aboutsummaryrefslogtreecommitdiff
path: root/networking/tls.c
diff options
context:
space:
mode:
authorRon Yorston <rmy@pobox.com>2018-11-28 10:28:18 +0000
committerRon Yorston <rmy@pobox.com>2018-11-28 10:28:18 +0000
commit2a69a2200a141c1504b662eca64b802cdab71b12 (patch)
treeeab0cc01852db237a26052a83c8f582ed92b7cd9 /networking/tls.c
parent97ca1f4b955f486cd26461cb09185335483d2921 (diff)
parent572dfb8e78323b9837f7c5e3369ee233a440b8f2 (diff)
downloadbusybox-w32-2a69a2200a141c1504b662eca64b802cdab71b12.tar.gz
busybox-w32-2a69a2200a141c1504b662eca64b802cdab71b12.tar.bz2
busybox-w32-2a69a2200a141c1504b662eca64b802cdab71b12.zip
Merge branch 'busybox' into merge
Diffstat (limited to 'networking/tls.c')
-rw-r--r--networking/tls.c1116
1 files changed, 817 insertions, 299 deletions
diff --git a/networking/tls.c b/networking/tls.c
index fce1d0ea6..38eb79798 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -12,16 +12,18 @@
12//kbuild:lib-$(CONFIG_TLS) += tls_pstm_montgomery_reduce.o 12//kbuild:lib-$(CONFIG_TLS) += tls_pstm_montgomery_reduce.o
13//kbuild:lib-$(CONFIG_TLS) += tls_pstm_mul_comba.o 13//kbuild:lib-$(CONFIG_TLS) += tls_pstm_mul_comba.o
14//kbuild:lib-$(CONFIG_TLS) += tls_pstm_sqr_comba.o 14//kbuild:lib-$(CONFIG_TLS) += tls_pstm_sqr_comba.o
15//kbuild:lib-$(CONFIG_TLS) += tls_rsa.o
16//kbuild:lib-$(CONFIG_TLS) += tls_aes.o 15//kbuild:lib-$(CONFIG_TLS) += tls_aes.o
17////kbuild:lib-$(CONFIG_TLS) += tls_aes_gcm.o 16//kbuild:lib-$(CONFIG_TLS) += tls_aesgcm.o
17//kbuild:lib-$(CONFIG_TLS) += tls_rsa.o
18//kbuild:lib-$(CONFIG_TLS) += tls_fe.o
18 19
19#include "tls.h" 20#include "tls.h"
20 21
22// works against "openssl s_server -cipher NULL"
23// and against wolfssl-3.9.10-stable/examples/server/server.c:
24#define ALLOW_RSA_NULL_SHA256 0 // for testing (does everything except encrypting)
25
21//Tested against kernel.org: 26//Tested against kernel.org:
22//TLS 1.2
23#define TLS_MAJ 3
24#define TLS_MIN 3
25//#define CIPHER_ID TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA // ok, recvs SERVER_KEY_EXCHANGE *** matrixssl uses this on my box 27//#define CIPHER_ID TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA // ok, recvs SERVER_KEY_EXCHANGE *** matrixssl uses this on my box
26//#define CIPHER_ID TLS_RSA_WITH_AES_256_CBC_SHA256 // ok, no SERVER_KEY_EXCHANGE 28//#define CIPHER_ID TLS_RSA_WITH_AES_256_CBC_SHA256 // ok, no SERVER_KEY_EXCHANGE
27//#define CIPHER_ID TLS_DH_anon_WITH_AES_256_CBC_SHA // SSL_ALERT_HANDSHAKE_FAILURE 29//#define CIPHER_ID TLS_DH_anon_WITH_AES_256_CBC_SHA // SSL_ALERT_HANDSHAKE_FAILURE
@@ -35,26 +37,28 @@
35//#define CIPHER_ID TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 37//#define CIPHER_ID TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
36//#define CIPHER_ID TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 // SSL_ALERT_HANDSHAKE_FAILURE 38//#define CIPHER_ID TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 // SSL_ALERT_HANDSHAKE_FAILURE
37//#define CIPHER_ID TLS_RSA_WITH_AES_256_GCM_SHA384 // ok, no SERVER_KEY_EXCHANGE 39//#define CIPHER_ID TLS_RSA_WITH_AES_256_GCM_SHA384 // ok, no SERVER_KEY_EXCHANGE
38//#define CIPHER_ID TLS_RSA_WITH_AES_128_GCM_SHA256 // ok, no SERVER_KEY_EXCHANGE *** select this? 40//#define CIPHER_ID TLS_RSA_WITH_AES_128_GCM_SHA256 // ok, no SERVER_KEY_EXCHANGE
39
40// works against "openssl s_server -cipher NULL"
41// and against wolfssl-3.9.10-stable/examples/server/server.c:
42//#define CIPHER_ID1 TLS_RSA_WITH_NULL_SHA256 // for testing (does everything except encrypting)
43 41
44// works against wolfssl-3.9.10-stable/examples/server/server.c 42// works against wolfssl-3.9.10-stable/examples/server/server.c
45// works for kernel.org 43// works for kernel.org
46// does not work for cdn.kernel.org (e.g. downloading an actual tarball, not a web page) 44// does not work for cdn.kernel.org (e.g. downloading an actual tarball, not a web page)
47// getting alert 40 "handshake failure" at once 45// getting alert 40 "handshake failure" at once
48// with GNU Wget 1.18, they agree on TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F) cipher 46// with GNU Wget 1.18, they agree on TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F) cipher
49// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES256-SHA256 47// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -cipher AES256-SHA256
50// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES256-GCM-SHA384 48// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -cipher AES256-GCM-SHA384
51// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-SHA256 49// fail: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -cipher AES128-SHA256
52// ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-GCM-SHA256 50// ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -cipher AES128-GCM-SHA256
53// ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher AES128-SHA 51// ok: openssl s_client -connect cdn.kernel.org:443 -debug -tls1_2 -cipher AES128-SHA
54// (TLS_RSA_WITH_AES_128_CBC_SHA - in TLS 1.2 it's mandated to be always supported) 52// (TLS_RSA_WITH_AES_128_CBC_SHA - in TLS 1.2 it's mandated to be always supported)
55#define CIPHER_ID1 TLS_RSA_WITH_AES_256_CBC_SHA256 // no SERVER_KEY_EXCHANGE from peer 53//#define CIPHER_ID1 TLS_RSA_WITH_AES_256_CBC_SHA256 //0x003D
56// Works with "wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.9.5.tar.xz" 54// Works with "wget https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.9.5.tar.xz"
57#define CIPHER_ID2 TLS_RSA_WITH_AES_128_CBC_SHA 55//#define CIPHER_ID2 TLS_RSA_WITH_AES_128_CBC_SHA //0x002F
56
57// bug #11456:
58// ftp.openbsd.org only supports ECDHE-RSA-AESnnn-GCM-SHAnnn or ECDHE-RSA-CHACHA20-POLY1305
59//#define CIPHER_ID3 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 //0xC02F
60// host is.gd accepts only ECDHE-ECDSA-foo (the simplest which works: ECDHE-ECDSA-AES128-SHA 0xC009)
61//#define CIPHER_ID4 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA //0xC009
58 62
59 63
60#define TLS_DEBUG 0 64#define TLS_DEBUG 0
@@ -84,6 +88,11 @@
84# define dbg_der(...) ((void)0) 88# define dbg_der(...) ((void)0)
85#endif 89#endif
86 90
91
92//TLS 1.2
93#define TLS_MAJ 3
94#define TLS_MIN 3
95
87#define RECORD_TYPE_CHANGE_CIPHER_SPEC 20 /* 0x14 */ 96#define RECORD_TYPE_CHANGE_CIPHER_SPEC 20 /* 0x14 */
88#define RECORD_TYPE_ALERT 21 /* 0x15 */ 97#define RECORD_TYPE_ALERT 21 /* 0x15 */
89#define RECORD_TYPE_HANDSHAKE 22 /* 0x16 */ 98#define RECORD_TYPE_HANDSHAKE 22 /* 0x16 */
@@ -102,66 +111,98 @@
102#define HANDSHAKE_CLIENT_KEY_EXCHANGE 16 /* 0x10 */ 111#define HANDSHAKE_CLIENT_KEY_EXCHANGE 16 /* 0x10 */
103#define HANDSHAKE_FINISHED 20 /* 0x14 */ 112#define HANDSHAKE_FINISHED 20 /* 0x14 */
104 113
114#define TLS_EMPTY_RENEGOTIATION_INFO_SCSV 0x00FF /* not a real cipher id... */
115
105#define SSL_NULL_WITH_NULL_NULL 0x0000 116#define SSL_NULL_WITH_NULL_NULL 0x0000
106#define SSL_RSA_WITH_NULL_MD5 0x0001 117#define SSL_RSA_WITH_NULL_MD5 0x0001
107#define SSL_RSA_WITH_NULL_SHA 0x0002 118#define SSL_RSA_WITH_NULL_SHA 0x0002
108#define SSL_RSA_WITH_RC4_128_MD5 0x0004 119#define SSL_RSA_WITH_RC4_128_MD5 0x0004
109#define SSL_RSA_WITH_RC4_128_SHA 0x0005 120#define SSL_RSA_WITH_RC4_128_SHA 0x0005
121#define TLS_RSA_WITH_IDEA_CBC_SHA 0x0007 /* 7 */
110#define SSL_RSA_WITH_3DES_EDE_CBC_SHA 0x000A /* 10 */ 122#define SSL_RSA_WITH_3DES_EDE_CBC_SHA 0x000A /* 10 */
111#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F /* 47 */
112#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 /* 53 */
113#define TLS_RSA_WITH_NULL_SHA256 0x003B /* 59 */
114
115#define TLS_EMPTY_RENEGOTIATION_INFO_SCSV 0x00FF
116 123
117#define TLS_RSA_WITH_IDEA_CBC_SHA 0x0007 /* 7 */
118#define SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 /* 22 */ 124#define SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 0x0016 /* 22 */
119#define SSL_DH_anon_WITH_RC4_128_MD5 0x0018 /* 24 */ 125#define SSL_DH_anon_WITH_RC4_128_MD5 0x0018 /* 24 */
120#define SSL_DH_anon_WITH_3DES_EDE_CBC_SHA 0x001B /* 27 */ 126#define SSL_DH_anon_WITH_3DES_EDE_CBC_SHA 0x001B /* 27 */
127#define TLS_RSA_WITH_AES_128_CBC_SHA 0x002F /*SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 */
121#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 /* 51 */ 128#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA 0x0033 /* 51 */
122#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 /* 57 */
123#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x0067 /* 103 */
124#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x006B /* 107 */
125#define TLS_DH_anon_WITH_AES_128_CBC_SHA 0x0034 /* 52 */ 129#define TLS_DH_anon_WITH_AES_128_CBC_SHA 0x0034 /* 52 */
130#define TLS_RSA_WITH_AES_256_CBC_SHA 0x0035 /* 53 */
131#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA 0x0039 /* 57 */
126#define TLS_DH_anon_WITH_AES_256_CBC_SHA 0x003A /* 58 */ 132#define TLS_DH_anon_WITH_AES_256_CBC_SHA 0x003A /* 58 */
133#define TLS_RSA_WITH_NULL_SHA256 0x003B /* 59 */
127#define TLS_RSA_WITH_AES_128_CBC_SHA256 0x003C /* 60 */ 134#define TLS_RSA_WITH_AES_128_CBC_SHA256 0x003C /* 60 */
128#define TLS_RSA_WITH_AES_256_CBC_SHA256 0x003D /* 61 */ 135#define TLS_RSA_WITH_AES_256_CBC_SHA256 0x003D /* 61 */
129#define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 /* 150 */ 136#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x0067 /* 103 */
137#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x006B /* 107 */
130#define TLS_PSK_WITH_AES_128_CBC_SHA 0x008C /* 140 */ 138#define TLS_PSK_WITH_AES_128_CBC_SHA 0x008C /* 140 */
131#define TLS_PSK_WITH_AES_128_CBC_SHA256 0x00AE /* 174 */
132#define TLS_PSK_WITH_AES_256_CBC_SHA384 0x00AF /* 175 */
133#define TLS_PSK_WITH_AES_256_CBC_SHA 0x008D /* 141 */ 139#define TLS_PSK_WITH_AES_256_CBC_SHA 0x008D /* 141 */
134#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x0090 /* 144 */ 140#define TLS_DHE_PSK_WITH_AES_128_CBC_SHA 0x0090 /* 144 */
135#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x0091 /* 145 */ 141#define TLS_DHE_PSK_WITH_AES_256_CBC_SHA 0x0091 /* 145 */
142#define TLS_RSA_WITH_SEED_CBC_SHA 0x0096 /* 150 */
143#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD */
144#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D /*TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD */
145#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 0x009E /*TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD */
146#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 0x009F /*TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD */
147#define TLS_DH_anon_WITH_AES_128_GCM_SHA256 0x00A6 /* RFC 5288 */
148#define TLS_DH_anon_WITH_AES_256_GCM_SHA384 0x00A7 /* RFC 5288 */
149#define TLS_PSK_WITH_AES_128_CBC_SHA256 0x00AE /* 174 */
150#define TLS_PSK_WITH_AES_256_CBC_SHA384 0x00AF /* 175 */
136#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /* 49156 */ 151#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /* 49156 */
137#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /* 49157 */ 152#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /* 49157 */
138#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /* 49161 */ 153#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /*TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 */
139#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /* 49162 */ 154#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /*TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 */
140#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /* 49170 */
141#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /* 49171 */
142#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /* 49172 */
143#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /* 49166 */ 155#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /* 49166 */
144#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /* 49167 */ 156#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /* 49167 */
145#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /* 49187 */ 157#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /* 49170 */
146#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /* 49188 */ 158#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /*TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 */
159#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /*TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 */
160#define TLS_ECDH_anon_WITH_AES_128_CBC_SHA 0xC018 /* RFC 4492 */
161#define TLS_ECDH_anon_WITH_AES_256_CBC_SHA 0xC019 /* RFC 4492 */
162#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 */
163#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 */
147#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /* 49189 */ 164#define TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 0xC025 /* 49189 */
