Use IV length of a crypter instead of block size for IV calculations
[strongswan.git] / src / libtls / tls_crypto.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "tls_crypto.h"
17
18 #include <debug.h>
19
20 ENUM_BEGIN(tls_cipher_suite_names, TLS_NULL_WITH_NULL_NULL,
21 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
22 "TLS_NULL_WITH_NULL_NULL",
23 "TLS_RSA_WITH_NULL_MD5",
24 "TLS_RSA_WITH_NULL_SHA",
25 "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
26 "TLS_RSA_WITH_RC4_128_MD5",
27 "TLS_RSA_WITH_RC4_128_SHA",
28 "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
29 "TLS_RSA_WITH_IDEA_CBC_SHA",
30 "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
31 "TLS_RSA_WITH_DES_CBC_SHA",
32 "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
33 "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA",
34 "TLS_DH_DSS_WITH_DES_CBC_SHA",
35 "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA",
36 "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA",
37 "TLS_DH_RSA_WITH_DES_CBC_SHA",
38 "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA",
39 "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA",
40 "TLS_DHE_DSS_WITH_DES_CBC_SHA",
41 "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA",
42 "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
43 "TLS_DHE_RSA_WITH_DES_CBC_SHA",
44 "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
45 "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5",
46 "TLS_DH_anon_WITH_RC4_128_MD5",
47 "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA",
48 "TLS_DH_anon_WITH_DES_CBC_SHA",
49 "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA");
50 ENUM_NEXT(tls_cipher_suite_names, TLS_KRB5_WITH_DES_CBC_SHA,
51 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
52 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
53 "TLS_KRB5_WITH_DES_CBC_SHA",
54 "TLS_KRB5_WITH_3DES_EDE_CBC_SHA",
55 "TLS_KRB5_WITH_RC4_128_SHA",
56 "TLS_KRB5_WITH_IDEA_CBC_SHA",
57 "TLS_KRB5_WITH_DES_CBC_MD5",
58 "TLS_KRB5_WITH_3DES_EDE_CBC_MD5",
59 "TLS_KRB5_WITH_RC4_128_MD5",
60 "TLS_KRB5_WITH_IDEA_CBC_MD5",
61 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA",
62 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA",
63 "TLS_KRB5_EXPORT_WITH_RC4_40_SHA",
64 "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5",
65 "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5",
66 "TLS_KRB5_EXPORT_WITH_RC4_40_MD5",
67 "TLS_PSK_WITH_NULL_SHA",
68 "TLS_DHE_PSK_WITH_NULL_SHA",
69 "TLS_RSA_PSK_WITH_NULL_SHA",
70 "TLS_RSA_WITH_AES_128_CBC_SHA",
71 "TLS_DH_DSS_WITH_AES_128_CBC_SHA",
72 "TLS_DH_RSA_WITH_AES_128_CBC_SHA",
73 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA",
74 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
75 "TLS_DH_anon_WITH_AES_128_CBC_SHA",
76 "TLS_RSA_WITH_AES_256_CBC_SHA",
77 "TLS_DH_DSS_WITH_AES_256_CBC_SHA",
78 "TLS_DH_RSA_WITH_AES_256_CBC_SHA",
79 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA",
80 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
81 "TLS_DH_anon_WITH_AES_256_CBC_SHA",
82 "TLS_RSA_WITH_NULL_SHA256",
83 "TLS_RSA_WITH_AES_128_CBC_SHA256 ",
84 "TLS_RSA_WITH_AES_256_CBC_SHA256",
85 "TLS_DH_DSS_WITH_AES_128_CBC_SHA256",
86 "TLS_DH_RSA_WITH_AES_128_CBC_SHA256",
87 "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256",
88 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",
89 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA",
90 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA",
91 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA",
92 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",
93 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA");
94 ENUM_NEXT(tls_cipher_suite_names, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
95 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
96 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,
97 "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
98 "TLS_DH_DSS_WITH_AES_256_CBC_SHA256",
99 "TLS_DH_RSA_WITH_AES_256_CBC_SHA256",
100 "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256",
101 "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
102 "TLS_DH_anon_WITH_AES_128_CBC_SHA256",
103 "TLS_DH_anon_WITH_AES_256_CBC_SHA256");
104 ENUM_NEXT(tls_cipher_suite_names, TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
105 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
106 TLS_DH_anon_WITH_AES_256_CBC_SHA256,
107 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",
108 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA",
109 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA",
110 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA",
111 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",
112 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA",
113 "TLS_PSK_WITH_RC4_128_SHA",
114 "TLS_PSK_WITH_3DES_EDE_CBC_SHA2",
115 "TLS_PSK_WITH_AES_128_CBC_SHA",
116 "TLS_PSK_WITH_AES_256_CBC_SHA",
117 "TLS_DHE_PSK_WITH_RC4_128_SHA",
118 "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA",
119 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA",
120 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA2",
121 "TLS_RSA_PSK_WITH_RC4_128_SHA",
122 "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA",
123 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA",
124 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA",
125 "TLS_RSA_WITH_SEED_CBC_SHA",
126 "TLS_DH_DSS_WITH_SEED_CBC_SHA",
127 "TLS_DH_RSA_WITH_SEED_CBC_SHA",
128 "TLS_DHE_DSS_WITH_SEED_CBC_SHA",
129 "TLS_DHE_RSA_WITH_SEED_CBC_SHA",
130 "TLS_DH_anon_WITH_SEED_CBC_SHA",
131 "TLS_RSA_WITH_AES_128_GCM_SHA256",
132 "TLS_RSA_WITH_AES_256_GCM_SHA384",
133 "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
134 "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
135 "TLS_DH_RSA_WITH_AES_128_GCM_SHA256",
