tls: add support for 8 more cipher ids - all tested to work

function                                             old     new   delta
tls_handshake                                       2059    2116     +57
static.ciphers                                         -      30     +30
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 1/0 up/down: 87/0)               Total: 87 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

1 files changed, 117 insertions, 87 deletions

diff --git a/networking/tls.c b/networking/tls.c
index 66d62fe3d..e76a78585 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -19,6 +19,10 @@
 
 #include "tls.h"
 
+// works against "openssl s_server -cipher NULL"
+// and against wolfssl-3.9.10-stable/examples/server/server.c:
+#define ALLOW_RSA_NULL_SHA256  0  // for testing (does everything except encrypting)
+
 //Tested against kernel.org:
 //#define CIPHER_ID TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA // ok, recvs SERVER_KEY_EXCHANGE *** matrixssl uses this on my box
 //#define CIPHER_ID TLS_RSA_WITH_AES_256_CBC_SHA256 // ok, no SERVER_KEY_EXCHANGE
@@ -35,10 +39,6 @@
 //#define CIPHER_ID TLS_RSA_WITH_AES_256_GCM_SHA384 // ok, no SERVER_KEY_EXCHANGE
 //#define CIPHER_ID TLS_RSA_WITH_AES_128_GCM_SHA256 // ok, no SERVER_KEY_EXCHANGE
 
-// works against "openssl s_server -cipher NULL"
-// and against wolfssl-3.9.10-stable/examples/server/server.c:
-//#define CIPHER_ID1 TLS_RSA_WITH_NULL_SHA256 // for testing (does everything except encrypting)
-
 // works against wolfssl-3.9.10-stable/examples/server/server.c
 // works for kernel.org
 // does not work for cdn.kernel.org (e.g. downloading an actual tarball, not a web page)
@@ -50,41 +50,15 @@
 //  ok:   openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-GCM-SHA256
 //  ok:   openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-SHA
 //        (TLS_RSA_WITH_AES_128_CBC_SHA - in TLS 1.2 it's mandated to be always supported)
-#define CIPHER_ID1  TLS_RSA_WITH_AES_256_CBC_SHA256 //0x003D
+//#define CIPHER_ID1  TLS_RSA_WITH_AES_256_CBC_SHA256 //0x003D
 // Works with "wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.9.5.tar.xz"
-#define CIPHER_ID2  TLS_RSA_WITH_AES_128_CBC_SHA    //0x002F
+//#define CIPHER_ID2  TLS_RSA_WITH_AES_128_CBC_SHA    //0x002F
 
 // bug #11456:
 // ftp.openbsd.org only supports ECDHE-RSA-AESnnn-GCM-SHAnnn or ECDHE-RSA-CHACHA20-POLY1305
-#define CIPHER_ID3  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 //0xC02F
+//#define CIPHER_ID3  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 //0xC02F
 // host is.gd accepts only ECDHE-ECDSA-foo (the simplest which works: ECDHE-ECDSA-AES128-SHA 0xC009)
-#define CIPHER_ID4  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA  //0xC009
-
-#define NUM_CIPHERS 4
-//TODO: we can support all these:
-//  TLS_RSA_WITH_AES_128_CBC_SHA            0x002F
-//  TLS_RSA_WITH_AES_256_CBC_SHA            0x0035
-//  TLS_RSA_WITH_AES_128_CBC_SHA256         0x003C
-//  TLS_RSA_WITH_AES_256_CBC_SHA256         0x003D
-//  TLS_RSA_WITH_AES_128_GCM_SHA256         0x009C
-//  TLS_RSA_WITH_AES_256_GCM_SHA384         0x009D
-//  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA    0xC009
-//  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA    0xC00A
-//  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA      0xC013
-//  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA      0xC014
-//  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023
-////TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 - can't do SHA384 yet
-//  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   0xC027
-////TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384   0xC028 - can't do SHA384 yet
-//  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B
-//  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C
-//  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   0xC02F
-//  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   0xC030
-//possibly these too:
-//  TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA      0xC035
-//  TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA      0xC036
-//  TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256   0xC037
-////TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384   0xC038 - can't do SHA384 yet
+//#define CIPHER_ID4  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA  //0xC009
 