148#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /* 49190 */ 165#define TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 0xC026 /* 49190 */
149#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /* 49191 */ 166#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0xC027 /*TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 */
150#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /* 49192 */ 167#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 0xC028 /*TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 */
151#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /* 49193 */ 168#define TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 0xC029 /* 49193 */
152#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /* 49194 */ 169#define TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 0xC02A /* 49194 */
153
154/* RFC 5288 "AES Galois Counter Mode (GCM) Cipher Suites for TLS" */ 170/* RFC 5288 "AES Galois Counter Mode (GCM) Cipher Suites for TLS" */
155#define TLS_RSA_WITH_AES_128_GCM_SHA256 0x009C /* 156 */ 171#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD */
156#define TLS_RSA_WITH_AES_256_GCM_SHA384 0x009D /* 157 */ 172#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD */
157#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xC02B /* 49195 */
158#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xC02C /* 49196 */
159#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /* 49197 */ 173#define TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 0xC02D /* 49197 */
160#define TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /* 49198 */ 174#define TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 0xC02E /* 49198 */
161#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /* 49199 */ 175#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0xC02F /*TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD */
162#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /* 49200 */ 176#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0xC030 /*TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD */
163#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /* 49201 */ 177#define TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /* 49201 */
164#define TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /* 49202 */ 178#define TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /* 49202 */
179#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035
180#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036
181#define TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037
182#define TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038
183
184/* From http://wiki.mozilla.org/Security/Server_Side_TLS */
185/* and 'openssl ciphers -V -stdname' */
186#define TLS_RSA_WITH_AES_128_CCM 0xC09C /*TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(128) Mac=AEAD */
187#define TLS_RSA_WITH_AES_256_CCM 0xC09D /*TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(256) Mac=AEAD */
188#define TLS_DHE_RSA_WITH_AES_128_CCM 0xC09E /*TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(128) Mac=AEAD */
189#define TLS_DHE_RSA_WITH_AES_256_CCM 0xC09F /*TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(256) Mac=AEAD */
190#define TLS_RSA_WITH_AES_128_CCM_8 0xC0A0 /*TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(128) Mac=AEAD */
191#define TLS_RSA_WITH_AES_256_CCM_8 0xC0A1 /*TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(256) Mac=AEAD */
192#define TLS_DHE_RSA_WITH_AES_128_CCM_8 0xC0A2 /*TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(128) Mac=AEAD */
193#define TLS_DHE_RSA_WITH_AES_256_CCM_8 0xC0A3 /*TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(256) Mac=AEAD */
194#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM 0xC0AC /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(128) Mac=AEAD */
195#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM 0xC0AD /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(256) Mac=AEAD */
196#define TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 0xC0AE /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(128) Mac=AEAD */
197#define TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 0xC0AF /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(256) Mac=AEAD */
198#define TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /*TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD */
199#define TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /*TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD */
200#define TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /*TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD */
201
202#define TLS_AES_128_GCM_SHA256 0x1301 /*TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD */
203#define TLS_AES_256_GCM_SHA384 0x1302 /*TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD */
204#define TLS_CHACHA20_POLY1305_SHA256 0x1303 /*TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD */
205#define TLS_AES_128_CCM_SHA256 0x1304 /*TLSv1.3 Kx=any Au=any Enc=AESCCM(128) Mac=AEAD */
165 206
166/* Might go to libbb.h */ 207/* Might go to libbb.h */
167#define TLS_MAX_CRYPTBLOCK_SIZE 16 208#define TLS_MAX_CRYPTBLOCK_SIZE 16
@@ -172,7 +213,6 @@ enum {
172 SHA1_OUTSIZE = 20, 213 SHA1_OUTSIZE = 20,
173 SHA256_OUTSIZE = 32, 214 SHA256_OUTSIZE = 32,
174 215
175 AES_BLOCKSIZE = 16,
176 AES128_KEYSIZE = 16, 216 AES128_KEYSIZE = 16,
177 AES256_KEYSIZE = 32, 217 AES256_KEYSIZE = 32,
178 218
@@ -181,10 +221,10 @@ enum {
181 RECHDR_LEN = 5, 221 RECHDR_LEN = 5,
182 222
183 /* 8 = 3+5. 3 extra bytes result in record data being 32-bit aligned */ 223 /* 8 = 3+5. 3 extra bytes result in record data being 32-bit aligned */
184 OUTBUF_PFX = 8 + AES_BLOCKSIZE, /* header + IV */ 224 OUTBUF_PFX = 8 + AES_BLOCK_SIZE, /* header + IV */
185 OUTBUF_SFX = TLS_MAX_MAC_SIZE + TLS_MAX_CRYPTBLOCK_SIZE, /* MAC + padding */ 225 OUTBUF_SFX = TLS_MAX_MAC_SIZE + TLS_MAX_CRYPTBLOCK_SIZE, /* MAC + padding */
186 226
187 // RFC 5246 227 // RFC 5246:
188 // | 6.2.1. Fragmentation 228 // | 6.2.1. Fragmentation
189 // | The record layer fragments information blocks into TLSPlaintext 229 // | The record layer fragments information blocks into TLSPlaintext
190 // | records carrying data in chunks of 2^14 bytes or less. Client 230 // | records carrying data in chunks of 2^14 bytes or less. Client
@@ -219,6 +259,14 @@ enum {
219 // | The length (in bytes) of the following TLSCiphertext.fragment. 259 // | The length (in bytes) of the following TLSCiphertext.fragment.
220 // | The length MUST NOT exceed 2^14 + 2048. 260 // | The length MUST NOT exceed 2^14 + 2048.
221 MAX_INBUF = RECHDR_LEN + (1 << 14) + 2048, 261 MAX_INBUF = RECHDR_LEN + (1 << 14) + 2048,
262
263 /* Bits for tls->flags */
264 NEED_EC_KEY = 1 << 0,
265 GOT_CERT_RSA_KEY_ALG = 1 << 1,
266 GOT_CERT_ECDSA_KEY_ALG = 1 << 2, // so far unused
267 GOT_EC_KEY = 1 << 3,
268 ENCRYPTION_AESGCM = 1 << 4, // else AES-SHA (or NULL-SHA if ALLOW_RSA_NULL_SHA256=1)
269 ENCRYPT_ON_WRITE = 1 << 5,
222}; 270};
223 271
224struct record_hdr { 272struct record_hdr {
@@ -233,12 +281,15 @@ struct tls_handshake_data {
233 281
234 uint8_t client_and_server_rand32[2 * 32]; 282 uint8_t client_and_server_rand32[2 * 32];
235 uint8_t master_secret[48]; 283 uint8_t master_secret[48];
284
236//TODO: store just the DER key here, parse/use/delete it when sending client key 285//TODO: store just the DER key here, parse/use/delete it when sending client key
237//this way it will stay key type agnostic here. 286//this way it will stay key type agnostic here.
238 psRsaKey_t server_rsa_pub_key; 287 psRsaKey_t server_rsa_pub_key;
288 uint8_t ecc_pub_key32[32];
239 289
240 unsigned saved_client_hello_size; 290/* HANDSHAKE HASH: */
241 uint8_t saved_client_hello[1]; 291 //unsigned saved_client_hello_size;
292 //uint8_t saved_client_hello[1];
242}; 293};
243 294
244 295
@@ -248,6 +299,15 @@ static unsigned get24be(const uint8_t *p)
248} 299}
249 300
250#if TLS_DEBUG 301#if TLS_DEBUG
302/* Nondestructively see the current hash value */
303# if TLS_DEBUG_HASH
304static unsigned sha_peek(md5sha_ctx_t *ctx, void *buffer)
305{
306 md5sha_ctx_t ctx_copy = *ctx; /* struct copy */
307 return sha_end(&ctx_copy, buffer);
308}
309# endif
310
251static void dump_hex(const char *fmt, const void *vp, int len) 311static void dump_hex(const char *fmt, const void *vp, int len)
252{ 312{
253 char hexbuf[32 * 1024 + 4]; 313 char hexbuf[32 * 1024 + 4];
@@ -287,7 +347,7 @@ static void dump_tls_record(const void *vp, int len)
287# define dump_tls_record(...) ((void)0) 347# define dump_tls_record(...) ((void)0)
288#endif 348#endif
289 349
290void tls_get_random(void *buf, unsigned len) 350void FAST_FUNC tls_get_random(void *buf, unsigned len)
291{ 351{
292#if !ENABLE_PLATFORM_MINGW32 352#if !ENABLE_PLATFORM_MINGW32
293 if (len != open_read_close("/dev/urandom", buf, len)) 353 if (len != open_read_close("/dev/urandom", buf, len))
@@ -299,16 +359,32 @@ void tls_get_random(void *buf, unsigned len)
299#endif 359#endif
300} 360}
301 361
302/* Nondestructively see the current hash value */ 362static void xorbuf3(void *dst, const void *src1, const void *src2, unsigned count)
303static unsigned sha_peek(md5sha_ctx_t *ctx, void *buffer)
304{ 363{
305 md5sha_ctx_t ctx_copy = *ctx; /* struct copy */ 364 uint8_t *d = dst;
306 return sha_end(&ctx_copy, buffer); 365 const uint8_t *s1 = src1;
366 const uint8_t* s2 = src2;
367 while (count--)
368 *d++ = *s1++ ^ *s2++;
307} 369}
308 370
309static ALWAYS_INLINE unsigned get_handshake_hash(tls_state_t *tls, void *buffer) 371void FAST_FUNC xorbuf(void *dst, const void *src, unsigned count)
310{ 372{
311 return sha_peek(&tls->hsd->handshake_hash_ctx, buffer); 373 xorbuf3(dst, dst, src, count);
374}
375
376void FAST_FUNC xorbuf_aligned_AES_BLOCK_SIZE(void *dst, const void *src)
377{
378 unsigned long *d = dst;
379 const unsigned long *s = src;
380 d[0] ^= s[0];
381#if ULONG_MAX <= 0xffffffffffffffff
382 d[1] ^= s[1];
383 #if ULONG_MAX == 0xffffffff
384 d[2] ^= s[2];
385 d[3] ^= s[3];
386 #endif
387#endif
312} 388}
313 389
314#if !TLS_DEBUG_HASH 390#if !TLS_DEBUG_HASH
@@ -335,7 +411,7 @@ static void hash_handshake(tls_state_t *tls, const char *fmt, const void *buffer
335#endif 411#endif
336} 412}
337 413
338// RFC 2104 414// RFC 2104:
339// HMAC(key, text) based on a hash H (say, sha256) is: 415// HMAC(key, text) based on a hash H (say, sha256) is:
340// ipad = [0x36 x INSIZE] 416// ipad = [0x36 x INSIZE]
341// opad = [0x5c x INSIZE] 417// opad = [0x5c x INSIZE]
@@ -350,35 +426,12 @@ typedef struct hmac_precomputed {
350 md5sha_ctx_t hashed_key_xor_opad; 426 md5sha_ctx_t hashed_key_xor_opad;
351} hmac_precomputed_t; 427} hmac_precomputed_t;
352 428
353static unsigned hmac_sha_precomputed_v(
354 hmac_precomputed_t *pre,
355 uint8_t *out,
356 va_list va)
357{
358 uint8_t *text;
359 unsigned len;
360
361 /* pre->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
362 /* pre->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
363
364 /* calculate out = H((key XOR ipad) + text) */
365 while ((text = va_arg(va, uint8_t*)) != NULL) {
366 unsigned text_size = va_arg(va, unsigned);
367 md5sha_hash(&pre->hashed_key_xor_ipad, text, text_size);
368 }
369 len = sha_end(&pre->hashed_key_xor_ipad, out);
370
371 /* out = H((key XOR opad) + out) */
372 md5sha_hash(&pre->hashed_key_xor_opad, out, len);
373 return sha_end(&pre->hashed_key_xor_opad, out);
374}
375
376typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC; 429typedef void md5sha_begin_func(md5sha_ctx_t *ctx) FAST_FUNC;
377static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size, md5sha_begin_func *begin) 430static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size, md5sha_begin_func *begin)
378{ 431{
379 uint8_t key_xor_ipad[SHA_INSIZE]; 432 uint8_t key_xor_ipad[SHA_INSIZE];
380 uint8_t key_xor_opad[SHA_INSIZE]; 433 uint8_t key_xor_opad[SHA_INSIZE];
381 uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE]; 434// uint8_t tempkey[SHA1_OUTSIZE < SHA256_OUTSIZE ? SHA256_OUTSIZE : SHA1_OUTSIZE];
382 unsigned i; 435 unsigned i;
383 436
384 // "The authentication key can be of any length up to INSIZE, the 437 // "The authentication key can be of any length up to INSIZE, the
@@ -386,10 +439,18 @@ static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size,
386 // than INSIZE bytes will first hash the key using H and then use the 439 // than INSIZE bytes will first hash the key using H and then use the
387 // resultant OUTSIZE byte string as the actual key to HMAC." 440 // resultant OUTSIZE byte string as the actual key to HMAC."