136 "TLS_DH_RSA_WITH_AES_256_GCM_SHA384",
137 "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256",
138 "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384",
139 "TLS_DH_DSS_WITH_AES_128_GCM_SHA256",
140 "TLS_DH_DSS_WITH_AES_256_GCM_SHA384",
141 "TLS_DH_anon_WITH_AES_128_GCM_SHA256",
142 "TLS_DH_anon_WITH_AES_256_GCM_SHA384",
143 "TLS_PSK_WITH_AES_128_GCM_SHA256",
144 "TLS_PSK_WITH_AES_256_GCM_SHA384",
145 "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",
146 "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",
147 "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256",
148 "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384",
149 "TLS_PSK_WITH_AES_128_CBC_SHA256",
150 "TLS_PSK_WITH_AES_256_CBC_SHA384",
151 "TLS_PSK_WITH_NULL_SHA256",
152 "TLS_PSK_WITH_NULL_SHA384",
153 "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",
154 "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",
155 "TLS_DHE_PSK_WITH_NULL_SHA256",
156 "TLS_DHE_PSK_WITH_NULL_SHA384",
157 "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256",
158 "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384",
159 "TLS_RSA_PSK_WITH_NULL_SHA256",
160 "TLS_RSA_PSK_WITH_NULL_SHA384",
161 "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",
162 "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256",
163 "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256",
164 "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256",
165 "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",
166 "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256",
167 "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",
168 "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256",
169 "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256",
170 "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256",
171 "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",
172 "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256");
173 ENUM_NEXT(tls_cipher_suite_names, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
174 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
175 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,
176 "TLS_EMPTY_RENEGOTIATION_INFO_SCSV");
177 ENUM_NEXT(tls_cipher_suite_names, TLS_ECDH_ECDSA_WITH_NULL_SHA,
178 TLS_ECDHE_PSK_WITH_NULL_SHA384,
179 TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
180 "TLS_ECDH_ECDSA_WITH_NULL_SHA",
181 "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
182 "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
183 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",
184 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",
185 "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
186 "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
187 "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",
188 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
189 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
190 "TLS_ECDH_RSA_WITH_NULL_SHA",
191 "TLS_ECDH_RSA_WITH_RC4_128_SHA",
192 "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",
193 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",
194 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",
195 "TLS_ECDHE_RSA_WITH_NULL_SHA",
196 "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
197 "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
198 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
199 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
200 "TLS_ECDH_anon_WITH_NULL_SHA",
201 "TLS_ECDH_anon_WITH_RC4_128_SHA",
202 "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA",
203 "TLS_ECDH_anon_WITH_AES_128_CBC_SHA",
204 "TLS_ECDH_anon_WITH_AES_256_CBC_SHA",
205 "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA",
206 "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA",
207 "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA",
208 "TLS_SRP_SHA_WITH_AES_128_CBC_SHA",
209 "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA",
210 "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA",
211 "TLS_SRP_SHA_WITH_AES_256_CBC_SHA",
212 "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA",
213 "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA",
214 "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
215 "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
216 "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",
217 "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",
218 "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
219 "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
220 "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",
221 "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",
222 "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
223 "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
224 "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",
225 "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",
226 "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
227 "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
228 "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",
229 "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",
230 "TLS_ECDHE_PSK_WITH_RC4_128_SHA",
231 "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA",
232 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA",
233 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA",
234 "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",
235 "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384",
236 "TLS_ECDHE_PSK_WITH_NULL_SHA",
237 "TLS_ECDHE_PSK_WITH_NULL_SHA256",
238 "TLS_ECDHE_PSK_WITH_NULL_SHA384");
239 ENUM_END(tls_cipher_suite_names, TLS_ECDHE_PSK_WITH_NULL_SHA384);
240
241 typedef struct private_tls_crypto_t private_tls_crypto_t;
242
243 /**
244 * Private data of an tls_crypto_t object.
