iPXE
tls.c
Go to the documentation of this file.
1/*
2 * Copyright (C) 2007 Michael Brown <mbrown@fensystems.co.uk>.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License as
6 * published by the Free Software Foundation; either version 2 of the
7 * License, or any later version.
8 *
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17 * 02110-1301, USA.
18 */
19
20FILE_LICENCE ( GPL2_OR_LATER );
21FILE_SECBOOT ( PERMITTED );
22
23/**
24 * @file
25 *
26 * Transport Layer Security Protocol
27 */
28
29#include <stdint.h>
30#include <stdlib.h>
31#include <stdarg.h>
32#include <string.h>
33#include <errno.h>
34#include <byteswap.h>
35#include <ipxe/pending.h>
36#include <ipxe/hmac.h>
37#include <ipxe/md5.h>
38#include <ipxe/sha1.h>
39#include <ipxe/sha256.h>
40#include <ipxe/md5_sha1.h>
41#include <ipxe/aes.h>
42#include <ipxe/rsa.h>
43#include <ipxe/hkdf.h>
44#include <ipxe/iobuf.h>
45#include <ipxe/xfer.h>
46#include <ipxe/open.h>
47#include <ipxe/x509.h>
48#include <ipxe/privkey.h>
49#include <ipxe/certstore.h>
50#include <ipxe/rootcert.h>
51#include <ipxe/rbg.h>
52#include <ipxe/validator.h>
53#include <ipxe/job.h>
54#include <ipxe/ffdhe.h>
55#include <ipxe/tls.h>
56#include <config/crypto.h>
57
58/* Disambiguate the various error causes */
59#define EINVAL_CHANGE_CIPHER __einfo_error ( EINFO_EINVAL_CHANGE_CIPHER )
60#define EINFO_EINVAL_CHANGE_CIPHER \
61 __einfo_uniqify ( EINFO_EINVAL, 0x01, \
62 "Invalid Change Cipher record" )
63#define EINVAL_ALERT __einfo_error ( EINFO_EINVAL_ALERT )
64#define EINFO_EINVAL_ALERT \
65 __einfo_uniqify ( EINFO_EINVAL, 0x02, \
66 "Invalid Alert record" )
67#define EINVAL_HELLO __einfo_error ( EINFO_EINVAL_HELLO )
68#define EINFO_EINVAL_HELLO \
69 __einfo_uniqify ( EINFO_EINVAL, 0x03, \
70 "Invalid Server Hello record" )
71#define EINVAL_CERTIFICATE __einfo_error ( EINFO_EINVAL_CERTIFICATE )
72#define EINFO_EINVAL_CERTIFICATE \
73 __einfo_uniqify ( EINFO_EINVAL, 0x04, \
74 "Invalid Certificate" )
75#define EINVAL_CERTIFICATES __einfo_error ( EINFO_EINVAL_CERTIFICATES )
76#define EINFO_EINVAL_CERTIFICATES \
77 __einfo_uniqify ( EINFO_EINVAL, 0x05, \
78 "Invalid Server Certificate record" )
79#define EINVAL_HELLO_DONE __einfo_error ( EINFO_EINVAL_HELLO_DONE )
80#define EINFO_EINVAL_HELLO_DONE \
81 __einfo_uniqify ( EINFO_EINVAL, 0x06, \
82 "Invalid Server Hello Done record" )
83#define EINVAL_FINISHED __einfo_error ( EINFO_EINVAL_FINISHED )
84#define EINFO_EINVAL_FINISHED \
85 __einfo_uniqify ( EINFO_EINVAL, 0x07, \
86 "Invalid Server Finished record" )
87#define EINVAL_HANDSHAKE __einfo_error ( EINFO_EINVAL_HANDSHAKE )
88#define EINFO_EINVAL_HANDSHAKE \
89 __einfo_uniqify ( EINFO_EINVAL, 0x08, \
90 "Invalid Handshake record" )
91#define EINVAL_IV __einfo_error ( EINFO_EINVAL_IV )
92#define EINFO_EINVAL_IV \
93 __einfo_uniqify ( EINFO_EINVAL, 0x0a, \
94 "Invalid initialisation vector" )
95#define EINVAL_PADDING __einfo_error ( EINFO_EINVAL_PADDING )
96#define EINFO_EINVAL_PADDING \
97 __einfo_uniqify ( EINFO_EINVAL, 0x0b, \
98 "Invalid block padding" )
99#define EINVAL_RX_STATE __einfo_error ( EINFO_EINVAL_RX_STATE )
100#define EINFO_EINVAL_RX_STATE \
101 __einfo_uniqify ( EINFO_EINVAL, 0x0c, \
102 "Invalid receive state" )
103#define EINVAL_MAC __einfo_error ( EINFO_EINVAL_MAC )
104#define EINFO_EINVAL_MAC \
105 __einfo_uniqify ( EINFO_EINVAL, 0x0d, \
106 "Invalid MAC or authentication tag" )
107#define EINVAL_TICKET __einfo_error ( EINFO_EINVAL_TICKET )
108#define EINFO_EINVAL_TICKET \
109 __einfo_uniqify ( EINFO_EINVAL, 0x0e, \
110 "Invalid New Session Ticket record")
111#define EINVAL_KEY_EXCHANGE __einfo_error ( EINFO_EINVAL_KEY_EXCHANGE )
112#define EINFO_EINVAL_KEY_EXCHANGE \
113 __einfo_uniqify ( EINFO_EINVAL, 0x0f, \
114 "Invalid Server Key Exchange record" )
115#define EIO_ALERT __einfo_error ( EINFO_EIO_ALERT )
116#define EINFO_EIO_ALERT \
117 __einfo_uniqify ( EINFO_EIO, 0x01, \
118 "Unknown alert level" )
119#define ENOENT_CERT __einfo_error ( EINFO_ENOENT_CERT )
120#define EINFO_ENOENT_CERT \
121 __einfo_uniqify ( EINFO_ENOENT, 0x01, \
122 "Missing server certificate" )
123#define ENOMEM_CONTEXT __einfo_error ( EINFO_ENOMEM_CONTEXT )
124#define EINFO_ENOMEM_CONTEXT \
125 __einfo_uniqify ( EINFO_ENOMEM, 0x01, \
126 "Not enough space for crypto context" )
127#define ENOMEM_CERTIFICATE __einfo_error ( EINFO_ENOMEM_CERTIFICATE )
128#define EINFO_ENOMEM_CERTIFICATE \
129 __einfo_uniqify ( EINFO_ENOMEM, 0x02, \
130 "Not enough space for certificate" )
131#define ENOMEM_CHAIN __einfo_error ( EINFO_ENOMEM_CHAIN )
132#define EINFO_ENOMEM_CHAIN \
133 __einfo_uniqify ( EINFO_ENOMEM, 0x03, \
134 "Not enough space for certificate chain" )
135#define ENOMEM_TX_PLAINTEXT __einfo_error ( EINFO_ENOMEM_TX_PLAINTEXT )
136#define EINFO_ENOMEM_TX_PLAINTEXT \
137 __einfo_uniqify ( EINFO_ENOMEM, 0x04, \
138 "Not enough space for transmitted plaintext" )
139#define ENOMEM_TX_CIPHERTEXT __einfo_error ( EINFO_ENOMEM_TX_CIPHERTEXT )
140#define EINFO_ENOMEM_TX_CIPHERTEXT \
141 __einfo_uniqify ( EINFO_ENOMEM, 0x05, \
142 "Not enough space for transmitted ciphertext" )
143#define ENOMEM_RX_DATA __einfo_error ( EINFO_ENOMEM_RX_DATA )
144#define EINFO_ENOMEM_RX_DATA \
145 __einfo_uniqify ( EINFO_ENOMEM, 0x07, \
146 "Not enough space for received data" )
147#define ENOMEM_RX_CONCAT __einfo_error ( EINFO_ENOMEM_RX_CONCAT )
148#define EINFO_ENOMEM_RX_CONCAT \
149 __einfo_uniqify ( EINFO_ENOMEM, 0x08, \
150 "Not enough space to concatenate received data" )
151#define ENOTSUP_CIPHER __einfo_error ( EINFO_ENOTSUP_CIPHER )
152#define EINFO_ENOTSUP_CIPHER \
153 __einfo_uniqify ( EINFO_ENOTSUP, 0x01, \
154 "Unsupported cipher" )
155#define ENOTSUP_NULL __einfo_error ( EINFO_ENOTSUP_NULL )
156#define EINFO_ENOTSUP_NULL \
157 __einfo_uniqify ( EINFO_ENOTSUP, 0x02, \
158 "Refusing to use null cipher" )
159#define ENOTSUP_SIG_HASH __einfo_error ( EINFO_ENOTSUP_SIG_HASH )
160#define EINFO_ENOTSUP_SIG_HASH \
161 __einfo_uniqify ( EINFO_ENOTSUP, 0x03, \
162 "Unsupported signature and hash algorithm" )
163#define ENOTSUP_VERSION __einfo_error ( EINFO_ENOTSUP_VERSION )
164#define EINFO_ENOTSUP_VERSION \
165 __einfo_uniqify ( EINFO_ENOTSUP, 0x04, \
166 "Unsupported protocol version" )
167#define ENOTSUP_GROUP __einfo_error ( EINFO_ENOTSUP_GROUP )
168#define EINFO_ENOTSUP_GROUP \
169 __einfo_uniqify ( EINFO_ENOTSUP, 0x05, \
170 "Unsupported key exchange group" )
171#define EPERM_ALERT __einfo_error ( EINFO_EPERM_ALERT )
172#define EINFO_EPERM_ALERT \
173 __einfo_uniqify ( EINFO_EPERM, 0x01, \
174 "Received fatal alert" )
175#define EPERM_VERIFY __einfo_error ( EINFO_EPERM_VERIFY )
176#define EINFO_EPERM_VERIFY \
177 __einfo_uniqify ( EINFO_EPERM, 0x02, \
178 "Handshake verification failed" )
179#define EPERM_RENEG_INSECURE __einfo_error ( EINFO_EPERM_RENEG_INSECURE )
180#define EINFO_EPERM_RENEG_INSECURE \
181 __einfo_uniqify ( EINFO_EPERM, 0x04, \
182 "Secure renegotiation not supported" )
183#define EPERM_RENEG_VERIFY __einfo_error ( EINFO_EPERM_RENEG_VERIFY )
184#define EINFO_EPERM_RENEG_VERIFY \
185 __einfo_uniqify ( EINFO_EPERM, 0x05, \
186 "Secure renegotiation verification failed" )
187#define EPERM_KEY_EXCHANGE __einfo_error ( EINFO_EPERM_KEY_EXCHANGE )
188#define EINFO_EPERM_KEY_EXCHANGE \
189 __einfo_uniqify ( EINFO_EPERM, 0x06, \
190 "ServerKeyExchange verification failed" )
191#define EPERM_EMS __einfo_error ( EINFO_EPERM_EMS )
192#define EINFO_EPERM_EMS \
193 __einfo_uniqify ( EINFO_EPERM, 0x07, \
194 "Extended master secret extension mismatch" )
195#define EPERM_BOUND __einfo_error ( EINFO_EPERM_BOUND )
196#define EINFO_EPERM_BOUND \
197 __einfo_uniqify ( EINFO_EPERM, 0x08, \
198 "Bound identity not validated" )
199#define EPROTO_VERSION __einfo_error ( EINFO_EPROTO_VERSION )
200#define EINFO_EPROTO_VERSION \
201 __einfo_uniqify ( EINFO_EPROTO, 0x01, \
202 "Illegal protocol version upgrade" )
203
204/** List of TLS session */
205static LIST_HEAD ( tls_sessions );
206
207static void tls_regenerate_ephemeral_master ( struct tls_connection *tls );
208static void tls_tx_resume_all ( struct tls_session *session );
209static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls,
210 size_t len );
211static int tls_send_handshake ( struct tls_connection *tls,
212 const void *data, size_t len );
213static int tls_send_alert ( struct tls_connection *tls, unsigned int level,
214 unsigned int description );
215static int tls_send_record ( struct tls_connection *tls, unsigned int type,
216 struct io_buffer *iobuf );
217static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type,
218 const void *data, size_t len );
219static void tls_clear_cipher ( struct tls_connection *tls,
220 struct tls_cipherspec *cipherspec );
221static void tls_clear_digest ( struct tls_connection *tls );
222static void tls_verify_handshake ( struct tls_connection *tls, void *out );
223
224/******************************************************************************
225 *
226 * Utility functions
227 *
228 ******************************************************************************
229 */
230
231/** A TLS 24-bit integer
232 *
233 * TLS uses 24-bit integers in several places, which are awkward to
234 * parse in C.
235 */
236typedef struct {
237 /** High byte */
238 uint8_t high;
239 /** Low word */
240 uint16_t low;
241} __attribute__ (( packed )) tls24_t;
242
243/**
244 * Extract 24-bit field value
245 *
246 * @v field24 24-bit field
247 * @ret value Field value
248 *
249 */
250static inline __attribute__ (( always_inline )) unsigned long
251tls_uint24 ( const tls24_t *field24 ) {
252
253 return ( ( field24->high << 16 ) | be16_to_cpu ( field24->low ) );
254}
255
256/**
257 * Set 24-bit field value
258 *
259 * @v field24 24-bit field
260 * @v value Field value
261 */
262static void tls_set_uint24 ( tls24_t *field24, unsigned long value ) {
263
264 field24->high = ( value >> 16 );
265 field24->low = cpu_to_be16 ( value );
266}
267
268/**
269 * Determine if TLS connection is ready for application data
270 *
271 * @v tls TLS connection
272 * @ret is_ready TLS connection is ready
273 */
274static int tls_ready ( struct tls_connection *tls ) {
275 return ( ( ! is_pending ( &tls->client.negotiation ) ) &&
276 ( ! is_pending ( &tls->server.negotiation ) ) );
277}
278
279/**
280 * Check for TLS version
281 *
282 * @v tls TLS connection
283 * @v version TLS version
284 * @ret at_least TLS connection is using at least the specified version
285 *
286 * Check that TLS connection uses at least the specified protocol
287 * version. Optimise down to a compile-time constant true result if
288 * this is already guaranteed by the minimum supported version check.
289 */
290static inline __attribute__ (( always_inline )) int
291tls_version ( struct tls_connection *tls, unsigned int version ) {
292 return ( ( TLS_VERSION_MIN >= version ) ||
293 ( tls->version >= version ) );
294}
295
296/******************************************************************************
297 *
298 * Cleanup functions
299 *
300 ******************************************************************************
301 */
302
303/**
304 * Free TLS session
305 *
306 * @v refcnt Reference counter
307 */
308static void free_tls_session ( struct refcnt *refcnt ) {
309 struct tls_session *session =
310 container_of ( refcnt, struct tls_session, refcnt );
311
312 /* Sanity check */
313 assert ( list_empty ( &session->conn ) );
314
315 /* Remove from list of sessions */
316 list_del ( &session->list );
317
318 /* Free dynamically-allocated resources */
319 x509_root_put ( session->root );
320 privkey_put ( session->key );
321 x509_put ( session->cert );
322 zfree ( session->ticket );
323
324 /* Free session */
325 zfree ( session );
326}
327
328/**
329 * Free TLS connection
330 *
331 * @v refcnt Reference counter
332 */
333static void free_tls ( struct refcnt *refcnt ) {
334 struct tls_connection *tls =
335 container_of ( refcnt, struct tls_connection, refcnt );
336 struct tls_session *session = tls->session;
337 struct io_buffer *iobuf;
338 struct io_buffer *tmp;
339
340 /* Free dynamically-allocated resources */
341 zfree ( tls->new_session_ticket );
342 tls_clear_cipher ( tls, &tls->tx.cipherspec.active );
343 tls_clear_cipher ( tls, &tls->tx.cipherspec.pending );
344 tls_clear_cipher ( tls, &tls->rx.cipherspec.active );
345 tls_clear_cipher ( tls, &tls->rx.cipherspec.pending );
346 tls_clear_digest ( tls );
347 list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) {
348 list_del ( &iobuf->list );
349 free_iob ( iobuf );
350 }
351 free_iob ( tls->rx.handshake );
352 privkey_put ( tls->client.key );
353 x509_chain_put ( tls->client.chain );
354 x509_chain_put ( tls->server.chain );
355 x509_root_put ( tls->server.root );
356
357 /* Drop reference to session */
358 assert ( list_empty ( &tls->list ) );
359 ref_put ( &session->refcnt );
360
361 /* Free TLS structure itself */
362 zfree ( tls );
363}
364
365/**
366 * Finish with TLS connection
367 *
368 * @v tls TLS connection
369 * @v rc Status code
370 */
371static void tls_close ( struct tls_connection *tls, int rc ) {
372
373 /* Remove pending operations, if applicable */
374 pending_put ( &tls->client.negotiation );
375 pending_put ( &tls->server.negotiation );
376 pending_put ( &tls->server.validation );
377
378 /* Remove process */
379 process_del ( &tls->tx.process );
380
381 /* Close all interfaces */
382 intf_shutdown ( &tls->cipherstream, rc );
383 intf_shutdown ( &tls->plainstream, rc );
384 intf_shutdown ( &tls->server.validator, rc );
385
386 /* Remove from session */
387 list_del ( &tls->list );
388 INIT_LIST_HEAD ( &tls->list );
389
390 /* Destroy ephemeral master secret */
391 tls_regenerate_ephemeral_master ( tls );
392
393 /* Resume all other connections, in case we were the lead connection */
394 tls_tx_resume_all ( tls->session );
395}
396
397/**
398 * Send closure alert and finish with TLS connection
399 *
400 * @v tls TLS connection
401 * @v rc Status code
402 */
403static void tls_close_alert ( struct tls_connection *tls, int rc ) {
404
405 /* Send closure alert */
406 tls_send_alert ( tls, TLS_ALERT_WARNING, TLS_ALERT_CLOSE_NOTIFY );
407
408 /* Close connection */
409 tls_close ( tls, rc );
410}
411
412/******************************************************************************
413 *
414 * Key schedule
415 *
416 ******************************************************************************
417 */
418
419/**
420 * Generate ephemeral master secret
421 *
422 * @v tls TLS connection
423 * @ret rc Return status code
424 */
425static int tls_generate_ephemeral_master ( struct tls_connection *tls ) {
426 struct tls_key_schedule *key = &tls->key;
427 struct digest_algorithm *digest = &tls_ephemeral_algorithm;
428 static const char salt[16] = "ephemeral master";
429 int rc;
430
431 /* Generate random bits with no additional input and without
432 * prediction resistance
433 */
434 if ( ( rc = rbg_generate ( NULL, 0, 0, key->ephemeral,
435 sizeof ( key->ephemeral ) ) ) != 0 ) {
436 DBGC ( tls, "TLS %p could not generate random data: %s\n",
437 tls, strerror ( rc ) );
438 return rc;
439 }
440
441 /* Generate ephemeral master secret */
442 hkdf_extract ( digest, salt, sizeof ( salt ), key->ephemeral,
443 sizeof ( key->ephemeral ), key->ephemeral );
444
445 return 0;
446}
447
448/**
449 * Generate ephemeral secret
450 *
451 * @v tls TLS connection
452 * @v info Additional information (or NULL)
453 * @v info_len Length of additional information
454 * @v out Ephemeral secret to fill in
455 * @v len Length of ephemeral secret
456 */
457static void tls_ephemeral ( struct tls_connection *tls, const void *info,
458 size_t info_len, void *out, size_t len ) {
459 struct tls_key_schedule *key = &tls->key;
460 struct digest_algorithm *digest = &tls_ephemeral_algorithm;
461
462 /* Generate from ephemeral master secret and additional information */
463 hkdf_expand ( digest, key->ephemeral, info, info_len, out, len );
464}
465
466/**
467 * Generate ephemeral secret from label
468 *
469 * @v tls TLS connection
470 * @v label Secret label
471 * @v out Ephemeral secret to fill in
472 * @v len Length of ephemeral secret
473 */
474static void tls_ephemeral_label ( struct tls_connection *tls,
475 const char *label, void *out, size_t len ) {
476
477 /* Generate from ephemeral master secret and label */
478 tls_ephemeral ( tls, label, strlen ( label ), out, len );
479 DBGC2 ( tls, "TLS %p ephemeral %s:\n", tls, label );
480 DBGC2_HDA ( tls, 0, out, len );
481}
482
483/**
484 * Regenerate ephemeral master secret
485 *
486 * @v tls TLS connection
487 */
488static void tls_regenerate_ephemeral_master ( struct tls_connection *tls ) {
489 struct tls_key_schedule *key = &tls->key;
490
491 /* Derive a new ephemeral master secret */
492 tls_ephemeral_label ( tls, "key reset", key->ephemeral,
493 sizeof ( key->ephemeral ) );
494
495 /* (Re)generate client random bytes */
496 tls_ephemeral_label ( tls, "client random", &tls->client.random.random,
497 sizeof ( tls->client.random.random ) );
498}
499
500/**
501 * Clear key schedule binding
502 *
503 * @v tls TLS connection
504 */
505static void tls_clear_binding ( struct tls_connection *tls ) {
506 struct tls_key_schedule *key = &tls->key;
507
508 /* Clear any existing binding */
509 x509_put ( key->bound );
510 key->bound = NULL;
511}
512
513/**
514 * Bind key schedule to a server identity
515 *
516 * @v tls TLS connection
517 * @v cert Server certificate
518 */
519static void tls_set_binding ( struct tls_connection *tls,
520 struct x509_certificate *cert ) {
521 struct tls_key_schedule *key = &tls->key;
522
523 /* Clear any existing binding */
524 tls_clear_binding ( tls );
525
526 /* Refuse to bind an empty shared secret */
527 if ( ! key->keyed ) {
528 DBGC ( tls, "TLS %p refusing empty binding\n", tls );
529 return;
530 }
531
532 /* Bind to new identity */
533 key->bound = x509_get ( cert );
534 DBGC ( tls, "TLS %p bound to %s\n", tls, x509_name ( cert ) );
535}
536
537/**
538 * Clear key schedule digest algorithm
539 *
540 * @v tls TLS connection
541 */
542static void tls_clear_digest ( struct tls_connection *tls ) {
543 struct tls_key_schedule *key = &tls->key;
544
545 /* Set null digest algorithm */
546 key->digest = &digest_null;
547
548 /* Free any dynamic storage */
549 zfree ( key->dynamic );
550 key->dynamic = NULL;
551 key->handshake = NULL;
552 key->kdf = NULL;
553
554 /* Key schedule no longer contains any shared secret */
555 tls_clear_binding ( tls );
556 key->keyed = 0;
557}
558
559/**
560 * Set key schedule digest algorithm
561 *
562 * @v tls TLS connection
563 * @v digest Key schedule digest algorithm
564 * @ret rc Return status code
565 */
566static int tls_set_digest ( struct tls_connection *tls,
567 struct digest_algorithm *digest ) {
568 struct tls_key_schedule *key = &tls->key;
569 size_t kdfsize;
570 size_t total;
571 void *dynamic;
572
573 /* Clear existing key schedule digest algorithm */
574 tls_clear_digest ( tls );
575
576 /* Allocate dynamic storage */
577 if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
578 kdfsize = hmac_keysize ( digest );
579 } else {
580 kdfsize = sizeof ( struct md5_sha1_hmac_keys );
581 }
582 total = ( digest->ctxsize + kdfsize );
583 dynamic = zalloc ( total );
584 if ( ! dynamic )
585 return -ENOMEM;
586
587 /* Assign storage */
588 key->dynamic = dynamic;
589 key->handshake = dynamic; dynamic += digest->ctxsize;
590 key->kdf = dynamic; dynamic += kdfsize;
591 assert ( ( key->dynamic + total ) == dynamic );
592
593 /* Store digest algorithm */
594 key->digest = digest;
595
596 /* Initialise handshake context */
597 digest_init ( digest, key->handshake );
598
599 /* Poison key derivation function master secret */
600 tls_ephemeral_label ( tls, "kdf poison", key->kdf, kdfsize );
601
602 /* Sanity checks */
603 assert ( ! key->keyed );
604 assert ( ! key->bound );
605
606 return 0;
607}
608
609/**
610 * Update HMAC with a list of ( data, len ) pairs
611 *
612 * @v digest Hash function to use
613 * @v ctx HMAC context
614 * @v args ( data, len ) pairs of data, terminated by NULL
615 */
616static void tls_hmac_update_va ( struct digest_algorithm *digest,
617 void *ctx, va_list args ) {
618 void *data;
619 size_t len;
620
621 while ( ( data = va_arg ( args, void * ) ) ) {
622 len = va_arg ( args, size_t );
623 hmac_update ( digest, ctx, data, len );
624 }
625}
626
627/**
628 * Generate secure pseudo-random data using a single hash function
629 *
630 * @v tls TLS connection
631 * @v digest Hash function to use
632 * @v hkey HMAC key
633 * @v out Output buffer
634 * @v out_len Length of output buffer
635 * @v seeds ( data, len ) pairs of seed data, terminated by NULL
636 */
637static void tls_p_hash_va ( struct tls_connection *tls,
638 struct digest_algorithm *digest, const void *hkey,
639 void *out, size_t out_len, va_list seeds ) {
640 uint8_t ctx[ hmac_ctxsize ( digest ) ];
641 uint8_t ctx_partial[ sizeof ( ctx ) ];
642 uint8_t a[digest->digestsize];
643 uint8_t out_tmp[digest->digestsize];
644 size_t frag_len = digest->digestsize;
645 va_list tmp;
646
647 /* Calculate A(1) */
648 hmac_init_key ( digest, ctx, hkey );
649 va_copy ( tmp, seeds );
650 tls_hmac_update_va ( digest, ctx, tmp );
651 va_end ( tmp );
652 hmac_final ( digest, ctx, a );
653 DBGC2 ( tls, "TLS %p %s A(1):\n", tls, digest->name );
654 DBGC2_HD ( tls, &a, sizeof ( a ) );
655
656 /* Generate as much data as required */
657 while ( out_len ) {
658
659 /* Calculate output portion */
660 hmac_init_key ( digest, ctx, hkey );
661 hmac_update ( digest, ctx, a, sizeof ( a ) );
662 memcpy ( ctx_partial, ctx, sizeof ( ctx_partial ) );
663 va_copy ( tmp, seeds );
664 tls_hmac_update_va ( digest, ctx, tmp );
665 va_end ( tmp );
666 hmac_final ( digest, ctx, out_tmp );
667
668 /* Copy output */
669 if ( frag_len > out_len )
670 frag_len = out_len;
671 memcpy ( out, out_tmp, frag_len );
672 DBGC2 ( tls, "TLS %p %s output:\n", tls, digest->name );
673 DBGC2_HD ( tls, out, frag_len );
674
675 /* Calculate A(i) */
676 hmac_final ( digest, ctx_partial, a );
677 DBGC2 ( tls, "TLS %p %s A(n):\n", tls, digest->name );
678 DBGC2_HD ( tls, &a, sizeof ( a ) );
679
680 out += frag_len;
681 out_len -= frag_len;
682 }
683}
684
685/**
686 * Generate secure pseudo-random data
687 *
688 * @v tls TLS connection
689 * @v out Output buffer
690 * @v out_len Length of output buffer
691 * @v ... ( data, len ) pairs of seed data, terminated by NULL
692 */
693static void tls_prf ( struct tls_connection *tls, void *out,
694 size_t out_len, ... ) {
695 struct tls_key_schedule *key = &tls->key;
696 struct md5_sha1_hmac_keys *hkeys;
697 va_list seeds;
698 va_list tmp;
699 uint8_t buf[out_len];
700 unsigned int i;
701
702 va_start ( seeds, out_len );
703
704 if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
705
706 /* Use P_Hash for TLSv1.2 and later */
707 tls_p_hash_va ( tls, key->digest, key->kdf,
708 out, out_len, seeds );
709
710 } else {
711
712 /* Use combination of P_MD5 and P_SHA-1 for TLSv1.1
713 * and earlier
714 */
715 hkeys = key->kdf;
716
717 /* Calculate MD5 portion */
718 va_copy ( tmp, seeds );
719 tls_p_hash_va ( tls, &md5_algorithm, hkeys->md5,
720 out, out_len, seeds );
721 va_end ( tmp );
722
723 /* Calculate SHA1 portion */
724 va_copy ( tmp, seeds );
725 tls_p_hash_va ( tls, &sha1_algorithm, hkeys->sha1,
726 buf, out_len, seeds );
727 va_end ( tmp );
728
729 /* XOR the two portions together into the final output buffer */
730 for ( i = 0 ; i < out_len ; i++ )
731 *( ( uint8_t * ) out + i ) ^= buf[i];
732 }
733
734 va_end ( seeds );
735}
736
737/**
738 * Generate secure pseudo-random data
739 *
740 * @v tls TLS connection
741 * @v out Output buffer
742 * @v out_len Length of output buffer
743 * @v label String literal label
744 * @v ... ( data, len ) pairs of seed data
745 */
746#define tls_prf_label( tls, out, out_len, label, ... ) \
747 tls_prf ( (tls), (out), (out_len), \
748 label, ( sizeof ( label ) - 1 ), __VA_ARGS__, NULL )
749
750/**
751 * Set key derivation function master secret
752 *
753 * @v tls TLS connection
754 * @v secret Secret
755 * @v secret_len Length of secret
756 */
757static void tls_set_kdf_master ( struct tls_connection *tls,
758 const void *secret, size_t secret_len ) {
759 struct tls_key_schedule *key = &tls->key;
760 struct digest_algorithm *digest = key->digest;
761 uint8_t ctx[ hmac_ctxsize ( digest ) ];
762 struct md5_sha1_hmac_keys *hkeys;
763 size_t subsecret_len;
764 const void *md5_secret;
765 const void *sha1_secret;
766
767 DBGC2 ( tls, "TLS %p KDF secret:\n", tls );
768 DBGC2_HD ( tls, secret, secret_len );
769
770 if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
771
772 /* Set HMAC key for TLSv1.2 and later */
773 hmac_key ( digest, ctx, secret, secret_len, key->kdf );
774
775 } else {
776
777 /* Set MD5+SHA1 HMAC keys for TLSv1.1 and earlier */
778 hkeys = key->kdf;
779 assert ( key->digest == &md5_sha1_algorithm );
780 assert ( sizeof ( ctx ) >= hmac_ctxsize ( &md5_algorithm ) );
781 assert ( sizeof ( ctx ) >= hmac_ctxsize ( &sha1_algorithm ) );
782
783 /* Split secret into two, with an overlap of up to one byte */
784 subsecret_len = ( ( secret_len + 1 ) / 2 );
785 md5_secret = secret;
786 sha1_secret = ( secret + secret_len - subsecret_len );
787
788 /* Set MD5 and SHA-1 HMAC keys */
789 hmac_key ( &md5_algorithm, ctx, md5_secret, subsecret_len,
790 hkeys->md5 );
791 hmac_key ( &sha1_algorithm, ctx, sha1_secret, subsecret_len,
792 hkeys->sha1 );
793 }
794}
795
796/**
797 * Share ephemeral public key
798 *
799 * @v tls TLS connection
800 * @v public Public key to fill in
801 * @ret rc Return status code
802 */
803static int tls_share_ephemeral ( struct tls_connection *tls, void *public ) {
804 struct tls_key_schedule *key = &tls->key;
805 struct tls_named_group *group = key->group;
806 struct exchange_algorithm *exchange = group->exchange;
807 size_t privsize = exchange->privsize;
808 struct {
809 uint8_t private[privsize];
810 } tmp;
811 int rc;
812
813 /* (Re)generate ephemeral private key */
814 tls_ephemeral_label ( tls, exchange->name, tmp.private, privsize );
815
816 /* Derive public key */
817 if ( ( rc = exchange_share ( exchange, tmp.private, public ) ) != 0 ) {
818 DBGC ( tls, "TLS %p could not share ephemeral key: %s\n",
819 tls, strerror ( rc ) );
820 goto err_share;
821 }
822
823 err_share:
824 memset ( &tmp, 0, sizeof ( tmp ) );
825 return rc;
826}
827
828/**
829 * Agree ephemeral public key (i.e. pre-master secret)
830 *
831 * @v tls TLS connection
832 * @v partner Partner public key
833 * @v partner_len Length of partner public key
834 * @v strip Strip/pad leading zeros
835 * @ret rc Return status code
836 */
837static int tls_agree_ephemeral ( struct tls_connection *tls,
838 const void *partner, size_t partner_len,
839 int strip ) {
840 struct tls_key_schedule *key = &tls->key;
841 struct tls_named_group *group = key->group;
842 struct exchange_algorithm *exchange = group->exchange;
843 size_t privsize = exchange->privsize;
844 size_t pubsize = exchange->pubsize;
845 size_t sharedsize = exchange->sharedsize;
846 struct {
847 uint8_t private[privsize];
848 uint8_t partner[pubsize];
849 uint8_t shared[sharedsize];
850 } *tmp;
851 size_t pad_len;
852 size_t shared_len;
853 uint8_t *shared;
854 int rc;
855
856 /* Allocate working space */
857 tmp = zalloc ( sizeof ( *tmp ) );
858 if ( ! tmp ) {
859 rc = -ENOMEM;
860 goto err_alloc;
861 }
862
863 /* (Re)generate ephemeral private key */
864 tls_ephemeral_label ( tls, exchange->name, tmp->private, privsize );
865
866 /* Zero-pad partner key if needed */
867 if ( partner_len > pubsize ) {
868 DBGC ( tls, "TLS %p partner key too long:\n", tls );
869 DBGC_HDA ( tls, 0, partner, partner_len );
870 rc = -EINVAL_KEY_EXCHANGE;
871 goto err_partner_len;
872 }
873 pad_len = ( pubsize - partner_len );
874 if ( pad_len && ( ! strip ) ) {
875 DBGC ( tls, "TLS %p partner key too short:\n", tls );
876 DBGC_HDA ( tls, 0, partner, partner_len );
877 rc = -EINVAL_KEY_EXCHANGE;
878 goto err_partner_len;
879 }
880 memcpy ( ( tmp->partner + pad_len ), partner, partner_len );
881
882 /* Agree shared secret */
883 if ( ( rc = exchange_agree ( exchange, tmp->private, tmp->partner,
884 tmp->shared ) ) != 0 ) {
885 DBGC ( tls, "TLS %p could not agree shared key: %s\n",
886 tls, strerror ( rc ) );
887 goto err_agree;
888 }
889
890 /* Strip leading zeros if needed */
891 shared = tmp->shared;
892 shared_len = sharedsize;
893 while ( strip && shared_len && ( ! *shared ) ) {
894 shared++;
895 shared_len--;
896 }
897
898 /* Set key derivation function secret to the shared secret */
899 DBGC ( tls, "TLS %p pre-master secret:\n", tls );
900 DBGC_HDA ( tls, 0, shared, shared_len );
901 tls_set_kdf_master ( tls, shared, shared_len );
902
903 /* Key derivation function secret has been overwritten with a
904 * value that was not derived from its previous value, and so
905 * is no longer bound to the server's identity.