388 if (key_size > SHA_INSIZE) { 441 if (key_size > SHA_INSIZE) {
389 md5sha_ctx_t ctx; 442 bb_error_msg_and_die("HMAC key>64"); //does not happen (yet?)
390 begin(&ctx); 443// md5sha_ctx_t ctx;
391 md5sha_hash(&ctx, key, key_size); 444// begin(&ctx);
392 key_size = sha_end(&ctx, tempkey); 445// md5sha_hash(&ctx, key, key_size);
446// key_size = sha_end(&ctx, tempkey);
447// //key = tempkey; - right? RIGHT? why does it work without this?
448// // because SHA_INSIZE is 64, but hmac() is always called with
449// // key_size = tls->MAC_size = SHA1/256_OUTSIZE (20 or 32),
450// // and prf_hmac_sha256() -> hmac_sha256() key sizes are:
451// // - RSA_PREMASTER_SIZE is 48
452// // - CURVE25519_KEYSIZE is 32
453// // - master_secret[] is 48
393 } 454 }
394 455
395 for (i = 0; i < key_size; i++) { 456 for (i = 0; i < key_size; i++) {
@@ -407,26 +468,43 @@ static void hmac_begin(hmac_precomputed_t *pre, uint8_t *key, unsigned key_size,
407 md5sha_hash(&pre->hashed_key_xor_opad, key_xor_opad, SHA_INSIZE); 468 md5sha_hash(&pre->hashed_key_xor_opad, key_xor_opad, SHA_INSIZE);
408} 469}
409 470
410static unsigned hmac(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...) 471static unsigned hmac_sha_precomputed_v(
472 hmac_precomputed_t *pre,
473 uint8_t *out,
474 va_list va)
475{
476 uint8_t *text;
477 unsigned len;
478
479 /* pre->hashed_key_xor_ipad contains unclosed "H((key XOR ipad) +" state */
480 /* pre->hashed_key_xor_opad contains unclosed "H((key XOR opad) +" state */
481
482 /* calculate out = H((key XOR ipad) + text) */
483 while ((text = va_arg(va, uint8_t*)) != NULL) {
484 unsigned text_size = va_arg(va, unsigned);
485 md5sha_hash(&pre->hashed_key_xor_ipad, text, text_size);
486 }
487 len = sha_end(&pre->hashed_key_xor_ipad, out);
488
489 /* out = H((key XOR opad) + out) */
490 md5sha_hash(&pre->hashed_key_xor_opad, out, len);
491 return sha_end(&pre->hashed_key_xor_opad, out);
492}
493
494static unsigned hmac_sha_precomputed(hmac_precomputed_t *pre_init, uint8_t *out, ...)
411{ 495{
412 hmac_precomputed_t pre; 496 hmac_precomputed_t pre;
413 va_list va; 497 va_list va;
414 unsigned len; 498 unsigned len;
415 499
416 va_start(va, key_size); 500 va_start(va, out);
417 501 pre = *pre_init; /* struct copy */
418 hmac_begin(&pre, key, key_size,
419 (tls->MAC_size == SHA256_OUTSIZE)
420 ? sha256_begin
421 : sha1_begin
422 );
423 len = hmac_sha_precomputed_v(&pre, out, va); 502 len = hmac_sha_precomputed_v(&pre, out, va);
424
425 va_end(va); 503 va_end(va);
426 return len; 504 return len;
427} 505}
428 506
429static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, unsigned key_size, ...) 507static unsigned hmac(tls_state_t *tls, uint8_t *out, uint8_t *key, unsigned key_size, ...)
430{ 508{
431 hmac_precomputed_t pre; 509 hmac_precomputed_t pre;
432 va_list va; 510 va_list va;
@@ -434,7 +512,11 @@ static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, un
434 512
435 va_start(va, key_size); 513 va_start(va, key_size);
436 514
437 hmac_begin(&pre, key, key_size, sha256_begin); 515 hmac_begin(&pre, key, key_size,
516 (tls->MAC_size == SHA256_OUTSIZE)
517 ? sha256_begin
518 : sha1_begin
519 );
438 len = hmac_sha_precomputed_v(&pre, out, va); 520 len = hmac_sha_precomputed_v(&pre, out, va);
439 521
440 va_end(va); 522 va_end(va);
@@ -449,8 +531,9 @@ static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, un
449// document and in TLS documents published prior to this document when 531// document and in TLS documents published prior to this document when
450// TLS 1.2 is negotiated. 532// TLS 1.2 is negotiated.
451// ^^^^^^^^^^^^^ IMPORTANT! 533// ^^^^^^^^^^^^^ IMPORTANT!
452// PRF uses sha256 regardless of cipher (at least for all ciphers 534// PRF uses sha256 regardless of cipher for all ciphers
453// defined by RFC5246). It's not sha1 for AES_128_CBC_SHA! 535// defined by RFC 5246. It's not sha1 for AES_128_CBC_SHA!
536// However, for _SHA384 ciphers, it's sha384. See RFC 5288,5289.
454//... 537//...
455// P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + 538// P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
456// HMAC_hash(secret, A(2) + seed) + 539// HMAC_hash(secret, A(2) + seed) +
@@ -472,12 +555,19 @@ static unsigned hmac_sha256(/*tls_state_t *tls,*/ uint8_t *out, uint8_t *key, un
472// PRF(secret, label, seed) = P_<hash>(secret, label + seed) 555// PRF(secret, label, seed) = P_<hash>(secret, label + seed)
473// 556//
474// The label is an ASCII string. 557// The label is an ASCII string.
558//
559// RFC 5288:
560// For cipher suites ending with _SHA256, the PRF is the TLS PRF
561// with SHA-256 as the hash function.
562// For cipher suites ending with _SHA384, the PRF is the TLS PRF
563// with SHA-384 as the hash function.
475static void prf_hmac_sha256(/*tls_state_t *tls,*/ 564static void prf_hmac_sha256(/*tls_state_t *tls,*/
476 uint8_t *outbuf, unsigned outbuf_size, 565 uint8_t *outbuf, unsigned outbuf_size,
477 uint8_t *secret, unsigned secret_size, 566 uint8_t *secret, unsigned secret_size,
478 const char *label, 567 const char *label,
479 uint8_t *seed, unsigned seed_size) 568 uint8_t *seed, unsigned seed_size)
480{ 569{
570 hmac_precomputed_t pre;
481 uint8_t a[TLS_MAX_MAC_SIZE]; 571 uint8_t a[TLS_MAX_MAC_SIZE];
482 uint8_t *out_p = outbuf; 572 uint8_t *out_p = outbuf;
483 unsigned label_size = strlen(label); 573 unsigned label_size = strlen(label);
@@ -485,28 +575,28 @@ static void prf_hmac_sha256(/*tls_state_t *tls,*/
485 575
486 /* In P_hash() calculation, "seed" is "label + seed": */ 576 /* In P_hash() calculation, "seed" is "label + seed": */
487#define SEED label, label_size, seed, seed_size 577#define SEED label, label_size, seed, seed_size
488#define SECRET secret, secret_size
489#define A a, MAC_size 578#define A a, MAC_size
490 579
580 hmac_begin(&pre, secret, secret_size, sha256_begin);
581
491 /* A(1) = HMAC_hash(secret, seed) */ 582 /* A(1) = HMAC_hash(secret, seed) */
492 hmac_sha256(/*tls,*/ a, SECRET, SEED, NULL); 583 hmac_sha_precomputed(&pre, a, SEED, NULL);
493//TODO: convert hmac to precomputed
494 584
495 for (;;) { 585 for (;;) {
496 /* HMAC_hash(secret, A(1) + seed) */ 586 /* HMAC_hash(secret, A(1) + seed) */
497 if (outbuf_size <= MAC_size) { 587 if (outbuf_size <= MAC_size) {
498 /* Last, possibly incomplete, block */ 588 /* Last, possibly incomplete, block */
499 /* (use a[] as temp buffer) */ 589 /* (use a[] as temp buffer) */
500 hmac_sha256(/*tls,*/ a, SECRET, A, SEED, NULL); 590 hmac_sha_precomputed(&pre, a, A, SEED, NULL);
501 memcpy(out_p, a, outbuf_size); 591 memcpy(out_p, a, outbuf_size);
502 return; 592 return;
503 } 593 }
504 /* Not last block. Store directly to result buffer */ 594 /* Not last block. Store directly to result buffer */
505 hmac_sha256(/*tls,*/ out_p, SECRET, A, SEED, NULL); 595 hmac_sha_precomputed(&pre, out_p, A, SEED, NULL);
506 out_p += MAC_size; 596 out_p += MAC_size;
507 outbuf_size -= MAC_size; 597 outbuf_size -= MAC_size;
508 /* A(2) = HMAC_hash(secret, A(1)) */ 598 /* A(2) = HMAC_hash(secret, A(1)) */
509 hmac_sha256(/*tls,*/ a, SECRET, A, NULL); 599 hmac_sha_precomputed(&pre, a, A, NULL);
510 } 600 }
511#undef A 601#undef A
512#undef SECRET 602#undef SECRET
@@ -566,17 +656,24 @@ static void *tls_get_outbuf(tls_state_t *tls, int len)
566 return tls->outbuf + OUTBUF_PFX; 656 return tls->outbuf + OUTBUF_PFX;
567} 657}
568 658
569static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type) 659static void *tls_get_zeroed_outbuf(tls_state_t *tls, int len)
660{
661 void *record = tls_get_outbuf(tls, len);
662 memset(record, 0, len);
663 return record;
664}
665
666static void xwrite_encrypted_and_hmac_signed(tls_state_t *tls, unsigned size, unsigned type)
570{ 667{
571 uint8_t *buf = tls->outbuf + OUTBUF_PFX; 668 uint8_t *buf = tls->outbuf + OUTBUF_PFX;
572 struct record_hdr *xhdr; 669 struct record_hdr *xhdr;
573 uint8_t padding_length; 670 uint8_t padding_length;
574 671
575 xhdr = (void*)(buf - RECHDR_LEN); 672 xhdr = (void*)(buf - RECHDR_LEN);
576 if (CIPHER_ID1 != TLS_RSA_WITH_NULL_SHA256 /* if "no encryption" can't be selected */ 673 if (!ALLOW_RSA_NULL_SHA256 /* if "no encryption" can't be selected */
577 || tls->cipher_id != TLS_RSA_WITH_NULL_SHA256 /* or if it wasn't selected */ 674 || tls->cipher_id != TLS_RSA_WITH_NULL_SHA256 /* or if it wasn't selected */
578 ) { 675 ) {
579 xhdr = (void*)(buf - RECHDR_LEN - AES_BLOCKSIZE); /* place for IV */ 676 xhdr = (void*)(buf - RECHDR_LEN - AES_BLOCK_SIZE); /* place for IV */
580 } 677 }
581 678
582 xhdr->type = type; 679 xhdr->type = type;
@@ -598,7 +695,7 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
598 695
599 size += tls->MAC_size; 696 size += tls->MAC_size;
600 697
601 // RFC 5246 698 // RFC 5246:
602 // 6.2.3.1. Null or Standard Stream Cipher 699 // 6.2.3.1. Null or Standard Stream Cipher
603 // 700 //
604 // Stream ciphers (including BulkCipherAlgorithm.null; see Appendix A.6) 701 // Stream ciphers (including BulkCipherAlgorithm.null; see Appendix A.6)
@@ -631,7 +728,7 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
631 // -------- ----------- ---------- -------------- 728 // -------- ----------- ---------- --------------
632 // SHA HMAC-SHA1 20 20 729 // SHA HMAC-SHA1 20 20
633 // SHA256 HMAC-SHA256 32 32 730 // SHA256 HMAC-SHA256 32 32
634 if (CIPHER_ID1 == TLS_RSA_WITH_NULL_SHA256 731 if (ALLOW_RSA_NULL_SHA256
635 && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256 732 && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256
636 ) { 733 ) {
637 /* No encryption, only signing */ 734 /* No encryption, only signing */
@@ -679,7 +776,7 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
679 // AES_128_CBC Block 16 16 16 776 // AES_128_CBC Block 16 16 16
680 // AES_256_CBC Block 32 16 16 777 // AES_256_CBC Block 32 16 16
681 778
682 tls_get_random(buf - AES_BLOCKSIZE, AES_BLOCKSIZE); /* IV */ 779 tls_get_random(buf - AES_BLOCK_SIZE, AES_BLOCK_SIZE); /* IV */
683 dbg("before crypt: 5 hdr + %u data + %u hash bytes\n", 780 dbg("before crypt: 5 hdr + %u data + %u hash bytes\n",
684 size - tls->MAC_size, tls->MAC_size); 781 size - tls->MAC_size, tls->MAC_size);
685 782
@@ -699,23 +796,23 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
699 // If you need no bytes to reach BLOCKSIZE, you have to pad a full 796 // If you need no bytes to reach BLOCKSIZE, you have to pad a full
700 // BLOCKSIZE with bytes of value (BLOCKSIZE-1). 797 // BLOCKSIZE with bytes of value (BLOCKSIZE-1).
701 // It's ok to have more than minimum padding, but we do minimum. 798 // It's ok to have more than minimum padding, but we do minimum.