245 */
246 struct private_tls_crypto_t {
247
248 /**
249 * Public tls_crypto_t interface.
250 */
251 tls_crypto_t public;
252
253 /**
254 * Protection layer
255 */
256 tls_protection_t *protection;
257
258 /**
259 * List of supported/acceptable cipher suites
260 */
261 tls_cipher_suite_t *suites;
262
263 /**
264 * Number of supported suites
265 */
266 int suite_count;
267
268 /**
269 * Selected cipher suite
270 */
271 tls_cipher_suite_t suite;
272
273 /**
274 * TLS context
275 */
276 tls_t *tls;
277
278 /**
279 * All handshake data concatentated
280 */
281 chunk_t handshake;
282
283 /**
284 * Connection state TLS PRF
285 */
286 tls_prf_t *prf;
287
288 /**
289 * Signer instance for inbound traffic
290 */
291 signer_t *signer_in;
292
293 /**
294 * Signer instance for outbound traffic
295 */
296 signer_t *signer_out;
297
298 /**
299 * Crypter instance for inbound traffic
300 */
301 crypter_t *crypter_in;
302
303 /**
304 * Crypter instance for outbound traffic
305 */
306 crypter_t *crypter_out;
307
308 /**
309 * IV for input decryption, if < TLSv1.2
310 */
311 chunk_t iv_in;
312
313 /**
314 * IV for output decryption, if < TLSv1.2
315 */
316 chunk_t iv_out;
317
318 /**
319 * EAP-[T]TLS MSK
320 */
321 chunk_t msk;
322
323 /**
324 * ASCII string constant used as seed for EAP-[T]TLS MSK PRF
325 */
326 char *msk_label;
327 };
328
329 typedef struct {
330 tls_cipher_suite_t suite;
331 hash_algorithm_t hash;
332 pseudo_random_function_t prf;
333 integrity_algorithm_t mac;
334 encryption_algorithm_t encr;
335 size_t encr_size;
336 } suite_algs_t;
337
338 /**
339 * Mapping suites to a set of algorithms
340 */
341 static suite_algs_t suite_algs[] = {
342 { TLS_RSA_WITH_NULL_MD5,
343 HASH_MD5,
344 PRF_HMAC_MD5,
345 AUTH_HMAC_MD5_128,
346 ENCR_NULL, 0
347 },
348 { TLS_RSA_WITH_NULL_SHA,
349 HASH_SHA1,
350 PRF_HMAC_SHA1,
351 AUTH_HMAC_SHA1_160,
352 ENCR_NULL, 0
353 },
354 { TLS_RSA_WITH_NULL_SHA256,
355 HASH_SHA256,
356 PRF_HMAC_SHA2_256,
357 AUTH_HMAC_SHA2_256_256,
358 ENCR_NULL, 0
359 },
360 { TLS_RSA_WITH_AES_128_CBC_SHA,
361 HASH_SHA1,
362 PRF_HMAC_SHA1,
363 AUTH_HMAC_SHA1_160,
364 ENCR_AES_CBC, 16
365 },
366 { TLS_RSA_WITH_AES_256_CBC_SHA,
367 HASH_SHA1,
368 PRF_HMAC_SHA1,
369 AUTH_HMAC_SHA1_160,
370 ENCR_AES_CBC, 32
371 },
372 { TLS_RSA_WITH_3DES_EDE_CBC_SHA,
373 HASH_SHA1,
374 PRF_HMAC_SHA1,
375 AUTH_HMAC_SHA1_160,
376 ENCR_3DES, 0
377 },
378 { TLS_RSA_WITH_AES_128_CBC_SHA256,
379 HASH_SHA256,
380 PRF_HMAC_SHA2_256,
381 AUTH_HMAC_SHA2_256_256,
382 ENCR_AES_CBC, 16
383 },
384 };
385
386 /**
387 * Look up algoritms by a suite
388 */
389 static suite_algs_t *find_suite(tls_cipher_suite_t suite)
390 {
391 int i;
392
393 for (i = 0; i < countof(suite_algs); i++)
394 {
395 if (suite_algs[i].suite == suite)
396 {
397 return &suite_algs[i];
398 }
399 }
400 return NULL;
401 }
402
403 /**
404 * Initialize the cipher suite list
405 */
406 static void build_cipher_suite_list(private_tls_crypto_t *this)
407 {
408 encryption_algorithm_t encr;
409 integrity_algorithm_t mac;
410 enumerator_t *encrs, *macs;
411 tls_cipher_suite_t supported[64], unique[64];
412 int count = 0, i, j;
413
414 /* we assume that we support RSA, but no DHE yet */