906 */
907 tls_clear_binding ( tls );
908
909 /* Key schedule now contains shared secret key material */
910 key->keyed = 1;
911
912 err_agree:
913 err_partner_len:
914 memset ( tmp, 0, sizeof ( *tmp ) );
915 zfree ( tmp );
916 err_alloc:
917 return rc;
918}
919
920/**
921 * Generate master secret
922 *
923 * @v tls TLS connection
924 *
925 * The client and server random values must already be known.
926 */
927static void tls_generate_master_secret ( struct tls_connection *tls ) {
928 struct tls_key_schedule *key = &tls->key;
929 struct digest_algorithm *digest = key->digest;
930 uint8_t digest_out[ digest->digestsize ];
931 uint8_t master_secret[48];
932
933 /* Sanity checks */
934 assert ( key->keyed );
935 assert ( key->bound );
936
937 /* Generate handshake digest */
938 tls_verify_handshake ( tls, digest_out );
939
940 /* Show inputs */
941 DBGC ( tls, "TLS %p client random bytes:\n", tls );
942 DBGC_HD ( tls, &tls->client.random, sizeof ( tls->client.random ) );
943 DBGC ( tls, "TLS %p server random bytes:\n", tls );
944 DBGC_HD ( tls, &tls->server.random, sizeof ( tls->server.random ) );
945 DBGC ( tls, "TLS %p session hash:\n", tls );
946 DBGC_HD ( tls, digest_out, sizeof ( digest_out ) );
947
948 /* Generate master secret */
949 if ( tls->extended_master_secret ) {
950 tls_prf_label ( tls, master_secret, sizeof ( master_secret ),
951 "extended master secret",
952 digest_out, sizeof ( digest_out ) );
953 } else {
954 tls_prf_label ( tls, master_secret, sizeof ( master_secret ),
955 "master secret",
956 &tls->client.random,
957 sizeof ( tls->client.random ),
958 &tls->server.random,
959 sizeof ( tls->server.random ) );
960 }
961
962 /* Show output */
963 DBGC ( tls, "TLS %p generated %smaster secret:\n", tls,
964 ( tls->extended_master_secret ? "extended ": "" ) );
965 DBGC_HD ( tls, master_secret, sizeof ( master_secret ) );
966
967 /* Set key derivation function secret to the master secret */
968 tls_set_kdf_master ( tls, master_secret, sizeof ( master_secret ) );
969}
970
971/**
972 * Generate key material
973 *
974 * @v tls TLS connection
975 *
976 * The master secret must already be known.
977 */
978static int tls_generate_keys ( struct tls_connection *tls ) {
979 struct tls_cipherspec *tx_cipherspec = &tls->tx.cipherspec.pending;
980 struct tls_cipherspec *rx_cipherspec = &tls->rx.cipherspec.pending;
981 size_t hash_size = tx_cipherspec->suite->mac_len;
982 size_t key_size = tx_cipherspec->suite->key_len;
983 size_t iv_size = tx_cipherspec->suite->fixed_iv_len;
984 size_t total = ( 2 * ( hash_size + key_size + iv_size ) );
985 uint8_t key_block[total];
986 uint8_t *key;
987 int rc;
988
989 /* Sanity checks */
990 assert ( tls->key.keyed );
991 assert ( tls->key.bound );
992
993 /* Generate key block */
994 tls_prf_label ( tls, key_block, sizeof ( key_block ), "key expansion",
995 &tls->server.random, sizeof ( tls->server.random ),
996 &tls->client.random, sizeof ( tls->client.random ) );
997
998 /* Split key block into portions */
999 key = key_block;
1000
1001 /* TX MAC secret */
1002 memcpy ( tx_cipherspec->mac_secret, key, hash_size );
1003 DBGC ( tls, "TLS %p TX MAC secret:\n", tls );
1004 DBGC_HD ( tls, key, hash_size );
1005 key += hash_size;
1006
1007 /* RX MAC secret */
1008 memcpy ( rx_cipherspec->mac_secret, key, hash_size );
1009 DBGC ( tls, "TLS %p RX MAC secret:\n", tls );
1010 DBGC_HD ( tls, key, hash_size );
1011 key += hash_size;
1012
1013 /* TX key */
1014 if ( ( rc = cipher_setkey ( tx_cipherspec->suite->cipher,
1015 tx_cipherspec->cipher_ctx,
1016 key, key_size ) ) != 0 ) {
1017 DBGC ( tls, "TLS %p could not set TX key: %s\n",
1018 tls, strerror ( rc ) );
1019 return rc;
1020 }
1021 DBGC ( tls, "TLS %p TX key:\n", tls );
1022 DBGC_HD ( tls, key, key_size );
1023 key += key_size;
1024
1025 /* RX key */
1026 if ( ( rc = cipher_setkey ( rx_cipherspec->suite->cipher,
1027 rx_cipherspec->cipher_ctx,
1028 key, key_size ) ) != 0 ) {
1029 DBGC ( tls, "TLS %p could not set TX key: %s\n",
1030 tls, strerror ( rc ) );
1031 return rc;
1032 }
1033 DBGC ( tls, "TLS %p RX key:\n", tls );
1034 DBGC_HD ( tls, key, key_size );
1035 key += key_size;
1036
1037 /* TX initialisation vector */
1038 memcpy ( tx_cipherspec->fixed_iv, key, iv_size );
1039 DBGC ( tls, "TLS %p TX IV:\n", tls );
1040 DBGC_HD ( tls, key, iv_size );
1041 key += iv_size;
1042
1043 /* RX initialisation vector */
1044 memcpy ( rx_cipherspec->fixed_iv, key, iv_size );
1045 DBGC ( tls, "TLS %p RX IV:\n", tls );
1046 DBGC_HD ( tls, key, iv_size );
1047 key += iv_size;
1048
1049 assert ( ( key_block + total ) == key );
1050
1051 return 0;
1052}
1053
1054/**
1055 * Generate resumption master secret
1056 *
1057 * @v tls TLS connection
1058 */
1059static void tls_generate_resumption_master ( struct tls_connection *tls ) {
1060 struct tls_session *session = tls->session;
1061 struct tls_key_schedule *key = &tls->key;
1062 struct digest_algorithm *digest = key->digest;
1063 struct md5_sha1_hmac_keys *hkeys;
1064 union {
1065 uint8_t opaque[48];
1066 struct {
1067 uint8_t md5[24];
1068 uint8_t sha1[24];
1069 } __attribute__ (( packed ));
1070 } *secret;
1071
1072 /* Sanity checks */
1073 assert ( key->keyed );
1074 assert ( key->bound );
1075 assert ( x509_is_valid ( key->bound, tls->server.root ) );
1076 assert ( sizeof ( *secret ) <=
1077 sizeof ( session->resumption_master_secret ) );
1078 secret = ( ( void * ) session->resumption_master_secret );
1079
1080 if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
1081
1082 /* For TLSv1.2, the pre-master secret may be any
1083 * length but the master secret is fixed at 48 bytes.
1084 * This is smaller than the block size for all
1085 * supported digest algorithms. The HMAC key
1086 * constructed from the master secret will therefore
1087 * be just the zero-padded master secret value. We
1088 * can therefore preserve just these first 48 bytes of
1089 * the KDF master secret (ignoring the zero padding up
1090 * to the digest block size).
1091 */
1092 assert ( sizeof ( *secret ) <= hmac_keysize ( digest ) );
1093 memcpy ( secret, key->kdf, sizeof ( *secret ) );
1094 session->resumption_master_secret_len = sizeof ( *secret );
1095
1096 } else {
1097
1098 /* For TLSv1.1 and earlier, the master secret is again
1099 * fixed at 48 bytes, but will be split as 24 bytes in
1100 * each of the MD5 and SHA-1 HMAC keys.
1101 */
1102 assert ( key->digest == &md5_sha1_algorithm );
1103 assert ( sizeof ( secret->md5 ) <=
1104 hmac_keysize ( &md5_algorithm ) );
1105 assert ( sizeof ( secret->sha1 ) <=
1106 hmac_keysize ( &sha1_algorithm ) );
1107 hkeys = key->kdf;
1108 memcpy ( secret->md5, hkeys->md5, sizeof ( secret->md5 ) );
1109 memcpy ( secret->sha1, hkeys->sha1, sizeof ( secret->sha1 ) );
1110 session->resumption_master_secret_len = sizeof ( *secret );
1111 }
1112}
1113
1114/**
1115 * Resume from resumption master secret
1116 *
1117 * @v tls TLS connection
1118 */
1119static void tls_resume_secret ( struct tls_connection *tls ) {
1120 struct tls_session *session = tls->session;
1121 struct tls_key_schedule *key = &tls->key;
1122 size_t len = session->resumption_master_secret_len;
1123
1124 /* For TLSv1.2 and earlier, the resumption master secret is
1125 * just the original master secret value.
1126 */
1127 tls_set_kdf_master ( tls, session->resumption_master_secret, len );
1128
1129 /* If the resumption master secret was non-empty, then the key
1130 * schedule now contains a shared secret that is already bound
1131 * to the server's identity.
1132 *
1133 * If the resumption master secret was empty (which should not
1134 * be possible if this function is called), then the key
1135 * schedule no longer contains any shared secret.
1136 */
1137 assert ( len );
1138 key->keyed = len;
1139 tls_set_binding ( tls, session->cert );
1140}
1141
1142/******************************************************************************
1143 *
1144 * Handshake verification
1145 *
1146 ******************************************************************************
1147 */
1148
1149/**
1150 * Add handshake record to verification hash
1151 *
1152 * @v tls TLS connection
1153 * @v data Handshake record
1154 * @v len Length of handshake record
1155 * @ret rc Return status code
1156 */
1157static int tls_add_handshake ( struct tls_connection *tls,
1158 const void *data, size_t len ) {
1159 struct tls_key_schedule *key = &tls->key;
1160 struct digest_algorithm *digest = key->digest;
1161
1162 digest_update ( digest, key->handshake, data, len );
1163 return 0;
1164}
1165
1166/**
1167 * Calculate handshake verification hash
1168 *
1169 * @v tls TLS connection
1170 * @v out Output buffer
1171 *
1172 * Calculates the digest over all handshake messages seen so far.
1173 */
1174static void tls_verify_handshake ( struct tls_connection *tls, void *out ) {
1175 struct tls_key_schedule *key = &tls->key;
1176 struct digest_algorithm *digest = key->digest;
1177 uint8_t ctx[ digest->ctxsize ];
1178
1179 memcpy ( ctx, key->handshake, sizeof ( ctx ) );
1180 digest_final ( digest, ctx, out );
1181}
1182
1183/******************************************************************************
1184 *
1185 * Cipher suite management
1186 *
1187 ******************************************************************************
1188 */
1189
1190/** Null cipher suite */
1191struct tls_cipher_suite tls_cipher_suite_null = {
1192 .exchange = &tls_pubkey_exchange_algorithm,
1193 .pubkey = &pubkey_null,
1194 .cipher = &cipher_null,
1195 .digest = &digest_null,
1196};
1197
1198/** Number of supported cipher suites */
1199#define TLS_NUM_CIPHER_SUITES table_num_entries ( TLS_CIPHER_SUITES )
1200
1201/**
1202 * Identify cipher suite
1203 *
1204 * @v cipher_suite Cipher suite specification
1205 * @ret suite Cipher suite, or NULL
1206 */
1207static struct tls_cipher_suite *
1208tls_find_cipher_suite ( unsigned int cipher_suite ) {
1209 struct tls_cipher_suite *suite;
1210
1211 /* Identify cipher suite */
1212 for_each_table_entry ( suite, TLS_CIPHER_SUITES ) {
1213 if ( suite->code == cipher_suite )
1214 return suite;
1215 }
1216
1217 return NULL;
1218}
1219
1220/**
1221 * Clear cipher suite
1222 *
1223 * @v cipherspec TLS cipher specification
1224 */
1225static void tls_clear_cipher ( struct tls_connection *tls __unused,
1226 struct tls_cipherspec *cipherspec ) {
1227
1228 zfree ( cipherspec->dynamic );
1229 memset ( cipherspec, 0, sizeof ( *cipherspec ) );
1230 cipherspec->suite = &tls_cipher_suite_null;
1231}
1232
1233/**
1234 * Set cipher suite
1235 *
1236 * @v tls TLS connection
1237 * @v cipherspec TLS cipher specification
1238 * @v suite Cipher suite
1239 * @ret rc Return status code
1240 */
1241static int tls_set_cipher ( struct tls_connection *tls,
1242 struct tls_cipherspec *cipherspec,
1243 struct tls_cipher_suite *suite ) {
1244 struct cipher_algorithm *cipher = suite->cipher;
1245 size_t total;
1246 void *dynamic;
1247
1248 /* Clear out old cipher contents, if any */
1249 tls_clear_cipher ( tls, cipherspec );
1250
1251 /* Allocate dynamic storage */
1252 total = ( cipher->ctxsize + suite->mac_len + suite->fixed_iv_len );
1253 dynamic = zalloc ( total );
1254 if ( ! dynamic ) {
1255 DBGC ( tls, "TLS %p could not allocate %zd bytes for crypto "
1256 "context\n", tls, total );
1257 return -ENOMEM_CONTEXT;
1258 }
1259
1260 /* Assign storage */
1261 cipherspec->dynamic = dynamic;
1262 cipherspec->cipher_ctx = dynamic; dynamic += cipher->ctxsize;
1263 cipherspec->mac_secret = dynamic; dynamic += suite->mac_len;
1264 cipherspec->fixed_iv = dynamic; dynamic += suite->fixed_iv_len;
1265 assert ( ( cipherspec->dynamic + total ) == dynamic );
1266
1267 /* Store parameters */
1268 cipherspec->suite = suite;
1269
1270 return 0;
1271}
1272
1273/**
1274 * Select next cipher suite
1275 *
1276 * @v tls TLS connection
1277 * @v cipher_suite Cipher suite specification
1278 * @ret rc Return status code
1279 */
1280static int tls_select_cipher ( struct tls_connection *tls,
1281 unsigned int cipher_suite ) {
1282 struct tls_cipher_suite *suite;
1283 struct digest_algorithm *digest;
1284 int rc;
1285
1286 /* Identify cipher suite */
1287 suite = tls_find_cipher_suite ( cipher_suite );
1288 if ( ! suite ) {
1289 DBGC ( tls, "TLS %p does not support cipher %04x\n",
1290 tls, ntohs ( cipher_suite ) );
1291 return -ENOTSUP_CIPHER;
1292 }
1293
1294 /* Set key schedule digest algorithm */
1295 digest = ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ?
1296 suite->handshake : &md5_sha1_algorithm );
1297 if ( ( rc = tls_set_digest ( tls, digest ) ) != 0 )
1298 return rc;
1299
1300 /* Set ciphers */
1301 if ( ( rc = tls_set_cipher ( tls, &tls->tx.cipherspec.pending,
1302 suite ) ) != 0 )
1303 return rc;
1304 if ( ( rc = tls_set_cipher ( tls, &tls->rx.cipherspec.pending,
1305 suite ) ) != 0 )
1306 return rc;
1307
1308 DBGC ( tls, "TLS %p selected %s-%s-%s-%d-%s\n", tls,
1309 suite->exchange->name, suite->pubkey->name,
1310 suite->cipher->name, ( suite->key_len * 8 ),
1311 suite->digest->name );
1312
1313 return 0;
1314}
1315
1316/**
1317 * Activate next cipher suite
1318 *
1319 * @v tls TLS connection
1320 * @v pair Cipher specification pair
1321 * @ret rc Return status code
1322 */
1323static int tls_change_cipher ( struct tls_connection *tls,
1324 struct tls_cipherspec_pair *pair ) {
1325
1326 /* Sanity check */
1327 if ( pair->pending.suite == &tls_cipher_suite_null ) {
1328 DBGC ( tls, "TLS %p refusing to use null cipher\n", tls );
1329 return -ENOTSUP_NULL;
1330 }
1331
1332 tls_clear_cipher ( tls, &pair->active );
1333 memswap ( &pair->active, &pair->pending, sizeof ( pair->active ) );
1334 return 0;
1335}
1336
1337/******************************************************************************
1338 *
1339 * Signature and hash algorithms
1340 *
1341 ******************************************************************************
1342 */
1343
1344/** Number of supported signature and hash algorithms */
1345#define TLS_NUM_SIG_HASH_ALGORITHMS \
1346 table_num_entries ( TLS_SIG_HASH_ALGORITHMS )
1347
1348/**
1349 * Find TLS signature and hash algorithm
1350 *
1351 * @v pubkey Public-key algorithm
1352 * @v digest Digest algorithm
1353 * @ret sig_hash Signature and hash algorithm, or NULL
1354 */
1355static struct tls_signature_hash_algorithm *
1356tls_signature_hash_algorithm ( struct pubkey_algorithm *pubkey,
1357 struct digest_algorithm *digest ) {
1358 struct tls_signature_hash_algorithm *sig_hash;
1359
1360 /* Identify signature and hash algorithm */
1361 for_each_table_entry ( sig_hash, TLS_SIG_HASH_ALGORITHMS ) {
1362 if ( ( sig_hash->pubkey == pubkey ) &&
1363 ( sig_hash->digest == digest ) ) {
1364 return sig_hash;
1365 }
1366 }
1367
1368 return NULL;
1369}
1370
1371/**
1372 * Find TLS signature and hash algorithm
1373 *
1374 * @v code Signature and hash algorithm identifier
1375 * @ret sig_hash Signature and hash algorithm, or NULL
1376 */
1377static struct tls_signature_hash_algorithm *
1378tls_find_signature_hash ( unsigned int code ) {
1379 struct tls_signature_hash_algorithm *sig_hash;
1380
1381 /* Identify signature and hash algorithm */
1382 for_each_table_entry ( sig_hash, TLS_SIG_HASH_ALGORITHMS ) {
1383 if ( sig_hash->code == code )
1384 return sig_hash;
1385 }
1386
1387 return NULL;
1388}
1389
1390/******************************************************************************
1391 *
1392 * Ephemeral key exchange
1393 *
1394 ******************************************************************************
1395 */
1396
1397/**
1398 * Identify named key exchange group
1399 *
1400 * @v named_group Named group specification
1401 * @ret group Named group, or NULL
1402 */
1403static struct tls_named_group *
1404tls_find_named_group ( unsigned int named_group ) {
1405 struct tls_named_group *group;
1406
1407 /* Identify named group */
1408 for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
1409 if ( group->code && ( group->code == named_group ) )
1410 return group;
1411 }
1412
1413 return NULL;
1414}
1415
1416/**
1417 * Identify named key exchange group by Diffie-Hellman parameters
1418 *
1419 * @v dh_p Prime modulus
1420 * @v dh_p_len Length of prime modulus
1421 * @v dh_g Generator
1422 * @v dh_g_len Length of generator
1423 * @ret group Named group, or NULL
1424 */
1425static struct tls_named_group *
1426tls_find_param_group ( const void *dh_p, size_t dh_p_len, const void *dh_g,
1427 size_t dh_g_len ) {
1428 struct tls_named_group *group;
1429
1430 /* Identify named group by parameters */
1431 for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
1432 if ( is_ffdhe ( group->exchange ) &&
1433 ffdhe_has_params ( group->exchange, dh_p, dh_p_len,
1434 dh_g, dh_g_len ) ) {
1435 return group;
1436 }
1437 }
1438
1439 return NULL;
1440}
1441
1442/**
1443 * Verify Diffie-Hellman parameter signature
1444 *
1445 * @v tls TLS connection
1446 * @v data Server Key Exchange handshake record
1447 * @v len Length of Server Key Exchange handshake record
1448 * @v param_len Length of Diffie-Hellman parameters
1449 * @ret rc Return status code
1450 */
1451static int tls_verify_dh_params ( struct tls_connection *tls, const void *data,
1452 size_t len, size_t param_len ) {
1453 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
1454 struct tls_signature_hash_algorithm *sig_hash;
1455 struct x509_certificate *cert;
1456 struct pubkey_algorithm *pubkey;
1457 struct digest_algorithm *digest;
1458 int use_sig_hash = tls_version ( tls, TLS_VERSION_TLS_1_2 );
1459 const struct {
1460 uint16_t sig_hash[use_sig_hash];
1461 uint16_t signature_len;
1462 uint8_t signature[0];
1463 } __attribute__ (( packed )) *sig;
1464 struct asn1_cursor signature;
1465 size_t remaining;
1466 int rc;
1467
1468 /* Identify server certificate */
1469 cert = x509_first ( tls->server.chain );
1470 if ( ! cert ) {
1471 DBGC ( tls, "TLS %p has no server certificate\n", tls );
1472 return -ENOENT_CERT;
1473 }
1474
1475 /* Signature follows parameters */
1476 assert ( param_len <= len );
1477 sig = ( data + param_len );
1478 remaining = ( len - param_len );
1479
1480 /* Parse signature from ServerKeyExchange */
1481 if ( ( sizeof ( *sig ) > remaining ) ||
1482 ( ntohs ( sig->signature_len ) > ( remaining -
1483 sizeof ( *sig ) ) ) ) {
1484 DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n",
1485 tls );
1486 DBGC_HDA ( tls, 0, data, len );
1487 return -EINVAL_KEY_EXCHANGE;
1488 }
1489 signature.data = sig->signature;
1490 signature.len = ntohs ( sig->signature_len );
1491
1492 /* Identify signature and hash algorithm */
1493 if ( use_sig_hash ) {
1494 sig_hash = tls_find_signature_hash ( sig->sig_hash[0] );
1495 if ( ! sig_hash ) {
1496 DBGC ( tls, "TLS %p unsupported signature hash "
1497 "%#04x\n", tls, sig->sig_hash[0] );
1498 return -ENOTSUP_SIG_HASH;
1499 }
1500 pubkey = sig_hash->pubkey;
1501 digest = sig_hash->digest;
1502 DBGC ( tls, "TLS %p using signature hash %s-%s\n",
1503 tls, pubkey->name, digest->name );
1504 if ( sig_hash->algorithm !=
1505 cert->subject.public_key.algorithm ) {
1506 DBGC ( tls, "TLS %p cannot use %s public key\n", tls,
1507 cert->subject.public_key.algorithm->name );
1508 return -EPERM_KEY_EXCHANGE;
1509 }
1510 } else {
1511 pubkey = cipherspec->suite->pubkey;
1512 digest = &md5_sha1_algorithm;
1513 }
1514
1515 /* Verify signature */
1516 {
1517 uint8_t ctx[digest->ctxsize];
1518 uint8_t hash[digest->digestsize];
1519
1520 /* Calculate digest */
1521 digest_init ( digest, ctx );
1522 digest_update ( digest, ctx, &tls->client.random,
1523 sizeof ( tls->client.random ) );
1524 digest_update ( digest, ctx, tls->server.random,
1525 sizeof ( tls->server.random ) );
1526 digest_update ( digest, ctx, data, param_len );
1527 digest_final ( digest, ctx, hash );
1528
1529 /* Verify signature */
1530 if ( ( rc = pubkey_verify ( pubkey,
1531 &cert->subject.public_key.raw,
1532 digest, hash,
1533 &signature ) ) != 0 ) {
1534 DBGC ( tls, "TLS %p ServerKeyExchange failed "
1535 "verification\n", tls );
1536 DBGC_HDA ( tls, 0, data, len );
1537 return -EPERM_KEY_EXCHANGE;
1538 }
1539 }
1540
1541 /* The verified signature indicates the server's intention to
1542 * delegate authority to the shared secret key material. The
1543 * shared secret is therefore bound to the server's identity.