702 padding_length = (~size) & (AES_BLOCKSIZE - 1); 799 padding_length = (~size) & (AES_BLOCK_SIZE - 1);
703 do { 800 do {
704 buf[size++] = padding_length; /* padding */ 801 buf[size++] = padding_length; /* padding */
705 } while ((size & (AES_BLOCKSIZE - 1)) != 0); 802 } while ((size & (AES_BLOCK_SIZE - 1)) != 0);
706 803
707 /* Encrypt content+MAC+padding in place */ 804 /* Encrypt content+MAC+padding in place */
708 aes_cbc_encrypt( 805 aes_cbc_encrypt(
709 tls->client_write_key, tls->key_size, /* selects 128/256 */ 806 &tls->aes_encrypt, /* selects 128/256 */
710 buf - AES_BLOCKSIZE, /* IV */ 807 buf - AES_BLOCK_SIZE, /* IV */
711 buf, size, /* plaintext */ 808 buf, size, /* plaintext */
712 buf /* ciphertext */ 809 buf /* ciphertext */
713 ); 810 );
714 811
715 /* Write out */ 812 /* Write out */
716 dbg("writing 5 + %u IV + %u encrypted bytes, padding_length:0x%02x\n", 813 dbg("writing 5 + %u IV + %u encrypted bytes, padding_length:0x%02x\n",
717 AES_BLOCKSIZE, size, padding_length); 814 AES_BLOCK_SIZE, size, padding_length);
718 size += AES_BLOCKSIZE; /* + IV */ 815 size += AES_BLOCK_SIZE; /* + IV */
719 xhdr->len16_hi = size >> 8; 816 xhdr->len16_hi = size >> 8;
720 xhdr->len16_lo = size & 0xff; 817 xhdr->len16_lo = size & 0xff;
721 dump_raw_out(">> %s\n", xhdr, RECHDR_LEN + size); 818 dump_raw_out(">> %s\n", xhdr, RECHDR_LEN + size);
@@ -723,28 +820,114 @@ static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
723 dbg("wrote %u bytes\n", (int)RECHDR_LEN + size); 820 dbg("wrote %u bytes\n", (int)RECHDR_LEN + size);
724} 821}
725 822
823/* Example how GCM encryption combines nonce, aad, input and generates
824 * "header | exp_nonce | encrypted output | tag":
825 * nonce:0d 6a 26 31 00 00 00 00 00 00 00 01 (implicit 4 bytes (derived from master secret), then explicit 8 bytes)
826 * aad: 00 00 00 00 00 00 00 01 17 03 03 00 1c
827 * in: 47 45 54 20 2f 69 6e 64 65 78 2e 68 74 6d 6c 20 48 54 54 50 2f 31 2e 30 0d 0a 0d 0a "GET /index.html HTTP/1.0\r\n\r\n" (0x1c bytes)
828 * out: f7 8a b2 8f 78 0e f6 d5 76 17 2e b5 6d 46 59 56 8b 46 9f 0b d9 2c 35 28 13 66 19 be
829 * tag: c2 86 ce 4a 50 4a d0 aa 50 b3 76 5c 49 2a 3f 33
830 * sent: 17 03 03 00 34|00 00 00 00 00 00 00 01|f7 8a b2 8f 78 0e f6 d5 76 17 2e b5 6d 46 59 56 8b 46 9f 0b d9 2c 35 28 13 66 19 be|c2 86 ce 4a 50 4a d0 aa 50 b3 76 5c 49 2a 3f 33
831 * .............................................^^ buf points here
832 */
833static void xwrite_encrypted_aesgcm(tls_state_t *tls, unsigned size, unsigned type)
834{
835#define COUNTER(v) (*(uint32_t*)(v + 12))
836
837 uint8_t aad[13 + 3] ALIGNED_long; /* +3 creates [16] buffer, simplifying GHASH() */
838 uint8_t nonce[12 + 4] ALIGNED_long; /* +4 creates space for AES block counter */
839 uint8_t scratch[AES_BLOCK_SIZE] ALIGNED_long; //[16]
840 uint8_t authtag[AES_BLOCK_SIZE] ALIGNED_long; //[16]
841 uint8_t *buf;
842 struct record_hdr *xhdr;
843 unsigned remaining;
844 unsigned cnt;
845 uint64_t t64;
846
847 buf = tls->outbuf + OUTBUF_PFX; /* see above for the byte it points to */
848 dump_hex("xwrite_encrypted_aesgcm plaintext:%s\n", buf, size);
849
850 xhdr = (void*)(buf - 8 - RECHDR_LEN);
851 xhdr->type = type; /* do it here so that "type" param no longer used */
852
853 aad[8] = type;
854 aad[9] = TLS_MAJ;
855 aad[10] = TLS_MIN;
856 aad[11] = size >> 8;
857 /* set aad[12], and clear aad[13..15] */
858 COUNTER(aad) = SWAP_LE32(size & 0xff);
859
860 memcpy(nonce, tls->client_write_IV, 4);
861 t64 = tls->write_seq64_be;
862 move_to_unaligned64(nonce + 4, t64);
863 move_to_unaligned64(aad, t64);
864 move_to_unaligned64(buf - 8, t64);
865 /* seq64 is not used later in this func, can increment here */
866 tls->write_seq64_be = SWAP_BE64(1 + SWAP_BE64(t64));
867
868 cnt = 1;
869 remaining = size;
870 while (remaining != 0) {
871 unsigned n;
872
873 cnt++;
874 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
875 aes_encrypt_one_block(&tls->aes_encrypt, nonce, scratch);
876 n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
877 xorbuf(buf, scratch, n);
878 buf += n;
879 remaining -= n;
880 }
881
882 aesgcm_GHASH(tls->H, aad, /*sizeof(aad),*/ tls->outbuf + OUTBUF_PFX, size, authtag /*, sizeof(authtag)*/);
883 COUNTER(nonce) = htonl(1);
884 aes_encrypt_one_block(&tls->aes_encrypt, nonce, scratch);
885 xorbuf_aligned_AES_BLOCK_SIZE(authtag, scratch);
886
887 memcpy(buf, authtag, sizeof(authtag));
888
889 /* Write out */
890 xhdr = (void*)(tls->outbuf + OUTBUF_PFX - 8 - RECHDR_LEN);
891 size += 8 + sizeof(authtag);
892 /*xhdr->type = type; - already is */
893 xhdr->proto_maj = TLS_MAJ;
894 xhdr->proto_min = TLS_MIN;
895 xhdr->len16_hi = size >> 8;
896 xhdr->len16_lo = size & 0xff;
897 size += RECHDR_LEN;
898 dump_raw_out(">> %s\n", xhdr, size);
899 xwrite(tls->ofd, xhdr, size);
900 dbg("wrote %u bytes\n", size);
901#undef COUNTER
902}
903
904static void xwrite_encrypted(tls_state_t *tls, unsigned size, unsigned type)
905{
906 if (!(tls->flags & ENCRYPTION_AESGCM)) {
907 xwrite_encrypted_and_hmac_signed(tls, size, type);
908 return;
909 }
910 xwrite_encrypted_aesgcm(tls, size, type);
911}
912
726static void xwrite_handshake_record(tls_state_t *tls, unsigned size) 913static void xwrite_handshake_record(tls_state_t *tls, unsigned size)
727{ 914{
728 //if (!tls->encrypt_on_write) { 915 uint8_t *buf = tls->outbuf + OUTBUF_PFX;
729 uint8_t *buf = tls->outbuf + OUTBUF_PFX; 916 struct record_hdr *xhdr = (void*)(buf - RECHDR_LEN);
730 struct record_hdr *xhdr = (void*)(buf - RECHDR_LEN);
731 917
732 xhdr->type = RECORD_TYPE_HANDSHAKE; 918 xhdr->type = RECORD_TYPE_HANDSHAKE;
733 xhdr->proto_maj = TLS_MAJ; 919 xhdr->proto_maj = TLS_MAJ;
734 xhdr->proto_min = TLS_MIN; 920 xhdr->proto_min = TLS_MIN;
735 xhdr->len16_hi = size >> 8; 921 xhdr->len16_hi = size >> 8;
736 xhdr->len16_lo = size & 0xff; 922 xhdr->len16_lo = size & 0xff;
737 dump_raw_out(">> %s\n", xhdr, RECHDR_LEN + size); 923 dump_raw_out(">> %s\n", xhdr, RECHDR_LEN + size);
738 xwrite(tls->ofd, xhdr, RECHDR_LEN + size); 924 xwrite(tls->ofd, xhdr, RECHDR_LEN + size);
739 dbg("wrote %u bytes\n", (int)RECHDR_LEN + size); 925 dbg("wrote %u bytes\n", (int)RECHDR_LEN + size);
740 // return;
741 //}
742 //xwrite_encrypted(tls, size, RECORD_TYPE_HANDSHAKE);
743} 926}
744 927
745static void xwrite_and_update_handshake_hash(tls_state_t *tls, unsigned size) 928static void xwrite_and_update_handshake_hash(tls_state_t *tls, unsigned size)
746{ 929{
747 if (!tls->encrypt_on_write) { 930 if (!(tls->flags & ENCRYPT_ON_WRITE)) {
748 uint8_t *buf; 931 uint8_t *buf;
749 932
750 xwrite_handshake_record(tls, size); 933 xwrite_handshake_record(tls, size);
@@ -783,6 +966,51 @@ static const char *alert_text(int code)
783 return itoa(code); 966 return itoa(code);
784} 967}
785 968
969static void tls_aesgcm_decrypt(tls_state_t *tls, uint8_t *buf, int size)
970{
971#define COUNTER(v) (*(uint32_t*)(v + 12))
972
973 //uint8_t aad[13 + 3] ALIGNED_long; /* +3 creates [16] buffer, simplifying GHASH() */
974 uint8_t nonce[12 + 4] ALIGNED_long; /* +4 creates space for AES block counter */
975 uint8_t scratch[AES_BLOCK_SIZE] ALIGNED_long; //[16]
976 //uint8_t authtag[AES_BLOCK_SIZE] ALIGNED_long; //[16]
977 unsigned remaining;
978 unsigned cnt;
979
980 //memcpy(aad, buf, 8);
981 //aad[8] = type;
982 //aad[9] = TLS_MAJ;
983 //aad[10] = TLS_MIN;
984 //aad[11] = size >> 8;
985 ///* set aad[12], and clear aad[13..15] */
986 //COUNTER(aad) = SWAP_LE32(size & 0xff);
987
988 memcpy(nonce, tls->server_write_IV, 4);
989 memcpy(nonce + 4, buf, 8);
990
991 cnt = 1;
992 remaining = size;
993 while (remaining != 0) {
994 unsigned n;
995
996 cnt++;
997 COUNTER(nonce) = htonl(cnt); /* yes, first cnt here is 2 (!) */
998 aes_encrypt_one_block(&tls->aes_decrypt, nonce, scratch);
999 n = remaining > AES_BLOCK_SIZE ? AES_BLOCK_SIZE : remaining;
1000 xorbuf3(buf, scratch, buf + 8, n);
1001 buf += n;
1002 remaining -= n;
1003 }
1004
1005 //aesgcm_GHASH(tls->H, aad, tls->inbuf + RECHDR_LEN, size, authtag);
1006 //COUNTER(nonce) = htonl(1);
1007 //aes_encrypt_one_block(&tls->aes_encrypt, nonce, scratch);
1008 //xorbuf_aligned_AES_BLOCK_SIZE(authtag, scratch);
1009
1010 //memcmp(buf, authtag, sizeof(authtag)) || DIE("HASH DOES NOT MATCH!");
1011#undef COUNTER
1012}
1013
786static int tls_xread_record(tls_state_t *tls, const char *expected) 1014static int tls_xread_record(tls_state_t *tls, const char *expected)
787{ 1015{
788 struct record_hdr *xhdr; 1016 struct record_hdr *xhdr;
@@ -853,34 +1081,43 @@ static int tls_xread_record(tls_state_t *tls, const char *expected)
853 sz = target - RECHDR_LEN; 1081 sz = target - RECHDR_LEN;
854 1082
855 /* Needs to be decrypted? */ 1083 /* Needs to be decrypted? */
856 if (tls->min_encrypted_len_on_read > tls->MAC_size) { 1084 if (tls->min_encrypted_len_on_read != 0) {
857 uint8_t *p = tls->inbuf + RECHDR_LEN; 1085 if (sz < (int)tls->min_encrypted_len_on_read)
858 int padding_len; 1086 bb_error_msg_and_die("bad encrypted len:%u", sz);
859 1087
860 if (sz & (AES_BLOCKSIZE-1) 1088 if (tls->flags & ENCRYPTION_AESGCM) {
861 || sz < (int)tls->min_encrypted_len_on_read 1089 /* AESGCM */
862 ) { 1090 uint8_t *p = tls->inbuf + RECHDR_LEN;
863 bb_error_msg_and_die("bad encrypted len:%u < %u", 1091
864 sz, tls->min_encrypted_len_on_read); 1092 sz -= 8 + AES_BLOCK_SIZE; /* we will overwrite nonce, drop hash */
1093 tls_aesgcm_decrypt(tls, p, sz);
1094 dbg("encrypted size:%u\n", sz);
1095 } else
1096 if (tls->min_encrypted_len_on_read > tls->MAC_size) {
1097 /* AES+SHA */
1098 uint8_t *p = tls->inbuf + RECHDR_LEN;
1099 int padding_len;
1100
1101 if (sz & (AES_BLOCK_SIZE-1))
1102 bb_error_msg_and_die("bad encrypted len:%u", sz);
1103
1104 /* Decrypt content+MAC+padding, moving it over IV in the process */
1105 sz -= AES_BLOCK_SIZE; /* we will overwrite IV now */
1106 aes_cbc_decrypt(
1107 &tls->aes_decrypt, /* selects 128/256 */
1108 p, /* IV */
1109 p + AES_BLOCK_SIZE, sz, /* ciphertext */
1110 p /* plaintext */
1111 );
1112 padding_len = p[sz - 1];
1113 dbg("encrypted size:%u type:0x%02x padding_length:0x%02x\n", sz, p[0], padding_len);
1114 padding_len++;
1115 sz -= tls->MAC_size + padding_len; /* drop MAC and padding */
1116 } else {
1117 /* if nonzero, then it's TLS_RSA_WITH_NULL_SHA256: drop MAC */
1118 /* else: no encryption yet on input, subtract zero = NOP */
1119 sz -= tls->min_encrypted_len_on_read;
865 } 1120 }
866 /* Decrypt content+MAC+padding, moving it over IV in the process */
867 sz -= AES_BLOCKSIZE; /* we will overwrite IV now */
868 aes_cbc_decrypt(
869 tls->server_write_key, tls->key_size, /* selects 128/256 */
870 p, /* IV */
871 p + AES_BLOCKSIZE, sz, /* ciphertext */
872 p /* plaintext */
873 );
874 padding_len = p[sz - 1];
875 dbg("encrypted size:%u type:0x%02x padding_length:0x%02x\n", sz, p[0], padding_len);
876 padding_len++;
877 sz -= tls->MAC_size + padding_len; /* drop MAC and padding */
878 //if (sz < 0)
879 // bb_error_msg_and_die("bad padding size:%u", padding_len);
880 } else {
881 /* if nonzero, then it's TLS_RSA_WITH_NULL_SHA256: drop MAC */
882 /* else: no encryption yet on input, subtract zero = NOP */
883 sz -= tls->min_encrypted_len_on_read;
884 } 1121 }
885 if (sz < 0) 1122 if (sz < 0)
886 bb_error_msg_and_die("encrypted data too short"); 1123 bb_error_msg_and_die("encrypted data too short");
@@ -921,7 +1158,8 @@ static int tls_xread_record(tls_state_t *tls, const char *expected)
921 * in our FINISHED record must include data of incoming packets too! 1158 * in our FINISHED record must include data of incoming packets too!