415 macs = lib->crypto->create_signer_enumerator(lib->crypto);
416 while (macs->enumerate(macs, &mac))
417 {
418 switch (mac)
419 {
420 case AUTH_HMAC_SHA1_160:
421 supported[count++] = TLS_RSA_WITH_NULL_SHA;
422 break;
423 case AUTH_HMAC_SHA2_256_256:
424 supported[count++] = TLS_RSA_WITH_NULL_SHA256;
425 break;
426 case AUTH_HMAC_MD5_128:
427 supported[count++] = TLS_RSA_WITH_NULL_MD5;
428 break;
429 default:
430 break;
431 }
432 encrs = lib->crypto->create_crypter_enumerator(lib->crypto);
433 while (encrs->enumerate(encrs, &encr))
434 {
435 switch (encr)
436 {
437 case ENCR_AES_CBC:
438 switch (mac)
439 {
440 case AUTH_HMAC_SHA1_160:
441 supported[count++] = TLS_RSA_WITH_AES_128_CBC_SHA;
442 supported[count++] = TLS_RSA_WITH_AES_256_CBC_SHA;
443 break;
444 case AUTH_HMAC_SHA2_256_256:
445 supported[count++] = TLS_RSA_WITH_AES_128_CBC_SHA256;
446 supported[count++] = TLS_RSA_WITH_AES_256_CBC_SHA256;
447 break;
448 default:
449 break;
450 }
451 break;
452 case ENCR_3DES:
453 switch (mac)
454 {
455 case AUTH_HMAC_SHA1_160:
456 supported[count++] = TLS_RSA_WITH_3DES_EDE_CBC_SHA;
457 break;
458 default:
459 break;
460 }
461 break;
462 default:
463 break;
464 }
465 }
466 encrs->destroy(encrs);
467 }
468 macs->destroy(macs);
469
470 /* remove duplicates */
471 this->suite_count = 0;
472 for (i = 0; i < count; i++)
473 {
474 bool match = FALSE;
475
476 for (j = 0; j < this->suite_count; j++)
477 {
478 if (supported[i] == unique[j])
479 {
480 match = TRUE;
481 break;
482 }
483 }
484 if (!match)
485 {
486 unique[this->suite_count++] = supported[i];
487 }
488 }
489 free(this->suites);
490 this->suites = malloc(sizeof(tls_cipher_suite_t) * this->suite_count);
491 memcpy(this->suites, unique, sizeof(tls_cipher_suite_t) * this->suite_count);
492 }
493
494 METHOD(tls_crypto_t, get_cipher_suites, int,
495 private_tls_crypto_t *this, tls_cipher_suite_t **suites)
496 {
497 *suites = this->suites;
498 return this->suite_count;
499 }
500
501 /**
502 * Create crypto primitives
503 */
504 static bool create_ciphers(private_tls_crypto_t *this, tls_cipher_suite_t suite)
505 {
506 suite_algs_t *algs;
507
508 algs = find_suite(suite);
509 if (!algs)
510 {
511 DBG1(DBG_IKE, "selected TLS suite not supported");
512 return FALSE;
513 }
514
515 DESTROY_IF(this->prf);
516 if (this->tls->get_version(this->tls) < TLS_1_2)
517 {
518 this->prf = tls_prf_create_10();
519 }
520 else
521 {
522 this->prf = tls_prf_create_12(algs->prf);
523 }
524 if (!this->prf)
525 {
526 DBG1(DBG_IKE, "selected TLS PRF not supported");
527 return FALSE;
528 }
529
530 DESTROY_IF(this->signer_in);
531 DESTROY_IF(this->signer_out);
532 this->signer_in = lib->crypto->create_signer(lib->crypto, algs->mac);
533 this->signer_out = lib->crypto->create_signer(lib->crypto, algs->mac);
534 if (!this->signer_in || !this->signer_out)
535 {
536 DBG1(DBG_IKE, "selected TLS MAC %N not supported",
537 integrity_algorithm_names, algs->mac);
538 return FALSE;
539 }
540
541 DESTROY_IF(this->crypter_in);
542 DESTROY_IF(this->crypter_out);
543 if (algs->encr == ENCR_NULL)
544 {
545 this->crypter_in = this->crypter_out = NULL;
546 }
547 else
548 {
549 this->crypter_in = lib->crypto->create_crypter(lib->crypto,
550 algs->encr, algs->encr_size);