1544 */
1545 tls_set_binding ( tls, cert );
1546
1547 return 0;
1548}
1549
1550/**
1551 * Receive new Server Key Exchange record using public key transport
1552 *
1553 * @v tls TLS connection
1554 * @v data Server Key Exchange handshake record
1555 * @v len Length of Server Key Exchange handshake record
1556 * @ret rc Return status code
1557 */
1558static int tls_new_server_key_exchange_pubkey ( struct tls_connection *tls,
1559 const void *data, size_t len ){
1560
1561 /* Should never be received */
1562 DBGC ( tls, "TLS %p received unexpected ServerKeyExchange:\n", tls );
1563 DBGC_HDA ( tls, 0, data, len );
1564 return -EPROTO;
1565}
1566
1567/**
1568 * Transmit Client Key Exchange record using public key exchange
1569 *
1570 * @v tls TLS connection
1571 * @ret rc Return status code
1572 */
1573static int tls_send_client_key_exchange_pubkey ( struct tls_connection *tls ) {
1574 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
1575 struct tls_key_schedule *key = &tls->key;
1576 struct pubkey_algorithm *pubkey = cipherspec->suite->pubkey;
1577 struct x509_certificate *cert;
1578 struct {
1579 uint16_t version;
1580 uint8_t random[46];
1581 } __attribute__ (( packed )) pre_master_secret;
1582 struct asn1_cursor cursor = {
1583 .data = &pre_master_secret,
1584 .len = sizeof ( pre_master_secret ),
1585 };
1586 struct asn1_builder builder = { NULL, 0 };
1587 int rc;
1588
1589 /* Generate pre-master secret */
1590 pre_master_secret.version = htons ( TLS_VERSION_MAX );
1591 tls_ephemeral_label ( tls, "classic pre-master",
1592 &pre_master_secret.random,
1593 sizeof ( pre_master_secret.random ) );
1594 tls_set_kdf_master ( tls, &pre_master_secret,
1595 sizeof ( pre_master_secret ) );
1596
1597 /* Key derivation function secret has been overwritten with a
1598 * value that was not derived from its previous value, and so
1599 * is no longer bound to the server's identity.
1600 */
1601 tls_clear_binding ( tls );
1602
1603 /* Key schedule now contains shared secret key material */
1604 key->keyed = 1;
1605
1606 /* Identify server certificate */
1607 cert = x509_first ( tls->server.chain );
1608 if ( ! cert ) {
1609 DBGC ( tls, "TLS %p has no server certificate\n", tls );
1610 rc = -ENOENT_CERT;
1611 goto err_cert;
1612 }
1613
1614 /* Encrypt pre-master secret using server's public key */
1615 if ( ( rc = pubkey_encrypt ( pubkey, &cert->subject.public_key.raw,
1616 &cursor, &builder ) ) != 0 ) {
1617 DBGC ( tls, "TLS %p could not encrypt pre-master secret: %s\n",
1618 tls, strerror ( rc ) );
1619 goto err_encrypt;
1620 }
1621
1622 /* Construct Client Key Exchange record */
1623 {
1624 struct {
1625 uint32_t type_length;
1626 uint16_t encrypted_pre_master_secret_len;
1627 } __attribute__ (( packed )) header;
1628
1629 header.type_length =
1630 ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
1631 htonl ( builder.len + sizeof ( header ) -
1632 sizeof ( header.type_length ) ) );
1633 header.encrypted_pre_master_secret_len = htons ( builder.len );
1634
1635 if ( ( rc = asn1_prepend_raw ( &builder, &header,
1636 sizeof ( header ) ) ) != 0 ) {
1637 DBGC ( tls, "TLS %p could not construct Client Key "
1638 "Exchange: %s\n", tls, strerror ( rc ) );
1639 goto err_prepend;
1640 }
1641 }
1642
1643 /* Transmit Client Key Exchange record */
1644 if ( ( rc = tls_send_handshake ( tls, builder.data,
1645 builder.len ) ) != 0 ) {
1646 goto err_send;
1647 }
1648
1649 /* Shared secret has now been incorporated into the handshake
1650 * digest. It can be decrypted only with access to the
1651 * certificate's private key, and has thereby been bound to
1652 * the server's identity.
1653 */
1654 tls_set_binding ( tls, cert );
1655
1656 err_send:
1657 err_prepend:
1658 err_encrypt:
1659 zfree ( builder.data );
1660 err_cert:
1661 return rc;
1662}
1663
1664/** Public key exchange algorithm */
1670
1671/**
1672 * Receive new Server Key Exchange record using DHE key exchange
1673 *
1674 * @v tls TLS connection
1675 * @v data Server Key Exchange handshake record
1676 * @v len Length of Server Key Exchange handshake record
1677 * @ret rc Return status code
1678 */
1679static int tls_new_server_key_exchange_dhe ( struct tls_connection *tls,
1680 const void *data, size_t len ) {
1681 struct tls_named_group *group;
1682 struct exchange_algorithm *exchange;
1683 const struct {
1684 uint16_t len;
1685 uint8_t data[0];
1686 } __attribute__ (( packed )) *dh_val[3];
1687 typeof ( dh_val[0] ) dh_p;
1688 typeof ( dh_val[1] ) dh_g;
1689 typeof ( dh_val[2] ) dh_ys;
1690 const void *param;
1691 size_t remaining;
1692 size_t frag_len;
1693 size_t param_len;
1694 unsigned int i;
1695 int rc;
1696
1697 /* Parse ServerKeyExchange */
1698 param = data;
1699 remaining = len;
1700 for ( i = 0 ; i < ( sizeof ( dh_val ) / sizeof ( dh_val[0] ) ) ; i++ ){
1701 dh_val[i] = param;
1702 if ( ( sizeof ( *dh_val[i] ) > remaining ) ||
1703 ( ntohs ( dh_val[i]->len ) > ( remaining -
1704 sizeof ( *dh_val[i] ) ) )){
1705 DBGC ( tls, "TLS %p received underlength "
1706 "ServerKeyExchange\n", tls );
1707 DBGC_HDA ( tls, 0, data, len );
1708 return -EINVAL_KEY_EXCHANGE;
1709 }
1710 frag_len = ( sizeof ( *dh_val[i] ) + ntohs ( dh_val[i]->len ));
1711 param += frag_len;
1712 remaining -= frag_len;
1713 }
1714 param_len = ( len - remaining );
1715
1716 /* Identify named group */
1717 dh_p = dh_val[0];
1718 dh_g = dh_val[1];
1719 dh_ys = dh_val[2];
1720 group = tls_find_param_group ( dh_p->data, ntohs ( dh_p->len ),
1721 dh_g->data, ntohs ( dh_g->len ) );
1722 if ( ! group ) {
1723 DBGC ( tls, "TLS %p unsupported %d-bit group:\n",
1724 tls, ( 8 * ntohs ( dh_p->len ) ) );
1725 DBGC_HDA ( tls, 0, data, len );
1726 return -ENOTSUP_GROUP;
1727 }
1728 tls->key.group = group;
1729 exchange = group->exchange;
1730 DBGC ( tls, "TLS %p using named group %s\n", tls, exchange->name );
1731
1732 /* Generate pre-master secret */
1733 if ( ( rc = tls_agree_ephemeral ( tls, dh_ys->data,
1734 ntohs ( dh_ys->len ), 1 ) ) != 0 ) {
1735 return rc;
1736 }
1737
1738 /* Verify parameter signature */
1739 if ( ( rc = tls_verify_dh_params ( tls, data, len, param_len ) ) != 0 )
1740 return rc;
1741
1742 return 0;
1743}
1744
1745/**
1746 * Transmit Client Key Exchange record using DHE key exchange
1747 *
1748 * @v tls TLS connection
1749 * @ret rc Return status code
1750 */
1751static int tls_send_client_key_exchange_dhe ( struct tls_connection *tls ) {
1752 struct tls_key_schedule *key = &tls->key;
1753 struct tls_named_group *group = key->group;
1754 struct exchange_algorithm *exchange = group->exchange;
1755 size_t pubsize = exchange->pubsize;
1756 struct {
1757 uint32_t type_length;
1758 uint16_t dh_xs_len;
1759 uint8_t dh_xs[pubsize];
1760 } __attribute__ (( packed )) *key_xchg;
1761 int rc;
1762
1763 /* Allocate space */
1764 key_xchg = malloc ( sizeof ( *key_xchg ) );
1765 if ( ! key_xchg ) {
1766 rc = -ENOMEM;
1767 goto err_alloc;
1768 }
1769
1770 /* Generate Client Key Exchange record */
1771 key_xchg->type_length =
1772 ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
1773 htonl ( sizeof ( *key_xchg ) -
1774 sizeof ( key_xchg->type_length ) ) );
1775 key_xchg->dh_xs_len = htons ( sizeof ( key_xchg->dh_xs ) );
1776 if ( ( rc = tls_share_ephemeral ( tls, key_xchg->dh_xs ) ) != 0 )
1777 goto err_share;
1778
1779 /* Transmit Client Key Exchange record */
1780 if ( ( rc = tls_send_handshake ( tls, key_xchg,
1781 sizeof ( *key_xchg ) ) ) !=0 ) {
1782 goto err_send_handshake;
1783 }
1784
1785 err_send_handshake:
1786 err_share:
1787 zfree ( key_xchg );
1788 err_alloc:
1789 return rc;
1790}
1791
1792/** Ephemeral Diffie-Hellman key exchange algorithm */
1798
1799/**
1800 * Receive new Server Key Exchange record using ECDHE key exchange
1801 *
1802 * @v tls TLS connection
1803 * @v data Server Key Exchange handshake record
1804 * @v len Length of Server Key Exchange handshake record
1805 * @ret rc Return status code
1806 */
1807static int tls_new_server_key_exchange_ecdhe ( struct tls_connection *tls,
1808 const void *data, size_t len ) {
1809 struct tls_named_group *group;
1810 struct exchange_algorithm *exchange;
1811 const struct {
1812 uint8_t curve_type;
1813 uint16_t named_group;
1814 uint8_t public_len;
1815 uint8_t public[0];
1816 } __attribute__ (( packed )) *ecdh = data;
1817 size_t param_len;
1818 int rc;
1819
1820 /* Parse ServerKeyExchange record */
1821 if ( ( sizeof ( *ecdh ) > len ) ||
1822 ( ecdh->public_len > ( len - sizeof ( *ecdh ) ) ) ) {
1823 DBGC ( tls, "TLS %p received underlength ServerKeyExchange\n",
1824 tls );
1825 DBGC_HDA ( tls, 0, data, len );
1826 return -EINVAL_KEY_EXCHANGE;
1827 }
1828 param_len = ( sizeof ( *ecdh ) + ecdh->public_len );
1829
1830 /* Identify named group */
1831 if ( ecdh->curve_type != TLS_NAMED_CURVE_TYPE ) {
1832 DBGC ( tls, "TLS %p unsupported curve type %d\n",
1833 tls, ecdh->curve_type );
1834 DBGC_HDA ( tls, 0, data, len );
1835 return -ENOTSUP_GROUP;
1836 }
1837 group = tls_find_named_group ( ecdh->named_group );
1838 if ( ! group ) {
1839 DBGC ( tls, "TLS %p unsupported named group %d\n",
1840 tls, ntohs ( ecdh->named_group ) );
1841 DBGC_HDA ( tls, 0, data, len );
1842 return -ENOTSUP_GROUP;
1843 }
1844 tls->key.group = group;
1845 exchange = group->exchange;
1846 DBGC ( tls, "TLS %p using named group %s\n", tls, exchange->name );
1847
1848 /* Generate pre-master secret */
1849 if ( ( rc = tls_agree_ephemeral ( tls, ecdh->public,
1850 ecdh->public_len, 0 ) ) != 0 ) {
1851 return rc;
1852 }
1853
1854 /* Verify parameter signature */
1855 if ( ( rc = tls_verify_dh_params ( tls, data, len, param_len ) ) != 0 )
1856 return rc;
1857
1858 return 0;
1859}
1860
1861/**
1862 * Transmit Client Key Exchange record using ECDHE key exchange
1863 *
1864 * @v tls TLS connection
1865 * @ret rc Return status code
1866 */
1867static int tls_send_client_key_exchange_ecdhe ( struct tls_connection *tls ) {
1868 struct tls_key_schedule *key = &tls->key;
1869 struct tls_named_group *group = key->group;
1870 struct exchange_algorithm *exchange = group->exchange;
1871 size_t pubsize = exchange->pubsize;
1872 struct {
1873 uint32_t type_length;
1874 uint8_t public_len;
1875 uint8_t public[pubsize];
1876 } __attribute__ (( packed )) key_xchg;
1877 int rc;
1878
1879 /* Generate Client Key Exchange record */
1880 key_xchg.type_length =
1881 ( cpu_to_le32 ( TLS_CLIENT_KEY_EXCHANGE ) |
1882 htonl ( sizeof ( key_xchg ) -
1883 sizeof ( key_xchg.type_length ) ) );
1884 key_xchg.public_len = sizeof ( key_xchg.public );
1885 if ( ( rc = tls_share_ephemeral ( tls, key_xchg.public ) ) != 0 )
1886 return rc;
1887
1888 /* Transmit Client Key Exchange record */
1889 if ( ( rc = tls_send_handshake ( tls, &key_xchg,
1890 sizeof ( key_xchg ) ) ) !=0 ) {
1891 return rc;
1892 }
1893
1894 return 0;
1895}
1896
1897/** Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm */
1903
1904/******************************************************************************
1905 *
1906 * Record handling
1907 *
1908 ******************************************************************************
1909 */
1910
1911/**
1912 * Resume TX state machine
1913 *
1914 * @v tls TLS connection
1915 */
1916static void tls_tx_resume ( struct tls_connection *tls ) {
1917 process_add ( &tls->tx.process );
1918}
1919
1920/**
1921 * Resume TX state machine for all connections within a session
1922 *
1923 * @v session TLS session
1924 */
1925static void tls_tx_resume_all ( struct tls_session *session ) {
1926 struct tls_connection *tls;
1927
1928 list_for_each_entry ( tls, &session->conn, list )
1929 tls_tx_resume ( tls );
1930}
1931
1932/**
1933 * Restart negotiation
1934 *
1935 * @v tls TLS connection
1936 */
1937static void tls_restart ( struct tls_connection *tls ) {
1938
1939 /* Sanity check */
1940 assert ( ! tls->tx.pending );
1941 assert ( ! is_pending ( &tls->client.negotiation ) );
1942 assert ( ! is_pending ( &tls->server.negotiation ) );
1943 assert ( ! is_pending ( &tls->server.validation ) );
1944
1945 /* Reset ephemeral master secret */
1946 tls_regenerate_ephemeral_master ( tls );
1947
1948 /* (Re)start negotiation */
1949 tls->tx.pending = TLS_TX_CLIENT_HELLO;
1950 tls_tx_resume ( tls );
1951 pending_get ( &tls->client.negotiation );
1952 pending_get ( &tls->server.negotiation );
1953}
1954
1955/**
1956 * Transmit Handshake record
1957 *
1958 * @v tls TLS connection
1959 * @v data Plaintext record
1960 * @v len Length of plaintext record
1961 * @ret rc Return status code
1962 */
1963static int tls_send_handshake ( struct tls_connection *tls,
1964 const void *data, size_t len ) {
1965
1966 /* Send record */
1967 return tls_send_plaintext ( tls, TLS_TYPE_HANDSHAKE, data, len );
1968}
1969
1970/**
1971 * Digest or transmit Client Hello record
1972 *
1973 * @v tls TLS connection
1974 * @v action Action to take on Client Hello record
1975 * @ret rc Return status code
1976 */
1977static int tls_client_hello ( struct tls_connection *tls,
1978 int ( * action ) ( struct tls_connection *tls,
1979 const void *data,
1980 size_t len ) ) {
1981 struct tls_session *session = tls->session;
1982 size_t name_len = strlen ( session->name );
1983 struct {
1984 uint16_t type;
1985 uint16_t len;
1986 struct {
1987 uint16_t len;
1988 struct {
1989 uint8_t type;
1990 uint16_t len;
1991 uint8_t name[name_len];
1992 } __attribute__ (( packed )) list[1];
1993 } __attribute__ (( packed )) data;
1994 } __attribute__ (( packed )) *server_name_ext;
1995 struct {
1996 uint16_t type;
1997 uint16_t len;
1998 struct {
1999 uint8_t max;
2000 } __attribute__ (( packed )) data;
2001 } __attribute__ (( packed )) *max_fragment_length_ext;
2002 struct {
2003 uint16_t type;
2004 uint16_t len;
2005 struct {
2006 uint16_t len;
2007 uint16_t code[TLS_NUM_SIG_HASH_ALGORITHMS];
2008 } __attribute__ (( packed )) data;
2009 } __attribute__ (( packed )) *signature_algorithms_ext;
2010 struct {
2011 uint16_t type;
2012 uint16_t len;
2013 struct {
2014 uint8_t len;
2015 uint8_t data[ tls->secure_renegotiation ?
2016 sizeof ( tls->verify.client ) :0 ];
2017 } __attribute__ (( packed )) data;
2018 } __attribute__ (( packed )) *renegotiation_info_ext;
2019 struct {
2020 uint16_t type;
2021 uint16_t len;
2022 struct {
2023 uint8_t data[session->ticket_len];
2024 } __attribute__ (( packed )) data;
2025 } __attribute__ (( packed )) *session_ticket_ext;
2026 struct {
2027 uint16_t type;
2028 uint16_t len;
2029 struct {
2030 uint16_t len;
2031 uint16_t code[TLS_NUM_NAMED_GROUPS];
2032 } __attribute__ (( packed )) data;
2033 } __attribute__ (( packed )) *named_group_ext;
2034 struct {
2035 uint16_t type;
2036 uint16_t len;
2037 } __attribute__ (( packed )) *extended_master_secret_ext;
2038 struct {
2039 typeof ( *server_name_ext ) server_name;
2040 typeof ( *max_fragment_length_ext ) max_fragment_length;
2041 typeof ( *signature_algorithms_ext ) signature_algorithms;
2042 typeof ( *renegotiation_info_ext ) renegotiation_info;
2043 typeof ( *session_ticket_ext ) session_ticket;
2044 typeof ( *extended_master_secret_ext ) extended_master_secret;
2045 typeof ( *named_group_ext )
2046 named_group[TLS_NUM_NAMED_GROUPS ? 1 : 0];
2047 } __attribute__ (( packed )) *extensions;
2048 struct {
2049 uint32_t type_length;
2050 uint16_t version;
2051 uint8_t random[32];
2052 uint8_t session_id_len;
2053 uint8_t session_id[tls->session_id_len];
2054 uint16_t cipher_suite_len;
2055 uint16_t cipher_suites[TLS_NUM_CIPHER_SUITES];
2056 uint8_t compression_methods_len;
2057 uint8_t compression_methods[1];
2058 uint16_t extensions_len;
2059 typeof ( *extensions ) extensions;
2060 } __attribute__ (( packed )) hello;
2061 struct tls_cipher_suite *suite;
2062 struct tls_signature_hash_algorithm *sighash;
2063 struct tls_named_group *group;
2064 unsigned int i;
2065
2066 /* Construct record */
2067 memset ( &hello, 0, sizeof ( hello ) );
2068 hello.type_length = ( cpu_to_le32 ( TLS_CLIENT_HELLO ) |
2069 htonl ( sizeof ( hello ) -
2070 sizeof ( hello.type_length ) ) );
2071 hello.version = htons ( TLS_VERSION_MAX );
2072 memcpy ( &hello.random, &tls->client.random, sizeof ( hello.random ) );
2073 hello.session_id_len = tls->session_id_len;
2074 memcpy ( hello.session_id, tls->session_id,
2075 sizeof ( hello.session_id ) );
2076 hello.cipher_suite_len = htons ( sizeof ( hello.cipher_suites ) );
2077 i = 0 ; for_each_table_entry ( suite, TLS_CIPHER_SUITES )
2078 hello.cipher_suites[i++] = suite->code;
2079 hello.compression_methods_len = sizeof ( hello.compression_methods );
2080 hello.extensions_len = htons ( sizeof ( hello.extensions ) );
2081 extensions = &hello.extensions;
2082
2083 /* Construct server name extension */
2084 server_name_ext = &extensions->server_name;
2085 server_name_ext->type = htons ( TLS_SERVER_NAME );
2086 server_name_ext->len = htons ( sizeof ( server_name_ext->data ) );
2087 server_name_ext->data.len
2088 = htons ( sizeof ( server_name_ext->data.list ) );
2089 server_name_ext->data.list[0].type = TLS_SERVER_NAME_HOST_NAME;
2090 server_name_ext->data.list[0].len
2091 = htons ( sizeof ( server_name_ext->data.list[0].name ) );
2092 memcpy ( server_name_ext->data.list[0].name, session->name,
2093 sizeof ( server_name_ext->data.list[0].name ) );
2094
2095 /* Construct maximum fragment length extension */
2096 max_fragment_length_ext = &extensions->max_fragment_length;
2097 max_fragment_length_ext->type = htons ( TLS_MAX_FRAGMENT_LENGTH );
2098 max_fragment_length_ext->len
2099 = htons ( sizeof ( max_fragment_length_ext->data ) );
2100 max_fragment_length_ext->data.max = TLS_MAX_FRAGMENT_LENGTH_VALUE;
2101
2102 /* Construct supported signature algorithms extension */
2103 signature_algorithms_ext = &extensions->signature_algorithms;
2104 signature_algorithms_ext->type = htons ( TLS_SIGNATURE_ALGORITHMS );
2105 signature_algorithms_ext->len
2106 = htons ( sizeof ( signature_algorithms_ext->data ) );
2107 signature_algorithms_ext->data.len
2108 = htons ( sizeof ( signature_algorithms_ext->data.code ) );
2109 i = 0 ; for_each_table_entry ( sighash, TLS_SIG_HASH_ALGORITHMS )
2110 signature_algorithms_ext->data.code[i++] = sighash->code;
2111
2112 /* Construct renegotiation information extension */
2113 renegotiation_info_ext = &extensions->renegotiation_info;
2114 renegotiation_info_ext->type = htons ( TLS_RENEGOTIATION_INFO );
2115 renegotiation_info_ext->len
2116 = htons ( sizeof ( renegotiation_info_ext->data ) );
2117 renegotiation_info_ext->data.len
2118 = sizeof ( renegotiation_info_ext->data.data );
2119 memcpy ( renegotiation_info_ext->data.data, tls->verify.client,
2120 sizeof ( renegotiation_info_ext->data.data ) );
2121
2122 /* Construct session ticket extension */
2123 session_ticket_ext = &extensions->session_ticket;
2124 session_ticket_ext->type = htons ( TLS_SESSION_TICKET );
2125 session_ticket_ext->len
2126 = htons ( sizeof ( session_ticket_ext->data ) );
2127 memcpy ( session_ticket_ext->data.data, session->ticket,
2128 sizeof ( session_ticket_ext->data.data ) );
2129
2130 /* Construct extended master secret extension */
2131 extended_master_secret_ext = &extensions->extended_master_secret;
2132 extended_master_secret_ext->type
2133 = htons ( TLS_EXTENDED_MASTER_SECRET );
2134 extended_master_secret_ext->len = 0;
2135
2136 /* Construct named groups extension, if applicable */
2137 if ( sizeof ( extensions->named_group ) ) {
2138 named_group_ext = &extensions->named_group[0];
2139 named_group_ext->type = htons ( TLS_NAMED_GROUP );
2140 named_group_ext->len
2141 = htons ( sizeof ( named_group_ext->data ) );
2142 named_group_ext->data.len
2143 = htons ( sizeof ( named_group_ext->data.code ) );
2144 i = 0 ; for_each_table_entry ( group, TLS_NAMED_GROUPS ) {
2145 if ( group->code )
2146 named_group_ext->data.code[i++] = group->code;
2147 }
2148 assert ( i == TLS_NUM_NAMED_GROUPS );
2149 }
2150
2151 return action ( tls, &hello, sizeof ( hello ) );
2152}
2153
2154/**
2155 * Transmit Client Hello record
2156 *
2157 * @v tls TLS connection
2158 * @ret rc Return status code
2159 */
2160static int tls_send_client_hello ( struct tls_connection *tls ) {
2161
2162 return tls_client_hello ( tls, tls_send_handshake );
2163}
2164
2165/**
2166 * Transmit Certificate record
2167 *
2168 * @v tls TLS connection
2169 * @ret rc Return status code
2170 */
2171static int tls_send_certificate ( struct tls_connection *tls ) {
2172 struct {
2173 tls24_t length;
2174 uint8_t data[0];
2175 } __attribute__ (( packed )) *certificate;
2176 struct {
2177 uint32_t type_length;
2178 tls24_t length;
2179 typeof ( *certificate ) certificates[0];
2180 } __attribute__ (( packed )) *certificates;
2181 struct x509_link *link;
2182 struct x509_certificate *cert;
2183 struct io_buffer *iobuf;
2184 size_t len;
2185
2186 /* Calculate length of client certificates */
2187 len = 0;
2188 list_for_each_entry ( link, &tls->client.chain->links, list ) {
2189 cert = link->cert;
2190 len += ( sizeof ( *certificate ) + cert->raw.len );
2191 DBGC ( tls, "TLS %p sending client certificate %s\n",
2192 tls, x509_name ( cert ) );
2193 }
2194
2195 /* Allocate storage for Certificate record (which may be too
2196 * large for the stack).
