TLS TX state machine.
static int	tls_session (struct tls_connection tls, const char name)
	Find or create session for TLS connection.
int	add_tls (struct interface xfer, const char name, struct x509_root root, struct private_key key)
	Add TLS on an interface.
	REQUIRING_SYMBOL (add_tls)
	REQUIRE_OBJECT (config_crypto)

Variables
struct tls_cipher_suite	tls_cipher_suite_null
	Null cipher suite.
struct tls_key_exchange_algorithm	tls_pubkey_exchange_algorithm
	Public key exchange algorithm.
struct tls_key_exchange_algorithm	tls_dhe_exchange_algorithm
	Ephemeral Diffie-Hellman key exchange algorithm.
struct tls_key_exchange_algorithm	tls_ecdhe_exchange_algorithm
	Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm.
static struct interface_operation	tls_plainstream_ops []
	TLS plaintext stream interface operations.
static struct interface_descriptor	tls_plainstream_desc
	TLS plaintext stream interface descriptor.
static struct interface_operation	tls_cipherstream_ops []
	TLS ciphertext stream interface operations.
static struct interface_descriptor	tls_cipherstream_desc
	TLS ciphertext stream interface descriptor.
static struct interface_operation	tls_validator_ops []
	TLS certificate validator interface operations.
static struct interface_descriptor	tls_validator_desc
	TLS certificate validator interface descriptor.
static struct process_descriptor	tls_process_desc
	TLS TX process descriptor.

Detailed Description

Transport Layer Security Protocol.

Definition in file tls.c.

Macro Definition Documentation

◆ EINVAL_CHANGE_CIPHER

#define EINVAL_CHANGE_CIPHER __einfo_error ( EINFO_EINVAL_CHANGE_CIPHER )

Definition at line 59 of file tls.c.

Referenced by tls_new_change_cipher().

◆ EINFO_EINVAL_CHANGE_CIPHER

#define EINFO_EINVAL_CHANGE_CIPHER

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x01, \

"Invalid Change Cipher record" )

__einfo_uniqify

#define __einfo_uniqify(einfo_base, uniq, desc)

Declare disambiguated error.

Definition errno.h:181

EINFO_EINVAL

#define EINFO_EINVAL

Definition errno.h:430

Definition at line 60 of file tls.c.

#define EINFO_EINVAL_CHANGE_CIPHER                                      \
        __einfo_uniqify ( EINFO_EINVAL, 0x01,                           \
                          "Invalid Change Cipher record" )

◆ EINVAL_ALERT

#define EINVAL_ALERT __einfo_error ( EINFO_EINVAL_ALERT )

Definition at line 63 of file tls.c.

Referenced by tls_new_alert().

◆ EINFO_EINVAL_ALERT

#define EINFO_EINVAL_ALERT

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x02, \

"Invalid Alert record" )

Definition at line 64 of file tls.c.

#define EINFO_EINVAL_ALERT                                              \
        __einfo_uniqify ( EINFO_EINVAL, 0x02,                           \
                          "Invalid Alert record" )

◆ EINVAL_HELLO

#define EINVAL_HELLO __einfo_error ( EINFO_EINVAL_HELLO )

Definition at line 67 of file tls.c.

Referenced by tls_new_server_hello().

◆ EINFO_EINVAL_HELLO

#define EINFO_EINVAL_HELLO

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x03, \

"Invalid Server Hello record" )

Definition at line 68 of file tls.c.

#define EINFO_EINVAL_HELLO                                              \
        __einfo_uniqify ( EINFO_EINVAL, 0x03,                           \
                          "Invalid Server Hello record" )

◆ EINVAL_CERTIFICATE

#define EINVAL_CERTIFICATE __einfo_error ( EINFO_EINVAL_CERTIFICATE )

Definition at line 71 of file tls.c.

Referenced by tls_parse_chain().

◆ EINFO_EINVAL_CERTIFICATE

#define EINFO_EINVAL_CERTIFICATE

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x04, \

"Invalid Certificate" )

Definition at line 72 of file tls.c.

#define EINFO_EINVAL_CERTIFICATE                                        \
        __einfo_uniqify ( EINFO_EINVAL, 0x04,                           \
                          "Invalid Certificate" )

◆ EINVAL_CERTIFICATES

#define EINVAL_CERTIFICATES __einfo_error ( EINFO_EINVAL_CERTIFICATES )

Definition at line 75 of file tls.c.

Referenced by tls_new_certificate().

◆ EINFO_EINVAL_CERTIFICATES

#define EINFO_EINVAL_CERTIFICATES

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x05, \

"Invalid Server Certificate record" )

Definition at line 76 of file tls.c.

#define EINFO_EINVAL_CERTIFICATES                                       \
        __einfo_uniqify ( EINFO_EINVAL, 0x05,                           \
                          "Invalid Server Certificate record" )

◆ EINVAL_HELLO_DONE

#define EINVAL_HELLO_DONE __einfo_error ( EINFO_EINVAL_HELLO_DONE )

Definition at line 79 of file tls.c.

Referenced by tls_new_server_hello_done().

◆ EINFO_EINVAL_HELLO_DONE

#define EINFO_EINVAL_HELLO_DONE

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x06, \

"Invalid Server Hello Done record" )

Definition at line 80 of file tls.c.

#define EINFO_EINVAL_HELLO_DONE                                         \
        __einfo_uniqify ( EINFO_EINVAL, 0x06,                           \
                          "Invalid Server Hello Done record" )

◆ EINVAL_FINISHED

#define EINVAL_FINISHED __einfo_error ( EINFO_EINVAL_FINISHED )

Definition at line 83 of file tls.c.

Referenced by tls_new_finished().

◆ EINFO_EINVAL_FINISHED

#define EINFO_EINVAL_FINISHED

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x07, \

"Invalid Server Finished record" )

Definition at line 84 of file tls.c.

#define EINFO_EINVAL_FINISHED                                           \
        __einfo_uniqify ( EINFO_EINVAL, 0x07,                           \
                          "Invalid Server Finished record" )

◆ EINVAL_HANDSHAKE

#define EINVAL_HANDSHAKE __einfo_error ( EINFO_EINVAL_HANDSHAKE )

Definition at line 87 of file tls.c.

◆ EINFO_EINVAL_HANDSHAKE

#define EINFO_EINVAL_HANDSHAKE

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x08, \

"Invalid Handshake record" )

Definition at line 88 of file tls.c.

#define EINFO_EINVAL_HANDSHAKE                                          \
        __einfo_uniqify ( EINFO_EINVAL, 0x08,                           \
                          "Invalid Handshake record" )

◆ EINVAL_IV

#define EINVAL_IV __einfo_error ( EINFO_EINVAL_IV )

Definition at line 91 of file tls.c.

Referenced by tls_new_ciphertext().

◆ EINFO_EINVAL_IV

#define EINFO_EINVAL_IV

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0a, \

"Invalid initialisation vector" )

Definition at line 92 of file tls.c.

#define EINFO_EINVAL_IV                                                 \
        __einfo_uniqify ( EINFO_EINVAL, 0x0a,                           \
                          "Invalid initialisation vector" )

◆ EINVAL_PADDING

#define EINVAL_PADDING __einfo_error ( EINFO_EINVAL_PADDING )

Definition at line 95 of file tls.c.

Referenced by tls_verify_padding().

◆ EINFO_EINVAL_PADDING

#define EINFO_EINVAL_PADDING

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0b, \

"Invalid block padding" )

Definition at line 96 of file tls.c.

#define EINFO_EINVAL_PADDING                                            \
        __einfo_uniqify ( EINFO_EINVAL, 0x0b,                           \
                          "Invalid block padding" )

◆ EINVAL_RX_STATE

#define EINVAL_RX_STATE __einfo_error ( EINFO_EINVAL_RX_STATE )

Definition at line 99 of file tls.c.

Referenced by tls_cipherstream_deliver().

◆ EINFO_EINVAL_RX_STATE

#define EINFO_EINVAL_RX_STATE

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0c, \

"Invalid receive state" )

Definition at line 100 of file tls.c.

#define EINFO_EINVAL_RX_STATE                                           \
        __einfo_uniqify ( EINFO_EINVAL, 0x0c,                           \
                          "Invalid receive state" )

◆ EINVAL_MAC

#define EINVAL_MAC __einfo_error ( EINFO_EINVAL_MAC )

Definition at line 103 of file tls.c.

Referenced by tls_new_ciphertext().

◆ EINFO_EINVAL_MAC

#define EINFO_EINVAL_MAC

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0d, \

"Invalid MAC or authentication tag" )

Definition at line 104 of file tls.c.

#define EINFO_EINVAL_MAC                                                \
        __einfo_uniqify ( EINFO_EINVAL, 0x0d,                           \
                          "Invalid MAC or authentication tag" )

◆ EINVAL_TICKET

#define EINVAL_TICKET __einfo_error ( EINFO_EINVAL_TICKET )

Definition at line 107 of file tls.c.

Referenced by tls_new_session_ticket().

◆ EINFO_EINVAL_TICKET

#define EINFO_EINVAL_TICKET

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0e, \

"Invalid New Session Ticket record")

Definition at line 108 of file tls.c.

#define EINFO_EINVAL_TICKET                                             \
        __einfo_uniqify ( EINFO_EINVAL, 0x0e,                           \
                          "Invalid New Session Ticket record")

◆ EINVAL_KEY_EXCHANGE

#define EINVAL_KEY_EXCHANGE __einfo_error ( EINFO_EINVAL_KEY_EXCHANGE )

Definition at line 111 of file tls.c.

Referenced by tls_agree_ephemeral(), tls_new_server_key_exchange_dhe(), tls_new_server_key_exchange_ecdhe(), and tls_verify_dh_params().

◆ EINFO_EINVAL_KEY_EXCHANGE

#define EINFO_EINVAL_KEY_EXCHANGE

Value:

__einfo_uniqify ( EINFO_EINVAL, 0x0f, \

"Invalid Server Key Exchange record" )

Definition at line 112 of file tls.c.

#define EINFO_EINVAL_KEY_EXCHANGE                                       \
        __einfo_uniqify ( EINFO_EINVAL, 0x0f,                           \
                          "Invalid Server Key Exchange record" )

◆ EIO_ALERT

#define EIO_ALERT __einfo_error ( EINFO_EIO_ALERT )

Definition at line 115 of file tls.c.

Referenced by tls_new_alert().

◆ EINFO_EIO_ALERT

#define EINFO_EIO_ALERT

Value:

__einfo_uniqify ( EINFO_EIO, 0x01, \

"Unknown alert level" )

EINFO_EIO

#define EINFO_EIO

Definition errno.h:435

Definition at line 116 of file tls.c.

#define EINFO_EIO_ALERT                                                 \
        __einfo_uniqify ( EINFO_EIO, 0x01,                              \
                          "Unknown alert level" )

◆ ENOENT_CERT

#define ENOENT_CERT __einfo_error ( EINFO_ENOENT_CERT )

Definition at line 119 of file tls.c.

Referenced by tls_parse_chain(), tls_send_client_key_exchange_pubkey(), and tls_verify_dh_params().

◆ EINFO_ENOENT_CERT

#define EINFO_ENOENT_CERT

Value:

__einfo_uniqify ( EINFO_ENOENT, 0x01, \

"Missing server certificate" )

EINFO_ENOENT

#define EINFO_ENOENT

Definition errno.h:516

Definition at line 120 of file tls.c.

#define EINFO_ENOENT_CERT                                               \
        __einfo_uniqify ( EINFO_ENOENT, 0x01,                           \
                          "Missing server certificate" )

◆ ENOMEM_CONTEXT

#define ENOMEM_CONTEXT __einfo_error ( EINFO_ENOMEM_CONTEXT )

Definition at line 123 of file tls.c.

Referenced by tls_set_cipher().

◆ EINFO_ENOMEM_CONTEXT

#define EINFO_ENOMEM_CONTEXT

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x01, \

"Not enough space for crypto context" )

EINFO_ENOMEM

#define EINFO_ENOMEM

Definition errno.h:536

Definition at line 124 of file tls.c.

#define EINFO_ENOMEM_CONTEXT                                            \
        __einfo_uniqify ( EINFO_ENOMEM, 0x01,                           \
                          "Not enough space for crypto context" )

◆ ENOMEM_CERTIFICATE

#define ENOMEM_CERTIFICATE __einfo_error ( EINFO_ENOMEM_CERTIFICATE )

Definition at line 127 of file tls.c.

Referenced by tls_send_certificate().

◆ EINFO_ENOMEM_CERTIFICATE

#define EINFO_ENOMEM_CERTIFICATE

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x02, \

"Not enough space for certificate" )

Definition at line 128 of file tls.c.

#define EINFO_ENOMEM_CERTIFICATE                                        \
        __einfo_uniqify ( EINFO_ENOMEM, 0x02,                           \
                          "Not enough space for certificate" )

◆ ENOMEM_CHAIN

#define ENOMEM_CHAIN __einfo_error ( EINFO_ENOMEM_CHAIN )

Definition at line 131 of file tls.c.

Referenced by tls_parse_chain().

◆ EINFO_ENOMEM_CHAIN

#define EINFO_ENOMEM_CHAIN

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x03, \

"Not enough space for certificate chain" )

Definition at line 132 of file tls.c.

#define EINFO_ENOMEM_CHAIN                                              \
        __einfo_uniqify ( EINFO_ENOMEM, 0x03,                           \
                          "Not enough space for certificate chain" )

◆ ENOMEM_TX_PLAINTEXT

#define ENOMEM_TX_PLAINTEXT __einfo_error ( EINFO_ENOMEM_TX_PLAINTEXT )

Definition at line 135 of file tls.c.

Referenced by tls_send_plaintext().

◆ EINFO_ENOMEM_TX_PLAINTEXT

#define EINFO_ENOMEM_TX_PLAINTEXT

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x04, \

"Not enough space for transmitted plaintext" )

Definition at line 136 of file tls.c.

#define EINFO_ENOMEM_TX_PLAINTEXT                                       \
        __einfo_uniqify ( EINFO_ENOMEM, 0x04,                           \
                          "Not enough space for transmitted plaintext" )

◆ ENOMEM_TX_CIPHERTEXT

#define ENOMEM_TX_CIPHERTEXT __einfo_error ( EINFO_ENOMEM_TX_CIPHERTEXT )

Definition at line 139 of file tls.c.

◆ EINFO_ENOMEM_TX_CIPHERTEXT

#define EINFO_ENOMEM_TX_CIPHERTEXT

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x05, \

"Not enough space for transmitted ciphertext" )

Definition at line 140 of file tls.c.

#define EINFO_ENOMEM_TX_CIPHERTEXT                                      \
        __einfo_uniqify ( EINFO_ENOMEM, 0x05,                           \
                          "Not enough space for transmitted ciphertext" )

◆ ENOMEM_RX_DATA

#define ENOMEM_RX_DATA __einfo_error ( EINFO_ENOMEM_RX_DATA )

Definition at line 143 of file tls.c.

Referenced by tls_newdata_process_header().

◆ EINFO_ENOMEM_RX_DATA

#define EINFO_ENOMEM_RX_DATA

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x07, \

"Not enough space for received data" )

Definition at line 144 of file tls.c.

#define EINFO_ENOMEM_RX_DATA                                            \
        __einfo_uniqify ( EINFO_ENOMEM, 0x07,                           \
                          "Not enough space for received data" )

◆ ENOMEM_RX_CONCAT

#define ENOMEM_RX_CONCAT __einfo_error ( EINFO_ENOMEM_RX_CONCAT )

Definition at line 147 of file tls.c.

Referenced by tls_new_record().

◆ EINFO_ENOMEM_RX_CONCAT

#define EINFO_ENOMEM_RX_CONCAT

Value:

__einfo_uniqify ( EINFO_ENOMEM, 0x08, \

"Not enough space to concatenate received data" )

Definition at line 148 of file tls.c.

#define EINFO_ENOMEM_RX_CONCAT                                          \
        __einfo_uniqify ( EINFO_ENOMEM, 0x08,                           \
                          "Not enough space to concatenate received data" )

◆ ENOTSUP_CIPHER

#define ENOTSUP_CIPHER __einfo_error ( EINFO_ENOTSUP_CIPHER )

Definition at line 151 of file tls.c.

Referenced by tls_select_cipher().

◆ EINFO_ENOTSUP_CIPHER

#define EINFO_ENOTSUP_CIPHER

Value:

__einfo_uniqify ( EINFO_ENOTSUP, 0x01, \

"Unsupported cipher" )

EINFO_ENOTSUP

#define EINFO_ENOTSUP

Definition errno.h:591

Definition at line 152 of file tls.c.

#define EINFO_ENOTSUP_CIPHER                                            \
        __einfo_uniqify ( EINFO_ENOTSUP, 0x01,                          \
                          "Unsupported cipher" )

◆ ENOTSUP_NULL

#define ENOTSUP_NULL __einfo_error ( EINFO_ENOTSUP_NULL )

Definition at line 155 of file tls.c.

Referenced by tls_change_cipher().

◆ EINFO_ENOTSUP_NULL

#define EINFO_ENOTSUP_NULL

Value:

__einfo_uniqify ( EINFO_ENOTSUP, 0x02, \

"Refusing to use null cipher" )

Definition at line 156 of file tls.c.

#define EINFO_ENOTSUP_NULL                                              \
        __einfo_uniqify ( EINFO_ENOTSUP, 0x02,                          \
                          "Refusing to use null cipher" )

◆ ENOTSUP_SIG_HASH

#define ENOTSUP_SIG_HASH __einfo_error ( EINFO_ENOTSUP_SIG_HASH )

Definition at line 159 of file tls.c.

Referenced by tls_send_certificate_verify(), and tls_verify_dh_params().

◆ EINFO_ENOTSUP_SIG_HASH

#define EINFO_ENOTSUP_SIG_HASH

Value:

__einfo_uniqify ( EINFO_ENOTSUP, 0x03, \

"Unsupported signature and hash algorithm" )

Definition at line 160 of file tls.c.

#define EINFO_ENOTSUP_SIG_HASH                                          \
        __einfo_uniqify ( EINFO_ENOTSUP, 0x03,                          \
                          "Unsupported signature and hash algorithm" )

◆ ENOTSUP_VERSION

#define ENOTSUP_VERSION __einfo_error ( EINFO_ENOTSUP_VERSION )

Definition at line 163 of file tls.c.

◆ EINFO_ENOTSUP_VERSION

#define EINFO_ENOTSUP_VERSION

Value:

__einfo_uniqify ( EINFO_ENOTSUP, 0x04, \

"Unsupported protocol version" )

Definition at line 164 of file tls.c.

#define EINFO_ENOTSUP_VERSION                                           \
        __einfo_uniqify ( EINFO_ENOTSUP, 0x04,                          \
                          "Unsupported protocol version" )

◆ ENOTSUP_GROUP

#define ENOTSUP_GROUP __einfo_error ( EINFO_ENOTSUP_GROUP )

Definition at line 167 of file tls.c.

Referenced by tls_new_server_key_exchange_dhe(), and tls_new_server_key_exchange_ecdhe().

◆ EINFO_ENOTSUP_GROUP

#define EINFO_ENOTSUP_GROUP

Value:

__einfo_uniqify ( EINFO_ENOTSUP, 0x05, \

"Unsupported key exchange group" )

Definition at line 168 of file tls.c.

#define EINFO_ENOTSUP_GROUP                                             \
        __einfo_uniqify ( EINFO_ENOTSUP, 0x05,                          \
                          "Unsupported key exchange group" )

◆ EPERM_ALERT

#define EPERM_ALERT __einfo_error ( EINFO_EPERM_ALERT )

Definition at line 171 of file tls.c.

Referenced by tls_new_alert().

◆ EINFO_EPERM_ALERT

#define EINFO_EPERM_ALERT

Value:

__einfo_uniqify ( EINFO_EPERM, 0x01, \

"Received fatal alert" )

EINFO_EPERM

#define EINFO_EPERM

Definition errno.h:616

Definition at line 172 of file tls.c.

#define EINFO_EPERM_ALERT                                               \
        __einfo_uniqify ( EINFO_EPERM, 0x01,                            \
                          "Received fatal alert" )

◆ EPERM_VERIFY

#define EPERM_VERIFY __einfo_error ( EINFO_EPERM_VERIFY )

Definition at line 175 of file tls.c.

Referenced by tls_new_finished().

◆ EINFO_EPERM_VERIFY

#define EINFO_EPERM_VERIFY

Value:

__einfo_uniqify ( EINFO_EPERM, 0x02, \

"Handshake verification failed" )

Definition at line 176 of file tls.c.

#define EINFO_EPERM_VERIFY                                              \
        __einfo_uniqify ( EINFO_EPERM, 0x02,                            \
                          "Handshake verification failed" )

◆ EPERM_RENEG_INSECURE

#define EPERM_RENEG_INSECURE __einfo_error ( EINFO_EPERM_RENEG_INSECURE )

Definition at line 179 of file tls.c.

Referenced by tls_new_hello_request().

◆ EINFO_EPERM_RENEG_INSECURE

#define EINFO_EPERM_RENEG_INSECURE

Value:

__einfo_uniqify ( EINFO_EPERM, 0x04, \

"Secure renegotiation not supported" )

Definition at line 180 of file tls.c.

#define EINFO_EPERM_RENEG_INSECURE                                      \
        __einfo_uniqify ( EINFO_EPERM, 0x04,                            \
                          "Secure renegotiation not supported" )

◆ EPERM_RENEG_VERIFY

#define EPERM_RENEG_VERIFY __einfo_error ( EINFO_EPERM_RENEG_VERIFY )

Definition at line 183 of file tls.c.

Referenced by tls_new_server_hello().

◆ EINFO_EPERM_RENEG_VERIFY

#define EINFO_EPERM_RENEG_VERIFY

Value:

__einfo_uniqify ( EINFO_EPERM, 0x05, \

"Secure renegotiation verification failed" )

Definition at line 184 of file tls.c.

#define EINFO_EPERM_RENEG_VERIFY                                        \
        __einfo_uniqify ( EINFO_EPERM, 0x05,                            \
                          "Secure renegotiation verification failed" )

◆ EPERM_KEY_EXCHANGE

#define EPERM_KEY_EXCHANGE __einfo_error ( EINFO_EPERM_KEY_EXCHANGE )

Definition at line 187 of file tls.c.

Referenced by tls_verify_dh_params().

◆ EINFO_EPERM_KEY_EXCHANGE

#define EINFO_EPERM_KEY_EXCHANGE

Value:

__einfo_uniqify ( EINFO_EPERM, 0x06, \

"ServerKeyExchange verification failed" )

Definition at line 188 of file tls.c.

#define EINFO_EPERM_KEY_EXCHANGE                                        \
        __einfo_uniqify ( EINFO_EPERM, 0x06,                            \
                          "ServerKeyExchange verification failed" )

◆ EPERM_EMS

#define EPERM_EMS __einfo_error ( EINFO_EPERM_EMS )

Definition at line 191 of file tls.c.

Referenced by tls_new_server_hello().

◆ EINFO_EPERM_EMS

#define EINFO_EPERM_EMS

Value:

__einfo_uniqify ( EINFO_EPERM, 0x07, \

"Extended master secret extension mismatch" )

Definition at line 192 of file tls.c.

#define EINFO_EPERM_EMS                                                 \
        __einfo_uniqify ( EINFO_EPERM, 0x07,                            \
                          "Extended master secret extension mismatch" )

◆ EPERM_BOUND

#define EPERM_BOUND __einfo_error ( EINFO_EPERM_BOUND )

Definition at line 195 of file tls.c.

Referenced by tls_send_finished().

◆ EINFO_EPERM_BOUND

#define EINFO_EPERM_BOUND

Value:

__einfo_uniqify ( EINFO_EPERM, 0x08, \

"Bound identity not validated" )

Definition at line 196 of file tls.c.

#define EINFO_EPERM_BOUND                                               \
        __einfo_uniqify ( EINFO_EPERM, 0x08,                            \
                          "Bound identity not validated" )

◆ EPROTO_VERSION

#define EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION )

Definition at line 199 of file tls.c.

Referenced by tls_new_server_hello().

◆ EINFO_EPROTO_VERSION

#define EINFO_EPROTO_VERSION

Value:

__einfo_uniqify ( EINFO_EPROTO, 0x01, \

"Illegal protocol version upgrade" )

EINFO_EPROTO

#define EINFO_EPROTO

Definition errno.h:626

Definition at line 200 of file tls.c.

#define EINFO_EPROTO_VERSION                                            \
        __einfo_uniqify ( EINFO_EPROTO, 0x01,                           \
                          "Illegal protocol version upgrade" )

◆ tls_prf_label

#define tls_prf_label	(	tls,
		out,
		out_len,
		label,
		... )

Value:

tls_prf ( (tls), (out), (out_len), \

label, ( sizeof ( label ) - 1 ), __VA_ARGS__, NULL )

NULL

#define NULL

NULL pointer (VOID *).

Definition Base.h:321

out

__be32 out[4]

Definition CIB_PRM.h:8

label

A text label widget.

Definition label.h:16

tls_prf

static void tls_prf(struct tls_connection *tls, void *out, size_t out_len,...)

Generate secure pseudo-random data.

Definition tls.c:693

Generate secure pseudo-random data.

Parameters

tls	TLS connection
out	Output buffer
out_len	Length of output buffer
label	String literal label
...	( data, len ) pairs of seed data

Definition at line 746 of file tls.c.

#define tls_prf_label( tls, out, out_len, label, ... )                  \
        tls_prf ( (tls), (out), (out_len),                              \
                  label, ( sizeof ( label ) - 1 ), __VA_ARGS__, NULL )

Referenced by tls_generate_keys(), tls_generate_master_secret(), tls_new_finished(), and tls_send_finished().