551 this->crypter_out = lib->crypto->create_crypter(lib->crypto,
552 algs->encr, algs->encr_size);
553 if (!this->crypter_in || !this->crypter_out)
554 {
555 DBG1(DBG_IKE, "selected TLS crypter %N not supported",
556 encryption_algorithm_names, algs->encr);
557 return FALSE;
558 }
559 }
560 return TRUE;
561 }
562
563 METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
564 private_tls_crypto_t *this, tls_cipher_suite_t *suites, int count)
565 {
566 int i, j;
567
568 for (i = 0; i < this->suite_count; i++)
569 {
570 for (j = 0; j < count; j++)
571 {
572 if (this->suites[i] == suites[j])
573 {
574 if (create_ciphers(this, this->suites[i]))
575 {
576 this->suite = this->suites[i];
577 return this->suite;
578 }
579 }
580 }
581 }
582 return 0;
583 }
584
585 METHOD(tls_crypto_t, set_protection, void,
586 private_tls_crypto_t *this, tls_protection_t *protection)
587 {
588 this->protection = protection;
589 }
590
591 METHOD(tls_crypto_t, append_handshake, void,
592 private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
593 {
594 u_int32_t header;
595
596 /* reconstruct handshake header */
597 header = htonl(data.len | (type << 24));
598 this->handshake = chunk_cat("mcc", this->handshake,
599 chunk_from_thing(header), data);
600 }
601
602 /**
603 * Create a hash of the stored handshake data
604 */
605 static bool hash_handshake(private_tls_crypto_t *this, chunk_t *hash)
606 {
607 if (this->tls->get_version(this->tls) >= TLS_1_2)
608 {
609 hasher_t *hasher;
610 suite_algs_t *alg;
611
612 alg = find_suite(this->suite);
613 if (!alg)
614 {
615 return FALSE;
616 }
617 hasher = lib->crypto->create_hasher(lib->crypto, alg->hash);
618 if (!hasher)
619 {
620 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, alg->hash);
621 return FALSE;
622 }
623 hasher->allocate_hash(hasher, this->handshake, hash);
624 hasher->destroy(hasher);
625 }
626 else
627 {
628 hasher_t *md5, *sha1;
629 char buf[HASH_SIZE_MD5 + HASH_SIZE_SHA1];
630
631 md5 = lib->crypto->create_hasher(lib->crypto, HASH_MD5);
632 if (!md5)
633 {
634 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, HASH_MD5);
635 return FALSE;
636 }
637 md5->get_hash(md5, this->handshake, buf);
638 md5->destroy(md5);
639 sha1 = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
640 if (!sha1)
641 {
642 DBG1(DBG_IKE, "%N not supported", hash_algorithm_names, HASH_SHA1);
643 return FALSE;
644 }
645 sha1->get_hash(sha1, this->handshake, buf + HASH_SIZE_MD5);
646 sha1->destroy(sha1);
647
648 *hash = chunk_clone(chunk_from_thing(buf));
649 }
650 return TRUE;
651 }
652
653 METHOD(tls_crypto_t, sign_handshake, bool,
654 private_tls_crypto_t *this, private_key_t *key, tls_writer_t *writer)
655 {
656 chunk_t sig, hash;
657
658 if (this->tls->get_version(this->tls) >= TLS_1_2)
659 {
660 /* TODO: use supported algorithms instead of fixed SHA1/RSA */
661 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, &sig))
662 {
663 return FALSE;
664 }
665 writer->write_uint8(writer, 2);
666 writer->write_uint8(writer, 1);
667 writer->write_data16(writer, sig);
668 free(sig.ptr);
669 }
670 else
671 {
672 if (!hash_handshake(this, &hash))
673 {
674 return FALSE;
675 }
676 if (!key->sign(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, &sig))