2197 */
2198 iobuf = tls_alloc_iob ( tls, ( sizeof ( *certificates ) + len ) );
2199 if ( ! iobuf )
2200 return -ENOMEM_CERTIFICATE;
2201
2202 /* Populate record */
2203 certificates = iob_put ( iobuf, sizeof ( *certificates ) );
2204 certificates->type_length =
2205 ( cpu_to_le32 ( TLS_CERTIFICATE ) |
2206 htonl ( sizeof ( *certificates ) + len -
2207 sizeof ( certificates->type_length ) ) );
2208 tls_set_uint24 ( &certificates->length, len );
2209 list_for_each_entry ( link, &tls->client.chain->links, list ) {
2210 cert = link->cert;
2211 certificate = iob_put ( iobuf, sizeof ( *certificate ) );
2212 tls_set_uint24 ( &certificate->length, cert->raw.len );
2213 memcpy ( iob_put ( iobuf, cert->raw.len ), cert->raw.data,
2214 cert->raw.len );
2215 }
2216
2217 /* Transmit record */
2218 return tls_send_record ( tls, TLS_TYPE_HANDSHAKE,
2219 iob_disown ( iobuf ) );
2220}
2221
2222/**
2223 * Transmit Client Key Exchange record
2224 *
2225 * @v tls TLS connection
2226 * @ret rc Return status code
2227 */
2228static int tls_send_client_key_exchange ( struct tls_connection *tls ) {
2229 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
2230 struct tls_cipher_suite *suite = cipherspec->suite;
2231 int rc;
2232
2233 /* Transmit Client Key Exchange record via key exchange algorithm */
2234 if ( ( rc = suite->exchange->client ( tls ) ) != 0 ) {
2235 DBGC ( tls, "TLS %p could not exchange keys: %s\n",
2236 tls, strerror ( rc ) );
2237 return rc;
2238 }
2239
2240 /* Generate master secret */
2241 tls_generate_master_secret ( tls );
2242
2243 /* Generate keys from master secret */
2244 if ( ( rc = tls_generate_keys ( tls ) ) != 0 ) {
2245 DBGC ( tls, "TLS %p could not generate keys: %s\n",
2246 tls, strerror ( rc ) );
2247 return rc;
2248 }
2249
2250 return 0;
2251}
2252
2253/**
2254 * Transmit Certificate Verify record
2255 *
2256 * @v tls TLS connection
2257 * @ret rc Return status code
2258 */
2259static int tls_send_certificate_verify ( struct tls_connection *tls ) {
2260 struct digest_algorithm *digest = tls->key.digest;
2261 struct x509_certificate *cert = x509_first ( tls->client.chain );
2262 struct pubkey_algorithm *pubkey = cert->signature_algorithm->pubkey;
2263 struct asn1_cursor *key = privkey_cursor ( tls->client.key );
2264 uint8_t digest_out[ digest->digestsize ];
2265 struct tls_signature_hash_algorithm *sig_hash = NULL;
2266 struct asn1_builder builder = { NULL, 0 };
2267 int rc;
2268
2269 /* Generate digest to be signed */
2270 tls_verify_handshake ( tls, digest_out );
2271
2272 /* TLSv1.2 and later use explicit algorithm identifiers */
2273 if ( tls_version ( tls, TLS_VERSION_TLS_1_2 ) ) {
2274 sig_hash = tls_signature_hash_algorithm ( pubkey, digest );
2275 if ( ! sig_hash ) {
2276 DBGC ( tls, "TLS %p could not identify (%s,%s) "
2277 "signature and hash algorithm\n", tls,
2278 pubkey->name, digest->name );
2279 rc = -ENOTSUP_SIG_HASH;
2280 goto err_sig_hash;
2281 }
2282 }
2283
2284 /* Sign digest */
2285 if ( ( rc = pubkey_sign ( pubkey, key, digest, digest_out,
2286 &builder ) ) != 0 ) {
2287 DBGC ( tls, "TLS %p could not sign %s digest using %s client "
2288 "private key: %s\n", tls, digest->name, pubkey->name,
2289 strerror ( rc ) );
2290 goto err_pubkey_sign;
2291 }
2292
2293 /* Construct Certificate Verify record */
2294 {
2295 int use_sig_hash = ( ( sig_hash == NULL ) ? 0 : 1 );
2296 struct {
2297 uint32_t type_length;
2298 uint16_t sig_hash[use_sig_hash];
2299 uint16_t signature_len;
2300 } __attribute__ (( packed )) header;
2301
2302 header.type_length = ( cpu_to_le32 ( TLS_CERTIFICATE_VERIFY ) |
2303 htonl ( builder.len +
2304 sizeof ( header ) -
2305 sizeof ( header.type_length )));
2306 if ( use_sig_hash ) {
2307 memcpy ( &header.sig_hash[0], &sig_hash->code,
2308 sizeof ( header.sig_hash[0] ) );
2309 }
2310 header.signature_len = htons ( builder.len );
2311
2312 if ( ( rc = asn1_prepend_raw ( &builder, &header,
2313 sizeof ( header ) ) ) != 0 ) {
2314 DBGC ( tls, "TLS %p could not construct Certificate "
2315 "Verify: %s\n", tls, strerror ( rc ) );
2316 goto err_prepend;
2317 }
2318 }
2319
2320 /* Transmit record */
2321 if ( ( rc = tls_send_handshake ( tls, builder.data,
2322 builder.len ) ) != 0 ) {
2323 goto err_send;
2324 }
2325
2326 err_send:
2327 err_prepend:
2328 err_pubkey_sign:
2329 err_sig_hash:
2330 zfree ( builder.data );
2331 return rc;
2332}
2333
2334/**
2335 * Transmit Change Cipher record
2336 *
2337 * @v tls TLS connection
2338 * @ret rc Return status code
2339 */
2340static int tls_send_change_cipher ( struct tls_connection *tls ) {
2341 static const struct {
2342 uint8_t spec;
2343 } __attribute__ (( packed )) change_cipher = {
2344 .spec = TLS_CHANGE_CIPHER_SPEC,
2345 };
2346
2347 return tls_send_plaintext ( tls, TLS_TYPE_CHANGE_CIPHER,
2348 &change_cipher, sizeof ( change_cipher ) );
2349}
2350
2351/**
2352 * Transmit Finished record
2353 *
2354 * @v tls TLS connection
2355 * @ret rc Return status code
2356 */
2357static int tls_send_finished ( struct tls_connection *tls ) {
2358 struct digest_algorithm *digest = tls->key.digest;
2359 struct tls_key_schedule *key = &tls->key;
2360 struct {
2361 uint32_t type_length;
2362 uint8_t verify_data[ sizeof ( tls->verify.client ) ];
2363 } __attribute__ (( packed )) finished;
2364 uint8_t digest_out[ digest->digestsize ];
2365 int rc;
2366
2367 /* Fail unless bound identity has been validated */
2368 if ( ! ( key->bound &&
2369 x509_is_valid ( key->bound, tls->server.root ) ) ) {
2370 DBGC ( tls, "TLS %p bound identity is not valid\n", tls );
2371 return -EPERM_BOUND;
2372 }
2373
2374 /* Construct client verification data */
2375 tls_verify_handshake ( tls, digest_out );
2376 tls_prf_label ( tls, tls->verify.client, sizeof ( tls->verify.client ),
2377 "client finished", digest_out, sizeof ( digest_out ) );
2378
2379 /* Construct record */
2380 memset ( &finished, 0, sizeof ( finished ) );
2381 finished.type_length = ( cpu_to_le32 ( TLS_FINISHED ) |
2382 htonl ( sizeof ( finished ) -
2383 sizeof ( finished.type_length ) ) );
2384 memcpy ( finished.verify_data, tls->verify.client,
2385 sizeof ( finished.verify_data ) );
2386
2387 /* Transmit record */
2388 if ( ( rc = tls_send_handshake ( tls, &finished,
2389 sizeof ( finished ) ) ) != 0 )
2390 return rc;
2391
2392 /* Mark client as finished */
2393 pending_put ( &tls->client.negotiation );
2394
2395 return 0;
2396}
2397
2398/**
2399 * Transmit Alert record
2400 *
2401 * @v tls TLS connection
2402 * @v level Alert level
2403 * @v description Alert description
2404 * @ret rc Return status code
2405 */
2406static int tls_send_alert ( struct tls_connection *tls, unsigned int level,
2407 unsigned int description ) {
2408 const struct {
2409 uint8_t level;
2410 uint8_t description;
2411 } __attribute__ (( packed )) alert = {
2412 .level = level,
2413 .description = description,
2414 };
2415
2416 /* Send record */
2417 return tls_send_plaintext ( tls, TLS_TYPE_ALERT, &alert,
2418 sizeof ( alert ) );
2419}
2420
2421/**
2422 * Receive new Change Cipher record
2423 *
2424 * @v tls TLS connection
2425 * @v iobuf I/O buffer
2426 * @ret rc Return status code
2427 */
2428static int tls_new_change_cipher ( struct tls_connection *tls,
2429 struct io_buffer *iobuf ) {
2430 const struct {
2431 uint8_t spec;
2432 } __attribute__ (( packed )) *change_cipher = iobuf->data;
2433 size_t len = iob_len ( iobuf );
2434 int rc;
2435
2436 /* Sanity check */
2437 if ( ( sizeof ( *change_cipher ) != len ) ||
2438 ( change_cipher->spec != TLS_CHANGE_CIPHER_SPEC ) ) {
2439 DBGC ( tls, "TLS %p received invalid Change Cipher\n", tls );
2440 DBGC_HD ( tls, change_cipher, len );
2441 return -EINVAL_CHANGE_CIPHER;
2442 }
2443 iob_pull ( iobuf, sizeof ( *change_cipher ) );
2444
2445 /* Change receive cipher spec */
2446 if ( ( rc = tls_change_cipher ( tls, &tls->rx.cipherspec ) ) != 0 ) {
2447 DBGC ( tls, "TLS %p could not activate RX cipher: %s\n",
2448 tls, strerror ( rc ) );
2449 return rc;
2450 }
2451 tls->rx.seq = ~( ( uint64_t ) 0 );
2452
2453 return 0;
2454}
2455
2456/**
2457 * Receive new Alert record
2458 *
2459 * @v tls TLS connection
2460 * @v iobuf I/O buffer
2461 * @ret rc Return status code
2462 */
2463static int tls_new_alert ( struct tls_connection *tls,
2464 struct io_buffer *iobuf ) {
2465 const struct {
2466 uint8_t level;
2467 uint8_t description;
2468 char next[0];
2469 } __attribute__ (( packed )) *alert = iobuf->data;
2470 size_t len = iob_len ( iobuf );
2471
2472 /* Sanity check */
2473 if ( sizeof ( *alert ) != len ) {
2474 DBGC ( tls, "TLS %p received overlength Alert\n", tls );
2475 DBGC_HD ( tls, alert, len );
2476 return -EINVAL_ALERT;
2477 }
2478 iob_pull ( iobuf, sizeof ( *alert ) );
2479
2480 /* Handle alert */
2481 switch ( alert->level ) {
2482 case TLS_ALERT_WARNING:
2483 switch ( alert->description ) {
2484 case TLS_ALERT_CLOSE_NOTIFY:
2485 DBGC ( tls, "TLS %p closed by notification\n", tls );
2486 tls_close ( tls, 0 );
2487 break;
2488 default:
2489 DBGC ( tls, "TLS %p received warning alert %d\n",
2490 tls, alert->description );
2491 break;
2492 }
2493 return 0;
2494 case TLS_ALERT_FATAL:
2495 DBGC ( tls, "TLS %p received fatal alert %d\n",
2496 tls, alert->description );
2497 return -EPERM_ALERT;
2498 default:
2499 DBGC ( tls, "TLS %p received unknown alert level %d"
2500 "(alert %d)\n", tls, alert->level, alert->description );
2501 return -EIO_ALERT;
2502 }
2503}
2504
2505/**
2506 * Receive new Hello Request handshake record
2507 *
2508 * @v tls TLS connection
2509 * @v data Plaintext handshake record
2510 * @v len Length of plaintext handshake record
2511 * @ret rc Return status code
2512 */
2513static int tls_new_hello_request ( struct tls_connection *tls,
2514 const void *data __unused,
2515 size_t len __unused ) {
2516
2517 /* Ignore if a handshake is in progress */
2518 if ( ! tls_ready ( tls ) ) {
2519 DBGC ( tls, "TLS %p ignoring Hello Request\n", tls );
2520 return 0;
2521 }
2522
2523 /* Fail unless server supports secure renegotiation */
2524 if ( ! ( tls->secure_renegotiation && tls->extended_master_secret ) ) {
2525 DBGC ( tls, "TLS %p refusing to renegotiate insecurely\n",
2526 tls );
2527 return -EPERM_RENEG_INSECURE;
2528 }
2529
2530 /* Restart negotiation */
2531 tls_restart ( tls );
2532
2533 return 0;
2534}
2535
2536/**
2537 * Receive new Server Hello handshake record
2538 *
2539 * @v tls TLS connection
2540 * @v data Plaintext handshake record
2541 * @v len Length of plaintext handshake record
2542 * @ret rc Return status code
2543 */
2544static int tls_new_server_hello ( struct tls_connection *tls,
2545 const void *data, size_t len ) {
2546 const struct {
2547 uint16_t version;
2548 uint8_t random[32];
2549 uint8_t session_id_len;
2550 uint8_t session_id[0];
2551 } __attribute__ (( packed )) *hello_a = data;
2552 const uint8_t *session_id;
2553 const struct {
2554 uint16_t cipher_suite;
2555 uint8_t compression_method;
2556 char next[0];
2557 } __attribute__ (( packed )) *hello_b;
2558 const struct {
2559 uint16_t len;
2560 uint8_t data[0];
2561 } __attribute__ (( packed )) *exts;
2562 const struct {
2563 uint16_t type;
2564 uint16_t len;
2565 uint8_t data[0];
2566 } __attribute__ (( packed )) *ext;
2567 const struct {
2568 uint8_t len;
2569 uint8_t data[0];
2570 } __attribute__ (( packed )) *reneg = NULL;
2571 const struct {
2572 uint8_t data[0];
2573 } __attribute__ (( packed )) *ems = NULL;
2574 uint16_t version;
2575 size_t exts_len;
2576 size_t ext_len;
2577 size_t remaining;
2578 int rc;
2579
2580 /* Parse header */
2581 if ( ( sizeof ( *hello_a ) > len ) ||
2582 ( hello_a->session_id_len > ( len - sizeof ( *hello_a ) ) ) ||
2583 ( sizeof ( *hello_b ) > ( len - sizeof ( *hello_a ) -
2584 hello_a->session_id_len ) ) ) {
2585 DBGC ( tls, "TLS %p received underlength Server Hello\n", tls );
2586 DBGC_HD ( tls, data, len );
2587 return -EINVAL_HELLO;
2588 }
2589 session_id = hello_a->session_id;
2590 hello_b = ( ( void * ) ( session_id + hello_a->session_id_len ) );
2591
2592 /* Parse extensions, if present */
2593 remaining = ( len - sizeof ( *hello_a ) - hello_a->session_id_len -
2594 sizeof ( *hello_b ) );
2595 if ( remaining ) {
2596
2597 /* Parse extensions length */
2598 exts = ( ( void * ) hello_b->next );
2599 if ( ( sizeof ( *exts ) > remaining ) ||
2600 ( ( exts_len = ntohs ( exts->len ) ) >
2601 ( remaining - sizeof ( *exts ) ) ) ) {
2602 DBGC ( tls, "TLS %p received underlength extensions\n",
2603 tls );
2604 DBGC_HD ( tls, data, len );
2605 return -EINVAL_HELLO;
2606 }
2607
2608 /* Parse extensions */
2609 for ( ext = ( ( void * ) exts->data ), remaining = exts_len ;
2610 remaining ;
2611 ext = ( ( ( void * ) ext ) + sizeof ( *ext ) + ext_len ),
2612 remaining -= ( sizeof ( *ext ) + ext_len ) ) {
2613
2614 /* Parse extension length */
2615 if ( ( sizeof ( *ext ) > remaining ) ||
2616 ( ( ext_len = ntohs ( ext->len ) ) >
2617 ( remaining - sizeof ( *ext ) ) ) ) {
2618 DBGC ( tls, "TLS %p received underlength "
2619 "extension\n", tls );
2620 DBGC_HD ( tls, data, len );
2621 return -EINVAL_HELLO;
2622 }
2623
2624 /* Record known extensions */
2625 switch ( ext->type ) {
2626 case htons ( TLS_RENEGOTIATION_INFO ) :
2627 reneg = ( ( void * ) ext->data );
2628 if ( ( sizeof ( *reneg ) > ext_len ) ||
2629 ( reneg->len >
2630 ( ext_len - sizeof ( *reneg ) ) ) ) {
2631 DBGC ( tls, "TLS %p received "
2632 "underlength renegotiation "
2633 "info\n", tls );
2634 DBGC_HD ( tls, data, len );
2635 return -EINVAL_HELLO;
2636 }
2637 break;
2638 case htons ( TLS_EXTENDED_MASTER_SECRET ) :
2639 ems = ( ( void * ) ext->data );
2640 break;
2641 }
2642 }
2643 }
2644
2645 /* Check and store protocol version */
2646 version = ntohs ( hello_a->version );
2647 if ( version < TLS_VERSION_MIN ) {
2648 DBGC ( tls, "TLS %p does not support protocol version %d.%d\n",
2649 tls, ( version >> 8 ), ( version & 0xff ) );
2650 return -ENOTSUP_VERSION;
2651 }
2652 if ( version > tls->version ) {
2653 DBGC ( tls, "TLS %p server attempted to illegally upgrade to "
2654 "protocol version %d.%d\n",
2655 tls, ( version >> 8 ), ( version & 0xff ) );
2656 return -EPROTO_VERSION;
2657 }
2658 tls->version = version;
2659 DBGC ( tls, "TLS %p using protocol version %d.%d\n",
2660 tls, ( version >> 8 ), ( version & 0xff ) );
2661
2662 /* Select cipher suite */
2663 if ( ( rc = tls_select_cipher ( tls, hello_b->cipher_suite ) ) != 0 )
2664 return rc;
2665
2666 /* Add preceding Client Hello to handshake digest */
2667 if ( ( rc = tls_client_hello ( tls, tls_add_handshake ) ) != 0 )
2668 return rc;
2669
2670 /* Copy out server random bytes */
2671 memcpy ( &tls->server.random, &hello_a->random,
2672 sizeof ( tls->server.random ) );
2673
2674 /* Handle extended master secret */
2675 tls->extended_master_secret = ( !! ems );
2676
2677 /* Check session ID */
2678 if ( hello_a->session_id_len &&
2679 ( hello_a->session_id_len == tls->session_id_len ) &&
2680 ( memcmp ( session_id, tls->session_id,
2681 tls->session_id_len ) == 0 ) ) {
2682
2683 /* Session ID match: reuse master secret */
2684 DBGC ( tls, "TLS %p resuming session ID:\n", tls );
2685 DBGC_HDA ( tls, 0, tls->session_id, tls->session_id_len );
2686 tls_resume_secret ( tls );
2687 if ( ( rc = tls_generate_keys ( tls ) ) != 0 )
2688 return rc;
2689
2690 /* Ensure master secret generation method matches */
2691 if ( tls->extended_master_secret !=
2692 tls->session->extended_master_secret ) {
2693 DBGC ( tls, "TLS %p mismatched extended master secret "
2694 "extension\n", tls );
2695 return -EPERM_EMS;
2696 }
2697
2698 } else {
2699
2700 /* Record new session ID, if present */
2701 if ( hello_a->session_id_len &&
2702 ( hello_a->session_id_len <= sizeof ( tls->session_id ))){
2703 tls->session_id_len = hello_a->session_id_len;
2704 memcpy ( tls->session_id, session_id,
2705 tls->session_id_len );
2706 DBGC ( tls, "TLS %p new session ID:\n", tls );
2707 DBGC_HDA ( tls, 0, tls->session_id,
2708 tls->session_id_len );
2709 }
2710 }
2711
2712 /* Handle secure renegotiation */
2713 if ( tls->secure_renegotiation ) {
2714
2715 /* Secure renegotiation is expected; verify data */
2716 if ( ( reneg == NULL ) ||
2717 ( reneg->len != sizeof ( tls->verify ) ) ||
2718 ( memcmp ( reneg->data, &tls->verify,
2719 sizeof ( tls->verify ) ) != 0 ) ) {
2720 DBGC ( tls, "TLS %p server failed secure "
2721 "renegotiation\n", tls );
2722 return -EPERM_RENEG_VERIFY;
2723 }
2724
2725 } else if ( reneg != NULL ) {
2726
2727 /* Secure renegotiation is being enabled */
2728 if ( reneg->len != 0 ) {
2729 DBGC ( tls, "TLS %p server provided non-empty initial "
2730 "renegotiation\n", tls );
2731 return -EPERM_RENEG_VERIFY;
2732 }
2733 tls->secure_renegotiation = 1;
2734 }
2735
2736 return 0;
2737}
2738
2739/**
2740 * Receive New Session Ticket handshake record
2741 *
2742 * @v tls TLS connection
2743 * @v data Plaintext handshake record
2744 * @v len Length of plaintext handshake record
2745 * @ret rc Return status code
2746 */
2747static int tls_new_session_ticket ( struct tls_connection *tls,
2748 const void *data, size_t len ) {
2749 const struct {
2750 uint32_t lifetime;
2751 uint16_t len;
2752 uint8_t ticket[0];
2753 } __attribute__ (( packed )) *new_session_ticket = data;
2754 size_t ticket_len;
2755
2756 /* Parse header */
2757 if ( sizeof ( *new_session_ticket ) > len ) {
2758 DBGC ( tls, "TLS %p received underlength New Session Ticket\n",
2759 tls );
2760 DBGC_HD ( tls, data, len );
2761 return -EINVAL_TICKET;
2762 }
2763 ticket_len = ntohs ( new_session_ticket->len );
2764 if ( ticket_len > ( len - sizeof ( *new_session_ticket ) ) ) {
2765 DBGC ( tls, "TLS %p received overlength New Session Ticket\n",
2766 tls );
2767 DBGC_HD ( tls, data, len );
2768 return -EINVAL_TICKET;
2769 }
2770
2771 /* Free any unapplied new session ticket */
2772 zfree ( tls->new_session_ticket );
2773 tls->new_session_ticket = NULL;
2774 tls->new_session_ticket_len = 0;
2775
2776 /* Record ticket */
2777 tls->new_session_ticket = malloc ( ticket_len );
2778 if ( ! tls->new_session_ticket )
2779 return -ENOMEM;
2780 memcpy ( tls->new_session_ticket, new_session_ticket->ticket,
2781 ticket_len );
2782 tls->new_session_ticket_len = ticket_len;
2783 DBGC ( tls, "TLS %p new session ticket:\n", tls );
2784 DBGC_HDA ( tls, 0, tls->new_session_ticket,
2785 tls->new_session_ticket_len );
2786
2787 return 0;
2788}
2789
2790/**
2791 * Parse certificate chain
2792 *
2793 * @v tls TLS connection
2794 * @v data Certificate chain
2795 * @v len Length of certificate chain
2796 * @ret rc Return status code
2797 */
2798static int tls_parse_chain ( struct tls_connection *tls,
2799 const void *data, size_t len ) {
2800 struct x509_certificate *cert;
2801 size_t remaining = len;
2802 int rc;
2803
2804 /* Free any existing certificate chain */
2805 x509_chain_put ( tls->server.chain );
2806 tls->server.chain = NULL;
2807
2808 /* Certificate has changed and so the key schedule is no
2809 * longer bound to the server identity.
2810 */
2811 tls->key.bound = 0;
2812
2813 /* Create certificate chain */
2814 tls->server.chain = x509_alloc_chain();
2815 if ( ! tls->server.chain ) {
2816 rc = -ENOMEM_CHAIN;
2817 goto err_alloc_chain;
2818 }
2819
2820 /* Add certificates to chain */
2821 while ( remaining ) {
2822 const struct {
2823 tls24_t length;
2824 uint8_t data[0];
2825 } __attribute__ (( packed )) *certificate = data;
2826 size_t certificate_len;
2827 size_t record_len;
2828
2829 /* Parse header */
2830 if ( sizeof ( *certificate ) > remaining ) {
2831 DBGC ( tls, "TLS %p underlength certificate:\n", tls );
2832 DBGC_HDA ( tls, 0, data, remaining );
2833 rc = -EINVAL_CERTIFICATE;
2834 goto err_underlength;
2835 }
2836 certificate_len = tls_uint24 ( &certificate->length );
2837 if ( certificate_len > ( remaining - sizeof ( *certificate ) )){
2838 DBGC ( tls, "TLS %p overlength certificate:\n", tls );
2839 DBGC_HDA ( tls, 0, data, remaining );
2840 rc = -EINVAL_CERTIFICATE;
2841 goto err_overlength;
2842 }
2843 record_len = ( sizeof ( *certificate ) + certificate_len );
2844
2845 /* Add certificate to chain */
2846 if ( ( rc = x509_append_raw ( tls->server.chain,
2847 certificate->data,
2848 certificate_len ) ) != 0 ) {
2849 DBGC ( tls, "TLS %p could not append certificate: %s\n",
2850 tls, strerror ( rc ) );
2851 DBGC_HDA ( tls, 0, data, remaining );
2852 goto err_parse;
2853 }
2854 cert = x509_last ( tls->server.chain );
2855 DBGC ( tls, "TLS %p found certificate %s\n",
2856 tls, x509_name ( cert ) );
2857
2858 /* Move to next certificate in list */
2859 data += record_len;
2860 remaining -= record_len;
2861 }
2862
2863 /* Identify server certificate */
2864 cert = x509_first ( tls->server.chain );
2865 if ( ! cert ) {
2866 DBGC ( tls, "TLS %p certificate chain is empty\n", tls );
2867 rc = -ENOENT_CERT;
2868 goto err_empty;
2869 }
2870
2871 /* Verify server name */
2872 if ( ( rc = x509_check_name ( cert, tls->session->name ) ) != 0 ) {
2873 DBGC ( tls, "TLS %p server certificate does not match %s: %s\n",
2874 tls, tls->session->name, strerror ( rc ) );
2875 goto err_name;
2876 }
2877
2878 return 0;
2879
2880 err_name:
2881 err_empty:
2882 err_parse:
2883 err_overlength:
2884 err_underlength:
2885 x509_chain_put ( tls->server.chain );
2886 tls->server.chain = NULL;
2887 err_alloc_chain:
2888 return rc;
2889}
2890
2891/**
2892 * Receive new Certificate handshake record
2893 *
2894 * @v tls TLS connection
2895 * @v data Plaintext handshake record
2896 * @v len Length of plaintext handshake record
2897 * @ret rc Return status code
2898 */
2899static int tls_new_certificate ( struct tls_connection *tls,
2900 const void *data, size_t len ) {
2901 const struct {
2902 tls24_t length;
2903 uint8_t certificates[0];
2904 } __attribute__ (( packed )) *certificate = data;
2905 size_t certificates_len;
2906 int rc;
2907
2908 /* Parse header */
2909 if ( sizeof ( *certificate ) > len ) {
2910 DBGC ( tls, "TLS %p received underlength Server Certificate\n",
2911 tls );
2912 DBGC_HD ( tls, data, len );
2913 return -EINVAL_CERTIFICATES;
2914 }
2915 certificates_len = tls_uint24 ( &certificate->length );
2916 if ( certificates_len > ( len - sizeof ( *certificate ) ) ) {
2917 DBGC ( tls, "TLS %p received overlength Server Certificate\n",
2918 tls );
2919 DBGC_HD ( tls, data, len );
2920 return -EINVAL_CERTIFICATES;
2921 }
2922
2923 /* Parse certificate chain */
2924 if ( ( rc = tls_parse_chain ( tls, certificate->certificates,
2925 certificates_len ) ) != 0 )
2926 return rc;
2927
2928 return 0;
2929}
2930
2931/**
2932 * Receive new Server Key Exchange handshake record
2933 *
2934 * @v tls TLS connection
2935 * @v data Plaintext handshake record
2936 * @v len Length of plaintext handshake record
2937 * @ret rc Return status code
2938 */
2939static int tls_new_server_key_exchange ( struct tls_connection *tls,
2940 const void *data, size_t len ) {
2941 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.pending;
2942 struct tls_cipher_suite *suite = cipherspec->suite;
2943 int rc;
2944
2945 /* Parse via key exchange algorithm */
2946 if ( ( rc = suite->exchange->server ( tls, data, len ) ) != 0 )
2947 return rc;
2948
2949 return 0;
2950}
2951
2952/**
2953 * Receive new Certificate Request handshake record
2954 *
2955 * @v tls TLS connection
2956 * @v data Plaintext handshake record
2957 * @v len Length of plaintext handshake record
2958 * @ret rc Return status code
2959 */
2960static int tls_new_certificate_request ( struct tls_connection *tls,
2961 const void *data __unused,
2962 size_t len __unused ) {
2963 struct x509_certificate *cert;
2964 int rc;
2965
2966 /* We can only send a single certificate, so there is no point
2967 * in parsing the Certificate Request.