922 */ 1159 */
923 if (tls->inbuf[0] == RECORD_TYPE_HANDSHAKE 1160 if (tls->inbuf[0] == RECORD_TYPE_HANDSHAKE
924 && tls->MAC_size != 0 /* do we know which hash to use? (server_hello() does not!) */ 1161/* HANDSHAKE HASH: */
1162 // && do_we_know_which_hash_to_use /* server_hello() might not know it in the future! */
925 ) { 1163 ) {
926 hash_handshake(tls, "<< hash:%s", tls->inbuf + RECHDR_LEN, sz); 1164 hash_handshake(tls, "<< hash:%s", tls->inbuf + RECHDR_LEN, sz);
927 } 1165 }
@@ -930,6 +1168,13 @@ static int tls_xread_record(tls_state_t *tls, const char *expected)
930 return sz; 1168 return sz;
931} 1169}
932 1170
1171static void binary_to_pstm(pstm_int *pstm_n, uint8_t *bin_ptr, unsigned len)
1172{
1173 pstm_init_for_read_unsigned_bin(/*pool:*/ NULL, pstm_n, len);
1174 pstm_read_unsigned_bin(pstm_n, bin_ptr, len);
1175 //return bin_ptr + len;
1176}
1177
933/* 1178/*
934 * DER parsing routines 1179 * DER parsing routines
935 */ 1180 */
@@ -1001,9 +1246,7 @@ static void der_binary_to_pstm(pstm_int *pstm_n, uint8_t *der, uint8_t *end)
1001 unsigned len = get_der_len(&bin_ptr, der, end); 1246 unsigned len = get_der_len(&bin_ptr, der, end);
1002 1247
1003 dbg_der("binary bytes:%u, first:0x%02x\n", len, bin_ptr[0]); 1248 dbg_der("binary bytes:%u, first:0x%02x\n", len, bin_ptr[0]);
1004 pstm_init_for_read_unsigned_bin(/*pool:*/ NULL, pstm_n, len); 1249 binary_to_pstm(pstm_n, bin_ptr, len);
1005 pstm_read_unsigned_bin(pstm_n, bin_ptr, len);
1006 //return bin + len;
1007} 1250}
1008 1251
1009static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len) 1252static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
@@ -1086,10 +1329,20 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
1086 * publicKey (BIT STRING) 1329 * publicKey (BIT STRING)
1087 * 1330 *
1088 * We need Certificate.tbsCertificate.subjectPublicKeyInfo.publicKey 1331 * We need Certificate.tbsCertificate.subjectPublicKeyInfo.publicKey
1332 *
1333 * Example of an ECDSA key:
1334 * SEQ 0x59 bytes (subjectPublicKeyInfo): 3059
1335 * SEQ 0x13 bytes (algorithm): 3013
1336 * OID 7 bytes: 0607 2a8648ce3d0201 (OID_ECDSA_KEY_ALG 42.134.72.206.61.2.1)
1337 * OID 8 bytes: 0608 2a8648ce3d030107 (OID_EC_prime256v1 42.134.72.206.61.3.1.7)
1338 * BITSTRING 0x42 bytes (publicKey): 0342
1339 * 0004 53af f65e 50cc 7959 7e29 0171 c75c
1340 * 7335 e07d f45b 9750 b797 3a38 aebb 2ac6
1341 * 8329 2748 e77e 41cb d482 2ce6 05ec a058
1342 * f3ab d561 2f4c d845 9ad3 7252 e3de bd3b
1343 * 9012
1089 */ 1344 */
1090 uint8_t *end = der + len; 1345 uint8_t *end = der + len;
1091 uint8_t tag_class, pc, tag_number;
1092 int version_present;
1093 1346
1094 /* enter "Certificate" item: [der, end) will be only Cert */ 1347 /* enter "Certificate" item: [der, end) will be only Cert */
1095 der = enter_der_item(der, &end); 1348 der = enter_der_item(der, &end);
@@ -1106,13 +1359,11 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
1106 * (constructed), and a tag number of 0 (see ITU-T X.690 sections 8.1.2 1359 * (constructed), and a tag number of 0 (see ITU-T X.690 sections 8.1.2
1107 * and 8.14). 1360 * and 8.14).
1108 */ 1361 */
1109 tag_class = der[0] >> 6; /* bits 8-7 */ 1362 /* bits 7-6: 10 */
1110 pc = (der[0] & 32) >> 5; /* bit 6 */ 1363 /* bit 5: 1 */
1111 tag_number = der[0] & 31; /* bits 5-1 */ 1364 /* bits 4-0: 00000 */
1112 version_present = tag_class == 2 && pc == 1 && tag_number == 0; 1365 if (der[0] == 0xa0)
1113 if (version_present) {
1114 der = skip_der_item(der, end); /* version */ 1366 der = skip_der_item(der, end); /* version */
1115 }
1116 1367
1117 /* skip up to subjectPublicKeyInfo */ 1368 /* skip up to subjectPublicKeyInfo */
1118 der = skip_der_item(der, end); /* serialNumber */ 1369 der = skip_der_item(der, end); /* serialNumber */
@@ -1124,40 +1375,67 @@ static void find_key_in_der_cert(tls_state_t *tls, uint8_t *der, int len)
1124 /* enter subjectPublicKeyInfo */ 1375 /* enter subjectPublicKeyInfo */
1125 der = enter_der_item(der, &end); 1376 der = enter_der_item(der, &end);
1126 { /* check subjectPublicKeyInfo.algorithm */ 1377 { /* check subjectPublicKeyInfo.algorithm */
1127 static const uint8_t expected[] = { 1378 static const uint8_t OID_RSA_KEY_ALG[] = {
1128 0x30,0x0d, // SEQ 13 bytes 1379 0x30,0x0d, // SEQ 13 bytes
1129 0x06,0x09, 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01, // OID RSA_KEY_ALG 42.134.72.134.247.13.1.1.1 1380 0x06,0x09, 0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01, //OID_RSA_KEY_ALG 42.134.72.134.247.13.1.1.1
1130 //0x05,0x00, // NULL 1381 //0x05,0x00, // NULL
1131 }; 1382 };
1132 if (memcmp(der, expected, sizeof(expected)) != 0) 1383 static const uint8_t OID_ECDSA_KEY_ALG[] = {
1133 bb_error_msg_and_die("not RSA key"); 1384 0x30,0x13, // SEQ 0x13 bytes
1385 0x06,0x07, 0x2a,0x86,0x48,0xce,0x3d,0x02,0x01, //OID_ECDSA_KEY_ALG 42.134.72.206.61.2.1
1386 //allow any curve code for now...
1387 // 0x06,0x08, 0x2a,0x86,0x48,0xce,0x3d,0x03,0x01,0x07, //OID_EC_prime256v1 42.134.72.206.61.3.1.7
1388 //RFC 3279:
1389 //42.134.72.206.61.3 is ellipticCurve
1390 //42.134.72.206.61.3.0 is c-TwoCurve
1391 //42.134.72.206.61.3.1 is primeCurve
1392 //42.134.72.206.61.3.1.7 is curve_secp256r1
1393 };
1394 if (memcmp(der, OID_RSA_KEY_ALG, sizeof(OID_RSA_KEY_ALG)) == 0) {
1395 dbg("RSA key\n");
1396 tls->flags |= GOT_CERT_RSA_KEY_ALG;
1397 } else
1398 if (memcmp(der, OID_ECDSA_KEY_ALG, sizeof(OID_ECDSA_KEY_ALG)) == 0) {
1399 dbg("ECDSA key\n");
1400 //UNUSED: tls->flags |= GOT_CERT_ECDSA_KEY_ALG;
1401 } else
1402 bb_error_msg_and_die("not RSA or ECDSA cert");
1134 } 1403 }
1135 /* skip subjectPublicKeyInfo.algorithm */
1136 der = skip_der_item(der, end);
1137 /* enter subjectPublicKeyInfo.publicKey */
1138// die_if_not_this_der_type(der, end, 0x03); /* must be BITSTRING */
1139 der = enter_der_item(der, &end);
1140 1404
1141 /* parse RSA key: */ 1405 if (tls->flags & GOT_CERT_RSA_KEY_ALG) {
1142//based on getAsnRsaPubKey(), pkcs1ParsePrivBin() is also of note 1406 /* parse RSA key: */
1143 dbg("key bytes:%u, first:0x%02x\n", (int)(end - der), der[0]); 1407 //based on getAsnRsaPubKey(), pkcs1ParsePrivBin() is also of note
1144 if (end - der < 14) xfunc_die(); 1408 /* skip subjectPublicKeyInfo.algorithm */
1145 /* example format: 1409 der = skip_der_item(der, end);
1146 * ignore bits: 00 1410 /* enter subjectPublicKeyInfo.publicKey */
1147 * SEQ 0x018a/394 bytes: 3082018a 1411 //die_if_not_this_der_type(der, end, 0x03); /* must be BITSTRING */
1148 * INTEGER 0x0181/385 bytes (modulus): 02820181 XX...XXX 1412 der = enter_der_item(der, &end);
1149 * INTEGER 3 bytes (exponent): 0203 010001 1413
1414 dbg("key bytes:%u, first:0x%02x\n", (int)(end - der), der[0]);
1415 if (end - der < 14)
1416 xfunc_die();
1417 /* example format:
1418 * ignore bits: 00
1419 * SEQ 0x018a/394 bytes: 3082018a
1420 * INTEGER 0x0181/385 bytes (modulus): 02820181 XX...XXX
1421 * INTEGER 3 bytes (exponent): 0203 010001
1422 */
1423 if (*der != 0) /* "ignore bits", should be 0 */
1424 xfunc_die();
1425 der++;
1426 der = enter_der_item(der, &end); /* enter SEQ */
1427 /* memset(tls->hsd->server_rsa_pub_key, 0, sizeof(tls->hsd->server_rsa_pub_key)); - already is */
1428 der_binary_to_pstm(&tls->hsd->server_rsa_pub_key.N, der, end); /* modulus */
1429 der = skip_der_item(der, end);
1430 der_binary_to_pstm(&tls->hsd->server_rsa_pub_key.e, der, end); /* exponent */
1431 tls->hsd->server_rsa_pub_key.size = pstm_unsigned_bin_size(&tls->hsd->server_rsa_pub_key.N);
1432 dbg("server_rsa_pub_key.size:%d\n", tls->hsd->server_rsa_pub_key.size);
1433 }
1434 /* else: ECDSA key. It is not used for generating encryption keys,
1435 * it is used only to sign the EC public key (which comes in ServerKey message).
1436 * Since we do not verify cert validity, verifying signature on EC public key
1437 * wouldn't add any security. Thus, we do nothing here.