◆ TLS_NUM_CIPHER_SUITES

#define TLS_NUM_CIPHER_SUITES table_num_entries ( TLS_CIPHER_SUITES )

Number of supported cipher suites.

Definition at line 1199 of file tls.c.

Referenced by tls_client_hello().

◆ TLS_NUM_SIG_HASH_ALGORITHMS

#define TLS_NUM_SIG_HASH_ALGORITHMS table_num_entries ( TLS_SIG_HASH_ALGORITHMS )

Number of supported signature and hash algorithms.

Definition at line 1345 of file tls.c.

1345#define TLS_NUM_SIG_HASH_ALGORITHMS \

1346 table_num_entries ( TLS_SIG_HASH_ALGORITHMS )

Referenced by tls_client_hello().

Function Documentation

◆ FILE_LICENCE()

FILE_LICENCE ( GPL2_OR_LATER )

◆ FILE_SECBOOT()

FILE_SECBOOT ( PERMITTED )

◆ LIST_HEAD()

LIST_HEAD ( tls_sessions )

static

List of TLS session.

References data, len, and type.

◆ tls_regenerate_ephemeral_master()

void tls_regenerate_ephemeral_master ( struct tls_connection * tls )

static

Regenerate ephemeral master secret.

Parameters

tls	TLS connection

Definition at line 488 of file tls.c.

                                                                           {
        struct tls_key_schedule *key = &tls->key;
 
        /* Derive a new ephemeral master secret */
        tls_ephemeral_label ( tls, "key reset", key->ephemeral,
                              sizeof ( key->ephemeral ) );
 
        /* (Re)generate client random bytes */
        tls_ephemeral_label ( tls, "client random", &tls->client.random.random,
                              sizeof ( tls->client.random.random ) );
}

References tls_connection::client, key, tls_connection::key, tls_client::random, tls_client_random::random, and tls_ephemeral_label().

Referenced by tls_close(), and tls_restart().

◆ tls_tx_resume_all()

void tls_tx_resume_all ( struct tls_session * session )

static

Resume TX state machine for all connections within a session.

Parameters

session TLS session

Definition at line 1925 of file tls.c.

                                                              {
        struct tls_connection *tls;
 
        list_for_each_entry ( tls, &session->conn, list )
                tls_tx_resume ( tls );
}

References tls_session::conn, tls_connection::list, list_for_each_entry, tls_connection::session, and tls_tx_resume().

Referenced by tls_close(), and tls_new_finished().

◆ tls_alloc_iob()

struct io_buffer * tls_alloc_iob	(	struct tls_connection *	tls,
		size_t	len )

static

Allocate I/O buffer for transmitted record(s).

Parameters

tls	TLS connection
len	I/O buffer payload length

Return values

iobuf I/O buffer

Definition at line 3472 of file tls.c.

                                                       {
        struct io_buffer *iobuf;
        size_t reserve;
 
        /* Calculate maximum additional length to reserve */
        reserve = tls_iob_reserved ( tls, len );
 
        /* Allocate I/O buffer */
        iobuf = xfer_alloc_iob ( &tls->cipherstream, ( reserve + len ) );
        if ( ! iobuf )
                return NULL;
 
        /* Reserve space */
        iob_reserve ( iobuf, reserve );
 
        return iobuf;
}

References tls_connection::cipherstream, iob_reserve, len, NULL, tls_iob_reserved(), and xfer_alloc_iob().

Referenced by tls_send_certificate(), and tls_send_plaintext().

◆ tls_send_handshake()

int tls_send_handshake	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Transmit Handshake record.

Parameters

tls	TLS connection
data	Plaintext record
len	Length of plaintext record

Return values

rc	Return status code

Definition at line 1963 of file tls.c.

                                                               {
 
        /* Send record */
        return tls_send_plaintext ( tls, TLS_TYPE_HANDSHAKE, data, len );
}

References data, len, tls_send_plaintext(), and TLS_TYPE_HANDSHAKE.

Referenced by tls_send_certificate_verify(), tls_send_client_hello(), tls_send_client_key_exchange_dhe(), tls_send_client_key_exchange_ecdhe(), tls_send_client_key_exchange_pubkey(), and tls_send_finished().

◆ tls_send_alert()

int tls_send_alert	(	struct tls_connection *	tls,
		unsigned int	level,
		unsigned int	description )

static

Transmit Alert record.

Parameters

tls	TLS connection
level	Alert level
description	Alert description

Return values

rc	Return status code

Definition at line 2406 of file tls.c.

                                                       {
        const struct {
                uint8_t level;
                uint8_t description;
        } __attribute__ (( packed )) alert = {
                .level = level,
                .description = description,
        };
 
        /* Send record */
        return tls_send_plaintext ( tls, TLS_TYPE_ALERT, &alert,
                                    sizeof ( alert ) );
}

References __attribute__, alert(), tls_send_plaintext(), and TLS_TYPE_ALERT.

Referenced by tls_close_alert().

◆ tls_send_record()

int tls_send_record	(	struct tls_connection *	tls,
		unsigned int	type,
		struct io_buffer *	iobuf )

static

Send plaintext record(s).

Parameters

tls	TLS connection
type	Record type
iobuf	I/O buffer

Return values

rc	Return status code

Definition at line 3499 of file tls.c.

                                                       {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active;
        struct tls_cipher_suite *suite = cipherspec->suite;
        struct cipher_algorithm *cipher = suite->cipher;
        struct digest_algorithm *digest = suite->digest;
        struct {
                uint8_t fixed[suite->fixed_iv_len];
                uint8_t rec[suite->record_iv_len];
        } __attribute__ (( packed )) iv;
        struct tls_auth_header authhdr;
        struct tls_header *tlshdr;
        uint8_t mac[digest->digestsize];
        const void *plaintext;
        const void *encrypt;
        void *ciphertext;
        size_t record_len;
        size_t encrypt_len;
        size_t pad_len;
        size_t len;
        int rc;
 
        /* Record plaintext pointer and length */
        plaintext = iobuf->data;
        len = iob_len ( iobuf );
 
        /* Add to handshake digest if applicable */
        if ( type == TLS_TYPE_HANDSHAKE )
                tls_add_handshake ( tls, plaintext, len );
 
        /* Start constructing ciphertext at start of reserved space */
        iob_push ( iobuf, tls_iob_reserved ( tls, len ) );
        iob_unput ( iobuf, iob_len ( iobuf ) );
 
        /* Construct records */
        do {
                /* Limit length of this record (may be zero) */
                record_len = len;
                if ( record_len > TLS_TX_BUFSIZE )
                        record_len = TLS_TX_BUFSIZE;
 
                /* Construct authentication header */
                authhdr.seq = cpu_to_be64 ( tls->tx.seq );
                authhdr.header.type = type;
                authhdr.header.version = htons ( tls->version );
                authhdr.header.length = htons ( record_len );
 
                /* Construct and set initialisation vector */
                memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) );
                tls_ephemeral ( tls, &authhdr, sizeof ( authhdr ), iv.rec,
                                sizeof ( iv.rec ) );
                if ( ( rc = cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv,
                                           sizeof ( iv ) ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not set TX IV: %s\n",
                               tls, strerror ( rc ) );
                        goto err_setiv;
                }
 
                /* Process authentication data */
                if ( suite->mac_len ) {
                        tls_hmac ( cipherspec, &authhdr, plaintext, record_len,
                                   mac );
                }
                if ( is_auth_cipher ( cipher ) ) {
                        cipher_encrypt ( cipher, cipherspec->cipher_ctx,
                                         &authhdr, NULL, sizeof ( authhdr ) );
                }
 
                /* Calculate encryption length */
                encrypt_len = ( record_len + suite->mac_len );
                if ( is_block_cipher ( cipher ) ) {
                        pad_len = ( ( ( cipher->blocksize - 1 ) &
                                      -( encrypt_len + 1 ) ) + 1 );
                } else {
                        pad_len = 0;
                }
                encrypt_len += pad_len;
 
                /* Add record header */
                tlshdr = iob_put ( iobuf, sizeof ( *tlshdr ) );
                tlshdr->type = type;
                tlshdr->version = htons ( tls->version );
                tlshdr->length = htons ( sizeof ( iv.rec ) + encrypt_len +
                                         cipher->authsize );
 
                /* Add record initialisation vector, if applicable */
                memcpy ( iob_put ( iobuf, sizeof ( iv.rec ) ), iv.rec,
                         sizeof ( iv.rec ) );
 
                /* Copy plaintext data if necessary */
                ciphertext = iob_put ( iobuf, record_len );
                assert ( ciphertext <= plaintext );
                if ( encrypt_len > record_len ) {
                        memmove ( ciphertext, plaintext, record_len );
                        encrypt = ciphertext;
                } else {
                        encrypt = plaintext;
                }
 
                /* Add MAC, if applicable */
                memcpy ( iob_put ( iobuf, suite->mac_len ), mac,
                         suite->mac_len );
 
                /* Add padding, if applicable */
                memset ( iob_put ( iobuf, pad_len ), ( pad_len - 1 ), pad_len );
 
                /* Encrypt data and append authentication tag */
                DBGC2 ( tls, "Sending plaintext data:\n" );
                DBGC2_HDA ( tls, 0, encrypt, encrypt_len );
                cipher_encrypt ( cipher, cipherspec->cipher_ctx, encrypt,
                                 ciphertext, encrypt_len );
                cipher_auth ( cipher, cipherspec->cipher_ctx,
                              iob_put ( iobuf, cipher->authsize ) );
 
                /* Move to next record */
                tls->tx.seq += 1;
                plaintext += record_len;
                len -= record_len;
 
        } while ( len );
 
        /* Send ciphertext */
        if ( ( rc = xfer_deliver_iob ( &tls->cipherstream,
                                       iob_disown ( iobuf ) ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not deliver ciphertext: %s\n",
                       tls, strerror ( rc ) );
                goto err_deliver;
        }
 
        assert ( iobuf == NULL );
        return 0;
 
 err_deliver:
 err_setiv:
        free_iob ( iobuf );
        return rc;
}

References __attribute__, tls_cipherspec_pair::active, assert, cipher_algorithm::authsize, cipher_algorithm::blocksize, tls_cipher_suite::cipher, cipher_auth(), tls_cipherspec::cipher_ctx, cipher_encrypt, cipher_setiv(), tls_tx::cipherspec, tls_connection::cipherstream, cpu_to_be64, io_buffer::data, DBGC, DBGC2, DBGC2_HDA, tls_cipher_suite::digest, digest_algorithm::digestsize, fixed, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, free_iob(), tls_auth_header::header, htons, iob_disown, iob_len(), iob_push, iob_put, iob_unput, is_auth_cipher(), is_block_cipher(), iv, len, tls_header::length, mac, tls_cipher_suite::mac_len, memcpy(), memmove(), memset(), NULL, rc, tls_cipher_suite::record_iv_len, tls_auth_header::seq, tls_tx::seq, strerror(), tls_cipherspec::suite, tls_add_handshake(), tls_ephemeral(), tls_hmac(), tls_iob_reserved(), TLS_TX_BUFSIZE, TLS_TYPE_HANDSHAKE, tls_connection::tx, tls_header::type, type, tls_connection::version, tls_header::version, and xfer_deliver_iob().

Referenced by tls_plainstream_deliver(), tls_send_certificate(), and tls_send_plaintext().

◆ tls_send_plaintext()

int tls_send_plaintext	(	struct tls_connection *	tls,
		unsigned int	type,
		const void *	data,
		size_t	len )

static

Send plaintext record.

Parameters

tls	TLS connection
type	Record type
data	Plaintext record
len	Length of plaintext record

Return values

rc	Return status code

Definition at line 3646 of file tls.c.

                                                               {
        struct io_buffer *iobuf;
        int rc;
 
        /* Allocate I/O buffer */
        iobuf = tls_alloc_iob ( tls, len );
        if ( ! iobuf )
                return -ENOMEM_TX_PLAINTEXT;
        memcpy ( iob_put ( iobuf, len ), data, len );
 
        /* Transmit I/O buffer */
        if ( ( rc = tls_send_record ( tls, type, iob_disown ( iobuf ) ) ) != 0 )
                return rc;
 
        return 0;
}

References data, ENOMEM_TX_PLAINTEXT, iob_disown, iob_put, len, memcpy(), rc, tls_alloc_iob(), tls_send_record(), and type.

Referenced by tls_send_alert(), tls_send_change_cipher(), and tls_send_handshake().

◆ tls_clear_cipher() [1/2]

void tls_clear_cipher	(	struct tls_connection *	tls,
		struct tls_cipherspec *	cipherspec )

static

References out.

Referenced by add_tls(), free_tls(), tls_change_cipher(), and tls_set_cipher().

◆ tls_clear_digest()

void tls_clear_digest ( struct tls_connection * tls )

static

Clear key schedule digest algorithm.

Parameters

tls	TLS connection

Definition at line 542 of file tls.c.

                                                            {
        struct tls_key_schedule *key = &tls->key;
 
        /* Set null digest algorithm */
        key->digest = &digest_null;
 
        /* Free any dynamic storage */
        zfree ( key->dynamic );
        key->dynamic = NULL;
        key->handshake = NULL;
        key->kdf = NULL;
 
        /* Key schedule no longer contains any shared secret */
        tls_clear_binding ( tls );
        key->keyed = 0;
}

References digest_null, key, tls_connection::key, NULL, tls_clear_binding(), and zfree().

Referenced by add_tls(), free_tls(), and tls_set_digest().

◆ tls_verify_handshake()

void tls_verify_handshake	(	struct tls_connection *	tls,
		void *	out )

static

Calculate handshake verification hash.

Parameters

tls	TLS connection
out	Output buffer

Calculates the digest over all handshake messages seen so far.

Definition at line 1174 of file tls.c.

                                                                           {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = key->digest;
        uint8_t ctx[ digest->ctxsize ];
 
        memcpy ( ctx, key->handshake, sizeof ( ctx ) );
        digest_final ( digest, ctx, out );
}

References ctx, digest_algorithm::ctxsize, digest_final(), key, tls_connection::key, memcpy(), and out.

Referenced by tls_generate_master_secret(), tls_new_finished(), tls_send_certificate_verify(), and tls_send_finished().

◆ tls_uint24()

unsigned long tls_uint24 ( const tls24_t * field24 )

inlinestatic

Extract 24-bit field value.

Parameters

field24 24-bit field

Return values

value Field value

Definition at line 251 of file tls.c.

                                      {
 
        return ( ( field24->high << 16 ) | be16_to_cpu ( field24->low ) );
}

References be16_to_cpu, tls24_t::high, and tls24_t::low.

Referenced by tls_new_certificate(), tls_new_handshake(), and tls_parse_chain().

◆ tls_set_uint24()

void tls_set_uint24	(	tls24_t *	field24,
		unsigned long	value )

static

Set 24-bit field value.

Parameters

field24	24-bit field
value	Field value

Definition at line 262 of file tls.c.

                                                                     {
 
        field24->high = ( value >> 16 );
        field24->low = cpu_to_be16 ( value );
}

References cpu_to_be16, tls24_t::high, tls24_t::low, and value.

Referenced by tls_send_certificate().

◆ tls_ready()

int tls_ready ( struct tls_connection * tls )

static

Determine if TLS connection is ready for application data.

Parameters

tls	TLS connection

Return values

is_ready TLS connection is ready

Definition at line 274 of file tls.c.

                                                    {
        return ( ( ! is_pending ( &tls->client.negotiation ) ) &&
                 ( ! is_pending ( &tls->server.negotiation ) ) );
}

References tls_connection::client, is_pending(), tls_client::negotiation, tls_server::negotiation, and tls_connection::server.

Referenced by tls_cipherstream_window(), tls_new_data(), tls_new_hello_request(), tls_plainstream_deliver(), and tls_plainstream_window().

◆ tls_version()

int tls_version	(	struct tls_connection *	tls,
		unsigned int	version )

inlinestatic

Check for TLS version.

Parameters

tls	TLS connection
version	TLS version

Return values

at_least TLS connection is using at least the specified version

Check that TLS connection uses at least the specified protocol version. Optimise down to a compile-time constant true result if this is already guaranteed by the minimum supported version check.

Definition at line 291 of file tls.c.

                                                                 {
        return ( ( TLS_VERSION_MIN >= version ) ||
                 ( tls->version >= version ) );
}

References TLS_VERSION_MIN, tls_connection::version, and version.

Referenced by tls_generate_resumption_master(), tls_prf(), tls_select_cipher(), tls_send_certificate_verify(), tls_set_digest(), tls_set_kdf_master(), and tls_verify_dh_params().

◆ free_tls_session()

void free_tls_session ( struct refcnt * refcnt )

static

Free TLS session.

Parameters

refcnt Reference counter

Definition at line 308 of file tls.c.

                                                       {
        struct tls_session *session =
                container_of ( refcnt, struct tls_session, refcnt );
 
        /* Sanity check */
        assert ( list_empty ( &session->conn ) );
 
        /* Remove from list of sessions */
        list_del ( &session->list );
 
        /* Free dynamically-allocated resources */
        x509_root_put ( session->root );
        privkey_put ( session->key );
        x509_put ( session->cert );
        zfree ( session->ticket );
 
        /* Free session */
        zfree ( session );
}

References assert, tls_session::cert, tls_session::conn, container_of, tls_session::key, tls_session::list, list_del, list_empty, privkey_put(), tls_session::root, tls_session::ticket, x509_put(), x509_root_put(), and zfree().

Referenced by tls_session().

◆ free_tls()

void free_tls ( struct refcnt * refcnt )

static

Free TLS connection.

Parameters

refcnt Reference counter

Definition at line 333 of file tls.c.

                                               {
        struct tls_connection *tls =
                container_of ( refcnt, struct tls_connection, refcnt );
        struct tls_session *session = tls->session;
        struct io_buffer *iobuf;
        struct io_buffer *tmp;
 
        /* Free dynamically-allocated resources */
        zfree ( tls->new_session_ticket );
        tls_clear_cipher ( tls, &tls->tx.cipherspec.active );
        tls_clear_cipher ( tls, &tls->tx.cipherspec.pending );
        tls_clear_cipher ( tls, &tls->rx.cipherspec.active );
        tls_clear_cipher ( tls, &tls->rx.cipherspec.pending );
        tls_clear_digest ( tls );
        list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) {
                list_del ( &iobuf->list );
                free_iob ( iobuf );
        }
        free_iob ( tls->rx.handshake );
        privkey_put ( tls->client.key );
        x509_chain_put ( tls->client.chain );
        x509_chain_put ( tls->server.chain );
        x509_root_put ( tls->server.root );
 
        /* Drop reference to session */
        assert ( list_empty ( &tls->list ) );
        ref_put ( &session->refcnt );
 
        /* Free TLS structure itself */
        zfree ( tls );
}

References tls_cipherspec_pair::active, assert, tls_client::chain, tls_server::chain, tls_rx::cipherspec, tls_tx::cipherspec, tls_connection::client, container_of, tls_rx::data, free_iob(), tls_rx::handshake, tls_client::key, io_buffer::list, tls_connection::list, list_del, list_empty, list_for_each_entry_safe, tls_connection::new_session_ticket, tls_cipherspec_pair::pending, privkey_put(), ref_put, tls_session::refcnt, tls_server::root, tls_connection::rx, tls_connection::server, tls_connection::session, tls_clear_cipher(), tls_clear_digest(), tmp, tls_connection::tx, x509_chain_put(), x509_root_put(), and zfree().

Referenced by add_tls().

◆ tls_close()

void tls_close	(	struct tls_connection *	tls,
		int	rc )

static

Finish with TLS connection.

Parameters

tls	TLS connection
rc	Status code

Definition at line 371 of file tls.c.

                                                             {
 
        /* Remove pending operations, if applicable */
        pending_put ( &tls->client.negotiation );
        pending_put ( &tls->server.negotiation );
        pending_put ( &tls->server.validation );
 
        /* Remove process */
        process_del ( &tls->tx.process );
 
        /* Close all interfaces */
        intf_shutdown ( &tls->cipherstream, rc );
        intf_shutdown ( &tls->plainstream, rc );
        intf_shutdown ( &tls->server.validator, rc );
 
        /* Remove from session */
        list_del ( &tls->list );
        INIT_LIST_HEAD ( &tls->list );
 
        /* Destroy ephemeral master secret */
        tls_regenerate_ephemeral_master ( tls );
 
        /* Resume all other connections, in case we were the lead connection */
        tls_tx_resume_all ( tls->session );
}

References tls_connection::cipherstream, tls_connection::client, INIT_LIST_HEAD, intf_shutdown(), tls_connection::list, list_del, tls_client::negotiation, tls_server::negotiation, pending_put(), tls_connection::plainstream, tls_tx::process, process_del(), rc, tls_connection::server, tls_connection::session, tls_regenerate_ephemeral_master(), tls_tx_resume_all(), tls_connection::tx, tls_server::validation, and tls_server::validator.

Referenced by tls_close_alert(), and tls_new_alert().

◆ tls_close_alert()

void tls_close_alert	(	struct tls_connection *	tls,
		int	rc )

static

Send closure alert and finish with TLS connection.

Parameters

tls	TLS connection
rc	Status code

Definition at line 403 of file tls.c.

                                                                   {
 
        /* Send closure alert */
        tls_send_alert ( tls, TLS_ALERT_WARNING, TLS_ALERT_CLOSE_NOTIFY );
 
        /* Close connection */
        tls_close ( tls, rc );
}

References rc, TLS_ALERT_CLOSE_NOTIFY, TLS_ALERT_WARNING, tls_close(), and tls_send_alert().

Referenced by tls_cipherstream_deliver(), tls_tx_step(), and tls_validator_done().

◆ tls_generate_ephemeral_master()

int tls_generate_ephemeral_master ( struct tls_connection * tls )

static

Generate ephemeral master secret.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 425 of file tls.c.

                                                                        {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = &tls_ephemeral_algorithm;
        static const char salt[16] = "ephemeral master";
        int rc;
 
        /* Generate random bits with no additional input and without
         * prediction resistance
         */
        if ( ( rc = rbg_generate ( NULL, 0, 0, key->ephemeral,
                                   sizeof ( key->ephemeral ) ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not generate random data: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
 
        /* Generate ephemeral master secret */
        hkdf_extract ( digest, salt, sizeof ( salt ), key->ephemeral,
                       sizeof ( key->ephemeral ), key->ephemeral );
 
        return 0;
}

References DBGC, hkdf_extract(), key, tls_connection::key, NULL, rbg_generate(), rc, strerror(), and tls_ephemeral_algorithm.

Referenced by add_tls().

◆ tls_ephemeral()

void tls_ephemeral	(	struct tls_connection *	tls,
		const void *	info,
		size_t	info_len,
		void *	out,
		size_t	len )

static

Generate ephemeral secret.

Parameters

tls	TLS connection
info	Additional information (or NULL)
info_len	Length of additional information
out	Ephemeral secret to fill in
len	Length of ephemeral secret

Definition at line 457 of file tls.c.

                                                                     {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = &tls_ephemeral_algorithm;
 
        /* Generate from ephemeral master secret and additional information */
        hkdf_expand ( digest, key->ephemeral, info, info_len, out, len );
}

References hkdf_expand(), info, info_len, key, tls_connection::key, len, out, and tls_ephemeral_algorithm.

Referenced by tls_ephemeral_label(), and tls_send_record().

◆ tls_ephemeral_label()

void tls_ephemeral_label	(	struct tls_connection *	tls,
		const char *	label,
		void *	out,
		size_t	len )

static

Generate ephemeral secret from label.

Parameters

tls	TLS connection
label	Secret label
out	Ephemeral secret to fill in
len	Length of ephemeral secret

Definition at line 474 of file tls.c.

                                                                             {
 
        /* Generate from ephemeral master secret and label */
        tls_ephemeral ( tls, label, strlen ( label ), out, len );
        DBGC2 ( tls, "TLS %p ephemeral %s:\n", tls, label );
        DBGC2_HDA ( tls, 0, out, len );
}

References DBGC2, DBGC2_HDA, len, out, strlen(), and tls_ephemeral().

Referenced by tls_agree_ephemeral(), tls_regenerate_ephemeral_master(), tls_send_client_key_exchange_pubkey(), tls_session(), tls_set_digest(), and tls_share_ephemeral().

◆ tls_clear_binding()

void tls_clear_binding ( struct tls_connection * tls )

static

Clear key schedule binding.

Parameters

tls	TLS connection

Definition at line 505 of file tls.c.

                                                             {
        struct tls_key_schedule *key = &tls->key;
 
        /* Clear any existing binding */
        x509_put ( key->bound );
        key->bound = NULL;
}

References key, tls_connection::key, NULL, and x509_put().

Referenced by tls_agree_ephemeral(), tls_clear_digest(), tls_send_client_key_exchange_pubkey(), and tls_set_binding().

◆ tls_set_binding()

void tls_set_binding	(	struct tls_connection *	tls,
		struct x509_certificate *	cert )

static

Bind key schedule to a server identity.

Parameters

tls	TLS connection
cert	Server certificate

Definition at line 519 of file tls.c.

                                                              {
        struct tls_key_schedule *key = &tls->key;
 
        /* Clear any existing binding */
        tls_clear_binding ( tls );
 
        /* Refuse to bind an empty shared secret */
        if ( ! key->keyed ) {
                DBGC ( tls, "TLS %p refusing empty binding\n", tls );
                return;
        }
 
        /* Bind to new identity */
        key->bound = x509_get ( cert );
        DBGC ( tls, "TLS %p bound to %s\n", tls, x509_name ( cert ) );
}

References DBGC, key, tls_connection::key, tls_clear_binding(), x509_get(), and x509_name().