 
 #define TLS_DEBUG      0
@@ -291,7 +265,7 @@ enum {
         GOT_CERT_RSA_KEY_ALG   = 1 << 1,
         GOT_CERT_ECDSA_KEY_ALG = 1 << 2, // so far unused
         GOT_EC_KEY             = 1 << 3,
-        ENCRYPTION_AESGCM      = 1 << 4, // else AES-SHA (or NULL-SHA if CIPHER_ID1 set to allow one)
+        ENCRYPTION_AESGCM      = 1 << 4, // else AES-SHA (or NULL-SHA if ALLOW_RSA_NULL_SHA256=1)
         ENCRYPT_ON_WRITE       = 1 << 5,
 };
 
@@ -676,7 +650,7 @@ static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, un
         uint8_t padding_length;
 
         xhdr = (void*)(buf - RECHDR_LEN);
-        if (CIPHER_ID1 != TLS_RSA_WITH_NULL_SHA256 /* if "no encryption" can't be selected */
+        if (!ALLOW_RSA_NULL_SHA256 /* if "no encryption" can't be selected */
          || tls->cipher_id != TLS_RSA_WITH_NULL_SHA256 /* or if it wasn't selected */
         ) {
                 xhdr = (void*)(buf - RECHDR_LEN - AES_BLOCK_SIZE); /* place for IV */
@@ -734,7 +708,7 @@ static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, un
         // --------  -----------  ----------  --------------
         // SHA       HMAC-SHA1       20            20
         // SHA256    HMAC-SHA256     32            32
-        if (CIPHER_ID1 == TLS_RSA_WITH_NULL_SHA256
+        if (ALLOW_RSA_NULL_SHA256
          && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256
         ) {
                 /* No encryption, only signing */
@@ -1478,6 +1452,39 @@ static ALWAYS_INLINE void fill_handshake_record_hdr(void *buf, unsigned type, un
 
 static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
 {
+#define NUM_CIPHERS (12 + ALLOW_RSA_NULL_SHA256)
+        static const uint8_t ciphers[] = {
+                0x00,(1 + NUM_CIPHERS) * 2, //len16_be
+                0x00,0xFF, //not a cipher - TLS_EMPTY_RENEGOTIATION_INFO_SCSV
+                /* ^^^^^^ RFC 5746 Renegotiation Indication Extension - some servers will refuse to work with us otherwise */
+                0xC0,0x09, // 1 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - ok: wget https://is.gd/
+                0xC0,0x0A, // 2 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - ok: wget https://is.gd/
+                0xC0,0x13, // 3 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA
+        //      0xC0,0x14, //   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - openssl s_server ... -cipher ECDHE-RSA-AES256-SHA: "No ciphers enabled for max supported SSL/TLS version"
+                0xC0,0x23, // 4 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - ok: wget https://is.gd/
+        //      0xC0,0x24, //   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0xC0,0x27, // 5 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA256
+        //      0xC0,0x28, //   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0xC0,0x2B, // 6 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ok: wget https://is.gd/
+        //      0xC0,0x2C, //   TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - wget https://is.gd/: "TLS error from peer (alert code 20): bad MAC"
+                0xC0,0x2F, // 7 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-GCM-SHA256
+        //      0xC0,0x30, //   TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher ECDHE-RSA-AES256-GCM-SHA384: "decryption failed or bad record mac"
+        //possibly these too:
+        //      0xC0,0x35, //   TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+        //      0xC0,0x36, //   TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+        //      0xC0,0x37, //   TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+        //      0xC0,0x38, //   TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0x00,0x2F, // 8 TLS_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher AES128-SHA
+                0x00,0x35, // 9 TLS_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher AES256-SHA
+                0x00,0x3C, //10 TLS_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher AES128-SHA256
+                0x00,0x3D, //11 TLS_RSA_WITH_AES_256_CBC_SHA256 - ok: openssl s_server ... -cipher AES256-SHA256
+                0x00,0x9C, //12 TLS_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher AES128-GCM-SHA256
+        //      0x00,0x9D, //   TLS_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher AES256-GCM-SHA384: "decryption failed or bad record mac"
+#if ALLOW_RSA_NULL_SHA256
+                0x00,0x3B, //   TLS_RSA_WITH_NULL_SHA256
+#endif
+                0x01,0x00, //not a cipher - comprtypes_len, comprtype
+        };
         static const uint8_t supported_groups[] = {
                 0x00,0x0a, //extension_type: "supported_groups"
                 0x00,0x04, //ext len
@@ -1502,7 +1509,7 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
                 uint8_t session_id_len;
                 /* uint8_t session_id[]; */
                 uint8_t cipherid_len16_hi, cipherid_len16_lo;
-                uint8_t cipherid[2 * (1 + NUM_CIPHERS)]; /* actually variable */
+                uint8_t cipherid[(1 + NUM_CIPHERS) * 2]; /* actually variable */
                 uint8_t comprtypes_len;
                 uint8_t comprtypes[1]; /* actually variable */
                 /* Extensions (SNI shown):
@@ -1550,28 +1557,8 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
                 memset(record->rand32, 0x11, sizeof(record->rand32));
         /* record->session_id_len = 0; - already is */
 