677 {
678 free(hash.ptr);
679 return FALSE;
680 }
681 writer->write_data16(writer, sig);
682 free(hash.ptr);
683 free(sig.ptr);
684 }
685 return TRUE;
686 }
687
688 METHOD(tls_crypto_t, verify_handshake, bool,
689 private_tls_crypto_t *this, public_key_t *key, tls_reader_t *reader)
690 {
691 if (this->tls->get_version(this->tls) >= TLS_1_2)
692 {
693 u_int8_t hash, alg;
694 chunk_t sig;
695
696 if (!reader->read_uint8(reader, &hash) ||
697 !reader->read_uint8(reader, &alg) ||
698 !reader->read_data16(reader, &sig))
699 {
700 DBG1(DBG_IKE, "received invalid Certificate Verify");
701 return FALSE;
702 }
703 /* TODO: map received hash/sig alg to signature scheme */
704 if (hash != 2 || alg != 1 ||
705 !key->verify(key, SIGN_RSA_EMSA_PKCS1_SHA1, this->handshake, sig))
706 {
707 return FALSE;
708 }
709 }
710 else
711 {
712 chunk_t sig, hash;
713
714 if (!reader->read_data16(reader, &sig))
715 {
716 DBG1(DBG_IKE, "received invalid Certificate Verify");
717 return FALSE;
718 }
719 if (!hash_handshake(this, &hash))
720 {
721 return FALSE;
722 }
723 if (!key->verify(key, SIGN_RSA_EMSA_PKCS1_NULL, hash, sig))
724 {
725 free(hash.ptr);
726 return FALSE;
727 }
728 free(hash.ptr);
729 }
730 return TRUE;
731 }
732
733 METHOD(tls_crypto_t, calculate_finished, bool,
734 private_tls_crypto_t *this, char *label, char out[12])
735 {
736 chunk_t seed;
737
738 if (!this->prf)
739 {
740 return FALSE;
741 }
742 if (!hash_handshake(this, &seed))
743 {
744 return FALSE;
745 }
746 this->prf->get_bytes(this->prf, label, seed, 12, out);
747 free(seed.ptr);
748 return TRUE;
749 }
750
751 METHOD(tls_crypto_t, derive_secrets, void,
752 private_tls_crypto_t *this, chunk_t premaster,
753 chunk_t client_random, chunk_t server_random)
754 {
755 char master[48];
756 chunk_t seed, block, client_write, server_write;
757 int mks, eks = 0, ivs = 0;
758
759 /* derive master secret */
760 seed = chunk_cata("cc", client_random, server_random);
761 this->prf->set_key(this->prf, premaster);
762 this->prf->get_bytes(this->prf, "master secret", seed,
763 sizeof(master), master);
764
765 this->prf->set_key(this->prf, chunk_from_thing(master));
766 memset(master, 0, sizeof(master));
767
768 /* derive key block for key expansion */
769 mks = this->signer_out->get_key_size(this->signer_out);
770 if (this->crypter_out)
771 {
772 eks = this->crypter_out->get_key_size(this->crypter_out);
773 if (this->tls->get_version(this->tls) < TLS_1_1)
774 {
775 ivs = this->crypter_out->get_iv_size(this->crypter_out);
776 }
777 }
778 seed = chunk_cata("cc", server_random, client_random);
779 block = chunk_alloca((mks + eks + ivs) * 2);
780 this->prf->get_bytes(this->prf, "key expansion", seed, block.len, block.ptr);
781
782 /* signer keys */
783 client_write = chunk_create(block.ptr, mks);
784 block = chunk_skip(block, mks);
785 server_write = chunk_create(block.ptr, mks);
786 block = chunk_skip(block, mks);
787 if (this->tls->is_server(this->tls))
788 {
789 this->signer_in->set_key(this->signer_in, client_write);
790 this->signer_out->set_key(this->signer_out, server_write);
791 }
792 else
793 {
794 this->signer_out->set_key(this->signer_out, client_write);
795 this->signer_in->set_key(this->signer_in, server_write);