Referenced by tls_resume_secret(), tls_send_client_key_exchange_pubkey(), and tls_verify_dh_params().

◆ tls_set_digest()

int tls_set_digest	(	struct tls_connection *	tls,
		struct digest_algorithm *	digest )

static

Set key schedule digest algorithm.

Parameters

tls	TLS connection
digest	Key schedule digest algorithm

Return values

rc	Return status code

Definition at line 566 of file tls.c.

                                                              {
        struct tls_key_schedule *key = &tls->key;
        size_t kdfsize;
        size_t total;
        void *dynamic;
 
        /* Clear existing key schedule digest algorithm */
        tls_clear_digest ( tls );
 
        /* Allocate dynamic storage */
        if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
                kdfsize = hmac_keysize ( digest );
        } else {
                kdfsize = sizeof ( struct md5_sha1_hmac_keys );
        }
        total = ( digest->ctxsize + kdfsize );
        dynamic = zalloc ( total );
        if ( ! dynamic )
                return -ENOMEM;
 
        /* Assign storage */
        key->dynamic = dynamic;
        key->handshake = dynamic;               dynamic += digest->ctxsize;
        key->kdf = dynamic;                     dynamic += kdfsize;
        assert ( ( key->dynamic + total ) == dynamic );
 
        /* Store digest algorithm */
        key->digest = digest;
 
        /* Initialise handshake context */
        digest_init ( digest, key->handshake );
 
        /* Poison key derivation function master secret */
        tls_ephemeral_label ( tls, "kdf poison", key->kdf, kdfsize );
 
        /* Sanity checks */
        assert ( ! key->keyed );
        assert ( ! key->bound );
 
        return 0;
}

References assert, digest_algorithm::ctxsize, tls_key_schedule::digest, digest_init(), tls_key_schedule::dynamic, ENOMEM, hmac_keysize(), key, tls_connection::key, tls_clear_digest(), tls_ephemeral_label(), tls_version(), TLS_VERSION_TLS_1_2, and zalloc().

Referenced by tls_select_cipher().

◆ tls_hmac_update_va()

void tls_hmac_update_va	(	struct digest_algorithm *	digest,
		void *	ctx,
		va_list	args )

static

Update HMAC with a list of ( data, len ) pairs.

Parameters

digest	Hash function to use
ctx	HMAC context
args	( data, len ) pairs of data, terminated by NULL

Definition at line 616 of file tls.c.

                                                           {
        void *data;
        size_t len;
 
        while ( ( data = va_arg ( args, void * ) ) ) {
                len = va_arg ( args, size_t );
                hmac_update ( digest, ctx, data, len );
        }
}

References ctx, data, hmac_update(), len, and va_arg.

Referenced by tls_p_hash_va().

◆ tls_p_hash_va()

void tls_p_hash_va	(	struct tls_connection *	tls,
		struct digest_algorithm *	digest,
		const void *	hkey,
		void *	out,
		size_t	out_len,
		va_list	seeds )

static

Generate secure pseudo-random data using a single hash function.

Parameters

tls	TLS connection
digest	Hash function to use
hkey	HMAC key
out	Output buffer
out_len	Length of output buffer
seeds	( data, len ) pairs of seed data, terminated by NULL

Definition at line 637 of file tls.c.

                                                                       {
        uint8_t ctx[ hmac_ctxsize ( digest ) ];
        uint8_t ctx_partial[ sizeof ( ctx ) ];
        uint8_t a[digest->digestsize];
        uint8_t out_tmp[digest->digestsize];
        size_t frag_len = digest->digestsize;
        va_list tmp;
 
        /* Calculate A(1) */
        hmac_init_key ( digest, ctx, hkey );
        va_copy ( tmp, seeds );
        tls_hmac_update_va ( digest, ctx, tmp );
        va_end ( tmp );
        hmac_final ( digest, ctx, a );
        DBGC2 ( tls, "TLS %p %s A(1):\n", tls, digest->name );
        DBGC2_HD ( tls, &a, sizeof ( a ) );
 
        /* Generate as much data as required */
        while ( out_len ) {
 
                /* Calculate output portion */
                hmac_init_key ( digest, ctx, hkey );
                hmac_update ( digest, ctx, a, sizeof ( a ) );
                memcpy ( ctx_partial, ctx, sizeof ( ctx_partial ) );
                va_copy ( tmp, seeds );
                tls_hmac_update_va ( digest, ctx, tmp );
                va_end ( tmp );
                hmac_final ( digest, ctx, out_tmp );
 
                /* Copy output */
                if ( frag_len > out_len )
                        frag_len = out_len;
                memcpy ( out, out_tmp, frag_len );
                DBGC2 ( tls, "TLS %p %s output:\n", tls, digest->name );
                DBGC2_HD ( tls, out, frag_len );
 
                /* Calculate A(i) */
                hmac_final ( digest, ctx_partial, a );
                DBGC2 ( tls, "TLS %p %s A(n):\n", tls, digest->name );
                DBGC2_HD ( tls, &a, sizeof ( a ) );
 
                out += frag_len;
                out_len -= frag_len;
        }
}

References ctx, DBGC2, DBGC2_HD, digest_algorithm::digestsize, hmac_ctxsize(), hmac_final(), hmac_init_key(), hmac_update(), memcpy(), digest_algorithm::name, out, tls_hmac_update_va(), tmp, va_copy, and va_end.

Referenced by tls_prf().

◆ tls_prf()

void tls_prf	(	struct tls_connection *	tls,
		void *	out,
		size_t	out_len,
			... )

static

Generate secure pseudo-random data.

Parameters

tls	TLS connection
out	Output buffer
out_len	Length of output buffer
...	( data, len ) pairs of seed data, terminated by NULL

Definition at line 693 of file tls.c.

                                            {
        struct tls_key_schedule *key = &tls->key;
        struct md5_sha1_hmac_keys *hkeys;
        va_list seeds;
        va_list tmp;
        uint8_t buf[out_len];
        unsigned int i;
 
        va_start ( seeds, out_len );
 
        if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
 
                /* Use P_Hash for TLSv1.2 and later */
                tls_p_hash_va ( tls, key->digest, key->kdf,
                                out, out_len, seeds );
 
        } else {
 
                /* Use combination of P_MD5 and P_SHA-1 for TLSv1.1
                 * and earlier
                 */
                hkeys = key->kdf;
 
                /* Calculate MD5 portion */
                va_copy ( tmp, seeds );
                tls_p_hash_va ( tls, &md5_algorithm, hkeys->md5,
                                out, out_len, seeds );
                va_end ( tmp );
 
                /* Calculate SHA1 portion */
                va_copy ( tmp, seeds );
                tls_p_hash_va ( tls, &sha1_algorithm, hkeys->sha1,
                                buf, out_len, seeds );
                va_end ( tmp );
 
                /* XOR the two portions together into the final output buffer */
                for ( i = 0 ; i < out_len ; i++ )
                        *( ( uint8_t * ) out + i ) ^= buf[i];
        }
 
        va_end ( seeds );
}

References key, tls_connection::key, md5_sha1_hmac_keys::md5, md5_algorithm, out, md5_sha1_hmac_keys::sha1, sha1_algorithm, tls_p_hash_va(), tls_version(), TLS_VERSION_TLS_1_2, tmp, va_copy, va_end, and va_start.

◆ tls_set_kdf_master()

void tls_set_kdf_master	(	struct tls_connection *	tls,
		const void *	secret,
		size_t	secret_len )

static

Set key derivation function master secret.

Parameters

tls	TLS connection
secret	Secret
secret_len	Length of secret

Definition at line 757 of file tls.c.

                                                                         {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = key->digest;
        uint8_t ctx[ hmac_ctxsize ( digest ) ];
        struct md5_sha1_hmac_keys *hkeys;
        size_t subsecret_len;
        const void *md5_secret;
        const void *sha1_secret;
 
        DBGC2 ( tls, "TLS %p KDF secret:\n", tls );
        DBGC2_HD ( tls, secret, secret_len );
 
        if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
 
                /* Set HMAC key for TLSv1.2 and later */
                hmac_key ( digest, ctx, secret, secret_len, key->kdf );
 
        } else {
 
                /* Set MD5+SHA1 HMAC keys for TLSv1.1 and earlier */
                hkeys = key->kdf;
                assert ( key->digest == &md5_sha1_algorithm );
                assert ( sizeof ( ctx ) >= hmac_ctxsize ( &md5_algorithm ) );
                assert ( sizeof ( ctx ) >= hmac_ctxsize ( &sha1_algorithm ) );
 
                /* Split secret into two, with an overlap of up to one byte */
                subsecret_len = ( ( secret_len + 1 ) / 2 );
                md5_secret = secret;
                sha1_secret = ( secret + secret_len - subsecret_len );
 
                /* Set MD5 and SHA-1 HMAC keys */
                hmac_key ( &md5_algorithm, ctx, md5_secret, subsecret_len,
                           hkeys->md5 );
                hmac_key ( &sha1_algorithm, ctx, sha1_secret, subsecret_len,
                           hkeys->sha1 );
        }
}

References assert, ctx, DBGC2, DBGC2_HD, hmac_ctxsize(), hmac_key(), key, tls_connection::key, md5_sha1_hmac_keys::md5, md5_algorithm, md5_sha1_algorithm, md5_sha1_hmac_keys::sha1, sha1_algorithm, tls_version(), and TLS_VERSION_TLS_1_2.

Referenced by tls_agree_ephemeral(), tls_generate_master_secret(), tls_resume_secret(), and tls_send_client_key_exchange_pubkey().

◆ tls_share_ephemeral()

int tls_share_ephemeral	(	struct tls_connection *	tls,
		void *	public )

static

Share ephemeral public key.

Parameters

tls	TLS connection
public	Public key to fill in

Return values

rc	Return status code

Definition at line 803 of file tls.c.

                                                                            {
        struct tls_key_schedule *key = &tls->key;
        struct tls_named_group *group = key->group;
        struct exchange_algorithm *exchange = group->exchange;
        size_t privsize = exchange->privsize;
        struct {
                uint8_t private[privsize];
        } tmp;
        int rc;
 
        /* (Re)generate ephemeral private key */
        tls_ephemeral_label ( tls, exchange->name, tmp.private, privsize );
 
        /* Derive public key */
        if ( ( rc = exchange_share ( exchange, tmp.private, public ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not share ephemeral key: %s\n",
                       tls, strerror ( rc ) );
                goto err_share;
        }
 
 err_share:
        memset ( &tmp, 0, sizeof ( tmp ) );
        return rc;
}

References DBGC, exchange_share(), group, key, tls_connection::key, memset(), exchange_algorithm::name, exchange_algorithm::privsize, rc, strerror(), tls_ephemeral_label(), and tmp.

Referenced by tls_send_client_key_exchange_dhe(), and tls_send_client_key_exchange_ecdhe().

◆ tls_agree_ephemeral()

int tls_agree_ephemeral	(	struct tls_connection *	tls,
		const void *	partner,
		size_t	partner_len,
		int	strip )

static

Agree ephemeral public key (i.e.

pre-master secret)

Parameters

tls	TLS connection
partner	Partner public key
partner_len	Length of partner public key
strip	Strip/pad leading zeros

Return values

rc	Return status code

Definition at line 837 of file tls.c.

                                             {
        struct tls_key_schedule *key = &tls->key;
        struct tls_named_group *group = key->group;
        struct exchange_algorithm *exchange = group->exchange;
        size_t privsize = exchange->privsize;
        size_t pubsize = exchange->pubsize;
        size_t sharedsize = exchange->sharedsize;
        struct {
                uint8_t private[privsize];
                uint8_t partner[pubsize];
                uint8_t shared[sharedsize];
        } *tmp;
        size_t pad_len;
        size_t shared_len;
        uint8_t *shared;
        int rc;
 
        /* Allocate working space */
        tmp = zalloc ( sizeof ( *tmp ) );
        if ( ! tmp ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
 
        /* (Re)generate ephemeral private key */
        tls_ephemeral_label ( tls, exchange->name, tmp->private, privsize );
 
        /* Zero-pad partner key if needed */
        if ( partner_len > pubsize ) {
                DBGC ( tls, "TLS %p partner key too long:\n", tls );
                DBGC_HDA ( tls, 0, partner, partner_len );
                rc = -EINVAL_KEY_EXCHANGE;
                goto err_partner_len;
        }
        pad_len = ( pubsize - partner_len );
        if ( pad_len && ( ! strip ) ) {
                DBGC ( tls, "TLS %p partner key too short:\n", tls );
                DBGC_HDA ( tls, 0, partner, partner_len );
                rc = -EINVAL_KEY_EXCHANGE;
                goto err_partner_len;
        }
        memcpy ( ( tmp->partner + pad_len ), partner, partner_len );
 
        /* Agree shared secret */
        if ( ( rc = exchange_agree ( exchange, tmp->private, tmp->partner,
                                     tmp->shared ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not agree shared key: %s\n",
                       tls, strerror ( rc ) );
                goto err_agree;
        }
 
        /* Strip leading zeros if needed */
        shared = tmp->shared;
        shared_len = sharedsize;
        while ( strip && shared_len && ( ! *shared ) ) {
                shared++;
                shared_len--;
        }
 
        /* Set key derivation function secret to the shared secret */
        DBGC ( tls, "TLS %p pre-master secret:\n", tls );
        DBGC_HDA ( tls, 0, shared, shared_len );
        tls_set_kdf_master ( tls, shared, shared_len );
 
        /* Key derivation function secret has been overwritten with a
         * value that was not derived from its previous value, and so
         * is no longer bound to the server's identity.
         */
        tls_clear_binding ( tls );
 
        /* Key schedule now contains shared secret key material */
        key->keyed = 1;
 
 err_agree:
 err_partner_len:
        memset ( tmp, 0, sizeof ( *tmp ) );
        zfree ( tmp );
 err_alloc:
        return rc;
}

References DBGC, DBGC_HDA, EINVAL_KEY_EXCHANGE, ENOMEM, exchange_agree(), group, key, tls_connection::key, memcpy(), memset(), exchange_algorithm::name, partner, exchange_algorithm::privsize, exchange_algorithm::pubsize, rc, exchange_algorithm::sharedsize, strerror(), tls_clear_binding(), tls_ephemeral_label(), tls_set_kdf_master(), tmp, zalloc(), and zfree().

Referenced by tls_new_server_key_exchange_dhe(), and tls_new_server_key_exchange_ecdhe().

◆ tls_generate_master_secret()

void tls_generate_master_secret ( struct tls_connection * tls )

static

Generate master secret.

Parameters

tls	TLS connection

The client and server random values must already be known.

Definition at line 927 of file tls.c.

                                                                      {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = key->digest;
        uint8_t digest_out[ digest->digestsize ];
        uint8_t master_secret[48];
 
        /* Sanity checks */
        assert ( key->keyed );
        assert ( key->bound );
 
        /* Generate handshake digest */
        tls_verify_handshake ( tls, digest_out );
 
        /* Show inputs */
        DBGC ( tls, "TLS %p client random bytes:\n", tls );
        DBGC_HD ( tls, &tls->client.random, sizeof ( tls->client.random ) );
        DBGC ( tls, "TLS %p server random bytes:\n", tls );
        DBGC_HD ( tls, &tls->server.random, sizeof ( tls->server.random ) );
        DBGC ( tls, "TLS %p session hash:\n", tls );
        DBGC_HD ( tls, digest_out, sizeof ( digest_out ) );
 
        /* Generate master secret */
        if ( tls->extended_master_secret ) {
                tls_prf_label ( tls, master_secret, sizeof ( master_secret ),
                                "extended master secret",
                                digest_out, sizeof ( digest_out ) );
        } else {
                tls_prf_label ( tls, master_secret, sizeof ( master_secret ),
                                "master secret",
                                &tls->client.random,
                                sizeof ( tls->client.random ),
                                &tls->server.random,
                                sizeof ( tls->server.random ) );
        }
 
        /* Show output */
        DBGC ( tls, "TLS %p generated %smaster secret:\n", tls,
               ( tls->extended_master_secret ? "extended ": "" ) );
        DBGC_HD ( tls, master_secret, sizeof ( master_secret ) );
 
        /* Set key derivation function secret to the master secret */
        tls_set_kdf_master ( tls, master_secret, sizeof ( master_secret ) );
}

References assert, tls_connection::client, DBGC, DBGC_HD, digest_algorithm::digestsize, tls_connection::extended_master_secret, key, tls_connection::key, tls_client::random, tls_server::random, tls_connection::server, tls_prf_label, tls_set_kdf_master(), and tls_verify_handshake().

Referenced by tls_send_client_key_exchange().

◆ tls_generate_keys()

int tls_generate_keys ( struct tls_connection * tls )

static

Generate key material.

Parameters

tls	TLS connection

The master secret must already be known.

Definition at line 978 of file tls.c.

                                                            {
        struct tls_cipherspec *tx_cipherspec = &tls->tx.cipherspec.pending;
        struct tls_cipherspec *rx_cipherspec = &tls->rx.cipherspec.pending;
        size_t hash_size = tx_cipherspec->suite->mac_len;
        size_t key_size = tx_cipherspec->suite->key_len;
        size_t iv_size = tx_cipherspec->suite->fixed_iv_len;
        size_t total = ( 2 * ( hash_size + key_size + iv_size ) );
        uint8_t key_block[total];
        uint8_t *key;
        int rc;
 
        /* Sanity checks */
        assert ( tls->key.keyed );
        assert ( tls->key.bound );
 
        /* Generate key block */
        tls_prf_label ( tls, key_block, sizeof ( key_block ), "key expansion",
                        &tls->server.random, sizeof ( tls->server.random ),
                        &tls->client.random, sizeof ( tls->client.random ) );
 
        /* Split key block into portions */
        key = key_block;
 
        /* TX MAC secret */
        memcpy ( tx_cipherspec->mac_secret, key, hash_size );
        DBGC ( tls, "TLS %p TX MAC secret:\n", tls );
        DBGC_HD ( tls, key, hash_size );
        key += hash_size;
 
        /* RX MAC secret */
        memcpy ( rx_cipherspec->mac_secret, key, hash_size );
        DBGC ( tls, "TLS %p RX MAC secret:\n", tls );
        DBGC_HD ( tls, key, hash_size );
        key += hash_size;
 
        /* TX key */
        if ( ( rc = cipher_setkey ( tx_cipherspec->suite->cipher,
                                    tx_cipherspec->cipher_ctx,
                                    key, key_size ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not set TX key: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
        DBGC ( tls, "TLS %p TX key:\n", tls );
        DBGC_HD ( tls, key, key_size );
        key += key_size;
 
        /* RX key */
        if ( ( rc = cipher_setkey ( rx_cipherspec->suite->cipher,
                                    rx_cipherspec->cipher_ctx,
                                    key, key_size ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not set TX key: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
        DBGC ( tls, "TLS %p RX key:\n", tls );
        DBGC_HD ( tls, key, key_size );
        key += key_size;
 
        /* TX initialisation vector */
        memcpy ( tx_cipherspec->fixed_iv, key, iv_size );
        DBGC ( tls, "TLS %p TX IV:\n", tls );
        DBGC_HD ( tls, key, iv_size );
        key += iv_size;
 
        /* RX initialisation vector */
        memcpy ( rx_cipherspec->fixed_iv, key, iv_size );
        DBGC ( tls, "TLS %p RX IV:\n", tls );
        DBGC_HD ( tls, key, iv_size );
        key += iv_size;
 
        assert ( ( key_block + total ) == key );
 
        return 0;
}

References assert, tls_key_schedule::bound, tls_cipher_suite::cipher, tls_cipherspec::cipher_ctx, cipher_setkey(), tls_rx::cipherspec, tls_tx::cipherspec, tls_connection::client, DBGC, DBGC_HD, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, key, tls_connection::key, tls_cipher_suite::key_len, tls_key_schedule::keyed, tls_cipher_suite::mac_len, tls_cipherspec::mac_secret, memcpy(), tls_cipherspec_pair::pending, tls_client::random, tls_server::random, rc, tls_connection::rx, tls_connection::server, strerror(), tls_cipherspec::suite, tls_prf_label, and tls_connection::tx.

Referenced by tls_new_server_hello(), and tls_send_client_key_exchange().

◆ tls_generate_resumption_master()

void tls_generate_resumption_master ( struct tls_connection * tls )

static

Generate resumption master secret.

Parameters

tls	TLS connection

Definition at line 1059 of file tls.c.

                                                                          {
        struct tls_session *session = tls->session;
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = key->digest;
        struct md5_sha1_hmac_keys *hkeys;
        union {
                uint8_t opaque[48];
                struct {
                        uint8_t md5[24];
                        uint8_t sha1[24];
                } __attribute__ (( packed ));
        } *secret;
 
        /* Sanity checks */
        assert ( key->keyed );
        assert ( key->bound );
        assert ( x509_is_valid ( key->bound, tls->server.root ) );
        assert ( sizeof ( *secret ) <=
                 sizeof ( session->resumption_master_secret ) );
        secret = ( ( void * ) session->resumption_master_secret );
 
        if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
 
                /* For TLSv1.2, the pre-master secret may be any
                 * length but the master secret is fixed at 48 bytes.
                 * This is smaller than the block size for all
                 * supported digest algorithms.  The HMAC key
                 * constructed from the master secret will therefore
                 * be just the zero-padded master secret value.  We
                 * can therefore preserve just these first 48 bytes of
                 * the KDF master secret (ignoring the zero padding up
                 * to the digest block size).
                 */
                assert ( sizeof ( *secret ) <= hmac_keysize ( digest ) );
                memcpy ( secret, key->kdf, sizeof ( *secret ) );
                session->resumption_master_secret_len = sizeof ( *secret );
 
        } else {
 
                /* For TLSv1.1 and earlier, the master secret is again
                 * fixed at 48 bytes, but will be split as 24 bytes in
                 * each of the MD5 and SHA-1 HMAC keys.
                 */
                assert ( key->digest == &md5_sha1_algorithm );
                assert ( sizeof ( secret->md5 ) <=
                         hmac_keysize ( &md5_algorithm ) );
                assert ( sizeof ( secret->sha1 ) <=
                         hmac_keysize ( &sha1_algorithm ) );
                hkeys = key->kdf;
                memcpy ( secret->md5, hkeys->md5, sizeof ( secret->md5 ) );
                memcpy ( secret->sha1, hkeys->sha1, sizeof ( secret->sha1 ) );
                session->resumption_master_secret_len = sizeof ( *secret );
        }
}

References __attribute__, assert, hmac_keysize(), key, tls_connection::key, md5_sha1_hmac_keys::md5, md5_algorithm, md5_sha1_algorithm, memcpy(), tls_session::resumption_master_secret, tls_session::resumption_master_secret_len, tls_server::root, tls_connection::server, tls_connection::session, md5_sha1_hmac_keys::sha1, sha1_algorithm, tls_version(), TLS_VERSION_TLS_1_2, and x509_is_valid().

Referenced by tls_new_finished().

◆ tls_resume_secret()

void tls_resume_secret ( struct tls_connection * tls )

static

Resume from resumption master secret.

Parameters

tls	TLS connection

Definition at line 1119 of file tls.c.

                                                             {
        struct tls_session *session = tls->session;
        struct tls_key_schedule *key = &tls->key;
        size_t len = session->resumption_master_secret_len;
 
        /* For TLSv1.2 and earlier, the resumption master secret is
         * just the original master secret value.
         */
        tls_set_kdf_master ( tls, session->resumption_master_secret, len );
 
        /* If the resumption master secret was non-empty, then the key
         * schedule now contains a shared secret that is already bound
         * to the server's identity.
         *
         * If the resumption master secret was empty (which should not
         * be possible if this function is called), then the key
         * schedule no longer contains any shared secret.
         */
        assert ( len );
        key->keyed = len;
        tls_set_binding ( tls, session->cert );
}

References assert, tls_session::cert, key, tls_connection::key, len, tls_session::resumption_master_secret, tls_session::resumption_master_secret_len, tls_connection::session, tls_set_binding(), and tls_set_kdf_master().

Referenced by tls_new_server_hello().

◆ tls_add_handshake()

int tls_add_handshake	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Add handshake record to verification hash.

Parameters

tls	TLS connection
data	Handshake record
len	Length of handshake record

Return values

rc	Return status code

Definition at line 1157 of file tls.c.

                                                              {
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = key->digest;
 
        digest_update ( digest, key->handshake, data, len );
        return 0;
}

References data, digest_update(), key, tls_connection::key, and len.

Referenced by tls_new_handshake(), tls_new_server_hello(), and tls_send_record().

◆ tls_find_cipher_suite()

struct tls_cipher_suite * tls_find_cipher_suite ( unsigned int cipher_suite )

static

Identify cipher suite.

Parameters

cipher_suite Cipher suite specification

Return values

suite Cipher suite, or NULL

Definition at line 1208 of file tls.c.

                                                    {
        struct tls_cipher_suite *suite;
 
        /* Identify cipher suite */
        for_each_table_entry ( suite, TLS_CIPHER_SUITES ) {
                if ( suite->code == cipher_suite )
                        return suite;
        }
 
        return NULL;
}

References tls_cipher_suite::code, for_each_table_entry, NULL, and TLS_CIPHER_SUITES.

Referenced by tls_select_cipher().

◆ tls_clear_cipher() [2/2]

void tls_clear_cipher	(	struct tls_connection *tls	__unused,
		struct tls_cipherspec *	cipherspec )

static

Clear cipher suite.

Parameters

cipherspec TLS cipher specification

Definition at line 1225 of file tls.c.