1150 */ 1438 */
1151 if (*der != 0) /* "ignore bits", should be 0 */
1152 xfunc_die();
1153 der++;
1154 der = enter_der_item(der, &end); /* enter SEQ */
1155 /* memset(tls->hsd->server_rsa_pub_key, 0, sizeof(tls->hsd->server_rsa_pub_key)); - already is */
1156 der_binary_to_pstm(&tls->hsd->server_rsa_pub_key.N, der, end); /* modulus */
1157 der = skip_der_item(der, end);
1158 der_binary_to_pstm(&tls->hsd->server_rsa_pub_key.e, der, end); /* exponent */
1159 tls->hsd->server_rsa_pub_key.size = pstm_unsigned_bin_size(&tls->hsd->server_rsa_pub_key.N);
1160 dbg("server_rsa_pub_key.size:%d\n", tls->hsd->server_rsa_pub_key.size);
1161} 1439}
1162 1440
1163/* 1441/*
@@ -1194,6 +1472,56 @@ static ALWAYS_INLINE void fill_handshake_record_hdr(void *buf, unsigned type, un
1194 1472
1195static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni) 1473static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
1196{ 1474{
1475#define NUM_CIPHERS (13 + ALLOW_RSA_NULL_SHA256)
1476 static const uint8_t ciphers[] = {
1477 0x00,(1 + NUM_CIPHERS) * 2, //len16_be
1478 0x00,0xFF, //not a cipher - TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1479 /* ^^^^^^ RFC 5746 Renegotiation Indication Extension - some servers will refuse to work with us otherwise */
1480 0xC0,0x09, // 1 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - ok: wget https://is.gd/
1481 0xC0,0x0A, // 2 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - ok: wget https://is.gd/
1482 0xC0,0x13, // 3 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA
1483 0xC0,0x14, // 4 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES256-SHA (might fail with older openssl)
1484 0xC0,0x23, // 5 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - ok: wget https://is.gd/
1485 // 0xC0,0x24, // TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1486 0xC0,0x27, // 6 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA256
1487 // 0xC0,0x28, // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1488 0xC0,0x2B, // 7 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ok: wget https://is.gd/
1489 // 0xC0,0x2C, // TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - wget https://is.gd/: "TLS error from peer (alert code 20): bad MAC"
1490//TODO: GCM_SHA384 ciphers can be supported, only need sha384-based PRF?
1491 0xC0,0x2F, // 8 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-GCM-SHA256
1492 // 0xC0,0x30, // TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher ECDHE-RSA-AES256-GCM-SHA384: "decryption failed or bad record mac"
1493 //possibly these too:
1494 // 0xC0,0x35, // TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1495 // 0xC0,0x36, // TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1496 // 0xC0,0x37, // TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1497 // 0xC0,0x38, // TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1498 0x00,0x2F, // 9 TLS_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher AES128-SHA
1499 0x00,0x35, //10 TLS_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher AES256-SHA
1500 0x00,0x3C, //11 TLS_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher AES128-SHA256
1501 0x00,0x3D, //12 TLS_RSA_WITH_AES_256_CBC_SHA256 - ok: openssl s_server ... -cipher AES256-SHA256
1502 0x00,0x9C, //13 TLS_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher AES128-GCM-SHA256
1503 // 0x00,0x9D, // TLS_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher AES256-GCM-SHA384: "decryption failed or bad record mac"
1504#if ALLOW_RSA_NULL_SHA256
1505 0x00,0x3B, // TLS_RSA_WITH_NULL_SHA256
1506#endif
1507 0x01,0x00, //not a cipher - comprtypes_len, comprtype
1508 };
1509 static const uint8_t supported_groups[] = {
1510 0x00,0x0a, //extension_type: "supported_groups"
1511 0x00,0x04, //ext len
1512 0x00,0x02, //list len
1513 0x00,0x1d, //curve_x25519 (RFC 7748)
1514 //0x00,0x17, //curve_secp256r1
1515 //0x00,0x18, //curve_secp384r1
1516 //0x00,0x19, //curve_secp521r1
1517 };
1518 //static const uint8_t signature_algorithms[] = {
1519 // 000d
1520 // 0020
1521 // 001e
1522 // 0601 0602 0603 0501 0502 0503 0401 0402 0403 0301 0302 0303 0201 0202 0203
1523 //};
1524
1197 struct client_hello { 1525 struct client_hello {
1198 uint8_t type; 1526 uint8_t type;
1199 uint8_t len24_hi, len24_mid, len24_lo; 1527 uint8_t len24_hi, len24_mid, len24_lo;
@@ -1202,7 +1530,7 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
1202 uint8_t session_id_len; 1530 uint8_t session_id_len;
1203 /* uint8_t session_id[]; */ 1531 /* uint8_t session_id[]; */
1204 uint8_t cipherid_len16_hi, cipherid_len16_lo; 1532 uint8_t cipherid_len16_hi, cipherid_len16_lo;
1205 uint8_t cipherid[2 * (2 + !!CIPHER_ID2)]; /* actually variable */ 1533 uint8_t cipherid[(1 + NUM_CIPHERS) * 2]; /* actually variable */
1206 uint8_t comprtypes_len; 1534 uint8_t comprtypes_len;
1207 uint8_t comprtypes[1]; /* actually variable */ 1535 uint8_t comprtypes[1]; /* actually variable */
1208 /* Extensions (SNI shown): 1536 /* Extensions (SNI shown):
@@ -1227,14 +1555,20 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
1227// 0017 0000 - extended master secret 1555// 0017 0000 - extended master secret
1228 }; 1556 };
1229 struct client_hello *record; 1557 struct client_hello *record;
1558 uint8_t *ptr;
1230 int len; 1559 int len;
1231 int sni_len = sni ? strnlen(sni, 127 - 9) : 0; 1560 int ext_len;
1561 int sni_len = sni ? strnlen(sni, 127 - 5) : 0;
1232 1562
1233 len = sizeof(*record); 1563 ext_len = 0;
1564 /* is.gd responds with "handshake failure" to our hello if there's no supported_groups element */
1565 ext_len += sizeof(supported_groups);
1234 if (sni_len) 1566 if (sni_len)
1235 len += 11 + sni_len; 1567 ext_len += 9 + sni_len;
1236 record = tls_get_outbuf(tls, len); 1568
1237 memset(record, 0, len); 1569 /* +2 is for "len of all extensions" 2-byte field */
1570 len = sizeof(*record) + 2 + ext_len;
1571 record = tls_get_zeroed_outbuf(tls, len);
1238 1572
1239 fill_handshake_record_hdr(record, HANDSHAKE_CLIENT_HELLO, len); 1573 fill_handshake_record_hdr(record, HANDSHAKE_CLIENT_HELLO, len);
1240 record->proto_maj = TLS_MAJ; /* the "requested" version of the protocol, */ 1574 record->proto_maj = TLS_MAJ; /* the "requested" version of the protocol, */
@@ -1244,46 +1578,43 @@ static void send_client_hello_and_alloc_hsd(tls_state_t *tls, const char *sni)
1244 memset(record->rand32, 0x11, sizeof(record->rand32)); 1578 memset(record->rand32, 0x11, sizeof(record->rand32));
1245 /* record->session_id_len = 0; - already is */ 1579 /* record->session_id_len = 0; - already is */
1246 1580
1247 /* record->cipherid_len16_hi = 0; */ 1581 BUILD_BUG_ON(sizeof(ciphers) != 2 + (1 + NUM_CIPHERS) * 2 + 2);
1248 record->cipherid_len16_lo = sizeof(record->cipherid); 1582 memcpy(&record->cipherid_len16_hi, ciphers, sizeof(ciphers));
1249 /* RFC 5746 Renegotiation Indication Extension - some servers will refuse to work with us otherwise */
1250 /*record->cipherid[0] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV >> 8; - zero */
1251 record->cipherid[1] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV & 0xff;
1252 if ((CIPHER_ID1 >> 8) != 0) record->cipherid[2] = CIPHER_ID1 >> 8;
1253 /*************************/ record->cipherid[3] = CIPHER_ID1 & 0xff;
1254#if CIPHER_ID2
1255 if ((CIPHER_ID2 >> 8) != 0) record->cipherid[4] = CIPHER_ID2 >> 8;
1256 /*************************/ record->cipherid[5] = CIPHER_ID2 & 0xff;
1257#endif
1258
1259 record->comprtypes_len = 1;
1260 /* record->comprtypes[0] = 0; */
1261 1583
1584 ptr = (void*)(record + 1);
1585 *ptr++ = ext_len >> 8;
1586 *ptr++ = ext_len;
1262 if (sni_len) { 1587 if (sni_len) {
1263 uint8_t *p = (void*)(record + 1); 1588 //ptr[0] = 0; //
1264 //p[0] = 0; // 1589 //ptr[1] = 0; //extension_type
1265 p[1] = sni_len + 9; //ext_len 1590 //ptr[2] = 0; //
1266 //p[2] = 0; // 1591 ptr[3] = sni_len + 5; //list len
1267 //p[3] = 0; //extension_type 1592 //ptr[4] = 0; //
1268 //p[4] = 0; // 1593 ptr[5] = sni_len + 3; //len of 1st SNI
1269 p[5] = sni_len + 5; //list len 1594 //ptr[6] = 0; //name type
1270 //p[6] = 0; // 1595 //ptr[7] = 0; //
1271 p[7] = sni_len + 3; //len of 1st SNI 1596 ptr[8] = sni_len; //name len
1272 //p[8] = 0; //name type 1597 ptr = mempcpy(&ptr[9], sni, sni_len);
1273 //p[9] = 0; //
1274 p[10] = sni_len; //name len
1275 memcpy(&p[11], sni, sni_len);
1276 } 1598 }
1599 memcpy(ptr, supported_groups, sizeof(supported_groups));
1277 1600
1278 dbg(">> CLIENT_HELLO\n"); 1601 tls->hsd = xzalloc(sizeof(*tls->hsd));
1279 /* Can hash it only when we know which MAC hash to use */ 1602 /* HANDSHAKE HASH: ^^^ + len if need to save saved_client_hello */
1280 /*xwrite_and_update_handshake_hash(tls, len); - WRONG! */ 1603 memcpy(tls->hsd->client_and_server_rand32, record->rand32, sizeof(record->rand32));
1281 xwrite_handshake_record(tls, len); 1604/* HANDSHAKE HASH:
1282
1283 tls->hsd = xzalloc(sizeof(*tls->hsd) + len);
1284 tls->hsd->saved_client_hello_size = len; 1605 tls->hsd->saved_client_hello_size = len;
1285 memcpy(tls->hsd->saved_client_hello, record, len); 1606 memcpy(tls->hsd->saved_client_hello, record, len);
1286 memcpy(tls->hsd->client_and_server_rand32, record->rand32, sizeof(record->rand32)); 1607 */
1608 dbg(">> CLIENT_HELLO\n");
1609 /* Can hash immediately only if we know which MAC hash to use.
1610 * So far we do know: it's sha256:
1611 */
1612 sha256_begin(&tls->hsd->handshake_hash_ctx);
1613 xwrite_and_update_handshake_hash(tls, len);
1614 /* if this would become infeasible: save tls->hsd->saved_client_hello,
1615 * use "xwrite_handshake_record(tls, len)" here,
1616 * and hash saved_client_hello later.