2968 */
2969
2970 /* Free any existing client certificate chain */
2971 x509_chain_put ( tls->client.chain );
2972 tls->client.chain = NULL;
2973
2974 /* Create client certificate chain */
2975 tls->client.chain = x509_alloc_chain();
2976 if ( ! tls->client.chain ) {
2977 rc = -ENOMEM;
2978 goto err_alloc;
2979 }
2980
2981 /* Determine client certificate to be sent, if any */
2982 cert = x509_find_key ( NULL, tls->client.key );
2983 if ( cert ) {
2984 DBGC ( tls, "TLS %p selected client certificate %s\n",
2985 tls, x509_name ( cert ) );
2986
2987 /* Append client certificate to chain */
2988 if ( ( rc = x509_append ( tls->client.chain, cert ) ) != 0 )
2989 goto err_append;
2990
2991 /* Append any relevant issuer certificates */
2992 if ( ( rc = x509_auto_append ( tls->client.chain,
2993 &certstore ) ) != 0 )
2994 goto err_auto_append;
2995 } else {
2996
2997 /* Send an empty certificate chain */
2998 DBGC ( tls, "TLS %p could not find certificate corresponding "
2999 "to private key\n", tls );
3000 }
3001
3002 return 0;
3003
3004 err_auto_append:
3005 err_append:
3006 x509_chain_put ( tls->client.chain );
3007 tls->client.chain = NULL;
3008 err_alloc:
3009 return rc;
3010}
3011
3012/**
3013 * Receive new Server Hello Done handshake record
3014 *
3015 * @v tls TLS connection
3016 * @v data Plaintext handshake record
3017 * @v len Length of plaintext handshake record
3018 * @ret rc Return status code
3019 */
3020static int tls_new_server_hello_done ( struct tls_connection *tls,
3021 const void *data, size_t len ) {
3022 const struct {
3023 char next[0];
3024 } __attribute__ (( packed )) *hello_done = data;
3025 int rc;
3026
3027 /* Sanity check */
3028 if ( sizeof ( *hello_done ) != len ) {
3029 DBGC ( tls, "TLS %p received overlength Server Hello Done\n",
3030 tls );
3031 DBGC_HD ( tls, data, len );
3032 return -EINVAL_HELLO_DONE;
3033 }
3034
3035 /* Begin certificate validation */
3036 if ( ( rc = create_validator ( &tls->server.validator,
3037 tls->server.chain,
3038 tls->server.root ) ) != 0 ) {
3039 DBGC ( tls, "TLS %p could not start certificate validation: "
3040 "%s\n", tls, strerror ( rc ) );
3041 return rc;
3042 }
3043 pending_get ( &tls->server.validation );
3044
3045 return 0;
3046}
3047
3048/**
3049 * Receive new Finished handshake record
3050 *
3051 * @v tls TLS connection
3052 * @v data Plaintext handshake record
3053 * @v len Length of plaintext handshake record
3054 * @ret rc Return status code
3055 */
3056static int tls_new_finished ( struct tls_connection *tls,
3057 const void *data, size_t len ) {
3058 struct tls_session *session = tls->session;
3059 struct tls_key_schedule *key = &tls->key;
3060 struct digest_algorithm *digest = tls->key.digest;
3061 const struct {
3062 uint8_t verify_data[ sizeof ( tls->verify.server ) ];
3063 char next[0];
3064 } __attribute__ (( packed )) *finished = data;
3065 uint8_t digest_out[ digest->digestsize ];
3066
3067 /* Sanity checks */
3068 if ( ! ( digest->digestsize && key->keyed && key->bound ) ) {
3069 DBGC ( tls, "TLS %p received premature Finished\n", tls );
3070 DBGC_HDA ( tls, 0, data, len );
3071 return -EINVAL_FINISHED;
3072 }
3073 if ( sizeof ( *finished ) != len ) {
3074 DBGC ( tls, "TLS %p received overlength Finished\n", tls );
3075 DBGC_HDA ( tls, 0, data, len );
3076 return -EINVAL_FINISHED;
3077 }
3078
3079 /* Verify data */
3080 tls_verify_handshake ( tls, digest_out );
3081 tls_prf_label ( tls, tls->verify.server, sizeof ( tls->verify.server ),
3082 "server finished", digest_out, sizeof ( digest_out ) );
3083 if ( memcmp ( tls->verify.server, finished->verify_data,
3084 sizeof ( tls->verify.server ) ) != 0 ) {
3085 DBGC ( tls, "TLS %p verification failed\n", tls );
3086 return -EPERM_VERIFY;
3087 }
3088
3089 /* Mark server as finished */
3090 pending_put ( &tls->server.negotiation );
3091
3092 /* If we are resuming a session (i.e. if the server Finished
3093 * arrives before the client Finished is sent), then schedule
3094 * transmission of Change Cipher and Finished.
3095 */
3096 if ( is_pending ( &tls->client.negotiation ) ) {
3097 tls->tx.pending |= ( TLS_TX_CHANGE_CIPHER | TLS_TX_FINISHED );
3098 tls_tx_resume ( tls );
3099 }
3100
3101 /* Record session ID, ticket, and master secret, if applicable */
3102 if ( x509_is_valid ( key->bound, tls->server.root ) &&
3103 ( tls->session_id_len || tls->new_session_ticket_len ) ) {
3104 tls_generate_resumption_master ( tls );
3105 session->extended_master_secret = tls->extended_master_secret;
3106 x509_put ( session->cert );
3107 session->cert = x509_get ( key->bound );
3108 if ( tls->session_id_len ) {
3109 session->id_len = tls->session_id_len;
3110 memcpy ( session->id, tls->session_id,
3111 sizeof ( session->id ) );
3112 }
3113 if ( tls->new_session_ticket_len ) {
3114 zfree ( session->ticket );
3115 session->ticket = tls->new_session_ticket;
3116 session->ticket_len = tls->new_session_ticket_len;
3117 tls->new_session_ticket = NULL;
3118 tls->new_session_ticket_len = 0;
3119 }
3120 }
3121
3122 /* Move to end of session's connection list and allow other
3123 * connections to start making progress.
3124 */
3125 list_del ( &tls->list );
3126 list_add_tail ( &tls->list, &session->conn );
3127 tls_tx_resume_all ( session );
3128
3129 /* Send notification of a window change */
3130 xfer_window_changed ( &tls->plainstream );
3131
3132 return 0;
3133}
3134
3135/**
3136 * Receive new Handshake record
3137 *
3138 * @v tls TLS connection
3139 * @v iobuf I/O buffer
3140 * @ret rc Return status code
3141 */
3142static int tls_new_handshake ( struct tls_connection *tls,
3143 struct io_buffer *iobuf ) {
3144 size_t remaining;
3145 int rc;
3146
3147 while ( ( remaining = iob_len ( iobuf ) ) ) {
3148 const struct {
3149 uint8_t type;
3150 tls24_t length;
3151 uint8_t payload[0];
3152 } __attribute__ (( packed )) *handshake = iobuf->data;
3153 const void *payload;
3154 size_t payload_len;
3155 size_t record_len;
3156
3157 /* Parse header */
3158 if ( sizeof ( *handshake ) > remaining ) {
3159 /* Leave remaining fragment unconsumed */
3160 break;
3161 }
3162 payload_len = tls_uint24 ( &handshake->length );
3163 if ( payload_len > ( remaining - sizeof ( *handshake ) ) ) {
3164 /* Leave remaining fragment unconsumed */
3165 break;
3166 }
3167 payload = &handshake->payload;
3168 record_len = ( sizeof ( *handshake ) + payload_len );
3169
3170 /* Handle payload */
3171 switch ( handshake->type ) {
3172 case TLS_HELLO_REQUEST:
3173 rc = tls_new_hello_request ( tls, payload,
3174 payload_len );
3175 break;
3176 case TLS_SERVER_HELLO:
3177 rc = tls_new_server_hello ( tls, payload, payload_len );
3178 break;
3179 case TLS_NEW_SESSION_TICKET:
3180 rc = tls_new_session_ticket ( tls, payload,
3181 payload_len );
3182 break;
3183 case TLS_CERTIFICATE:
3184 rc = tls_new_certificate ( tls, payload, payload_len );
3185 break;
3186 case TLS_SERVER_KEY_EXCHANGE:
3187 rc = tls_new_server_key_exchange ( tls, payload,
3188 payload_len );
3189 break;
3190 case TLS_CERTIFICATE_REQUEST:
3191 rc = tls_new_certificate_request ( tls, payload,
3192 payload_len );
3193 break;
3194 case TLS_SERVER_HELLO_DONE:
3195 rc = tls_new_server_hello_done ( tls, payload,
3196 payload_len );
3197 break;
3198 case TLS_FINISHED:
3199 rc = tls_new_finished ( tls, payload, payload_len );
3200 break;
3201 default:
3202 DBGC ( tls, "TLS %p ignoring handshake type %d\n",
3203 tls, handshake->type );
3204 rc = 0;
3205 break;
3206 }
3207
3208 /* Add to handshake digest (except for Hello Requests,
3209 * which are explicitly excluded).
3210 */
3211 if ( handshake->type != TLS_HELLO_REQUEST )
3212 tls_add_handshake ( tls, handshake, record_len );
3213
3214 /* Abort on failure */
3215 if ( rc != 0 )
3216 return rc;
3217
3218 /* Move to next handshake record */
3219 iob_pull ( iobuf, record_len );
3220 }
3221
3222 return 0;
3223}
3224
3225/**
3226 * Receive new unknown record
3227 *
3228 * @v tls TLS connection
3229 * @v iobuf I/O buffer
3230 * @ret rc Return status code
3231 */
3232static int tls_new_unknown ( struct tls_connection *tls __unused,
3233 struct io_buffer *iobuf ) {
3234
3235 /* RFC4346 says that we should just ignore unknown record types */
3236 iob_pull ( iobuf, iob_len ( iobuf ) );
3237 return 0;
3238}
3239
3240/**
3241 * Receive new data record
3242 *
3243 * @v tls TLS connection
3244 * @v rx_data List of received data buffers
3245 * @ret rc Return status code
3246 */
3247static int tls_new_data ( struct tls_connection *tls,
3248 struct list_head *rx_data ) {
3249 struct io_buffer *iobuf;
3250 int rc;
3251
3252 /* Fail unless we are ready to receive data */
3253 if ( ! tls_ready ( tls ) )
3254 return -ENOTCONN;
3255
3256 /* Deliver each I/O buffer in turn */
3257 while ( ( iobuf = list_first_entry ( rx_data, struct io_buffer,
3258 list ) ) ) {
3259 list_del ( &iobuf->list );
3260 if ( ( rc = xfer_deliver_iob ( &tls->plainstream,
3261 iobuf ) ) != 0 ) {
3262 DBGC ( tls, "TLS %p could not deliver data: "
3263 "%s\n", tls, strerror ( rc ) );
3264 return rc;
3265 }
3266 }
3267
3268 return 0;
3269}
3270
3271/**
3272 * Receive new record
3273 *
3274 * @v tls TLS connection
3275 * @v type Record type
3276 * @v rx_data List of received data buffers
3277 * @ret rc Return status code
3278 */
3279static int tls_new_record ( struct tls_connection *tls, unsigned int type,
3280 struct list_head *rx_data ) {
3281 int ( * handler ) ( struct tls_connection *tls,
3282 struct io_buffer *iobuf );
3283 struct io_buffer *tmp = NULL;
3284 struct io_buffer **iobuf;
3285 int rc;
3286
3287 /* Deliver data records as-is to the plainstream interface */
3288 if ( type == TLS_TYPE_DATA )
3289 return tls_new_data ( tls, rx_data );
3290
3291 /* Determine handler and fragment buffer */
3292 iobuf = &tmp;
3293 switch ( type ) {
3294 case TLS_TYPE_CHANGE_CIPHER:
3295 handler = tls_new_change_cipher;
3296 break;
3297 case TLS_TYPE_ALERT:
3298 handler = tls_new_alert;
3299 break;
3300 case TLS_TYPE_HANDSHAKE:
3301 handler = tls_new_handshake;
3302 iobuf = &tls->rx.handshake;
3303 break;
3304 default:
3305 DBGC ( tls, "TLS %p unknown record type %d\n", tls, type );
3306 handler = tls_new_unknown;
3307 break;
3308 }
3309
3310 /* Merge into a single I/O buffer */
3311 if ( *iobuf )
3312 list_add ( &(*iobuf)->list, rx_data );
3313 *iobuf = iob_concatenate ( rx_data );
3314 if ( ! *iobuf ) {
3315 DBGC ( tls, "TLS %p could not concatenate non-data record "
3316 "type %d\n", tls, type );
3317 rc = -ENOMEM_RX_CONCAT;
3318 goto err_concatenate;
3319 }
3320
3321 /* Handle record */
3322 if ( ( rc = handler ( tls, *iobuf ) ) != 0 )
3323 goto err_handle;
3324
3325 /* Discard I/O buffer if empty */
3326 if ( ! iob_len ( *iobuf ) ) {
3327 free_iob ( *iobuf );
3328 *iobuf = NULL;
3329 }
3330
3331 /* Sanity check */
3332 assert ( tmp == NULL );
3333
3334 return 0;
3335
3336 err_handle:
3337 free_iob ( *iobuf );
3338 *iobuf = NULL;
3339 err_concatenate:
3340 return rc;
3341}
3342
3343/******************************************************************************
3344 *
3345 * Record encryption/decryption
3346 *
3347 ******************************************************************************
3348 */
3349
3350/**
3351 * Initialise HMAC
3352 *
3353 * @v cipherspec Cipher specification
3354 * @v ctx Context
3355 * @v authhdr Authentication header
3356 */
3357static void tls_hmac_init ( struct tls_cipherspec *cipherspec, void *ctx,
3358 struct tls_auth_header *authhdr ) {
3359 struct tls_cipher_suite *suite = cipherspec->suite;
3360 struct digest_algorithm *digest = suite->digest;
3361
3362 hmac_init ( digest, ctx, cipherspec->mac_secret, suite->mac_len );
3363 hmac_update ( digest, ctx, authhdr, sizeof ( *authhdr ) );
3364}
3365
3366/**
3367 * Update HMAC
3368 *
3369 * @v cipherspec Cipher specification
3370 * @v ctx Context
3371 * @v data Data
3372 * @v len Length of data
3373 */
3374static void tls_hmac_update ( struct tls_cipherspec *cipherspec, void *ctx,
3375 const void *data, size_t len ) {
3376 struct digest_algorithm *digest = cipherspec->suite->digest;
3377
3378 hmac_update ( digest, ctx, data, len );
3379}
3380
3381/**
3382 * Finalise HMAC
3383 *
3384 * @v cipherspec Cipher specification
3385 * @v ctx Context
3386 * @v mac HMAC to fill in
3387 */
3388static void tls_hmac_final ( struct tls_cipherspec *cipherspec, void *ctx,
3389 void *hmac ) {
3390 struct digest_algorithm *digest = cipherspec->suite->digest;
3391
3392 hmac_final ( digest, ctx, hmac );
3393}
3394
3395/**
3396 * Calculate HMAC
3397 *
3398 * @v cipherspec Cipher specification
3399 * @v authhdr Authentication header
3400 * @v data Data
3401 * @v len Length of data
3402 * @v mac HMAC to fill in
3403 */
3404static void tls_hmac ( struct tls_cipherspec *cipherspec,
3405 struct tls_auth_header *authhdr,
3406 const void *data, size_t len, void *hmac ) {
3407 struct digest_algorithm *digest = cipherspec->suite->digest;
3408 uint8_t ctx[ hmac_ctxsize ( digest ) ];
3409
3410 tls_hmac_init ( cipherspec, ctx, authhdr );
3411 tls_hmac_update ( cipherspec, ctx, data, len );
3412 tls_hmac_final ( cipherspec, ctx, hmac );
3413}
3414
3415/**
3416 * Calculate HMAC over list of I/O buffers
3417 *
3418 * @v cipherspec Cipher specification
3419 * @v authhdr Authentication header
3420 * @v list List of I/O buffers
3421 * @v mac HMAC to fill in
3422 */
3423static void tls_hmac_list ( struct tls_cipherspec *cipherspec,
3424 struct tls_auth_header *authhdr,
3425 struct list_head *list, void *hmac ) {
3426 struct digest_algorithm *digest = cipherspec->suite->digest;
3427 uint8_t ctx[ hmac_ctxsize ( digest ) ];
3428 struct io_buffer *iobuf;
3429
3430 tls_hmac_init ( cipherspec, ctx, authhdr );
3431 list_for_each_entry ( iobuf, list, list ) {
3432 tls_hmac_update ( cipherspec, ctx, iobuf->data,
3433 iob_len ( iobuf ) );
3434 }
3435 tls_hmac_final ( cipherspec, ctx, hmac );
3436}
3437
3438/**
3439 * Calculate maximum additional length required for transmitted record(s)
3440 *
3441 * @v tls TLS connection
3442 * @v len I/O buffer payload length
3443 * @ret reserve Maximum additional length to reserve
3444 */
3445static size_t tls_iob_reserved ( struct tls_connection *tls, size_t len ) {
3446 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active;
3447 struct tls_cipher_suite *suite = cipherspec->suite;
3448 struct cipher_algorithm *cipher = suite->cipher;
3449 struct tls_header *tlshdr;
3450 unsigned int count;
3451 size_t each;
3452
3453 /* Calculate number of records (allowing for zero-length records) */
3454 count = ( len ? ( ( len + TLS_TX_BUFSIZE - 1 ) / TLS_TX_BUFSIZE ) : 1 );
3455
3456 /* Calculate maximum additional length per record */
3457 each = ( sizeof ( *tlshdr ) + suite->record_iv_len + suite->mac_len +
3458 ( is_block_cipher ( cipher ) ? cipher->blocksize : 0 ) +
3459 cipher->authsize );
3460
3461 /* Calculate maximum total additional length */
3462 return ( count * each );
3463}
3464
3465/**
3466 * Allocate I/O buffer for transmitted record(s)
3467 *
3468 * @v tls TLS connection
3469 * @v len I/O buffer payload length
3470 * @ret iobuf I/O buffer
3471 */
3472static struct io_buffer * tls_alloc_iob ( struct tls_connection *tls,
3473 size_t len ) {
3474 struct io_buffer *iobuf;
3475 size_t reserve;
3476
3477 /* Calculate maximum additional length to reserve */
3478 reserve = tls_iob_reserved ( tls, len );
3479
3480 /* Allocate I/O buffer */
3481 iobuf = xfer_alloc_iob ( &tls->cipherstream, ( reserve + len ) );
3482 if ( ! iobuf )
3483 return NULL;
3484
3485 /* Reserve space */
3486 iob_reserve ( iobuf, reserve );
3487
3488 return iobuf;
3489}
3490
3491/**
3492 * Send plaintext record(s)
3493 *
3494 * @v tls TLS connection
3495 * @v type Record type
3496 * @v iobuf I/O buffer
3497 * @ret rc Return status code
3498 */
3499static int tls_send_record ( struct tls_connection *tls, unsigned int type,
3500 struct io_buffer *iobuf ) {
3501 struct tls_cipherspec *cipherspec = &tls->tx.cipherspec.active;
3502 struct tls_cipher_suite *suite = cipherspec->suite;
3503 struct cipher_algorithm *cipher = suite->cipher;
3504 struct digest_algorithm *digest = suite->digest;
3505 struct {
3506 uint8_t fixed[suite->fixed_iv_len];
3507 uint8_t rec[suite->record_iv_len];
3508 } __attribute__ (( packed )) iv;
3509 struct tls_auth_header authhdr;
3510 struct tls_header *tlshdr;
3511 uint8_t mac[digest->digestsize];
3512 const void *plaintext;
3513 const void *encrypt;
3514 void *ciphertext;
3515 size_t record_len;
3516 size_t encrypt_len;
3517 size_t pad_len;
3518 size_t len;
3519 int rc;
3520
3521 /* Record plaintext pointer and length */
3522 plaintext = iobuf->data;
3523 len = iob_len ( iobuf );
3524
3525 /* Add to handshake digest if applicable */
3526 if ( type == TLS_TYPE_HANDSHAKE )
3527 tls_add_handshake ( tls, plaintext, len );
3528
3529 /* Start constructing ciphertext at start of reserved space */
3530 iob_push ( iobuf, tls_iob_reserved ( tls, len ) );
3531 iob_unput ( iobuf, iob_len ( iobuf ) );
3532
3533 /* Construct records */
3534 do {
3535 /* Limit length of this record (may be zero) */
3536 record_len = len;
3537 if ( record_len > TLS_TX_BUFSIZE )
3538 record_len = TLS_TX_BUFSIZE;
3539
3540 /* Construct authentication header */
3541 authhdr.seq = cpu_to_be64 ( tls->tx.seq );
3542 authhdr.header.type = type;
3543 authhdr.header.version = htons ( tls->version );
3544 authhdr.header.length = htons ( record_len );
3545
3546 /* Construct and set initialisation vector */
3547 memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) );
3548 tls_ephemeral ( tls, &authhdr, sizeof ( authhdr ), iv.rec,
3549 sizeof ( iv.rec ) );
3550 if ( ( rc = cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv,
3551 sizeof ( iv ) ) ) != 0 ) {
3552 DBGC ( tls, "TLS %p could not set TX IV: %s\n",
3553 tls, strerror ( rc ) );
3554 goto err_setiv;
3555 }
3556
3557 /* Process authentication data */
3558 if ( suite->mac_len ) {
3559 tls_hmac ( cipherspec, &authhdr, plaintext, record_len,
3560 mac );
3561 }
3562 if ( is_auth_cipher ( cipher ) ) {
3563 cipher_encrypt ( cipher, cipherspec->cipher_ctx,
3564 &authhdr, NULL, sizeof ( authhdr ) );
3565 }
3566
3567 /* Calculate encryption length */
3568 encrypt_len = ( record_len + suite->mac_len );
3569 if ( is_block_cipher ( cipher ) ) {
3570 pad_len = ( ( ( cipher->blocksize - 1 ) &
3571 -( encrypt_len + 1 ) ) + 1 );
3572 } else {
3573 pad_len = 0;
3574 }
3575 encrypt_len += pad_len;
3576
3577 /* Add record header */
3578 tlshdr = iob_put ( iobuf, sizeof ( *tlshdr ) );
3579 tlshdr->type = type;
3580 tlshdr->version = htons ( tls->version );
3581 tlshdr->length = htons ( sizeof ( iv.rec ) + encrypt_len +
3582 cipher->authsize );
3583
3584 /* Add record initialisation vector, if applicable */
3585 memcpy ( iob_put ( iobuf, sizeof ( iv.rec ) ), iv.rec,
3586 sizeof ( iv.rec ) );
3587
3588 /* Copy plaintext data if necessary */
3589 ciphertext = iob_put ( iobuf, record_len );
3590 assert ( ciphertext <= plaintext );
3591 if ( encrypt_len > record_len ) {
3592 memmove ( ciphertext, plaintext, record_len );
3593 encrypt = ciphertext;
3594 } else {
3595 encrypt = plaintext;
3596 }
3597
3598 /* Add MAC, if applicable */
3599 memcpy ( iob_put ( iobuf, suite->mac_len ), mac,
3600 suite->mac_len );
3601
3602 /* Add padding, if applicable */
3603 memset ( iob_put ( iobuf, pad_len ), ( pad_len - 1 ), pad_len );
3604
3605 /* Encrypt data and append authentication tag */
3606 DBGC2 ( tls, "Sending plaintext data:\n" );
3607 DBGC2_HDA ( tls, 0, encrypt, encrypt_len );
3608 cipher_encrypt ( cipher, cipherspec->cipher_ctx, encrypt,
3609 ciphertext, encrypt_len );
3610 cipher_auth ( cipher, cipherspec->cipher_ctx,
3611 iob_put ( iobuf, cipher->authsize ) );
3612
3613 /* Move to next record */
3614 tls->tx.seq += 1;
3615 plaintext += record_len;
3616 len -= record_len;
3617
3618 } while ( len );
3619
3620 /* Send ciphertext */
3621 if ( ( rc = xfer_deliver_iob ( &tls->cipherstream,
3622 iob_disown ( iobuf ) ) ) != 0 ) {
3623 DBGC ( tls, "TLS %p could not deliver ciphertext: %s\n",
3624 tls, strerror ( rc ) );
3625 goto err_deliver;
3626 }
3627
3628 assert ( iobuf == NULL );
3629 return 0;
3630
3631 err_deliver:
3632 err_setiv:
3633 free_iob ( iobuf );
3634 return rc;
3635}
3636
3637/**
3638 * Send plaintext record
3639 *
3640 * @v tls TLS connection
3641 * @v type Record type
3642 * @v data Plaintext record
3643 * @v len Length of plaintext record
3644 * @ret rc Return status code
3645 */
3646static int tls_send_plaintext ( struct tls_connection *tls, unsigned int type,
3647 const void *data, size_t len ) {
3648 struct io_buffer *iobuf;
3649 int rc;
3650
3651 /* Allocate I/O buffer */
3652 iobuf = tls_alloc_iob ( tls, len );
3653 if ( ! iobuf )
3654 return -ENOMEM_TX_PLAINTEXT;
3655 memcpy ( iob_put ( iobuf, len ), data, len );
3656
3657 /* Transmit I/O buffer */
3658 if ( ( rc = tls_send_record ( tls, type, iob_disown ( iobuf ) ) ) != 0 )
3659 return rc;
3660
3661 return 0;
3662}
3663
3664/**
3665 * Verify block padding
3666 *
3667 * @v tls TLS connection
3668 * @v iobuf Last received I/O buffer
3669 * @ret len Padding length, or negative error
3670 * @ret rc Return status code
3671 */
3672static int tls_verify_padding ( struct tls_connection *tls,
3673 struct io_buffer *iobuf ) {
3674 uint8_t *padding;
3675 unsigned int pad;
3676 unsigned int i;
3677 size_t len;
3678
3679 /* Extract and verify padding */
3680 padding = ( iobuf->tail - 1 );
3681 pad = *padding;
3682 len = ( pad + 1 );
3683 if ( len > iob_len ( iobuf ) ) {
3684 DBGC ( tls, "TLS %p received underlength padding\n", tls );
3685 DBGC_HD ( tls, iobuf->data, iob_len ( iobuf ) );
3686 return -EINVAL_PADDING;
3687 }
3688 for ( i = 0 ; i < pad ; i++ ) {
3689 if ( *(--padding) != pad ) {
3690 DBGC ( tls, "TLS %p received bad padding\n", tls );
3691 DBGC_HD ( tls, iobuf->data, iob_len ( iobuf ) );
3692 return -EINVAL_PADDING;
3693 }
3694 }
3695
3696 return len;
3697}
3698
3699/**
3700 * Receive new ciphertext record
3701 *
3702 * @v tls TLS connection
3703 * @v tlshdr Record header
3704 * @v rx_data List of received data buffers
3705 * @ret rc Return status code
3706 */
3707static int tls_new_ciphertext ( struct tls_connection *tls,
3708 struct tls_header *tlshdr,
3709 struct list_head *rx_data ) {
3710 struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active;
3711 struct tls_cipher_suite *suite = cipherspec->suite;
3712 struct cipher_algorithm *cipher = suite->cipher;
3713 struct digest_algorithm *digest = suite->digest;
3714 size_t len = ntohs ( tlshdr->length );
3715 struct {
3716 uint8_t fixed[suite->fixed_iv_len];
3717 uint8_t record[suite->record_iv_len];
3718 } __attribute__ (( packed )) iv;
3719 struct tls_auth_header authhdr;
3720 uint8_t verify_mac[digest->digestsize];
3721 uint8_t verify_auth[cipher->authsize];
3722 struct io_buffer *first;
3723 struct io_buffer *last;
3724 struct io_buffer *iobuf;
3725 void *mac;
3726 void *auth;
3727 size_t check_len;
3728 int pad_len;
3729 int rc;
3730
3731 /* Locate first and last data buffers */
3732 assert ( ! list_empty ( rx_data ) );
3733 first = list_first_entry ( rx_data, struct io_buffer, list );
3734 last = list_last_entry ( rx_data, struct io_buffer, list );
3735
3736 /* Extract initialisation vector */
3737 if ( iob_len ( first ) < sizeof ( iv.record ) ) {
3738 DBGC ( tls, "TLS %p received underlength IV\n", tls );
3739 DBGC_HD ( tls, first->data, iob_len ( first ) );
3740 return -EINVAL_IV;
3741 }
3742 memcpy ( iv.fixed, cipherspec->fixed_iv, sizeof ( iv.fixed ) );
3743 memcpy ( iv.record, first->data, sizeof ( iv.record ) );
3744 iob_pull ( first, sizeof ( iv.record ) );
3745 len -= sizeof ( iv.record );
3746
3747 /* Extract unencrypted authentication tag */
3748 if ( iob_len ( last ) < cipher->authsize ) {
3749 DBGC ( tls, "TLS %p received underlength authentication tag\n",
3750 tls );
3751 DBGC_HD ( tls, last->data, iob_len ( last ) );
3752 return -EINVAL_MAC;
3753 }
3754 iob_unput ( last, cipher->authsize );
3755 len -= cipher->authsize;
3756 auth = last->tail;
3757
3758 /* Construct authentication data */
3759 authhdr.seq = cpu_to_be64 ( tls->rx.seq );
3760 authhdr.header.type = tlshdr->type;
3761 authhdr.header.version = tlshdr->version;
3762 authhdr.header.length = htons ( len );
3763
3764 /* Set initialisation vector */
3765 if ( ( rc = cipher_setiv ( cipher, cipherspec->cipher_ctx, &iv,
3766 sizeof ( iv ) ) ) != 0 ) {
3767 DBGC ( tls, "TLS %p could not set RX IV: %s\n",
3768 tls, strerror ( rc ) );
3769 return rc;
3770 }
3771
3772 /* Process authentication data, if applicable */
3773 if ( is_auth_cipher ( cipher ) ) {
3774 cipher_decrypt ( cipher, cipherspec->cipher_ctx, &authhdr,
3775 NULL, sizeof ( authhdr ) );
3776 }
3777
3778 /* Decrypt the received data */
3779 check_len = 0;
3780 list_for_each_entry ( iobuf, &tls->rx.data, list ) {
3781 cipher_decrypt ( cipher, cipherspec->cipher_ctx,
3782 iobuf->data, iobuf->data, iob_len ( iobuf ) );
3783 check_len += iob_len ( iobuf );
3784 }
3785 assert ( check_len == len );
3786
3787 /* Strip block padding, if applicable */
3788 if ( is_block_cipher ( cipher ) ) {
3789 pad_len = tls_verify_padding ( tls, last );
3790 if ( pad_len < 0 ) {
3791 /* Assume zero padding length to avoid timing attacks */
3792 pad_len = 0;
3793 }
3794 iob_unput ( last, pad_len );
3795 len -= pad_len;
3796 }
3797
3798 /* Extract decrypted MAC */
3799 if ( iob_len ( last ) < suite->mac_len ) {
3800 DBGC ( tls, "TLS %p received underlength MAC\n", tls );
3801 DBGC_HD ( tls, last->data, iob_len ( last ) );
3802 return -EINVAL_MAC;
3803 }
3804 iob_unput ( last, suite->mac_len );
3805 len -= suite->mac_len;
3806 mac = last->tail;
3807
3808 /* Dump received data */
3809 DBGC2 ( tls, "Received plaintext data:\n" );
3810 check_len = 0;
3811 list_for_each_entry ( iobuf, rx_data, list ) {
3812 DBGC2_HD ( tls, iobuf->data, iob_len ( iobuf ) );
3813 check_len += iob_len ( iobuf );
3814 }
3815 assert ( check_len == len );
3816
3817 /* Generate MAC */
3818 authhdr.header.length = htons ( len );
3819 if ( suite->mac_len )
3820 tls_hmac_list ( cipherspec, &authhdr, rx_data, verify_mac );
3821
3822 /* Generate authentication tag */
3823 cipher_auth ( cipher, cipherspec->cipher_ctx, verify_auth );
3824
3825 /* Verify MAC */
3826 if ( memcmp ( mac, verify_mac, suite->mac_len ) != 0 ) {
3827 DBGC ( tls, "TLS %p failed MAC verification\n", tls );
3828 return -EINVAL_MAC;
3829 }
3830
3831 /* Verify authentication tag */
3832 if ( memcmp ( auth, verify_auth, cipher->authsize ) != 0 ) {
3833 DBGC ( tls, "TLS %p failed authentication tag verification\n",
3834 tls );
3835 return -EINVAL_MAC;
3836 }
3837
3838 /* Process plaintext record */
3839 if ( ( rc = tls_new_record ( tls, tlshdr->type, rx_data ) ) != 0 )
3840 return rc;
3841
3842 return 0;
3843}
3844
3845/******************************************************************************
3846 *
3847 * Plaintext stream operations
3848 *
3849 ******************************************************************************
3850 */
3851
3852/**
3853 * Check flow control window
3854 *
3855 * @v tls TLS connection
3856 * @ret len Length of window
3857 */
3858static size_t tls_plainstream_window ( struct tls_connection *tls ) {
3859
3860 /* Block window unless we are ready to accept data */
3861 if ( ! tls_ready ( tls ) )
3862 return 0;
3863
3864 return xfer_window ( &tls->cipherstream );
3865}
3866
3867/**
3868 * Deliver datagram as raw data
3869 *
3870 * @v tls TLS connection
3871 * @v iobuf I/O buffer
3872 * @v meta Data transfer metadata
3873 * @ret rc Return status code
3874 */
3875static int tls_plainstream_deliver ( struct tls_connection *tls,
3876 struct io_buffer *iobuf,
3877 struct xfer_metadata *meta __unused ) {
3878 int rc;
3879
3880 /* Refuse unless we are ready to accept data */
3881 if ( ! tls_ready ( tls ) ) {
3882 rc = -ENOTCONN;
3883 goto done;
3884 }
3885
3886 /* Send data record */
3887 if ( ( rc = tls_send_record ( tls, TLS_TYPE_DATA,
3888 iob_disown ( iobuf ) ) ) != 0 )
3889 goto done;
3890
3891 done:
3892 free_iob ( iobuf );
3893 return rc;
3894}
3895
3896/**
3897 * Report job progress
3898 *
3899 * @v tls TLS connection
3900 * @v progress Progress report to fill in
3901 * @ret ongoing_rc Ongoing job status code (if known)
3902 */
3903static int tls_progress ( struct tls_connection *tls,
3904 struct job_progress *progress ) {
3905
3906 /* Return cipherstream or validator progress as applicable */
3907 if ( is_pending ( &tls->server.validation ) ) {
3908 return job_progress ( &tls->server.validator, progress );
3909 } else {
3910 return job_progress ( &tls->cipherstream, progress );
3911 }
3912}
3913
3914/** TLS plaintext stream interface operations */
3924
3925/** TLS plaintext stream interface descriptor */
3926static struct interface_descriptor tls_plainstream_desc =
3927 INTF_DESC_PASSTHRU ( struct tls_connection, plainstream,
3928 tls_plainstream_ops, cipherstream );
3929
3930/******************************************************************************
3931 *
3932 * Ciphertext stream operations
3933 *
3934 ******************************************************************************
3935 */
3936
3937/**
3938 * Handle received TLS header
3939 *
3940 * @v tls TLS connection
3941 * @ret rc Returned status code
3942 */
3943static int tls_newdata_process_header ( struct tls_connection *tls ) {
3944 struct tls_cipherspec *cipherspec = &tls->rx.cipherspec.active;
3945 struct cipher_algorithm *cipher = cipherspec->suite->cipher;
3946 size_t iv_len = cipherspec->suite->record_iv_len;
3947 size_t data_len = ntohs ( tls->rx.header.length );
3948 size_t remaining = data_len;
3949 size_t frag_len;
3950 size_t reserve;
3951 struct io_buffer *iobuf;
3952 struct io_buffer *tmp;
3953 int rc;
3954
3955 /* Sanity check */
3956 assert ( ( TLS_RX_BUFSIZE % cipher->alignsize ) == 0 );
3957
3958 /* Calculate alignment reservation at start of first data buffer */
3959 reserve = ( ( -iv_len ) & ( cipher->alignsize - 1 ) );
3960 remaining += reserve;
3961
3962 /* Allocate data buffers now that we know the length */
3963 assert ( list_empty ( &tls->rx.data ) );
3964 while ( remaining ) {
3965
3966 /* Calculate fragment length. Ensure that no block is
3967 * smaller than TLS_RX_MIN_BUFSIZE (by increasing the
3968 * allocation length if necessary).