                                                                   {
 
        zfree ( cipherspec->dynamic );
        memset ( cipherspec, 0, sizeof ( *cipherspec ) );
        cipherspec->suite = &tls_cipher_suite_null;
}

References __unused, tls_cipherspec::dynamic, memset(), tls_cipherspec::suite, tls_cipher_suite_null, and zfree().

◆ tls_set_cipher()

int tls_set_cipher	(	struct tls_connection *	tls,
		struct tls_cipherspec *	cipherspec,
		struct tls_cipher_suite *	suite )

static

Set cipher suite.

Parameters

tls	TLS connection
cipherspec	TLS cipher specification
suite	Cipher suite

Return values

rc	Return status code

Definition at line 1241 of file tls.c.

                                                             {
        struct cipher_algorithm *cipher = suite->cipher;
        size_t total;
        void *dynamic;
 
        /* Clear out old cipher contents, if any */
        tls_clear_cipher ( tls, cipherspec );
 
        /* Allocate dynamic storage */
        total = ( cipher->ctxsize + suite->mac_len + suite->fixed_iv_len );
        dynamic = zalloc ( total );
        if ( ! dynamic ) {
                DBGC ( tls, "TLS %p could not allocate %zd bytes for crypto "
                       "context\n", tls, total );
                return -ENOMEM_CONTEXT;
        }
 
        /* Assign storage */
        cipherspec->dynamic = dynamic;
        cipherspec->cipher_ctx = dynamic;       dynamic += cipher->ctxsize;
        cipherspec->mac_secret = dynamic;       dynamic += suite->mac_len;
        cipherspec->fixed_iv = dynamic;         dynamic += suite->fixed_iv_len;
        assert ( ( cipherspec->dynamic + total ) == dynamic );
 
        /* Store parameters */
        cipherspec->suite = suite;
 
        return 0;
}

References assert, tls_cipher_suite::cipher, tls_cipherspec::cipher_ctx, cipher_algorithm::ctxsize, DBGC, tls_cipherspec::dynamic, ENOMEM_CONTEXT, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, tls_cipher_suite::mac_len, tls_cipherspec::mac_secret, tls_cipherspec::suite, tls_clear_cipher(), and zalloc().

Referenced by tls_select_cipher().

◆ tls_select_cipher()

int tls_select_cipher	(	struct tls_connection *	tls,
		unsigned int	cipher_suite )

static

Select next cipher suite.

Parameters

tls	TLS connection
cipher_suite	Cipher suite specification

Return values

rc	Return status code

Definition at line 1280 of file tls.c.

                                                           {
        struct tls_cipher_suite *suite;
        struct digest_algorithm *digest;
        int rc;
 
        /* Identify cipher suite */
        suite = tls_find_cipher_suite ( cipher_suite );
        if ( ! suite ) {
                DBGC ( tls, "TLS %p does not support cipher %04x\n",
                       tls, ntohs ( cipher_suite ) );
                return -ENOTSUP_CIPHER;
        }
 
        /* Set key schedule digest algorithm */
        digest = ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ?
                   suite->handshake : &md5_sha1_algorithm );
        if ( ( rc = tls_set_digest ( tls, digest ) ) != 0 )
                return rc;
 
        /* Set ciphers */
        if ( ( rc = tls_set_cipher ( tls, &tls->tx.cipherspec.pending,
                                     suite ) ) != 0 )
                return rc;
        if ( ( rc = tls_set_cipher ( tls, &tls->rx.cipherspec.pending,
                                     suite ) ) != 0 )
                return rc;
 
        DBGC ( tls, "TLS %p selected %s-%s-%s-%d-%s\n", tls,
               suite->exchange->name, suite->pubkey->name,
               suite->cipher->name, ( suite->key_len * 8 ),
               suite->digest->name );
 
        return 0;
}

References tls_cipher_suite::cipher, tls_rx::cipherspec, tls_tx::cipherspec, DBGC, tls_cipher_suite::digest, ENOTSUP_CIPHER, tls_cipher_suite::exchange, tls_cipher_suite::handshake, tls_cipher_suite::key_len, md5_sha1_algorithm, cipher_algorithm::name, digest_algorithm::name, pubkey_algorithm::name, tls_key_exchange_algorithm::name, ntohs, tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, rc, tls_connection::rx, tls_find_cipher_suite(), tls_set_cipher(), tls_set_digest(), tls_version(), TLS_VERSION_TLS_1_2, and tls_connection::tx.

Referenced by tls_new_server_hello().

◆ tls_change_cipher()

int tls_change_cipher	(	struct tls_connection *	tls,
		struct tls_cipherspec_pair *	pair )

static

Activate next cipher suite.

Parameters

tls	TLS connection
pair	Cipher specification pair

Return values

rc	Return status code

Definition at line 1323 of file tls.c.

                                                                  {
 
        /* Sanity check */
        if ( pair->pending.suite == &tls_cipher_suite_null ) {
                DBGC ( tls, "TLS %p refusing to use null cipher\n", tls );
                return -ENOTSUP_NULL;
        }
 
        tls_clear_cipher ( tls, &pair->active );
        memswap ( &pair->active, &pair->pending, sizeof ( pair->active ) );
        return 0;
}

References tls_cipherspec_pair::active, DBGC, ENOTSUP_NULL, memswap(), tls_cipherspec_pair::pending, tls_cipherspec::suite, tls_cipher_suite_null, and tls_clear_cipher().

Referenced by tls_new_change_cipher(), and tls_tx_step().

◆ tls_signature_hash_algorithm()

struct tls_signature_hash_algorithm * tls_signature_hash_algorithm	(	struct pubkey_algorithm *	pubkey,
		struct digest_algorithm *	digest )

static

Find TLS signature and hash algorithm.

Parameters

pubkey	Public-key algorithm
digest	Digest algorithm

Return values

sig_hash Signature and hash algorithm, or NULL

Definition at line 1356 of file tls.c.

                                                                 {
        struct tls_signature_hash_algorithm *sig_hash;
 
        /* Identify signature and hash algorithm */
        for_each_table_entry ( sig_hash, TLS_SIG_HASH_ALGORITHMS ) {
                if ( ( sig_hash->pubkey == pubkey ) &&
                     ( sig_hash->digest == digest ) ) {
                        return sig_hash;
                }
        }
 
        return NULL;
}

References tls_signature_hash_algorithm::digest, for_each_table_entry, NULL, tls_signature_hash_algorithm::pubkey, and TLS_SIG_HASH_ALGORITHMS.

Referenced by tls_send_certificate_verify().

◆ tls_find_signature_hash()

struct tls_signature_hash_algorithm * tls_find_signature_hash ( unsigned int code )

static

Find TLS signature and hash algorithm.

Parameters

code	Signature and hash algorithm identifier

Return values

sig_hash Signature and hash algorithm, or NULL

Definition at line 1378 of file tls.c.

                                              {
        struct tls_signature_hash_algorithm *sig_hash;
 
        /* Identify signature and hash algorithm */
        for_each_table_entry ( sig_hash, TLS_SIG_HASH_ALGORITHMS ) {
                if ( sig_hash->code == code )
                        return sig_hash;
        }
 
        return NULL;
}

References code, tls_signature_hash_algorithm::code, for_each_table_entry, NULL, and TLS_SIG_HASH_ALGORITHMS.

Referenced by tls_verify_dh_params().

◆ tls_find_named_group()

struct tls_named_group * tls_find_named_group ( unsigned int named_group )

static

Identify named key exchange group.

Parameters

named_group Named group specification

Return values

group Named group, or NULL

Definition at line 1404 of file tls.c.

                                                  {
        struct tls_named_group *group;
 
        /* Identify named group */
        for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
                if ( group->code && ( group->code == named_group ) )
                        return group;
        }
 
        return NULL;
}

References for_each_table_entry, group, NULL, and TLS_NAMED_GROUPS.

Referenced by tls_new_server_key_exchange_ecdhe().

◆ tls_find_param_group()

struct tls_named_group * tls_find_param_group	(	const void *	dh_p,
		size_t	dh_p_len,
		const void *	dh_g,
		size_t	dh_g_len )

static

Identify named key exchange group by Diffie-Hellman parameters.

Parameters

dh_p	Prime modulus
dh_p_len	Length of prime modulus
dh_g	Generator
dh_g_len	Length of generator

Return values

group Named group, or NULL

Definition at line 1426 of file tls.c.

                                         {
        struct tls_named_group *group;
 
        /* Identify named group by parameters */
        for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
                if ( is_ffdhe ( group->exchange ) &&
                     ffdhe_has_params ( group->exchange, dh_p, dh_p_len,
                                        dh_g, dh_g_len ) ) {
                        return group;
                }
        }
 
        return NULL;
}

References ffdhe_has_params(), for_each_table_entry, group, is_ffdhe(), NULL, and TLS_NAMED_GROUPS.

Referenced by tls_new_server_key_exchange_dhe().

◆ tls_verify_dh_params()

int tls_verify_dh_params	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len,
		size_t	param_len )

static

Verify Diffie-Hellman parameter signature.

Parameters

tls	TLS connection
data	Server Key Exchange handshake record
len	Length of Server Key Exchange handshake record
param_len	Length of Diffie-Hellman parameters

Return values

rc	Return status code

Definition at line 1451 of file tls.c.

                                                                 {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
        struct tls_signature_hash_algorithm *sig_hash;
        struct x509_certificate *cert;
        struct pubkey_algorithm *pubkey;
        struct digest_algorithm *digest;
        int use_sig_hash = tls_version ( tls, TLS_VERSION_TLS_1_2 );
        const struct {
                uint16_t sig_hash[use_sig_hash];
                uint16_t signature_len;
                uint8_t signature[0];
        } __attribute__ (( packed )) *sig;
        struct asn1_cursor signature;
        size_t remaining;
        int rc;
 
        /* Identify server certificate */
        cert = x509_first ( tls->server.chain );
        if ( ! cert ) {
                DBGC ( tls, "TLS %p has no server certificate\n", tls );
                return -ENOENT_CERT;
        }
 
        /* Signature follows parameters */
        assert ( param_len <= len );
        sig = ( data + param_len );
        remaining = ( len - param_len );
 
        /* Parse signature from ServerKeyExchange */
        if ( ( sizeof ( *sig ) > remaining ) ||
             ( ntohs ( sig->signature_len ) > ( remaining -
                                                sizeof ( *sig ) ) ) ) {
                DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n",
                       tls );
                DBGC_HDA ( tls, 0, data, len );
                return -EINVAL_KEY_EXCHANGE;
        }
        signature.data = sig->signature;
        signature.len = ntohs ( sig->signature_len );
 
        /* Identify signature and hash algorithm */
        if ( use_sig_hash ) {
                sig_hash = tls_find_signature_hash ( sig->sig_hash[0] );
                if ( ! sig_hash ) {
                        DBGC ( tls, "TLS %p unsupported signature hash "
                               "%#04x\n", tls, sig->sig_hash[0] );
                        return -ENOTSUP_SIG_HASH;
                }
                pubkey = sig_hash->pubkey;
                digest = sig_hash->digest;
                DBGC ( tls, "TLS %p using signature hash %s-%s\n",
                       tls, pubkey->name, digest->name );
                if ( sig_hash->algorithm !=
                     cert->subject.public_key.algorithm ) {
                        DBGC ( tls, "TLS %p cannot use %s public key\n", tls,
                               cert->subject.public_key.algorithm->name );
                        return -EPERM_KEY_EXCHANGE;
                }
        } else {
                pubkey = cipherspec->suite->pubkey;
                digest = &md5_sha1_algorithm;
        }
 
        /* Verify signature */
        {
                uint8_t ctx[digest->ctxsize];
                uint8_t hash[digest->digestsize];
 
                /* Calculate digest */
                digest_init ( digest, ctx );
                digest_update ( digest, ctx, &tls->client.random,
                                sizeof ( tls->client.random ) );
                digest_update ( digest, ctx, tls->server.random,
                                sizeof ( tls->server.random ) );
                digest_update ( digest, ctx, data, param_len );
                digest_final ( digest, ctx, hash );
 
                /* Verify signature */
                if ( ( rc = pubkey_verify ( pubkey,
                                            &cert->subject.public_key.raw,
                                            digest, hash,
                                            &signature ) ) != 0 ) {
                        DBGC ( tls, "TLS %p ServerKeyExchange failed "
                               "verification\n", tls );
                        DBGC_HDA ( tls, 0, data, len );
                        return -EPERM_KEY_EXCHANGE;
                }
        }
 
        /* The verified signature indicates the server's intention to
         * delegate authority to the shared secret key material.  The
         * shared secret is therefore bound to the server's identity.
         */
        tls_set_binding ( tls, cert );
 
        return 0;
}

References __attribute__, tls_signature_hash_algorithm::algorithm, x509_public_key::algorithm, assert, tls_server::chain, tls_tx::cipherspec, tls_connection::client, ctx, digest_algorithm::ctxsize, data, DBGC, DBGC_HDA, tls_signature_hash_algorithm::digest, digest_final(), digest_init(), digest_update(), digest_algorithm::digestsize, EINVAL_KEY_EXCHANGE, ENOENT_CERT, ENOTSUP_SIG_HASH, EPERM_KEY_EXCHANGE, hash, len, md5_sha1_algorithm, asn1_algorithm::name, digest_algorithm::name, pubkey_algorithm::name, ntohs, tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, tls_signature_hash_algorithm::pubkey, pubkey_verify(), x509_subject::public_key, tls_client::random, tls_server::random, x509_public_key::raw, rc, tls_connection::server, sig, signature, x509_certificate::subject, tls_cipherspec::suite, tls_find_signature_hash(), tls_set_binding(), tls_version(), TLS_VERSION_TLS_1_2, tls_connection::tx, and x509_first().

Referenced by tls_new_server_key_exchange_dhe(), and tls_new_server_key_exchange_ecdhe().

◆ tls_new_server_key_exchange_pubkey()

int tls_new_server_key_exchange_pubkey	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Key Exchange record using public key transport.

Parameters

tls	TLS connection
data	Server Key Exchange handshake record
len	Length of Server Key Exchange handshake record

Return values

rc	Return status code

Definition at line 1558 of file tls.c.

                                                                              {
 
        /* Should never be received */
        DBGC ( tls, "TLS %p received unexpected ServerKeyExchange:\n", tls );
        DBGC_HDA ( tls, 0, data, len );
        return -EPROTO;
}

References data, DBGC, DBGC_HDA, EPROTO, and len.

◆ tls_send_client_key_exchange_pubkey()

int tls_send_client_key_exchange_pubkey ( struct tls_connection * tls )

static

Transmit Client Key Exchange record using public key exchange.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 1573 of file tls.c.

                                                                              {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
        struct tls_key_schedule *key = &tls->key;
        struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey;
        struct x509_certificate *cert;
        struct {
                uint16_t version;
                uint8_t random[46];
        } __attribute__ (( packed )) pre_master_secret;
        struct asn1_cursor cursor = {
                .data = &pre_master_secret,
                .len = sizeof ( pre_master_secret ),
        };
        struct asn1_builder builder = { NULL, 0 };
        int rc;
 
        /* Generate pre-master secret */
        pre_master_secret.version = htons ( TLS_VERSION_MAX );
        tls_ephemeral_label ( tls, "classic pre-master",
                              &pre_master_secret.random,
                              sizeof ( pre_master_secret.random ) );
        tls_set_kdf_master ( tls, &pre_master_secret,
                             sizeof ( pre_master_secret ) );
 
        /* Key derivation function secret has been overwritten with a
         * value that was not derived from its previous value, and so
         * is no longer bound to the server's identity.
         */
        tls_clear_binding ( tls );
 
        /* Key schedule now contains shared secret key material */
        key->keyed = 1;
 
        /* Identify server certificate */
        cert = x509_first ( tls->server.chain );
        if ( ! cert ) {
                DBGC ( tls, "TLS %p has no server certificate\n", tls );
                rc = -ENOENT_CERT;
                goto err_cert;
        }
 
        /* Encrypt pre-master secret using server's public key */
        if ( ( rc = pubkey_encrypt ( pubkey, &cert->subject.public_key.raw,
                                     &cursor, &builder ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not encrypt pre-master secret: %s\n",
                       tls, strerror ( rc ) );
                goto err_encrypt;
        }
 
        /* Construct Client Key Exchange record */
        {
                struct {
                        uint32_t type_length;
                        uint16_t encrypted_pre_master_secret_len;
                } __attribute__ (( packed )) header;
 
                header.type_length =
                        ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
                          htonl ( builder.len + sizeof ( header ) -
                                  sizeof ( header.type_length ) ) );
                header.encrypted_pre_master_secret_len = htons ( builder.len );
 
                if ( ( rc = asn1_prepend_raw ( &builder, &header,
                                               sizeof ( header ) ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not construct Client Key "
                               "Exchange: %s\n", tls, strerror ( rc ) );
                        goto err_prepend;
                }
        }
 
        /* Transmit Client Key Exchange record */
        if ( ( rc = tls_send_handshake ( tls, builder.data,
                                         builder.len ) ) != 0 ) {
                goto err_send;
        }
 
        /* Shared secret has now been incorporated into the handshake
         * digest.  It can be decrypted only with access to the
         * certificate's private key, and has thereby been bound to
         * the server's identity.
         */
        tls_set_binding ( tls, cert );
 
 err_send:
 err_prepend:
 err_encrypt:
        zfree ( builder.data );
 err_cert:
        return rc;
}

References __attribute__, asn1_prepend_raw(), tls_server::chain, tls_tx::cipherspec, cpu_to_le32, asn1_builder::data, DBGC, ENOENT_CERT, header, htonl, htons, key, tls_connection::key, asn1_builder::len, NULL, tls_cipherspec_pair::pending, tls_cipher_suite::pubkey, pubkey_encrypt(), x509_subject::public_key, random(), x509_public_key::raw, rc, tls_connection::server, strerror(), x509_certificate::subject, tls_cipherspec::suite, tls_clear_binding(), TLS_CLIENT_KEY_EXCHANGE, tls_ephemeral_label(), tls_send_handshake(), tls_set_binding(), tls_set_kdf_master(), TLS_VERSION_MAX, tls_connection::tx, version, x509_first(), and zfree().

◆ tls_new_server_key_exchange_dhe()

int tls_new_server_key_exchange_dhe	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Key Exchange record using DHE key exchange.

Parameters

tls	TLS connection
data	Server Key Exchange handshake record
len	Length of Server Key Exchange handshake record

Return values

rc	Return status code

Definition at line 1679 of file tls.c.

                                                                            {
        struct tls_named_group *group;
        struct exchange_algorithm *exchange;
        const struct {
                uint16_t len;
                uint8_t data[0];
        } __attribute__ (( packed )) *dh_val[3];
        typeof ( dh_val[0] ) dh_p;
        typeof ( dh_val[1] ) dh_g;
        typeof ( dh_val[2] ) dh_ys;
        const void *param;
        size_t remaining;
        size_t frag_len;
        size_t param_len;
        unsigned int i;
        int rc;
 
        /* Parse ServerKeyExchange */
        param = data;
        remaining = len;
        for ( i = 0 ; i < ( sizeof ( dh_val ) / sizeof ( dh_val[0] ) ) ; i++ ){
                dh_val[i] = param;
                if ( ( sizeof ( *dh_val[i] ) > remaining ) ||
                     ( ntohs ( dh_val[i]->len ) > ( remaining -
                                                    sizeof ( *dh_val[i] ) ) )){
                        DBGC ( tls, "TLS %p received underlength "
                               "ServerKeyExchange\n", tls );
                        DBGC_HDA ( tls, 0, data, len );
                        return -EINVAL_KEY_EXCHANGE;
                }
                frag_len = ( sizeof ( *dh_val[i] ) + ntohs ( dh_val[i]->len ));
                param += frag_len;
                remaining -= frag_len;
        }
        param_len = ( len - remaining );
 
        /* Identify named group */
        dh_p = dh_val[0];
        dh_g = dh_val[1];
        dh_ys = dh_val[2];
        group = tls_find_param_group ( dh_p->data, ntohs ( dh_p->len ),
                                       dh_g->data, ntohs ( dh_g->len ) );
        if ( ! group ) {
                DBGC ( tls, "TLS %p unsupported %d-bit group:\n",
                       tls, ( 8 * ntohs ( dh_p->len ) ) );
                DBGC_HDA ( tls, 0, data, len );
                return -ENOTSUP_GROUP;
        }
        tls->key.group = group;
        exchange = group->exchange;
        DBGC ( tls, "TLS %p using named group %s\n", tls, exchange->name );
 
        /* Generate pre-master secret */
        if ( ( rc = tls_agree_ephemeral ( tls, dh_ys->data,
                                          ntohs ( dh_ys->len ), 1 ) ) != 0 ) {
                return rc;
        }
 
        /* Verify parameter signature */
        if ( ( rc = tls_verify_dh_params ( tls, data, len, param_len ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, data, DBGC, DBGC_HDA, EINVAL_KEY_EXCHANGE, ENOTSUP_GROUP, group, tls_key_schedule::group, tls_connection::key, len, exchange_algorithm::name, ntohs, param, rc, tls_agree_ephemeral(), tls_find_param_group(), tls_verify_dh_params(), and typeof().

◆ tls_send_client_key_exchange_dhe()

int tls_send_client_key_exchange_dhe ( struct tls_connection * tls )

static

Transmit Client Key Exchange record using DHE key exchange.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 1751 of file tls.c.

                                                                           {
        struct tls_key_schedule *key = &tls->key;
        struct tls_named_group *group = key->group;
        struct exchange_algorithm *exchange = group->exchange;
        size_t pubsize = exchange->pubsize;
        struct {
                uint32_t type_length;
                uint16_t dh_xs_len;
                uint8_t dh_xs[pubsize];
        } __attribute__ (( packed )) *key_xchg;
        int rc;
 
        /* Allocate space */
        key_xchg = malloc ( sizeof ( *key_xchg ) );
        if ( ! key_xchg ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
 
        /* Generate Client Key Exchange record */
        key_xchg->type_length =
                ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
                  htonl ( sizeof ( *key_xchg ) -
                          sizeof ( key_xchg->type_length ) ) );
        key_xchg->dh_xs_len = htons ( sizeof ( key_xchg->dh_xs ) );
        if ( ( rc = tls_share_ephemeral ( tls, key_xchg->dh_xs ) ) != 0 )
                goto err_share;
 
        /* Transmit Client Key Exchange record */
        if ( ( rc = tls_send_handshake ( tls, key_xchg,
                                         sizeof ( *key_xchg ) ) ) !=0 ) {
                goto err_send_handshake;
        }
 
 err_send_handshake:
 err_share:
        zfree ( key_xchg );
 err_alloc:
        return rc;
}

References __attribute__, cpu_to_le32, ENOMEM, group, htonl, htons, key, tls_connection::key, malloc(), exchange_algorithm::pubsize, rc, TLS_CLIENT_KEY_EXCHANGE, tls_send_handshake(), tls_share_ephemeral(), and zfree().

◆ tls_new_server_key_exchange_ecdhe()

int tls_new_server_key_exchange_ecdhe	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Key Exchange record using ECDHE key exchange.

Parameters

tls	TLS connection
data	Server Key Exchange handshake record
len	Length of Server Key Exchange handshake record

Return values

rc	Return status code

Definition at line 1807 of file tls.c.

                                                                              {
        struct tls_named_group *group;
        struct exchange_algorithm *exchange;
        const struct {
                uint8_t curve_type;
                uint16_t named_group;
                uint8_t public_len;
                uint8_t public[0];
        } __attribute__ (( packed )) *ecdh = data;
        size_t param_len;
        int rc;
 
        /* Parse ServerKeyExchange record */
        if ( ( sizeof ( *ecdh ) > len ) ||
             ( ecdh->public_len > ( len - sizeof ( *ecdh ) ) ) ) {
                DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n",
                       tls );
                DBGC_HDA ( tls, 0, data, len );
                return -EINVAL_KEY_EXCHANGE;
        }
        param_len = ( sizeof ( *ecdh ) + ecdh->public_len );
 
        /* Identify named group */
        if ( ecdh->curve_type != TLS_NAMED_CURVE_TYPE ) {
                DBGC ( tls, "TLS %p unsupported curve type %d\n",
                       tls, ecdh->curve_type );
                DBGC_HDA ( tls, 0, data, len );
                return -ENOTSUP_GROUP;
        }
        group = tls_find_named_group ( ecdh->named_group );
        if ( ! group ) {
                DBGC ( tls, "TLS %p unsupported named group %d\n",
                       tls, ntohs ( ecdh->named_group ) );
                DBGC_HDA ( tls, 0, data, len );
                return -ENOTSUP_GROUP;
        }
        tls->key.group = group;
        exchange = group->exchange;
        DBGC ( tls, "TLS %p using named group %s\n", tls, exchange->name );
 
        /* Generate pre-master secret */
        if ( ( rc = tls_agree_ephemeral ( tls, ecdh->public,
                                          ecdh->public_len, 0 ) ) != 0 ) {
                return rc;
        }
 
        /* Verify parameter signature */
        if ( ( rc = tls_verify_dh_params ( tls, data, len, param_len ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, data, DBGC, DBGC_HDA, EINVAL_KEY_EXCHANGE, ENOTSUP_GROUP, group, tls_key_schedule::group, tls_connection::key, len, exchange_algorithm::name, ntohs, rc, tls_agree_ephemeral(), tls_find_named_group(), TLS_NAMED_CURVE_TYPE, and tls_verify_dh_params().

◆ tls_send_client_key_exchange_ecdhe()

int tls_send_client_key_exchange_ecdhe ( struct tls_connection * tls )

static

Transmit Client Key Exchange record using ECDHE key exchange.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 1867 of file tls.c.