796 }
797
798 /* crypter keys, and IVs if < TLSv1.2 */
799 if (this->crypter_out && this->crypter_in)
800 {
801 client_write = chunk_create(block.ptr, eks);
802 block = chunk_skip(block, eks);
803 server_write = chunk_create(block.ptr, eks);
804 block = chunk_skip(block, eks);
805
806 if (this->tls->is_server(this->tls))
807 {
808 this->crypter_in->set_key(this->crypter_in, client_write);
809 this->crypter_out->set_key(this->crypter_out, server_write);
810 }
811 else
812 {
813 this->crypter_out->set_key(this->crypter_out, client_write);
814 this->crypter_in->set_key(this->crypter_in, server_write);
815 }
816 if (ivs)
817 {
818 client_write = chunk_create(block.ptr, ivs);
819 block = chunk_skip(block, ivs);
820 server_write = chunk_create(block.ptr, ivs);
821 block = chunk_skip(block, ivs);
822
823 if (this->tls->is_server(this->tls))
824 {
825 this->iv_in = chunk_clone(client_write);
826 this->iv_out = chunk_clone(server_write);
827 }
828 else
829 {
830 this->iv_out = chunk_clone(client_write);
831 this->iv_in = chunk_clone(server_write);
832 }
833 }
834 }
835 }
836
837 METHOD(tls_crypto_t, change_cipher, void,
838 private_tls_crypto_t *this, bool inbound)
839 {
840 if (this->protection)
841 {
842 if (inbound)
843 {
844 this->protection->set_cipher(this->protection, TRUE,
845 this->signer_in, this->crypter_in, this->iv_in);
846 }
847 else
848 {
849 this->protection->set_cipher(this->protection, FALSE,
850 this->signer_out, this->crypter_out, this->iv_out);
851 }
852 }
853 }
854
855 METHOD(tls_crypto_t, derive_eap_msk, void,
856 private_tls_crypto_t *this, chunk_t client_random, chunk_t server_random)
857 {
858 chunk_t seed;
859
860 seed = chunk_cata("cc", client_random, server_random);
861 free(this->msk.ptr);
862 this->msk = chunk_alloc(64);
863 this->prf->get_bytes(this->prf, this->msk_label, seed,
864 this->msk.len, this->msk.ptr);
865 }
866
867 METHOD(tls_crypto_t, get_eap_msk, chunk_t,
868 private_tls_crypto_t *this)
869 {
870 return this->msk;
871 }
872
873 METHOD(tls_crypto_t, destroy, void,
874 private_tls_crypto_t *this)
875 {
876 DESTROY_IF(this->signer_in);
877 DESTROY_IF(this->signer_out);
878 DESTROY_IF(this->crypter_in);
879 DESTROY_IF(this->crypter_out);
880 free(this->iv_in.ptr);
881 free(this->iv_out.ptr);
882 free(this->handshake.ptr);
883 free(this->msk.ptr);
884 DESTROY_IF(this->prf);
885 free(this->suites);
886 free(this);
887 }
888
889 /**
890 * See header
891 */
892 tls_crypto_t *tls_crypto_create(tls_t *tls, char *msk_label)
893 {
894 private_tls_crypto_t *this;
895
896 INIT(this,
897 .public = {
898 .get_cipher_suites = _get_cipher_suites,
899 .select_cipher_suite = _select_cipher_suite,
900 .set_protection = _set_protection,
901 .append_handshake = _append_handshake,
902 .sign_handshake = _sign_handshake,
903 .verify_handshake = _verify_handshake,
904 .calculate_finished = _calculate_finished,
905 .derive_secrets = _derive_secrets,
906 .change_cipher = _change_cipher,
907 .derive_eap_msk = _derive_eap_msk,
908 .get_eap_msk = _get_eap_msk,
909 .destroy = _destroy,
910 },
911 .tls = tls,
912 .msk_label = msk_label
913 );
914
915 build_cipher_suite_list(this);
916
917 return &this->public;
918 }