3969 */
3970 frag_len = remaining;
3971 if ( frag_len > TLS_RX_BUFSIZE )
3972 frag_len = TLS_RX_BUFSIZE;
3973 remaining -= frag_len;
3974 if ( remaining < TLS_RX_MIN_BUFSIZE ) {
3975 frag_len += remaining;
3976 remaining = 0;
3977 }
3978
3979 /* Allocate buffer */
3980 iobuf = alloc_iob_raw ( frag_len, TLS_RX_ALIGN, 0 );
3981 if ( ! iobuf ) {
3982 DBGC ( tls, "TLS %p could not allocate %zd of %zd "
3983 "bytes for receive buffer\n", tls,
3984 remaining, data_len );
3985 rc = -ENOMEM_RX_DATA;
3986 goto err;
3987 }
3988
3989 /* Ensure tailroom is exactly what we asked for. This
3990 * will result in unaligned I/O buffers when the
3991 * fragment length is unaligned, which can happen only
3992 * before we switch to using a block cipher.
3993 */
3994 iob_reserve ( iobuf, ( iob_tailroom ( iobuf ) - frag_len ) );
3995
3996 /* Ensure first buffer length will be aligned to a
3997 * multiple of the cipher alignment size after
3998 * stripping the record IV.
3999 */
4000 iob_reserve ( iobuf, reserve );
4001 reserve = 0;
4002
4003 /* Add I/O buffer to list */
4004 list_add_tail ( &iobuf->list, &tls->rx.data );
4005 }
4006
4007 /* Move to data state */
4008 tls->rx.state = TLS_RX_DATA;
4009
4010 return 0;
4011
4012 err:
4013 list_for_each_entry_safe ( iobuf, tmp, &tls->rx.data, list ) {
4014 list_del ( &iobuf->list );
4015 free_iob ( iobuf );
4016 }
4017 return rc;
4018}
4019
4020/**
4021 * Handle received TLS data payload
4022 *
4023 * @v tls TLS connection
4024 * @ret rc Returned status code
4025 */
4026static int tls_newdata_process_data ( struct tls_connection *tls ) {
4027 struct io_buffer *iobuf;
4028 int rc;
4029
4030 /* Move current buffer to end of list */
4031 iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list );
4032 list_del ( &iobuf->list );
4033 list_add_tail ( &iobuf->list, &tls->rx.data );
4034
4035 /* Continue receiving data if any space remains */
4036 iobuf = list_first_entry ( &tls->rx.data, struct io_buffer, list );
4037 if ( iob_tailroom ( iobuf ) )
4038 return 0;
4039
4040 /* Process record */
4041 if ( ( rc = tls_new_ciphertext ( tls, &tls->rx.header,
4042 &tls->rx.data ) ) != 0 )
4043 return rc;
4044
4045 /* Increment RX sequence number */
4046 tls->rx.seq += 1;
4047
4048 /* Return to header state */
4049 assert ( list_empty ( &tls->rx.data ) );
4050 tls->rx.state = TLS_RX_HEADER;
4051 iob_unput ( &tls->rx.iobuf, sizeof ( tls->rx.header ) );
4052
4053 return 0;
4054}
4055
4056/**
4057 * Check flow control window
4058 *
4059 * @v tls TLS connection
4060 * @ret len Length of window
4061 */
4062static size_t tls_cipherstream_window ( struct tls_connection *tls ) {
4063
4064 /* Open window until we are ready to accept data */
4065 if ( ! tls_ready ( tls ) )
4066 return -1UL;
4067
4068 return xfer_window ( &tls->plainstream );
4069}
4070
4071/**
4072 * Receive new ciphertext
4073 *
4074 * @v tls TLS connection
4075 * @v iobuf I/O buffer
4076 * @v meta Data transfer metadat
4077 * @ret rc Return status code
4078 */
4079static int tls_cipherstream_deliver ( struct tls_connection *tls,
4080 struct io_buffer *iobuf,
4081 struct xfer_metadata *xfer __unused ) {
4082 size_t frag_len;
4083 int ( * process ) ( struct tls_connection *tls );
4084 struct io_buffer *dest;
4085 int rc;
4086
4087 while ( iob_len ( iobuf ) ) {
4088
4089 /* Select buffer according to current state */
4090 switch ( tls->rx.state ) {
4091 case TLS_RX_HEADER:
4092 dest = &tls->rx.iobuf;
4093 process = tls_newdata_process_header;
4094 break;
4095 case TLS_RX_DATA:
4096 dest = list_first_entry ( &tls->rx.data,
4097 struct io_buffer, list );
4098 assert ( dest != NULL );
4099 process = tls_newdata_process_data;
4100 break;
4101 default:
4102 assert ( 0 );
4103 rc = -EINVAL_RX_STATE;
4104 goto done;
4105 }
4106
4107 /* Copy data portion to buffer */
4108 frag_len = iob_len ( iobuf );
4109 if ( frag_len > iob_tailroom ( dest ) )
4110 frag_len = iob_tailroom ( dest );
4111 memcpy ( iob_put ( dest, frag_len ), iobuf->data, frag_len );
4112 iob_pull ( iobuf, frag_len );
4113
4114 /* Process data if buffer is now full */
4115 if ( iob_tailroom ( dest ) == 0 ) {
4116 if ( ( rc = process ( tls ) ) != 0 ) {
4117 tls_close_alert ( tls, rc );
4118 goto done;
4119 }
4120 }
4121 }
4122 rc = 0;
4123
4124 done:
4125 free_iob ( iobuf );
4126 return rc;
4127}
4128
4129/** TLS ciphertext stream interface operations */
4139
4140/** TLS ciphertext stream interface descriptor */
4141static struct interface_descriptor tls_cipherstream_desc =
4142 INTF_DESC_PASSTHRU ( struct tls_connection, cipherstream,
4143 tls_cipherstream_ops, plainstream );
4144
4145/******************************************************************************
4146 *
4147 * Certificate validator
4148 *
4149 ******************************************************************************
4150 */
4151
4152/**
4153 * Handle certificate validation completion
4154 *
4155 * @v tls TLS connection
4156 * @v rc Reason for completion
4157 */
4158static void tls_validator_done ( struct tls_connection *tls, int rc ) {
4159
4160 /* Mark validation as complete */
4161 pending_put ( &tls->server.validation );
4162
4163 /* Close validator interface */
4164 intf_restart ( &tls->server.validator, rc );
4165
4166 /* Check for validation failure */
4167 if ( rc != 0 ) {
4168 DBGC ( tls, "TLS %p certificate validation failed: %s\n",
4169 tls, strerror ( rc ) );
4170 goto err;
4171 }
4172 DBGC ( tls, "TLS %p certificate validation succeeded\n", tls );
4173
4174 /* Schedule transmission of applicable handshake messages */
4175 tls->tx.pending |= ( TLS_TX_CLIENT_KEY_EXCHANGE |
4176 TLS_TX_CHANGE_CIPHER |
4177 TLS_TX_FINISHED );
4178 if ( tls->client.chain ) {
4179 tls->tx.pending |= TLS_TX_CERTIFICATE;
4180 if ( ! list_empty ( &tls->client.chain->links ) )
4181 tls->tx.pending |= TLS_TX_CERTIFICATE_VERIFY;
4182 }
4183 tls_tx_resume ( tls );
4184
4185 return;
4186
4187 err:
4188 tls_close_alert ( tls, rc );
4189 return;
4190}
4191
4192/** TLS certificate validator interface operations */
4196
4197/** TLS certificate validator interface descriptor */
4198static struct interface_descriptor tls_validator_desc =
4199 INTF_DESC ( struct tls_connection, server.validator,
4200 tls_validator_ops );
4201
4202/******************************************************************************
4203 *
4204 * Controlling process
4205 *
4206 ******************************************************************************
4207 */
4208
4209/**
4210 * TLS TX state machine
4211 *
4212 * @v tls TLS connection
4213 */
4214static void tls_tx_step ( struct tls_connection *tls ) {
4215 struct tls_session *session = tls->session;
4216 struct tls_connection *conn;
4217 int rc;
4218
4219 /* Wait for cipherstream to become ready */
4220 if ( ! xfer_window ( &tls->cipherstream ) )
4221 return;
4222
4223 /* Send first pending transmission */
4224 if ( tls->tx.pending & TLS_TX_CLIENT_HELLO ) {
4225 /* Serialise server negotiations within a session, to
4226 * provide a consistent view of session IDs and
4227 * session tickets.
4228 */
4229 list_for_each_entry ( conn, &session->conn, list ) {
4230 if ( conn == tls )
4231 break;
4232 if ( is_pending ( &conn->server.negotiation ) )
4233 return;
4234 }
4235 /* Record or generate session ID and associated master secret */
4236 if ( session->id_len ) {
4237 /* Attempt to resume an existing session */
4238 memcpy ( tls->session_id, session->id,
4239 sizeof ( tls->session_id ) );
4240 tls->session_id_len = session->id_len;
4241 } else {
4242 /* No existing session: use a random session ID */
4243 assert ( sizeof ( tls->session_id ) ==
4244 sizeof ( tls->client.random ) );
4245 memcpy ( tls->session_id, &tls->client.random,
4246 sizeof ( tls->session_id ) );
4247 tls->session_id_len = sizeof ( tls->session_id );
4248 }
4249 /* Send Client Hello */
4250 if ( ( rc = tls_send_client_hello ( tls ) ) != 0 ) {
4251 DBGC ( tls, "TLS %p could not send Client Hello: %s\n",
4252 tls, strerror ( rc ) );
4253 goto err;
4254 }
4255 tls->tx.pending &= ~TLS_TX_CLIENT_HELLO;
4256 } else if ( tls->tx.pending & TLS_TX_CERTIFICATE ) {
4257 /* Send Certificate */
4258 if ( ( rc = tls_send_certificate ( tls ) ) != 0 ) {
4259 DBGC ( tls, "TLS %p cold not send Certificate: %s\n",
4260 tls, strerror ( rc ) );
4261 goto err;
4262 }
4263 tls->tx.pending &= ~TLS_TX_CERTIFICATE;
4264 } else if ( tls->tx.pending & TLS_TX_CLIENT_KEY_EXCHANGE ) {
4265 /* Send Client Key Exchange */
4266 if ( ( rc = tls_send_client_key_exchange ( tls ) ) != 0 ) {
4267 DBGC ( tls, "TLS %p could not send Client Key "
4268 "Exchange: %s\n", tls, strerror ( rc ) );
4269 goto err;
4270 }
4271 tls->tx.pending &= ~TLS_TX_CLIENT_KEY_EXCHANGE;
4272 } else if ( tls->tx.pending & TLS_TX_CERTIFICATE_VERIFY ) {
4273 /* Send Certificate Verify */
4274 if ( ( rc = tls_send_certificate_verify ( tls ) ) != 0 ) {
4275 DBGC ( tls, "TLS %p could not send Certificate "
4276 "Verify: %s\n", tls, strerror ( rc ) );
4277 goto err;
4278 }
4279 tls->tx.pending &= ~TLS_TX_CERTIFICATE_VERIFY;
4280 } else if ( tls->tx.pending & TLS_TX_CHANGE_CIPHER ) {
4281 /* Send Change Cipher, and then change the cipher in use */
4282 if ( ( rc = tls_send_change_cipher ( tls ) ) != 0 ) {
4283 DBGC ( tls, "TLS %p could not send Change Cipher: "
4284 "%s\n", tls, strerror ( rc ) );
4285 goto err;
4286 }
4287 if ( ( rc = tls_change_cipher ( tls,
4288 &tls->tx.cipherspec ) ) != 0 ){
4289 DBGC ( tls, "TLS %p could not activate TX cipher: "
4290 "%s\n", tls, strerror ( rc ) );
4291 goto err;
4292 }
4293 tls->tx.seq = 0;
4294 tls->tx.pending &= ~TLS_TX_CHANGE_CIPHER;
4295 } else if ( tls->tx.pending & TLS_TX_FINISHED ) {
4296 /* Send Finished */
4297 if ( ( rc = tls_send_finished ( tls ) ) != 0 ) {
4298 DBGC ( tls, "TLS %p could not send Finished: %s\n",
4299 tls, strerror ( rc ) );
4300 goto err;
4301 }
4302 tls->tx.pending &= ~TLS_TX_FINISHED;
4303 }
4304
4305 /* Reschedule process if pending transmissions remain,
4306 * otherwise send notification of a window change.
4307 */
4308 if ( tls->tx.pending ) {
4309 tls_tx_resume ( tls );
4310 } else {
4311 xfer_window_changed ( &tls->plainstream );
4312 }
4313
4314 return;
4315
4316 err:
4317 tls_close_alert ( tls, rc );
4318}
4319
4320/** TLS TX process descriptor */
4321static struct process_descriptor tls_process_desc =
4322 PROC_DESC_ONCE ( struct tls_connection, tx.process, tls_tx_step );
4323
4324/******************************************************************************
4325 *
4326 * Session management
4327 *
4328 ******************************************************************************
4329 */
4330
4331/**
4332 * Find or create session for TLS connection
4333 *
4334 * @v tls TLS connection
4335 * @v name Server name
4336 * @ret rc Return status code
4337 */
4338static int tls_session ( struct tls_connection *tls, const char *name ) {
4339 struct tls_session *session;
4340 char *name_copy;
4341 int rc;
4342
4343 /* Find existing matching session, if any */
4344 list_for_each_entry ( session, &tls_sessions, list ) {
4345 if ( ( strcmp ( name, session->name ) == 0 ) &&
4346 ( tls->server.root == session->root ) &&
4347 ( tls->client.key == session->key ) ) {
4348 ref_get ( &session->refcnt );
4349 tls->session = session;
4350 DBGC ( tls, "TLS %p joining session %s\n", tls, name );
4351 return 0;
4352 }
4353 }
4354
4355 /* Create new session */
4356 session = zalloc ( sizeof ( *session ) + strlen ( name )
4357 + 1 /* NUL */ );
4358 if ( ! session ) {
4359 rc = -ENOMEM;
4360 goto err_alloc;
4361 }
4362 ref_init ( &session->refcnt, free_tls_session );
4363 name_copy = ( ( ( void * ) session ) + sizeof ( *session ) );
4364 strcpy ( name_copy, name );
4365 session->name = name_copy;
4366 session->root = x509_root_get ( tls->server.root );
4367 session->key = privkey_get ( tls->client.key );
4368 INIT_LIST_HEAD ( &session->conn );
4369 list_add ( &session->list, &tls_sessions );
4370
4371 /* Poison resumption master secret */
4372 tls_ephemeral_label ( tls, "res poison",
4373 session->resumption_master_secret,
4374 sizeof ( session->resumption_master_secret ) );
4375
4376 /* Record session */
4377 tls->session = session;
4378
4379 DBGC ( tls, "TLS %p created session %s\n", tls, name );
4380 return 0;
4381
4382 ref_put ( &session->refcnt );
4383 err_alloc:
4384 return rc;
4385}
4386
4387/******************************************************************************
4388 *
4389 * Instantiator
4390 *
4391 ******************************************************************************
4392 */
4393
4394/**
4395 * Add TLS on an interface
4396 *
4397 * @v xfer Data transfer interface
4398 * @v name Host name
4399 * @v root Root of trust (or NULL to use default)
4400 * @v key Private key (or NULL to use default)
4401 * @ret rc Return status code
4402 */
4403int add_tls ( struct interface *xfer, const char *name,
4404 struct x509_root *root, struct private_key *key ) {
4405 struct tls_connection *tls;
4406 int rc;
4407
4408 /* Allocate and initialise TLS structure */
4409 tls = malloc ( sizeof ( *tls ) );
4410 if ( ! tls ) {
4411 rc = -ENOMEM;
4412 goto err_alloc;
4413 }
4414 memset ( tls, 0, sizeof ( *tls ) );
4415 ref_init ( &tls->refcnt, free_tls );
4416 INIT_LIST_HEAD ( &tls->list );
4417 intf_init ( &tls->plainstream, &tls_plainstream_desc, &tls->refcnt );
4418 intf_init ( &tls->cipherstream, &tls_cipherstream_desc, &tls->refcnt );
4419 intf_init ( &tls->server.validator, &tls_validator_desc, &tls->refcnt );
4420 process_init_stopped ( &tls->tx.process, &tls_process_desc,
4421 &tls->refcnt );
4422 tls->client.key = privkey_get ( key ? key : &private_key );
4423 tls->server.root = x509_root_get ( root ? root : &root_certificates );
4424 tls->version = TLS_VERSION_MAX;
4425 tls_clear_cipher ( tls, &tls->tx.cipherspec.active );
4426 tls_clear_cipher ( tls, &tls->tx.cipherspec.pending );
4427 tls_clear_cipher ( tls, &tls->rx.cipherspec.active );
4428 tls_clear_cipher ( tls, &tls->rx.cipherspec.pending );
4429 tls_clear_digest ( tls );
4430 iob_populate ( &tls->rx.iobuf, &tls->rx.header, 0,
4431 sizeof ( tls->rx.header ) );
4432 INIT_LIST_HEAD ( &tls->rx.data );
4433 if ( ( rc = tls_generate_ephemeral_master ( tls ) ) != 0 )
4434 goto err_ephemeral;
4435 if ( ( rc = tls_session ( tls, name ) ) != 0 )
4436 goto err_session;
4437 list_add_tail ( &tls->list, &tls->session->conn );
4438
4439 /* Start negotiation */
4440 tls_restart ( tls );
4441
4442 /* Attach to parent interface, mortalise self, and return */
4443 intf_insert ( xfer, &tls->plainstream, &tls->cipherstream );
4444 ref_put ( &tls->refcnt );
4445 return 0;
4446
4447 err_session:
4448 err_ephemeral:
4449 ref_put ( &tls->refcnt );
4450 err_alloc:
4451 return rc;
4452}
4453
4454/* Drag in objects via add_tls() */
4455REQUIRING_SYMBOL ( add_tls );
4456
4457/* Drag in crypto configuration */
4458REQUIRE_OBJECT ( config_crypto );
NULL
#define NULL
NULL pointer (VOID *).
Definition Base.h:321
ctx
struct golan_eq_context ctx
Definition CIB_PRM.h:0
out
__be32 out[4]
Definition CIB_PRM.h:8
sig
u8 sig
Definition CIB_PRM.h:15
signature
u8 signature
CPU signature.
Definition CIB_PRM.h:7
key
union @162305117151260234136356364136041353210355154177 key
typeof
typeof(acpi_finder=acpi_find)
ACPI table finder.
Definition acpi.c:48
aes.h
AES algorithm.
link
u32 link
Link to next descriptor.
Definition ar9003_mac.h:1
pad
u32 pad[9]
Padding.
Definition ar9003_mac.h:23
info
u32 info
Definition ar9003_mac.h:0
rc
struct arbelprm_rc_send_wqe rc
Definition arbel.h:3
value
pseudo_bit_t value[0x00020]
Definition arbel.h:2
hash
pseudo_bit_t hash[0x00010]
Definition arbel.h:2
code
static unsigned int code
Definition hyperv.h:26
uint16_t
unsigned short uint16_t
Definition stdint.h:11
uint32_t
unsigned int uint32_t
Definition stdint.h:12
uint64_t
unsigned long long uint64_t
Definition stdint.h:13
uint8_t
unsigned char uint8_t
Definition stdint.h:10
dest
if(len >=6 *4) __asm__ __volatile__("movsl" if(len >=5 *4) __asm__ __volatile__("movsl" if(len >=4 *4) __asm__ __volatile__("movsl" if(len >=3 *4) __asm__ __volatile__("movsl" if(len >=2 *4) __asm__ __volatile__("movsl" if(len >=1 *4) __asm__ __volatile__("movsl" if((len % 4) >=2) __asm__ __volatile__("movsw" if((len % 2) >=1) __asm__ __volatile__("movsb" retur dest)
Definition string.h:151
asn1_prepend_raw
int asn1_prepend_raw(struct asn1_builder *builder, const void *data, size_t len)
Prepend raw data to ASN.1 builder.
Definition asn1.c:1019
assert
#define assert(condition)
Assert a condition at run-time.
Definition assert.h:50
version
u32 version
Driver version.
Definition ath9k_hw.c:1985
name
const char * name
Definition ath9k_hw.c:1986
max
#define max(x, y)
Definition ath.h:41
done
struct bofm_section_header done
Definition bofm_test.c:46
certstore
struct x509_chain certstore
Certificate store.
Definition certstore.c:90
certstore.h
Certificate store.
crypto.h
Cryptographic configuration.
TLS_VERSION_MAX
#define TLS_VERSION_MAX
Maximum TLS version.
Definition crypto.h:17
TLS_VERSION_MIN
#define TLS_VERSION_MIN
Minimum TLS version.
Definition crypto.h:14
cipher_null
struct cipher_algorithm cipher_null
Definition crypto_null.c:94
pubkey_null
struct pubkey_algorithm pubkey_null
Definition crypto_null.c:144
digest_null
struct digest_algorithm digest_null
Definition crypto_null.c:53
next
uint32_t next
Next descriptor address.
Definition dwmac.h:11
len
ring len
Length.
Definition dwmac.h:226
fixed
struct eltorito_descriptor_fixed fixed
Fixed portion.
Definition eltorito.h:1
ext
uint16_t ext
Extended status.
Definition ena.h:9
type
uint32_t type
Operating system type.
Definition ena.h:1
data
uint8_t data[48]
Additional event data.
Definition ena.h:11
spec
uint16_t spec
ENA specification version.
Definition ena.h:15
header
struct ena_llq_option header
Header locations.
Definition ena.h:5
meta
uint8_t meta
Metadata flags.
Definition ena.h:3
group
uint16_t group
Type of event.
Definition ena.h:1
mac
uint8_t mac[ETH_ALEN]
MAC address.
Definition ena.h:13
errno.h
Error codes.
partner
struct eth_slow_lacp_entity_tlv partner
Partner information.
Definition eth_slow.h:5
ffdhe_has_params
int ffdhe_has_params(struct exchange_algorithm *exchange, const void *dh_p, size_t dh_p_len, const void *dh_g, size_t dh_g_len)
Check group parameters.
Definition ffdhe.c:310
ffdhe.h
Finite Field Diffie-Hellman Ephemeral key exchange.
is_ffdhe
static int is_ffdhe(struct exchange_algorithm *exchange)
Check if key exchange algorithm is a finite field DHE group.
Definition ffdhe.h:52
__unused
#define __unused
Declare a variable or data structure as unused.
Definition compiler.h:598
DBGC2
#define DBGC2(...)
Definition compiler.h:547
DBGC2_HD
#define DBGC2_HD(...)
Definition compiler.h:549
DBGC_HD
#define DBGC_HD(...)
Definition compiler.h:532
DBGC2_HDA
#define DBGC2_HDA(...)
Definition compiler.h:548
DBGC
#define DBGC(...)
Definition compiler.h:530
DBGC_HDA
#define DBGC_HDA(...)
Definition compiler.h:531
count
static unsigned int count
Number of entries.
Definition dwmac.h:220
FILE_LICENCE
#define FILE_LICENCE(_licence)
Declare a particular licence as applying to a file.
Definition compiler.h:921
REQUIRE_OBJECT
#define REQUIRE_OBJECT(object)
Require an object.
Definition compiler.h:227
EPROTO
#define EPROTO
Protocol error.