                                                                             {
        struct tls_key_schedule *key = &tls->key;
        struct tls_named_group *group = key->group;
        struct exchange_algorithm *exchange = group->exchange;
        size_t pubsize = exchange->pubsize;
        struct {
                uint32_t type_length;
                uint8_t public_len;
                uint8_t public[pubsize];
        } __attribute__ (( packed )) key_xchg;
        int rc;
 
        /* Generate Client Key Exchange record */
        key_xchg.type_length =
                ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
                  htonl ( sizeof ( key_xchg ) -
                          sizeof ( key_xchg.type_length ) ) );
        key_xchg.public_len = sizeof ( key_xchg.public );
        if ( ( rc = tls_share_ephemeral ( tls, key_xchg.public ) ) != 0 )
                return rc;
 
        /* Transmit Client Key Exchange record */
        if ( ( rc = tls_send_handshake ( tls, &key_xchg,
                                         sizeof ( key_xchg ) ) ) !=0 ) {
                return rc;
        }
 
        return 0;
}

References __attribute__, cpu_to_le32, group, htonl, key, tls_connection::key, exchange_algorithm::pubsize, rc, TLS_CLIENT_KEY_EXCHANGE, tls_send_handshake(), and tls_share_ephemeral().

◆ tls_tx_resume()

void tls_tx_resume ( struct tls_connection * tls )

static

Resume TX state machine.

Parameters

tls	TLS connection

Definition at line 1916 of file tls.c.

                                                         {
        process_add ( &tls->tx.process );
}

References tls_tx::process, process_add(), and tls_connection::tx.

Referenced by tls_new_finished(), tls_restart(), tls_tx_resume_all(), tls_tx_step(), and tls_validator_done().

◆ tls_restart()

void tls_restart ( struct tls_connection * tls )

static

Restart negotiation.

Parameters

tls	TLS connection

Definition at line 1937 of file tls.c.

                                                       {
 
        /* Sanity check */
        assert ( ! tls->tx.pending );
        assert ( ! is_pending ( &tls->client.negotiation ) );
        assert ( ! is_pending ( &tls->server.negotiation ) );
        assert ( ! is_pending ( &tls->server.validation ) );
 
        /* Reset ephemeral master secret */
        tls_regenerate_ephemeral_master ( tls );
 
        /* (Re)start negotiation */
        tls->tx.pending = TLS_TX_CLIENT_HELLO;
        tls_tx_resume ( tls );
        pending_get ( &tls->client.negotiation );
        pending_get ( &tls->server.negotiation );
}

References assert, tls_connection::client, is_pending(), tls_client::negotiation, tls_server::negotiation, tls_tx::pending, pending_get(), tls_connection::server, tls_regenerate_ephemeral_master(), TLS_TX_CLIENT_HELLO, tls_tx_resume(), tls_connection::tx, and tls_server::validation.

Referenced by add_tls(), and tls_new_hello_request().

◆ tls_client_hello()

int tls_client_hello	(	struct tls_connection *	tls,
		int(*	action )(struct tls_connection tls, const void data, size_t len) )

static

Digest or transmit Client Hello record.

Parameters

tls	TLS connection
action	Action to take on Client Hello record

Return values

rc	Return status code

Definition at line 1977 of file tls.c.

                                                                {
        struct tls_session *session = tls->session;
        size_t name_len = strlen ( session->name );
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint16_t len;
                        struct {
                                uint8_t type;
                                uint16_t len;
                                uint8_t name[name_len];
                        } __attribute__ (( packed )) list[1];
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *server_name_ext;
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint8_t max;
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *max_fragment_length_ext;
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint16_t len;
                        uint16_t code[TLS_NUM_SIG_HASH_ALGORITHMS];
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *signature_algorithms_ext;
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint8_t len;
                        uint8_t data[ tls->secure_renegotiation ?
                                      sizeof ( tls->verify.client ) :0 ];
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *renegotiation_info_ext;
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint8_t data[session->ticket_len];
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *session_ticket_ext;
        struct {
                uint16_t type;
                uint16_t len;
                struct {
                        uint16_t len;
                        uint16_t code[TLS_NUM_NAMED_GROUPS];
                } __attribute__ (( packed )) data;
        } __attribute__ (( packed )) *named_group_ext;
        struct {
                uint16_t type;
                uint16_t len;
        } __attribute__ (( packed )) *extended_master_secret_ext;
        struct {
                typeof ( *server_name_ext ) server_name;
                typeof ( *max_fragment_length_ext ) max_fragment_length;
                typeof ( *signature_algorithms_ext ) signature_algorithms;
                typeof ( *renegotiation_info_ext ) renegotiation_info;
                typeof ( *session_ticket_ext ) session_ticket;
                typeof ( *extended_master_secret_ext ) extended_master_secret;
                typeof ( *named_group_ext )
                        named_group[TLS_NUM_NAMED_GROUPS ? 1 : 0];
        } __attribute__ (( packed )) *extensions;
        struct {
                uint32_t type_length;
                uint16_t version;
                uint8_t random[32];
                uint8_t session_id_len;
                uint8_t session_id[tls->session_id_len];
                uint16_t cipher_suite_len;
                uint16_t cipher_suites[TLS_NUM_CIPHER_SUITES];
                uint8_t compression_methods_len;
                uint8_t compression_methods[1];
                uint16_t extensions_len;
                typeof ( *extensions ) extensions;
        } __attribute__ (( packed )) hello;
        struct tls_cipher_suite *suite;
        struct tls_signature_hash_algorithm *sighash;
        struct tls_named_group *group;
        unsigned int i;
 
        /* Construct record */
        memset ( &hello, 0, sizeof ( hello ) );
        hello.type_length = ( cpu_to_le32 ( TLS_CLIENT_HELLO ) |
                              htonl ( sizeof ( hello ) -
                                      sizeof ( hello.type_length ) ) );
        hello.version = htons ( TLS_VERSION_MAX );
        memcpy ( &hello.random, &tls->client.random, sizeof ( hello.random ) );
        hello.session_id_len = tls->session_id_len;
        memcpy ( hello.session_id, tls->session_id,
                 sizeof ( hello.session_id ) );
        hello.cipher_suite_len = htons ( sizeof ( hello.cipher_suites ) );
        i = 0 ; for_each_table_entry ( suite, TLS_CIPHER_SUITES )
                hello.cipher_suites[i++] = suite->code;
        hello.compression_methods_len = sizeof ( hello.compression_methods );
        hello.extensions_len = htons ( sizeof ( hello.extensions ) );
        extensions = &hello.extensions;
 
        /* Construct server name extension */
        server_name_ext = &extensions->server_name;
        server_name_ext->type = htons ( TLS_SERVER_NAME );
        server_name_ext->len = htons ( sizeof ( server_name_ext->data ) );
        server_name_ext->data.len
                = htons ( sizeof ( server_name_ext->data.list ) );
        server_name_ext->data.list[0].type = TLS_SERVER_NAME_HOST_NAME;
        server_name_ext->data.list[0].len
                = htons ( sizeof ( server_name_ext->data.list[0].name ) );
        memcpy ( server_name_ext->data.list[0].name, session->name,
                 sizeof ( server_name_ext->data.list[0].name ) );
 
        /* Construct maximum fragment length extension */
        max_fragment_length_ext = &extensions->max_fragment_length;
        max_fragment_length_ext->type = htons ( TLS_MAX_FRAGMENT_LENGTH );
        max_fragment_length_ext->len
                = htons ( sizeof ( max_fragment_length_ext->data ) );
        max_fragment_length_ext->data.max = TLS_MAX_FRAGMENT_LENGTH_VALUE;
 
        /* Construct supported signature algorithms extension */
        signature_algorithms_ext = &extensions->signature_algorithms;
        signature_algorithms_ext->type = htons ( TLS_SIGNATURE_ALGORITHMS );
        signature_algorithms_ext->len
                = htons ( sizeof ( signature_algorithms_ext->data ) );
        signature_algorithms_ext->data.len
                = htons ( sizeof ( signature_algorithms_ext->data.code ) );
        i = 0 ; for_each_table_entry ( sighash, TLS_SIG_HASH_ALGORITHMS )
                signature_algorithms_ext->data.code[i++] = sighash->code;
 
        /* Construct renegotiation information extension */
        renegotiation_info_ext = &extensions->renegotiation_info;
        renegotiation_info_ext->type = htons ( TLS_RENEGOTIATION_INFO );
        renegotiation_info_ext->len
                = htons ( sizeof ( renegotiation_info_ext->data ) );
        renegotiation_info_ext->data.len
                = sizeof ( renegotiation_info_ext->data.data );
        memcpy ( renegotiation_info_ext->data.data, tls->verify.client,
                 sizeof ( renegotiation_info_ext->data.data ) );
 
        /* Construct session ticket extension */
        session_ticket_ext = &extensions->session_ticket;
        session_ticket_ext->type = htons ( TLS_SESSION_TICKET );
        session_ticket_ext->len
                = htons ( sizeof ( session_ticket_ext->data ) );
        memcpy ( session_ticket_ext->data.data, session->ticket,
                 sizeof ( session_ticket_ext->data.data ) );
 
        /* Construct extended master secret extension */
        extended_master_secret_ext = &extensions->extended_master_secret;
        extended_master_secret_ext->type
                = htons ( TLS_EXTENDED_MASTER_SECRET );
        extended_master_secret_ext->len = 0;
 
        /* Construct named groups extension, if applicable */
        if ( sizeof ( extensions->named_group ) ) {
                named_group_ext = &extensions->named_group[0];
                named_group_ext->type = htons ( TLS_NAMED_GROUP );
                named_group_ext->len
                        = htons ( sizeof ( named_group_ext->data ) );
                named_group_ext->data.len
                        = htons ( sizeof ( named_group_ext->data.code ) );
                i = 0 ; for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
                        if ( group->code )
                                named_group_ext->data.code[i++] = group->code;
                }
                assert ( i == TLS_NUM_NAMED_GROUPS );
        }
 
        return action ( tls, &hello, sizeof ( hello ) );
}

References __attribute__, assert, tls_connection::client, tls_verify_data::client, code, tls_cipher_suite::code, tls_signature_hash_algorithm::code, cpu_to_le32, data, for_each_table_entry, group, hello, htonl, htons, len, tls_session::list, max, memcpy(), memset(), name, tls_session::name, random(), tls_client::random, tls_connection::secure_renegotiation, tls_connection::session, tls_connection::session_id, tls_connection::session_id_len, strlen(), tls_session::ticket, tls_session::ticket_len, TLS_CIPHER_SUITES, TLS_CLIENT_HELLO, TLS_EXTENDED_MASTER_SECRET, TLS_MAX_FRAGMENT_LENGTH, TLS_MAX_FRAGMENT_LENGTH_VALUE, TLS_NAMED_GROUP, TLS_NAMED_GROUPS, TLS_NUM_CIPHER_SUITES, TLS_NUM_NAMED_GROUPS, TLS_NUM_SIG_HASH_ALGORITHMS, TLS_RENEGOTIATION_INFO, TLS_SERVER_NAME, TLS_SERVER_NAME_HOST_NAME, TLS_SESSION_TICKET, TLS_SIG_HASH_ALGORITHMS, TLS_SIGNATURE_ALGORITHMS, TLS_VERSION_MAX, type, typeof(), tls_connection::verify, and version.

Referenced by tls_new_server_hello(), and tls_send_client_hello().

◆ tls_send_client_hello()

int tls_send_client_hello ( struct tls_connection * tls )

static

Transmit Client Hello record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2160 of file tls.c.

                                                                {
 
        return tls_client_hello ( tls, tls_send_handshake );
}

References tls_client_hello(), and tls_send_handshake().

Referenced by tls_tx_step().

◆ tls_send_certificate()

int tls_send_certificate ( struct tls_connection * tls )

static

Transmit Certificate record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2171 of file tls.c.

                                                               {
        struct {
                tls24_t length;
                uint8_t data[0];
        } __attribute__ (( packed )) *certificate;
        struct {
                uint32_t type_length;
                tls24_t length;
                typeof ( *certificate ) certificates[0];
        } __attribute__ (( packed )) *certificates;
        struct x509_link *link;
        struct x509_certificate *cert;
        struct io_buffer *iobuf;
        size_t len;
 
        /* Calculate length of client certificates */
        len = 0;
        list_for_each_entry ( link, &tls->client.chain->links, list ) {
                cert = link->cert;
                len += ( sizeof ( *certificate ) + cert->raw.len );
                DBGC ( tls, "TLS %p sending client certificate %s\n",
                       tls, x509_name ( cert ) );
        }
 
        /* Allocate storage for Certificate record (which may be too
         * large for the stack).
         */
        iobuf = tls_alloc_iob ( tls, ( sizeof ( *certificates ) + len ) );
        if ( ! iobuf )
                return -ENOMEM_CERTIFICATE;
 
        /* Populate record */
        certificates = iob_put ( iobuf, sizeof ( *certificates ) );
        certificates->type_length =
                ( cpu_to_le32 ( TLS_CERTIFICATE ) |
                  htonl ( sizeof ( *certificates ) + len -
                          sizeof ( certificates->type_length ) ) );
        tls_set_uint24 ( &certificates->length, len );
        list_for_each_entry ( link, &tls->client.chain->links, list ) {
                cert = link->cert;
                certificate = iob_put ( iobuf, sizeof ( *certificate ) );
                tls_set_uint24 ( &certificate->length, cert->raw.len );
                memcpy ( iob_put ( iobuf, cert->raw.len ), cert->raw.data,
                         cert->raw.len );
        }
 
        /* Transmit record */
        return tls_send_record ( tls, TLS_TYPE_HANDSHAKE,
                                 iob_disown ( iobuf ) );
}

References __attribute__, tls_client::chain, tls_connection::client, cpu_to_le32, asn1_cursor::data, data, DBGC, ENOMEM_CERTIFICATE, htonl, iob_disown, iob_put, asn1_cursor::len, len, length, link, x509_chain::links, io_buffer::list, list_for_each_entry, memcpy(), x509_certificate::raw, tls_alloc_iob(), TLS_CERTIFICATE, tls_send_record(), tls_set_uint24(), TLS_TYPE_HANDSHAKE, typeof(), and x509_name().

Referenced by tls_tx_step().

◆ tls_send_client_key_exchange()

int tls_send_client_key_exchange ( struct tls_connection * tls )

static

Transmit Client Key Exchange record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2228 of file tls.c.

                                                                       {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
        struct tls_cipher_suite *suite = cipherspec->suite;
        int rc;
 
        /* Transmit Client Key Exchange record via key exchange algorithm */
        if ( ( rc = suite->exchange->client ( tls ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not exchange keys: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
 
        /* Generate master secret */
        tls_generate_master_secret ( tls );
 
        /* Generate keys from master secret */
        if ( ( rc = tls_generate_keys ( tls ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not generate keys: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
 
        return 0;
}

References tls_tx::cipherspec, tls_key_exchange_algorithm::client, DBGC, tls_cipher_suite::exchange, tls_cipherspec_pair::pending, rc, strerror(), tls_cipherspec::suite, tls_generate_keys(), tls_generate_master_secret(), and tls_connection::tx.

Referenced by tls_tx_step().

◆ tls_send_certificate_verify()

int tls_send_certificate_verify ( struct tls_connection * tls )

static

Transmit Certificate Verify record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2259 of file tls.c.

                                                                      {
        struct digest_algorithm *digest = tls->key.digest;
        struct x509_certificate *cert = x509_first ( tls->client.chain );
        struct pubkey_algorithm *pubkey = cert->signature_algorithm->pubkey;
        struct asn1_cursor *key = privkey_cursor ( tls->client.key );
        uint8_t digest_out[ digest->digestsize ];
        struct tls_signature_hash_algorithm *sig_hash = NULL;
        struct asn1_builder builder = { NULL, 0 };
        int rc;
 
        /* Generate digest to be signed */
        tls_verify_handshake ( tls, digest_out );
 
        /* TLSv1.2 and later use explicit algorithm identifiers */
        if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
                sig_hash = tls_signature_hash_algorithm ( pubkey, digest );
                if ( ! sig_hash ) {
                        DBGC ( tls, "TLS %p could not identify (%s,%s) "
                               "signature and hash algorithm\n", tls,
                               pubkey->name, digest->name );
                        rc = -ENOTSUP_SIG_HASH;
                        goto err_sig_hash;
                }
        }
 
        /* Sign digest */
        if ( ( rc = pubkey_sign ( pubkey, key, digest, digest_out,
                                  &builder ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not sign %s digest using %s client "
                       "private key: %s\n", tls, digest->name, pubkey->name,
                       strerror ( rc ) );
                goto err_pubkey_sign;
        }
 
        /* Construct Certificate Verify record */
        {
                int use_sig_hash = ( ( sig_hash == NULL ) ? 0 : 1 );
                struct {
                        uint32_t type_length;
                        uint16_t sig_hash[use_sig_hash];
                        uint16_t signature_len;
                } __attribute__ (( packed )) header;
 
                header.type_length = ( cpu_to_le32 ( TLS_CERTIFICATE_VERIFY ) |
                                       htonl ( builder.len +
                                               sizeof ( header ) -
                                               sizeof ( header.type_length )));
                if ( use_sig_hash ) {
                        memcpy ( &header.sig_hash[0], &sig_hash->code,
                                 sizeof ( header.sig_hash[0] ) );
                }
                header.signature_len = htons ( builder.len );
 
                if ( ( rc = asn1_prepend_raw ( &builder, &header,
                                               sizeof ( header ) ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not construct Certificate "
                               "Verify: %s\n", tls, strerror ( rc ) );
                        goto err_prepend;
                }
        }
 
        /* Transmit record */
        if ( ( rc = tls_send_handshake ( tls, builder.data,
                                         builder.len ) ) != 0 ) {
                goto err_send;
        }
 
 err_send:
 err_prepend:
 err_pubkey_sign:
 err_sig_hash:
        zfree ( builder.data );
        return rc;
}

References __attribute__, asn1_prepend_raw(), tls_client::chain, tls_connection::client, tls_signature_hash_algorithm::code, cpu_to_le32, asn1_builder::data, DBGC, tls_key_schedule::digest, digest_algorithm::digestsize, ENOTSUP_SIG_HASH, header, htonl, htons, key, tls_client::key, tls_connection::key, asn1_builder::len, memcpy(), digest_algorithm::name, pubkey_algorithm::name, NULL, privkey_cursor(), asn1_algorithm::pubkey, pubkey_sign(), rc, x509_certificate::signature_algorithm, strerror(), TLS_CERTIFICATE_VERIFY, tls_send_handshake(), tls_signature_hash_algorithm(), tls_verify_handshake(), tls_version(), TLS_VERSION_TLS_1_2, x509_first(), and zfree().

Referenced by tls_tx_step().

◆ tls_send_change_cipher()

int tls_send_change_cipher ( struct tls_connection * tls )

static

Transmit Change Cipher record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2340 of file tls.c.

                                                                 {
        static const struct {
                uint8_t spec;
        } __attribute__ (( packed )) change_cipher = {
                .spec = TLS_CHANGE_CIPHER_SPEC,
        };
 
        return tls_send_plaintext ( tls, TLS_TYPE_CHANGE_CIPHER,
                                    &change_cipher, sizeof ( change_cipher ) );
}

References __attribute__, spec, TLS_CHANGE_CIPHER_SPEC, tls_send_plaintext(), and TLS_TYPE_CHANGE_CIPHER.

Referenced by tls_tx_step().

◆ tls_send_finished()

int tls_send_finished ( struct tls_connection * tls )

static

Transmit Finished record.

Parameters

tls	TLS connection

Return values

rc	Return status code

Definition at line 2357 of file tls.c.

                                                            {
        struct digest_algorithm *digest = tls->key.digest;
        struct tls_key_schedule *key = &tls->key;
        struct {
                uint32_t type_length;
                uint8_t verify_data[ sizeof ( tls->verify.client ) ];
        } __attribute__ (( packed )) finished;
        uint8_t digest_out[ digest->digestsize ];
        int rc;
 
        /* Fail unless bound identity has been validated */
        if ( ! ( key->bound &&
                 x509_is_valid ( key->bound, tls->server.root ) ) ) {
                DBGC ( tls, "TLS %p bound identity is not valid\n", tls );
                return -EPERM_BOUND;
        }
 
        /* Construct client verification data */
        tls_verify_handshake ( tls, digest_out );
        tls_prf_label ( tls, tls->verify.client, sizeof ( tls->verify.client ),
                        "client finished", digest_out, sizeof ( digest_out ) );
 
        /* Construct record */
        memset ( &finished, 0, sizeof ( finished ) );
        finished.type_length = ( cpu_to_le32 ( TLS_FINISHED ) |
                                 htonl ( sizeof ( finished ) -
                                         sizeof ( finished.type_length ) ) );
        memcpy ( finished.verify_data, tls->verify.client,
                 sizeof ( finished.verify_data ) );
 
        /* Transmit record */
        if ( ( rc = tls_send_handshake ( tls, &finished,
                                         sizeof ( finished ) ) ) != 0 )
                return rc;
 
        /* Mark client as finished */
        pending_put ( &tls->client.negotiation );
 
        return 0;
}

References __attribute__, tls_connection::client, tls_verify_data::client, cpu_to_le32, DBGC, tls_key_schedule::digest, digest_algorithm::digestsize, EPERM_BOUND, htonl, key, tls_connection::key, memcpy(), memset(), tls_client::negotiation, pending_put(), rc, tls_server::root, tls_connection::server, TLS_FINISHED, tls_prf_label, tls_send_handshake(), tls_verify_handshake(), tls_connection::verify, and x509_is_valid().

Referenced by tls_tx_step().

◆ tls_new_change_cipher()

int tls_new_change_cipher	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf )

static

Receive new Change Cipher record.

Parameters

tls	TLS connection
iobuf	I/O buffer

Return values

rc	Return status code

Definition at line 2428 of file tls.c.

                                                             {
        const struct {
                uint8_t spec;
        } __attribute__ (( packed )) *change_cipher = iobuf->data;
        size_t len = iob_len ( iobuf );
        int rc;
 
        /* Sanity check */
        if ( ( sizeof ( *change_cipher ) != len ) ||
             ( change_cipher->spec != TLS_CHANGE_CIPHER_SPEC ) ) {
                DBGC ( tls, "TLS %p received invalid Change Cipher\n", tls );
                DBGC_HD ( tls, change_cipher, len );
                return -EINVAL_CHANGE_CIPHER;
        }
        iob_pull ( iobuf, sizeof ( *change_cipher ) );
 
        /* Change receive cipher spec */
        if ( ( rc = tls_change_cipher ( tls, &tls->rx.cipherspec ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not activate RX cipher: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
        tls->rx.seq = ~( ( uint64_t ) 0 );
 
        return 0;
}

References __attribute__, tls_rx::cipherspec, io_buffer::data, DBGC, DBGC_HD, EINVAL_CHANGE_CIPHER, iob_len(), iob_pull, len, rc, tls_connection::rx, tls_rx::seq, spec, strerror(), tls_change_cipher(), and TLS_CHANGE_CIPHER_SPEC.

Referenced by tls_new_record().

◆ tls_new_alert()

int tls_new_alert	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf )

static

Receive new Alert record.

Parameters

tls	TLS connection
iobuf	I/O buffer

Return values

rc	Return status code

Definition at line 2463 of file tls.c.

                                                     {
        const struct {
                uint8_t level;
                uint8_t description;
                char next[0];
        } __attribute__ (( packed )) *alert = iobuf->data;
        size_t len = iob_len ( iobuf );
 
        /* Sanity check */
        if ( sizeof ( *alert ) != len ) {
                DBGC ( tls, "TLS %p received overlength Alert\n", tls );
                DBGC_HD ( tls, alert, len );
                return -EINVAL_ALERT;
        }
        iob_pull ( iobuf, sizeof ( *alert ) );
 
        /* Handle alert */
        switch ( alert->level ) {
        case TLS_ALERT_WARNING:
                switch ( alert->description ) {
                case TLS_ALERT_CLOSE_NOTIFY:
                        DBGC ( tls, "TLS %p closed by notification\n", tls );
                        tls_close ( tls, 0 );
                        break;
                default:
                        DBGC ( tls, "TLS %p received warning alert %d\n",
                               tls, alert->description );
                        break;
                }
                return 0;
        case TLS_ALERT_FATAL:
                DBGC ( tls, "TLS %p received fatal alert %d\n",
                       tls, alert->description );
                return -EPERM_ALERT;
        default:
                DBGC ( tls, "TLS %p received unknown alert level %d"
                       "(alert %d)\n", tls, alert->level, alert->description );
                return -EIO_ALERT;
        }
}

References __attribute__, alert(), io_buffer::data, DBGC, DBGC_HD, EINVAL_ALERT, EIO_ALERT, EPERM_ALERT, iob_len(), iob_pull, len, next, TLS_ALERT_CLOSE_NOTIFY, TLS_ALERT_FATAL, TLS_ALERT_WARNING, and tls_close().

Referenced by tls_new_record().

◆ tls_new_hello_request()

int tls_new_hello_request	(	struct tls_connection *	tls,
		const void *data	__unused,
		size_t len	__unused )

static

Receive new Hello Request handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2513 of file tls.c.

                                                         {
 
        /* Ignore if a handshake is in progress */
        if ( ! tls_ready ( tls ) ) {
                DBGC ( tls, "TLS %p ignoring Hello Request\n", tls );
                return 0;
        }
 
        /* Fail unless server supports secure renegotiation */
        if ( ! ( tls->secure_renegotiation && tls->extended_master_secret ) ) {
                DBGC ( tls, "TLS %p refusing to renegotiate insecurely\n",
                       tls );
                return -EPERM_RENEG_INSECURE;
        }
 
        /* Restart negotiation */
        tls_restart ( tls );
 
        return 0;
}

References __unused, data, DBGC, EPERM_RENEG_INSECURE, tls_connection::extended_master_secret, len, tls_connection::secure_renegotiation, tls_ready(), and tls_restart().