1617 */
1287} 1618}
1288 1619
1289static void get_server_hello(tls_state_t *tls) 1620static void get_server_hello(tls_state_t *tls)
@@ -1303,7 +1634,7 @@ static void get_server_hello(tls_state_t *tls)
1303 1634
1304 struct server_hello *hp; 1635 struct server_hello *hp;
1305 uint8_t *cipherid; 1636 uint8_t *cipherid;
1306 unsigned cipher; 1637 uint8_t cipherid1;
1307 int len, len24; 1638 int len, len24;
1308 1639
1309 len = tls_xread_handshake_block(tls, 74 - 32); 1640 len = tls_xread_handshake_block(tls, 74 - 32);
@@ -1336,33 +1667,87 @@ static void get_server_hello(tls_state_t *tls)
1336 len24 += 32; /* what len would be if session id would be present */ 1667 len24 += 32; /* what len would be if session id would be present */
1337 } 1668 }
1338 1669
1339 if (len24 < 70 1670 if (len24 < 70)
1340// || cipherid[0] != (CIPHER_ID >> 8)
1341// || cipherid[1] != (CIPHER_ID & 0xff)
1342// || cipherid[2] != 0 /* comprtype */
1343 ) {
1344 bad_record_die(tls, "'server hello'", len); 1671 bad_record_die(tls, "'server hello'", len);
1345 }
1346 dbg("<< SERVER_HELLO\n"); 1672 dbg("<< SERVER_HELLO\n");
1347 1673
1348 memcpy(tls->hsd->client_and_server_rand32 + 32, hp->rand32, sizeof(hp->rand32)); 1674 memcpy(tls->hsd->client_and_server_rand32 + 32, hp->rand32, sizeof(hp->rand32));
1349 1675
1350 tls->cipher_id = cipher = 0x100 * cipherid[0] + cipherid[1]; 1676 /* Set up encryption params based on selected cipher */
1351 dbg("server chose cipher %04x\n", cipher); 1677#if 0
1352 1678 0xC0,0x09, // 1 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - ok: wget https://is.gd/
1353 if (cipher == TLS_RSA_WITH_AES_128_CBC_SHA) { 1679 0xC0,0x0A, // 2 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - ok: wget https://is.gd/
1354 tls->key_size = AES128_KEYSIZE; 1680 0xC0,0x13, // 3 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA
1355 tls->MAC_size = SHA1_OUTSIZE; 1681 0xC0,0x14, // 4 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher ECDHE-RSA-AES256-SHA (might fail with older openssl)
1356 } 1682 0xC0,0x23, // 5 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - ok: wget https://is.gd/
1357 else { /* TLS_RSA_WITH_AES_256_CBC_SHA256 */ 1683 // 0xC0,0x24, // TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1358 tls->key_size = AES256_KEYSIZE; 1684 0xC0,0x27, // 6 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-SHA256
1359 tls->MAC_size = SHA256_OUTSIZE; 1685 // 0xC0,0x28, // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1686 0xC0,0x2B, // 7 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ok: wget https://is.gd/
1687 // 0xC0,0x2C, // TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - wget https://is.gd/: "TLS error from peer (alert code 20): bad MAC"
1688 0xC0,0x2F, // 8 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher ECDHE-RSA-AES128-GCM-SHA256
1689 // 0xC0,0x30, // TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher ECDHE-RSA-AES256-GCM-SHA384: "decryption failed or bad record mac"
1690 //possibly these too:
1691 // 0xC0,0x35, // TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
1692 // 0xC0,0x36, // TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
1693 // 0xC0,0x37, // TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
1694 // 0xC0,0x38, // TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 - can't do SHA384 yet
1695 0x00,0x2F, // 9 TLS_RSA_WITH_AES_128_CBC_SHA - ok: openssl s_server ... -cipher AES128-SHA
1696 0x00,0x35, //10 TLS_RSA_WITH_AES_256_CBC_SHA - ok: openssl s_server ... -cipher AES256-SHA
1697 0x00,0x3C, //11 TLS_RSA_WITH_AES_128_CBC_SHA256 - ok: openssl s_server ... -cipher AES128-SHA256
1698 0x00,0x3D, //12 TLS_RSA_WITH_AES_256_CBC_SHA256 - ok: openssl s_server ... -cipher AES256-SHA256
1699 0x00,0x9C, //13 TLS_RSA_WITH_AES_128_GCM_SHA256 - ok: openssl s_server ... -cipher AES128-GCM-SHA256
1700 // 0x00,0x9D, // TLS_RSA_WITH_AES_256_GCM_SHA384 - openssl s_server ... -cipher AES256-GCM-SHA384: "decryption failed or bad record mac"
1701 0x00,0x3B, // TLS_RSA_WITH_NULL_SHA256
1702#endif
1703 cipherid1 = cipherid[1];
1704 tls->cipher_id = 0x100 * cipherid[0] + cipherid1;
1705 tls->key_size = AES256_KEYSIZE;
1706 tls->MAC_size = SHA256_OUTSIZE;
1707 /*tls->IV_size = 0; - already is */
1708 if (cipherid[0] == 0xC0) {
1709 /* All C0xx are ECDHE */
1710 tls->flags |= NEED_EC_KEY;
1711 if (cipherid1 & 1) {
1712 /* Odd numbered C0xx use AES128 (even ones use AES256) */
1713 tls->key_size = AES128_KEYSIZE;
1714 }
1715 if (cipherid1 <= 0x14) {
1716 tls->MAC_size = SHA1_OUTSIZE;
1717 } else
1718 if (cipherid1 >= 0x2B && cipherid1 <= 0x30) {
1719 /* C02B,2C,2F,30 are AES-GCM */
1720 tls->flags |= ENCRYPTION_AESGCM;
1721 tls->MAC_size = 0;
1722 tls->IV_size = 4;
1723 }
1724 } else {
1725 /* All 00xx are RSA */
1726 if (cipherid1 == 0x2F
1727 || cipherid1 == 0x3C
1728 || cipherid1 == 0x9C
1729 ) {
1730 tls->key_size = AES128_KEYSIZE;
1731 }
1732 if (cipherid1 <= 0x35) {
1733 tls->MAC_size = SHA1_OUTSIZE;
1734 } else
1735 if (cipherid1 == 0x9C /*|| cipherid1 == 0x9D*/) {
1736 /* 009C,9D are AES-GCM */
1737 tls->flags |= ENCRYPTION_AESGCM;
1738 tls->MAC_size = 0;
1739 tls->IV_size = 4;
1740 }
1360 } 1741 }
1742 dbg("server chose cipher %04x\n", tls->cipher_id);
1743 dbg("key_size:%u MAC_size:%u IV_size:%u\n", tls->key_size, tls->MAC_size, tls->IV_size);
1744
1361 /* Handshake hash eventually destined to FINISHED record 1745 /* Handshake hash eventually destined to FINISHED record
1362 * is sha256 regardless of cipher 1746 * is sha256 regardless of cipher
1363 * (at least for all ciphers defined by RFC5246). 1747 * (at least for all ciphers defined by RFC5246).
1364 * It's not sha1 for AES_128_CBC_SHA - only MAC is sha1, not this hash. 1748 * It's not sha1 for AES_128_CBC_SHA - only MAC is sha1, not this hash.
1365 */ 1749 */
1750/* HANDSHAKE HASH:
1366 sha256_begin(&tls->hsd->handshake_hash_ctx); 1751 sha256_begin(&tls->hsd->handshake_hash_ctx);
1367 hash_handshake(tls, ">> client hello hash:%s", 1752 hash_handshake(tls, ">> client hello hash:%s",
1368 tls->hsd->saved_client_hello, tls->hsd->saved_client_hello_size 1753 tls->hsd->saved_client_hello, tls->hsd->saved_client_hello_size
@@ -1370,6 +1755,7 @@ static void get_server_hello(tls_state_t *tls)
1370 hash_handshake(tls, "<< server hello hash:%s", 1755 hash_handshake(tls, "<< server hello hash:%s",
1371 tls->inbuf + RECHDR_LEN, len 1756 tls->inbuf + RECHDR_LEN, len
1372 ); 1757 );
1758 */
1373} 1759}
1374 1760
1375static void get_server_cert(tls_state_t *tls) 1761static void get_server_cert(tls_state_t *tls)
@@ -1402,6 +1788,68 @@ static void get_server_cert(tls_state_t *tls)
1402 find_key_in_der_cert(tls, certbuf + 10, len); 1788 find_key_in_der_cert(tls, certbuf + 10, len);
1403} 1789}
1404 1790
1791/* On input, len is known to be >= 4.
1792 * The record is known to be SERVER_KEY_EXCHANGE.
1793 */
1794static void process_server_key(tls_state_t *tls, int len)
1795{
1796 struct record_hdr *xhdr;
1797 uint8_t *keybuf;
1798 int len1;
1799 uint32_t t32;
1800
1801 xhdr = (void*)tls->inbuf;
1802 keybuf = (void*)(xhdr + 1);
1803//seen from is.gd: it selects curve_x25519:
1804// 0c 00006e //SERVER_KEY_EXCHANGE, len
1805// 03 //curve_type: named curve
1806// 001d //curve_x25519
1807//server-chosen EC point, and then signed_params
1808// (RFC 8422: "A hash of the params, with the signature
1809// appropriate to that hash applied. The private key corresponding
1810// to the certified public key in the server's Certificate message is
1811// used for signing.")
1812//follow. Format unclear/guessed:
1813// 20 //eccPubKeyLen
1814// 25511923d73b70dd2f60e66ba2f3fda31a9c25170963c7a3a972e481dbb2835d //eccPubKey (32bytes)
1815// 0203 //hashSigAlg: 2:SHA1 (4:SHA256 5:SHA384 6:SHA512), 3:ECDSA (1:RSA)
1816// 0046 //len (16bit)
1817// 30 44 //SEQ, len
1818// 02 20 //INTEGER, len
1819// 2e18e7c2a9badd0a70cd3059a6ab114539b9f5163568911147386cd77ed7c412 //32bytes
1820//this item ^^^^^ is sometimes 33 bytes (with all container sizes also +1)
1821// 02 20 //INTEGER, len
1822// 64523d6216cb94c43c9b20e377d8c52c55be6703fd6730a155930c705eaf3af6 //32bytes
1823//same about this item ^^^^^
1824
1825//seen from ftp.openbsd.org
1826//(which only accepts ECDHE-RSA-AESnnn-GCM-SHAnnn and ECDHE-RSA-CHACHA20-POLY1305 ciphers):
1827// 0c 000228 //SERVER_KEY_EXCHANGE, len
1828// 03 //curve_type: named curve
1829// 001d //curve_x25519
1830// 20 //eccPubKeyLen
1831// eef7a15c43b71a4c7eaa48a39369399cc4332e569ec90a83274cc92596705c1a //eccPubKey
1832// 0401 //hashSigAlg: 4:SHA256, 1:RSA
1833// 0200 //len
1834// //0x200 bytes follow
1835
1836 /* Get and verify length */
1837 len1 = get24be(keybuf + 1);
1838 if (len1 > len - 4) tls_error_die(tls);
1839 len = len1;
1840 if (len < (1+2+1+32)) tls_error_die(tls);
1841 keybuf += 4;
1842
1843 /* So far we only support curve_x25519 */
1844 move_from_unaligned32(t32, keybuf);
1845 if (t32 != htonl(0x03001d20))
1846 bb_error_msg_and_die("elliptic curve is not x25519");
1847
1848 memcpy(tls->hsd->ecc_pub_key32, keybuf + 4, 32);
1849 tls->flags |= GOT_EC_KEY;
1850 dbg("got eccPubKey\n");
1851}
1852
1405static void send_empty_client_cert(tls_state_t *tls) 1853static void send_empty_client_cert(tls_state_t *tls)
1406{ 1854{
1407 struct client_empty_cert { 1855 struct client_empty_cert {
@@ -1411,12 +1859,14 @@ static void send_empty_client_cert(tls_state_t *tls)
1411 }; 1859 };
1412 struct client_empty_cert *record; 1860 struct client_empty_cert *record;
1413 1861
1414 record = tls_get_outbuf(tls, sizeof(*record)); 1862 record = tls_get_zeroed_outbuf(tls, sizeof(*record));
1415//FIXME: can just memcpy a ready-made one. 1863 //fill_handshake_record_hdr(record, HANDSHAKE_CERTIFICATE, sizeof(*record));
1416 fill_handshake_record_hdr(record, HANDSHAKE_CERTIFICATE, sizeof(*record)); 1864 //record->cert_chain_len24_hi = 0;
1417 record->cert_chain_len24_hi = 0; 1865 //record->cert_chain_len24_mid = 0;
1418 record->cert_chain_len24_mid = 0; 1866 //record->cert_chain_len24_lo = 0;
1419 record->cert_chain_len24_lo = 0; 1867 // same as above:
1868 record->type = HANDSHAKE_CERTIFICATE;
1869 record->len24_lo = 3;
1420 1870
1421 dbg(">> CERTIFICATE\n"); 1871 dbg(">> CERTIFICATE\n");
1422 xwrite_and_update_handshake_hash(tls, sizeof(*record)); 1872 xwrite_and_update_handshake_hash(tls, sizeof(*record));
@@ -1427,36 +1877,72 @@ static void send_client_key_exchange(tls_state_t *tls)
1427 struct client_key_exchange { 1877 struct client_key_exchange {
1428 uint8_t type; 1878 uint8_t type;
1429 uint8_t len24_hi, len24_mid, len24_lo; 1879 uint8_t len24_hi, len24_mid, len24_lo;
1430 /* keylen16 exists for RSA (in TLS, not in SSL), but not for some other key types */ 1880 uint8_t key[2 + 4 * 1024]; // size??
1431 uint8_t keylen16_hi, keylen16_lo;
1432 uint8_t key[4 * 1024]; // size??
1433 }; 1881 };
1434//FIXME: better size estimate 1882//FIXME: better size estimate
1435 struct client_key_exchange *record = tls_get_outbuf(tls, sizeof(*record)); 1883 struct client_key_exchange *record = tls_get_zeroed_outbuf(tls, sizeof(*record));
1436 uint8_t rsa_premaster[RSA_PREMASTER_SIZE]; 1884 uint8_t rsa_premaster[RSA_PREMASTER_SIZE];
1885 uint8_t x25519_premaster[CURVE25519_KEYSIZE];
1886 uint8_t *premaster;
1887 int premaster_size;
1437 int len; 1888 int len;
1438 1889
1439 tls_get_random(rsa_premaster, sizeof(rsa_premaster)); 1890 if (!(tls->flags & NEED_EC_KEY)) {
1440 if (TLS_DEBUG_FIXED_SECRETS) 1891 /* RSA */
1441 memset(rsa_premaster, 0x44, sizeof(rsa_premaster)); 1892 if (!(tls->flags & GOT_CERT_RSA_KEY_ALG))
1442 // RFC 5246 1893 bb_error_msg("server cert is not RSA");
1443 // "Note: The version number in the PreMasterSecret is the version 1894
1444 // offered by the client in the ClientHello.client_version, not the 1895 tls_get_random(rsa_premaster, sizeof(rsa_premaster));
1445 // version negotiated for the connection." 1896 if (TLS_DEBUG_FIXED_SECRETS)
1446 rsa_premaster[0] = TLS_MAJ; 1897 memset(rsa_premaster, 0x44, sizeof(rsa_premaster));
1447 rsa_premaster[1] = TLS_MIN; 1898 // RFC 5246
1448 dump_hex("premaster:%s\n", rsa_premaster, sizeof(rsa_premaster)); 1899 // "Note: The version number in the PreMasterSecret is the version
1449 len = psRsaEncryptPub(/*pool:*/ NULL, 1900 // offered by the client in the ClientHello.client_version, not the
1450 /* psRsaKey_t* */ &tls->hsd->server_rsa_pub_key, 1901 // version negotiated for the connection."