-        /* record->cipherid_len16_hi = 0; */
-        record->cipherid_len16_lo = sizeof(record->cipherid);
-        /* RFC 5746 Renegotiation Indication Extension - some servers will refuse to work with us otherwise */
-        /*record->cipherid[0] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV >> 8; - zero */
-        record->cipherid[1] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV & 0xff;
-        if ((CIPHER_ID1 >> 8) != 0) record->cipherid[2] = CIPHER_ID1 >> 8;
-        /*************************/ record->cipherid[3] = CIPHER_ID1 & 0xff;
-#if CIPHER_ID2
-        if ((CIPHER_ID2 >> 8) != 0) record->cipherid[4] = CIPHER_ID2 >> 8;
-        /*************************/ record->cipherid[5] = CIPHER_ID2 & 0xff;
-#endif
-#if CIPHER_ID3
-        if ((CIPHER_ID3 >> 8) != 0) record->cipherid[6] = CIPHER_ID3 >> 8;
-        /*************************/ record->cipherid[7] = CIPHER_ID3 & 0xff;
-#endif
-#if CIPHER_ID4
-        if ((CIPHER_ID4 >> 8) != 0) record->cipherid[8] = CIPHER_ID4 >> 8;
-        /*************************/ record->cipherid[9] = CIPHER_ID4 & 0xff;
-#endif
-
-        record->comprtypes_len = 1;
-        /* record->comprtypes[0] = 0; */
+        BUILD_BUG_ON(sizeof(ciphers) != 2 + (1 + NUM_CIPHERS) * 2 + 2);
+        memcpy(&record->cipherid_len16_hi, ciphers, sizeof(ciphers));
 
         ptr = (void*)(record + 1);
         *ptr++ = ext_len >> 8;
@@ -1626,6 +1613,7 @@ static void get_server_hello(tls_state_t *tls)
 
         struct server_hello *hp;
         uint8_t *cipherid;
+        uint8_t cipherid1;
         unsigned cipher;
         int len, len24;
 
@@ -1659,39 +1647,81 @@ static void get_server_hello(tls_state_t *tls)
                 len24 += 32; /* what len would be if session id would be present */
         }
 
-        if (len24 < 70
-//       || cipherid[0]  != (CIPHER_ID >> 8)
-//       || cipherid[1]  != (CIPHER_ID & 0xff)
-//       || cipherid[2]  != 0 /* comprtype */
-        ) {
+        if (len24 < 70)
                 bad_record_die(tls, "'server hello'", len);
-        }
         dbg("<< SERVER_HELLO\n");
 
         memcpy(tls->hsd->client_and_server_rand32 + 32, hp->rand32, sizeof(hp->rand32));
 