Referenced by tls_new_handshake().

◆ tls_new_server_hello()

int tls_new_server_hello	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Hello handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2544 of file tls.c.

                                                                 {
        const struct {
                uint16_t version;
                uint8_t random[32];
                uint8_t session_id_len;
                uint8_t session_id[0];
        } __attribute__ (( packed )) *hello_a = data;
        const uint8_t *session_id;
        const struct {
                uint16_t cipher_suite;
                uint8_t compression_method;
                char next[0];
        } __attribute__ (( packed )) *hello_b;
        const struct {
                uint16_t len;
                uint8_t data[0];
        } __attribute__ (( packed )) *exts;
        const struct {
                uint16_t type;
                uint16_t len;
                uint8_t data[0];
        } __attribute__ (( packed )) *ext;
        const struct {
                uint8_t len;
                uint8_t data[0];
        } __attribute__ (( packed )) *reneg = NULL;
        const struct {
                uint8_t data[0];
        } __attribute__ (( packed )) *ems = NULL;
        uint16_t version;
        size_t exts_len;
        size_t ext_len;
        size_t remaining;
        int rc;
 
        /* Parse header */
        if ( ( sizeof ( *hello_a ) > len ) ||
             ( hello_a->session_id_len > ( len - sizeof ( *hello_a ) ) ) ||
             ( sizeof ( *hello_b ) > ( len - sizeof ( *hello_a ) -
                                       hello_a->session_id_len ) ) ) {
                DBGC ( tls, "TLS %p received underlength Server Hello\n", tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_HELLO;
        }
        session_id = hello_a->session_id;
        hello_b = ( ( void * ) ( session_id + hello_a->session_id_len ) );
 
        /* Parse extensions, if present */
        remaining = ( len - sizeof ( *hello_a ) - hello_a->session_id_len -
                      sizeof ( *hello_b ) );
        if ( remaining ) {
 
                /* Parse extensions length */
                exts = ( ( void * ) hello_b->next );
                if ( ( sizeof ( *exts ) > remaining ) ||
                     ( ( exts_len = ntohs ( exts->len ) ) >
                       ( remaining - sizeof ( *exts ) ) ) ) {
                        DBGC ( tls, "TLS %p received underlength extensions\n",
                               tls );
                        DBGC_HD ( tls, data, len );
                        return -EINVAL_HELLO;
                }
 
                /* Parse extensions */
                for ( ext = ( ( void * ) exts->data ), remaining = exts_len ;
                      remaining ;
                      ext = ( ( ( void * ) ext ) + sizeof ( *ext ) + ext_len ),
                              remaining -= ( sizeof ( *ext ) + ext_len ) ) {
 
                        /* Parse extension length */
                        if ( ( sizeof ( *ext ) > remaining ) ||
                             ( ( ext_len = ntohs ( ext->len ) ) >
                               ( remaining - sizeof ( *ext ) ) ) ) {
                                DBGC ( tls, "TLS %p received underlength "
                                       "extension\n", tls );
                                DBGC_HD ( tls, data, len );
                                return -EINVAL_HELLO;
                        }
 
                        /* Record known extensions */
                        switch ( ext->type ) {
                        case htons ( TLS_RENEGOTIATION_INFO ) :
                                reneg = ( ( void * ) ext->data );
                                if ( ( sizeof ( *reneg ) > ext_len ) ||
                                     ( reneg->len >
                                       ( ext_len - sizeof ( *reneg ) ) ) ) {
                                        DBGC ( tls, "TLS %p received "
                                               "underlength renegotiation "
                                               "info\n", tls );
                                        DBGC_HD ( tls, data, len );
                                        return -EINVAL_HELLO;
                                }
                                break;
                        case htons ( TLS_EXTENDED_MASTER_SECRET ) :
                                ems = ( ( void * ) ext->data );
                                break;
                        }
                }
        }
 
        /* Check and store protocol version */
        version = ntohs ( hello_a->version );
        if ( version < TLS_VERSION_MIN ) {
                DBGC ( tls, "TLS %p does not support protocol version %d.%d\n",
                       tls, ( version >> 8 ), ( version & 0xff ) );
                return -ENOTSUP_VERSION;
        }
        if ( version > tls->version ) {
                DBGC ( tls, "TLS %p server attempted to illegally upgrade to "
                       "protocol version %d.%d\n",
                       tls, ( version >> 8 ), ( version & 0xff ) );
                return -EPROTO_VERSION;
        }
        tls->version = version;
        DBGC ( tls, "TLS %p using protocol version %d.%d\n",
               tls, ( version >> 8 ), ( version & 0xff ) );
 
        /* Select cipher suite */
        if ( ( rc = tls_select_cipher ( tls, hello_b->cipher_suite ) ) != 0 )
                return rc;
 
        /* Add preceding Client Hello to handshake digest */
        if ( ( rc = tls_client_hello ( tls, tls_add_handshake ) ) != 0 )
                return rc;
 
        /* Copy out server random bytes */
        memcpy ( &tls->server.random, &hello_a->random,
                 sizeof ( tls->server.random ) );
 
        /* Handle extended master secret */
        tls->extended_master_secret = ( !! ems );
 
        /* Check session ID */
        if ( hello_a->session_id_len &&
             ( hello_a->session_id_len == tls->session_id_len ) &&
             ( memcmp ( session_id, tls->session_id,
                        tls->session_id_len ) == 0 ) ) {
 
                /* Session ID match: reuse master secret */
                DBGC ( tls, "TLS %p resuming session ID:\n", tls );
                DBGC_HDA ( tls, 0, tls->session_id, tls->session_id_len );
                tls_resume_secret ( tls );
                if ( ( rc = tls_generate_keys ( tls ) ) != 0 )
                        return rc;
 
                /* Ensure master secret generation method matches */
                if ( tls->extended_master_secret !=
                     tls->session->extended_master_secret ) {
                        DBGC ( tls, "TLS %p mismatched extended master secret "
                               "extension\n", tls );
                        return -EPERM_EMS;
                }
 
        } else {
 
                /* Record new session ID, if present */
                if ( hello_a->session_id_len &&
                     ( hello_a->session_id_len <= sizeof ( tls->session_id ))){
                        tls->session_id_len = hello_a->session_id_len;
                        memcpy ( tls->session_id, session_id,
                                 tls->session_id_len );
                        DBGC ( tls, "TLS %p new session ID:\n", tls );
                        DBGC_HDA ( tls, 0, tls->session_id,
                                   tls->session_id_len );
                }
        }
 
        /* Handle secure renegotiation */
        if ( tls->secure_renegotiation ) {
 
                /* Secure renegotiation is expected; verify data */
                if ( ( reneg == NULL ) ||
                     ( reneg->len != sizeof ( tls->verify ) ) ||
                     ( memcmp ( reneg->data, &tls->verify,
                                sizeof ( tls->verify ) ) != 0 ) ) {
                        DBGC ( tls, "TLS %p server failed secure "
                               "renegotiation\n", tls );
                        return -EPERM_RENEG_VERIFY;
                }
 
        } else if ( reneg != NULL ) {
 
                /* Secure renegotiation is being enabled */
                if ( reneg->len != 0 ) {
                        DBGC ( tls, "TLS %p server provided non-empty initial "
                               "renegotiation\n", tls );
                        return -EPERM_RENEG_VERIFY;
                }
                tls->secure_renegotiation = 1;
        }
 
        return 0;
}

References __attribute__, data, DBGC, DBGC_HD, DBGC_HDA, EINVAL_HELLO, ENOTSUP_VERSION, EPERM_EMS, EPERM_RENEG_VERIFY, EPROTO_VERSION, ext, tls_connection::extended_master_secret, tls_session::extended_master_secret, htons, len, memcmp(), memcpy(), next, ntohs, NULL, random(), tls_server::random, rc, tls_connection::secure_renegotiation, tls_connection::server, tls_connection::session, tls_connection::session_id, tls_connection::session_id_len, tls_add_handshake(), tls_client_hello(), TLS_EXTENDED_MASTER_SECRET, tls_generate_keys(), TLS_RENEGOTIATION_INFO, tls_resume_secret(), tls_select_cipher(), TLS_VERSION_MIN, type, tls_connection::verify, tls_connection::version, and version.

Referenced by tls_new_handshake().

◆ tls_new_session_ticket()

int tls_new_session_ticket	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive New Session Ticket handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2747 of file tls.c.

                                                                   {
        const struct {
                uint32_t lifetime;
                uint16_t len;
                uint8_t ticket[0];
        } __attribute__ (( packed )) *new_session_ticket = data;
        size_t ticket_len;
 
        /* Parse header */
        if ( sizeof ( *new_session_ticket ) > len ) {
                DBGC ( tls, "TLS %p received underlength New Session Ticket\n",
                       tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_TICKET;
        }
        ticket_len = ntohs ( new_session_ticket->len );
        if ( ticket_len > ( len - sizeof ( *new_session_ticket ) ) ) {
                DBGC ( tls, "TLS %p received overlength New Session Ticket\n",
                       tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_TICKET;
        }
 
        /* Free any unapplied new session ticket */
        zfree ( tls->new_session_ticket );
        tls->new_session_ticket = NULL;
        tls->new_session_ticket_len = 0;
 
        /* Record ticket */
        tls->new_session_ticket = malloc ( ticket_len );
        if ( ! tls->new_session_ticket )
                return -ENOMEM;
        memcpy ( tls->new_session_ticket, new_session_ticket->ticket,
                 ticket_len );
        tls->new_session_ticket_len = ticket_len;
        DBGC ( tls, "TLS %p new session ticket:\n", tls );
        DBGC_HDA ( tls, 0, tls->new_session_ticket,
                   tls->new_session_ticket_len );
 
        return 0;
}

References __attribute__, data, DBGC, DBGC_HD, DBGC_HDA, EINVAL_TICKET, ENOMEM, len, lifetime, malloc(), memcpy(), tls_connection::new_session_ticket, tls_connection::new_session_ticket_len, ntohs, NULL, and zfree().

Referenced by tls_new_handshake().

◆ tls_parse_chain()

int tls_parse_chain	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Parse certificate chain.

Parameters

tls	TLS connection
data	Certificate chain
len	Length of certificate chain

Return values

rc	Return status code

Definition at line 2798 of file tls.c.

                                                            {
        struct x509_certificate *cert;
        size_t remaining = len;
        int rc;
 
        /* Free any existing certificate chain */
        x509_chain_put ( tls->server.chain );
        tls->server.chain = NULL;
 
        /* Certificate has changed and so the key schedule is no
         * longer bound to the server identity.
         */
        tls->key.bound = 0;
 
        /* Create certificate chain */
        tls->server.chain = x509_alloc_chain();
        if ( ! tls->server.chain ) {
                rc = -ENOMEM_CHAIN;
                goto err_alloc_chain;
        }
 
        /* Add certificates to chain */
        while ( remaining ) {
                const struct {
                        tls24_t length;
                        uint8_t data[0];
                } __attribute__ (( packed )) *certificate = data;
                size_t certificate_len;
                size_t record_len;
 
                /* Parse header */
                if ( sizeof ( *certificate ) > remaining ) {
                        DBGC ( tls, "TLS %p underlength certificate:\n", tls );
                        DBGC_HDA ( tls, 0, data, remaining );
                        rc = -EINVAL_CERTIFICATE;
                        goto err_underlength;
                }
                certificate_len = tls_uint24 ( &certificate->length );
                if ( certificate_len > ( remaining - sizeof ( *certificate ) )){
                        DBGC ( tls, "TLS %p overlength certificate:\n", tls );
                        DBGC_HDA ( tls, 0, data, remaining );
                        rc = -EINVAL_CERTIFICATE;
                        goto err_overlength;
                }
                record_len = ( sizeof ( *certificate ) + certificate_len );
 
                /* Add certificate to chain */
                if ( ( rc = x509_append_raw ( tls->server.chain,
                                              certificate->data,
                                              certificate_len ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not append certificate: %s\n",
                               tls, strerror ( rc ) );
                        DBGC_HDA ( tls, 0, data, remaining );
                        goto err_parse;
                }
                cert = x509_last ( tls->server.chain );
                DBGC ( tls, "TLS %p found certificate %s\n",
                       tls, x509_name ( cert ) );
 
                /* Move to next certificate in list */
                data += record_len;
                remaining -= record_len;
        }
 
        /* Identify server certificate */
        cert = x509_first ( tls->server.chain );
        if ( ! cert ) {
                DBGC ( tls, "TLS %p certificate chain is empty\n", tls );
                rc = -ENOENT_CERT;
                goto err_empty;
        }
 
        /* Verify server name */
        if ( ( rc = x509_check_name ( cert, tls->session->name ) ) != 0 ) {
                DBGC ( tls, "TLS %p server certificate does not match %s: %s\n",
                       tls, tls->session->name, strerror ( rc ) );
                goto err_name;
        }
 
        return 0;
 
 err_name:
 err_empty:
 err_parse:
 err_overlength:
 err_underlength:
        x509_chain_put ( tls->server.chain );
        tls->server.chain = NULL;
 err_alloc_chain:
        return rc;
}

References __attribute__, tls_key_schedule::bound, tls_server::chain, data, DBGC, DBGC_HDA, EINVAL_CERTIFICATE, ENOENT_CERT, ENOMEM_CHAIN, tls_connection::key, len, length, tls_session::name, NULL, rc, tls_connection::server, tls_connection::session, strerror(), tls_uint24(), x509_alloc_chain(), x509_append_raw(), x509_chain_put(), x509_check_name(), x509_first(), x509_last(), and x509_name().

Referenced by tls_new_certificate().

◆ tls_new_certificate()

int tls_new_certificate	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Certificate handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2899 of file tls.c.

                                                                {
        const struct {
                tls24_t length;
                uint8_t certificates[0];
        } __attribute__ (( packed )) *certificate = data;
        size_t certificates_len;
        int rc;
 
        /* Parse header */
        if ( sizeof ( *certificate ) > len ) {
                DBGC ( tls, "TLS %p received underlength Server Certificate\n",
                       tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_CERTIFICATES;
        }
        certificates_len = tls_uint24 ( &certificate->length );
        if ( certificates_len > ( len - sizeof ( *certificate ) ) ) {
                DBGC ( tls, "TLS %p received overlength Server Certificate\n",
                       tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_CERTIFICATES;
        }
 
        /* Parse certificate chain */
        if ( ( rc = tls_parse_chain ( tls, certificate->certificates,
                                      certificates_len ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, data, DBGC, DBGC_HD, EINVAL_CERTIFICATES, len, length, rc, tls_parse_chain(), and tls_uint24().

Referenced by tls_new_handshake().

◆ tls_new_server_key_exchange()

int tls_new_server_key_exchange	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Key Exchange handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2939 of file tls.c.

                                                                        {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
        struct tls_cipher_suite *suite = cipherspec->suite;
        int rc;
 
        /* Parse via key exchange algorithm */
        if ( ( rc = suite->exchange->server ( tls, data, len ) ) != 0 )
                return rc;
 
        return 0;
}

References tls_tx::cipherspec, data, tls_cipher_suite::exchange, len, tls_cipherspec_pair::pending, rc, tls_key_exchange_algorithm::server, tls_cipherspec::suite, and tls_connection::tx.

Referenced by tls_new_handshake().

◆ tls_new_certificate_request()

int tls_new_certificate_request	(	struct tls_connection *	tls,
		const void *data	__unused,
		size_t len	__unused )

static

Receive new Certificate Request handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 2960 of file tls.c.

                                                               {
        struct x509_certificate *cert;
        int rc;
 
        /* We can only send a single certificate, so there is no point
         * in parsing the Certificate Request.
         */
 
        /* Free any existing client certificate chain */
        x509_chain_put ( tls->client.chain );
        tls->client.chain = NULL;
 
        /* Create client certificate chain */
        tls->client.chain = x509_alloc_chain();
        if ( ! tls->client.chain ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
 
        /* Determine client certificate to be sent, if any */
        cert = x509_find_key ( NULL, tls->client.key );
        if ( cert ) {
                DBGC ( tls, "TLS %p selected client certificate %s\n",
                       tls, x509_name ( cert ) );
 
                /* Append client certificate to chain */
                if ( ( rc = x509_append ( tls->client.chain, cert ) ) != 0 )
                        goto err_append;
 
                /* Append any relevant issuer certificates */
                if ( ( rc = x509_auto_append ( tls->client.chain,
                                               &certstore ) ) != 0 )
                        goto err_auto_append;
        } else {
 
                /* Send an empty certificate chain */
                DBGC ( tls, "TLS %p could not find certificate corresponding "
                       "to private key\n", tls );
        }
 
        return 0;
 
 err_auto_append:
 err_append:
        x509_chain_put ( tls->client.chain );
        tls->client.chain = NULL;
 err_alloc:
        return rc;
}

References __unused, certstore, tls_client::chain, tls_connection::client, data, DBGC, ENOMEM, tls_client::key, len, NULL, rc, x509_alloc_chain(), x509_append(), x509_auto_append(), x509_chain_put(), x509_find_key(), and x509_name().

Referenced by tls_new_handshake().

◆ tls_new_server_hello_done()

int tls_new_server_hello_done	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Server Hello Done handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 3020 of file tls.c.

                                                                      {
        const struct {
                char next[0];
        } __attribute__ (( packed )) *hello_done = data;
        int rc;
 
        /* Sanity check */
        if ( sizeof ( *hello_done ) != len ) {
                DBGC ( tls, "TLS %p received overlength Server Hello Done\n",
                       tls );
                DBGC_HD ( tls, data, len );
                return -EINVAL_HELLO_DONE;
        }
 
        /* Begin certificate validation */
        if ( ( rc = create_validator ( &tls->server.validator,
                                       tls->server.chain,
                                       tls->server.root ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not start certificate validation: "
                       "%s\n", tls, strerror ( rc ) );
                return rc;
        }
        pending_get ( &tls->server.validation );
 
        return 0;
}

References __attribute__, tls_server::chain, create_validator(), data, DBGC, DBGC_HD, EINVAL_HELLO_DONE, len, next, pending_get(), rc, tls_server::root, tls_connection::server, strerror(), tls_server::validation, and tls_server::validator.

Referenced by tls_new_handshake().

◆ tls_new_finished()

int tls_new_finished	(	struct tls_connection *	tls,
		const void *	data,
		size_t	len )

static

Receive new Finished handshake record.

Parameters

tls	TLS connection
data	Plaintext handshake record
len	Length of plaintext handshake record

Return values

rc	Return status code

Definition at line 3056 of file tls.c.

                                                             {
        struct tls_session *session = tls->session;
        struct tls_key_schedule *key = &tls->key;
        struct digest_algorithm *digest = tls->key.digest;
        const struct {
                uint8_t verify_data[ sizeof ( tls->verify.server ) ];
                char next[0];
        } __attribute__ (( packed )) *finished = data;
        uint8_t digest_out[ digest->digestsize ];
 
        /* Sanity checks */
        if ( ! ( digest->digestsize && key->keyed && key->bound ) ) {
                DBGC ( tls, "TLS %p received premature Finished\n", tls );
                DBGC_HDA ( tls, 0, data, len );
                return -EINVAL_FINISHED;
        }
        if ( sizeof ( *finished ) != len ) {
                DBGC ( tls, "TLS %p received overlength Finished\n", tls );
                DBGC_HDA ( tls, 0, data, len );
                return -EINVAL_FINISHED;
        }
 
        /* Verify data */
        tls_verify_handshake ( tls, digest_out );
        tls_prf_label ( tls, tls->verify.server, sizeof ( tls->verify.server ),
                        "server finished", digest_out, sizeof ( digest_out ) );
        if ( memcmp ( tls->verify.server, finished->verify_data,
                      sizeof ( tls->verify.server ) ) != 0 ) {
                DBGC ( tls, "TLS %p verification failed\n", tls );
                return -EPERM_VERIFY;
        }
 
        /* Mark server as finished */
        pending_put ( &tls->server.negotiation );
 
        /* If we are resuming a session (i.e. if the server Finished
         * arrives before the client Finished is sent), then schedule
         * transmission of Change Cipher and Finished.
         */
        if ( is_pending ( &tls->client.negotiation ) ) {
                tls->tx.pending |= ( TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED );
                tls_tx_resume ( tls );
        }
 
        /* Record session ID, ticket, and master secret, if applicable */
        if ( x509_is_valid ( key->bound, tls->server.root ) &&
             ( tls->session_id_len || tls->new_session_ticket_len ) ) {
                tls_generate_resumption_master ( tls );
                session->extended_master_secret = tls->extended_master_secret;
                x509_put ( session->cert );
                session->cert = x509_get ( key->bound );
                if ( tls->session_id_len ) {
                        session->id_len = tls->session_id_len;
                        memcpy ( session->id, tls->session_id,
                                 sizeof ( session->id ) );
                }
                if ( tls->new_session_ticket_len ) {
                        zfree ( session->ticket );
                        session->ticket = tls->new_session_ticket;
                        session->ticket_len = tls->new_session_ticket_len;
                        tls->new_session_ticket = NULL;
                        tls->new_session_ticket_len = 0;
                }
        }
 
        /* Move to end of session's connection list and allow other
         * connections to start making progress.
         */
        list_del ( &tls->list );
        list_add_tail ( &tls->list, &session->conn );
        tls_tx_resume_all ( session );
 
        /* Send notification of a window change */
        xfer_window_changed ( &tls->plainstream );
 
        return 0;
}

References __attribute__, tls_session::cert, tls_connection::client, tls_session::conn, data, DBGC, DBGC_HDA, tls_key_schedule::digest, digest_algorithm::digestsize, EINVAL_FINISHED, EPERM_VERIFY, tls_connection::extended_master_secret, tls_session::extended_master_secret, tls_session::id, tls_session::id_len, is_pending(), key, tls_connection::key, len, tls_connection::list, list_add_tail, list_del, memcmp(), memcpy(), tls_client::negotiation, tls_server::negotiation, tls_connection::new_session_ticket, tls_connection::new_session_ticket_len, next, NULL, tls_tx::pending, pending_put(), tls_connection::plainstream, tls_server::root, tls_connection::server, tls_verify_data::server, tls_connection::session, tls_connection::session_id, tls_connection::session_id_len, tls_session::ticket, tls_session::ticket_len, tls_generate_resumption_master(), tls_prf_label, TLS_TX_CHANGE_CIPHER, TLS_TX_FINISHED, tls_tx_resume(), tls_tx_resume_all(), tls_verify_handshake(), tls_connection::tx, tls_connection::verify, x509_get(), x509_is_valid(), x509_put(), xfer_window_changed(), and zfree().

Referenced by tls_new_handshake().

◆ tls_new_handshake()

int tls_new_handshake	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf )

static

Receive new Handshake record.

Parameters

tls	TLS connection
iobuf	I/O buffer

Return values

rc	Return status code

Definition at line 3142 of file tls.c.

                                                         {
        size_t remaining;
        int rc;
 
        while ( ( remaining = iob_len ( iobuf ) ) ) {
                const struct {
                        uint8_t type;
                        tls24_t length;
                        uint8_t payload[0];
                } __attribute__ (( packed )) *handshake = iobuf->data;
                const void *payload;
                size_t payload_len;
                size_t record_len;
 
                /* Parse header */
                if ( sizeof ( *handshake ) > remaining ) {
                        /* Leave remaining fragment unconsumed */
                        break;
                }
                payload_len = tls_uint24 ( &handshake->length );
                if ( payload_len > ( remaining - sizeof ( *handshake ) ) ) {
                        /* Leave remaining fragment unconsumed */
                        break;
                }
                payload = &handshake->payload;
                record_len = ( sizeof ( *handshake ) + payload_len );
 
                /* Handle payload */
                switch ( handshake->type ) {
                case TLS_HELLO_REQUEST:
                        rc = tls_new_hello_request ( tls, payload,
                                                     payload_len );
                        break;
                case TLS_SERVER_HELLO:
                        rc = tls_new_server_hello ( tls, payload, payload_len );
                        break;
                case TLS_NEW_SESSION_TICKET:
                        rc = tls_new_session_ticket ( tls, payload,
                                                      payload_len );
                        break;
                case TLS_CERTIFICATE:
                        rc = tls_new_certificate ( tls, payload, payload_len );
                        break;
                case TLS_SERVER_KEY_EXCHANGE:
                        rc = tls_new_server_key_exchange ( tls, payload,
                                                           payload_len );
                        break;
                case TLS_CERTIFICATE_REQUEST:
                        rc = tls_new_certificate_request ( tls, payload,
                                                           payload_len );
                        break;
                case TLS_SERVER_HELLO_DONE:
                        rc = tls_new_server_hello_done ( tls, payload,
                                                         payload_len );
                        break;
                case TLS_FINISHED:
                        rc = tls_new_finished ( tls, payload, payload_len );
                        break;
                default:
                        DBGC ( tls, "TLS %p ignoring handshake type %d\n",
                               tls, handshake->type );
                        rc = 0;
                        break;
                }
 
                /* Add to handshake digest (except for Hello Requests,
                 * which are explicitly excluded).
                 */
                if ( handshake->type != TLS_HELLO_REQUEST )
                        tls_add_handshake ( tls, handshake, record_len );
 
                /* Abort on failure */
                if ( rc != 0 )
                        return rc;
 
                /* Move to next handshake record */
                iob_pull ( iobuf, record_len );
        }
 
        return 0;
}

References __attribute__, io_buffer::data, DBGC, iob_len(), iob_pull, length, rc, tls_add_handshake(), TLS_CERTIFICATE, TLS_CERTIFICATE_REQUEST, TLS_FINISHED, TLS_HELLO_REQUEST, tls_new_certificate(), tls_new_certificate_request(), tls_new_finished(), tls_new_hello_request(), tls_new_server_hello(), tls_new_server_hello_done(), tls_new_server_key_exchange(), TLS_NEW_SESSION_TICKET, tls_new_session_ticket(), TLS_SERVER_HELLO, TLS_SERVER_HELLO_DONE, TLS_SERVER_KEY_EXCHANGE, tls_uint24(), and type.