Definition errno.h:625
ENOMEM
#define ENOMEM
Not enough space.
Definition errno.h:535
ENOTCONN
#define ENOTCONN
The socket is not connected.
Definition errno.h:570
FILE_SECBOOT
#define FILE_SECBOOT(_status)
Declare a file's UEFI Secure Boot permission status.
Definition compiler.h:951
REQUIRING_SYMBOL
#define REQUIRING_SYMBOL(symbol)
Specify the file's requiring symbol.
Definition compiler.h:140
hkdf_expand
void hkdf_expand(struct digest_algorithm *digest, const void *prk, const void *info, size_t info_len, void *out, size_t len)
Expand pseudorandom key.
Definition hkdf.c:95
hkdf_extract
void hkdf_extract(struct digest_algorithm *digest, const void *salt, size_t salt_len, const void *ikm, size_t ikm_len, void *prk)
Extract fixed-length pseudorandom key.
Definition hkdf.c:56
hkdf.h
HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
hmac_init
void hmac_init(struct digest_algorithm *digest, void *ctx, const void *secret, size_t len)
Initialise HMAC.
Definition hmac.c:106
hmac_final
void hmac_final(struct digest_algorithm *digest, void *ctx, void *hmac)
Finalise HMAC.
Definition hmac.c:124
hmac_key
void hmac_key(struct digest_algorithm *digest, void *ctx, const void *secret, size_t len, void *key)
Construct HMAC reduced key.
Definition hmac.c:59
hmac_init_key
void hmac_init_key(struct digest_algorithm *digest, void *ctx, const void *key)
Initialise HMAC from reduced key.
Definition hmac.c:82
hmac.h
Keyed-Hashing for Message Authentication.
hmac_update
static void hmac_update(struct digest_algorithm *digest, void *ctx, const void *data, size_t len)
Update HMAC.
Definition hmac.h:62
hmac_ctxsize
static size_t hmac_ctxsize(struct digest_algorithm *digest)
Calculate HMAC context size.
Definition hmac.h:48
hmac_keysize
static size_t hmac_keysize(struct digest_algorithm *digest)
Calculate HMAC reduced key size.
Definition hmac.h:35
info_len
uint8_t info_len
Reject information length.
Definition ib_mad.h:7
cpu_to_be16
#define cpu_to_be16(value)
Definition byteswap.h:110
htonl
#define htonl(value)
Definition byteswap.h:134
cpu_to_le32
#define cpu_to_le32(value)
Definition byteswap.h:108
htons
#define htons(value)
Definition byteswap.h:136
ntohs
#define ntohs(value)
Definition byteswap.h:137
cpu_to_be64
#define cpu_to_be64(value)
Definition byteswap.h:112
be16_to_cpu
#define be16_to_cpu(value)
Definition byteswap.h:116
__attribute__
#define __attribute__(x)
Definition compiler.h:10
is_block_cipher
static int is_block_cipher(struct cipher_algorithm *cipher)
Definition crypto.h:352
digest_init
static void digest_init(struct digest_algorithm *digest, void *ctx)
Definition crypto.h:294
cipher_setkey
static int cipher_setkey(struct cipher_algorithm *cipher, void *ctx, const void *key, size_t keylen)
Definition crypto.h:310
digest_final
static void digest_final(struct digest_algorithm *digest, void *ctx, void *out)
Definition crypto.h:305
pubkey_encrypt
static int pubkey_encrypt(struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, const struct asn1_cursor *plaintext, struct asn1_builder *ciphertext)
Definition crypto.h:362
exchange_share
static int exchange_share(struct exchange_algorithm *exchange, const void *private, void *public)
Definition crypto.h:397
pubkey_verify
static int pubkey_verify(struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, const struct asn1_cursor *signature)
Definition crypto.h:383
exchange_agree
static int exchange_agree(struct exchange_algorithm *exchange, const void *private, const void *partner, void *shared)
Definition crypto.h:403
cipher_setiv
static int cipher_setiv(struct cipher_algorithm *cipher, void *ctx, const void *iv, size_t ivlen)
Definition crypto.h:316
digest_update
static void digest_update(struct digest_algorithm *digest, void *ctx, const void *data, size_t len)
Definition crypto.h:299
cipher_decrypt
#define cipher_decrypt(cipher, ctx, src, dst, len)
Definition crypto.h:336
is_auth_cipher
static int is_auth_cipher(struct cipher_algorithm *cipher)
Definition crypto.h:357
pubkey_sign
static int pubkey_sign(struct pubkey_algorithm *pubkey, const struct asn1_cursor *key, struct digest_algorithm *digest, const void *value, struct asn1_builder *signature)
Definition crypto.h:376
cipher_encrypt
#define cipher_encrypt(cipher, ctx, src, dst, len)
Definition crypto.h:326
cipher_auth
static void cipher_auth(struct cipher_algorithm *cipher, void *ctx, void *auth)
Definition crypto.h:342
param
struct hv_monitor_parameter param[4][32]
Parameters.
Definition hyperv.h:13
string.h
String functions.
memcpy
void * memcpy(void *dest, const void *src, size_t len) __nonnull
memset
void * memset(void *dest, int character, size_t len) __nonnull
memmove
void * memmove(void *dest, const void *src, size_t len) __nonnull
intf_close
void intf_close(struct interface *intf, int rc)
Close an object interface.
Definition interface.c:250
intf_shutdown
void intf_shutdown(struct interface *intf, int rc)
Shut down an object interface.
Definition interface.c:279
intf_insert
void intf_insert(struct interface *intf, struct interface *upper, struct interface *lower)
Insert a filter interface.
Definition interface.c:402
intf_restart
void intf_restart(struct interface *intf, int rc)
Shut down and restart an object interface.
Definition interface.c:344
INTF_DESC
#define INTF_DESC(object_type, intf, operations)
Define an object interface descriptor.
Definition interface.h:81
INTF_DESC_PASSTHRU
#define INTF_DESC_PASSTHRU(object_type, intf, operations, passthru)
Define an object interface descriptor with pass-through interface.
Definition interface.h:98
intf_init
static void intf_init(struct interface *intf, struct interface_descriptor *desc, struct refcnt *refcnt)
Initialise an object interface.
Definition interface.h:204
INTF_OP
#define INTF_OP(op_type, object_type, op_func)
Define an object interface operation.
Definition interface.h:33
free_iob
void free_iob(struct io_buffer *iobuf)
Free I/O buffer.
Definition iobuf.c:153
alloc_iob_raw
struct io_buffer * alloc_iob_raw(size_t len, size_t align, size_t offset)
Allocate I/O buffer with specified alignment and offset.
Definition iobuf.c:49
iob_concatenate
struct io_buffer * iob_concatenate(struct list_head *list)
Concatenate I/O buffers into a single buffer.
Definition iobuf.c:250
iobuf.h
I/O buffers.
iob_push
#define iob_push(iobuf, len)
Definition iobuf.h:89
iob_populate
static void iob_populate(struct io_buffer *iobuf, void *data, size_t len, size_t max_len)
Create a temporary I/O buffer.
Definition iobuf.h:195
iob_put
#define iob_put(iobuf, len)
Definition iobuf.h:125
iob_disown
#define iob_disown(iobuf)
Disown an I/O buffer.
Definition iobuf.h:217
iob_len
static size_t iob_len(struct io_buffer *iobuf)
Calculate length of data in an I/O buffer.
Definition iobuf.h:160
iob_reserve
#define iob_reserve(iobuf, len)
Definition iobuf.h:72
iob_pull
#define iob_pull(iobuf, len)
Definition iobuf.h:107
iob_unput
#define iob_unput(iobuf, len)
Definition iobuf.h:140
iob_tailroom
static size_t iob_tailroom(struct io_buffer *iobuf)
Calculate available space at end of an I/O buffer.
Definition iobuf.h:180
job_progress
int job_progress(struct interface *intf, struct job_progress *progress)
Get job progress.
Definition job.c:44
job.h
Job control interfaces.
tmp
unsigned long tmp
Definition linux_pci.h:65
list_first_entry
#define list_first_entry(list, type, member)
Get the container of the first entry in a list.
Definition list.h:334
list_last_entry
#define list_last_entry(list, type, member)
Get the container of the last entry in a list.
Definition list.h:347
list_for_each_entry_safe
#define list_for_each_entry_safe(pos, tmp, head, member)
Iterate over entries in a list, safe against deletion of the current entry.
Definition list.h:459
list_add_tail
#define list_add_tail(new, head)
Add a new entry to the tail of a list.
Definition list.h:94
list_for_each_entry
#define list_for_each_entry(pos, head, member)
Iterate over entries in a list.
Definition list.h:432
list_del
#define list_del(list)
Delete an entry from a list.
Definition list.h:120
INIT_LIST_HEAD
#define INIT_LIST_HEAD(list)
Initialise a list head.
Definition list.h:46
list_empty
#define list_empty(list)
Test whether a list is empty.
Definition list.h:137
LIST_HEAD
#define LIST_HEAD(list)
Declare a static list head.
Definition list.h:38
list_add
#define list_add(new, head)
Add a new entry to the head of a list.
Definition list.h:70
zalloc
void * zalloc(size_t size)
Allocate cleared memory.
Definition malloc.c:662
malloc
void * malloc(size_t size)
Allocate memory.
Definition malloc.c:621
zfree
void zfree(void *ptr)
Clear and free memory.
Definition malloc.c:682
md5.h
MD5 algorithm.
md5_algorithm
struct digest_algorithm md5_algorithm
md5_sha1_algorithm
struct digest_algorithm md5_sha1_algorithm
Hybrid MD5+SHA1 digest algorithm.
Definition md5_sha1.c:84
md5_sha1.h
Hybrid MD5+SHA1 hash as used by TLSv1.1 and earlier.
alert
void alert(unsigned int row, const char *fmt,...)
Show alert message.
Definition message.c:104
open.h
Data transfer interface opening.
first
uint32_t first
First block in range.
Definition pccrr.h:1
pending_put
void pending_put(struct pending_operation *pending)
Mark an operation as no longer pending.
Definition pending.c:59
pending_get
void pending_get(struct pending_operation *pending)
Mark an operation as pending.
Definition pending.c:46
pending.h
Pending operations.
is_pending
static int is_pending(struct pending_operation *pending)
Check if an operation is pending.
Definition pending.h:25
privkey.h
Private key.
privkey_cursor
static struct asn1_cursor * privkey_cursor(struct private_key *key)
Get private key ASN.1 cursor.
Definition privkey.h:53
privkey_put
static void privkey_put(struct private_key *key)
Drop reference to private key.
Definition privkey.h:42
privkey_get
static struct private_key * privkey_get(struct private_key *key)
Get reference to private key.
Definition privkey.h:31
process_del
void process_del(struct process *process)
Remove process from process list.
Definition process.c:80
process_add
void process_add(struct process *process)
Add process to process list.
Definition process.c:60
PROC_DESC_ONCE
#define PROC_DESC_ONCE(object_type, process, _step)
Define a process descriptor for a process that runs only once.
Definition process.h:98
process_init_stopped
static void process_init_stopped(struct process *process, struct process_descriptor *desc, struct refcnt *refcnt)
Initialise process without adding to process list.
Definition process.h:146
random
long int random(void)
Generate a pseudo-random number between 0 and 2147483647L or 2147483562?
Definition random.c:32
rbg_generate
int rbg_generate(const void *additional, size_t additional_len, int prediction_resist, void *data, size_t len)
Generate bits using RBG.
Definition rbg.c:117
rbg.h
RBG mechanism.
ref_get
#define ref_get(refcnt)
Get additional reference to object.
Definition refcnt.h:93
ref_put
#define ref_put(refcnt)
Drop reference to object.
Definition refcnt.h:107
ref_init
#define ref_init(refcnt, free)
Initialise a reference counter.
Definition refcnt.h:65
root_certificates
struct x509_root root_certificates
Root certificates.
Definition rootcert.c:79
rootcert.h
Root certificate store.
rsa.h
RSA public-key cryptography.
sha1.h
SHA-1 algorithm.
sha1_algorithm
struct digest_algorithm sha1_algorithm
sha256.h
SHA-256 algorithm.
length
u16 length
Definition sky2.h:1
va_copy
#define va_copy(dest, src)
Definition stdarg.h:11
va_arg
#define va_arg(ap, type)
Definition stdarg.h:9
va_end
#define va_end(ap)
Definition stdarg.h:10
va_start
#define va_start(ap, last)
Definition stdarg.h:8
va_list
__builtin_va_list va_list
Definition stdarg.h:7
container_of
#define container_of(ptr, type, field)
Get containing structure.
Definition stddef.h:36
ENOTSUP_VERSION
#define ENOTSUP_VERSION
Definition stp.c:46
root
struct stp_switch root
Root switch.
Definition stp.h:15
hello
uint16_t hello
Hello time.
Definition stp.h:27
strerror
char * strerror(int errno)
Retrieve string representation of error number.
Definition strerror.c:79
memswap
void * memswap(void *first, void *second, size_t len)
Swap memory regions.
Definition string.c:154
strcmp
int strcmp(const char *first, const char *second)
Compare strings.
Definition string.c:174
memcmp
int memcmp(const void *first, const void *second, size_t len)
Compare memory regions.
Definition string.c:115
strcpy
char * strcpy(char *dest, const char *src)
Copy string.
Definition string.c:378
strlen
size_t strlen(const char *src)
Get length of string.
Definition string.c:244
asn1_algorithm::name
const char * name
Name.
Definition asn1.h:416
asn1_algorithm::pubkey
struct pubkey_algorithm * pubkey
Public-key algorithm (if applicable).
Definition asn1.h:420
asn1_builder
An ASN.1 object builder.
Definition asn1.h:29
asn1_builder::data
void * data
Data.
Definition asn1.h:36
asn1_builder::len
size_t len
Length of data.
Definition asn1.h:38
asn1_cursor
An ASN.1 object cursor.
Definition asn1.h:21
asn1_cursor::data
const void * data
Start of data.
Definition asn1.h:23
asn1_cursor::len
size_t len
Length of data.
Definition asn1.h:25
cipher_algorithm
A cipher algorithm.
Definition crypto.h:58
cipher_algorithm::name
const char * name
Algorithm name.
Definition crypto.h:60
cipher_algorithm::blocksize
size_t blocksize
Block size.
Definition crypto.h:68
cipher_algorithm::ctxsize
size_t ctxsize
Context size.
Definition crypto.h:62
cipher_algorithm::authsize
size_t authsize
Authentication tag size.
Definition crypto.h:82
cipher_algorithm::alignsize
size_t alignsize
Alignment size.
Definition crypto.h:80
digest_algorithm
A message digest algorithm.
Definition crypto.h:19
digest_algorithm::digestsize
size_t digestsize
Digest size.
Definition crypto.h:27
digest_algorithm::ctxsize
size_t ctxsize
Context size.
Definition crypto.h:23
digest_algorithm::name
const char * name
Algorithm name.
Definition crypto.h:21
exchange_algorithm
A key exchange algorithm.
Definition crypto.h:210
exchange_algorithm::sharedsize
size_t sharedsize
Shared secret size.
Definition crypto.h:218
exchange_algorithm::privsize
size_t privsize
Private key size.
Definition crypto.h:214
exchange_algorithm::pubsize
size_t pubsize
Public key size.
Definition crypto.h:216
exchange_algorithm::name
const char * name
Algorithm name.
Definition crypto.h:212
interface_descriptor
An object interface descriptor.
Definition interface.h:56
interface_operation
An object interface operation.
Definition interface.h:18
interface
An object interface.
Definition interface.h:125
io_buffer
A persistent I/O buffer.
Definition iobuf.h:38
io_buffer::data
void * data
Start of data.
Definition iobuf.h:53
io_buffer::tail
void * tail
End of data.
Definition iobuf.h:55
io_buffer::list
struct list_head list
List of which this buffer is a member.
Definition iobuf.h:45
job_progress
Job progress.
Definition job.h:16
label
A text label widget.
Definition label.h:16
list_head
A doubly-linked list entry (or list head).
Definition list.h:19
md5_sha1_hmac_keys
An MD5+SHA1 HMAC key block.
Definition md5_sha1.h:57
md5_sha1_hmac_keys::md5
uint8_t md5[MD5_BLOCK_SIZE]
MD5 HMAC key.
Definition md5_sha1.h:59
md5_sha1_hmac_keys::sha1
uint8_t sha1[SHA1_BLOCK_SIZE]
SHA-1 HMAC key.
Definition md5_sha1.h:61
private_key
A private key.
Definition privkey.h:17
process_descriptor
A process descriptor.
Definition process.h:32
process
A process.
Definition process.h:18
pubkey_algorithm
A public key algorithm.
Definition crypto.h:142
pubkey_algorithm::name
const char * name
Algorithm name.
Definition crypto.h:144
refcnt
A reference counter.
Definition refcnt.h:27
tls24_t
A TLS 24-bit integer.
Definition tls.c:236
tls24_t::high
uint8_t high
High byte.
Definition tls.c:238
tls24_t::low
uint16_t low
Low word.
Definition tls.c:240
tls_auth_header
TLS authentication header.
Definition tls.h:164
tls_auth_header::seq
uint64_t seq
Sequence number.
Definition tls.h:166
tls_auth_header::header
struct tls_header header
TLS header.
Definition tls.h:168
tls_cipher_suite
A TLS cipher suite.
Definition tls.h:219
tls_cipher_suite::fixed_iv_len
uint8_t fixed_iv_len
Fixed initialisation vector length.
Definition tls.h:235
tls_cipher_suite::cipher
struct cipher_algorithm * cipher
Bulk encryption cipher algorithm.
Definition tls.h:225
tls_cipher_suite::pubkey
struct pubkey_algorithm * pubkey
Public-key encryption algorithm.
Definition tls.h:223
tls_cipher_suite::key_len
uint8_t key_len
Key length.
Definition tls.h:233
tls_cipher_suite::mac_len
uint8_t mac_len
MAC length.
Definition tls.h:239
tls_cipher_suite::record_iv_len
uint8_t record_iv_len
Record initialisation vector length.
Definition tls.h:237
tls_cipher_suite::digest
struct digest_algorithm * digest
MAC digest algorithm.
Definition tls.h:227
tls_cipher_suite::exchange
struct tls_key_exchange_algorithm * exchange
Key exchange algorithm.
Definition tls.h:221
tls_cipher_suite::code
uint16_t code
Numeric code (in network-endian order).
Definition tls.h:231
tls_cipher_suite::handshake
struct digest_algorithm * handshake
Handshake digest algorithm (for TLSv1.2 and above).
Definition tls.h:229
tls_cipherspec_pair
A TLS cipher specification pair.
Definition tls.h:293
tls_cipherspec_pair::pending
struct tls_cipherspec pending
Next cipher specification.
Definition tls.h:297
tls_cipherspec_pair::active
struct tls_cipherspec active
Current cipher specification.
Definition tls.h:295
tls_cipherspec
A TLS cipher specification.
Definition tls.h:279
tls_cipherspec::fixed_iv
void * fixed_iv
Fixed initialisation vector.
Definition tls.h:289
tls_cipherspec::suite
struct tls_cipher_suite * suite
Cipher suite.
Definition tls.h:281
tls_cipherspec::cipher_ctx
void * cipher_ctx
Bulk encryption cipher context.
Definition tls.h:285
tls_cipherspec::dynamic
void * dynamic
Dynamically-allocated storage.
Definition tls.h:283
tls_cipherspec::mac_secret
void * mac_secret
MAC secret.
Definition tls.h:287
tls_client_random::random
uint8_t random[32]
Random data.
Definition tls.h:328
tls_client::random
struct tls_client_random random
Random bytes.
Definition tls.h:499
tls_client::key
struct private_key * key
Private key (if used).
Definition tls.h:501
tls_client::chain
struct x509_chain * chain
Certificate chain (if used).
Definition tls.h:503
tls_client::negotiation
struct pending_operation negotiation
Security negotiation pending operation.
Definition tls.h:505
tls_connection
A TLS connection.
Definition tls.h:525
tls_connection::cipherstream
struct interface cipherstream
Ciphertext stream.
Definition tls.h:545
tls_connection::session
struct tls_session * session
Session.
Definition tls.h:530
tls_connection::server
struct tls_server server
Server state.
Definition tls.h:565
tls_connection::key
struct tls_key_schedule key
Key schedule.
Definition tls.h:557
tls_connection::rx
struct tls_rx rx
Receive state.
Definition tls.h:561
tls_connection::new_session_ticket
void * new_session_ticket
New session ticket.
Definition tls.h:538
tls_connection::verify
struct tls_verify_data verify
Verification data.
Definition tls.h:554
tls_connection::session_id_len
size_t session_id_len
Length of session ID.
Definition tls.h:536
tls_connection::plainstream
struct interface plainstream
Plaintext stream.
Definition tls.h:543
tls_connection::tx
struct tls_tx tx
Transmit state.
Definition tls.h:559
tls_connection::session_id
uint8_t session_id[32]
Session ID.
Definition tls.h:534
tls_connection::extended_master_secret
int extended_master_secret
Extended master secret flag.
Definition tls.h:552
tls_connection::list
struct list_head list
List of connections within the same session.
Definition tls.h:532
tls_connection::client
struct tls_client client
Client state.
Definition tls.h:563
tls_connection::version
uint16_t version
Protocol version.
Definition tls.h:548
tls_connection::new_session_ticket_len
size_t new_session_ticket_len
Length of new session ticket.
Definition tls.h:540
tls_connection::refcnt
struct refcnt refcnt
Reference counter.
Definition tls.h:527
tls_connection::secure_renegotiation
int secure_renegotiation
Secure renegotiation flag.
Definition tls.h:550
tls_header
A TLS header.
Definition tls.h:30
tls_header::version
uint16_t version
Protocol version.
Definition tls.h:40
tls_header::length
uint16_t length
Length of payload.
Definition tls.h:42
tls_header::type
uint8_t type
Content type.
Definition tls.h:35
tls_key_exchange_algorithm
A TLS key exchange algorithm.
Definition tls.h:196
tls_key_exchange_algorithm::name
const char * name
Algorithm name.
Definition tls.h:198
tls_key_exchange_algorithm::server
int(* server)(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Key Exchange record using ECDHE key exchange.
Definition tls.h:207
tls_key_exchange_algorithm::client
int(* client)(struct tls_connection *tls)
Transmit Client Key Exchange record.
Definition tls.h:215
tls_key_schedule
TLS key schedule.
Definition tls.h:370
tls_key_schedule::bound
struct x509_certificate * bound
Server identity to which the schedule has been bound (if any).
Definition tls.h:455
tls_key_schedule::keyed
int keyed
Schedule holds secret key material.
Definition tls.h:393
tls_key_schedule::digest
struct digest_algorithm * digest
Digest algorithm.
Definition tls.h:378
tls_key_schedule::group
struct tls_named_group * group
Named key exchange group.
Definition tls.h:380
tls_key_schedule::dynamic
void * dynamic
Dynamically-allocated storage.
Definition tls.h:457
tls_named_group
A TLS named group.
Definition tls.h:254
tls_rx::cipherspec
struct tls_cipherspec_pair cipherspec
Cipher specifications.
Definition tls.h:481
tls_rx::data
struct list_head data
List of received data buffers.
Definition tls.h:491
tls_rx::iobuf
struct io_buffer iobuf
Current received record header (static I/O buffer).
Definition tls.h:489
tls_rx::handshake
struct io_buffer * handshake
Received handshake fragment.
Definition tls.h:493
tls_rx::state
enum tls_rx_state state
State machine current state.
Definition tls.h:485
tls_rx::header
struct tls_header header
Current received record header.
Definition tls.h:487
tls_rx::seq
uint64_t seq
Sequence number.
Definition tls.h:483
tls_server::validation
struct pending_operation validation
Certificate validation pending operation.
Definition tls.h:519
tls_server::validator
struct interface validator
Certificate validator.
Definition tls.h:517
tls_server::root
struct x509_root * root
Root of trust.
Definition tls.h:513
tls_server::negotiation
struct pending_operation negotiation
Security negotiation pending operation.
Definition tls.h:521
tls_server::chain
struct x509_chain * chain
Certificate chain.
Definition tls.h:515
tls_server::random
uint8_t random[32]
Random bytes.
Definition tls.h:511
tls_session
A TLS session.
Definition tls.h:332
tls_session::key
struct private_key * key
Private key.
Definition tls.h:343
tls_session::id
uint8_t id[32]
Session ID.
Definition tls.h:348
tls_session::resumption_master_secret
uint8_t resumption_master_secret[48]
Resumption master secret.
Definition tls.h:356
tls_session::extended_master_secret
int extended_master_secret
Extended master secret flag.
Definition tls.h:360
tls_session::name
const char * name
Server name.
Definition tls.h:339
tls_session::cert
struct x509_certificate * cert
Server certificate.
Definition tls.h:346
tls_session::id_len
size_t id_len
Length of session ID.
Definition tls.h:350
tls_session::ticket_len
size_t ticket_len
Length of session ticket.
Definition tls.h:354
tls_session::root
struct x509_root * root
Root of trust.
Definition tls.h:341
tls_session::conn
struct list_head conn
List of connections.
Definition tls.h:363
tls_session::refcnt
struct refcnt refcnt
Reference counter.
Definition tls.h:334
tls_session::resumption_master_secret_len
size_t resumption_master_secret_len
Length of resumption master secret.
Definition tls.h:358
tls_session::ticket
void * ticket
Session ticket.
Definition tls.h:352
tls_session::list
struct list_head list
List of sessions.
Definition tls.h:336
tls_signature_hash_algorithm
A TLS signature algorithm.
Definition tls.h:301
tls_signature_hash_algorithm::algorithm
struct asn1_algorithm * algorithm
Required certificate OID-identified algorithm.
Definition tls.h:307
tls_signature_hash_algorithm::pubkey
struct pubkey_algorithm * pubkey
Public-key algorithm.
Definition tls.h:305
tls_signature_hash_algorithm::code
uint16_t code
Numeric code (in network-endian order).
Definition tls.h:309
tls_signature_hash_algorithm::digest
struct digest_algorithm * digest
Digest algorithm.
Definition tls.h:303
tls_tx::seq
uint64_t seq
Sequence number.
Definition tls.h:471
tls_tx::pending
unsigned int pending
Pending transmissions.
Definition tls.h:473
tls_tx::cipherspec
struct tls_cipherspec_pair cipherspec
Cipher specifications.
Definition tls.h:469
tls_tx::process
struct process process
Transmit process.
Definition tls.h:475
tls_verify_data::client
uint8_t client[12]
Client verification data.
Definition tls.h:174
tls_verify_data::server
uint8_t server[12]
Server verification data.
Definition tls.h:176
x509_certificate
An X.509 certificate.
Definition x509.h:216
x509_certificate::subject
struct x509_subject subject
Subject.
Definition x509.h:245
x509_certificate::raw
struct asn1_cursor raw
Raw certificate.
Definition x509.h:231
x509_certificate::signature_algorithm
struct asn1_algorithm * signature_algorithm
Signature algorithm.
Definition x509.h:239
x509_chain::links
struct list_head links
List of links.
Definition x509.h:205
x509_link
A link in an X.509 certificate chain.
Definition x509.h:171
x509_public_key::algorithm
struct asn1_algorithm * algorithm
Public key algorithm.
Definition x509.h:54
x509_public_key::raw
struct asn1_cursor raw
Raw public key information.
Definition x509.h:52
x509_root
An X.509 root certificate list.
Definition x509.h:375
x509_subject::public_key
struct x509_public_key public_key
Public key information.
Definition x509.h:66
xfer_metadata
Data transfer metadata.
Definition xfer.h:23
for_each_table_entry
#define for_each_table_entry(pointer, table)
Iterate through all entries within a linker table.
Definition tables.h:386
tls_alloc_iob
static struct io_buffer * tls_alloc_iob(struct tls_connection *tls, size_t len)
Allocate I/O buffer for transmitted record(s).
Definition tls.c:3472
EINVAL_CHANGE_CIPHER
#define EINVAL_CHANGE_CIPHER
Definition tls.c:59
tls_cipherstream_desc
static struct interface_descriptor tls_cipherstream_desc
TLS ciphertext stream interface descriptor.
Definition tls.c:4141
tls_hmac_init
static void tls_hmac_init(struct tls_cipherspec *cipherspec, void *ctx, struct tls_auth_header *authhdr)
Initialise HMAC.
Definition tls.c:3357
tls_new_ciphertext
static int tls_new_ciphertext(struct tls_connection *tls, struct tls_header *tlshdr, struct list_head *rx_data)
Receive new ciphertext record.
Definition tls.c:3707
EINVAL_ALERT
#define EINVAL_ALERT
Definition tls.c:63
tls_new_server_key_exchange_pubkey
static int tls_new_server_key_exchange_pubkey(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Key Exchange record using public key transport.