1451 rsa_premaster, /*inlen:*/ sizeof(rsa_premaster), 1902 rsa_premaster[0] = TLS_MAJ;
1452 record->key, sizeof(record->key), 1903 rsa_premaster[1] = TLS_MIN;
1453 data_param_ignored 1904 dump_hex("premaster:%s\n", rsa_premaster, sizeof(rsa_premaster));
1454 ); 1905 len = psRsaEncryptPub(/*pool:*/ NULL,
1455 record->keylen16_hi = len >> 8; 1906 /* psRsaKey_t* */ &tls->hsd->server_rsa_pub_key,
1456 record->keylen16_lo = len & 0xff; 1907 rsa_premaster, /*inlen:*/ sizeof(rsa_premaster),
1457 len += 2; 1908 record->key + 2, sizeof(record->key) - 2,
1909 data_param_ignored
1910 );
1911 /* keylen16 exists for RSA (in TLS, not in SSL), but not for some other key types */
1912 record->key[0] = len >> 8;
1913 record->key[1] = len & 0xff;
1914 len += 2;
1915 premaster = rsa_premaster;
1916 premaster_size = sizeof(rsa_premaster);
1917 } else {
1918 /* ECDHE */
1919 static const uint8_t basepoint9[CURVE25519_KEYSIZE] = {9};
1920 uint8_t privkey[CURVE25519_KEYSIZE]; //[32]
1921
1922 if (!(tls->flags & GOT_EC_KEY))
1923 bb_error_msg("server did not provide EC key");
1924
1925 /* Generate random private key, see RFC 7748 */
1926 tls_get_random(privkey, sizeof(privkey));
1927 privkey[0] &= 0xf8;
1928 privkey[CURVE25519_KEYSIZE-1] = ((privkey[CURVE25519_KEYSIZE-1] & 0x7f) | 0x40);
1929
1930 /* Compute public key */
1931 curve25519(record->key + 1, privkey, basepoint9);
1932
1933 /* Compute premaster using peer's public key */
1934 dbg("computing x25519_premaster\n");
1935 curve25519(x25519_premaster, privkey, tls->hsd->ecc_pub_key32);
1936
1937 len = CURVE25519_KEYSIZE;
1938 record->key[0] = len;
1939 len++;
1940 premaster = x25519_premaster;
1941 premaster_size = sizeof(x25519_premaster);
1942 }
1943
1458 record->type = HANDSHAKE_CLIENT_KEY_EXCHANGE; 1944 record->type = HANDSHAKE_CLIENT_KEY_EXCHANGE;
1459 record->len24_hi = 0; 1945 /* record->len24_hi = 0; - already is */
1460 record->len24_mid = len >> 8; 1946 record->len24_mid = len >> 8;
1461 record->len24_lo = len & 0xff; 1947 record->len24_lo = len & 0xff;
1462 len += 4; 1948 len += 4;
@@ -1476,7 +1962,7 @@ static void send_client_key_exchange(tls_state_t *tls)
1476 // of the premaster secret will vary depending on key exchange method. 1962 // of the premaster secret will vary depending on key exchange method.
1477 prf_hmac_sha256(/*tls,*/ 1963 prf_hmac_sha256(/*tls,*/
1478 tls->hsd->master_secret, sizeof(tls->hsd->master_secret), 1964 tls->hsd->master_secret, sizeof(tls->hsd->master_secret),
1479 rsa_premaster, sizeof(rsa_premaster), 1965 premaster, premaster_size,
1480 "master secret", 1966 "master secret",
1481 tls->hsd->client_and_server_rand32, sizeof(tls->hsd->client_and_server_rand32) 1967 tls->hsd->client_and_server_rand32, sizeof(tls->hsd->client_and_server_rand32)
1482 ); 1968 );
@@ -1523,23 +2009,38 @@ static void send_client_key_exchange(tls_state_t *tls)
1523 memcpy(&tmp64[32], &tls->hsd->client_and_server_rand32[0] , 32); 2009 memcpy(&tmp64[32], &tls->hsd->client_and_server_rand32[0] , 32);
1524 2010
1525 prf_hmac_sha256(/*tls,*/ 2011 prf_hmac_sha256(/*tls,*/
1526 tls->client_write_MAC_key, 2 * (tls->MAC_size + tls->key_size), 2012 tls->client_write_MAC_key, 2 * (tls->MAC_size + tls->key_size + tls->IV_size),
1527 // also fills: 2013 // also fills:
1528 // server_write_MAC_key[] 2014 // server_write_MAC_key[]
1529 // client_write_key[] 2015 // client_write_key[]
1530 // server_write_key[] 2016 // server_write_key[]
2017 // client_write_IV[]
2018 // server_write_IV[]
1531 tls->hsd->master_secret, sizeof(tls->hsd->master_secret), 2019 tls->hsd->master_secret, sizeof(tls->hsd->master_secret),
1532 "key expansion", 2020 "key expansion",
1533 tmp64, 64 2021 tmp64, 64
1534 ); 2022 );
1535 tls->client_write_key = tls->client_write_MAC_key + (2 * tls->MAC_size); 2023 tls->client_write_key = tls->client_write_MAC_key + (2 * tls->MAC_size);
1536 tls->server_write_key = tls->client_write_key + tls->key_size; 2024 tls->server_write_key = tls->client_write_key + tls->key_size;
2025 tls->client_write_IV = tls->server_write_key + tls->key_size;
2026 tls->server_write_IV = tls->client_write_IV + tls->IV_size;
1537 dump_hex("client_write_MAC_key:%s\n", 2027 dump_hex("client_write_MAC_key:%s\n",
1538 tls->client_write_MAC_key, tls->MAC_size 2028 tls->client_write_MAC_key, tls->MAC_size
1539 ); 2029 );
1540 dump_hex("client_write_key:%s\n", 2030 dump_hex("client_write_key:%s\n",
1541 tls->client_write_key, tls->key_size 2031 tls->client_write_key, tls->key_size
1542 ); 2032 );
2033 dump_hex("client_write_IV:%s\n",
2034 tls->client_write_IV, tls->IV_size
2035 );
2036
2037 aes_setkey(&tls->aes_decrypt, tls->server_write_key, tls->key_size);
2038 aes_setkey(&tls->aes_encrypt, tls->client_write_key, tls->key_size);
2039 {
2040 uint8_t iv[AES_BLOCK_SIZE];
2041 memset(iv, 0, AES_BLOCK_SIZE);
2042 aes_encrypt_one_block(&tls->aes_encrypt, iv, tls->H);
2043 }
1543 } 2044 }
1544} 2045}
1545 2046
@@ -1604,7 +2105,8 @@ static void send_client_finished(tls_state_t *tls)
1604 2105
1605 fill_handshake_record_hdr(record, HANDSHAKE_FINISHED, sizeof(*record)); 2106 fill_handshake_record_hdr(record, HANDSHAKE_FINISHED, sizeof(*record));
1606 2107
1607 len = get_handshake_hash(tls, handshake_hash); 2108 len = sha_end(&tls->hsd->handshake_hash_ctx, handshake_hash);
2109
1608 prf_hmac_sha256(/*tls,*/ 2110 prf_hmac_sha256(/*tls,*/
1609 record->prf_result, sizeof(record->prf_result), 2111 record->prf_result, sizeof(record->prf_result),
1610 tls->hsd->master_secret, sizeof(tls->hsd->master_secret), 2112 tls->hsd->master_secret, sizeof(tls->hsd->master_secret),
@@ -1663,8 +2165,19 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
1663 //SvKey len=455^ 2165 //SvKey len=455^
1664 // with TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: 461 bytes: 2166 // with TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: 461 bytes:
1665 // 0c 00|01|c9 03|00|17|41|04|cd|9b|b4|29|1f|f6|b0|c2|84|82|7f|29|6a|47|4e|ec|87|0b|c1|9c|69|e1|f8|c6|d0|53|e9|27|90|a5|c8|02|15|75... 2167 // 0c 00|01|c9 03|00|17|41|04|cd|9b|b4|29|1f|f6|b0|c2|84|82|7f|29|6a|47|4e|ec|87|0b|c1|9c|69|e1|f8|c6|d0|53|e9|27|90|a5|c8|02|15|75...
2168 //
2169 // RFC 8422 5.4. Server Key Exchange
2170 // This message is sent when using the ECDHE_ECDSA, ECDHE_RSA, and
2171 // ECDH_anon key exchange algorithms.
2172 // This message is used to convey the server's ephemeral ECDH public key
2173 // (and the corresponding elliptic curve domain parameters) to the
2174 // client.
1666 dbg("<< SERVER_KEY_EXCHANGE len:%u\n", len); 2175 dbg("<< SERVER_KEY_EXCHANGE len:%u\n", len);
1667//probably need to save it 2176 dump_raw_in("<< %s\n", tls->inbuf, RECHDR_LEN + len);
2177 if (tls->flags & NEED_EC_KEY)
2178 process_server_key(tls, len);
2179
2180 // read next handshake block
1668 len = tls_xread_handshake_block(tls, 4); 2181 len = tls_xread_handshake_block(tls, 4);
1669 } 2182 }
1670 2183
@@ -1698,7 +2211,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
1698 send_change_cipher_spec(tls); 2211 send_change_cipher_spec(tls);
1699 /* from now on we should send encrypted */ 2212 /* from now on we should send encrypted */
1700 /* tls->write_seq64_be = 0; - already is */ 2213 /* tls->write_seq64_be = 0; - already is */
1701 tls->encrypt_on_write = 1; 2214 tls->flags |= ENCRYPT_ON_WRITE;
1702 2215
1703 send_client_finished(tls); 2216 send_client_finished(tls);
1704 2217
@@ -1707,18 +2220,22 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
1707 if (len != 1 || memcmp(tls->inbuf, rec_CHANGE_CIPHER_SPEC, 6) != 0) 2220 if (len != 1 || memcmp(tls->inbuf, rec_CHANGE_CIPHER_SPEC, 6) != 0)
1708 bad_record_die(tls, "switch to encrypted traffic", len); 2221 bad_record_die(tls, "switch to encrypted traffic", len);
1709 dbg("<< CHANGE_CIPHER_SPEC\n"); 2222 dbg("<< CHANGE_CIPHER_SPEC\n");
1710 if (CIPHER_ID1 == TLS_RSA_WITH_NULL_SHA256 2223
2224 if (ALLOW_RSA_NULL_SHA256
1711 && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256 2225 && tls->cipher_id == TLS_RSA_WITH_NULL_SHA256
1712 ) { 2226 ) {
1713 tls->min_encrypted_len_on_read = tls->MAC_size; 2227 tls->min_encrypted_len_on_read = tls->MAC_size;
1714 } else { 2228 } else
1715 unsigned mac_blocks = (unsigned)(tls->MAC_size + AES_BLOCKSIZE-1) / AES_BLOCKSIZE; 2229 if (!(tls->flags & ENCRYPTION_AESGCM)) {
2230 unsigned mac_blocks = (unsigned)(tls->MAC_size + AES_BLOCK_SIZE-1) / AES_BLOCK_SIZE;
1716 /* all incoming packets now should be encrypted and have 2231 /* all incoming packets now should be encrypted and have
1717 * at least IV + (MAC padded to blocksize): 2232 * at least IV + (MAC padded to blocksize):
1718 */ 2233 */
1719 tls->min_encrypted_len_on_read = AES_BLOCKSIZE + (mac_blocks * AES_BLOCKSIZE); 2234 tls->min_encrypted_len_on_read = AES_BLOCK_SIZE + (mac_blocks * AES_BLOCK_SIZE);
1720 dbg("min_encrypted_len_on_read: %u", tls->min_encrypted_len_on_read); 2235 } else {
2236 tls->min_encrypted_len_on_read = 8 + AES_BLOCK_SIZE;
1721 } 2237 }
2238 dbg("min_encrypted_len_on_read: %u\n", tls->min_encrypted_len_on_read);
1722 2239
1723 /* Get (encrypted) FINISHED from the server */ 2240 /* Get (encrypted) FINISHED from the server */
1724 len = tls_xread_record(tls, "'server finished'"); 2241 len = tls_xread_record(tls, "'server finished'");
@@ -1728,6 +2245,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni)
1728 /* application data can be sent/received */ 2245 /* application data can be sent/received */
1729 2246
1730 /* free handshake data */ 2247 /* free handshake data */
2248 psRsaKey_clear(&tls->hsd->server_rsa_pub_key);
1731// if (PARANOIA) 2249// if (PARANOIA)
1732// memset(tls->hsd, 0, tls->hsd->hsd_size); 2250// memset(tls->hsd, 0, tls->hsd->hsd_size);
1733 free(tls->hsd); 2251 free(tls->hsd);
@@ -1742,12 +2260,12 @@ static void tls_xwrite(tls_state_t *tls, int len)
1742 2260
1743// To run a test server using openssl: 2261// To run a test server using openssl:
1744// openssl req -x509 -newkey rsa:$((4096/4*3)) -keyout key.pem -out server.pem -nodes -days 99999 -subj '/CN=localhost' 2262// openssl req -x509 -newkey rsa:$((4096/4*3)) -keyout key.pem -out server.pem -nodes -days 99999 -subj '/CN=localhost'
1745// openssl s_server -key key.pem -cert server.pem -debug -tls1_2 -no_tls1 -no_tls1_1 2263// openssl s_server -key key.pem -cert server.pem -debug -tls1_2
1746// 2264//
1747// Unencryped SHA256 example: 2265// Unencryped SHA256 example:
1748// openssl req -x509 -newkey rsa:$((4096/4*3)) -keyout key.pem -out server.pem -nodes -days 99999 -subj '/CN=localhost' 2266// openssl req -x509 -newkey rsa:$((4096/4*3)) -keyout key.pem -out server.pem -nodes -days 99999 -subj '/CN=localhost'
1749// openssl s_server -key key.pem -cert server.pem -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher NULL 2267// openssl s_server -key key.pem -cert server.pem -debug -tls1_2 -cipher NULL
1750// openssl s_client -connect 127.0.0.1:4433 -debug -tls1_2 -no_tls1 -no_tls1_1 -cipher NULL-SHA256 2268// openssl s_client -connect 127.0.0.1:4433 -debug -tls1_2 -cipher NULL-SHA256
1751 2269
1752void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags) 2270void FAST_FUNC tls_run_copy_loop(tls_state_t *tls, unsigned flags)
1753{ 2271{
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-15 14:10:58 +0000