Referenced by tls_new_record().

◆ tls_new_unknown()

int tls_new_unknown	(	struct tls_connection *tls	__unused,
		struct io_buffer *	iobuf )

static

Receive new unknown record.

Parameters

tls	TLS connection
iobuf	I/O buffer

Return values

rc	Return status code

Definition at line 3232 of file tls.c.

                                                       {
 
        /* RFC4346 says that we should just ignore unknown record types */
        iob_pull ( iobuf, iob_len ( iobuf ) );
        return 0;
}

References __unused, iob_len(), and iob_pull.

Referenced by tls_new_record().

◆ tls_new_data()

int tls_new_data	(	struct tls_connection *	tls,
		struct list_head *	rx_data )

static

Receive new data record.

Parameters

tls	TLS connection
rx_data	List of received data buffers

Return values

rc	Return status code

Definition at line 3247 of file tls.c.

                                                      {
        struct io_buffer *iobuf;
        int rc;
 
        /* Fail unless we are ready to receive data */
        if ( ! tls_ready ( tls ) )
                return -ENOTCONN;
 
        /* Deliver each I/O buffer in turn */
        while ( ( iobuf = list_first_entry ( rx_data, struct io_buffer,
                                             list ) ) ) {
                list_del ( &iobuf->list );
                if ( ( rc = xfer_deliver_iob ( &tls->plainstream,
                                               iobuf ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not deliver data: "
                               "%s\n", tls, strerror ( rc ) );
                        return rc;
                }
        }
 
        return 0;
}

References DBGC, ENOTCONN, io_buffer::list, list_del, list_first_entry, tls_connection::plainstream, rc, strerror(), tls_ready(), and xfer_deliver_iob().

Referenced by tls_new_record().

◆ tls_new_record()

int tls_new_record	(	struct tls_connection *	tls,
		unsigned int	type,
		struct list_head *	rx_data )

static

Receive new record.

Parameters

tls	TLS connection
type	Record type
rx_data	List of received data buffers

Return values

rc	Return status code

Definition at line 3279 of file tls.c.

                                                        {
        int ( * handler ) ( struct tls_connection *tls,
                            struct io_buffer *iobuf );
        struct io_buffer *tmp = NULL;
        struct io_buffer **iobuf;
        int rc;
 
        /* Deliver data records as-is to the plainstream interface */
        if ( type == TLS_TYPE_DATA )
                return tls_new_data ( tls, rx_data );
 
        /* Determine handler and fragment buffer */
        iobuf = &tmp;
        switch ( type ) {
        case TLS_TYPE_CHANGE_CIPHER:
                handler = tls_new_change_cipher;
                break;
        case TLS_TYPE_ALERT:
                handler = tls_new_alert;
                break;
        case TLS_TYPE_HANDSHAKE:
                handler = tls_new_handshake;
                iobuf = &tls->rx.handshake;
                break;
        default:
                DBGC ( tls, "TLS %p unknown record type %d\n", tls, type );
                handler = tls_new_unknown;
                break;
        }
 
        /* Merge into a single I/O buffer */
        if ( *iobuf )
                list_add ( &(*iobuf)->list, rx_data );
        *iobuf = iob_concatenate ( rx_data );
        if ( ! *iobuf ) {
                DBGC ( tls, "TLS %p could not concatenate non-data record "
                       "type %d\n", tls, type );
                rc = -ENOMEM_RX_CONCAT;
                goto err_concatenate;
        }
 
        /* Handle record */
        if ( ( rc = handler ( tls, *iobuf ) ) != 0 )
                goto err_handle;
 
        /* Discard I/O buffer if empty */
        if ( ! iob_len ( *iobuf ) ) {
                free_iob ( *iobuf );
                *iobuf = NULL;
        }
 
        /* Sanity check */
        assert ( tmp == NULL );
 
        return 0;
 
 err_handle:
        free_iob ( *iobuf );
        *iobuf = NULL;
 err_concatenate:
        return rc;
}

References assert, DBGC, ENOMEM_RX_CONCAT, free_iob(), tls_rx::handshake, iob_concatenate(), iob_len(), list_add, NULL, rc, tls_connection::rx, tls_new_alert(), tls_new_change_cipher(), tls_new_data(), tls_new_handshake(), tls_new_unknown(), TLS_TYPE_ALERT, TLS_TYPE_CHANGE_CIPHER, TLS_TYPE_DATA, TLS_TYPE_HANDSHAKE, tmp, and type.

Referenced by tls_new_ciphertext().

◆ tls_hmac_init()

void tls_hmac_init	(	struct tls_cipherspec *	cipherspec,
		void *	ctx,
		struct tls_auth_header *	authhdr )

static

Initialise HMAC.

Parameters

cipherspec	Cipher specification
ctx	Context
authhdr	Authentication header

Definition at line 3357 of file tls.c.

                                                              {
        struct tls_cipher_suite *suite = cipherspec->suite;
        struct digest_algorithm *digest = suite->digest;
 
        hmac_init ( digest, ctx, cipherspec->mac_secret, suite->mac_len );
        hmac_update ( digest, ctx, authhdr, sizeof ( *authhdr ) );
}

References ctx, tls_cipher_suite::digest, hmac_init(), hmac_update(), tls_cipher_suite::mac_len, tls_cipherspec::mac_secret, and tls_cipherspec::suite.

Referenced by tls_hmac(), and tls_hmac_list().

◆ tls_hmac_update()

void tls_hmac_update	(	struct tls_cipherspec *	cipherspec,
		void *	ctx,
		const void *	data,
		size_t	len )

static

Update HMAC.

Parameters

cipherspec	Cipher specification
ctx	Context
data	Data
len	Length of data

Definition at line 3374 of file tls.c.

                                                             {
        struct digest_algorithm *digest = cipherspec->suite->digest;
 
        hmac_update ( digest, ctx, data, len );
}

References ctx, data, tls_cipher_suite::digest, hmac_update(), len, and tls_cipherspec::suite.

Referenced by tls_hmac(), and tls_hmac_list().

◆ tls_hmac_final()

void tls_hmac_final	(	struct tls_cipherspec *	cipherspec,
		void *	ctx,
		void *	hmac )

static

Finalise HMAC.

Parameters

cipherspec	Cipher specification
ctx	Context
mac	HMAC to fill in

Definition at line 3388 of file tls.c.

                                          {
        struct digest_algorithm *digest = cipherspec->suite->digest;
 
        hmac_final ( digest, ctx, hmac );
}

References ctx, tls_cipher_suite::digest, hmac_final(), and tls_cipherspec::suite.

Referenced by tls_hmac(), and tls_hmac_list().

◆ tls_hmac()

void tls_hmac	(	struct tls_cipherspec *	cipherspec,
		struct tls_auth_header *	authhdr,
		const void *	data,
		size_t	len,
		void *	hmac )

static

Calculate HMAC.

Parameters

cipherspec	Cipher specification
authhdr	Authentication header
data	Data
len	Length of data
mac	HMAC to fill in

Definition at line 3404 of file tls.c.

                                                                  {
        struct digest_algorithm *digest = cipherspec->suite->digest;
        uint8_t ctx[ hmac_ctxsize ( digest ) ];
 
        tls_hmac_init ( cipherspec, ctx, authhdr );
        tls_hmac_update ( cipherspec, ctx, data, len );
        tls_hmac_final ( cipherspec, ctx, hmac );
}

References ctx, data, tls_cipher_suite::digest, hmac_ctxsize(), len, tls_cipherspec::suite, tls_hmac_final(), tls_hmac_init(), and tls_hmac_update().

Referenced by tls_send_record().

◆ tls_hmac_list()

void tls_hmac_list	(	struct tls_cipherspec *	cipherspec,
		struct tls_auth_header *	authhdr,
		struct list_head *	list,
		void *	hmac )

static

Calculate HMAC over list of I/O buffers.

Parameters

cipherspec	Cipher specification
authhdr	Authentication header
list	List of I/O buffers
mac	HMAC to fill in

Definition at line 3423 of file tls.c.

                                                                 {
        struct digest_algorithm *digest = cipherspec->suite->digest;
        uint8_t ctx[ hmac_ctxsize ( digest ) ];
        struct io_buffer *iobuf;
 
        tls_hmac_init ( cipherspec, ctx, authhdr );
        list_for_each_entry ( iobuf, list, list ) {
                tls_hmac_update ( cipherspec, ctx, iobuf->data,
                                  iob_len ( iobuf ) );
        }
        tls_hmac_final ( cipherspec, ctx, hmac );
}

References ctx, io_buffer::data, tls_cipher_suite::digest, hmac_ctxsize(), iob_len(), io_buffer::list, list_for_each_entry, tls_cipherspec::suite, tls_hmac_final(), tls_hmac_init(), and tls_hmac_update().

Referenced by tls_new_ciphertext().

◆ tls_iob_reserved()

size_t tls_iob_reserved	(	struct tls_connection *	tls,
		size_t	len )

static

Calculate maximum additional length required for transmitted record(s).

Parameters

tls	TLS connection
len	I/O buffer payload length

Return values

reserve Maximum additional length to reserve

Definition at line 3445 of file tls.c.

                                                                          {
        struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active;
        struct tls_cipher_suite *suite = cipherspec->suite;
        struct cipher_algorithm *cipher = suite->cipher;
        struct tls_header *tlshdr;
        unsigned int count;
        size_t each;
 
        /* Calculate number of records (allowing for zero-length records) */
        count = ( len ? ( ( len + TLS_TX_BUFSIZE - 1 ) / TLS_TX_BUFSIZE ) : 1 );
 
        /* Calculate maximum additional length per record */
        each = ( sizeof ( *tlshdr ) + suite->record_iv_len + suite->mac_len +
                 ( is_block_cipher ( cipher ) ? cipher->blocksize : 0 ) +
                 cipher->authsize );
 
        /* Calculate maximum total additional length */
        return ( count * each );
}

References tls_cipherspec_pair::active, cipher_algorithm::authsize, cipher_algorithm::blocksize, tls_cipher_suite::cipher, tls_tx::cipherspec, count, is_block_cipher(), len, tls_cipher_suite::mac_len, tls_cipher_suite::record_iv_len, tls_cipherspec::suite, TLS_TX_BUFSIZE, and tls_connection::tx.

Referenced by tls_alloc_iob(), and tls_send_record().

◆ tls_verify_padding()

int tls_verify_padding	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf )

static

Verify block padding.

Parameters

tls	TLS connection
iobuf	Last received I/O buffer

Return values

len	Padding length, or negative error
rc	Return status code

Definition at line 3672 of file tls.c.

                                                          {
        uint8_t *padding;
        unsigned int pad;
        unsigned int i;
        size_t len;
 
        /* Extract and verify padding */
        padding = ( iobuf->tail - 1 );
        pad = *padding;
        len = ( pad + 1 );
        if ( len > iob_len ( iobuf ) ) {
                DBGC ( tls, "TLS %p received underlength padding\n", tls );
                DBGC_HD ( tls, iobuf->data, iob_len ( iobuf ) );
                return -EINVAL_PADDING;
        }
        for ( i = 0 ; i < pad ; i++ ) {
                if ( *(--padding) != pad ) {
                        DBGC ( tls, "TLS %p received bad padding\n", tls );
                        DBGC_HD ( tls, iobuf->data, iob_len ( iobuf ) );
                        return -EINVAL_PADDING;
                }
        }
 
        return len;
}

References io_buffer::data, DBGC, DBGC_HD, EINVAL_PADDING, iob_len(), len, pad, and io_buffer::tail.

Referenced by tls_new_ciphertext().

◆ tls_new_ciphertext()

int tls_new_ciphertext	(	struct tls_connection *	tls,
		struct tls_header *	tlshdr,
		struct list_head *	rx_data )

static

Receive new ciphertext record.

Parameters

tls	TLS connection
tlshdr	Record header
rx_data	List of received data buffers

Return values

rc	Return status code

Definition at line 3707 of file tls.c.

                                                            {
        struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active;
        struct tls_cipher_suite *suite = cipherspec->suite;
        struct cipher_algorithm *cipher = suite->cipher;
        struct digest_algorithm *digest = suite->digest;
        size_t len = ntohs ( tlshdr->length );
        struct {
                uint8_t fixed[suite->fixed_iv_len];
                uint8_t record[suite->record_iv_len];
        } __attribute__ (( packed )) iv;
        struct tls_auth_header authhdr;
        uint8_t verify_mac[digest->digestsize];
        uint8_t verify_auth[cipher->authsize];
        struct io_buffer *first;
        struct io_buffer *last;
        struct io_buffer *iobuf;
        void *mac;
        void *auth;
        size_t check_len;
        int pad_len;
        int rc;
 
        /* Locate first and last data buffers */
        assert ( ! list_empty ( rx_data ) );
        first = list_first_entry ( rx_data, struct io_buffer, list );
        last = list_last_entry ( rx_data, struct io_buffer, list );
 
        /* Extract initialisation vector */
        if ( iob_len ( first ) < sizeof ( iv.record ) ) {
                DBGC ( tls, "TLS %p received underlength IV\n", tls );
                DBGC_HD ( tls, first->data, iob_len ( first ) );
                return -EINVAL_IV;
        }
        memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) );
        memcpy ( iv.record, first->data, sizeof ( iv.record ) );
        iob_pull ( first, sizeof ( iv.record ) );
        len -= sizeof ( iv.record );
 
        /* Extract unencrypted authentication tag */
        if ( iob_len ( last ) < cipher->authsize ) {
                DBGC ( tls, "TLS %p received underlength authentication tag\n",
                       tls );
                DBGC_HD ( tls, last->data, iob_len ( last ) );
                return -EINVAL_MAC;
        }
        iob_unput ( last, cipher->authsize );
        len -= cipher->authsize;
        auth = last->tail;
 
        /* Construct authentication data */
        authhdr.seq = cpu_to_be64 ( tls->rx.seq );
        authhdr.header.type = tlshdr->type;
        authhdr.header.version = tlshdr->version;
        authhdr.header.length = htons ( len );
 
        /* Set initialisation vector */
        if ( ( rc = cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv,
                                   sizeof ( iv ) ) ) != 0 ) {
                DBGC ( tls, "TLS %p could not set RX IV: %s\n",
                       tls, strerror ( rc ) );
                return rc;
        }
 
        /* Process authentication data, if applicable */
        if ( is_auth_cipher ( cipher ) ) {
                cipher_decrypt ( cipher, cipherspec->cipher_ctx, &authhdr,
                                 NULL, sizeof ( authhdr ) );
        }
 
        /* Decrypt the received data */
        check_len = 0;
        list_for_each_entry ( iobuf, &tls->rx.data, list ) {
                cipher_decrypt ( cipher, cipherspec->cipher_ctx,
                                 iobuf->data, iobuf->data, iob_len ( iobuf ) );
                check_len += iob_len ( iobuf );
        }
        assert ( check_len == len );
 
        /* Strip block padding, if applicable */
        if ( is_block_cipher ( cipher ) ) {
                pad_len = tls_verify_padding ( tls, last );
                if ( pad_len < 0 ) {
                        /* Assume zero padding length to avoid timing attacks */
                        pad_len = 0;
                }
                iob_unput ( last, pad_len );
                len -= pad_len;
        }
 
        /* Extract decrypted MAC */
        if ( iob_len ( last ) < suite->mac_len ) {
                DBGC ( tls, "TLS %p received underlength MAC\n", tls );
                DBGC_HD ( tls, last->data, iob_len ( last ) );
                return -EINVAL_MAC;
        }
        iob_unput ( last, suite->mac_len );
        len -= suite->mac_len;
        mac = last->tail;
 
        /* Dump received data */
        DBGC2 ( tls, "Received plaintext data:\n" );
        check_len = 0;
        list_for_each_entry ( iobuf, rx_data, list ) {
                DBGC2_HD ( tls, iobuf->data, iob_len ( iobuf ) );
                check_len += iob_len ( iobuf );
        }
        assert ( check_len == len );
 
        /* Generate MAC */
        authhdr.header.length = htons ( len );
        if ( suite->mac_len )
                tls_hmac_list ( cipherspec, &authhdr, rx_data, verify_mac );
 
        /* Generate authentication tag */
        cipher_auth ( cipher, cipherspec->cipher_ctx, verify_auth );
 
        /* Verify MAC */
        if ( memcmp ( mac, verify_mac, suite->mac_len ) != 0 ) {
                DBGC ( tls, "TLS %p failed MAC verification\n", tls );
                return -EINVAL_MAC;
        }
 
        /* Verify authentication tag */
        if ( memcmp ( auth, verify_auth, cipher->authsize ) != 0 ) {
                DBGC ( tls, "TLS %p failed authentication tag verification\n",
                       tls );
                return -EINVAL_MAC;
        }
 
        /* Process plaintext record */
        if ( ( rc = tls_new_record ( tls, tlshdr->type, rx_data ) ) != 0 )
                return rc;
 
        return 0;
}

References __attribute__, tls_cipherspec_pair::active, assert, cipher_algorithm::authsize, tls_cipher_suite::cipher, cipher_auth(), tls_cipherspec::cipher_ctx, cipher_decrypt, cipher_setiv(), tls_rx::cipherspec, cpu_to_be64, io_buffer::data, tls_rx::data, DBGC, DBGC2, DBGC2_HD, DBGC_HD, tls_cipher_suite::digest, digest_algorithm::digestsize, EINVAL_IV, EINVAL_MAC, first, fixed, tls_cipherspec::fixed_iv, tls_cipher_suite::fixed_iv_len, tls_auth_header::header, htons, iob_len(), iob_pull, iob_unput, is_auth_cipher(), is_block_cipher(), iv, len, tls_header::length, io_buffer::list, list_empty, list_first_entry, list_for_each_entry, list_last_entry, mac, tls_cipher_suite::mac_len, memcmp(), memcpy(), ntohs, NULL, rc, tls_cipher_suite::record_iv_len, tls_connection::rx, tls_auth_header::seq, tls_rx::seq, strerror(), tls_cipherspec::suite, io_buffer::tail, tls_hmac_list(), tls_new_record(), tls_verify_padding(), tls_header::type, and tls_header::version.

Referenced by tls_newdata_process_data().

◆ tls_plainstream_window()

size_t tls_plainstream_window ( struct tls_connection * tls )

static

Check flow control window.

Parameters

tls	TLS connection

Return values

len	Length of window

Definition at line 3858 of file tls.c.

                                                                    {
 
        /* Block window unless we are ready to accept data */
        if ( ! tls_ready ( tls ) )
                return 0;
 
        return xfer_window ( &tls->cipherstream );
}

References tls_connection::cipherstream, tls_ready(), and xfer_window().

◆ tls_plainstream_deliver()

int tls_plainstream_deliver	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf,
		struct xfer_metadata *meta	__unused )

static

Deliver datagram as raw data.

Parameters

tls	TLS connection
iobuf	I/O buffer
meta	Data transfer metadata

Return values

rc	Return status code

Definition at line 3875 of file tls.c.

                                                                           {
        int rc;
        
        /* Refuse unless we are ready to accept data */
        if ( ! tls_ready ( tls ) ) {
                rc = -ENOTCONN;
                goto done;
        }
 
        /* Send data record */
        if ( ( rc = tls_send_record ( tls, TLS_TYPE_DATA,
                                      iob_disown ( iobuf ) ) ) != 0 )
                goto done;
 
 done:
        free_iob ( iobuf );
        return rc;
}

References __unused, done, ENOTCONN, free_iob(), iob_disown, meta, rc, tls_ready(), tls_send_record(), and TLS_TYPE_DATA.

◆ tls_progress()

int tls_progress	(	struct tls_connection *	tls,
		struct job_progress *	progress )

static

Report job progress.

Parameters

tls	TLS connection
progress	Progress report to fill in

Return values

ongoing_rc Ongoing job status code (if known)

Definition at line 3903 of file tls.c.

                                                          {
 
        /* Return cipherstream or validator progress as applicable */
        if ( is_pending ( &tls->server.validation ) ) {
                return job_progress ( &tls->server.validator, progress );
        } else {
                return job_progress ( &tls->cipherstream, progress );
        }
}

References tls_connection::cipherstream, is_pending(), job_progress(), tls_connection::server, tls_server::validation, and tls_server::validator.

◆ tls_newdata_process_header()

int tls_newdata_process_header ( struct tls_connection * tls )

static

Handle received TLS header.

Parameters

tls	TLS connection

Return values

rc	Returned status code

Definition at line 3943 of file tls.c.

                                                                     {
        struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active;
        struct cipher_algorithm *cipher = cipherspec->suite->cipher;
        size_t iv_len = cipherspec->suite->record_iv_len;
        size_t data_len = ntohs ( tls->rx.header.length );
        size_t remaining = data_len;
        size_t frag_len;
        size_t reserve;
        struct io_buffer *iobuf;
        struct io_buffer *tmp;
        int rc;
 
        /* Sanity check */
        assert ( ( TLS_RX_BUFSIZE % cipher->alignsize ) == 0 );
 
        /* Calculate alignment reservation at start of first data buffer */
        reserve = ( ( -iv_len ) & ( cipher->alignsize - 1 ) );
        remaining += reserve;
 
        /* Allocate data buffers now that we know the length */
        assert ( list_empty ( &tls->rx.data ) );
        while ( remaining ) {
 
                /* Calculate fragment length.  Ensure that no block is
                 * smaller than TLS_RX_MIN_BUFSIZE (by increasing the
                 * allocation length if necessary).
                 */
                frag_len = remaining;
                if ( frag_len > TLS_RX_BUFSIZE )
                        frag_len = TLS_RX_BUFSIZE;
                remaining -= frag_len;
                if ( remaining < TLS_RX_MIN_BUFSIZE ) {
                        frag_len += remaining;
                        remaining = 0;
                }
 
                /* Allocate buffer */
                iobuf = alloc_iob_raw ( frag_len, TLS_RX_ALIGN, 0 );
                if ( ! iobuf ) {
                        DBGC ( tls, "TLS %p could not allocate %zd of %zd "
                               "bytes for receive buffer\n", tls,
                               remaining, data_len );
                        rc = -ENOMEM_RX_DATA;
                        goto err;
                }
 
                /* Ensure tailroom is exactly what we asked for.  This
                 * will result in unaligned I/O buffers when the
                 * fragment length is unaligned, which can happen only
                 * before we switch to using a block cipher.
                 */
                iob_reserve ( iobuf, ( iob_tailroom ( iobuf ) - frag_len ) );
 
                /* Ensure first buffer length will be aligned to a
                 * multiple of the cipher alignment size after
                 * stripping the record IV.
                 */
                iob_reserve ( iobuf, reserve );
                reserve = 0;
 
                /* Add I/O buffer to list */
                list_add_tail ( &iobuf->list, &tls->rx.data );
        }
 
        /* Move to data state */
        tls->rx.state = TLS_RX_DATA;
 
        return 0;
 
 err:
        list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) {
                list_del ( &iobuf->list );
                free_iob ( iobuf );
        }
        return rc;
}

References tls_cipherspec_pair::active, cipher_algorithm::alignsize, alloc_iob_raw(), assert, tls_cipher_suite::cipher, tls_rx::cipherspec, tls_rx::data, data_len, DBGC, ENOMEM_RX_DATA, free_iob(), tls_rx::header, iob_reserve, iob_tailroom(), tls_header::length, io_buffer::list, list_add_tail, list_del, list_empty, list_for_each_entry_safe, ntohs, rc, tls_cipher_suite::record_iv_len, tls_connection::rx, tls_rx::state, tls_cipherspec::suite, TLS_RX_ALIGN, TLS_RX_BUFSIZE, TLS_RX_DATA, TLS_RX_MIN_BUFSIZE, and tmp.

Referenced by tls_cipherstream_deliver().

◆ tls_newdata_process_data()

int tls_newdata_process_data ( struct tls_connection * tls )

static

Handle received TLS data payload.

Parameters

tls	TLS connection

Return values

rc	Returned status code

Definition at line 4026 of file tls.c.

                                                                   {
        struct io_buffer *iobuf;
        int rc;
 
        /* Move current buffer to end of list */
        iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list );
        list_del ( &iobuf->list );
        list_add_tail ( &iobuf->list, &tls->rx.data );
 
        /* Continue receiving data if any space remains */
        iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list );
        if ( iob_tailroom ( iobuf ) )
                return 0;
 
        /* Process record */
        if ( ( rc = tls_new_ciphertext ( tls, &tls->rx.header,
                                         &tls->rx.data ) ) != 0 )
                return rc;
 
        /* Increment RX sequence number */
        tls->rx.seq += 1;
 
        /* Return to header state */
        assert ( list_empty ( &tls->rx.data ) );
        tls->rx.state = TLS_RX_HEADER;
        iob_unput ( &tls->rx.iobuf, sizeof ( tls->rx.header ) );
 
        return 0;
}

References assert, tls_rx::data, tls_rx::header, iob_tailroom(), iob_unput, tls_rx::iobuf, io_buffer::list, list_add_tail, list_del, list_empty, list_first_entry, rc, tls_connection::rx, tls_rx::seq, tls_rx::state, tls_new_ciphertext(), and TLS_RX_HEADER.