Definition tls.c:1558
tls_send_handshake
static int tls_send_handshake(struct tls_connection *tls, const void *data, size_t len)
Transmit Handshake record.
Definition tls.c:1963
ENOTSUP_CIPHER
#define ENOTSUP_CIPHER
Definition tls.c:151
tls_new_finished
static int tls_new_finished(struct tls_connection *tls, const void *data, size_t len)
Receive new Finished handshake record.
Definition tls.c:3056
tls_progress
static int tls_progress(struct tls_connection *tls, struct job_progress *progress)
Report job progress.
Definition tls.c:3903
EPERM_BOUND
#define EPERM_BOUND
Definition tls.c:195
ENOTSUP_NULL
#define ENOTSUP_NULL
Definition tls.c:155
tls_verify_dh_params
static int tls_verify_dh_params(struct tls_connection *tls, const void *data, size_t len, size_t param_len)
Verify Diffie-Hellman parameter signature.
Definition tls.c:1451
tls_validator_done
static void tls_validator_done(struct tls_connection *tls, int rc)
Handle certificate validation completion.
Definition tls.c:4158
EINVAL_KEY_EXCHANGE
#define EINVAL_KEY_EXCHANGE
Definition tls.c:111
tls_send_alert
static int tls_send_alert(struct tls_connection *tls, unsigned int level, unsigned int description)
Transmit Alert record.
Definition tls.c:2406
tls_p_hash_va
static void tls_p_hash_va(struct tls_connection *tls, struct digest_algorithm *digest, const void *hkey, void *out, size_t out_len, va_list seeds)
Generate secure pseudo-random data using a single hash function.
Definition tls.c:637
tls_set_digest
static int tls_set_digest(struct tls_connection *tls, struct digest_algorithm *digest)
Set key schedule digest algorithm.
Definition tls.c:566
ENOMEM_CHAIN
#define ENOMEM_CHAIN
Definition tls.c:131
tls_prf
static void tls_prf(struct tls_connection *tls, void *out, size_t out_len,...)
Generate secure pseudo-random data.
Definition tls.c:693
tls_send_certificate
static int tls_send_certificate(struct tls_connection *tls)
Transmit Certificate record.
Definition tls.c:2171
ENOTSUP_GROUP
#define ENOTSUP_GROUP
Definition tls.c:167
tls_tx_resume
static void tls_tx_resume(struct tls_connection *tls)
Resume TX state machine.
Definition tls.c:1916
EPERM_EMS
#define EPERM_EMS
Definition tls.c:191
tls_validator_ops
static struct interface_operation tls_validator_ops[]
TLS certificate validator interface operations.
Definition tls.c:4193
free_tls_session
static void free_tls_session(struct refcnt *refcnt)
Free TLS session.
Definition tls.c:308
tls_new_change_cipher
static int tls_new_change_cipher(struct tls_connection *tls, struct io_buffer *iobuf)
Receive new Change Cipher record.
Definition tls.c:2428
tls_resume_secret
static void tls_resume_secret(struct tls_connection *tls)
Resume from resumption master secret.
Definition tls.c:1119
tls_clear_digest
static void tls_clear_digest(struct tls_connection *tls)
Clear key schedule digest algorithm.
Definition tls.c:542
EINVAL_RX_STATE
#define EINVAL_RX_STATE
Definition tls.c:99
tls_tx_step
static void tls_tx_step(struct tls_connection *tls)
TLS TX state machine.
Definition tls.c:4214
EINVAL_CERTIFICATES
#define EINVAL_CERTIFICATES
Definition tls.c:75
tls_newdata_process_data
static int tls_newdata_process_data(struct tls_connection *tls)
Handle received TLS data payload.
Definition tls.c:4026
EPERM_KEY_EXCHANGE
#define EPERM_KEY_EXCHANGE
Definition tls.c:187
tls_prf_label
#define tls_prf_label(tls, out, out_len, label,...)
Generate secure pseudo-random data.
Definition tls.c:746
tls_send_finished
static int tls_send_finished(struct tls_connection *tls)
Transmit Finished record.
Definition tls.c:2357
tls_agree_ephemeral
static int tls_agree_ephemeral(struct tls_connection *tls, const void *partner, size_t partner_len, int strip)
Agree ephemeral public key (i.e.
Definition tls.c:837
EINVAL_TICKET
#define EINVAL_TICKET
Definition tls.c:107
tls_cipherstream_ops
static struct interface_operation tls_cipherstream_ops[]
TLS ciphertext stream interface operations.
Definition tls.c:4130
EINVAL_CERTIFICATE
#define EINVAL_CERTIFICATE
Definition tls.c:71
tls_send_record
static int tls_send_record(struct tls_connection *tls, unsigned int type, struct io_buffer *iobuf)
Send plaintext record(s).
Definition tls.c:3499
ENOMEM_RX_DATA
#define ENOMEM_RX_DATA
Definition tls.c:143
tls_set_cipher
static int tls_set_cipher(struct tls_connection *tls, struct tls_cipherspec *cipherspec, struct tls_cipher_suite *suite)
Set cipher suite.
Definition tls.c:1241
ENOMEM_CERTIFICATE
#define ENOMEM_CERTIFICATE
Definition tls.c:127
tls_generate_master_secret
static void tls_generate_master_secret(struct tls_connection *tls)
Generate master secret.
Definition tls.c:927
tls_send_client_hello
static int tls_send_client_hello(struct tls_connection *tls)
Transmit Client Hello record.
Definition tls.c:2160
tls_share_ephemeral
static int tls_share_ephemeral(struct tls_connection *tls, void *public)
Share ephemeral public key.
Definition tls.c:803
tls_client_hello
static int tls_client_hello(struct tls_connection *tls, int(*action)(struct tls_connection *tls, const void *data, size_t len))
Digest or transmit Client Hello record.
Definition tls.c:1977
tls_find_cipher_suite
static struct tls_cipher_suite * tls_find_cipher_suite(unsigned int cipher_suite)
Identify cipher suite.
Definition tls.c:1208
tls_validator_desc
static struct interface_descriptor tls_validator_desc
TLS certificate validator interface descriptor.
Definition tls.c:4198
tls_set_uint24
static void tls_set_uint24(tls24_t *field24, unsigned long value)
Set 24-bit field value.
Definition tls.c:262
tls_hmac_update_va
static void tls_hmac_update_va(struct digest_algorithm *digest, void *ctx, va_list args)
Update HMAC with a list of ( data, len ) pairs.
Definition tls.c:616
tls_cipherstream_deliver
static int tls_cipherstream_deliver(struct tls_connection *tls, struct io_buffer *iobuf, struct xfer_metadata *xfer __unused)
Receive new ciphertext.
Definition tls.c:4079
tls_hmac_final
static void tls_hmac_final(struct tls_cipherspec *cipherspec, void *ctx, void *hmac)
Finalise HMAC.
Definition tls.c:3388
EPERM_ALERT
#define EPERM_ALERT
Definition tls.c:171
EINVAL_IV
#define EINVAL_IV
Definition tls.c:91
ENOMEM_TX_PLAINTEXT
#define ENOMEM_TX_PLAINTEXT
Definition tls.c:135
EINVAL_HELLO_DONE
#define EINVAL_HELLO_DONE
Definition tls.c:79
tls_new_server_key_exchange_ecdhe
static int tls_new_server_key_exchange_ecdhe(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Key Exchange record using ECDHE key exchange.
Definition tls.c:1807
tls_ephemeral
static void tls_ephemeral(struct tls_connection *tls, const void *info, size_t info_len, void *out, size_t len)
Generate ephemeral secret.
Definition tls.c:457
TLS_NUM_CIPHER_SUITES
#define TLS_NUM_CIPHER_SUITES
Number of supported cipher suites.
Definition tls.c:1199
tls_set_binding
static void tls_set_binding(struct tls_connection *tls, struct x509_certificate *cert)
Bind key schedule to a server identity.
Definition tls.c:519
tls_newdata_process_header
static int tls_newdata_process_header(struct tls_connection *tls)
Handle received TLS header.
Definition tls.c:3943
tls_send_client_key_exchange
static int tls_send_client_key_exchange(struct tls_connection *tls)
Transmit Client Key Exchange record.
Definition tls.c:2228
tls_version
static int tls_version(struct tls_connection *tls, unsigned int version)
Check for TLS version.
Definition tls.c:291
tls_find_param_group
static struct tls_named_group * tls_find_param_group(const void *dh_p, size_t dh_p_len, const void *dh_g, size_t dh_g_len)
Identify named key exchange group by Diffie-Hellman parameters.
Definition tls.c:1426
tls_ready
static int tls_ready(struct tls_connection *tls)
Determine if TLS connection is ready for application data.
Definition tls.c:274
tls_plainstream_desc
static struct interface_descriptor tls_plainstream_desc
TLS plaintext stream interface descriptor.
Definition tls.c:3926
tls_change_cipher
static int tls_change_cipher(struct tls_connection *tls, struct tls_cipherspec_pair *pair)
Activate next cipher suite.
Definition tls.c:1323
tls_plainstream_deliver
static int tls_plainstream_deliver(struct tls_connection *tls, struct io_buffer *iobuf, struct xfer_metadata *meta __unused)
Deliver datagram as raw data.
Definition tls.c:3875
tls_session
static int tls_session(struct tls_connection *tls, const char *name)
Find or create session for TLS connection.
Definition tls.c:4338
free_tls
static void free_tls(struct refcnt *refcnt)
Free TLS connection.
Definition tls.c:333
tls_send_client_key_exchange_dhe
static int tls_send_client_key_exchange_dhe(struct tls_connection *tls)
Transmit Client Key Exchange record using DHE key exchange.
Definition tls.c:1751
EIO_ALERT
#define EIO_ALERT
Definition tls.c:115
EINVAL_HELLO
#define EINVAL_HELLO
Definition tls.c:67
tls_restart
static void tls_restart(struct tls_connection *tls)
Restart negotiation.
Definition tls.c:1937
tls_cipher_suite_null
struct tls_cipher_suite tls_cipher_suite_null
Null cipher suite.
Definition tls.c:1191
tls_pubkey_exchange_algorithm
struct tls_key_exchange_algorithm tls_pubkey_exchange_algorithm
Public key exchange algorithm.
Definition tls.c:1665
tls_plainstream_window
static size_t tls_plainstream_window(struct tls_connection *tls)
Check flow control window.
Definition tls.c:3858
tls_hmac_list
static void tls_hmac_list(struct tls_cipherspec *cipherspec, struct tls_auth_header *authhdr, struct list_head *list, void *hmac)
Calculate HMAC over list of I/O buffers.
Definition tls.c:3423
tls_send_change_cipher
static int tls_send_change_cipher(struct tls_connection *tls)
Transmit Change Cipher record.
Definition tls.c:2340
tls_generate_ephemeral_master
static int tls_generate_ephemeral_master(struct tls_connection *tls)
Generate ephemeral master secret.
Definition tls.c:425
tls_ecdhe_exchange_algorithm
struct tls_key_exchange_algorithm tls_ecdhe_exchange_algorithm
Ephemeral Elliptic Curve Diffie-Hellman key exchange algorithm.
Definition tls.c:1898
tls_send_client_key_exchange_pubkey
static int tls_send_client_key_exchange_pubkey(struct tls_connection *tls)
Transmit Client Key Exchange record using public key exchange.
Definition tls.c:1573
tls_find_named_group
static struct tls_named_group * tls_find_named_group(unsigned int named_group)
Identify named key exchange group.
Definition tls.c:1404
EINVAL_FINISHED
#define EINVAL_FINISHED
Definition tls.c:83
tls_cipherstream_window
static size_t tls_cipherstream_window(struct tls_connection *tls)
Check flow control window.
Definition tls.c:4062
tls_send_plaintext
static int tls_send_plaintext(struct tls_connection *tls, unsigned int type, const void *data, size_t len)
Send plaintext record.
Definition tls.c:3646
tls_hmac
static void tls_hmac(struct tls_cipherspec *cipherspec, struct tls_auth_header *authhdr, const void *data, size_t len, void *hmac)
Calculate HMAC.
Definition tls.c:3404
EINVAL_MAC
#define EINVAL_MAC
Definition tls.c:103
tls_hmac_update
static void tls_hmac_update(struct tls_cipherspec *cipherspec, void *ctx, const void *data, size_t len)
Update HMAC.
Definition tls.c:3374
EPERM_RENEG_INSECURE
#define EPERM_RENEG_INSECURE
Definition tls.c:179
tls_new_server_hello
static int tls_new_server_hello(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Hello handshake record.
Definition tls.c:2544
tls_send_certificate_verify
static int tls_send_certificate_verify(struct tls_connection *tls)
Transmit Certificate Verify record.
Definition tls.c:2259
tls_close_alert
static void tls_close_alert(struct tls_connection *tls, int rc)
Send closure alert and finish with TLS connection.
Definition tls.c:403
ENOMEM_RX_CONCAT
#define ENOMEM_RX_CONCAT
Definition tls.c:147
tls_close
static void tls_close(struct tls_connection *tls, int rc)
Finish with TLS connection.
Definition tls.c:371
tls_select_cipher
static int tls_select_cipher(struct tls_connection *tls, unsigned int cipher_suite)
Select next cipher suite.
Definition tls.c:1280
EINVAL_PADDING
#define EINVAL_PADDING
Definition tls.c:95
tls_new_certificate_request
static int tls_new_certificate_request(struct tls_connection *tls, const void *data __unused, size_t len __unused)
Receive new Certificate Request handshake record.
Definition tls.c:2960
tls_verify_padding
static int tls_verify_padding(struct tls_connection *tls, struct io_buffer *iobuf)
Verify block padding.
Definition tls.c:3672
tls_new_server_key_exchange_dhe
static int tls_new_server_key_exchange_dhe(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Key Exchange record using DHE key exchange.
Definition tls.c:1679
tls_ephemeral_label
static void tls_ephemeral_label(struct tls_connection *tls, const char *label, void *out, size_t len)
Generate ephemeral secret from label.
Definition tls.c:474
EPROTO_VERSION
#define EPROTO_VERSION
Definition tls.c:199
tls_generate_resumption_master
static void tls_generate_resumption_master(struct tls_connection *tls)
Generate resumption master secret.
Definition tls.c:1059
tls_process_desc
static struct process_descriptor tls_process_desc
TLS TX process descriptor.
Definition tls.c:4321
tls_new_session_ticket
static int tls_new_session_ticket(struct tls_connection *tls, const void *data, size_t len)
Receive New Session Ticket handshake record.
Definition tls.c:2747
EPERM_VERIFY
#define EPERM_VERIFY
Definition tls.c:175
EPERM_RENEG_VERIFY
#define EPERM_RENEG_VERIFY
Definition tls.c:183
ENOTSUP_SIG_HASH
#define ENOTSUP_SIG_HASH
Definition tls.c:159
tls_new_unknown
static int tls_new_unknown(struct tls_connection *tls __unused, struct io_buffer *iobuf)
Receive new unknown record.
Definition tls.c:3232
tls_dhe_exchange_algorithm
struct tls_key_exchange_algorithm tls_dhe_exchange_algorithm
Ephemeral Diffie-Hellman key exchange algorithm.
Definition tls.c:1793
tls_new_data
static int tls_new_data(struct tls_connection *tls, struct list_head *rx_data)
Receive new data record.
Definition tls.c:3247
TLS_NUM_SIG_HASH_ALGORITHMS
#define TLS_NUM_SIG_HASH_ALGORITHMS
Number of supported signature and hash algorithms.
Definition tls.c:1345
tls_new_hello_request
static int tls_new_hello_request(struct tls_connection *tls, const void *data __unused, size_t len __unused)
Receive new Hello Request handshake record.
Definition tls.c:2513
tls_new_handshake
static int tls_new_handshake(struct tls_connection *tls, struct io_buffer *iobuf)
Receive new Handshake record.
Definition tls.c:3142
tls_iob_reserved
static size_t tls_iob_reserved(struct tls_connection *tls, size_t len)
Calculate maximum additional length required for transmitted record(s).
Definition tls.c:3445
tls_signature_hash_algorithm
static struct tls_signature_hash_algorithm * tls_signature_hash_algorithm(struct pubkey_algorithm *pubkey, struct digest_algorithm *digest)
Find TLS signature and hash algorithm.
Definition tls.c:1356
tls_plainstream_ops
static struct interface_operation tls_plainstream_ops[]
TLS plaintext stream interface operations.
Definition tls.c:3915
tls_clear_binding
static void tls_clear_binding(struct tls_connection *tls)
Clear key schedule binding.
Definition tls.c:505
tls_parse_chain
static int tls_parse_chain(struct tls_connection *tls, const void *data, size_t len)
Parse certificate chain.
Definition tls.c:2798
tls_regenerate_ephemeral_master
static void tls_regenerate_ephemeral_master(struct tls_connection *tls)
Regenerate ephemeral master secret.
Definition tls.c:488
tls_new_certificate
static int tls_new_certificate(struct tls_connection *tls, const void *data, size_t len)
Receive new Certificate handshake record.
Definition tls.c:2899
tls_new_server_hello_done
static int tls_new_server_hello_done(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Hello Done handshake record.
Definition tls.c:3020
tls_verify_handshake
static void tls_verify_handshake(struct tls_connection *tls, void *out)
Calculate handshake verification hash.
Definition tls.c:1174
ENOMEM_CONTEXT
#define ENOMEM_CONTEXT
Definition tls.c:123
tls_add_handshake
static int tls_add_handshake(struct tls_connection *tls, const void *data, size_t len)
Add handshake record to verification hash.
Definition tls.c:1157
tls_generate_keys
static int tls_generate_keys(struct tls_connection *tls)
Generate key material.
Definition tls.c:978
tls_new_record
static int tls_new_record(struct tls_connection *tls, unsigned int type, struct list_head *rx_data)
Receive new record.
Definition tls.c:3279
tls_uint24
static unsigned long tls_uint24(const tls24_t *field24)
Extract 24-bit field value.
Definition tls.c:251
tls_clear_cipher
static void tls_clear_cipher(struct tls_connection *tls, struct tls_cipherspec *cipherspec)
tls_set_kdf_master
static void tls_set_kdf_master(struct tls_connection *tls, const void *secret, size_t secret_len)
Set key derivation function master secret.
Definition tls.c:757
tls_new_server_key_exchange
static int tls_new_server_key_exchange(struct tls_connection *tls, const void *data, size_t len)
Receive new Server Key Exchange handshake record.
Definition tls.c:2939
tls_send_client_key_exchange_ecdhe
static int tls_send_client_key_exchange_ecdhe(struct tls_connection *tls)
Transmit Client Key Exchange record using ECDHE key exchange.
Definition tls.c:1867
ENOENT_CERT
#define ENOENT_CERT
Definition tls.c:119
tls_new_alert
static int tls_new_alert(struct tls_connection *tls, struct io_buffer *iobuf)
Receive new Alert record.
Definition tls.c:2463
tls_tx_resume_all
static void tls_tx_resume_all(struct tls_session *session)
Resume TX state machine for all connections within a session.
Definition tls.c:1925
tls_find_signature_hash
static struct tls_signature_hash_algorithm * tls_find_signature_hash(unsigned int code)
Find TLS signature and hash algorithm.
Definition tls.c:1378
add_tls
int add_tls(struct interface *xfer, const char *name, struct x509_root *root, struct private_key *key)
Add TLS on an interface.
Definition tls.c:4403
tls.h
Transport Layer Security Protocol.
TLS_SERVER_HELLO
#define TLS_SERVER_HELLO
Definition tls.h:69
TLS_SERVER_KEY_EXCHANGE
#define TLS_SERVER_KEY_EXCHANGE
Definition tls.h:72
TLS_TYPE_ALERT
#define TLS_TYPE_ALERT
Alert content type.
Definition tls.h:58
TLS_TX_BUFSIZE
#define TLS_TX_BUFSIZE
TX maximum fragment length.
Definition tls.h:577
tls_ephemeral_algorithm
#define tls_ephemeral_algorithm
HKDF algorithm for ephemeral secrets.
Definition tls.h:367
TLS_NEW_SESSION_TICKET
#define TLS_NEW_SESSION_TICKET
Definition tls.h:70
TLS_CLIENT_KEY_EXCHANGE
#define TLS_CLIENT_KEY_EXCHANGE
Definition tls.h:76
TLS_VERSION_TLS_1_2
#define TLS_VERSION_TLS_1_2
TLS version 1.2.
Definition tls.h:49
TLS_NUM_NAMED_GROUPS
#define TLS_NUM_NAMED_GROUPS
Number of non-anonymous TLS named groups.
Definition tls.h:273
TLS_CHANGE_CIPHER_SPEC
#define TLS_CHANGE_CIPHER_SPEC
Change cipher spec magic byte.
Definition tls.h:55
TLS_CIPHER_SUITES
#define TLS_CIPHER_SUITES
TLS cipher suite table.
Definition tls.h:243
TLS_EXTENDED_MASTER_SECRET
#define TLS_EXTENDED_MASTER_SECRET
Definition tls.h:155
TLS_RENEGOTIATION_INFO
#define TLS_RENEGOTIATION_INFO
Definition tls.h:161
TLS_RX_MIN_BUFSIZE
#define TLS_RX_MIN_BUFSIZE
Minimum RX I/O buffer size.
Definition tls.h:595
TLS_MAX_FRAGMENT_LENGTH_VALUE
#define TLS_MAX_FRAGMENT_LENGTH_VALUE
Advertised maximum fragment length.
Definition tls.h:569
TLS_FINISHED
#define TLS_FINISHED
Definition tls.h:77
TLS_CERTIFICATE_VERIFY
#define TLS_CERTIFICATE_VERIFY
Definition tls.h:75
TLS_ALERT_FATAL
#define TLS_ALERT_FATAL
Definition tls.h:81
TLS_ALERT_CLOSE_NOTIFY
#define TLS_ALERT_CLOSE_NOTIFY
Definition tls.h:84
TLS_HELLO_REQUEST
#define TLS_HELLO_REQUEST
Definition tls.h:67
TLS_RX_ALIGN
#define TLS_RX_ALIGN
RX I/O buffer alignment.
Definition tls.h:598
TLS_CLIENT_HELLO
#define TLS_CLIENT_HELLO
Definition tls.h:68
TLS_TYPE_HANDSHAKE
#define TLS_TYPE_HANDSHAKE
Handshake content type.
Definition tls.h:61
TLS_SERVER_NAME
#define TLS_SERVER_NAME
Definition tls.h:132
TLS_RX_HEADER
@ TLS_RX_HEADER
Definition tls.h:181
TLS_RX_DATA
@ TLS_RX_DATA
Definition tls.h:182
TLS_TYPE_DATA
#define TLS_TYPE_DATA
Application data content type.
Definition tls.h:64
TLS_ALERT_WARNING
#define TLS_ALERT_WARNING
Definition tls.h:80
TLS_CERTIFICATE_REQUEST
#define TLS_CERTIFICATE_REQUEST
Definition tls.h:73
TLS_TX_FINISHED
@ TLS_TX_FINISHED
Definition tls.h:192
TLS_TX_CLIENT_KEY_EXCHANGE
@ TLS_TX_CLIENT_KEY_EXCHANGE
Definition tls.h:189
TLS_TX_CLIENT_HELLO
@ TLS_TX_CLIENT_HELLO
Definition tls.h:187
TLS_TX_CHANGE_CIPHER
@ TLS_TX_CHANGE_CIPHER
Definition tls.h:191
TLS_TX_CERTIFICATE_VERIFY
@ TLS_TX_CERTIFICATE_VERIFY
Definition tls.h:190
TLS_TX_CERTIFICATE
@ TLS_TX_CERTIFICATE
Definition tls.h:188
TLS_CERTIFICATE
#define TLS_CERTIFICATE
Definition tls.h:71
TLS_TYPE_CHANGE_CIPHER
#define TLS_TYPE_CHANGE_CIPHER
Change cipher content type.
Definition tls.h:52
TLS_SERVER_NAME_HOST_NAME
#define TLS_SERVER_NAME_HOST_NAME
Definition tls.h:133
TLS_SIG_HASH_ALGORITHMS
#define TLS_SIG_HASH_ALGORITHMS
TLS signature hash algorithm table.
Definition tls.h:317
TLS_SERVER_HELLO_DONE
#define TLS_SERVER_HELLO_DONE
Definition tls.h:74
TLS_MAX_FRAGMENT_LENGTH
#define TLS_MAX_FRAGMENT_LENGTH
Definition tls.h:136
TLS_RX_BUFSIZE
#define TLS_RX_BUFSIZE
RX I/O buffer size.
Definition tls.h:587
TLS_NAMED_GROUP
#define TLS_NAMED_GROUP
Definition tls.h:143
TLS_NAMED_CURVE_TYPE
#define TLS_NAMED_CURVE_TYPE
TLS named curve type.
Definition tls.h:251
TLS_SESSION_TICKET
#define TLS_SESSION_TICKET
Definition tls.h:158
TLS_NAMED_GROUPS
#define TLS_NAMED_GROUPS
TLS named group table.
Definition tls.h:262
TLS_SIGNATURE_ALGORITHMS
#define TLS_SIGNATURE_ALGORITHMS
Definition tls.h:152
data_len
uint32_t data_len
Microcode data size (or 0 to indicate 2000 bytes).
Definition ucode.h:15
create_validator
int create_validator(struct interface *job, struct x509_chain *chain, struct x509_root *root)
Instantiate a certificate validator.
Definition validator.c:760
validator.h
Certificate validator.
lifetime
u32 lifetime
For Lifetime-type KDEs, the lifetime in seconds.
Definition wpa.h:27
iv
u8 iv[16]
Initialization vector.
Definition wpa.h:33
tx
u8 tx[WPA_TKIP_MIC_KEY_LEN]
MIC key for packets to the AP.
Definition wpa.h:4
x509_auto_append
int x509_auto_append(struct x509_chain *chain, struct x509_chain *store)
Append X.509 certificates to X.509 certificate chain.
Definition x509.c:1868
x509_is_valid
int x509_is_valid(struct x509_certificate *cert, struct x509_root *root)
Check if X.509 certificate is valid.
Definition x509.c:1313
x509_check_name
int x509_check_name(struct x509_certificate *cert, const char *name)
Check X.509 certificate name.
Definition x509.c:1564
x509_alloc_chain
struct x509_chain * x509_alloc_chain(void)
Allocate X.509 certificate chain.
Definition x509.c:1615
x509_name
const char * x509_name(struct x509_certificate *cert)
Get X.509 certificate display name.
Definition x509.c:147
x509_find_key
struct x509_certificate * x509_find_key(struct x509_chain *store, struct private_key *key)
Identify X.509 certificate by corresponding public key.
Definition x509.c:1835
x509_append_raw
int x509_append_raw(struct x509_chain *chain, const void *data, size_t len)
Append X.509 certificate to X.509 certificate chain.
Definition x509.c:1674
x509_append
int x509_append(struct x509_chain *chain, struct x509_certificate *cert)
Append X.509 certificate to X.509 certificate chain.
Definition x509.c:1638
x509.h
X.509 certificates.
x509_first
static struct x509_certificate * x509_first(struct x509_chain *chain)
Get first certificate in X.509 certificate chain.
Definition x509.h:311
x509_root_get
static struct x509_root * x509_root_get(struct x509_root *root)
Get reference to X.509 root certificate list.
Definition x509.h:393
x509_get
static struct x509_certificate * x509_get(struct x509_certificate *cert)
Get reference to X.509 certificate.
Definition x509.h:267
x509_put
static void x509_put(struct x509_certificate *cert)
Drop reference to X.509 certificate.
Definition x509.h:278
x509_last
static struct x509_certificate * x509_last(struct x509_chain *chain)
Get last certificate in X.509 certificate chain.
Definition x509.h:325
x509_root_put
static void x509_root_put(struct x509_root *root)
Drop reference to X.509 root certificate list.
Definition x509.h:404
x509_chain_put
static void x509_chain_put(struct x509_chain *chain)
Drop reference to X.509 certificate chain.
Definition x509.h:300
xfer_window
size_t xfer_window(struct interface *intf)
Check flow control window.
Definition xfer.c:117
xfer_deliver
int xfer_deliver(struct interface *intf, struct io_buffer *iobuf, struct xfer_metadata *meta)
Deliver datagram.
Definition xfer.c:195
xfer_alloc_iob
struct io_buffer * xfer_alloc_iob(struct interface *intf, size_t len)
Allocate I/O buffer.
Definition xfer.c:159
xfer_window_changed
void xfer_window_changed(struct interface *intf)
Report change of flow control window.
Definition xfer.c:147
xfer_deliver_iob
int xfer_deliver_iob(struct interface *intf, struct io_buffer *iobuf)
Deliver datagram as I/O buffer without metadata.
Definition xfer.c:256
xfer.h
Data transfer interfaces.
Generated by doxygen 1.16.1