-        tls->cipher_id = cipher = 0x100 * cipherid[0] + cipherid[1];
+        /* Set up encryption params based on selected cipher */
+#if 0
+                0xC0,0x09, // 1 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - ok: wget https://is.gd/
+                0xC0,0x0A, // 2 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - ok: wget https://is.gd/
+                0xC0,0x13, // 3 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA
+        //      0xC0,0x14, //   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - openssl s_server ... -cipher ECDHE-RSA-AES256-SHA: "No ciphers enabled for max supported SSL/TLS version"
+                0xC0,0x23, // 4 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - ok: wget https://is.gd/
+        //      0xC0,0x24, //   TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0xC0,0x27, // 5 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA256
+        //      0xC0,0x28, //   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0xC0,0x2B, // 6 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ok: wget https://is.gd/
+        //      0xC0,0x2C, //   TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - wget https://is.gd/: "TLS error from peer (alert code 20): bad MAC"
+                0xC0,0x2F, // 7 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-GCM-SHA256
+        //      0xC0,0x30, //   TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher ECDHE-RSA-AES256-GCM-SHA384: "decryption failed or bad record mac"
+        //possibly these too:
+        //      0xC0,0x35, //   TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+        //      0xC0,0x36, //   TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+        //      0xC0,0x37, //   TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+        //      0xC0,0x38, //   TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
+                0x00,0x2F, // 8 TLS_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher AES128-SHA
+                0x00,0x35, // 9 TLS_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher AES256-SHA
+                0x00,0x3C, //10 TLS_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher AES128-SHA256
+                0x00,0x3D, //11 TLS_RSA_WITH_AES_256_CBC_SHA256 - ok: openssl s_server ... -cipher AES256-SHA256
+                0x00,0x9C, //12 TLS_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher AES128-GCM-SHA256
+        //      0x00,0x9D, //   TLS_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher AES256-GCM-SHA384: "decryption failed or bad record mac"
+                0x00,0x3B, //   TLS_RSA_WITH_NULL_SHA256
+#endif
+        cipherid1 = cipherid[1];
+        tls->cipher_id = cipher = 0x100 * cipherid[0] + cipherid1;
         dbg("server chose cipher %04x\n", cipher);
-
-        if (cipher == TLS_RSA_WITH_AES_128_CBC_SHA
-         || cipher == TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
-        ) {
-                if (cipher == TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA)
-                        tls->flags |= NEED_EC_KEY;
-                tls->key_size = AES128_KEYSIZE;
-                tls->MAC_size = SHA1_OUTSIZE;
-        }
-        else
-        if (cipher == TLS_RSA_WITH_AES_256_CBC_SHA256) {
-                tls->key_size = AES256_KEYSIZE;
-                tls->MAC_size = SHA256_OUTSIZE;
-        }
-        else { /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
-                tls->flags |= NEED_EC_KEY | ENCRYPTION_AESGCM;
-                tls->key_size = AES128_KEYSIZE;
-                /* tls->MAC_size = 0; */
-                tls->IV_size = 4;
+        tls->key_size = AES256_KEYSIZE;
+        tls->MAC_size = SHA256_OUTSIZE;
+        /*tls->IV_size = 0; - already is */
+        if (cipherid[0] == 0xC0) {
+                /* All C0xx are ECDHE */
+                tls->flags |= NEED_EC_KEY;
+                if (cipherid1 & 1) {
+                        /* Odd numbered C0xx use AES128 (even ones use AES256) */
+                        tls->key_size = AES128_KEYSIZE;
+                }
+                if (cipherid1 <= 0x14) {
+                        tls->MAC_size = SHA1_OUTSIZE;
+                } else
+                if (cipherid1 >= 0x2B && cipherid1 <= 0x30) {
+                        /* C02B,2C,2F,30 are AES-GCM */
+                        tls->flags |= ENCRYPTION_AESGCM;
+                        tls->MAC_size = 0;
+                        tls->IV_size = 4;
+                }
+        } else {
+                /* All 00xx are RSA */
+                if (cipherid1 == 0x2F
+                 || cipherid1 == 0x3C
+                 || cipherid1 == 0x9C
+                ) {
+                        tls->key_size = AES128_KEYSIZE;
+                }
+                if (cipherid1 <= 0x35) {
+                        tls->MAC_size = SHA1_OUTSIZE;
+                } else
+                if (cipherid1 == 0x9C || cipherid1 == 0x9D) {
+                        /* 009C,9D are AES-GCM */
+                        tls->flags |= ENCRYPTION_AESGCM;
+                        tls->MAC_size = 0;
+                        tls->IV_size = 4;
+                }
         }
+        dbg("key_size:%u MAC_size:%u IV_size:%u\n", tls->key_size, tls->MAC_size, tls->IV_size);
+
         /* Handshake hash eventually destined to FINISHED record
          * is sha256 regardless of cipher
          * (at least for all ciphers defined by RFC5246).
@@ -2171,7 +2201,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
                 bad_record_die(tls, "switch to encrypted traffic", len);
         dbg("<< CHANGE_CIPHER_SPEC\n");
 
-        if (CIPHER_ID1 == TLS_RSA_WITH_NULL_SHA256
+        if (ALLOW_RSA_NULL_SHA256
          && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256
         ) {
                 tls->min_encrypted_len_on_read = tls->MAC_size;