Referenced by tls_cipherstream_deliver().

◆ tls_cipherstream_window()

size_t tls_cipherstream_window ( struct tls_connection * tls )

static

Check flow control window.

Parameters

tls	TLS connection

Return values

len	Length of window

Definition at line 4062 of file tls.c.

                                                                     {
 
        /* Open window until we are ready to accept data */
        if ( ! tls_ready ( tls ) )
                return -1UL;
 
        return xfer_window ( &tls->plainstream );
}

References tls_connection::plainstream, tls_ready(), and xfer_window().

◆ tls_cipherstream_deliver()

int tls_cipherstream_deliver	(	struct tls_connection *	tls,
		struct io_buffer *	iobuf,
		struct xfer_metadata *xfer	__unused )

static

Receive new ciphertext.

Parameters

tls	TLS connection
iobuf	I/O buffer
meta	Data transfer metadat

Return values

rc	Return status code

Definition at line 4079 of file tls.c.

                                                                            {
        size_t frag_len;
        int ( * process ) ( struct tls_connection *tls );
        struct io_buffer *dest;
        int rc;
 
        while ( iob_len ( iobuf ) ) {
 
                /* Select buffer according to current state */
                switch ( tls->rx.state ) {
                case TLS_RX_HEADER:
                        dest = &tls->rx.iobuf;
                        process = tls_newdata_process_header;
                        break;
                case TLS_RX_DATA:
                        dest = list_first_entry ( &tls->rx.data,
                                                  struct io_buffer, list );
                        assert ( dest != NULL );
                        process = tls_newdata_process_data;
                        break;
                default:
                        assert ( 0 );
                        rc = -EINVAL_RX_STATE;
                        goto done;
                }
 
                /* Copy data portion to buffer */
                frag_len = iob_len ( iobuf );
                if ( frag_len > iob_tailroom ( dest ) )
                        frag_len = iob_tailroom ( dest );
                memcpy ( iob_put ( dest, frag_len ), iobuf->data, frag_len );
                iob_pull ( iobuf, frag_len );
 
                /* Process data if buffer is now full */
                if ( iob_tailroom ( dest ) == 0 ) {
                        if ( ( rc = process ( tls ) ) != 0 ) {
                                tls_close_alert ( tls, rc );
                                goto done;
                        }
                }
        }
        rc = 0;
 
 done:
        free_iob ( iobuf );
        return rc;
}

References __unused, assert, io_buffer::data, tls_rx::data, dest, done, EINVAL_RX_STATE, free_iob(), iob_len(), iob_pull, iob_put, iob_tailroom(), tls_rx::iobuf, io_buffer::list, list_first_entry, memcpy(), NULL, rc, tls_connection::rx, tls_rx::state, tls_close_alert(), tls_newdata_process_data(), tls_newdata_process_header(), TLS_RX_DATA, and TLS_RX_HEADER.

◆ tls_validator_done()

void tls_validator_done	(	struct tls_connection *	tls,
		int	rc )

static

Handle certificate validation completion.

Parameters

tls	TLS connection
rc	Reason for completion

Definition at line 4158 of file tls.c.

                                                                      {
 
        /* Mark validation as complete */
        pending_put ( &tls->server.validation );
 
        /* Close validator interface */
        intf_restart ( &tls->server.validator, rc );
 
        /* Check for validation failure */
        if ( rc != 0 ) {
                DBGC ( tls, "TLS %p certificate validation failed: %s\n",
                       tls, strerror ( rc ) );
                goto err;
        }
        DBGC ( tls, "TLS %p certificate validation succeeded\n", tls );
 
        /* Schedule transmission of applicable handshake messages */
        tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE |
                             TLS_TX_CHANGE_CIPHER |
                             TLS_TX_FINISHED );
        if ( tls->client.chain ) {
                tls->tx.pending |= TLS_TX_CERTIFICATE;
                if ( ! list_empty ( &tls->client.chain->links ) )
                        tls->tx.pending |= TLS_TX_CERTIFICATE_VERIFY;
        }
        tls_tx_resume ( tls );
 
        return;
 
 err:
        tls_close_alert ( tls, rc );
        return;
}

References tls_client::chain, tls_connection::client, DBGC, intf_restart(), x509_chain::links, list_empty, tls_tx::pending, pending_put(), rc, tls_connection::server, strerror(), tls_close_alert(), TLS_TX_CERTIFICATE, TLS_TX_CERTIFICATE_VERIFY, TLS_TX_CHANGE_CIPHER, TLS_TX_CLIENT_KEY_EXCHANGE, TLS_TX_FINISHED, tls_tx_resume(), tls_connection::tx, tls_server::validation, and tls_server::validator.

◆ tls_tx_step()

void tls_tx_step ( struct tls_connection * tls )

static

TLS TX state machine.

Parameters

tls	TLS connection

Definition at line 4214 of file tls.c.

                                                       {
        struct tls_session *session = tls->session;
        struct tls_connection *conn;
        int rc;
 
        /* Wait for cipherstream to become ready */
        if ( ! xfer_window ( &tls->cipherstream ) )
                return;
 
        /* Send first pending transmission */
        if ( tls->tx.pending & TLS_TX_CLIENT_HELLO ) {
                /* Serialise server negotiations within a session, to
                 * provide a consistent view of session IDs and
                 * session tickets.
                 */
                list_for_each_entry ( conn, &session->conn, list ) {
                        if ( conn == tls )
                                break;
                        if ( is_pending ( &conn->server.negotiation ) )
                                return;
                }
                /* Record or generate session ID and associated master secret */
                if ( session->id_len ) {
                        /* Attempt to resume an existing session */
                        memcpy ( tls->session_id, session->id,
                                 sizeof ( tls->session_id ) );
                        tls->session_id_len = session->id_len;
                } else {
                        /* No existing session: use a random session ID */
                        assert ( sizeof ( tls->session_id ) ==
                                 sizeof ( tls->client.random ) );
                        memcpy ( tls->session_id, &tls->client.random,
                                 sizeof ( tls->session_id ) );
                        tls->session_id_len = sizeof ( tls->session_id );
                }
                /* Send Client Hello */
                if ( ( rc = tls_send_client_hello ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not send Client Hello: %s\n",
                               tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.pending &= ~TLS_TX_CLIENT_HELLO;
        } else if ( tls->tx.pending & TLS_TX_CERTIFICATE ) {
                /* Send Certificate */
                if ( ( rc = tls_send_certificate ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p cold not send Certificate: %s\n",
                               tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.pending &= ~TLS_TX_CERTIFICATE;
        } else if ( tls->tx.pending & TLS_TX_CLIENT_KEY_EXCHANGE ) {
                /* Send Client Key Exchange */
                if ( ( rc = tls_send_client_key_exchange ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not send Client Key "
                               "Exchange: %s\n", tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.pending &= ~TLS_TX_CLIENT_KEY_EXCHANGE;
        } else if ( tls->tx.pending & TLS_TX_CERTIFICATE_VERIFY ) {
                /* Send Certificate Verify */
                if ( ( rc = tls_send_certificate_verify ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not send Certificate "
                               "Verify: %s\n", tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.pending &= ~TLS_TX_CERTIFICATE_VERIFY;
        } else if ( tls->tx.pending & TLS_TX_CHANGE_CIPHER ) {
                /* Send Change Cipher, and then change the cipher in use */
                if ( ( rc = tls_send_change_cipher ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not send Change Cipher: "
                               "%s\n", tls, strerror ( rc ) );
                        goto err;
                }
                if ( ( rc = tls_change_cipher ( tls,
                                                &tls->tx.cipherspec ) ) != 0 ){
                        DBGC ( tls, "TLS %p could not activate TX cipher: "
                               "%s\n", tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.seq = 0;
                tls->tx.pending &= ~TLS_TX_CHANGE_CIPHER;
        } else if ( tls->tx.pending & TLS_TX_FINISHED ) {
                /* Send Finished */
                if ( ( rc = tls_send_finished ( tls ) ) != 0 ) {
                        DBGC ( tls, "TLS %p could not send Finished: %s\n",
                               tls, strerror ( rc ) );
                        goto err;
                }
                tls->tx.pending &= ~TLS_TX_FINISHED;
        }
 
        /* Reschedule process if pending transmissions remain,
         * otherwise send notification of a window change.
         */
        if ( tls->tx.pending ) {
                tls_tx_resume ( tls );
        } else {
                xfer_window_changed ( &tls->plainstream );
        }
 
        return;
 
 err:
        tls_close_alert ( tls, rc );
}

References assert, tls_tx::cipherspec, tls_connection::cipherstream, tls_connection::client, tls_session::conn, DBGC, tls_session::id, tls_session::id_len, is_pending(), tls_connection::list, list_for_each_entry, memcpy(), tls_server::negotiation, tls_tx::pending, tls_connection::plainstream, tls_client::random, rc, tls_tx::seq, tls_connection::server, tls_connection::session, tls_connection::session_id, tls_connection::session_id_len, strerror(), tls_change_cipher(), tls_close_alert(), tls_send_certificate(), tls_send_certificate_verify(), tls_send_change_cipher(), tls_send_client_hello(), tls_send_client_key_exchange(), tls_send_finished(), TLS_TX_CERTIFICATE, TLS_TX_CERTIFICATE_VERIFY, TLS_TX_CHANGE_CIPHER, TLS_TX_CLIENT_HELLO, TLS_TX_CLIENT_KEY_EXCHANGE, TLS_TX_FINISHED, tls_tx_resume(), tls_connection::tx, xfer_window(), and xfer_window_changed().

◆ tls_session()

int tls_session	(	struct tls_connection *	tls,
		const char *	name )

static

Find or create session for TLS connection.

Parameters

tls	TLS connection
name	Server name

Return values

rc	Return status code

Definition at line 4338 of file tls.c.

                                                                        {
        struct tls_session *session;
        char *name_copy;
        int rc;
 
        /* Find existing matching session, if any */
        list_for_each_entry ( session, &tls_sessions, list ) {
                if ( ( strcmp ( name, session->name ) == 0 ) &&
                     ( tls->server.root == session->root ) &&
                     ( tls->client.key == session->key ) ) {
                        ref_get ( &session->refcnt );
                        tls->session = session;
                        DBGC ( tls, "TLS %p joining session %s\n", tls, name );
                        return 0;
                }
        }
 
        /* Create new session */
        session = zalloc ( sizeof ( *session ) + strlen ( name )
                           + 1 /* NUL */ );
        if ( ! session ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
        ref_init ( &session->refcnt, free_tls_session );
        name_copy = ( ( ( void * ) session ) + sizeof ( *session ) );
        strcpy ( name_copy, name );
        session->name = name_copy;
        session->root = x509_root_get ( tls->server.root );
        session->key = privkey_get ( tls->client.key );
        INIT_LIST_HEAD ( &session->conn );
        list_add ( &session->list, &tls_sessions );
 
        /* Poison resumption master secret */
        tls_ephemeral_label ( tls, "res poison",
                              session->resumption_master_secret,
                              sizeof ( session->resumption_master_secret ) );
 
        /* Record session */
        tls->session = session;
 
        DBGC ( tls, "TLS %p created session %s\n", tls, name );
        return 0;
 
        ref_put ( &session->refcnt );
 err_alloc:
        return rc;
}

References tls_connection::client, tls_session::conn, DBGC, ENOMEM, free_tls_session(), INIT_LIST_HEAD, tls_client::key, tls_session::key, tls_session::list, list_add, list_for_each_entry, name, tls_session::name, privkey_get(), rc, ref_get, ref_init, ref_put, tls_session::refcnt, tls_session::resumption_master_secret, tls_server::root, tls_session::root, tls_connection::server, tls_connection::session, strcmp(), strcpy(), strlen(), tls_ephemeral_label(), x509_root_get(), and zalloc().

◆ add_tls()

int add_tls	(	struct interface *	xfer,
		const char *	name,
		struct x509_root *	root,
		struct private_key *	key )

Add TLS on an interface.

Parameters

xfer	Data transfer interface
name	Host name
root	Root of trust (or NULL to use default)
key	Private key (or NULL to use default)

Return values

rc	Return status code

Definition at line 4403 of file tls.c.

                                                                {
        struct tls_connection *tls;
        int rc;
 
        /* Allocate and initialise TLS structure */
        tls = malloc ( sizeof ( *tls ) );
        if ( ! tls ) {
                rc = -ENOMEM;
                goto err_alloc;
        }
        memset ( tls, 0, sizeof ( *tls ) );
        ref_init ( &tls->refcnt, free_tls );
        INIT_LIST_HEAD ( &tls->list );
        intf_init ( &tls->plainstream, &tls_plainstream_desc, &tls->refcnt );
        intf_init ( &tls->cipherstream, &tls_cipherstream_desc, &tls->refcnt );
        intf_init ( &tls->server.validator, &tls_validator_desc, &tls->refcnt );
        process_init_stopped ( &tls->tx.process, &tls_process_desc,
                               &tls->refcnt );
        tls->client.key = privkey_get ( key ? key : &private_key );
        tls->server.root = x509_root_get ( root ? root : &root_certificates );
        tls->version = TLS_VERSION_MAX;
        tls_clear_cipher ( tls, &tls->tx.cipherspec.active );
        tls_clear_cipher ( tls, &tls->tx.cipherspec.pending );
        tls_clear_cipher ( tls, &tls->rx.cipherspec.active );
        tls_clear_cipher ( tls, &tls->rx.cipherspec.pending );
        tls_clear_digest ( tls );
        iob_populate ( &tls->rx.iobuf, &tls->rx.header, 0,
                       sizeof ( tls->rx.header ) );
        INIT_LIST_HEAD ( &tls->rx.data );
        if ( ( rc = tls_generate_ephemeral_master ( tls ) ) != 0 )
                goto err_ephemeral;
        if ( ( rc = tls_session ( tls, name ) ) != 0 )
                goto err_session;
        list_add_tail ( &tls->list, &tls->session->conn );
 
        /* Start negotiation */
        tls_restart ( tls );
 
        /* Attach to parent interface, mortalise self, and return */
        intf_insert ( xfer, &tls->plainstream, &tls->cipherstream );
        ref_put ( &tls->refcnt );
        return 0;
 
 err_session:
 err_ephemeral:
        ref_put ( &tls->refcnt );
 err_alloc:
        return rc;
}

References tls_cipherspec_pair::active, tls_rx::cipherspec, tls_tx::cipherspec, tls_connection::cipherstream, tls_connection::client, tls_session::conn, tls_rx::data, ENOMEM, free_tls(), tls_rx::header, INIT_LIST_HEAD, intf_init(), intf_insert(), iob_populate(), tls_rx::iobuf, key, tls_client::key, tls_connection::list, list_add_tail, malloc(), memset(), name, tls_cipherspec_pair::pending, tls_connection::plainstream, privkey_get(), tls_tx::process, process_init_stopped(), rc, ref_init, ref_put, tls_connection::refcnt, root, tls_server::root, root_certificates, tls_connection::rx, tls_connection::server, tls_connection::session, tls_cipherstream_desc, tls_clear_cipher(), tls_clear_digest(), tls_generate_ephemeral_master(), tls_plainstream_desc, tls_process_desc, tls_restart(), tls_validator_desc, TLS_VERSION_MAX, tls_connection::tx, tls_server::validator, tls_connection::version, and x509_root_get().

Referenced by apply_syslogs_settings(), https_filter(), ipair_rx_session(), and REQUIRING_SYMBOL().

◆ REQUIRING_SYMBOL()

REQUIRING_SYMBOL ( add_tls )

References add_tls().

◆ REQUIRE_OBJECT()

REQUIRE_OBJECT ( config_crypto )

Variable Documentation

◆ tls_cipher_suite_null

struct tls_cipher_suite tls_cipher_suite_null

Initial value:

                      = {
        .exchange = &tls_pubkey_exchange_algorithm,
        .pubkey = &pubkey_null,
        .cipher = &cipher_null,
        .digest = &digest_null,
}

Null cipher suite.

Definition at line 1191 of file tls.c.

                                              {
        .exchange = &tls_pubkey_exchange_algorithm,
        .pubkey = &pubkey_null,
        .cipher = &cipher_null,
        .digest = &digest_null,
};

Referenced by tls_change_cipher(), and tls_clear_cipher().

◆ tls_pubkey_exchange_algorithm

struct tls_key_exchange_algorithm tls_pubkey_exchange_algorithm

Initial value:

                                = {
        .name = "pubkey",
        .server = tls_new_server_key_exchange_pubkey,
        .client = tls_send_client_key_exchange_pubkey,
}

Public key exchange algorithm.

Definition at line 1665 of file tls.c.

                                                                {
        .name = "pubkey",
        .server = tls_new_server_key_exchange_pubkey,
        .client = tls_send_client_key_exchange_pubkey,
};

Referenced by __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), and __tls_cipher_suite().

◆ tls_dhe_exchange_algorithm

struct tls_key_exchange_algorithm tls_dhe_exchange_algorithm

Initial value:

                                = {
        .name = "dhe",
        .server = tls_new_server_key_exchange_dhe,
        .client = tls_send_client_key_exchange_dhe,
}

Ephemeral Diffie-Hellman key exchange algorithm.

Definition at line 1793 of file tls.c.

                                                             {
        .name = "dhe",
        .server = tls_new_server_key_exchange_dhe,
        .client = tls_send_client_key_exchange_dhe,
};

Referenced by __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), and __tls_cipher_suite().

◆ tls_ecdhe_exchange_algorithm

struct tls_key_exchange_algorithm tls_ecdhe_exchange_algorithm

Initial value:

                                = {
        .name = "ecdhe",
        .server = tls_new_server_key_exchange_ecdhe,
        .client = tls_send_client_key_exchange_ecdhe,
}

Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm.

Definition at line 1898 of file tls.c.

                                                               {
        .name = "ecdhe",
        .server = tls_new_server_key_exchange_ecdhe,
        .client = tls_send_client_key_exchange_ecdhe,
};

Referenced by __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), __tls_cipher_suite(), and __tls_cipher_suite().

◆ tls_plainstream_ops

struct interface_operation tls_plainstream_ops[]

static

Initial value:

                                 = {
        INTF_OP ( xfer_alloc_iob, struct tls_connection *, tls_alloc_iob ),
        INTF_OP ( xfer_deliver, struct tls_connection *,
                  tls_plainstream_deliver ),
        INTF_OP ( xfer_window, struct tls_connection *,
                  tls_plainstream_window ),
        INTF_OP ( job_progress, struct tls_connection *, tls_progress ),
        INTF_OP ( intf_close, struct tls_connection *, tls_close_alert ),
}

TLS plaintext stream interface operations.

Definition at line 3915 of file tls.c.

                                                        {
        INTF_OP ( xfer_alloc_iob, struct tls_connection *, tls_alloc_iob ),
        INTF_OP ( xfer_deliver, struct tls_connection *,
                  tls_plainstream_deliver ),
        INTF_OP ( xfer_window, struct tls_connection *,
                  tls_plainstream_window ),
        INTF_OP ( job_progress, struct tls_connection *, tls_progress ),
        INTF_OP ( intf_close, struct tls_connection *, tls_close_alert ),
};

◆ tls_plainstream_desc

struct interface_descriptor tls_plainstream_desc

static

Initial value:

                         =
INTF_DESC_PASSTHRU ( struct tls_connection, plainstream,
                     tls_plainstream_ops, cipherstream )

TLS plaintext stream interface descriptor.

Definition at line 3926 of file tls.c.

Referenced by add_tls().

◆ tls_cipherstream_ops

struct interface_operation tls_cipherstream_ops[]

static

Initial value:

                                 = {
        INTF_OP ( xfer_deliver, struct tls_connection *,
                  tls_cipherstream_deliver ),
        INTF_OP ( xfer_window, struct tls_connection *,
                  tls_cipherstream_window ),
        INTF_OP ( xfer_window_changed, struct tls_connection *,
                  tls_tx_resume ),
        INTF_OP ( intf_close, struct tls_connection *, tls_close ),
}

TLS ciphertext stream interface operations.

Definition at line 4130 of file tls.c.

                                                         {
        INTF_OP ( xfer_deliver, struct tls_connection *,
                  tls_cipherstream_deliver ),
        INTF_OP ( xfer_window, struct tls_connection *,
                  tls_cipherstream_window ),
        INTF_OP ( xfer_window_changed, struct tls_connection *,
                  tls_tx_resume ),
        INTF_OP ( intf_close, struct tls_connection *, tls_close ),
};

◆ tls_cipherstream_desc

struct interface_descriptor tls_cipherstream_desc

static

Initial value:

                         =
INTF_DESC_PASSTHRU ( struct tls_connection, cipherstream,
                     tls_cipherstream_ops, plainstream )

TLS ciphertext stream interface descriptor.

Definition at line 4141 of file tls.c.

Referenced by add_tls().

◆ tls_validator_ops

struct interface_operation tls_validator_ops[]

static

Initial value:

                                 = {
        INTF_OP ( intf_close, struct tls_connection *, tls_validator_done ),
}

TLS certificate validator interface operations.

Definition at line 4193 of file tls.c.

                                                      {
        INTF_OP ( intf_close, struct tls_connection *, tls_validator_done ),
};

◆ tls_validator_desc

struct interface_descriptor tls_validator_desc

static

Initial value:

                         =
INTF_DESC ( struct tls_connection, server.validator,
            tls_validator_ops )

TLS certificate validator interface descriptor.

Definition at line 4198 of file tls.c.

Referenced by add_tls().

◆ tls_process_desc

struct process_descriptor tls_process_desc

static

Initial value:

=

PROC_DESC_ONCE ( struct tls_connection, tx.process, tls_tx_step )

PROC_DESC_ONCE

#define PROC_DESC_ONCE(object_type, process, _step)

Define a process descriptor for a process that runs only once.

Definition process.h:98

tls_tx_step

static void tls_tx_step(struct tls_connection *tls)

TLS TX state machine.

Definition tls.c:4214

tx

u8 tx[WPA_TKIP_MIC_KEY_LEN]

MIC key for packets to the AP.

Definition wpa.h:4

TLS TX process descriptor.

Definition at line 4321 of file tls.c.

Referenced by add_tls().

Data Structures

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ EINVAL_CHANGE_CIPHER

◆ EINFO_EINVAL_CHANGE_CIPHER

◆ EINVAL_ALERT

◆ EINFO_EINVAL_ALERT

◆ EINVAL_HELLO

◆ EINFO_EINVAL_HELLO

◆ EINVAL_CERTIFICATE

◆ EINFO_EINVAL_CERTIFICATE

◆ EINVAL_CERTIFICATES

◆ EINFO_EINVAL_CERTIFICATES

◆ EINVAL_HELLO_DONE

◆ EINFO_EINVAL_HELLO_DONE

◆ EINVAL_FINISHED

◆ EINFO_EINVAL_FINISHED

◆ EINVAL_HANDSHAKE

◆ EINFO_EINVAL_HANDSHAKE

◆ EINVAL_IV

◆ EINFO_EINVAL_IV

◆ EINVAL_PADDING

◆ EINFO_EINVAL_PADDING

◆ EINVAL_RX_STATE

◆ EINFO_EINVAL_RX_STATE

◆ EINVAL_MAC

◆ EINFO_EINVAL_MAC

◆ EINVAL_TICKET

◆ EINFO_EINVAL_TICKET

◆ EINVAL_KEY_EXCHANGE

◆ EINFO_EINVAL_KEY_EXCHANGE

◆ EIO_ALERT

◆ EINFO_EIO_ALERT

◆ ENOENT_CERT

◆ EINFO_ENOENT_CERT

◆ ENOMEM_CONTEXT

◆ EINFO_ENOMEM_CONTEXT

◆ ENOMEM_CERTIFICATE

◆ EINFO_ENOMEM_CERTIFICATE

◆ ENOMEM_CHAIN

◆ EINFO_ENOMEM_CHAIN

◆ ENOMEM_TX_PLAINTEXT

◆ EINFO_ENOMEM_TX_PLAINTEXT

◆ ENOMEM_TX_CIPHERTEXT

◆ EINFO_ENOMEM_TX_CIPHERTEXT

◆ ENOMEM_RX_DATA

◆ EINFO_ENOMEM_RX_DATA

◆ ENOMEM_RX_CONCAT

◆ EINFO_ENOMEM_RX_CONCAT

◆ ENOTSUP_CIPHER

◆ EINFO_ENOTSUP_CIPHER

◆ ENOTSUP_NULL

◆ EINFO_ENOTSUP_NULL

◆ ENOTSUP_SIG_HASH

◆ EINFO_ENOTSUP_SIG_HASH

◆ ENOTSUP_VERSION

◆ EINFO_ENOTSUP_VERSION

◆ ENOTSUP_GROUP

◆ EINFO_ENOTSUP_GROUP

◆ EPERM_ALERT

◆ EINFO_EPERM_ALERT

◆ EPERM_VERIFY

◆ EINFO_EPERM_VERIFY

◆ EPERM_RENEG_INSECURE

◆ EINFO_EPERM_RENEG_INSECURE

◆ EPERM_RENEG_VERIFY

◆ EINFO_EPERM_RENEG_VERIFY

◆ EPERM_KEY_EXCHANGE

◆ EINFO_EPERM_KEY_EXCHANGE

◆ EPERM_EMS

◆ EINFO_EPERM_EMS

◆ EPERM_BOUND

◆ EINFO_EPERM_BOUND

◆ EPROTO_VERSION

◆ EINFO_EPROTO_VERSION

◆ tls_prf_label

◆ TLS_NUM_CIPHER_SUITES